Random BSOD occuring only in a particular account. Bugcheck code: 0xF4

[Aveon]

I have been getting random BSOD only in a particular account.

The BSOD is very random. In the other account I have tried running Driver verifier however I could not see any crashes.

Here is a short report on the bugcheck

This was probably caused by the following module: [FONT=Segoe UI, Arial]ntoskrnl.exe[/FONT] (nt+0x7EFC0)
Bugcheck code: 0xF4 (0x3, 0xFFFFFA800BEA6730, 0xFFFFFA800BEA6A10, 0xFFFFF80003181460)
Error: [FONT=Segoe UI, Arial]CRITICAL_OBJECT_TERMINATION[/FONT]
file path: C:\Windows\system32\ntoskrnl.exe

Thanks in advance.

 

[x BlueRobot]

[COLOR="Red"]BugCheck F4[/COLOR], {3, fffffa800bea6730, fffffa800bea6a10, fffff80003181460}

----- ETW minidump data unavailable-----
Probably caused by : wininit.exe

Remove:

Start Menu\Programs\DAEMON Tools Pro
Start Menu\Programs\TuneUp Utilities 2011

Daemon Tools is known to cause BSODs with Windows, and it is advisable you remove this program. Furhtermore, programs such as TuneUp Utilities do not improve the performance of Windows 7, and can cause crashes and problems with your system.

A recommended alternative for Daemon Tools is:

• MagicISO

You can also use some of Windows built-in features, which Daemon Tools provided, such as burning .ISO files to a CD/DVD.

Follow these steps -

Memory:

• http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Run Memtest86+ for least 7-8 passes, and preferably overnight as it can take a while to fully complete.

Test each RAM stick individually, if an error is found then move the same RAM stick into the next DIMM slot and test again, if errors are found for the same RAM stick in every available slot then you have a faulty RAM module. On the other hand, if no errors are found in the next slot or the other slots for the same RAM module, then you have a faulty DIMM slot.

Test each RAM stick and every motherboard DIMM slot available.

Scan for any corrupted or missing protected Windows files:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

 

[Aveon]

Thanks a lot for the quick reply.

Will remove both and let you know the results. I would need Daemon tools for IDE emulation though. Will remove it for temporary testing

I don't think the memory would be faulty . I have assembled this system 3 months back and haven't gotten any BSODs until last week. I have added a new 2 TB hard drive 2-3 weeks back though .

Again the BSOD are only visible in a particular account which is used by my brother during the day. I only access system during evening . I used the system heavily on the weekend in my account and there wasn't a single BSOD.

SFC / Scannow completely verified the system without violations

 

[x BlueRobot]

Have you tried creating a new user account for your brother?

 

[Aveon]

Have you tried creating a new user account for your brother?

Not yet! but I wanted to keep it as a last option until I sort out the issue!

 

[x BlueRobot]

Any more crashes? If it seems to be only occurring within his user account, then it may be a good option

 

[Aveon]

NO BSODs today. So things seems fine for the day.

Not sure if it was daemon tools or Tune-up utilities.

I will test it for another 2-3 days and see what happens .

 

[x BlueRobot]

That's good to know, post back any more crashes, hopefully they won't occur

 

[Aveon]

My Brother reported there was a BSOD today. However strange I could not find any minidumps , I could see the system had rebooted in the Event viewer.

I had unchecked the overwrite dump option in the advanced system settings. Could that have disabled the dumps ?|

Need to do more debugging

 

[x BlueRobot]

Make sure it has been configured to create a Minidump:

• http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html

Have you considered creating a new temporary account (don't remove his account) and see if any BSODs occur then?

 

[Aveon]

Make sure it has been configured to create a Minidump:

• http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html

Have you considered creating a new temporary account (don't remove his account) and see if any BSODs occur then?

Yeah will create a new account and test .

BTW what's useful for debugging ? Kernel dumps or mini dumps ? Previously I had enabled kernel dumps and it was dumping minidumps as well.




