BSOD says Device Driver Attempting to Corrupt the system

[bearcat22]

Thank you for taking a look. Running Win 7 64, using HP p6710f desktop.

Was getting BSOD with various errors. Replaced the RAM with new, and for a few
days it was better. BSOD began again.

Took the computer to professionals at MicroCenter, and they stated it was corrupt RAM
even though I told them it was brand new. They sold me replacement RAM. After I installed
it, all programs ran incredibly slowly.

I found that I could not launch Malwarebytes, and none of my browsers would launch, making me
suspect a virus.
I am currently doing everything in Safe Mode.
Hopefully I can figure out how to attach the Minidump files and other things needed
to analyze.

Currently it will only boot to BSOD saying "A problem has been detected. A device driver
attempting to corrupt the system has been caught. The faulty driver currently on the kernel stack must be replaced with a working version."

Unfortunately, I don't know how to identify or how to replace a faulty driver.

your help is greatly appreciated, I've been struggling with this for a whole week!

 

[axe0]

Hi bearcat22,

It looks like the crashes are caused by a driver from Avg Secure Search.
Have you had Avg installed in the past?

 

[bearcat22]

Hi bearcat22,

It looks like the crashes are caused by a driver from Avg Secure Search.
Have you had Avg installed in the past?

Thank God! Thank you for helping! Yes, I have long long ago used AVG.
Can you please tell me the name of the driver and how to remove it?

I notice that something called MsMpEng.exe uses up a huge amount
of RAM. When I was able to get Malwarebytes running a few days ago,
it also showed it was using a ridiculous amount of RAM.

I am currently in Safe Mode and am running Trend Micro free online
virus scan.

I've run Windows Update in Normal mode, and as far as I can tell,
it shows nothing about needing to replace any driver. So, I don't understand
the BSOD.

Update: Trend Micro results say that nothing was found.

 

[billmcct]

Try the AVG Removal tool.
Install AVG on your PC, Mac | AVG installation files

 

[bearcat22]

Try the AVG Removal tool.
Install AVG on your PC, Mac | AVG installation files

Thanks. Could you please be more specific? There appear to be several tools.

I ran "AVG Clear" and it is hung up on "Deleting file C:\defs\fffff\engsup.exe"

That is not the correct name. I'm an old man with bad eyes, and it is physically
impossible for me to tell how many "ffff" there are in that name.

There is something else, called "Universal AVG Removal Tool" Running that just gives
a rotating hourglass that never ends. How many hours should I run this before I know that
it is not working?

Update: These finished running, and I ran them both again.
As far as I can tell, there is no more AVG content on the machine.
Rebooted, and got the Exact Same BSOD as before, saying a
device driver is the problem.

I then went into device manager in Safe Mode, and checked every
item to see if there were updates needed. every single thing says
that the drivers are up to date.

Update: In Safe Mode I downloaded and ran Microsoft Malicious software removal tool. As it ran, it SAID that it had found 4 items, but when it finished the end screen said "No malicious software was detected"

 

[axe0]

Before doing anything below, please note that although some of what I posted is a bit extreme, it is just to be sure nothing will interfere with Malwarebytes as I suspect Malwarebytes should be able to handle this issue.


Please try the following:

• Search msconfig and open it
  • Go to the tab services
  • Check 'hide microsoft services'
  • Uncheck all other services
  • Go to the tab startup
  • Disable everything
• Click apply and click ok
• Reboot your pc to normal mode.

Next, please download Rkill by Grinler and save it to your desktop.

• Link 1
• Link 2
  • Double-click on the Rkill desktop icon to run the tool.
  • If using Vista/Windows7, right-click on it and Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs
  • If the tool does not run from any of the links provided, please let me know.

• Do not reboot the computer, you will need to run the application again.

Next, run Malwarebytes.

 

[bearcat22]

Before doing anything below, please note that although some of what I posted is a bit extreme, it is just to be sure nothing will interfere with Malwarebytes as I suspect Malwarebytes should be able to handle this issue.


Please try the following:

• Search msconfig and open it
  • Go to the tab services
  • Check 'hide microsoft services'
  • Uncheck all other services
  • Go to the tab startup
  • Disable everything
• Click apply and click ok
• Reboot your pc to normal mode.

Next, please download Rkill by Grinler and save it to your desktop.

• Link 1
• Link 2
  • Double-click on the Rkill desktop icon to run the tool.
  • If using Vista/Windows7, right-click on it and Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs
  • If the tool does not run from any of the links provided, please let me know.

• Do not reboot the computer, you will need to run the application again.

Next, run Malwarebytes.

Thank you for your help.

I am pretty desperate, and have been thinking that the only way to fix this
is to upgrade from Windows 7 to Windows 10.
Win 7 came preinstalled and I have no installation disk.

Right now, I am in Safe Mode. I cannot boot to Normal Mode at all.

Right now, I get a new BSOD that says "USBfilter.sys The driver is attempting to access memory after it has been freed STOP: 0x000000D5

When I tried to download the Windows 10 upgrade tool, it said Error: 0x8007042C-0x90017

I have not purchased Win 10, I'm assuming the upgrade is still for free

I will not follow your instructions until after you respond to this.

 

[axe0]

The upgrade isn't free anymore, technically the free upgrade shouldn't have been possible anymore for a long time (even though it still was), though I only know this theoretically and cannot say with certainty.

Could you upload the latest dump file, just copy it from Windows\Minidump to the desktop, then zip it and upload it here.
Note that you cannot do anything with it while it is in the Minidump folder, that's why you need to copy it to another location like the desktop.

