[SOLVED] BSOD Randomly on multiple pc.

[maai]

Hello All,

I got BSOD issue after wake from sleep/hibernate/working on multiple HP Elitebook 840 G4 with some wireless network environment,
I already research and look into the dump file and looks like ntoskrnl.exe or network driver is the cause.

Step I was taken,
1. Run Malwarebytes - No malware found.
2. Update BIOS - BSOD still persist.
3. Update Wireless driver from Intel (version 20.50) - Issue persists.
4. Update the latest driver from HP website - Issue persists.
5. Swap RAM & SSD - Issue persists.

Spec
OS Name: Microsoft Windows 10 Enterprise
OS Version: 10.0.16299 N/A Build 16299
OS Manufacturer: Microsoft Corporation
OS Configuration: Member Workstation
OS Build Type: Multiprocessor Free

System Manufacturer: HP
System Model: HP EliteBook 840 G4
System Type: x64-based PC
Processor(s): 1 Processor(s) Installed.
[01]: Intel64 Family 6 Model 142 Stepping 9 GenuineIntel ~2611 Mhz
BIOS Version: HP P78 Ver. 01.16, 03/29/2018

Storage: KXG50ZNV256G TOSHIBA SSD nVME m.2 256 GB

Total Physical Memory: 8,071 MB

Hotfix(s): 3 Hotfix(s) Installed.
[01]: KB4088785
[02]: KB4090914
[03]: KB4088776
Network Card(s): 4 NIC(s) Installed.
[01]: Intel(R) Dual Band Wireless-AC 8265
Connection Name: Wi-Fi
DHCP Enabled: Yes

[02]: Intel(R) Ethernet Connection (4) I219-LM
Connection Name: Ethernet
Status: Media disconnected
[03]: Bluetooth Device (Personal Area Network)
Connection Name: Bluetooth Network Connection
Status: Media disconnected
[04]: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Connection Name: Ethernet 2
Status: Hardware not present
Hyper-V Requirements: VM Monitor Mode Extensions: Yes
Virtualization Enabled In Firmware: No
Second Level Address Translation: Yes
Data Execution Prevention Available: Yes


Please find attached 2 sample dump logs for more information. Attachments removed on user request - xilolee.


Thanks in advance for any assistance.

 

[axe0]

Hi Maai,

From the eventlogs of both pc's, it seems a script is failing that is meant to activate Windows on logon.

2018-05-07T08:07:09.310 Logon script failed. GPO Name : Activate Windows via KMSGPO File System Path : \\COMPANYNAME.corp\SysVol\COMPANYNAME.corp\Policies\{962B05CD-6D93-4B3E-B63A-5F570B9C5B22}\UserScript Name: kmsact.bat

I would ask you to install a genuine copy of Windows, we don't provide support until this is done as per the forum rules.

 

[maai]

Dear axe0,

I confirmed you that we use genuine Windows 100%, By the way, I have made a decision to pass the issue to Microsoft and the issue has been solved now

The issue caused by the wireless configuration on the controller.

Thank you.

 

[axe0]

If you say so, I've never seen a batch used for activating Windows on Enterprise systems.

 

[xilolee]

I modified your posts to remove sensible information (on your request).

 

[maai]

Big Thanks Xilolee

---

FYR,

The BSOD issue has been solved by "disable FT 802.11" on the wireless controller.

Here is Bug check analysis for my BSOD Issue,

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000091002, ID of the 'NdisOidDoubleComplete' rule that was violated.
Arg2: fffff800e3002638, A pointer to the string describing the violated rule condition.
Arg3: ffffd805f37ec2c0, Address of internal rule state (second argument to !ruleinfo).
Arg4: ffffd805f37ec398, Address of supplemental states (third argument to !ruleinfo). 
 
Debugging Details:
------------------
 
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
 
KEY_VALUES_STRING: 1
 
 
TIMELINE_ANALYSIS: 1
 
 
DUMP_CLASS: 1
 
DUMP_QUALIFIER: 400
 
BUILD_VERSION_STRING:  10.0.16299.371 (WinBuild.160101.0800)
 
SYSTEM_MANUFACTURER:  HP
 
SYSTEM_PRODUCT_NAME:  HP EliteBook 840 G4
 
SYSTEM_SKU:  X3V00AV
 
BIOS_VENDOR:  HP
 
BIOS_VERSION:  P78 Ver. 01.16
 
BIOS_DATE:  03/29/2018
 
BASEBOARD_MANUFACTURER:  HP
 
BASEBOARD_PRODUCT:  828C
 
BASEBOARD_VERSION:  KBC Version 45.41
 
DUMP_TYPE:  2
 
BUGCHECK_P1: 91002
 
BUGCHECK_P2: fffff800e3002638
 
BUGCHECK_P3: ffffd805f37ec2c0
 
BUGCHECK_P4: ffffd805f37ec398
 
DV_VIOLATED_CONDITION:  Double OID completion detected at NdisMOidRequestComplete.
 
