[SOLVED] Multiple BSOD Codes and Instances Over The Past Week

RaiseTheCurve · Dec 29, 2013

Hi there! I hope I'm in the right place. I'm not exactly computer illiterate but I'm losing my mind with this.

System:
Dell all OEM Inspiron 5520 13 months old

Speccy snap attached for system rundown

I have no idea what the serial number is on this puppy because the heat generated has melted all the stickers off (as well as stressed and cracked away most of the casing around the vent)

I appreciate any help you kind folks can throw my way. The two programs that I can reliably recreate the BSODs with are Vuze and Bluestacks (android emulator). Only a Vuze minidump is attached because, for the life of me, I can't recreate the Bluestacks crash this morning.

I need to know what driver(s) I'm looking at (and a pointer to the replacement, if you would be so kind, once uninstalled) and/or whether I need to go shopping for some RAM before this machine gets torn to pieces by all these hard stops.

Much love to y'all. Happy holidays!

--Matt

Attached (Compressed):
SPECCY SNAP.zip
BSOD FILE COLLECTION.zip
SYSTEM HEALTH REPORT.zip
VERIFIER-ENABLED BSOD MINIDUMP.zip

TomasD · Dec 29, 2013

Hello,

first, thanks for a great first post - it has all the information we need.

The BSODs are caused by mcdbus.sys driver, which belongs to MagicISO:

Code:

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000081, MmMapLockedPages called without MDL_MAPPING_CAN_FAIL
Arg2: fffffa800b7f2f40, MDL address.
Arg3: 000000000000008a, MDL flags.
Arg4: 0000000000000000, 0.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_81

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  System

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

LAST_CONTROL_TRANSFER:  from fffff800033034ec to fffff80002e76bc0

STACK_TEXT:  
fffff880`035fc328 fffff800`033034ec : 00000000`000000c4 00000000`00000081 fffffa80`0b7f2f40 00000000`0000008a : nt!KeBugCheckEx
fffff880`035fc330 fffff800`033168fa : fffffa80`0b7f2f40 00000000`00000002 fffffa80`0c73d560 fffff880`035fd000 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`035fc370 fffff880`04836823 : fffffa80`08122e10 fffff980`36996fc0 fffffa80`0c1f6750 fffff880`000007ad : nt!VerifierMmMapLockedPages+0x4a
fffff880`035fc3b0 fffffa80`08122e10 : fffff980`36996fc0 fffffa80`0c1f6750 fffff880`000007ad fffffa80`08122e10 : [B]mcdbus+0x36823[/B]
fffff880`035fc3b8 fffff980`36996fc0 : fffffa80`0c1f6750 fffff880`000007ad fffffa80`08122e10 fffffa80`08122ee0 : 0xfffffa80`08122e10
fffff880`035fc3c0 fffffa80`0c1f6750 : fffff880`000007ad fffffa80`08122e10 fffffa80`08122ee0 fffff880`035fc960 : 0xfffff980`36996fc0
fffff880`035fc3c8 fffff880`000007ad : fffffa80`08122e10 fffffa80`08122ee0 fffff880`035fc960 fffff980`36996fc0 : 0xfffffa80`0c1f6750
fffff880`035fc3d0 fffffa80`08122e10 : fffffa80`08122ee0 fffff880`035fc960 fffff980`36996fc0 fffffa80`0c73d6b0 : 0xfffff880`000007ad
fffff880`035fc3d8 fffffa80`08122ee0 : fffff880`035fc960 fffff980`36996fc0 fffffa80`0c73d6b0 fffff880`035fc970 : 0xfffffa80`08122e10
fffff880`035fc3e0 fffff880`035fc960 : fffff980`36996fc0 fffffa80`0c73d6b0 fffff880`035fc970 fffffa80`00000000 : 0xfffffa80`08122ee0
fffff880`035fc3e8 fffff980`36996fc0 : fffffa80`0c73d6b0 fffff880`035fc970 fffffa80`00000000 fffff980`36996fe8 : 0xfffff880`035fc960
fffff880`035fc3f0 fffffa80`0c73d6b0 : fffff880`035fc970 fffffa80`00000000 fffff980`36996fe8 fffffa80`0b74a600 : 0xfffff980`36996fc0
fffff880`035fc3f8 fffff880`035fc970 : fffffa80`00000000 fffff980`36996fe8 fffffa80`0b74a600 fffff800`0331501d : 0xfffffa80`0c73d6b0
fffff880`035fc400 fffffa80`00000000 : fffff980`36996fe8 fffffa80`0b74a600 fffff800`0331501d fffffa80`08122e10 : 0xfffff880`035fc970
fffff880`035fc408 fffff980`36996fe8 : fffffa80`0b74a600 fffff800`0331501d fffffa80`08122e10 00000000`00000002 : 0xfffffa80`00000000
fffff880`035fc410 fffffa80`0b74a600 : fffff800`0331501d fffffa80`08122e10 00000000`00000002 fffffa80`6264636d : 0xfffff980`36996fe8
fffff880`035fc418 fffff800`0331501d : fffffa80`08122e10 00000000`00000002 fffffa80`6264636d fffffa80`0c73d560 : 0xfffffa80`0b74a600
fffff880`035fc420 fffff880`048362db : 00000000`000003b6 fffffa80`0bd05280 00000000`00000000 00000000`00003b60 : nt!VerifierExAllocatePoolWithTag+0x1d
fffff880`035fc460 00000000`000003b6 : fffffa80`0bd05280 00000000`00000000 00000000`00003b60 fffffa80`0b759e00 : mcdbus+0x362db
fffff880`035fc468 fffffa80`0bd05280 : 00000000`00000000 00000000`00003b60 fffffa80`0b759e00 00000000`00000801 : 0x3b6
fffff880`035fc470 00000000`00000000 : 00000000`00003b60 fffffa80`0b759e00 00000000`00000801 fffffa80`0bd05010 : 0xfffffa80`0bd05280


