[SOLVED] Need help with Random BSOD

c7c4c7 · Sep 17, 2020

The machine runs fine for a period of time and then, I get the BSOD. Netio gets blamed for the error many times. There is also problems with something writing into a protected are of memory. First time using the new Dump analysis and am lost

Thanks for the help

zbook · Sep 17, 2020

Hi c7c4c7,

Dell support for the computer ended with Windows 7.

The computer has Windows 1607 which ended support on April 10, 2018.
Were there failures to upgrade or had you blocked upgrades?

https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet

In addition to the unsupported Windows version /build other problems identified were misbehaving drivers, recurrent registry hive corruption, and drive problems.

Please perform the following steps:

1) Open administrative command prompt and type or copy and paste:
2) sfc /scannow
3) dism /online /cleanup-image /scanhealth
4) dism /online /cleanup-image /restorehealth
5) sfc /scannow
6) chkdsk /scan
7) wmic recoveros set autoreboot = false
8) wmic recoveros set DebugInfoType = 7
9) wmic recoveros get autoreboot
10) wmic recoveros get DebugInfoType
11) bcdedit /enum {badmemory}

12) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

13) Run HD Tune (free version) (all drives)
HD Tune website
Post images into the thread for results on these tabs:
a) Health
b) Benchmark
c) Full error scan

14) Run Sea Tools for Windows
long generic test
Post an image of the test result into the thread
SeaTools for Windows | Seagate
How to use SeaTools for Windows | Seagate Support US

15) Open administrative command prompt and type or copy and paste:
chkdsk /b /v
This may take hours to run so plan to run overnight.
Run on all drives using the syntax: chkdsk /b /v C: or chkdsk /b /v D: changing the drive letter to the applicable drive.

C:\Windows\system32>chkdsk /b /v
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Type: Y
reboot

16) Use the information in this link to find the chkdsk report in the event viewer.
Copy and paste into notepad > save to desktop > post into the thread using a one drive, drop box, or google drive share link:
Read Chkdsk Log in Event Viewer in Windows 10 Windows 10 Performance Maintenance Tutorials
Read Chkdsk Log in Event Viewer in Windows 10

17) Uninstall Kaspersky AV using the applicable uninstall tool:
Removal tool for Kaspersky applications (kavremover)

18) Uninstall Malwarebytes using the applicable uninstall tool:
https://downloads.malwarebytes.com/file/mb_clean

19) Make sure Windows defender is on

20) Uninstall and reinstall: k57nd60a.sys
Broadcom NetLink (TM) Gigabit Ethernet

(Find a replacement driver before replacing the current driver)

Updating a driver.

k57nd60a.sys

Broadcom NetLink Gigabit Ethernet NDIS6.x Unified Driver

Support Documents and Downloads

21) These steps can be performed overnight:
a) HD Tune full error scan
b) Sea Tools for Windows long generic test
c) Chkdsk

Code:

Driver    c:\windows\system32\drivers\k57nd60a.sys (15.6.1.3, 436.00 KB (446,464 bytes), 7/16/2016 4:41 AM)

Code:

k57nd60a.sys Wed Aug 19 19:16:18 2015 (55D53872)

MrPepka · Sep 18, 2020

Why do you need 2 antiviruses? Remove Kaspersky and leave Malwarebytes alone

x BlueRobot · Sep 18, 2020

I would start with removing Kaspersky using their removal tool - Removal tool for Kaspersky applications (kavremover)

Please ensure that you reboot the system and then see if the crashes continue. I believe that Kaspersky is most likely the main culprit here.

Rich (BB code):

1: kd> lmvm klwtp
Browse full module list
start             end                 module name
fffff801`380a0000 fffff801`380d1000   klwtp    T (no symbols)           
    Loaded symbol image file: klwtp.sys
    Image path: \SystemRoot\system32\DRIVERS\klwtp.sys
    Image name: klwtp.sys
    Browse all global symbols  functions  data
    Timestamp:        Sun May  6 00:17:19 2007 (463D107F)
    CheckSum:         0003A368
    ImageSize:        00031000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

It seems that the driver attempted to reference an address which was already paged out, which resulted in an illegal page fault.

Rich (BB code):

1: kd> !pte ffff8207cc20ba50
                                           VA ffff8207cc20ba50
PXE at FFFFF57ABD5EA820    PPE at FFFFF57ABD5040F8    PDE at FFFFF57AA081F308    PTE at FFFFF54103E61058
contains 00000000003CF863  contains 0000000000000000
pfn 3cf       ---DA--KWEV  contains 0000000000000000
not valid

zbook · Sep 18, 2020

Kaspersky appears to be the cause of the BSODs.

The logs displayed Malwarebytes registry hive and faulting application problems:

Code:

Event[2445]:
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2020-08-01T17:55:16.668
  Event ID: 5
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: Marilyn-PC
  Description:
{Registry Hive Recovered} Registry hive (file): '\??\C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\S-1-5-21-1943052622-2247614736-1185404217-1000-08012020175516471-ntuser.dat' was corrupted and it has been recovered. Some data might have been lost.

Code:

Event[3998]:
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2020-07-02T03:16:48.678
  Event ID: 5
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: Marilyn-PC
  Description:
{Registry Hive Recovered} Registry hive (file): '\??\C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\S-1-5-21-1943052622-2247614736-1185404217-1000-07022020031648499-ntuser.dat' was corrupted and it has been recovered. Some data might have been lost.

Code:

