[SOLVED] BSOD Driver Error (?) after Firefox Search

B

Blackcrimson

Member
Joined
Mar 13, 2022
Posts
10
This thread is a duplicate of the following thread on Techsupport Forum: https://www.techsupportforum.com/th...or-after-firefox-search.1258558/#post-7858687


4. Please provide answers for -
· OS - WINDOWS 11
· x64 ?
· WINDOWS 11
· OEM I think
· Approximate age of system: around 1 year or so
· Approximate age: half a year OS reinstall due to SSD breaking (Replaced SSDs)
· Have you re-installed the OS? (Completely, see above)
· CPU 12th Gen Intel(R) Core(TM) i7-12700KF 3.61 GHz
· Video Card RTX-3080TI
· MotherBoard MSI Mag Z690 TOMAHAWK WIFI DDR4
· Power Supply - Be Quiet Straight Power 11 850W 80+ Platinum Mod
· System Manufacturer - ??? Windows?
· Exact model number

DESKTOP (This is a different, new PC from the one my other, older threads are about)

Description of issue: Suddenly Bluescreen with QR code (too quickly to read it all).
I was using Google with Firefox, typed in a search and clicked to Images.
Suddenly a bluescreen.

Der Computer wurde nach einem schwerwiegenden Fehler neu gestartet. Der Fehlercode war: 0x000000e6 (0x0000000000000026, 0x0000000000000000, 0x0000000045050500, 0x0000000000000004). Ein volles Abbild wurde gespeichert in: C:\Windows\Minidump\091923-4968-01.dmp. Berichts-ID: 9315770d-5969-406a-b212-75b993a88f28.


I tried the Sysnative BSOD Collection App but it doesn't create a zip and the window stays open saying "Waiting for System" or somesuch.

I think this is just a minor driver issue of some kind and nothing serious? I only have had this BSOD ever.

I am currently updating "KB5030219" "KB890830" "KB5031217" "KB5030559". Perhaps this will already resolve the issue.

Edit2: I did DISM /online /cleanup-image /scanhealth and it got to 100% and says something in german that the "component memory can be repaired". I think this is good?

Now doing sfc /scannow. Results are: It repaired damaged files. Were those responsible for the BSOD? Or is the BSOD responsible for those files it repaired? I cannot tell.

Edit3: I have looked into the minidump files with bluescreen viewer. In the original dump file that is attached, it is "ntoskrnl.exe" But a second minidump file appeared!
I did not bluescreen! Where does that file come from? Sfc? Update? DISM? In this file, ntoskrnl.exe and FLTMGR.SYS are marked red.

I would like to know, if it can be found out at all, what caused this crash.
I was unable to recreate this crash as of now, and will edit this further to keep everything up to date (Until there is a reply, after which I will update in a reply instead)

I would also like to know how safe the information contained in the BSOD Collection App is. Since anyone logged in can view this and download the attached files, how dangerous is the information in the bsod collection app? (such as network info etc)
But if this is -required- to get help (or to prove that my windows is a legal copy) I can send it via DM, or add it anyways. Just unsure on the security.

I am using Samsung NVMEs and Magician says they are status 'good'. SSD 970 EVO. But I cannot do SMART self scan. Should I install the Samsung NVME Driver?
I seem to only have basic windows NVME drivers? I am not sure.


Specifid Edit for the Sysnative Forum: See the thread on Techsupport.


I have since not had another bluescreen. Attached you will find FOUR files.

1: the minidump of the BSOD
2: A second minidump that I do not know where it came from, because I did not get a BSOD again
3: The Sysnative Collection App result -after- the BSOD but -before- the second Minidump appeared
4: The Sysnative Collection App result after I installed specific drivers, windows update, disabled driver verifier after running it once and restarting, and after having used the sfc and DISM commands to SCANHEALTH, AnalyzeComponentStore, and to fix things.

I suppose the files will tell you everything I've done to attempt to make my pc healthier.