DV_MSDN_LINK: [U][url=https://go.microsoft.com/fwlink/?LinkId=278803]NdisOidDoubleComplete rule (ndis) | Microsoft Docs[/url][/U]
 
DV_RULE_INFO: [U]0x91002[/U]
 
BUGCHECK_STR:  0xc4_NdisOidDoubleComplete_XDV
 
CPU_COUNT: 4
 
CPU_MHZ: a98
 
CPU_VENDOR:  GenuineIntel
 
CPU_FAMILY: 6
 
CPU_MODEL: 8e
 
CPU_STEPPING: 9
 
CPU_MICROCODE: 6,8e,9,0 (F,M,S,R)  SIG: 84'00000000 (cache) 84'00000000 (init)
 
BLACKBOXBSD: 1 ([U]!blackboxbsd[/U])
 
 
CUSTOMER_CRASH_COUNT:  1
 
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
 
PROCESS_NAME:  System
 
CURRENT_IRQL:  2
 
ANALYSIS_SESSION_HOST:  
 
ANALYSIS_SESSION_TIME:  05-07-2018 21:46:09.0501
 
ANALYSIS_VERSION: 10.0.17074.1002 amd64fre
 
LAST_CONTROL_TRANSFER:  from fffff800e2ff52ac to fffff803f21f9930
 
STACK_TEXT:  
ffffc289`41de7578 fffff800`e2ff52ac : 00000000`000000c4 00000000`00091002 fffff800`e3002638 ffffd805`f37ec2c0 : nt!KeBugCheckEx
ffffc289`41de7580 fffff800`e2fe280b : fffff800`e3002638 ffffd805`f37ec2c0 ffffc289`41de7660 ffffd805`f37ec398 : VerifierExt!SLIC_StatefulAbort+0xadc
ffffc289`41de7620 fffff800`e3cc65b8 : fffff800`e6779f20 ffffe986`0eb8ef24 ffffe986`0eb8ef24 00000000`0000007f : VerifierExt!XdvNdisMOidRequestComplete_wrapper+0x11b
ffffc289`41de7690 fffff800`e6779879 : fffff800`e6771c60 00000000`00000093 00000000`00000000 00000000`00000000 : ndis!ndisVerifierNdisMOidRequestComplete+0x28
ffffc289`41de76d0 fffff800`e6771c60 : 00000000`00000093 00000000`00000000 00000000`00000000 ffffd805`0000007f : Netwtw06+0x9879
ffffc289`41de76d8 00000000`00000093 : 00000000`00000000 00000000`00000000 ffffd805`0000007f ffffd805`0000007f : Netwtw06+0x1c60
ffffc289`41de76e0 00000000`00000000 : 00000000`00000000 ffffd805`0000007f ffffd805`0000007f fffff800`00000000 : 0x93
 
 
THREAD_SHA1_HASH_MOD_FUNC:  62060e7c4354c5255a25e3f96b0574e64815b721
 
THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  45e8520459cbd40e10049d08e47f181ebb713b50
 
THREAD_SHA1_HASH_MOD:  ef77ca7668a38cf18d129c297bb89ee7acb7468c
 
FOLLOWUP_IP: 
Netwtw06+9879
fffff800`e6779879 eb05            jmp     Netwtw06+0x9880 (fffff800`e6779880)
 
FAULT_INSTR_CODE:  52e805eb
 
SYMBOL_STACK_INDEX:  4
 
SYMBOL_NAME:  Netwtw06+9879
 
FOLLOWUP_NAME:  MachineOwner
 
MODULE_NAME: [U]Netwtw06[/U]
 
IMAGE_NAME:  Netwtw06.sys
 
DEBUG_FLR_IMAGE_TIMESTAMP:  5ab1363b
 
STACK_COMMAND:  .thread ; .cxr ; kb
 
BUCKET_ID_FUNC_OFFSET:  9879
 
FAILURE_BUCKET_ID:  0xc4_NdisOidDoubleComplete_XDV_VRF_Netwtw06!unknown_function
 
BUCKET_ID:  0xc4_NdisOidDoubleComplete_XDV_VRF_Netwtw06!unknown_function
 
PRIMARY_PROBLEM_CLASS:  0xc4_NdisOidDoubleComplete_XDV_VRF_Netwtw06!unknown_function
 
TARGET_TIME:  2018-05-07T10:41:45.000Z
 
OSBUILD:  16299
 
OSSERVICEPACK:  371
 
SERVICEPACK_NUMBER: 0
 
OS_REVISION: 0
 
SUITE_MASK:  272
 
PRODUCT_TYPE:  1
 
OSPLATFORM_TYPE:  x64
 
OSNAME:  Windows 10
 
OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS
 
OS_LOCALE:  
 
USER_LCID:  0
 
OSBUILD_TIMESTAMP:  2018-03-30 10:22:49
 
BUILDDATESTAMP_STR:  160101.0800
 
BUILDLAB_STR:  WinBuild
 
BUILDOSVER_STR:  10.0.16299.371
 
ANALYSIS_SESSION_ELAPSED_TIME:  1e187
 
ANALYSIS_SOURCE:  KM
 
FAILURE_ID_HASH_STRING:  km:0xc4_ndisoiddoublecomplete_xdv_vrf_netwtw06!unknown_function
 
FAILURE_ID_HASH:  {50782a9b-d80c-3ad8-f9cd-6eaded9368b6}
 
Followup:     MachineOwner