8/8/2020 4:28 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: ntdll.dll, version: 10.0.14393.2214, time stamp: 0x5ac2f612&#x000d;&#x000a;Exception code: 0xc0000374&#x000d;&#x000a;Fault offset: 0x00000000000f8353&#x000d;&#x000a;Faulting process id: 0x118c&#x000d;&#x000a;Faulting application start time: 0x01d66da0fe574f83&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Windows\SYSTEM32\ntdll.dll&#x000d;&#x000a;Report Id: 239d7f9f-6b6f-4dd4-8996-533cddcaff30&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:32 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: ntdll.dll, version: 10.0.14393.2214, time stamp: 0x5ac2f612&#x000d;&#x000a;Exception code: 0xc0000374&#x000d;&#x000a;Fault offset: 0x00000000000f8353&#x000d;&#x000a;Faulting process id: 0x182c&#x000d;&#x000a;Faulting application start time: 0x01d66da17e990081&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Windows\SYSTEM32\ntdll.dll&#x000d;&#x000a;Report Id: 1989ff33-af2c-4cf4-b1b8-2df8cced7bb6&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:26 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: ntdll.dll, version: 10.0.14393.2214, time stamp: 0x5ac2f612&#x000d;&#x000a;Exception code: 0xc0000374&#x000d;&#x000a;Fault offset: 0x00000000000f8353&#x000d;&#x000a;Faulting process id: 0x1e50&#x000d;&#x000a;Faulting application start time: 0x01d66da0b9a84372&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Windows\SYSTEM32\ntdll.dll&#x000d;&#x000a;Report Id: 9474caa0-2073-4515-ab56-3d2e55fd0186&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:31 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: ntdll.dll, version: 10.0.14393.2214, time stamp: 0x5ac2f612&#x000d;&#x000a;Exception code: 0xc0000374&#x000d;&#x000a;Fault offset: 0x00000000000f8353&#x000d;&#x000a;Faulting process id: 0x221c&#x000d;&#x000a;Faulting application start time: 0x01d66da1677f3d4b&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Windows\SYSTEM32\ntdll.dll&#x000d;&#x000a;Report Id: 722de2b2-15b5-4bd6-8df4-0da4fd5d2dce&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:33 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: ntdll.dll, version: 10.0.14393.2214, time stamp: 0x5ac2f612&#x000d;&#x000a;Exception code: 0xc0000374&#x000d;&#x000a;Fault offset: 0x00000000000f8353&#x000d;&#x000a;Faulting process id: 0x25a8&#x000d;&#x000a;Faulting application start time: 0x01d66da1af77e302&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Windows\SYSTEM32\ntdll.dll&#x000d;&#x000a;Report Id: 6b3e4463-82fd-4476-92a6-5ccd6e56af53&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:33 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: ntdll.dll, version: 10.0.14393.2214, time stamp: 0x5ac2f612&#x000d;&#x000a;Exception code: 0xc0000374&#x000d;&#x000a;Fault offset: 0x00000000000f8353&#x000d;&#x000a;Faulting process id: 0x2a08&#x000d;&#x000a;Faulting application start time: 0x01d66da1944eef8c&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Windows\SYSTEM32\ntdll.dll&#x000d;&#x000a;Report Id: 15e2f8be-592f-45da-88b3-ef76f2effda8&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:33 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: ntdll.dll, version: 10.0.14393.2214, time stamp: 0x5ac2f612&#x000d;&#x000a;Exception code: 0xc0000374&#x000d;&#x000a;Fault offset: 0x00000000000f8353&#x000d;&#x000a;Faulting process id: 0x2acc&#x000d;&#x000a;Faulting application start time: 0x01d66da19ccffdc2&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Windows\SYSTEM32\ntdll.dll&#x000d;&#x000a;Report Id: 67fc98c6-44e1-45d1-adfe-f7ba6ae36b4c&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:33 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: ntdll.dll, version: 10.0.14393.2214, time stamp: 0x5ac2f612&#x000d;&#x000a;Exception code: 0xc0000374&#x000d;&#x000a;Fault offset: 0x00000000000f8353&#x000d;&#x000a;Faulting process id: 0x2af0&#x000d;&#x000a;Faulting application start time: 0x01d66da1a3380c57&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Windows\SYSTEM32\ntdll.dll&#x000d;&#x000a;Report Id: 7f390d6b-1daa-4b6c-bd44-722dba5d0846&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:33 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: ntdll.dll, version: 10.0.14393.2214, time stamp: 0x5ac2f612&#x000d;&#x000a;Exception code: 0xc0000374&#x000d;&#x000a;Fault offset: 0x00000000000f8353&#x000d;&#x000a;Faulting process id: 0x2b58&#x000d;&#x000a;Faulting application start time: 0x01d66da1b4026781&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Windows\SYSTEM32\ntdll.dll&#x000d;&#x000a;Report Id: 5fc16e30-3e0b-410e-b4d2-5594f45e5f5c&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:33 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: ntdll.dll, version: 10.0.14393.2214, time stamp: 0x5ac2f612&#x000d;&#x000a;Exception code: 0xc0000374&#x000d;&#x000a;Fault offset: 0x00000000000f8353&#x000d;&#x000a;Faulting process id: 0x2bdc&#x000d;&#x000a;Faulting application start time: 0x01d66da199172573&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Windows\SYSTEM32\ntdll.dll&#x000d;&#x000a;Report Id: 6879df30-c310-4a6d-b2cb-bb3b2e2396b2&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:27 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: ntdll.dll, version: 10.0.14393.2214, time stamp: 0x5ac2f612&#x000d;&#x000a;Exception code: 0xc0000374&#x000d;&#x000a;Fault offset: 0x00000000000f8353&#x000d;&#x000a;Faulting process id: 0x934&#x000d;&#x000a;Faulting application start time: 0x01d66da0cb65ed60&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Windows\SYSTEM32\ntdll.dll&#x000d;&#x000a;Report Id: 8832bb4b-4525-4aa1-959d-381c5ee38093&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:28 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: Qt5Core.dll, version: 5.14.1.0, time stamp: 0x5e8272e4&#x000d;&#x000a;Exception code: 0xc0000005&#x000d;&#x000a;Fault offset: 0x0000000000232e97&#x000d;&#x000a;Faulting process id: 0x118c&#x000d;&#x000a;Faulting application start time: 0x01d66da0fe574f83&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll&#x000d;&#x000a;Report Id: e4970302-c270-4bfb-8b9f-21e50cbedf4c&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:32 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: Qt5Core.dll, version: 5.14.1.0, time stamp: 0x5e8272e4&#x000d;&#x000a;Exception code: 0xc0000005&#x000d;&#x000a;Fault offset: 0x0000000000232e97&#x000d;&#x000a;Faulting process id: 0x182c&#x000d;&#x000a;Faulting application start time: 0x01d66da17e990081&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll&#x000d;&#x000a;Report Id: e595e096-7994-4716-98c7-49f4459dbdd5&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:29 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: Qt5Core.dll, version: 5.14.1.0, time stamp: 0x5e8272e4&#x000d;&#x000a;Exception code: 0xc0000005&#x000d;&#x000a;Fault offset: 0x0000000000232e97&#x000d;&#x000a;Faulting process id: 0x1dc0&#x000d;&#x000a;Faulting application start time: 0x01d66da10ca8b46f&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll&#x000d;&#x000a;Report Id: fe228b65-3a3e-4d42-884a-03681acb0ba4&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:26 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: Qt5Core.dll, version: 5.14.1.0, time stamp: 0x5e8272e4&#x000d;&#x000a;Exception code: 0xc0000005&#x000d;&#x000a;Fault offset: 0x0000000000232e97&#x000d;&#x000a;Faulting process id: 0x1e50&#x000d;&#x000a;Faulting application start time: 0x01d66da0b9a84372&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll&#x000d;&#x000a;Report Id: 1ce2a668-8a16-4dfe-95f3-a3caab6b1549&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:29 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: Qt5Core.dll, version: 5.14.1.0, time stamp: 0x5e8272e4&#x000d;&#x000a;Exception code: 0xc0000005&#x000d;&#x000a;Fault offset: 0x0000000000232e97&#x000d;&#x000a;Faulting process id: 0x1ef8&#x000d;&#x000a;Faulting application start time: 0x01d66da11aebbab2&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll&#x000d;&#x000a;Report Id: 12bc6bad-f38a-466d-8f3e-376d9c9db8d6&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:31 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: Qt5Core.dll, version: 5.14.1.0, time stamp: 0x5e8272e4&#x000d;&#x000a;Exception code: 0xc0000005&#x000d;&#x000a;Fault offset: 0x0000000000232e97&#x000d;&#x000a;Faulting process id: 0x221c&#x000d;&#x000a;Faulting application start time: 0x01d66da1677f3d4b&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll&#x000d;&#x000a;Report Id: 557653dc-f2ae-46f9-b941-a4bdef126d0b&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:33 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: Qt5Core.dll, version: 5.14.1.0, time stamp: 0x5e8272e4&#x000d;&#x000a;Exception code: 0xc0000005&#x000d;&#x000a;Fault offset: 0x0000000000232e97&#x000d;&#x000a;Faulting process id: 0x25a8&#x000d;&#x000a;Faulting application start time: 0x01d66da1af77e302&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll&#x000d;&#x000a;Report Id: 94f05fda-54e1-4ceb-8bdd-94a1ef5eed2d&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:29 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: Qt5Core.dll, version: 5.14.1.0, time stamp: 0x5e8272e4&#x000d;&#x000a;Exception code: 0xc0000005&#x000d;&#x000a;Fault offset: 0x0000000000232e97&#x000d;&#x000a;Faulting process id: 0x25e0&#x000d;&#x000a;Faulting application start time: 0x01d66da110926af7&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll&#x000d;&#x000a;Report Id: f4ac1f5b-0382-40cf-9d11-5acbbfc7071e&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:33 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: Qt5Core.dll, version: 5.14.1.0, time stamp: 0x5e8272e4&#x000d;&#x000a;Exception code: 0xc0000005&#x000d;&#x000a;Fault offset: 0x0000000000232e97&#x000d;&#x000a;Faulting process id: 0x2a08&#x000d;&#x000a;Faulting application start time: 0x01d66da1944eef8c&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll&#x000d;&#x000a;Report Id: e35efb83-b853-4b47-94db-4f2c12e4544d&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:33 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: Qt5Core.dll, version: 5.14.1.0, time stamp: 0x5e8272e4&#x000d;&#x000a;Exception code: 0xc0000005&#x000d;&#x000a;Fault offset: 0x0000000000232e97&#x000d;&#x000a;Faulting process id: 0x2acc&#x000d;&#x000a;Faulting application start time: 0x01d66da19ccffdc2&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll&#x000d;&#x000a;Report Id: badf4c9d-3928-4c18-b17c-44e670df6845&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:33 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: Qt5Core.dll, version: 5.14.1.0, time stamp: 0x5e8272e4&#x000d;&#x000a;Exception code: 0xc0000005&#x000d;&#x000a;Fault offset: 0x0000000000232e97&#x000d;&#x000a;Faulting process id: 0x2af0&#x000d;&#x000a;Faulting application start time: 0x01d66da1a3380c57&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll&#x000d;&#x000a;Report Id: e67158be-bc15-444d-a950-c5fe520fe4b8&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:33 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: Qt5Core.dll, version: 5.14.1.0, time stamp: 0x5e8272e4&#x000d;&#x000a;Exception code: 0xc0000005&#x000d;&#x000a;Fault offset: 0x0000000000232e97&#x000d;&#x000a;Faulting process id: 0x2b58&#x000d;&#x000a;Faulting application start time: 0x01d66da1b4026781&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll&#x000d;&#x000a;Report Id: 79a9672b-f88b-43c8-a5f1-5579fa1b564a&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:33 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: Qt5Core.dll, version: 5.14.1.0, time stamp: 0x5e8272e4&#x000d;&#x000a;Exception code: 0xc0000005&#x000d;&#x000a;Fault offset: 0x0000000000232e97&#x000d;&#x000a;Faulting process id: 0x2bdc&#x000d;&#x000a;Faulting application start time: 0x01d66da199172573&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll&#x000d;&#x000a;Report Id: dda0ea65-8d33-4fe0-a197-eb0ddef0b94a&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:29 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: Qt5Core.dll, version: 5.14.1.0, time stamp: 0x5e8272e4&#x000d;&#x000a;Exception code: 0xc0000005&#x000d;&#x000a;Fault offset: 0x0000000000232e97&#x000d;&#x000a;Faulting process id: 0x4fc&#x000d;&#x000a;Faulting application start time: 0x01d66da115261254&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll&#x000d;&#x000a;Report Id: b777b4dc-c42c-41c9-84d9-fa8ce5dd47e2&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:
8/8/2020 4:27 PM    Application Error    Faulting application name: mbam.exe, version: 4.0.0.753, time stamp: 0x5f107449&#x000d;&#x000a;Faulting module name: Qt5Core.dll, version: 5.14.1.0, time stamp: 0x5e8272e4&#x000d;&#x000a;Exception code: 0xc0000005&#x000d;&#x000a;Fault offset: 0x0000000000232e97&#x000d;&#x000a;Faulting process id: 0x934&#x000d;&#x000a;Faulting application start time: 0x01d66da0cb65ed60&#x000d;&#x000a;Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe&#x000d;&#x000a;Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll&#x000d;&#x000a;Report Id: ffd9c366-4eb4-4ce9-838a-6d577ea5694f&#x000d;&#x000a;Faulting package full name: &#x000d;&#x000a;Faulting package-relative application ID:

c7c4c7 · Sep 18, 2020

Couple of things
Thanks for all the suggestions
The updates were not being applied because the system reserve partition had run out of space, got that fixed started applying the updates.

Malwarebytes finds things that other virus detection programs don't, but it doesn't have a firewall. That's why there are 2, I know that it's not common practice.

ZBook, thanks for all of the suggestion. I ran the sfc /scannow and it came back with no errors. I'm not sure if the rest of your original post and suggestions after the sfc scan were to be done assuming that the original scan had problems, please clarify.

Your last post said that the problem was with Kaspersky but everything in the post points to malwarebytes, please clarify

Had another Blue Screen this morning right in the middle of downloading more updates, indicated an NDIS driver error. Everything I read indicates a wireless problem, but no wireless installed. Latest ethernet adaptor driver indicates that there is no better driver available

zbook · Sep 18, 2020

What steps were made to identify the cause of the upgrade failure and fix the system reserved partition?

Upload a new Sysnative log collector log for any BSOD.

Please post results for steps 1 - 12.

Uninstall all of the non-Microsoft AV software.

Once the computer has had stability for several days or more you can consider reinstalling Malwarebytes.

c7c4c7 · Sep 18, 2020

What steps were made to identify the cause of the upgrade failure and fix the system reserved partition?
https://support.microsoft.com/en-in...m-reserved-partition-error-installing-windows
Windows 10 with MBR partition

Press the Windows key + R. In the Run window that comes up, type diskmgmt.msc and press Enter.
Select the partition marked System Reserve. Press-and-hold or right-click on it.
Select Change Drive Letter and Paths.
Choose Add.
Enter Y for the drive letter.
Tap or click OK.
From the Start menu, search for cmd. Right-click Command Prompt from the search results, and select Run as administrator.
In the command prompt, type Y: and hit enter to switch to that drive. Then, navigate to the Fonts folder by typing cd Boot\Fonts.
Type the following and press Enter:
takeown /d y /r /f .
Note: You must include the space and the period after the “f”, or the command will not work properly.
Back up the permission to the drive by typing the following and press Enter:
icacls Y:\* /save %systemdrive%\NTFSp.txt /c /t
Note: Make sure that all files are showed as successful and none as failed.
Type whoami and press Enter, and then record the user name. Type the following command and press Enter:
icacls . /grant <username you got from whoami>:F /t

Note: Do not put a space between the username and ":F", or the command won't work.
Make sure you are still located in Fonts location (Y:\Boot\Fonts) as described in step 8. Then, Type del *.* to delete font files. The system may ask you if you are sure to continue, press Y and then enter to continue.

Restore permissions

Type the following command and press Enter:
icacls Y:\ /restore %systemdrive%\NTFSp.txt /c /t
A message may display indicating some files failed while processing – this is normal as these files have been deleted subsequent to backing them up.
If the amount of successful files is none, then the command was executed incorrectly; you must have some files successfully processed before continuing.
Adjust the ACL back to System by typing the following and press Enter:
icacls . /grant system:f /t
Set the owner of the drive back to System by typing the following command and pressing Enter:
icacls Y: /setowner “SYSTEM” /t /c
Go back to Disk Management and Refresh the data to confirm if the SRP now has a greater percentage of free space. If so, the drive letter can be removed at this point.
Right-click the System Reserved Partition.
Select Change Drive Letter and Paths.
Choose the Y: drive.
Select Remove.
Click OK.

More to follow

zbook · Sep 18, 2020

1) Had there been a pop up error message or did you troubleshoot the logs.

2) Open disk management > by default some columns are compressed > widen each Status and Volume > make sure the contents within the parenthesis are in full view and that none of the characters are cutoff > view disk 0 > widen this row as needed so that all of the characters are in full view > post an image into the thread
Disk Management - How to Post a Screenshot of

3) Download and install Minitool Partition Wizard > click launch > post an image of the results into this thread
MiniTool Partition Wizard Free Edition
MiniTool Portable Partition Magic Brings Easier Disk Management

4) Post a new Sysnative Log collector share link.

c7c4c7 · Sep 18, 2020

Here is a BSOD from this morning while downloading an update for Windows. You will notice in the MSinfo file that there is now a USB attached Wireless adapter. That was added after receiving this BSOD and it indicating a possible network error.

There was yet another BSOD that I didn't notice until processing this one. I will send it later.

Your 1-12 steps outstanding until I get sometime later today.

zbook · Sep 18, 2020

The logs displayed the use of Windows driver verifier.

How come it was used?

How come Kaspersky AV was not uninstalled?

How come Malwarebytes was not uninstalled?

Code:

Broadcom NetLink (TM) Gigabit Ethernet    PCI\VEN_14E4&DEV_1691&SUBSYS_04AA1028&REV_01\4&626E76F&0&00E3    This device is disabled.

Code:

  STANDARD FLAGS:
    [X] (0x00000000) Automatic Checks
    [X] (0x00000001) Special pool
    [X] (0x00000002) Force IRQL checking
    [X] (0x00000008) Pool tracking
    [ ] (0x00000010) I/O verification
    [X] (0x00000020) Deadlock detection
    [ ] (0x00000080) DMA checking
    [X] (0x00000100) Security checks
    [X] (0x00000800) Miscellaneous checks
    [X] (0x00020000) DDI compliance checking

  ADDITIONAL FLAGS:
    [ ] (0x00000004) Randomized low resources simulation
    [ ] (0x00000200) Force pending I/O requests
    [ ] (0x00000400) IRP logging
    [ ] (0x00002000) Invariant MDL checking for stack
    [ ] (0x00004000) Invariant MDL checking for driver
    [X] (0x00008000) Power framework delay fuzzing
    [ ] (0x00010000) Port/miniport interface checking
    [ ] (0x00040000) Systematic low resources simulation
    [ ] (0x00080000) DDI compliance checking (additional)
    [ ] (0x00200000) NDIS/WIFI verification
    [ ] (0x00800000) Kernel synchronization delay fuzzing
    [ ] (0x01000000) VM switch verification
    [ ] (0x02000000) Code integrity checks