The Sysnative collection app does not close by itself or says it is done, it always says "waiting for SystemInfo" is this bad?
 

Attachments

Hello Blackcrimson,

I am SQx and I will be handling your dumps to help you solve the problem.

Please give me some time to look it over and I will get back to you as soon as possible.
 
Understood. So far, I haven't had another bluescreen, perhaps the scans etc fixed it already, but I won't rest easy until we know what exactly was at fault here. Are bluescreens possible to occur even on a fully healthy system? Just a hiccup?
 
It would really help if you could change your system language to English and run the file collection app again. Most of us on here only read English I'm afraid.

If you've only had a BSOD using Firefox I would suggest you first look for updates to any extensions/add-ons you have installed in the browser. You might even re-try the search that made it BSOD with browser extensions disabled.
 
Once I changed my system language to english on my old PC and it messed with the install paths in some weird way, because Programme becomes 'Program Files' etc.
Will undoing it after the file collection ap undo the folder name changes? Or should I use System Restore after I changed system language, just in case?

The crash only was once, the same search hasn't done those crashes again.
 
The folder that the system zips up should still be in the \documents folder.

Please try and locate the sub-folder named \SysnativeFileCollectionApp -- zip the entire folder up and attach to your next post.

Regards. . .

jcgriff2
 
It worked properly this time. However, be advised, folder names and file names will still be in german. But the app has properly shut down this time, likely because it wanted to be ran on an English system language.

This should have all the info. So far I've not had any more issues, but the real purpose is just to see what actually caused these hiccups, so I know if I actually fixed it, or if I should be worried.
 

Attachments

Hello Blackcrimson,

Sorry for delay.

I checked the dumps and it looks like you are experiencing the issue with Malwarebytes Anti-Ransomware component in the first dump:
Code: 
10: kd> .load pde
=========================================================================================
 PDE v11.3 - Copyright 2017 Andrew Richards
=========================================================================================
10: kd> !dpx
Start memory scan  : 0xfffff48b9aabf598 ($csp)
End memory scan    : 0xfffff48b9aac0000 (Kernel Stack Base)

