Solved BSOD while running full malwarebytes antimalware program

[p5200]

I've had this happen about 3-4 times while running this program. All help will be appreciated Thanks!

 

[Arc]

Well, you have uploaded the SF Diag tool itself, whereas we need the data generated by running it.

Post it following the Blue Screen of Death (BSOD) Posting Instructions.

 

[p5200]

That's what I get for leaving too many icons on my desktop sorry folks! I hope this is correct.

 

[Arc]

Scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Get rid of intel rapid storage. First uninstall it from Control Panel > Programs and Features. Then Uninstall the driver from device manager.

1. Right click on "my computer" icon and click "manage" on the context menu.
2. It will open the "computer management" window.
3. Select "Device Manager" in the left pane, It will list all the existing devices up.
4. Expand "IDE ATA/ATAPI controllers" by clicking on the triangle in front of it.
5. Select one Intel device item under it, right click, uninstall.
6. Continue the process for all Intel items under "IDE ATA/ATAPI controllers"
7. Now restart the computer. At restart, windows will auto configure the appropriate native system driver.

Update JMicron Controllers from ftp://driver.jmicron.com.tw/SATA_Controller/Windows/.

Let us know the results.
_______________________________________________________________

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 34, {50853, fffff880074b87e8, fffff880074b8040, fffff80002296e5f}

Probably caused by : memory_corruption ( nt!MiCheckControlArea+17f )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CACHE_MANAGER (34)
    See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000050853
Arg2: fffff880074b87e8
Arg3: fffff880074b8040
Arg4: fffff80002296e5f

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880074b87e8 -- (.exr 0xfffff880074b87e8)
ExceptionAddress: fffff80002296e5f (nt!MiCheckControlArea+0x000000000000017f)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff880074b8040 -- (.cxr 0xfffff880074b8040)
rax=fffffa8010678450 rbx=0000000000000000 rcx=0000000000008080
rdx=0000000000000000 rsi=fffffa800d050270 rdi=0000000000000000
rip=fffff80002296e5f rsp=fffff880074b8a20 rbp=fffffa800f9a7500
 r8=fffffa800fed8010  r9=fffff880074b88d8 r10=fffffa80097b12c0
r11=fffff880074b8ac0 r12=0000000000000000 r13=0010000000000000
r14=000000000000fffe r15=0000000000000001
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00210206
nt!MiCheckControlArea+0x17f:
fffff800`02296e5f 49395d50        cmp     qword ptr [r13+50h],rbx ds:002b:00100000`00000050=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800024b3100
GetUlongFromAddress: unable to read from fffff800024b31c0
 ffffffffffffffff 

FOLLOWUP_IP: 
nt!MiCheckControlArea+17f
fffff800`02296e5f 49395d50        cmp     qword ptr [r13+50h],rbx

FAULTING_IP: 
nt!MiCheckControlArea+17f
fffff800`02296e5f 49395d50        cmp     qword ptr [r13+50h],rbx

BUGCHECK_STR:  0x34

LAST_CONTROL_TRANSFER:  from fffff80002284e54 to fffff80002296e5f

STACK_TEXT:  
fffff880`074b8a20 fffff800`02284e54 : 00000000`00000000 00000000`00000000 fffffa80`0f9a7500 fffffa80`06709880 : nt!MiCheckControlArea+0x17f
fffff880`074b8a90 fffff800`022bfc4b : fffffa80`0f9a7500 fffffa80`10678450 fffffa80`10678400 fffffa80`10678400 : nt!ObfDereferenceObject+0xd4
fffff880`074b8af0 fffff800`022c04ce : fffffa80`0f9a7520 fffffa80`0f9a7520 fffff880`0225d180 fffffa80`10678400 : nt!CcDeleteSharedCacheMap+0x1cb
fffff880`074b8b50 fffff800`022c0b08 : fffff880`0225d700 fffff880`074b8c58 fffffa80`0cf429b0 fffff800`02482938 : nt!CcWriteBehind+0x54e
fffff880`074b8c00 fffff800`02285261 : fffffa80`0670a510 fffff800`02573a01 fffff800`02482920 fffffa80`00000002 : nt!CcWorkerThread+0x1c8
fffff880`074b8cb0 fffff800`02519bae : 00000000`00000001 fffffa80`0710f040 00000000`00000080 fffffa80`066ec040 : nt!ExpWorkerThread+0x111
fffff880`074b8d40 fffff800`0226c8c6 : fffff880`009e8180 fffffa80`0710f040 fffffa80`0aade2a0 00000001`dd68e000 : nt!PspSystemThreadStartup+0x5a
fffff880`074b8d80 00000000`00000000 : fffff880`074b9000 fffff880`074b3000 fffff880`074b89e0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MiCheckControlArea+17f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  51db806a

