BSOD randomly and every time the PC is shutting down.

[pablorindt]

Hi guys,

I'm having random BSODs and really don't know what to do about it. It started a long time ago, all random and without any clue. I have upgraded my motherboard, cpu and RAM. The harddisk was fairly new. The graphics card is changed also and these BSODs still occur. Is it the power, or the graphics card?

The weird thing is that it's now crashing everytime I shut it down.

Thanks for the help!

 

[Arc]

Welcome aboard.

It is crashed by Kaspersky.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800399a0d8, fffff88003999930, 0}

*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys
[COLOR=Red]Probably caused by : klif.sys [/COLOR]( klif+4f525 )

Followup: MachineOwner
---------

Uninstall Kaspersky.
Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.

Download and install those, and then run full system scans with both of them, one by one.

Scan the system for possible virus infection.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Also perform some disc checks.

1. Reseat the sata and power.
2. Run chkdsk /f/r, following the option two of the tutorial Disk Check
3. Seatool for dos: SeaTools | Seagate download
   Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

Let us know the results.

 

[pablorindt]

Hey Arc,

Thanks for the fast reply, that's amazing! I've done every step (chkdsk took long pfew). No malware has been found, also no rootkits. I've deinstalled kaspersky and installed MSE as you said.

Checkdisk didn't found any errors. I will report back if I got another BSOD. Thanks again!

 

[pablorindt]

So, it was running fine the whole week until five minutes ago. It crashed again... Below is a full log!

Hope someone can help me

 

[Arc]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d89968e706, b3b7465eebe5b65c, fffff80002e31c1c, 1}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d89968e706, Reserved
Arg2: b3b7465eebe5b65c, Reserved
Arg3: fffff80002e31c1c, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
    0 : A generic data region
    1 : Modification of a function or .pdata
    2 : A processor IDT
    3 : A processor GDT
    4 : Type 1 process list corruption
    5 : Type 2 process list corruption
    6 : Debug routine modification
    7 : Critical MSR modification

Debugging Details:
------------------


FAULTING_IP: 
nt!WPP_SF_qLLLL+0
fffff800`02e31c1c 4c8bdc          mov     r11,rsp

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x109

PROCESS_NAME:  System

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`033cb498 00000000`00000000 : 00000000`00000109 a3a039d8`9968e706 b3b7465e`ebe5b65c fffff800`02e31c1c : nt!KeBugCheckEx


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff80002e31c8d - nt!WPP_SF_qLLLL+71
    [ 1f:1b ]
1 error : !nt (fffff80002e31c8d)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight, per RAM module per slot.

 

[pablorindt]

Ran the memtest the whole night for 16+ hours. Nothing found, it has done around 14 passes. So looks like my memory is oke...

 

[Arc]

In such a situation, it is better to enable Driver Verifier to monitor the drivers.

Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[pablorindt]

Hey Arc,

Thanks again for the great help and fast reply's. I've been running the verifier tool on the background (at least I guess, no where to see if it actually runs, but I changed the settings and rebooted). Nothing found yet, no crashes whatsoever.

What's next? Keep it running untill a crash occurs?

 

[Arc]

Memtost found nothing, no virus found, DV found nothing, all good.

Disable verifier now. Use the computer normally. If it crashes again, let us know.

 

[pablorindt]

He Arc,

So it just crashed again. I rebooted and made a new dump so I hope something is in it this time!

Thank you!

 

[Arc]

A bit new, but strange. This stopcode is applicable for checked versions usually, not for free version.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

[COLOR=Red]BugCheck 1[/COLOR], {7fefe5d108a, 0, ffff0000, fffff880068e7b60}

Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )

Followup: MachineOwner
---------

And, no more information.

I think, you should go for a clean install.

 

[pablorindt]

I don't really get what you mean with the checked and free version stuff. PFf a full reinstall will be a lot of work reinstalling every single plugin and app I use (for music production). Thanks again for your help!