Solved Frequent BSOD at random times.

Seikan340

New member
Local time
1:48 AM
Messages
2
Hello, lately I started having a few BSOD happening at rather random moments, I mostly remember them happening while browsing on firefox, I've got for example one while watching a youtube video, or earlier reading a blog post.
I can go on for a few days without any or have to in a single day like today.

I thank you all for your time.
 

My Computer My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Custom build
OS
Windows 7 Ultimate x64
CPU
Intel(R) Core (TM) i7-4770K
Motherboard
Asus Z87-A
Graphics Card(s)
NVIDIA GeForce GTX 770
Hard Drives
Kingston SSDNow V300 240GB
Seagate Barracuda ST 1000 DM 003 3,5" 1000GB ST1000DM003
Antivirus
Avast
Browser
Firefox
Hello and welcome Seikan mate there is dump file I don't fully understand or have seen before and I suggest you run in safe mode these for starters as it looks to be a system thing.


http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

http://www.sevenforums.com/tutorials/433-disk-check.html< if necessary include the /f and /r in the command line as per Option2

As an afterthought could you run Speccy and post the temps too https://www.piriform.com/speccy/download * when you post back shots of the Speccy readouts it will display the activation code - best dealt with taking a snip then use paint to obliterate it before posting snips How to Use the Snipping Tool in Vista > save the pic to wherever and then click on where you saved it to then right click it and use paint to erase the info ( a small icon that looks like a pencil eraser see pic
Code:
ADDITIONAL_DEBUG_TEXT:  
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.
MODULE_NAME: [COLOR=red]tcpip[/COLOR]
FAULTING_MODULE: fffff8000304c000 nt
DEBUG_FLR_IMAGE_TIMESTAMP:  533f5bd4
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP: 
tcpip+127c1d
fffff880`01b28c1d 8b4128          mov     eax,dword ptr [rcx+28h]
CONTEXT:  fffff8800cf5d870 -- (.cxr 0xfffff8800cf5d870;r)
rax=fffffa800d5555a0 rbx=fffffa800d5556d0 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000010 rdi=0000000000000010
rip=fffff88001b28c1d rsp=fffff8800cf5e250 rbp=fffff88001b6e9a0
 r8=0000000000000006  r9=fffff8800cf5e3a0 r10=fffffa8006835020
r11=fffff8800cf5e100 r12=0000000000000012 r13=fffffa80074dfb40
r14=0000000000000000 r15=0000000000000002
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
tcpip+0x127c1d:
fffff880`01b28c1d 8b4128          mov     eax,dword ptr [rcx+28h] ds:002b:00000000`00000028=????????
Last set context:
rax=fffffa800d5555a0 rbx=fffffa800d5556d0 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000010 rdi=0000000000000010
rip=fffff88001b28c1d rsp=fffff8800cf5e250 rbp=fffff88001b6e9a0
 r8=0000000000000006  r9=fffff8800cf5e3a0 r10=fffffa8006835020
r11=fffff8800cf5e100 r12=0000000000000012 r13=fffffa80074dfb40
r14=0000000000000000 r15=0000000000000002
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
tcpip+0x127c1d:
fffff880`01b28c1d 8b4128          mov     eax,dword ptr [rcx+28h] ds:002b:00000000`00000028=????????
Resetting default scope
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  [COLOR=red]WIN7_DRIVER_FAULT[/COLOR]
BUGCHECK_STR:  0x3B
CURRENT_IRQL:  0
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff88001b28c1d
STACK_TEXT:  
fffff880`0cf5e250 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip+0x127c1d