STACK_COMMAND:  kb

FOLLOWUP_IP: 
mcdbus+36823
fffff880`04836823 ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  mcdbus+36823

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: mcdbus

IMAGE_NAME:  [B]mcdbus.sys[/B]

DEBUG_FLR_IMAGE_TIMESTAMP:  49a3cd1f

FAILURE_BUCKET_ID:  X64_0xc4_81_VRF_mcdbus+36823

BUCKET_ID:  X64_0xc4_81_VRF_mcdbus+36823

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xc4_81_vrf_mcdbus+36823

FAILURE_ID_HASH:  {dbd46518-5081-2d73-86df-a4a15e2eb197}

Followup: MachineOwner

Code:

start             end                 module name
fffff880`04800000 fffff880`0483c880   mcdbus   T (no symbols)           
    Loaded symbol image file: mcdbus.sys
    Image path: \SystemRoot\system32\DRIVERS\mcdbus.sys
    Image name: mcdbus.sys
    Browse all global symbols  functions  data
    Timestamp:        [B]Tue Feb 24 12:34:07 2009[/B] (49A3CD1F)
    CheckSum:         00041E84
    ImageSize:        0003C880
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

As you can see, the driver dates back to Feb 2009, so it's very likely to have compatibility problems with Windows 7. I would recommend you to do one of the following:

Update the application to upgrade the application (anyhow, it doesn't seem to be supported since Feb 2010)
Replace it with some other alternative
Remove it if it's not essential.

RaiseTheCurve · Dec 29, 2013

TomasD said:
Hello,

first, thanks for a great first post - it has all the information we need.

The BSODs are caused by mcdbus.sys driver, which belongs to MagicISO:

TomasD said:
As you can see, the driver dates back to Feb 2009, so it's very likely to have compatibility problems with Windows 7. I would recommend you to do one of the following:

Update the application to upgrade the application (anyhow, it doesn't seem to be supported since Feb 2010)

Replace it with some other alternative

Remove it if it's not essential.