    [X] Indicates flag is enabled

Code:

start             end                 module name
fffff803`20570000 fffff803`2063c000   ACPI     ACPI.sys     90B929F2 (This is a reproducible build file hash, not a timestamp)
fffff803`204d0000 fffff803`204f5000   acpiex   acpiex.sys   2B91EDB2 (This is a reproducible build file hash, not a timestamp)
fffff806`21d50000 fffff806`21df7000   afd      afd.sys      B88DD13E (This is a reproducible build file hash, not a timestamp)
fffff806`21d30000 fffff806`21d43000   afunix   afunix.sys   9D6C12C4 (This is a reproducible build file hash, not a timestamp)
fffff803`21f50000 fffff803`21f77000   AgileVpn AgileVpn.sys ABB3CDA0 (This is a reproducible build file hash, not a timestamp)
fffff806`22510000 fffff806`2255f000   ahcache  ahcache.sys  2118A981 (This is a reproducible build file hash, not a timestamp)
fffff806`224f0000 fffff806`22506000   bam      bam.sys      22198778 (This is a reproducible build file hash, not a timestamp)
fffff806`21be0000 fffff806`21bf6000   BasicDisplay BasicDisplay.sys 4E6E05E1 (This is a reproducible build file hash, not a timestamp)
fffff806`21c00000 fffff806`21c11000   BasicRender BasicRender.sys 82A93228 (This is a reproducible build file hash, not a timestamp)
fffff806`21830000 fffff806`2183a000   Beep     Beep.SYS     528EC21A (This is a reproducible build file hash, not a timestamp)
fffff803`1ffa0000 fffff803`1ffab000   BOOTVID  BOOTVID.dll  0F301604 (This is a reproducible build file hash, not a timestamp)
fffff803`21eb0000 fffff803`21ed5000   bowser   bowser.sys   D37F2E35 (This is a reproducible build file hash, not a timestamp)
fffff99f`722b0000 fffff99f`722f8000   cdd      cdd.dll      00000000 (This is a reproducible build file hash, not a timestamp)
fffff806`22150000 fffff806`22180000   cdrom    cdrom.sys    9F6B0B7B (This is a reproducible build file hash, not a timestamp)
fffff803`208a0000 fffff803`208b9000   CEA      CEA.sys      F3811107 (This is a reproducible build file hash, not a timestamp)
fffff803`20190000 fffff803`2026d000   CI       CI.dll       600A2941 (This is a reproducible build file hash, not a timestamp)
fffff803`21700000 fffff803`2176b000   CLASSPNP CLASSPNP.SYS D51A9199 (This is a reproducible build file hash, not a timestamp)
fffff806`237d0000 fffff806`23847000   cldflt   cldflt.sys   CA1A8818 (This is a reproducible build file hash, not a timestamp)
fffff803`1ff10000 fffff803`1ff78000   CLFS     CLFS.SYS     A2E71555 (This is a reproducible build file hash, not a timestamp)
fffff803`20000000 fffff803`20105000   clipsp   clipsp.sys   Mon Sep 23 22:47:06 2019 (5D8991BA)
fffff803`20820000 fffff803`2085b000   cm_km    cm_km.sys    Fri Feb 15 06:52:58 2019 (5C66B62A)
fffff803`1ffb0000 fffff803`1ffbe000   cmimcext cmimcext.sys C7F022B4 (This is a reproducible build file hash, not a timestamp)
fffff803`20270000 fffff803`2032c000   cng      cng.sys      9795E330 (This is a reproducible build file hash, not a timestamp)
fffff806`22220000 fffff806`22231000   CompositeBus CompositeBus.sys F050D616 (This is a reproducible build file hash, not a timestamp)
fffff803`21c00000 fffff803`21c13000   condrv   condrv.sys   AEE79CBA (This is a reproducible build file hash, not a timestamp)
fffff806`22070000 fffff806`2208d000   crashdmp crashdmp.sys 70ECCDBC (This is a reproducible build file hash, not a timestamp)
fffff806`21f40000 fffff806`21fd4000   csc      csc.sys      3812391B (This is a reproducible build file hash, not a timestamp)
fffff806`22f10000 fffff806`22f1e000   dddriver64Dcsa dddriver64Dcsa.sys Mon May 18 12:47:58 2020 (5EC2CA4E)
fffff806`224a0000 fffff806`224cc000   dfsc     dfsc.sys     FABE3F7D (This is a reproducible build file hash, not a timestamp)
fffff803`216e0000 fffff803`216fc000   disk     disk.sys     384FEFED (This is a reproducible build file hash, not a timestamp)
fffff806`22d20000 fffff806`22d41000   drmk     drmk.sys     ***** Invalid (A3E06FB0)
fffff806`23a80000 fffff806`23a9d000   dump_dumpfve dump_dumpfve.sys 4BEDF38A (This is a reproducible build file hash, not a timestamp)
fffff806`23a30000 fffff806`23a5e000   dump_storahci dump_storahci.sys 1228E814 (This is a reproducible build file hash, not a timestamp)
fffff806`239f0000 fffff806`239fe000   dump_storport dump_storport.sys Fri Apr 26 22:44:32 2019 (5CC3D020)
fffff806`21840000 fffff806`21bb1000   dxgkrnl  dxgkrnl.sys  4A05912A (This is a reproducible build file hash, not a timestamp)
fffff806`23360000 fffff806`233d1000   dxgmms1  dxgmms1.sys  5749FE14 (This is a reproducible build file hash, not a timestamp)
fffff806`233e0000 fffff806`234ba000   dxgmms2  dxgmms2.sys  90BC4EA1 (This is a reproducible build file hash, not a timestamp)
fffff803`21d80000 fffff803`21db3000   farflt   farflt.sys   Fri Jul 10 08:26:47 2020 (5F086C97)
fffff806`23660000 fffff806`236cb000   fastfat  fastfat.SYS  2734E7BF (This is a reproducible build file hash, not a timestamp)
fffff806`21450000 fffff806`21465000   filecrypt filecrypt.sys 4EAD73C1 (This is a reproducible build file hash, not a timestamp)
fffff803`20b80000 fffff803`20b9a000   fileinfo fileinfo.sys 24BBED20 (This is a reproducible build file hash, not a timestamp)