               rcx : 0xfffff80317154300 :  !da ""Break, ignore, zap or remove ? ""
               rsp : 0xfffff48b9aabf598 : 0xfffff80315fc0294 : nt!DbgPrompt+0x44
               rbp : 0xfffff48b9aabf6f0 :  !da ""res..00000152 FLT_DEFERRED_IO_WORKITEM structures..00000000 FLT_GENERIC_WORKITEM...""
0xfffff48b9aabf598 : 0xfffff80315fc0294 : nt!DbgPrompt+0x44
0xfffff48b9aabf5a8 : 0xfffff8031715c010 : FLTMGR!FltvMessageTable
0xfffff48b9aabf5b8 : 0xfffff8031714c5c2 : FLTMGR!RtlStringVPrintfWorkerA+0x2a
0xfffff48b9aabf5d8 : 0xfffff80317154300 :  !da ""Break, ignore, zap or remove ? ""
0xfffff48b9aabf5e8 : 0xfffff8031718ea43 : FLTMGR!FltpvPrintErrors+0x167
0xfffff48b9aabf5f8 : 0xfffff8031715c010 : FLTMGR!FltvMessageTable
0xfffff48b9aabf630 : 0x56205245544c4946 :  !da ""FILTER VERIFIER ERROR:   A filter (Filter = FFFFAE801CA22B90 (MBAMFarflt)) leake...""
0xfffff48b9aabf638 : 0x2052454946495245 :  !da ""ERIFIER ERROR:   A filter (Filter = FFFFAE801CA22B90 (MBAMFarflt)) leaked refere...""
0xfffff48b9aabf640 : 0x20203a524f525245 :  !da ""ERROR:   A filter (Filter = FFFFAE801CA22B90 (MBAMFarflt)) leaked references to ...""
0xfffff48b9aabf648 : 0x65746c6966204120 :  !da "" A filter (Filter = FFFFAE801CA22B90 (MBAMFarflt)) leaked references to the foll...""
0xfffff48b9aabf650 : 0x65746c6946282072 :  !da ""r (Filter = FFFFAE801CA22B90 (MBAMFarflt)) leaked references to the following re...""
0xfffff48b9aabf658 : 0x46464646203d2072 :  !da ""r = FFFFAE801CA22B90 (MBAMFarflt)) leaked references to the following resources:...""
0xfffff48b9aabf660 : 0x3241433130384541 :  !da ""AE801CA22B90 (MBAMFarflt)) leaked references to the following resources:..000000...""
0xfffff48b9aabf668 : 0x424d282030394232 :  !da ""2B90 (MBAMFarflt)) leaked references to the following resources:..00000000 Filte...""
0xfffff48b9aabf670 : 0x746c667261464d41 :  !da ""AMFarflt)) leaked references to the following resources:..00000000 Filter Contex...""
0xfffff48b9aabf678 : 0x656b61656c202929 :  !da "")) leaked references to the following resources:..00000000 Filter Context Struct...""
0xfffff48b9aabf680 : 0x6572656665722064 :  !da ""d references to the following resources:..00000000 Filter Context Structures..00...""
0xfffff48b9aabf688 : 0x206f74207365636e :  !da ""nces to the following resources:..00000000 Filter Context Structures..00000000 F...""
0xfffff48b9aabf690 : 0x6c6c6f6620656874 :  !da ""the following resources:..00000000 Filter Context Structures..00000000 FLT_CALLB...""
0xfffff48b9aabf698 : 0x657220676e69776f :  !da ""owing resources:..00000000 Filter Context Structures..00000000 FLT_CALLBACK_DATA...""
0xfffff48b9aabf6a0 : 0x3a73656372756f73 :  !da ""sources:..00000000 Filter Context Structures..00000000 FLT_CALLBACK_DATA structu...""
0xfffff48b9aabf6a8 : 0x303030303030090a :  !da ""..00000000 Filter Context Structures..00000000 FLT_CALLBACK_DATA structures..000...""
0xfffff48b9aabf6b0 : 0x65746c6946203030 :  !da ""00 Filter Context Structures..00000000 FLT_CALLBACK_DATA structures..00000152 FL...""
0xfffff48b9aabf6b8 : 0x7865746e6f432072 :  !da ""r Context Structures..00000000 FLT_CALLBACK_DATA structures..00000152 FLT_DEFERR...""