Hi Tomas,

Thank you very much for your help!!

My pleasure, regarding the "great first post" -- I did a lot of scouring around here (great forum!) to try and discern the problem myself.

As far as the driver, that's awesome news because MagicISO is not necessary, just a way to set up a virtual optical drive to mount ISOs on. My guess is: a recent Windows update decided to not play nice with the old warhorse, because it's worked flawlessly for years.

While I was sleeping, another BSOD event occurred. If you could do me the great favor of taking a quick look at it -- just to verify there was no other driver involved -- I would really appreciate it.

Thank you again, so much!

--Matt

Attached (compressed):
VERIFIER-ENABLED BSOD MINIDUMP 2.zip

TomasD · Dec 29, 2013

Hi,

The latest BSOD is still caused by the same mcdbus.sys driver:

Code:

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000081, MmMapLockedPages called without MDL_MAPPING_CAN_FAIL
Arg2: fffffa8012f16540, MDL address.
Arg3: 000000000000008a, MDL flags.
Arg4: 0000000000000000, 0.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_81

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  System

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

LAST_CONTROL_TRANSFER:  from fffff800033074ec to fffff80002e7abc0

STACK_TEXT:  
fffff880`035cb328 fffff800`033074ec : 00000000`000000c4 00000000`00000081 fffffa80`12f16540 00000000`0000008a : nt!KeBugCheckEx
fffff880`035cb330 fffff800`0331a8fa : fffffa80`12f16540 00000000`00000002 fffffa80`0bcd9300 fffff880`035cc000 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`035cb370 fffff880`04e36823 : fffffa80`1237d2a0 fffff981`1d3e0fc0 fffffa80`0bb38420 fffff880`000007ad : nt!VerifierMmMapLockedPages+0x4a
fffff880`035cb3b0 fffffa80`1237d2a0 : fffff981`1d3e0fc0 fffffa80`0bb38420 fffff880`000007ad fffffa80`1237d2a0 : [B]mcdbus[/B]+0x36823
fffff880`035cb3b8 fffff981`1d3e0fc0 : fffffa80`0bb38420 fffff880`000007ad fffffa80`1237d2a0 fffffa80`1237d370 : 0xfffffa80`1237d2a0
fffff880`035cb3c0 fffffa80`0bb38420 : fffff880`000007ad fffffa80`1237d2a0 fffffa80`1237d370 fffff880`035cb960 : 0xfffff981`1d3e0fc0
fffff880`035cb3c8 fffff880`000007ad : fffffa80`1237d2a0 fffffa80`1237d370 fffff880`035cb960 fffff981`1d3e0fc0 : 0xfffffa80`0bb38420
fffff880`035cb3d0 fffffa80`1237d2a0 : fffffa80`1237d370 fffff880`035cb960 fffff981`1d3e0fc0 fffffa80`0bcd9450 : 0xfffff880`000007ad
fffff880`035cb3d8 fffffa80`1237d370 : fffff880`035cb960 fffff981`1d3e0fc0 fffffa80`0bcd9450 fffff880`035cb970 : 0xfffffa80`1237d2a0
fffff880`035cb3e0 fffff880`035cb960 : fffff981`1d3e0fc0 fffffa80`0bcd9450 fffff880`035cb970 fffffa80`00000000 : 0xfffffa80`1237d370
fffff880`035cb3e8 fffff981`1d3e0fc0 : fffffa80`0bcd9450 fffff880`035cb970 fffffa80`00000000 fffff981`1d3e0fe8 : 0xfffff880`035cb960
fffff880`035cb3f0 fffffa80`0bcd9450 : fffff880`035cb970 fffffa80`00000000 fffff981`1d3e0fe8 fffffa80`15280f00 : 0xfffff981`1d3e0fc0
fffff880`035cb3f8 fffff880`035cb970 : fffffa80`00000000 fffff981`1d3e0fe8 fffffa80`15280f00 fffff800`0331901d : 0xfffffa80`0bcd9450
fffff880`035cb400 fffffa80`00000000 : fffff981`1d3e0fe8 fffffa80`15280f00 fffff800`0331901d fffffa80`1237d2a0 : 0xfffff880`035cb970
fffff880`035cb408 fffff981`1d3e0fe8 : fffffa80`15280f00 fffff800`0331901d fffffa80`1237d2a0 00000000`00000002 : 0xfffffa80`00000000
fffff880`035cb410 fffffa80`15280f00 : fffff800`0331901d fffffa80`1237d2a0 00000000`00000002 fffffa80`6264636d : 0xfffff981`1d3e0fe8
fffff880`035cb418 fffff800`0331901d : fffffa80`1237d2a0 00000000`00000002 fffffa80`6264636d fffffa80`0bcd9300 : 0xfffffa80`15280f00
fffff880`035cb420 fffff880`04e362db : 00000000`00000000 fffff880`0442cf08 00000000`00000000 00000000`00000000 : nt!VerifierExAllocatePoolWithTag+0x1d
fffff880`035cb460 00000000`00000000 : fffff880`0442cf08 00000000`00000000 00000000`00000000 00000000`00000000 : [B]mcdbus[/B]+0x362db