STACK_COMMAND:  .cxr 0xfffff880074b8040 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x34_nt!MiCheckControlArea+17f

BUCKET_ID:  X64_0x34_nt!MiCheckControlArea+17f

Followup: MachineOwner
---------

 

[p5200]

I got this from WhoCrashed program.

[FONT=Segoe UI, Arial]Crash Dump Analysis [/FONT]
[FONT=Segoe UI, Arial]Crash dump directory: C:\Windows\Minidump[/FONT]

[FONT=Segoe UI, Arial]Crash dumps are enabled on your computer.
[/FONT]
[FONT=Segoe UI, Arial]On Mon 9/16/2013 11:55:13 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\091613-6458-01.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]ntoskrnl.exe[/FONT] (nt+0x75B80)
Bugcheck code: 0x34 (0x50853, 0xFFFFF880074B87E8, 0xFFFFF880074B8040, 0xFFFFF80002296E5F)
Error: [FONT=Segoe UI, Arial]CACHE_MANAGER[/FONT]
file path: C:\Windows\system32\ntoskrnl.exe
product: [FONT=Segoe UI, Arial]Microsoft® Windows® Operating System[/FONT]
company: [FONT=Segoe UI, Arial]Microsoft Corporation[/FONT]
description: NT Kernel & System
Bug check description: This indicates that a problem occurred in the file system's cache manager.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time. [/FONT]

 

[p5200]

Ill try what you said Thanks!

 

[p5200]

I've completed all the instructions now I will run my maleware program and see if it makes it all the way through. Thank you very much!

 

[Arc]

OK let us know how it goes.

 

[p5200]

I ran the malware program earlier with no problems but just ran it again and got another BSOD. Here is whocrashed report also. [FONT=Segoe UI, Arial]Crash Dump Analysis [/FONT]
[FONT=Segoe UI, Arial]Crash dump directory: C:\Windows\Minidump[/FONT]

[FONT=Segoe UI, Arial]Crash dumps are enabled on your computer.
[/FONT]
[FONT=Segoe UI, Arial]On Tue 9/17/2013 2:55:37 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\091713-8985-01.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]ntoskrnl.exe[/FONT] (nt+0x88A16)
Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF80002291A16, 0xFFFFF8800250F888, 0xFFFFF8800250F0E0)
Error: [FONT=Segoe UI, Arial]SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M[/FONT]
file path: C:\Windows\system32\ntoskrnl.exe
product: [FONT=Segoe UI, Arial]Microsoft® Windows® Operating System[/FONT]
company: [FONT=Segoe UI, Arial]Microsoft Corporation[/FONT]
description: NT Kernel & System
Bug check description: This indicates that a system thread generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time. [/FONT]

 

[Arc]

I am asking for some more help .... perhaps I am missing something here.

 

[p5200]

I am asking for some more help .... perhaps I am missing something here.

Here is the stop code on the blue screen I got if that helps. sorry I guess I just don't quite understand what I need to do. Stop code 0X0000007E Should I be looking into the bug check analysis you posted?

 

[p5200]

I changed my dump to give a kernel dmp and will run program to try and get another BSOD is that a waste of time?

 

[nommy the first]

Hello p5200,

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

[COLOR=Red][B]BugCheck 1000007E[/B][/COLOR], {ffffffffc0000005, fffff80002291a16, fffff8800250f888, fffff8800250f0e0}

[COLOR=Red][B]Probably caused by : ntkrnlmp.exe[/B][/COLOR] ( nt!IopDeleteFile+48 )

Followup: MachineOwner
---------

Usual causes: Insufficient disk space, Device driver, Video card, BIOS, Breakpoints with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control.