0xfffff48b9aabf6c0 : 0x7463757274532074 :  !da ""t Structures..00000000 FLT_CALLBACK_DATA structures..00000152 FLT_DEFERRED_IO_WO...""
0xfffff48b9aabf6c8 : 0x3030090a73657275 :  !da ""ures..00000000 FLT_CALLBACK_DATA structures..00000152 FLT_DEFERRED_IO_WORKITEM s...""
0xfffff48b9aabf6d0 : 0x4620303030303030 :  !da ""000000 FLT_CALLBACK_DATA structures..00000152 FLT_DEFERRED_IO_WORKITEM structure...""
0xfffff48b9aabf6d8 : 0x424c4c41435f544c :  !da ""LT_CALLBACK_DATA structures..00000152 FLT_DEFERRED_IO_WORKITEM structures..00000...""
0xfffff48b9aabf6e0 : 0x415441445f4b4341 :  !da ""ACK_DATA structures..00000152 FLT_DEFERRED_IO_WORKITEM structures..00000000 FLT_...""
0xfffff48b9aabf6e8 : 0x7574637572747320 :  !da "" structures..00000152 FLT_DEFERRED_IO_WORKITEM structures..00000000 FLT_GENERIC_...""
0xfffff48b9aabf6f0 : 0x303030090a736572 :  !da ""res..00000152 FLT_DEFERRED_IO_WORKITEM structures..00000000 FLT_GENERIC_WORKITEM...""
0xfffff48b9aabf6f8 : 0x4c46203235313030 :  !da ""00152 FLT_DEFERRED_IO_WORKITEM structures..00000000 FLT_GENERIC_WORKITEM structu...""
0xfffff48b9aabf700 : 0x5252454645445f54 :  !da ""T_DEFERRED_IO_WORKITEM structures..00000000 FLT_GENERIC_WORKITEM structures..000...""
0xfffff48b9aabf708 : 0x4f575f4f495f4445 :  !da ""ED_IO_WORKITEM structures..00000000 FLT_GENERIC_WORKITEM structures..00000000 FL...""
0xfffff48b9aabf710 : 0x73204d4554494b52 :  !da ""RKITEM structures..00000000 FLT_GENERIC_WORKITEM structures..00000000 FLT_FILE_N...""
0xfffff48b9aabf718 : 0x6572757463757274 :  !da ""tructures..00000000 FLT_GENERIC_WORKITEM structures..00000000 FLT_FILE_NAME_INFO...""
0xfffff48b9aabf720 : 0x3030303030090a73 :  !da ""s..00000000 FLT_GENERIC_WORKITEM structures..00000000 FLT_FILE_NAME_INFORMATION ...""
0xfffff48b9aabf728 : 0x5f544c4620303030 :  !da ""000 FLT_GENERIC_WORKITEM structures..00000000 FLT_FILE_NAME_INFORMATION structur...""
0xfffff48b9aabf730 : 0x5f434952454e4547 :  !da ""GENERIC_WORKITEM structures..00000000 FLT_FILE_NAME_INFORMATION structures..0000...""
0xfffff48b9aabf738 : 0x4d4554494b524f57 :  !da ""WORKITEM structures..00000000 FLT_FILE_NAME_INFORMATION structures..00000000 FIL...""
0xfffff48b9aabf740 : 0x7574637572747320 :  !da "" structures..00000000 FLT_FILE_NAME_INFORMATION structures..00000000 FILE_OBJECT...""
0xfffff48b9aabf748 : 0x303030090a736572 :  !da ""res..00000000 FLT_FILE_NAME_INFORMATION structures..00000000 FILE_OBJECT structu...""
0xfffff48b9aabf750 : 0x4c46203030303030 :  !da ""00000 FLT_FILE_NAME_INFORMATION structures..00000000 FILE_OBJECT structures..000...""
0xfffff48b9aabf758 : 0x4e5f454c49465f54 :  !da ""T_FILE_NAME_INFORMATION structures..00000000 FILE_OBJECT structures..00000000 FL...""
0xfffff48b9aabf760 : 0x4f464e495f454d41 :  !da ""AME_INFORMATION structures..00000000 FILE_OBJECT structures..00000000 FLT_OBJECT...""
0xfffff48b9aabf768 : 0x204e4f4954414d52 :  !da ""RMATION structures..00000000 FILE_OBJECT structures..00000000 FLT_OBJECT structu...""
0xfffff48b9aabf770 : 0x7275746375727473 :  !da ""structures..00000000 FILE_OBJECT structures..00000000 FLT_OBJECT structures..000...""
0xfffff48b9aabf778 : 0x30303030090a7365 :  !da ""es..00000000 FILE_OBJECT structures..00000000 FLT_OBJECT structures..00000000 EC...""