BTW I have VMware . Could it be causing the BSODs

Also I see this in the event viewer log

Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications.

Secondly here is what the event viewer was displaying [if this could be helpful]:
- System

- Provider


[ Name] Microsoft-Windows-Kernel-Power


[ Guid] {331C3B3A-2005-44C2-AC5E-77220C37D6B4}



EventID 41


Version 2


Level 1


Task 63


Opcode 0


Keywords 0x8000000000000002

- TimeCreated


[ SystemTime] 2012-12-19T07:41:19.573205400Z



EventRecordID 34052


Correlation

- Execution


[ ProcessID] 4


[ ThreadID] 8



Channel System


Computer Aveon-PC

- Security


[ UserID] S-1-5-18

- EventData

BugcheckCode 244

BugcheckParameter1 0x3

BugcheckParameter2 0xfffffa800bbb5b30

BugcheckParameter3 0xfffffa800bbb5e10

BugcheckParameter4 0xfffff80003187460

SleepInProgress false

PowerButtonTimestamp 0

 

[x BlueRobot]

It depends, usually only a Minidump is needed and it also saves space too, but in some cases a Kernel dump is needed as it provides more information about the crash.

Did the dump file not get saved?

Minidumps will be fine

 

[x BlueRobot]

Install and perform a full scan with:

• Malwarebytes : Free anti-malware download

Run a full scan with your Kaspersky Internet Security program, just to make sure no malware has infected Windows and causing it to crash.

:info: Remember to install the free version of Malwarebytes not the free trail; untick the free trial box during installation

 

[Aveon]

It depends, usually only a Minidump is needed and it also saves space too, but in some cases a Kernel dump is needed as it provides more information about the crash.

Did the dump file not get saved?

Minidumps will be fine

Yep they were not saved today. Not sure why though. I could see the system had abruptly shutdown around 1:10 PM.

Will be trying that malware bytes thingy.

 

[Aveon]

I have initiated the full scan .

I just noted something peculiar and thought I should mention it.
I noticed in the event viewer the BSOD was initiated just after the following two events always occurred
1>>>"File System Filter 'KLIF' (6.1, ‎2012‎-‎09‎-‎25T19:58:18.000000000Z) has successfully loaded and registered with Filter Manager."
2>>>"File System Filter 'FileInfo' (6.1, ‎2009‎-‎07‎-‎14T05:04:25.000000000Z) has successfully loaded and registered with Filter Manager."

All the BSODs have the same events triggered before the BSOD struck.
My brother reported a BSOD just after the login.
I observed the events in that BSOD and I found 3 event before the BSOD struck.
1st was the system start-up
2nd and 3rd were the one I mentioned above.

I goggled this stuff and found it is kaspersky files. I think these are the files causing issues.
My brother also informed me that kaspersky crashed multiple times.

So I am not sure but I think kaspersky is the culprit here.

 

[x BlueRobot]

Remove:

Start Menu\Programs\Kaspersky Internet Security 2012

Install Microsoft Security Essentials:

Install and perform a full scan with:

• Microsoft Security Essentials | Protect against viruses, spyware, and other malware

MSE is lightweight and free, I haven't seen it cause any problems personally, and it seems to be much more stable with Windows 7 than most other AV programs; keep Malwarebytes installed.

It will be worth testing, and post back your results

Any findings from Malwarebytes yet?

 

[Aveon]

Malware bytes detected two malwares . some brewer apps. removed them

I am trying to reinstall KIS 2012 and check if it works .

 

[x BlueRobot]

Okay, and good to know that malware has been removed, have you tested with the new user account yet?

Run a scan with:

• Anti-rootkit utility TDSSKiller

 

[Aveon]

Okay, and good to know that malware has been removed, have you tested with the new user account yet?

Run a scan with:

• Anti-rootkit utility TDSSKiller

Security essentials took time to download. Damn my internet connection.

However I managed to reinstall Kaspersky and no BSOD reported by my bro today.

 

[x BlueRobot]

Thanks for the update, upload any more crashes, hopefully they won't occur