FOLLOWUP_IP: 
tcpip+127c1d
fffff880`01b28c1d 8b4128          mov     eax,dword ptr [rcx+28h]
SYMBOL_STACK_INDEX:  0
SYMBOL_NAME:  tcpip+127c1d
FOLLOWUP_NAME:  MachineOwner
IMAGE_NAME:  [COLOR=red]tcpip.sys[/COLOR]
STACK_COMMAND:  .cxr 0xfffff8800cf5d870 ; kb
BUCKET_ID:  WRONG_SYMBOLS
FAILURE_BUCKET_ID:  [COLOR=red]WRONG_SYMBOLS[/COLOR]
ANALYSIS_SOURCE:  KM
FAILURE_ID_HASH_STRING:  km:wrong_symbols
FAILURE_ID_HASH:  {70b057e8-2462-896f-28e7-ac72d4d365f8}
Followup: MachineOwner
 

My Computer My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Own build (new) Desk1 / Asus ROG Win 7 / Desk2 1st build
OS
Desk1 7 Home Prem / Desk2 10 Pro / Main lap Asus ROG 10 Pro 2 laptop Toshiba 7 Pro Asus P2520 7 & 10
CPU
Desk1 i5 3750K / Laptop i7 GTX 860M / Desk2 i5 2500
Motherboard
Desk1 Asus P877-V / Desk2 Gigabyte H67 UD3H / Laptop ?
Memory
Desk1 8GB (1866) / Desk2 16GB (1333) / Laptop 8Gb DDR3
Graphics Card(s)
Desk 1& 2NVidia GTX 650 & Laptops on board Intel
Sound Card
Desk 1 & 2 -XONAR DG Realtek High Def audio Laptop
Monitor(s) Displays
Desk 1 Benq HD 2450 / Desk2 Philips 24" / Laptop 17.5"
Screen Resolution
1920x1080 D1 & D2 & Laptop 1
Hard Drives
Desk1 Samsung 120GB 830 SSD
Asus ROG 256GB 850 Pro SSD
Desk2 Samsung 840 256 SSD
Toshiba 120GB EVO
PSU
Desk 1 Corsair HX 1050/ Laptop ? / Desk 2 Corsair HX 650
Case
Desk 1 Cooler HAF XM ? Toshiba laptop / Desk2 Coolermaster
Cooling
Fans on all Desk1 -2 Desk2 - all Coolermasters 5 Laptop ?
Keyboard
Desk 1 MS Sidewinder X6 Desk 2 MS Sidewinder X 4
Mouse
Desk 1&2 - Gigabyte MS 900 gamer - laptop - Logitec wireless
Internet Speed
ADSL2+
Other Info
One other Desktop (tester) and spare Toshba laptop both with SSD's
Running Kaspersky 2016 ISS on all machines config'd identically
Logitec audio stereo systems on each machine (x3)
Canon MG5250MFC
Router/modem TP-Link running WPA2SK
tcpip.sys is a driver from Windows related to the network, meaning either the network drivers or 3rd party drivers connecting to the network are causing issues.

The flagged drivers are Malwarebytes Web Access control and Acronis Storage Filter management.
Either update or reinstall Malwarebytes and Acronis.
Code:
*** WARNING: Unable to verify timestamp for mwac.sys
*** ERROR: Module load completed but symbols could not be loaded for mwac.sys

2: kd> lmvm mwac
start             end                 module name
fffff880`0c8d9000 fffff880`0c8eb000   mwac     T (no symbols)           
    Loaded symbol image file: mwac.sys
    Image path: \??\C:\Windows\system32\drivers\mwac.sys
    Image name: mwac.sys
    Timestamp:        [COLOR="Red"]Wed Jun 18 04:06:34 2014[/COLOR] (53A0F42A)
    CheckSum:         00010FDD
    ImageSize:        00012000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4


*** WARNING: Unable to verify timestamp for fltsrv.sys
*** ERROR: Module load completed but symbols could not be loaded for fltsrv.sys

2: kd> lmvm fltsrv
start             end                 module name
fffff880`01f51000 fffff880`01f6f000   fltsrv   T (no symbols)           
    Loaded symbol image file: fltsrv.sys
    Image path: \SystemRoot\system32\DRIVERS\fltsrv.sys
    Image name: fltsrv.sys
    Timestamp:        [COLOR="red"]Mon May 13 11:40:09 2013[/COLOR] (5190B4F9)
    CheckSum:         00021D3A
    ImageSize:        0001E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