0xfffff48b9aabf780 : 0x4c49462030303030 :  !da ""0000 FILE_OBJECT structures..00000000 FLT_OBJECT structures..00000000 ECP contex...""
0xfffff48b9aabf788 : 0x5443454a424f5f45 :  !da ""E_OBJECT structures..00000000 FLT_OBJECT structures..00000000 ECP context struct...""
0xfffff48b9aabf790 : 0x7574637572747320 :  !da "" structures..00000000 FLT_OBJECT structures..00000000 ECP context structures.Typ...""
0xfffff48b9aabf798 : 0x303030090a736572 :  !da ""res..00000000 FLT_OBJECT structures..00000000 ECP context structures.Type "!fltk...""
0xfffff48b9aabf7a0 : 0x4c46203030303030 :  !da ""00000 FLT_OBJECT structures..00000000 ECP context structures.Type "!fltkd.filter...""
0xfffff48b9aabf7a8 : 0x5443454a424f5f54 :  !da ""T_OBJECT structures..00000000 ECP context structures.Type "!fltkd.filter FFFFAE8...""
0xfffff48b9aabf7b0 : 0x7574637572747320 :  !da "" structures..00000000 ECP context structures.Type "!fltkd.filter FFFFAE801CA22B9...""
0xfffff48b9aabf7b8 : 0x303030090a736572 :  !da ""res..00000000 ECP context structures.Type "!fltkd.filter FFFFAE801CA22B90 8 1" i...""
0xfffff48b9aabf7c0 : 0x4345203030303030 :  !da ""00000 ECP context structures.Type "!fltkd.filter FFFFAE801CA22B90 8 1" in the de...""
0xfffff48b9aabf7c8 : 0x7865746e6f632050 :  !da ""P context structures.Type "!fltkd.filter FFFFAE801CA22B90 8 1" in the debugger f...""
0xfffff48b9aabf7d0 : 0x7463757274732074 :  !da ""t structures.Type "!fltkd.filter FFFFAE801CA22B90 8 1" in the debugger for a lis...""
0xfffff48b9aabf7d8 : 0x7079540a73657275 :  !da ""ures.Type "!fltkd.filter FFFFAE801CA22B90 8 1" in the debugger for a list of lea...""
0xfffff48b9aabf7e0 : 0x6b746c6621222065 :  !da ""e "!fltkd.filter FFFFAE801CA22B90 8 1" in the debugger for a list of leaked re.""
0xfffff48b9aabf7e8 : 0x7265746c69662e64 :  !da ""d.filter FFFFAE801CA22B90 8 1" in the debugger for a list of leaked re.""
0xfffff48b9aabf7f0 : 0x3845414646464620 :  !da "" FFFFAE801CA22B90 8 1" in the debugger for a list of leaked re.""
0xfffff48b9aabf7f8 : 0x3942323241433130 :  !da ""01CA22B90 8 1" in the debugger for a list of leaked re.""
0xfffff48b9aabf800 : 0x6920223120382030 :  !da ""0 8 1" in the debugger for a list of leaked re.""
0xfffff48b9aabf808 : 0x656420656874206e :  !da ""n the debugger for a list of leaked re.""
0xfffff48b9aabf810 : 0x6620726567677562 :  !da ""bugger for a list of leaked re.""
0xfffff48b9aabf818 : 0x73696c206120726f :  !da ""or a list of leaked re.""
0xfffff48b9aabf820 : 0x61656c20666f2074 :  !da ""t of leaked re.""
0xfffff48b9aabf838 : 0xfffff803164c44b3 : nt!VerifierKeReleaseSpinLock+0x43
0xfffff48b9aabf868 : 0xfffff8031718e412 : FLTMGR!FltpvDoLostObjectCheck+0x1f2
0xfffff48b9aabf910 : 0xfffff8031718e220 : FLTMGR!FltpvDoLostObjectCheck
0xfffff48b9aabf938 : 0xfffff80315cbdbd5 : nt!ExpWorkerThread+0x155
0xfffff48b9aabf958 : 0xfffff8031674eac0 : nt!ExNode0
0xfffff48b9aabf988 : 0xfffff8031674eac0 : nt!ExNode0
0xfffff48b9aabf990 : 0xfffff8031674eac0 : nt!ExNode0
0xfffff48b9aabfb28 : 0xfffff80315c17667 : nt!PspSystemThreadStartup+0x57
0xfffff48b9aabfb48 : 0xfffff80315cbda80 : nt!ExpWorkerThread
0xfffff48b9aabfb78 : 0xfffff80315e3c0a4 : nt!KiStartSystemThread+0x34
0xfffff48b9aabfb90 : 0xfffff80315c17610 : nt!PspSystemThreadStartup

