[SOLVED] Blue screen at random times twice yesterday. PROBLEM: Kaseya VSA KAPFA.SYS. FIX: Kaseya solved it.

B

brad8598

Well-known member
Joined
Dec 7, 2018
Posts
51
Let me know if I need to post more info but I am attaching FileCollection logs.

Here are the speccy results- http://speccy.piriform.com/results/TkA6jnBl2f7xA8RaMOajTci

A brief description of your problem (but you can also include the steps you tried)
Blue screen, installed all Windows and driver updates
System Manufacturer?
ASUS
Laptop or Desktop?
Desktop
Exact model number (if laptop, check label on bottom)
ASUS Motherboard TUF B360M-PLUS GAMING (LGA1151)
OS ? (Windows 10, 8.1, 8, 7, Vista)
W10
x86 (32bit) or x64 (64bit)?
64
What was original installed OS on system?
10
Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)?
Purchased
Age of system? (hardware)
1 year
Age of OS installation?
1/22/21
Have you re-installed the OS?
No
CPU
i7
RAM (brand, EXACT model, what slots are you using?)
Don't know, I am remote
Video Card
MotherBoard - (if NOT a laptop)
ASUS Motherboard TUF B360M-PLUS GAMING (LGA1151
Power Supply - brand & wattage (if laptop, skip this one)
Is driver verifier enabled or disabled?
Disable
What security software are you using? (Firewall, antivirus, antimalware, antispyware, and so forth)
Windows Defender
Are you using proxy, vpn, ipfilters or similar software?
No
Are you using Disk Image tools? (like daemon tools, alcohol 52% or 120%, virtual CloneDrive, roxio software)
Acronis
Are you currently under/overclocking? Are there overclocking software installed on your system?
No
 

Attachments

Stop 0xEF's are typically hardware related, although, in some circumstances I have seen security programs being over zealous and terminating legitimate processes. I would suggest running MemTest86 for at least 8 passes (will require two runs of 4 passes) to ensure that there is no issues with the RAM.

Test RAM with PassMark MemTest86
 
I would also suggest checking the hard drive.
Hard Drive (HDD) Diagnostics (Sea Tools for DOS) & SSD Test
Rich (BB code): 
1/6/2022 5:52 PM    Windows Error Reporting    Fault bucket 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_IOERR_c000000e, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 62b081e0-cb29-416e-9b89-d6e35e223b3a

Problem signature:
P1: ef
P2: ffff800377647140
P3: 0
P4: 0
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\010622-30671-01.dmp
\\?\C:\WINDOWS\TEMP\WER-71203-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3EE8.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3EF9.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F17.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F28.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_ef_30bcb03573651ab68d71c0ac202520fa6dd13a6_00000000_cab_eb88f1b7-f074-40fc-bc5e-876a24cbb17b

Analysis symbol: 
Rechecking for solution: 0
Report Id: 53b459f2-1c05-4626-953f-ed9a516a0b43
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
1/6/2022 3:40 AM    Windows Error Reporting    Fault bucket 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_c0000005_nt!PspCatchCriticalBreak, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: c05d8c99-d8cc-4cf2-a96a-acefd5c9409f

Problem signature:
P1: ef
P2: ffffc40d14819080
P3: 0
P4: 0
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\010522-33968-01.dmp
\\?\C:\WINDOWS\TEMP\WER-74328-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER482F.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4840.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER485E.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER48BD.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_ef_80b079d2b0db87e9884fdec4a6f73b9e6f975be_00000000_cab_183b9878-1d95-48b3-9c50-82d855de712a

Analysis symbol: 
Rechecking for solution: 0
Report Id: b03bf233-98ec-4610-9a00-e210ca152e34
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
12/21/2021 12:17 AM    Windows Error Reporting    Fault bucket 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_IOERR_c000000e, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 75f57cf4-e642-424e-aea2-4cc2f5ec6f2f

