Solved Windows 7 - several BSOD per day, all bug check code 0x00000109

[diaspm]

Hi

The BSOD started happening this week and since then it is occuring several times per day.

I ran BlueScreenView and i got the following specs:
bug check code: 0x00000109
caused by driver: ntoskrnl.exe
crash address: ntoskrnl.exe+75c40
File version: 6.1.7601.18044 (win7sp1_gdr.130104-1431)

I 'm completely lost on what is causing it. I checked ram and hdd for errors and both come clean (however I could not run extended checks since it takes a few hours and the BSOD breaks it). apparently all drivers are updated.

I dont't know what to do the BSOD. Help would be much appreciated.

 

[Pauly]

Hello diaspm, Welcome to SF

Nothing specific in those dumps im afraid to point at a particular cause
Bug check 0x109 wouold suggest a faulty driver or memory problems
I would first check all memory by running some diagnostic software
http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html
http://www.sevenforums.com/tutorials/433-disk-check.html
Hard Drive Diagnostic Procedure

Then if no faults found try enabling driver verifier
http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html
just remember if your pc wont boot after enabling then enter safe mode to turn it of again

Also you have many old drivers on your system you ned to update the old ones, heres a list of the ones that predate win 7

NTIDrvr.sys 25/03/2009 03:09:39
DKbFltr.sys 26/03/2009 03:15:42
usbfilter.sys 03/04/2009 11:39:51
UBHelper.sys 27/04/2009 08:48:19
AtiPcie.sys 05/05/2009 15:00:22
Rt64win7.sys 22/05/2009 14:52:30
mwlPSDFilter.sys 02/06/2009 10:07:30
mwlPSDNServ.sys 02/06/2009 10:07:39
mwlPSDVDisk.sys 02/06/2009 10:15:29
SynTP.sys 19/06/2009 02:33:58
RTKVHD64.sys 06/07/2009 09:18:54

 

[diaspm]

Thank you Pauly, both for the welcome as well as your fast reply. I will follow each one of your suggested steps and return back on results asap
cheers

 

[diaspm]

Some update:
1. the ram test with Memtest86+ ran without any reported error.
2. I am having trouble to run the disk check: I made a "chkdsk /R" command but the check is interrupted by BSOD. Then the laptop restarts and the check strats again from 0 (last time it happened the check was no more than 12% completed) ... i am worried data can be damaged because of it.
Any suggestion? Txs

 

[Pauly]

Scrap it and run the bootable hdd diagnostic software this runs outside of OS so hopefully no bsod

 

[diaspm]

Yes I had to give up from the chkdsk.
Then I went for the bootable HDD (it is a Western Digital) diagnostic tool and I was able to run the extended test (no BSODs this time No faults were found

It leaves me the last suggested step: I 'm gonna enable driver verifier and see what it gets.
I will report back on the results/logs

Txs!

 

[diaspm]

Hello again
Well it does not take long to get 3 BSOD and collect the dump files after enabling Driver Verifier.
May you please have a look to see if you can spot what can be triggering the BSODs? unfortunately I'm not skilled to read the files. Txs!

 

[Pauly]

Think we might need some help here, im going to request assistance from other BSOD members

 

[diaspm]

Txs mate!
If you see it is too much trouble I can always go to the a-bomb solution: reinstall windows from scratch
I was trying to avoid it but I don't want to give you so much work ...
cheers

 

[Pauly]

Got some help heres what he said

This is what I managed to find from the BSOD:

[COLOR=blue]Arg4: 0000000000000007[/COLOR], Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
[COLOR=blue]7 : Critical MSR modification[/COLOR]

1: kd> [COLOR=seagreen]!error c0000082[/COLOR]
Error code: (NTSTATUS) 0xc0000082 (3221225602) - Too many GUIDs were requested from the allocation server at once.

It seems the MSR (Micrsoft Reserved Partition) was modified in some form, this partition is attached with a GUID which is basically just a software reference number, and is used for the GPT format for hard-drives.

Microsoft requires an MSR on every GPT disk

I'm guessing the OP is using the GPT format, and that MSR has got corrupted in some form.

