Daily BSODs in last week or so - STOP:0x0000001E

[MisterTwister]

Hi all

1st time poster, recent BSOD sufferer. Zip file attached. This has been happening for maybe a week, not sure. Only change to anything I'm aware of was updating my McAfee subscription from a CD. I'm also running composing software called Finale 2010 and it chugs to a halt and crashes. It's not exclusive to that, it just did it on the desktop yesterday with nothing running.

Thanks for your help!

 

[koolkat77]

Welcome.

McAfee is known to cause BSOD's. Please remove it for testing purpose.

Start Menu\Programs\McAfee	Public:Start Menu\Programs\McAfee	Public

Revo Uninstaller:

Use Revo Uninstaller to uninstall stubborn software.

• Download and install the software
• Opt for Advance Mode while uninstalling which allows you to remove leftover registry.
• Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

Microsoft Security Essentials is recommended from a strict BSOD perspective, compatibility & stability compared to other internet security software. Malwarebytes is a great combo to MSE. They are free and lightweight.

Also uninstall your existing Antivirus software before you install MSE.

http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

   Warning

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

 Clean boot

• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Reduce items at start-up. No software except anti-virus is required plus doing this improves the time for logging into windows:

• How to Change, Add, or Remove Startup Programs in Windows 7

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

• Click on the rb:
• Type CMD on Search
• Left click and Run as Administrator
• Type SFC /scannow

Full tutorial here:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

[FONT="Lucida Console"]Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\YUSSI\Downloads\Compressed\IAIN-PC-24_03_2015_210604_52\032415-5647-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18741.amd64fre.win7sp1_gdr.150202-1526
Machine Name:
Kernel base = 0xfffff800`0284c000 PsLoadedModuleList = 0xfffff800`02a90890
Debug session time: Wed Mar 25 02:54:13.263 2015 (UTC + 6:00)
System Uptime: 0 days 3:15:41.153
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
.................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff880036ad360, 1, 971}

*** WARNING: Unable to verify timestamp for RapportCerberus64_80128.sys
*** ERROR: Module load completed but symbols could not be loaded for RapportCerberus64_80128.sys
Probably caused by : RapportCerberus64_80128.sys ( RapportCerberus64_80128+80360 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880036ad360, The address that the exception occurred at
Arg3: 0000000000000001, Parameter 0 of the exception
Arg4: 0000000000000971, Parameter 1 of the exception

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002afa100
GetUlongFromAddress: unable to read from fffff80002afa1c0
 0000000000000000 Nonpaged pool

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
RapportCerberus64_80128+80360
fffff880`036ad360 c681d104000000  mov     byte ptr [rcx+4D1h],0

BUGCHECK_STR:  0x1E_c0000005_R

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

TRAP_FRAME:  fffff8800f1b4220 -- (.trap 0xfffff8800f1b4220)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=00000000000004a0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880036ad360 rsp=fffff8800f1b43b8 rbp=fffffa800a398930
 r8=0000000000000000  r9=0000000000000001 r10=0000000000000001
r11=fffff8800f1b41a0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
RapportCerberus64_80128+0x80360:
fffff880`036ad360 c681d104000000  mov     byte ptr [rcx+4D1h],0 ds:00000000`00000971=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000290c698 to fffff800028c0ec0

STACK_TEXT:  
fffff880`0f1b3998 fffff800`0290c698 : 00000000`0000001e ffffffff`c0000005 fffff880`036ad360 00000000`00000001 : nt!KeBugCheckEx
fffff880`0f1b39a0 fffff800`028c0542 : fffff880`0f1b4178 00000000`00000000 fffff880`0f1b4220 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x487ed
fffff880`0f1b4040 fffff800`028bf0ba : 00000000`00000001 00000000`00000971 00000001`20707200 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`0f1b4220 fffff880`036ad360 : fffff880`036caf86 fffff8a0`12e3d410 fffff880`036ed4e0 00000000`00000000 : nt!KiPageFault+0x23a
fffff880`0f1b43b8 fffff880`036caf86 : fffff8a0`12e3d410 fffff880`036ed4e0 00000000`00000000 00000000`00000000 : RapportCerberus64_80128+0x80360
fffff880`0f1b43c0 fffff8a0`12e3d410 : fffff880`036ed4e0 00000000`00000000 00000000`00000000 00000000`000004a0 : RapportCerberus64_80128+0x9df86
fffff880`0f1b43c8 fffff880`036ed4e0 : 00000000`00000000 00000000`00000000 00000000`000004a0 fffff880`0368eb47 : 0xfffff8a0`12e3d410
fffff880`0f1b43d0 00000000`00000000 : 00000000`00000000 00000000`000004a0 fffff880`0368eb47 00000000`00000ff0 : RapportCerberus64_80128+0xc04e0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
RapportCerberus64_80128+80360
fffff880`036ad360 c681d104000000  mov     byte ptr [rcx+4D1h],0

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  RapportCerberus64_80128+80360

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: RapportCerberus64_80128

IMAGE_NAME:  RapportCerberus64_80128.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  54ca0a95

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_R_RapportCerberus64_80128+80360

BUCKET_ID:  X64_0x1E_c0000005_R_RapportCerberus64_80128+80360

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x1e_c0000005_r_rapportcerberus64_80128+80360

FAILURE_ID_HASH:  {59c10f5c-d40a-1841-01e6-f21a3ab43cb7}

Followup: MachineOwner
---------

0: kd> lmvm RapportCerberus64_80128
start             end                 module name
fffff880`0362d000 fffff880`036f95c0   RapportCerberus64_80128 T (no symbols)           
    Loaded symbol image file: RapportCerberus64_80128.sys
    Image path: RapportCerberus64_80128.sys
    Image name: RapportCerberus64_80128.sys
    Timestamp:        Thu Jan 29 16:25:25 2015 (54CA0A95)
    CheckSum:         000D2CE0
    ImageSize:        000CC5C0
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
[/FONT]

Make scans with the following:

Kaspersky TDSSKiller

• Anti-rootkit utility TDSSKiller

ESET online scanner:

• Free Online Virus Scanner | ESET

Run Disk Check on your Hard Drive for file system errors and bad sectors on it.

 Hard Drive Diagnostics

• Double click and open my computer.
• Right click on desired drive and hit properties.
• Click on tools tab and Check now.

Read complete instructions on the tutorial: http://www.sevenforums.com/tutorials/433-disk-check.html

Other Tests:

 

• Upload a screenshot of your hard disk using Crystal Disk Info.
• Make a hard drive test from the hard drive manufacturers website.
• Test your Hard Drive with SeaTools.

 

[MisterTwister]

Hi! Thanks so much for this. I've had no problems at all with McAfee until I extended my subscription by buying a disc and installing it. Anyway:

1. Revo uninstalled McAfee;
2. I installed MS Sec Essentials and Malwarebytes;
3. I CANNOT do the Clean System Startup step. When I "Disable All" and click "OK", it just hangs for an age and has to be shut using ctrl-alt-del. The PC then doesn't funciton at all and has to be shut down physically, weird;
4. I think I've reduced my start up programmes using CCCleaner;
5. SFC - no integrity violations;
6. Kaspersky - no threats found;
7. ESET, all OK;
8. Run disk check, C drive only, no issues;
9. I've attached the image obtained from Crystal Disk.

So should I not reinstall McAfee then? Just wait and see what happens now? Thanks again, very much appreciated!

 

[koolkat77]

So should I not reinstall McAfee then? Just wait and see what happens now?

Yes, for some time