BSOD randomly with new computer - Last error code 3b

[sheisel]

I have disabled scheduled backups and will just do manually as needed. Found this on the Genie Backup Support Site.

GBM Causes Blue Screen of Death (BSOD) when running Backup

SYMPTOMS

When you run a backup Job and when “Preparing open files” stage occurs, you encounter Blue Screen of Death or automatic system reboot. This can also happen when running Disaster Recovery job or create a Disaster Recovery bootable disk.

CAUSE:

This problem is caused after cloning or creating an image restore to a hard drive using "Acronis True Image" which is used by Seagate/Maxtor and many other companies. The problem is that Acronis writes an incorrect signature to the hard drive's MBR causing windows to throw a BSOD when doing a Volume Shadow Copy. GBM uses Volume Shadow Copy to capture open files.

RESOLUTION

To write a new signature to a drive's MBR, you need "MBRFix" which can be downloaded here
Reboot your PC and start in "Windows Safe Mode with Command Prompt" or the Command Prompt in Windows.
Browse to the folder where you downloaded MBRFix to.
MBRFix requires a drive number. Usually your boot drive is drive 0. To make sure this is indeed the boot drive, at the command prompt, type:
MBRFix /drive 0 listpartitions
Examine the results to make sure that the drive has the boot partition and is the size you expect.
Just to be safe, create a copy of the current MBR by typing:
MBRFix /drive 0 savembr ORIGINAL_MBR.bin
Now create and save a new signature in the MBR by typing:
MBRFix /drive 0 generatesignature
Reboot your computer.
XP will detect and install a new "device" and prompts you to reboot your computer again. Reboot as requested.

OR

Go to windows Device Manage
Click "view" and select "show hidden devices"
Scroll down to "storage volumes"
Click on the plus to expand.
Click on each one listed and right click and uninstall. (you will get a message on some staying to reboot before it takes effect. Select no until you do them all.)
Reboot.
Wait till windows automatically reinstalls devices. Will prompt to reboot again.
Reboot.

 

[Boozad]

OK, let us know how the manual backups go. I've a feeling that it will solve the issue.

 

[sheisel]

I was out all week so did not use my computer, but it was on without backups. Used it a bit this morning and had a BSOD when I left for a minute so don't know exactly what was running except MS Security Essentials, Chrome and MS Word. Attached is the zip file from the dump. As I noted, Genie Backup were not running.

 

[Boozad]

This one seems to be blaming MS Anti Malware, it may well be a false positive. You don't happen to have MBAM running realtime protection do you?

fffff880`09243f48  fffff880`01176008
[COLOR=Red]*** WARNING: Unable to verify timestamp for MpFilter.sys
*** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys[/COLOR]
 MpFilter+0xc008

 

[sheisel]

Yes, I just checked. MS Security Essentials was running real-time protection. Had run a scan on another computer earlier (from this computer, but that was done. I have disabled the real-time protection now.

Seems like everything causes problems. I am beginning to go back to memory issues. This is a new computer that came with 4 MB RAM and I added an identical 4 MB RAM module. Can not do it today, but next week should I removed the added memory? I know you had me test it earlier.

Thanks

 

[Boozad]

Mismatched memory modules can cause issues even if there's no fault with them if the timings or voltages don't correlate. Download Speccy linked in my sig, run it and expand the RAM tab on the left, then expand Slot #1 and Slot #2 to show the timings and voltages. Post a screenshot of what it shows.

View attachment 367688​

 

[sheisel]

Had another shut down over the weekend. Attached is the zip with the new dmp file. Also ran the Speccy and attached the image of the screen shot.

 

[Boozad]

This dump is a 0xD1 which indicates a driver, but none are showing in the dump. What is showing is the Volume ShadowCopy service, whether that was definitely the issue or not I can't say, but it may be worth disabling it temproarily to rule it out.

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff8800131868c, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: fffff8800131868c, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c1100
GetUlongFromAddress: unable to read from fffff800032c11c0
 fffff8800131868c Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
Ntfs! ?? ::NNGAKEGL::`string'+6f60
fffff880`0131868c 55              push    rbp

IP_IN_PAGED_CODE: 
Ntfs! ?? ::NNGAKEGL::`string'+6f60
fffff880`0131868c 55              push    rbp

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME: [COLOR=Red] VSSVC.exe[/COLOR]

If the crashes persist we may have to look at enabling Driver Verifier.

 

[sheisel]

I started Driver Verifier and it ran for a couple of days without a problem, but sometime over the weekend windows shut down. Attached is the zip file.

I set the Volume ShadowCopy service to manual, but was not sure how to disable it.

 

[sheisel]

Reposting


I started Driver Verifier and it ran for a couple of days without a problem, but sometime over the weekend windows shut down. Attached is the zip file.

I set the Volume ShadowCopy service to manual, but was not sure how to disable it.

 

[Boozad]

Unfortunately the last logs are completely empty, can your run the Log Collector again and post up the resulting logs.

 

[sheisel]

Sorry about that Boozad.

I tried to generate the logs again two more times which took forever and both times they came up empty. Turned off driver verifier and the log generated as usual. Apparently verifier blocks the log collector somehow. Verifier has been running for a week without an incident so hopefully I can leave it off. I also had real time protection turned off in security essentials for that week too, but have that on again as of yesterday. Windows update took over 8 hours when verifier was running which was very annoying.

Anyway attached is the log.

Sorry again. I should have looked at the log before posting.

 

[sheisel]

I had another BSOD incident over the weekend. Posting the new log collector data. Thanks for your help.

 

[Boozad]

The last dump is partially corrupt and I can't dump the stack unfortunately, however this does show which may be relevant.

[B][COLOR=Red]OVERLAPPED_MODULE: Address regions for 'hiber_dumpfve' and 'WUDFRd.sys' overlap[/COLOR][/B]

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003319100
GetUlongFromAddress: unable to read from fffff800033191c0
 0000000004000000 Nonpaged pool

CURRENT_IRQL:  0

FAULTING_IP: 
nt!KiProcessExpiredTimerList+72
fffff800`030e7262 803818          cmp     byte ptr [rax],18h

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

Are you using hibernation at all?

 

[sheisel]

My power settings are set to sleep after three hours and hybernate is set to never. Allow to hybrid sleep is set to on. Does this answer your question?

 

[Boozad]

It may be an idea to disable sleep while we're trying to work through this. It's a tough one and it would be best to eliminate any possible causes, no matter how remote they may seem.

 

[sheisel]

OK. I've disabled sleeping.

 

[Boozad]

Good, upload new logs from any subsequent BSODs.

 

[sheisel]

Boozad,

All was working fine for sometime. Probably 10 days or so. I then changed the sleep settings for the system to sleep after 15 minutes (see screenshot jpg). Kind of to see if this was the issue. The system worked OK like this for about a week and then had a BSOD when going to sleep today.

Thanks for all your help.

Scott

 

[sheisel]

Had another BSOD so I have now gone back to not allowing the computer to go to sleep. Also attaching new log file.