I would follow these steps:



Scan for any malware or rootkits using:

• http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html
• http://support.kaspersky.com/5350

Enter Command Prompt at boot, and then attempt to use the chkdsk /f /r command from there.

 

[diaspm]

Hi Pauly
Thank you for your reply. And please extend my gratefulness to x BlueRobot
I wasn't able to catch back before today. I scanned the laptop with Windows Defender Offine as suggested. After 6 (!) hours running an extensive analysis, it reported the laptop was infected with both
Exploit:Java/CVE-2012-4681 and
Exploit:Java/CVE-2012-1723.gen!A
I removed both on Windows Defender Offline. I was already singing victory but 40min later the BSOD came back. Desilusion.
Do you have some other ideia or recommendation on how can i get rid of it?
I am thinking to use a bootable antivirus (i may try with AVG rescue this time) and leave the laptop scanning tonight to check if there is still any malware infecting the laptop. I will update tomorow.
Txs

 

[Pauly]

Enter Command Prompt at boot, and then attempt to use the chkdsk /f /r command from there.

[/QUOTE]

Look into this you may well have some kind of corruption there, run the scan and let us know

 

[diaspm]

Hi Pauly
Report on the past 24H events:
First, i ran AVG rescue (bootable) during last night... time lost since it did not detect anything.
But I later ran the Kaspersky bootkit (like i should have done by x BlueRobot suggestion, instead of using AVG) and after more 6 hours waiting it found some additional malware that windows defender offline has missed - it's name: Exploit:Java/CVE-2010-0840.gg
Despite removed, the laptop kept crashing from BSODs
It was then that I saw your last post and I went to run the chkdsk /f /r command on promp. This time no BSOD during the analysis. Attached the resulting log, fyi.
I will make some time to see if I report any BSOD. The laptop is not mine (it's from my parents) and I am retaining it for longer than they wished to. I guess if a BSOD comes in the next hours I will have no choice than reinstalling Windows 7
In any case I will give feedback.
meanwhile and once again, thank you for all the support ...

 

[diaspm]

ups, i missed to add the file on my last post

 

[x BlueRobot]

Java has many security problems, and it may be best that you remove Java completely. Most programs and website do not even require Java anymore.

• How do I uninstall Java on my Windows computer ?

Some corrections were made to your file system.

Personally, I would create a backup of all your personal files and save these to a external hard-drive or a USB stick, and then restore the computer to it's factory settings which may be a easier option for you:

• Acer Support: Frequently Asked Questions list for How to use Acer eRecovery
• http://www.sevenforums.com/tutorials/615-backup-user-system-files.html

We can then work through removing any bloatware after the factory restore, these are programs which are basically junk and are not needed, they can reduce performance and corrupt your system:

• http://www.sevenforums.com/tutorials/219576-clean-up-factory-bloatware.html

 

[x BlueRobot]

For information purposes and if anyone is interested, here is a description from Microsoft about the malware:

• Encyclopedia entry: Exploit:Java/CVE-2012-4681 - Learn more about malware - Microsoft Malware Protection Center
• Encyclopedia entry: Exploit:Java/CVE-2012-1723.gen!A - Learn more about malware - Microsoft Malware Protection Center

I wasn't able to find anything for Exploit:Java/CVE-2010-0840.gg.

 

[diaspm]

Hi mates. I am glad to say "Problem solved"
After my last post yesterday evening I reported no more BSODs since. In fact the laptop is running smoother than before the first BSOD event last week (I guess the malware was already degrading its performance for some time).
My understanding is that after the malware was finally removed (I got surprised that windows defender missed to catch all the malware but fortunately Kaspersky seems to have finished the job) it was the checkdisk command that repaired the conflit which was triggering the BSODs.
Whatever it was, it is to you guys (Pauly and x BlueRobot) that I owe my gratitude for avoiding to format the laptop. Honestly, it would have been faster ... but the fact is that I am much more informed than 1 week ago and I learn a lot in the meantime. I hope my incident could have expanded your expertise some way and that it may be helpful to someone in future. In short: thanks!

 

[x BlueRobot]

Your very welcome, and that's why I always recommend multiple anti-malware scanners, others will catch viruses and spyware which the other one wasn't able to.