A 0x3B(SYSTEM_SERVICE_EXCEPTION) could have a few options where I'll try to explain what happens according to what I understand.
In this case it is likely that Malwarebytes and Acronis are both trying to access the internet, so they give instructions to the related driver to request data from the internet. However the data is not in the correct way requested so the related driver gives a signal that it can't execute the data, an exception of a system service (part of a program or a program) which hasn't been catched (properly).
I hope I have made it a little bit clear of what could have happened with a really short explanation, there are quite a few scenario's of what could have happened.

Lastly Seikan340, you are running a Lenovo Product ID on an ASUS board.
This makes your installation counterfeit.
Troubleshooting a counterfeit installation is useless as it is not known what has been modified to your system.
A counterfeit installation contains heavily modified code which causes the system to behave in unexpected ways.
For this reason, analyzing counterfeit systems is unreliable and most analysts won't try it.
Code:
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free
Registered Owner:          Djalal
Registered Organization:   
Product ID:                [COLOR="Red"]00426-OEM-8992662-00497[/COLOR] <-- Lenovo PID on ASUS board
Original Install Date:     06/06/2014, 18:34:32
System Boot Time:          02/11/2015, 20:45:06
System Manufacturer:       ASUS

I recommend to install a genuine copy of Windows.
If, after you have installed a genuine copy of Windows, you still get BSOD's we'll be happy to assist you.
 
Last edited:

My Computer My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Custom build
OS
Windows 10 Pro
CPU
i5-6500
Motherboard
Gigabyte B150-HD3P-CF
Memory
16GB DDR4 2133 Crucial Ballistix Sport LT
Graphics Card(s)
MSI GeForce GTX 1060 GAMING X 6G
Sound Card
Intel Display Audio
Monitor(s) Displays
Liyama ProLite XB2483HSU-B2
Screen Resolution
1920 x 1080
Hard Drives
Crucial MX200 500GB & Toshiba DT01ACA300 3TB
PSU
Corsair RM550x
Case
Fractal Design Define S
Cooling
Cooler Master TX3 i
Keyboard
Func KB-460 (MX Red)
Mouse
Corsair Gaming M65 RGB
Antivirus
Bitdefender Total Security 2016 + MBAM Pro + MBAE Pro
Browser
Google Chrome
Other Info
Creative Sound Blaster Tactic3D Rage V2 headset
Interesting axe I could see it was something to do with Windows but not the rest (am only a novice) it was aslo a good spot to the malware stuff too.

Now I wonder if the validation could be cleared up with running this for the OP? Genuine Windows - Windows Help
 

My Computer My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Own build (new) Desk1 / Asus ROG Win 7 / Desk2 1st build
OS
Desk1 7 Home Prem / Desk2 10 Pro / Main lap Asus ROG 10 Pro 2 laptop Toshiba 7 Pro Asus P2520 7 & 10
CPU
Desk1 i5 3750K / Laptop i7 GTX 860M / Desk2 i5 2500
Motherboard
Desk1 Asus P877-V / Desk2 Gigabyte H67 UD3H / Laptop ?
Memory
Desk1 8GB (1866) / Desk2 16GB (1333) / Laptop 8Gb DDR3
Graphics Card(s)
Desk 1& 2NVidia GTX 650 & Laptops on board Intel
Sound Card
Desk 1 & 2 -XONAR DG Realtek High Def audio Laptop
Monitor(s) Displays
Desk 1 Benq HD 2450 / Desk2 Philips 24" / Laptop 17.5"
Screen Resolution
1920x1080 D1 & D2 & Laptop 1
Hard Drives
Desk1 Samsung 120GB 830 SSD
Asus ROG 256GB 850 Pro SSD
Desk2 Samsung 840 256 SSD
Toshiba 120GB EVO
PSU
Desk 1 Corsair HX 1050/ Laptop ? / Desk 2 Corsair HX 650
Case
Desk 1 Cooler HAF XM ? Toshiba laptop / Desk2 Coolermaster
Cooling
Fans on all Desk1 -2 Desk2 - all Coolermasters 5 Laptop ?
Keyboard
Desk 1 MS Sidewinder X6 Desk 2 MS Sidewinder X 4
Mouse
Desk 1&2 - Gigabyte MS 900 gamer - laptop - Logitec wireless
Internet Speed
ADSL2+
Other Info
One other Desktop (tester) and spare Toshba laptop both with SSD's
Running Kaspersky 2016 ISS on all machines config'd identically
Logitec audio stereo systems on each machine (x3)
Canon MG5250MFC
Router/modem TP-Link running WPA2SK
It does make sense that it would be related to malwarebytes since I did install it recently, I'll check it up, thanks a lot.