----------

Please run Memtest86+ to test your RAM for issues.

   Tip

Let Memtest run for at least 10 passes and preferably overnight as it may take very long to complete.
:ar: Especially read part three of the tutorial, which explains you to test each RAM stick in all DIMM slots to filter out failing slots.

Suppose you have got the result like that:

test|Slot1|Slot2
RAM1| Error | Error
RAM2|Good|Good

It is a RAM, a bad RAM.

But if you have got a result like that:

test|Slot1|Slot2
RAM1| Error |Good
RAM2| Error |Good

It is a motherboard issue. The particular slot is bad.

----------

Please use the SFC /SCANNOW command as displayed in option two of this tutorial.

1. Click on the rb:.
2. Open an elevated command prompt.
3. Type "SFC /SCANNOW" without the quotations.
4. Let SFC do it's thing, and then prompted to, restart.
   
   If SFC found and repaired anything, please do the following:
5. When restarted, open an elevated command prompt.
6. Type (or copy) the following, this will create a .txt file on your desktop;
   findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"
7. In your next reply, please attach this file using the method displayed in this tutorial.

----------

   Warning

:warno not do this step if your hard drive is an SSD!:warn:

Please scan your hard drive with Chkdsk.

1. Click on the rb:
2. Open an Elevated Command Prompt.
3. Type the following;
   chkdsk C: /F/R
   :ar:Replace C: with the letter of your hard drive.
4. You will get a message that your drive is in use and that Chkdsk will be run at start up.
5. Please exit the command prompt, close and save any open programs and restart your machine. Chkdsk will now scan at boot.

   Warning

Do not attempt to cancel or stop the scan, this might result in a loss in data and could render your Windows unusable!

----------

Please stress test the graphics card using Furmark GPU Stress Test.

   Information

During the test please check the screen for artifacts.
The purpose of this test is to make your machine crash and create dump files so that we can pinpoint the cause of your problem.

   Tip

Please run Furmark once when your machine has just started, and once again when your machine has been active for several hours.

----------

Please scan your hard drive with SeaTools for Windows.
:info:Read the tutorial before attempting to run the tool.


Good luck and keep us posted,
Nommy

 

[p5200]

I ran the CHKDSK once the other day and it is a ssd hope I didn't screw it up. I ran the sfc /scannow with no problems I will try your other suggestions. Now what's going on with my print?

 

[ICIT2LOL]

I ran the CHKDSK once the other day and it is a ssd hope I didn't screw it up. I ran the sfc /scannow with no problems I will try your other suggestions. Now what's going on with my print?

No mate I have done the same on mine - I didn't know this at the time either. Now in your specs the hard drive is quoted as a spinner is it?

If it is a spinner then you could try a surface test with the Partition Wizard tool.

Best Free Partition Manager Freeware and free partition magic for Windows 7, Windows 8, Windows Vista and Windows XP 32 bit & 64 bit. MiniTool Free Partition Manager Software Home Edition.

the pic is of my SSD but the rule applies to spinners

 

[Layback Bear]

p5200 Please correct your System Specs so other member know exactly what they are working with. We try are best not to give improper advise.
Could you also post a full picture of your Disk Management using this Tutorial by Brink.

http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

View attachment 286308

 

[p5200]

I'll see what I can do about posting what you asked for. I'm running a SamSung 840 120GB ssd which I installed with fresh install of win 7 pro last week. I wonder why it showed up as a spinner? Thanks!

 

[p5200]

Here is what my system says.

 

[p5200]

I've updated my spec sorry, I have trouble remembering things like that. I'm still trying to figure out how to correctly use the Mem test 86 iso I burned it for a while but, didn't really understand what I was looking for. I'll set it to run all night when I go to bed.

 

[Layback Bear]

We need to know how much free space you have on your C drive.

I'm no BSOD expert but what I'm trying to do is get some basic information that will allow the BSOD experts to give more help concerning your BSOD.
Where did you get your copy of Windows 7 Pro and did you complete all the Windows Updates?