10: kd> !PDE.da fffff48b9aabf630
FILTER VERIFIER ERROR:   A filter (Filter = FFFFAE801CA22B90 (MBAMFarflt)) leaked references to the following resources:
    00000000 Filter Context Structures
    00000000 FLT_CALLBACK_DATA structures
    00000152 FLT_DEFERRED_IO_WORKITEM structures
    00000000 FLT_GENERIC_WORKITEM structures
    00000000 FLT_FILE_NAME_INFORMATION structures
    00000000 FILE_OBJECT structures
    00000000 FLT_OBJECT structures
    00000000 ECP context structures
Type "!fltkd.filter FFFFAE801CA22B90 8 1" in the debugger for a list of leaked re


and Malwarebytes Web Protection component in the second one.
Code: 
fffff803`41e7c768  fffff803`ba2e5618Unable to load image mwac.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mwac.sys
 mwac+0x5618

As you can see, Malwarebytes has released a fix today: Malwarebytes 4.6.3.282 component package 1.0.2151

Please update Malwarebytes to fix the issues.

Blackcrimson said:
This thread is a duplicate of the following thread on Techsupport Forum: https://www.techsupportforum.com/th...or-after-firefox-search.1258558/#post-7858687
Click to expand...
Blue Screen Viewer is very limited in how much analysis it can actually do and therefore does not provide sufficient data to base any decent suggestion on. It may indicate the Windows kernel being the cause when in reality a third-party driver is causing the crash.

Blue Screen Viewer can contain a lot of unsorted information which can be confusing. Please ignore it for now.
Blackcrimson said:
I would also like to know how safe the information contained in the BSOD Collection App is. Since anyone logged in can view this and download the attached files, how dangerous is the information in the bsod collection app?
Click to expand...
This tool contains system information, events, list of the drivers and it has been designed to troubleshoot other problems as well such as networking problems, and so on that is needed to find the root cause, it does not contain personal information.


Blackcrimson said:
I am using Samsung NVMEs and Magician says they are status 'good'. SSD 970 EVO. But I cannot do SMART self scan. Should I install the Samsung NVME Driver?I seem to only have basic windows NVME drivers?
Click to expand...
Usually the default driver is sufficient for Windows, but you can install Samsung NVME Driver and try to do SMART self scan.

Blackcrimson said:
The Sysnative collection app does not close by itself or says it is done, it always says "waiting for SystemInfo" is this bad?
Click to expand...

This happens <1% of the time and is caused by excess entries in the WERCON section of Microsoft's msinfo32.
Typically, a reboot can help here. After a reboot msinfo32 should complete.
 
Malwarebytes? That would explain why I bluescreened during -firefox- browsing, I suppose. That makes me much less nervous now. I was worried I had some fault in one of my RAM and the like.

And as a freebie, it animated me to update a few drivers and do some scans, so all should be well now.

Should.

Thanks for the help, I can consider this resolved (for now) and will see if things remain stable. Is it possible to remove the attachments once it seems resolved?
 
Greetings,
Blackcrimson said:
Is it possible to remove the attachments once it seems resolved?
Click to expand...

it's only moderators and administrators can remove attachments. Why you want to remove them?They don't contain any private information?

Please let me know if you have any questions left.
 
Not only do they not contain any personally identifying information, but it can be useful to leave the attachments up for others who are learning to analyse BSODs (or who are just interested) to be able to 'follow along' what the experienced analyst has written here and look at your uploaded data to make sure they understand how they arrived at the resolution.
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top