STACK_COMMAND:  kb

FOLLOWUP_IP: 
mcdbus+36823
fffff880`04e36823 ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  mcdbus+36823

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: [B]mcdbus[/B]

IMAGE_NAME:  [B]mcdbus.sys[/B]

DEBUG_FLR_IMAGE_TIMESTAMP:  49a3cd1f

FAILURE_BUCKET_ID:  X64_0xc4_81_VRF_mcdbus+36823

BUCKET_ID:  X64_0xc4_81_VRF_mcdbus+36823

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xc4_81_vrf_mcdbus+36823

FAILURE_ID_HASH:  {dbd46518-5081-2d73-86df-a4a15e2eb197}

Followup: MachineOwner

Have you rebooted the computer after removing MagicISO? If you did, it's possible the uninstaller still left the driver. To be sure, you can disable it by following these steps:

Download Autoruns
Extract the files and launch autoruns.exe
Once launched, click File -> Run as Administrator
Navigate to Drivers tab
Find and uncheck mcdbus.sys
Reboot the computer

RaiseTheCurve · Dec 29, 2013

TomasD said:
Hi,

The latest BSOD is still caused by the same mcdbus.sys driver:

TomasD said:
Have you rebooted the computer after removing MagicISO? If you did, it's possible the uninstaller still left the driver. To be sure, you can disable it by following these steps:

Download Autoruns

Extract the files and launch autoruns.exe

Once launched, click File -> Run as Administrator

Navigate to Drivers tab

Find and uncheck mcdbus.sys

Reboot the computer

Hi Tomas,

No, I had not even attempted an uninstall at that point. I went to sleep immediately after my OP. The second event occurred before I had a chance to check your first reply. I am uninstalling using REVO right now, and will use AUTORUNS if necessary (thanks for that tip).

Thanks a billion for checking the second dump. I hope this solves all the problems. I was fearful there was more than one driver involved because of differing BSOD codes over the week.

Have a wonderful rest of the evening!

--Matt

TomasD · Dec 29, 2013

RaiseTheCurve said:
Hi Tomas,

No, I had not even attempted an uninstall at that point. I went to sleep immediately after my OP. The second event occurred before I had a chance to check your first reply. I am uninstalling using REVO right now, and will use AUTORUNS if necessary (thanks for that tip).

Thanks a billion for checking the second dump. I hope this solves all the problems. I was fearful there was more than one driver involved because of differing BSOD codes over the week.

Have a wonderful rest of the evening!

--Matt

It's always a possibility there might be something else involved, but at the moment I see an issue with mcdbus.sys and we need to get it resolved. If you get other BSODs afterwards, we will continue troubleshooting ;-)

Please let us know the results and have a nice evening as well.

RaiseTheCurve · Dec 29, 2013

TomasD said:
Please let us know the results...