Problem signature:
P1: ef
P2: ffffb80153a6a0c0
P3: 0
P4: 0
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\121921-32234-01.dmp
\\?\C:\WINDOWS\TEMP\WER-66937-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER27F5.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2806.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2824.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER28A2.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_ef_2e26d038a5e2514978ee51b5445253155f731_00000000_cab_06c4ab02-fc65-497d-af53-01820019c0bd

Analysis symbol: 
Rechecking for solution: 0
Report Id: 4878d5f8-6038-4356-a321-92be3d15d99b
Report Status: 268435460
Hashed bucket: 
Cab Guid: 0
12/14/2021 12:10 PM    Windows Error Reporting    Fault bucket 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_IOERR_c000000e, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 1ffde32e-bfb1-44d8-be20-de74c9df1380

Problem signature:
P1: ef
P2: ffff9506b7e27140
P3: 0
P4: 0
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\121421-28265-01.dmp
\\?\C:\WINDOWS\TEMP\WER-69046-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3515.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3525.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3543.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3554.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_ef_993f30aab9c78668c24431367a41b7f3aca8985c_00000000_cab_e69a09dd-44c0-4512-b915-bb765fa75d0f

Analysis symbol: 
Rechecking for solution: 0
Report Id: 3fc3e083-fe8d-4568-bf51-634cdba37072
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
12/5/2021 1:11 PM    Windows Error Reporting    Fault bucket 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_IOERR_c000000e, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 3a68643c-ccf2-42ad-9da8-6f6ba58e4c68

Problem signature:
P1: ef
P2: ffffa586bca8a140
P3: 0
P4: 0
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\120521-28812-01.dmp
\\?\C:\WINDOWS\TEMP\WER-61062-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC0.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERED1.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREEF.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF00.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_ef_ea927343f3857386cb94db138c7d9defe853a_00000000_cab_5941ce39-35df-4b59-9f3a-72a742ba05cc

Analysis symbol: 
Rechecking for solution: 0
Report Id: 83d933d4-198c-432f-a5c6-2fc9b0e6e740
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
12/4/2021 7:25 AM    Windows Error Reporting    Fault bucket 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_IOERR_c000000e, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 14481624-9be2-4b3a-81a4-9d9a5a9101be

Problem signature:
P1: ef
P2: ffffbb8cfc6aa140
P3: 0
P4: 0
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\120421-28734-01.dmp
\\?\C:\WINDOWS\TEMP\WER-61296-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA7A.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA7B.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA9A.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAAA.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_ef_d004f3f30bc6fa5286ba6851ecfdcc2490186a_00000000_cab_901079d8-20e8-4f64-b3b4-5ec85d1fe103

Analysis symbol: 
Rechecking for solution: 0
Report Id: df9f69a7-8a83-4db0-a4d1-dca1feb45c1d
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
11/28/2021 4:05 AM    Windows Error Reporting    Fault bucket 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_IOERR_c000000e, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: c50ee21a-2aa6-4f32-b4c6-bcb3d4f054c8

Problem signature:
P1: ef
P2: ffffc00b4381b140
P3: 0
P4: 0
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\112721-19500-01.dmp
\\?\C:\WINDOWS\TEMP\WER-58718-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E6.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F7.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER615.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER626.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_ef_17a4a4df6795bfbd2d9a8036a4b1516ccc3a682c_00000000_cab_d9eb0f52-723c-4d7e-a8d8-8f4ea23ea095

Analysis symbol: 
Rechecking for solution: 0
Report Id: 492da782-131e-4d94-868f-8157261630ca
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
11/26/2021 9:44 PM    Windows Error Reporting    Fault bucket 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_IOERR_c000000e, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: ad1993aa-6d22-4378-adec-a2c321444e2d

Problem signature:
P1: ef
P2: ffffb08af8c39140
P3: 0
P4: 0
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\112621-18687-01.dmp
\\?\C:\WINDOWS\TEMP\WER-61562-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER11CD.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER11CE.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER11ED.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER11FD.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_ef_73b47250afd78899ada59d99f5c9b904b67d_00000000_cab_143e3964-997f-429c-a975-5208d29019ef