 

[bearcat22]

The upgrade isn't free anymore, technically the free upgrade shouldn't have been possible anymore for a long time (even though it still was), though I only know this theoretically and cannot say with certainty.

Could you upload the latest dump file, just copy it from Windows\Minidump to the desktop, then zip it and upload it here.
Note that you cannot do anything with it while it is in the Minidump folder, that's why you need to copy it to another location like the desktop.

I am not sure I understand. Trying now to give you the Minidump.

 

[bearcat22]

Is there any source that is both Cheap and Safe to get a LEGITIMATE copy of Windows?
A physical disk I can keep and use to repair with, like back in the good old days of XP?
For example, this seems cheap: Windows 10 Home 32/64bit download

But is it LEGAL and not pirated? How do I know?

 

[bearcat22]

it has been over a week that the computer has been broken like this.

I'm pretty much going nuts with frustration.

I have spent money on a tech diagnosis, and a lot of money on new RAM.

Nothing is working.

Am I correct in thinking that even if I "Return to Factory Condition" as the
Hewlett Packard software offers, I will STILL NEED a physical Windows disc
to get running again?

 

[bearcat22]

Here is the Event Viewer Log, and also Minidump, if that helps.
I cannot run Malwarebytes.

 

[bearcat22]

UPDATE: While in Safe Mode I was finally able to get Malwarebytes to launch. It found nothing.

 

[bearcat22]

Here is a zip of the latest malwarebytes

 

[philc43]

Can you confirm if Driver Verifier is turned on? One of your minidumps showed a Driver Verifier detected error.

031819-17971-01.dmp:
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000e1, Synchronization object address is bogus or pageable.
Arg2: fffff9809c8b4bf0, Synchronization object address.
Arg3: 0000000000000000
Arg4: 0000000000000000

Please turn this off: Driver Verifier - Enable and Disable

Then retry your system in normal mode and post any new BSOD mini-dumps.


It looks to me as if you still have traces of AVG on your system:

FAILURE_ID_HASH_STRING: km:x64_0xc4_e1_avgtpx64+2784

 

[bearcat22]

Can you confirm if Driver Verifier is turned on? One of your minidumps showed a Driver Verifier detected error.

031819-17971-01.dmp:
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000e1, Synchronization object address is bogus or pageable.
Arg2: fffff9809c8b4bf0, Synchronization object address.
Arg3: 0000000000000000
Arg4: 0000000000000000

Please turn this off: Driver Verifier - Enable and Disable

Then retry your system in normal mode and post any new BSOD mini-dumps.


It looks to me as if you still have traces of AVG on your system:

FAILURE_ID_HASH_STRING: km:x64_0xc4_e1_avgtpx64+2784

Thank you for your advice.
What bothers me a lot is that Windows / Microsoft created something that
tells me that there is a bad driver, BUT for no sane reason, Windows does not ALSO
just tell me WHICH SPECIFIC DRIVER IS BAD. Why did they build it this way, with maximum frustration?



I am extremely reluctant to retry Normal Mode any more.
I can currently only boot into Safe Mode.
Anything I do in "Last Known Good Configuration" results
in yet another BSOD.

I have been able to move many things onto an external hard drive.

I just placed an order for some kind of "Restore" disk that supposedly might
either repair or reinstall the system.
Unless you tell me a good reason not to, I will try this out when it arrives two days from now.

Here is the product I plan to try:

Windows 7 All-in-One All Versions 32/64-Bit Repair, Reinstall, Restore Disc
https://www.amazon.com/gp/product/B01MFC7AYT/ref=ppx_yo_dt_b_asin_title_o00_s00?ie=UTF8&psc=1

If there are Good Reasons not to try this, please tell me as soon as possible.

If this fails, I will try what you advise.

 

[philc43]

In fact the Driver Verifier is telling you that there is a bad driver and it is causing the BSODs. The driver is identified and it is the AVG one. As long as you have Driver Verifier enabled you will get BSODs because that is the way it is designed to work.

As I said before turn Driver Verifier OFF, it puts too much strain on your system and slows it down, it is not meant to be on all the time.

Give this a try before you do anything else. Turn OFF driver verifier and then try normal mode again

 

[bearcat22]

In fact the Driver Verifier is telling you that there is a bad driver and it is causing the BSODs. The driver is identified and it is the AVG one. As long as you have Driver Verifier enabled you will get BSODs because that is the way it is designed to work.

As I said before turn Driver Verifier OFF, it puts too much strain on your system and slows it down, it is not meant to be on all the time.

Give this a try before you do anything else. Turn OFF driver verifier and then try normal mode again

Ok, I THINK I turned off Driver Verifier. I rebooted to Normal Mode, and Chrome launched without
an immediate BSOD.

Now what?

How exactly do I locate and remove the Bad Driver at the root of all this trouble?

Bear in mind, I know pretty much ZERO about computers.

 

[bearcat22]

I checked to be sure Windows Firewall and the default Windows antivirus are running.
I tested out Chrome, and it is running with faster speed than I have ever seen.
I tested to see what processes are running. Even though a huge amount of RAM is being used,
the utility opened up in a microsecond, faster than ever before.
I went looking for AVG content, found some, sent it to the recycle bin, and emptied the recycle bin.
The EXTERNAL drive I put a lot of content on is NOT connected.

 

[philc43]

All looks good so far. If you do get another BSOD post a new set of logfiles. Enjoy the faster speeds now that Driver verifier is off