Hi Tomas!

Everything is running smoothly. =)

I've been stressing the system as much as I can with all of the software that previously initiated a crash and things are awesome. I dare say I even see an increase in responsiveness.

I uninstalled both MagicISO and MagicDisc with REVO, rebooted the system and ran DriverView to verify the errant driver was nowhere to be found, and then replaced the outdated virtual optical drive software with Slysoft's CloneDrive freeware. I hope this helps anyone who finds themselves in my position in future, since the incompatibility of the Magic tools seems to be a new development.

Thank you again for your quick and insightful help!

All the best,

--Matt

RaiseTheCurve · Dec 30, 2013

Two explorer freezes and a BSOD in the last hour. At least I made it six hours.
I'm re-enabling Verifier and will upload documentation when I can catch one. =)

RaiseTheCurve · Dec 30, 2013

As I so love saying: Fish on!

I caught one. Here's the data. I upgraded my chipset and bluetooth wireless drivers through dell's website, so I've attached updated collection and perf files as well. I can't wait to hear the news on this one. =)

All the best,

--Matt

Attached (compressed):
BSOD COLLECTION 2.zip
SYSTEM HEALTH REPORT 2.zip
VERIFIER-ENABLED BSOD MINIDUMP 3.zip

TomasD · Dec 30, 2013

Hi Matt,

The recent BSOD seems to be related to networx.sys driver, which belongs to SoftPerfect NetWorx application. A quick Google search shows that this driver is quite known for causing crashes.

Could you please remove the application? If you still need it, you can reinstall it back, but without "Install LAN traffic filtering driver" option.

RaiseTheCurve · Dec 30, 2013

Wow. That's insane. Now that I think about it, all of these problems began occurring exactly the day I decided to try the LAN filtering option for the first time. It allows Networx to track data usage by application, rather than by gross volume. Do you think I can just deselect that option rather than uninstalling? [Edit: Never mind that. I'll uninstall and reinstall as requested.]

Thanks, Tomas!

TomasD · Dec 30, 2013

RaiseTheCurve said:
Wow. That's insane. Now that I think about it, all of these problems began occurring exactly the day I decided to try the LAN filtering option for the first time. It allows Networx to track data usage by application, rather than by gross volume. Do you think I can just deselect that option rather than uninstalling?

I'm not sure if the application allows deselecting it now. Even it does, it's still possible it leaves the driver loaded.

As I said, you can remove the application and then install it again without filtering driver. Also, you can try disabling the driver using Autoruns, but it's possible NetworkX application will stop working or start throwing error messages.

RaiseTheCurve · Dec 30, 2013

Alright, sir! Done and done. Re-installed without the LAN driver. =)

Thanks again. I've seen more blue screens and system hangs in the last week than I have in my entire life -- Windows 3.1 to present. Hopefully this solves it, but, just in case, I'm going to leave Verifier on this time, lol.

All the best to you, and a Happy New Year, for sure!

--Matt

TomasD · Dec 30, 2013

Perfect. If you won't see any new BSODs after few days, don't forget to disable Driver Verifier and mark this topic as solved.

Happy new year!

[SOLVED] Multiple BSOD Codes and Instances Over The Past Week

RaiseTheCurve

Member

Attachments

TomasD

Sysnative Staff, BSOD Kernel Dump Senior Analyst

RaiseTheCurve

Member

Attachments

TomasD

Sysnative Staff, BSOD Kernel Dump Senior Analyst

RaiseTheCurve

Member

TomasD

Sysnative Staff, BSOD Kernel Dump Senior Analyst

RaiseTheCurve

Member

RaiseTheCurve

Member

RaiseTheCurve

Member

Attachments

TomasD

Sysnative Staff, BSOD Kernel Dump Senior Analyst

RaiseTheCurve

Member

TomasD

Sysnative Staff, BSOD Kernel Dump Senior Analyst

RaiseTheCurve

Member

TomasD

Sysnative Staff, BSOD Kernel Dump Senior Analyst