Analysis symbol: 
Rechecking for solution: 0
Report Id: 4fc1c296-e85b-4398-820a-34f7caeddf10
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
11/24/2021 2:53 PM    Windows Error Reporting    Fault bucket 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_c0000005_nt!PspCatchCriticalBreak, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 537346de-fb78-4dd0-b4de-0552f81c1c97

Problem signature:
P1: ef
P2: ffffe604c0c15140
P3: 0
P4: 0
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\112421-27812-01.dmp
\\?\C:\WINDOWS\TEMP\WER-70187-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3860.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3861.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER388F.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER38A0.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_ef_a48ffde7f14337b249af39be7922ae74da1878_00000000_cab_812f318d-1589-4f50-8dd6-737aadeb975b

Analysis symbol: 
Rechecking for solution: 0
Report Id: 4cc81eae-426d-418f-af3c-804440ae3fd7
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
11/23/2021 4:54 PM    Windows Error Reporting    Fault bucket 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_IOERR_c000000e, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: b3a11661-d4f5-45d0-b178-7b023e573e94

Problem signature:
P1: ef
P2: ffff9b01b52c10c0
P3: 0
P4: 0
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\112321-24437-01.dmp
\\?\C:\WINDOWS\TEMP\WER-64296-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C7C.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C9C.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1CBA.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1CCB.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_ef_6af9553c8676ac6af1e9cbea55470d18912c6a_00000000_cab_ce70eaed-20a6-492e-9950-af4739f24b80

Analysis symbol: 
Rechecking for solution: 0
Report Id: f84cfec6-6ca3-4458-b086-523bc12dd9fc
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
11/20/2021 10:56 AM    Windows Error Reporting    Fault bucket 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_IOERR_c000000e, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: ee54af55-e80b-4ff2-b42f-4b47dcc8c26b

Problem signature:
P1: ef
P2: ffffa10772822080
P3: 0
P4: 0
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\112021-24000-01.dmp
\\?\C:\WINDOWS\TEMP\WER-60984-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA1.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB1.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREDF.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF0.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_ef_454fcbc260b5702b6eeb1d669a41faa669c27d2b_00000000_cab_28570132-d35c-4bf9-a7aa-f02b2aca490d

Analysis symbol: 
Rechecking for solution: 0
Report Id: b3fb7f46-cc85-4cd1-bc90-73a28e4c028d
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
11/19/2021 12:06 PM    Windows Error Reporting    Fault bucket 0x154_c0000006_c000000e_nt!ExFreePool, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 7152ee3f-d1eb-43d7-aef5-352c76fc4cc6

Problem signature:
P1: 154
P2: ffff980fe7e45000
P3: ffffa98283a559b0
P4: 2
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\111921-21593-01.dmp
\\?\C:\WINDOWS\TEMP\WER-65078-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1DA5.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1DB5.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1DE3.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E51.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_154_2845bacc48615277b42ce716a27e94f604a8b11_00000000_cab_eebaeb5c-5533-4dc0-864c-6af2116b162b

Analysis symbol: 
Rechecking for solution: 0
Report Id: 5f589a49-919e-453c-8492-606e92592bc8
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
11/18/2021 4:49 PM    Windows Error Reporting    Fault bucket 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_c0000005_nt!PspCatchCriticalBreak, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: bb11696b-0d42-4a34-b779-d6b236db828b

Problem signature:
P1: ef
P2: ffffe10976bf0140
P3: 0
P4: 0
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\111821-22109-01.dmp
\\?\C:\WINDOWS\TEMP\WER-68218-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F29.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F49.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F77.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FD6.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_ef_52e8d7fc182e80ae7ebbab1213e729455cb2d9_00000000_cab_a6883274-a3c0-4c2f-bf10-9a2e0f3b9ba8

Analysis symbol: 
Rechecking for solution: 0
Report Id: 8a23377b-4f4d-4e1d-980a-6a6b1fc2d817
Report Status: 268959844
Hashed bucket: 
Cab Guid: 0
11/17/2021 2:52 AM    Windows Error Reporting    Fault bucket 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_IOERR_c000000e, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0c9400c0-b46d-4349-bace-6740e490039b