fffff803`20110000 fffff803`20181000   FLTMGR   FLTMGR.SYS   801A5F11 (This is a reproducible build file hash, not a timestamp)
fffff803`20bf0000 fffff803`20bfd000   Fs_Rec   Fs_Rec.sys   unavailable (00000000)
fffff803`214b0000 fffff803`21579000   fvevol   fvevol.sys   D4B5A2E7 (This is a reproducible build file hash, not a timestamp)
fffff803`213f0000 fffff803`2146a000   fwpkclnt fwpkclnt.sys 58C1E6ED (This is a reproducible build file hash, not a timestamp)
fffff806`22490000 fffff806`2249a000   gpuenergydrv gpuenergydrv.sys 0CC24294 (This is a reproducible build file hash, not a timestamp)
fffff803`1f01c000 fffff803`1f0c0000   hal      hal.dll      5C190592 (This is a reproducible build file hash, not a timestamp)
fffff806`22c80000 fffff806`22ca2000   HDAudBus HDAudBus.sys 9F031398 (This is a reproducible build file hash, not a timestamp)
fffff806`23fc0000 fffff806`23fd1000   HECIx64  HECIx64.sys  Tue Oct 19 18:33:43 2010 (4CBE2AD7)
fffff806`23500000 fffff806`2353b000   HIDCLASS HIDCLASS.SYS D4D0DEE6 (This is a reproducible build file hash, not a timestamp)
fffff806`23710000 fffff806`23723000   HIDPARSE HIDPARSE.SYS 0D56F932 (This is a reproducible build file hash, not a timestamp)
fffff806`234e0000 fffff806`234f2000   hidusb   hidusb.sys   7B9189FE (This is a reproducible build file hash, not a timestamp)
fffff803`22910000 fffff803`22a54000   HTTP     HTTP.sys     FED4DDA3 (This is a reproducible build file hash, not a timestamp)
fffff806`23aa0000 fffff806`23fbdc40   igdkmd64 igdkmd64.sys Thu May 19 12:45:17 2016 (573DFBAD)
fffff806`23240000 fffff806`23293000   IntcDAud IntcDAud.sys Fri Oct 15 03:28:17 2010 (4CB810A1)
fffff803`20690000 fffff803`206eb000   intelpep intelpep.sys 3F6D1245 (This is a reproducible build file hash, not a timestamp)
fffff806`22eb0000 fffff806`22eee000   intelppm intelppm.sys BC7DD83C (This is a reproducible build file hash, not a timestamp)
fffff803`216a0000 fffff803`216b2000   iorate   iorate.sys   18D52DDA (This is a reproducible build file hash, not a timestamp)
fffff806`22d50000 fffff806`22dc1000   k57nd60a k57nd60a.sys Wed Aug 19 21:16:18 2015 (55D53872)
fffff806`23610000 fffff806`23624000   kbdclass kbdclass.sys 0B474226 (This is a reproducible build file hash, not a timestamp)
fffff806`235d0000 fffff806`235e1000   kbdhid   kbdhid.sys   4CF68CA7 (This is a reproducible build file hash, not a timestamp)
fffff803`1fc00000 fffff803`1fc0b000   kdcom    kdcom.dll    Sat Feb  3 09:28:36 2018 (5A75D524)
fffff806`22240000 fffff806`2224d000   kdnic    kdnic.sys    1FF5F7F5 (This is a reproducible build file hash, not a timestamp)
fffff803`20a40000 fffff803`20a51000   klbackupdisk klbackupdisk.sys Sun Apr 13 21:44:40 2008 (4802C518)
fffff806`22190000 fffff806`221b0000   klbackupflt klbackupflt.sys ***** Invalid (946E4501)
fffff806`22470000 fffff806`22484000   kldisk   kldisk.sys   ***** Invalid (B1F414C8)
fffff806`21400000 fffff806`2144a000   klflt    klflt.sys    ***** Invalid (82E91C41)
fffff806`21780000 fffff806`2181e000   klgse    klgse.sys    Fri Jun 19 06:44:53 2020 (5EECA535)
fffff806`21480000 fffff806`215e2000   klhk     klhk.sys     Fri Jun 19 06:44:37 2020 (5EECA525)
fffff803`21cc0000 fffff803`21cf8000   klids    klids.sys    Fri Aug 21 10:15:16 2020 (5F3FE504)
fffff806`21600000 fffff806`216f4000   klif     klif.sys     Sun Jun 28 12:25:37 2020 (5EF8D291)
fffff806`21e40000 fffff806`21e4b000   klim6    klim6.sys    Wed Jan  7 08:19:10 2015 (54AD405E)
fffff806`235f0000 fffff806`23602000   klkbdflt klkbdflt.sys Tue Nov 16 11:47:54 2021 (6193EECA)
fffff806`23560000 fffff806`2356e000   klmouflt klmouflt.sys Fri Sep 12 22:44:37 1975 (0AB7B625)
fffff806`215f0000 fffff806`215fb000   klpd     klpd.sys     Tue Mar 13 08:59:09 2029 (6F59042D)
fffff806`22560000 fffff806`2256d000   kltap    kltap.sys    Fri Mar 16 13:44:54 2018 (5AAC10A6)
fffff803`20740000 fffff803`2077e000   klupd_klif_arkmon klupd_klif_arkmon.sys Mon Jul 27 10:44:08 2020 (5F1EF648)
fffff803`21c60000 fffff803`21c76000   klupd_klif_kimul klupd_klif_kimul.sys Tue Jan 22 02:00:22 2019 (5C46CD96)
fffff803`21df0000 fffff803`21e3b000   klupd_klif_klark klupd_klif_klark.sys Mon Jul 27 10:45:48 2020 (5F1EF6AC)
fffff803`21680000 fffff803`2169a000   klupd_klif_klbg klupd_klif_klbg.sys Mon Jul 27 10:45:47 2020 (5F1EF6AB)
fffff803`21c80000 fffff803`21cb3000   klupd_klif_mark klupd_klif_mark.sys Mon Jul 27 10:46:24 2020 (5F1EF6D0)
fffff806`21c60000 fffff806`21c78000   klwfp    klwfp.sys    Tue Feb 26 02:47:08 2019 (5C74FD0C)
fffff806`21e00000 fffff806`21e31000   klwtp    klwtp.sys    Sat May  5 18:17:19 2007 (463D107F)
fffff806`221c0000 fffff806`221f8000   kneps    kneps.sys    Tue Sep  1 16:08:06 2020 (5F4EB836)
fffff806`21700000 fffff806`21778000   ks       ks.sys       1F5FE6FB (This is a reproducible build file hash, not a timestamp)
fffff803`1fe40000 fffff803`1fe6a000   ksecdd   ksecdd.sys   A35F28F6 (This is a reproducible build file hash, not a timestamp)
fffff803`210c0000 fffff803`210f2000   ksecpkg  ksecpkg.sys  E1E129D5 (This is a reproducible build file hash, not a timestamp)
fffff806`23220000 fffff806`2322f000   ksthunk  ksthunk.sys  15502221 (This is a reproducible build file hash, not a timestamp)
