BSOD windows 8 with Windows defender

enterprised1 · Apr 13, 2013

I'm having the same issue as this guy. Whenever the computer is idle and Windows Defender begins its scan, the computer crashes with the ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY error message. I can also recreate the BSOD by running a manual scan.

I've run the driver verifier and as soon as I restart, it BSOD's with a DRIVER_VERIFIER_IOMANAGER_VIOLATION message pointing to PXHLPA64.sys. Then it goes in a restart loop until I roll back to the saved system state.

I tracked the PxHLPA64.sys file to Adobe Illustrator so I can't exactly uninstall the driver without uninstalling Illustrator. I tried disabling it using autoruns, but it didn't make a difference.

I'm attaching the jcgriff2 and perfmon data. Please let me know if there's anything else I need to upload.

Thank You!

jcgriff2 · Apr 13, 2013

Hi -

Try the link in post #2 for PXHLPA64.sys update from Adobe Forums -

http://forums.adobe.com/message/4891537

For info:

Code:


PxHlpa64.sys           Mon Oct 17 10:29:34 2011 (4E9C3BCE)

http://www.sysnative.com/drivers/driver.php?id=PxHlpa64.sys

Regards. . .

jcgriff2

BSOD SUMMARY

Code:


Debug session time: Sat Apr 13 00:19:38.508 2013 (UTC - 4:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\041213-22666-01.dmp]
Built by: 9200.16551.amd64fre.win8_gdr.130306-1502
System Uptime: 0 days 0:05:06.646
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff880018b3db0, 800000030fc7e963, fffff8801dae6340, 2}
BugCheck Info: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
Bugcheck code 000000fC
Arguments: 
Arg1: fffff880018b3db0, Virtual address for the attempted execute.
Arg2: 800000030fc7e963, PTE contents.
Arg3: fffff8801dae6340, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
BiosVersion = F8n
BiosReleaseDate = 01/07/2011
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = GA-MA790FXT-UD5P
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Fri Apr 12 23:43:29.302 2013 (UTC - 4:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\041213-23758-01.dmp]
Built by: 9200.16551.amd64fre.win8_gdr.130306-1502
System Uptime: 0 days 0:12:45.478
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff8800193cdb0, 800000030fc8b963, fffff8801cf95340, 2}
BugCheck Info: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
Bugcheck code 000000fC
Arguments: 
Arg1: fffff8800193cdb0, Virtual address for the attempted execute.
Arg2: 800000030fc8b963, PTE contents.
Arg3: fffff8801cf95340, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
BiosVersion = F8n
BiosReleaseDate = 01/07/2011
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = GA-MA790FXT-UD5P
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Fri Apr 12 23:29:51.546 2013 (UTC - 4:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\041213-22042-01.dmp]
Built by: 9200.16551.amd64fre.win8_gdr.130306-1502
System Uptime: 0 days 1:36:05.331
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff880018ccdb0, 800000030fc8b963, fffff8801c591340, 2}
BugCheck Info: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
Bugcheck code 000000fC
Arguments: 
Arg1: fffff880018ccdb0, Virtual address for the attempted execute.
Arg2: 800000030fc8b963, PTE contents.
Arg3: fffff8801c591340, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
BiosVersion = F8n
BiosReleaseDate = 01/07/2011
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = GA-MA790FXT-UD5P
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Fri Apr 12 21:52:55.197 2013 (UTC - 4:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\041213-21060-01.dmp]
Built by: 9200.16551.amd64fre.win8_gdr.130306-1502
System Uptime: 0 days 1:57:06.828
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff88001945db0, 800000030fc8b963, fffff8801c716340, 2}
BugCheck Info: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
Bugcheck code 000000fC
Arguments: 
Arg1: fffff88001945db0, Virtual address for the attempted execute.
Arg2: 800000030fc8b963, PTE contents.
Arg3: fffff8801c716340, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
BiosVersion = F8n
BiosReleaseDate = 01/07/2011
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = GA-MA790FXT-UD5P
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Fri Apr 12 10:50:44.273 2013 (UTC - 4:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\041213-20810-01.dmp]
Built by: 9200.16551.amd64fre.win8_gdr.130306-1502
System Uptime: 0 days 0:02:56.084
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff880014dbdb0, 800000030fc8b963, fffff8801d525340, 2}
BugCheck Info: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
Bugcheck code 000000fC
Arguments: 
Arg1: fffff880014dbdb0, Virtual address for the attempted execute.
Arg2: 800000030fc8b963, PTE contents.
Arg3: fffff8801d525340, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
BiosVersion = F8n
BiosReleaseDate = 01/07/2011
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = GA-MA790FXT-UD5P
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Fri Apr 12 10:02:56.267 2013 (UTC - 4:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\041213-25911-01.dmp]
Built by: 9200.16551.amd64fre.win8_gdr.130306-1502
System Uptime: 0 days 1:41:29.631
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff8800195edb0, 800000030fc7e963, fffff8801db79340, 2}
BugCheck Info: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
Bugcheck code 000000fC
Arguments: 
Arg1: fffff8800195edb0, Virtual address for the attempted execute.
Arg2: 800000030fc7e963, PTE contents.
Arg3: fffff8801db79340, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
BiosVersion = F8n
BiosReleaseDate = 01/07/2011
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = GA-MA790FXT-UD5P
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Fri Apr 12 08:20:35.566 2013 (UTC - 4:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\041213-27658-01.dmp]
Built by: 9200.16551.amd64fre.win8_gdr.130306-1502
System Uptime: 0 days 0:12:30.595