Problem signature:
P1: ef
P2: ffffad8c6bbf4080
P3: 0
P4: 0
P5: 0
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\111621-26046-01.dmp
\\?\C:\WINDOWS\TEMP\WER-61656-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERED0.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE0.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF0E.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF1F.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_ef_2340d5b94bfaec302861a1763271c96a899c3f7_00000000_cab_18e5192a-ce4d-4b4b-bccc-97535a692318

Analysis symbol: 
Rechecking for solution: 0
Report Id: 3d99d15c-9b23-427e-b851-21972cd1d345
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
 
Oh, remember those drivers now, I believe there's another one or two other drivers from a similar ASUS package which used to cause similar problems.
 
Thanks for the suggestions. At the moment I am 6 hours away from the machine and don't have anyone with availability to get there to do the suggested MemTest or SeaTools test. I did check the Kingston SSD Manager and everything shows as good with the drive and the firmware is up to date.
I did remove the AsIO.sys driver mentioned and am hoping that to be the cause as I will have to schedule someone onsite and after business hours for this one. Thanks for the suggestions and I will report back.
 
Still a blue screen after removing AsIO.sys. I am scheduling someone to go onsite to run Memtest but won't be until Thursday. Anything I can do in the meantime?
 
Unfortunately not really, this is most likely going to be either failing RAM or a failing hard disk.
 
So everything with MemTest passed- 2 tests of 4 passes each. I can post results if that is helpful. I also mentioned the SSD reads as healthy and no firmware updates. However, after removing AsIO.sys I have only had the one blue screen shortly after, which prompted my post on Tuesday. Unless you can give me any more instructions I was going to ask user to monitor and leave myself a note to review at the end of next week. Thoughts?
 
I'll monitor it for now and see what happens. If it crashes again, then please upload the new crash dumps.
 
Ok, so I have 2 new minidump files when I checked today- one from Friday afternoon, one from this morning. Can I just attach them here or do I need to submit through the same process as before?
 

Attachments

Both are the same EF bug check as before.

Have you looked at the temps for the CPU, MB and any video cards in this machine?

…………………………………………………………………………………………………………………………………………………………………………………………………………………………


Code: 
Debug session time: Mon Jan 17 10:48:49.149 2022 (UTC - 5:00)
Loading Dump File [C:\BSOD App\SysnativeBSODApps\011722-24015-01.dmp]
Built by: 19041.1.amd64fre.vb_release.191206-1406
System Uptime: 0 days 9:10:06.847
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000EF]CRITICAL_PROCESS_DIED (ef)[/url]
Bugcheck code 000000eF
Arguments: 
Arg1: ffffa48fd5c56140, Process object or thread object
Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.
Arg3: 0000000000000000
Arg4: 0000000000000000
PROCESS_NAME:  csrss.exe
Probably caused by: ntkrnlmp.exe ( nt!PspCatchCriticalBreak+10e )
FAILURE_BUCKET_ID:  0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_dbc0e080_nt!PspCatchCriticalBreak
MaxSpeed:     3200
CurrentSpeed: 3192
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Fri Jan 14 14:28:56.646 2022 (UTC - 5:00)
Loading Dump File [C:\BSOD App\SysnativeBSODApps\011422-21000-01.dmp]
Built by: 19041.1.amd64fre.vb_release.191206-1406
System Uptime: 0 days 3:43:00.344
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000EF]CRITICAL_PROCESS_DIED (ef)[/url]
Bugcheck code 000000eF
Arguments: 
Arg1: ffff830f2b940080, Process object or thread object
Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.
Arg3: 0000000000000000
Arg4: 0000000000000000
PROCESS_NAME:  svchost.exe
Probably caused by: ntkrnlmp.exe ( nt!PspCatchCriticalBreak+10e )
FAILURE_BUCKET_ID:  0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_2c141080_nt!PspCatchCriticalBreak
MaxSpeed:     3200
CurrentSpeed: 3192
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
 
Just now getting back to this as user stopped letting me know it was happening. Apparently it never stopped. Here are CPU & GPU temps but not sure what I am looking for. Should I also upload the latest dump file?