fffff803`22a60000 fffff803`22a78000   lltdio   lltdio.sys   707E9308 (This is a reproducible build file hash, not a timestamp)
fffff806`23730000 fffff806`2375a000   luafv    luafv.sys    08A8E82A (This is a reproducible build file hash, not a timestamp)
fffff803`21d50000 fffff803`21d76000   mbae64   mbae64.sys   Thu Apr 25 04:32:45 2019 (5CC17EBD)
fffff803`21d00000 fffff803`21d13000   mbam     mbam.sys     Tue Aug  4 14:53:10 2020 (5F29BCA6)
fffff806`23870000 fffff806`238a8000   MbamChameleon MbamChameleon.sys Mon Aug 17 08:58:32 2020 (5F3A8D08)
fffff803`21c20000 fffff803`21c5f000   mbamswissarmy mbamswissarmy.sys Wed Nov 20 08:57:29 2019 (5DD55459)
fffff803`1fc10000 fffff803`1fe11000   mcupdate mcupdate.dll Mon Dec 18 03:17:14 1989 (258CAB1A)
fffff803`22ac0000 fffff803`22ad4000   mmcss    mmcss.sys    3EE4136D (This is a reproducible build file hash, not a timestamp)
fffff806`234c0000 fffff806`234d8000   monitor  monitor.sys  6240F19B (This is a reproducible build file hash, not a timestamp)
fffff806`23570000 fffff806`23583000   mouclass mouclass.sys 4A22FFB8 (This is a reproducible build file hash, not a timestamp)
fffff806`23540000 fffff806`23550000   mouhid   mouhid.sys   A140C187 (This is a reproducible build file hash, not a timestamp)
fffff803`20a60000 fffff803`20a7f000   mountmgr mountmgr.sys 63D3E2C9 (This is a reproducible build file hash, not a timestamp)
fffff803`22aa0000 fffff803`22aba000   mpsdrv   mpsdrv.sys   7D5AF2F0 (This is a reproducible build file hash, not a timestamp)
fffff803`22ae0000 fffff803`22b13000   mqac     mqac.sys     5B322411 (This is a reproducible build file hash, not a timestamp)
fffff803`22b20000 fffff803`22baf000   mrxsmb   mrxsmb.sys   FC33D1FB (This is a reproducible build file hash, not a timestamp)
fffff803`21ae0000 fffff803`21b32000   mrxsmb10 mrxsmb10.sys 5DDA4A77 (This is a reproducible build file hash, not a timestamp)
fffff803`21e60000 fffff803`21ea5000   mrxsmb20 mrxsmb20.sys CAF89690 (This is a reproducible build file hash, not a timestamp)
fffff806`21c40000 fffff806`21c51000   Msfs     Msfs.SYS     unavailable (00000000)
fffff803`20780000 fffff803`2078b000   msisadrv msisadrv.sys 5E470A0E (This is a reproducible build file hash, not a timestamp)
fffff806`23950000 fffff806`23969000   mslldp   mslldp.sys   15C3108A (This is a reproducible build file hash, not a timestamp)
fffff803`1fe70000 fffff803`1fed0000   msrpc    msrpc.sys    unavailable (00000000)
fffff803`20500000 fffff803`20542000   mssecflt mssecflt.sys 8C5A1671 (This is a reproducible build file hash, not a timestamp)
fffff806`22010000 fffff806`22020000   mssmbios mssmbios.sys E6DC521D (This is a reproducible build file hash, not a timestamp)
fffff803`21650000 fffff803`21675000   mup      mup.sys      565E0311 (This is a reproducible build file hash, not a timestamp)
fffff803`21d20000 fffff803`21d42000   mwac     mwac.sys     Fri Jul 17 13:33:46 2020 (5F11EF0A)
fffff803`20ea0000 fffff803`21012000   ndis     ndis.sys     645448CA (This is a reproducible build file hash, not a timestamp)
fffff803`22000000 fffff803`2200f000   ndistapi ndistapi.sys 690D0D05 (This is a reproducible build file hash, not a timestamp)
fffff803`21e40000 fffff803`21e58000   ndisuio  ndisuio.sys  38FD20EE (This is a reproducible build file hash, not a timestamp)
fffff806`22ef0000 fffff806`22efd000   NdisVirtualBus NdisVirtualBus.sys D217410A (This is a reproducible build file hash, not a timestamp)
fffff803`22010000 fffff803`2204a000   ndiswan  ndiswan.sys  18A46B18 (This is a reproducible build file hash, not a timestamp)
fffff803`21f00000 fffff803`21f41000   NDProxy  NDProxy.sys  193FE713 (This is a reproducible build file hash, not a timestamp)
fffff803`22bb0000 fffff803`22bd7000   Ndu      Ndu.sys      23725908 (This is a reproducible build file hash, not a timestamp)
fffff806`21ea0000 fffff806`21eb4000   netbios  netbios.sys  B37FD2E9 (This is a reproducible build file hash, not a timestamp)
fffff806`21cd0000 fffff806`21d29000   netbt    netbt.sys    113D2A22 (This is a reproducible build file hash, not a timestamp)
fffff803`21020000 fffff803`210b4000   NETIO    NETIO.SYS    E3375155 (This is a reproducible build file hash, not a timestamp)
fffff806`21c20000 fffff806`21c3c000   Npfs     Npfs.SYS     B03ECFD3 (This is a reproducible build file hash, not a timestamp)
fffff806`22000000 fffff806`2200d000   npsvctrig npsvctrig.sys 0E7AC006 (This is a reproducible build file hash, not a timestamp)
fffff806`21fe0000 fffff806`21ff2000   nsiproxy nsiproxy.sys 528DA18A (This is a reproducible build file hash, not a timestamp)
fffff803`1f0c0000 fffff803`1fb77000   nt       ntkrnlmp.exe D1492AC1 (This is a reproducible build file hash, not a timestamp)
fffff803`20c00000 fffff803`20e9d000   Ntfs     Ntfs.sys     C29C750B (This is a reproducible build file hash, not a timestamp)
fffff803`1ffc0000 fffff803`1ffcc000   ntosext  ntosext.sys  BAC877D8 (This is a reproducible build file hash, not a timestamp)
fffff806`21820000 fffff806`2182a000   Null     Null.SYS     unavailable (00000000)
fffff806`21e70000 fffff806`21e9b000   pacer    pacer.sys    E7276BDE (This is a reproducible build file hash, not a timestamp)