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff88001946db0, 800000030fc7e963, fffff8801cdf0340, 2}
BugCheck Info: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
Bugcheck code 000000fC
Arguments: 
Arg1: fffff88001946db0, Virtual address for the attempted execute.
Arg2: 800000030fc7e963, PTE contents.
Arg3: fffff8801cdf0340, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
BiosVersion = F8n
BiosReleaseDate = 01/07/2011
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = GA-MA790FXT-UD5P
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Fri Apr 12 08:07:13.904 2013 (UTC - 4:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\041213-25365-01.dmp]
Built by: 9200.16551.amd64fre.win8_gdr.130306-1502
System Uptime: 0 days 0:17:44.044
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff880018efdb0, 800000030fc7e963, fffff8801d8ed340, 2}
BugCheck Info: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
Bugcheck code 000000fC
Arguments: 
Arg1: fffff880018efdb0, Virtual address for the attempted execute.
Arg2: 800000030fc7e963, PTE contents.
Arg3: fffff8801d8ed340, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
BiosVersion = F8n
BiosReleaseDate = 01/07/2011
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = GA-MA790FXT-UD5P
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Fri Apr 12 06:58:16.078 2013 (UTC - 4:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\041213-38173-01.dmp]
Built by: 9200.16551.amd64fre.win8_gdr.130306-1502
System Uptime: 0 days 0:00:38.075
*** WARNING: Unable to verify timestamp for PxHlpa64.sys
*** ERROR: Module load completed but symbols could not be loaded for PxHlpa64.sys
Probably caused by : PxHlpa64.sys ( PxHlpa64+307c )
BugCheck C9, {228, fffff880013f507c, fffff9801069ce10, 0}
BugCheck Info: DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
Bugcheck code 000000c9
Arguments: 
Arg1: 0000000000000228, A driver's completion routine has not marked the IRP pending if the
	PendingReturned field was set in the IRP passed to it. This may cause the OS
	to hang, especially if an error is returned by the stack.
Arg2: fffff880013f507c, The address in the driver's code where the error was detected.
Arg3: fffff9801069ce10, IRP address.
Arg4: 0000000000000000
BUGCHECK_STR:  0xc9_228
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_0xc9_228_VRFK_PxHlpa64+307c
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Tue Apr  9 06:37:29.479 2013 (UTC - 4:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\040913-23493-01.dmp]
Built by: 9200.16496.amd64fre.win8_gdr.130108-1504
System Uptime: 0 days 11:42:21.732
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff880018d9db0, 800000030fc7e963, fffff88021f72360, 2}
BugCheck Info: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
Bugcheck code 000000fC
Arguments: 
Arg1: fffff880018d9db0, Virtual address for the attempted execute.
Arg2: 800000030fc7e963, PTE contents.
Arg3: fffff88021f72360, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
BiosVersion = F8n
BiosReleaseDate = 01/07/2011
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = GA-MA790FXT-UD5P
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sun Apr  7 06:56:36.901 2013 (UTC - 4:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\040713-22776-01.dmp]
Built by: 9200.16496.amd64fre.win8_gdr.130108-1504
System Uptime: 0 days 5:14:51.917
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff88001973db0, 800000030fc7e963, fffff88020f33360, 2}
BugCheck Info: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
Bugcheck code 000000fC
Arguments: 
Arg1: fffff88001973db0, Virtual address for the attempted execute.
Arg2: 800000030fc7e963, PTE contents.
Arg3: fffff88020f33360, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
BiosVersion = F8n
BiosReleaseDate = 01/07/2011
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = GA-MA790FXT-UD5P
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sat Apr  6 07:11:55.771 2013 (UTC - 4:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\040613-22947-01.dmp]
Built by: 9200.16496.amd64fre.win8_gdr.130108-1504
System Uptime: 0 days 19:07:53.070
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff8800192bdb0, 800000030fc7e963, fffff88020f48360, 2}
BugCheck Info: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
Bugcheck code 000000fC
Arguments: 
Arg1: fffff8800192bdb0, Virtual address for the attempted execute.
Arg2: 800000030fc7e963, PTE contents.
Arg3: fffff88020f48360, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
BiosVersion = F8n
BiosReleaseDate = 01/07/2011
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = GA-MA790FXT-UD5P
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

         
       J. C. Griffith, Microsoft MVP (jcgriff2)   
             
           [url]https://mvp.support.microsoft.com/profile/Griffith[/url]   

           [url]www.sysnative.com[/url]
             
           [url]www.jcgriff2.com[/url] 


¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨

enterprised1 · Apr 23, 2013

None of the updates for Pxhlpa.sys worked so I used autoruns to disable it and Driver Verifier ran without issue. I left Driver Verifier enabled for about a week and it didn't crash. So yesterday, I turned it off. Now the crashes return whenever I leave the computer idle or do a manual Windows Defender scan. Any ideas as to why that would be?

Also, the problem seems to be similar, if not the same as the one in this post. Let me know if you'd prefer to work off that thread and I'll just post my updates there.

Thanks!

Search

Search

BSOD windows 8 with Windows defender

enterprised1

New member

Attachments

jcgriff2

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)

enterprised1

New member

BSOD windows 8 with Windows defender

enterprised1

New member

Attachments

jcgriff2

Co-Founder / AdminBSOD Instructor/ExpertMicrosoft MVP (Ret.)

enterprised1

New member

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)