1669499817129.png
 
I know it's a long time ago now, but can you remember what happened just before these BSODs began? If something was working and now it's not, then something has changed. If you can identify what changed then you're halfway home. ;)

Did you open it up for an internal clean for example?
Did you add any new hardware?
Have you ever had the case open?

Did you add any new applications?
Did you update any existing software (including Windows)?
Did you update any drivers? If so how?

You seem to be using a Kaseya management tool. Is your PC managed remotely?
Code: 
KaseyaRemoteControlHost.exe
Process ID: 5436
User: SYSTEM
Domain: NT AUTHORITY
Path: C:\Program Files (x86)\Kaseya\KSAAS106664052940267\Endpoint\KaseyaRemoteControlHost.exe
Memory Usage: 53 MB
Peak Memory Usage: 66 MB

You also seem to be running the Acronis Active Protection service (to protect against ransomware). It might be wise to turn this, and all other Acronis features, off whilst troubleshooting these BSODs.
Code: 
active_protection_service.exe
Process ID: 5292
User: SYSTEM
Domain: NT AUTHORITY
Path: C:\Program Files\Common Files\Acronis\ActiveProtection\active_protection_service.exe
Memory Usage: 14 MB
Peak Memory Usage: 136 MB
 
ubuysa said:
I know it's a long time ago now, but can you remember what happened just before these BSODs began? If something was working and now it's not, then something has changed. If you can identify what changed then you're halfway home. ;)

Did you open it up for an internal clean for example?
Did you add any new hardware?
Have you ever had the case open?

Did you add any new applications?
Did you update any existing software (including Windows)?
Did you update any drivers? If so how?

You seem to be using a Kaseya management tool. Is your PC managed remotely?
Code: 
KaseyaRemoteControlHost.exe
Process ID: 5436
User: SYSTEM
Domain: NT AUTHORITY
Path: C:\Program Files (x86)\Kaseya\KSAAS106664052940267\Endpoint\KaseyaRemoteControlHost.exe
Memory Usage: 53 MB
Peak Memory Usage: 66 MB

You also seem to be running the Acronis Active Protection service (to protect against ransomware). It might be wise to turn this, and all other Acronis features, off whilst troubleshooting these BSODs.
Code: 
active_protection_service.exe
Process ID: 5292
User: SYSTEM
Domain: NT AUTHORITY
Path: C:\Program Files\Common Files\Acronis\ActiveProtection\active_protection_service.exe
Memory Usage: 14 MB
Peak Memory Usage: 136 MB
Click to expand...

I really don't think anything changed but to be honest it has been too long. However, I work for a small MSP and without a boring detail as to why, this is a non-critical non-billed computer so I would have been the one making the changes. Also since it is non-critical and non-billable is why I have so many gaps in responses as in keeps getting bumped down the list. I do know at one point we added a larger SSD but that was either an attempt to resolve or well before the problem began occurring.

I do manage the computer remotely through Kaseya.

I will turn off Acronis services while testing but I also believed this was something I tried at first as it is known to cause BSODs sometimes.

x BlueRobot said:
Could you please provide the latest dump files?
Click to expand...

I have attached the last 3 dump files.
 

Attachments

The dump files are the same as before apart from a Stop 0x154. I suspect the issue is still hardware. Does the system crash at all within Safe Mode with Networking?
 
x BlueRobot said:
The dump files are the same as before apart from a Stop 0x154. I suspect the issue is still hardware. Does the system crash at all within Safe Mode with Networking?
Click to expand...

I am going to start tonight putting it in Safe Mode with Networking each night as the crashes seem pretty consistent in the morning hours. The end user will have to switch back during the day as certain things she needs do not work in safe mode. I'll give it at least a couple days of this and see if crashes still occur.
 
So far I have not had crashes with Safe Mode with networking, but I still cannot pinpoint any hardware failures based on diagnostic tests. Any suggestions?
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top