And yeah, it's my brother's custom built computer but he's abroad, it says Windows is activated but wouldn't be surprised it isn't a genuine copy of it... but yeah since I'm in charge of it for now I think I should get a genuine windows for it, probably W10 though I'm still a little bit skeptical about getting it now.

Anyways thanks again!
 

My Computer My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Custom build
OS
Windows 7 Ultimate x64
CPU
Intel(R) Core (TM) i7-4770K
Motherboard
Asus Z87-A
Graphics Card(s)
NVIDIA GeForce GTX 770
Hard Drives
Kingston SSDNow V300 240GB
Seagate Barracuda ST 1000 DM 003 3,5" 1000GB ST1000DM003
Antivirus
Avast
Browser
Firefox
it says Windows is activated but wouldn't be surprised it isn't a genuine copy of it...

No nor would I mate because a lot of counterfeit stuff is very often Ultimate and people think they are getting the very best when for ordinary use even Home premium is more than adequate. Just check out that link I sent.
 

My Computer My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Own build (new) Desk1 / Asus ROG Win 7 / Desk2 1st build
OS
Desk1 7 Home Prem / Desk2 10 Pro / Main lap Asus ROG 10 Pro 2 laptop Toshiba 7 Pro Asus P2520 7 & 10
CPU
Desk1 i5 3750K / Laptop i7 GTX 860M / Desk2 i5 2500
Motherboard
Desk1 Asus P877-V / Desk2 Gigabyte H67 UD3H / Laptop ?
Memory
Desk1 8GB (1866) / Desk2 16GB (1333) / Laptop 8Gb DDR3
Graphics Card(s)
Desk 1& 2NVidia GTX 650 & Laptops on board Intel
Sound Card
Desk 1 & 2 -XONAR DG Realtek High Def audio Laptop
Monitor(s) Displays
Desk 1 Benq HD 2450 / Desk2 Philips 24" / Laptop 17.5"
Screen Resolution
1920x1080 D1 & D2 & Laptop 1
Hard Drives
Desk1 Samsung 120GB 830 SSD
Asus ROG 256GB 850 Pro SSD
Desk2 Samsung 840 256 SSD
Toshiba 120GB EVO
PSU
Desk 1 Corsair HX 1050/ Laptop ? / Desk 2 Corsair HX 650
Case
Desk 1 Cooler HAF XM ? Toshiba laptop / Desk2 Coolermaster
Cooling
Fans on all Desk1 -2 Desk2 - all Coolermasters 5 Laptop ?
Keyboard
Desk 1 MS Sidewinder X6 Desk 2 MS Sidewinder X 4
Mouse
Desk 1&2 - Gigabyte MS 900 gamer - laptop - Logitec wireless
Internet Speed
ADSL2+
Other Info
One other Desktop (tester) and spare Toshba laptop both with SSD's
Running Kaspersky 2016 ISS on all machines config'd identically
Logitec audio stereo systems on each machine (x3)
Canon MG5250MFC
Router/modem TP-Link running WPA2SK
Back
Top