fffff803`208c0000 fffff803`208f0000   partmgr  partmgr.sys  83BF1E25 (This is a reproducible build file hash, not a timestamp)
fffff803`20790000 fffff803`207ff000   pci      pci.sys      1D5E3C2E (This is a reproducible build file hash, not a timestamp)
fffff803`20720000 fffff803`20735000   pcw      pcw.sys      6B731527 (This is a reproducible build file hash, not a timestamp)
fffff803`20860000 fffff803`20893000   pdc      pdc.sys      3782E704 (This is a reproducible build file hash, not a timestamp)
fffff803`21a00000 fffff803`21ad6000   peauth   peauth.sys   Sun Jan 11 19:52:12 2015 (54B328CC)
fffff806`22cb0000 fffff806`22d17000   portcls  portcls.sys  D4F15BF0 (This is a reproducible build file hash, not a timestamp)
fffff803`1ff80000 fffff803`1ff9a000   PSHED    PSHED.dll    B21F9DDA (This is a reproducible build file hash, not a timestamp)
fffff803`20be0000 fffff803`20bec040   PxHlpa64 PxHlpa64.sys Tue Oct 20 13:08:42 2009 (4ADDFCAA)
fffff803`21f80000 fffff803`21fa2000   rasl2tp  rasl2tp.sys  A7AA404E (This is a reproducible build file hash, not a timestamp)
fffff803`21fe0000 fffff803`21ffc000   raspppoe raspppoe.sys 053A7D72 (This is a reproducible build file hash, not a timestamp)
fffff803`21fb0000 fffff803`21fd0000   raspptp  raspptp.sys  54893590 (This is a reproducible build file hash, not a timestamp)
fffff803`21ee0000 fffff803`21efd000   rassstp  rassstp.sys  6EC6A1E5 (This is a reproducible build file hash, not a timestamp)
fffff806`21ec0000 fffff806`21f3b000   rdbss    rdbss.sys    B7D44CE1 (This is a reproducible build file hash, not a timestamp)
fffff806`22f20000 fffff806`22f2e000   rdpbus   rdpbus.sys   4E9899F8 (This is a reproducible build file hash, not a timestamp)
fffff803`21600000 fffff803`2164e000   rdyboost rdyboost.sys F450CEB3 (This is a reproducible build file hash, not a timestamp)
fffff803`22a80000 fffff803`22a9b000   rspndr   rspndr.sys   ED98D1EE (This is a reproducible build file hash, not a timestamp)
fffff806`22fd0000 fffff806`23218400   RTKVHD64 RTKVHD64.sys Tue Jun 22 04:27:26 2010 (4C2081FE)
fffff803`20550000 fffff803`2056a000   SgrmAgent SgrmAgent.sys F851A195 (This is a reproducible build file hash, not a timestamp)
fffff803`1fff0000 fffff803`1ffff000   SleepStudyHelper SleepStudyHelper.sys BA6E2346 (This is a reproducible build file hash, not a timestamp)
fffff803`20900000 fffff803`209a5000   spaceport spaceport.sys BF564869 (This is a reproducible build file hash, not a timestamp)
fffff803`21b40000 fffff803`21bd5000   srv      srv.sys      D056B088 (This is a reproducible build file hash, not a timestamp)
fffff806`22270000 fffff806`22335000   srv2     srv2.sys     E6CC385C (This is a reproducible build file hash, not a timestamp)
fffff806`238f0000 fffff806`23943000   srvnet   srvnet.sys   0071D57A (This is a reproducible build file hash, not a timestamp)
fffff803`20a80000 fffff803`20aae000   storahci storahci.sys 1228E814 (This is a reproducible build file hash, not a timestamp)
fffff803`20ab0000 fffff803`20b52000   storport storport.sys 777B2F84 (This is a reproducible build file hash, not a timestamp)
fffff806`23850000 fffff806`2386a000   storqosflt storqosflt.sys D77C69C8 (This is a reproducible build file hash, not a timestamp)
fffff806`22f00000 fffff806`22f0c000   swenum   swenum.sys   C4D73525 (This is a reproducible build file hash, not a timestamp)
fffff806`21470000 fffff806`2147e000   tbs      tbs.sys      965BAC31 (This is a reproducible build file hash, not a timestamp)
fffff803`21100000 fffff803`213e9000   tcpip    tcpip.sys    B57EAB08 (This is a reproducible build file hash, not a timestamp)
fffff803`21be0000 fffff803`21bf4000   tcpipreg tcpipreg.sys 3451B629 (This is a reproducible build file hash, not a timestamp)
fffff806`21cb0000 fffff806`21cc0000   TDI      TDI.SYS      894065A0 (This is a reproducible build file hash, not a timestamp)
fffff806`21c80000 fffff806`21ca6000   tdx      tdx.sys      0A1F3DC4 (This is a reproducible build file hash, not a timestamp)
fffff803`1fee0000 fffff803`1ff07000   tm       tm.sys       9A74C3B7 (This is a reproducible build file hash, not a timestamp)
fffff806`22e60000 fffff806`22ea1000   ucx01000 ucx01000.sys 04268533 (This is a reproducible build file hash, not a timestamp)
fffff806`22250000 fffff806`22265000   umbus    umbus.sys    3104A4AD (This is a reproducible build file hash, not a timestamp)
fffff806`23590000 fffff806`235c3000   usbccgp  usbccgp.sys  386E8BEC (This is a reproducible build file hash, not a timestamp)
fffff806`22fc0000 fffff806`22fce000   USBD     USBD.SYS     CD63CE9D (This is a reproducible build file hash, not a timestamp)
fffff806`23fe0000 fffff806`23ffd000   usbehci  usbehci.sys  7C61F55C (This is a reproducible build file hash, not a timestamp)
fffff806`22f30000 fffff806`22fba000   usbhub   usbhub.sys   813B20B8 (This is a reproducible build file hash, not a timestamp)
fffff806`232b0000 fffff806`23350000   UsbHub3  UsbHub3.sys  8ACAE8B2 (This is a reproducible build file hash, not a timestamp)
fffff806`22c00000 fffff806`22c7a000   USBPORT  USBPORT.SYS  A13767BB (This is a reproducible build file hash, not a timestamp)
fffff806`23630000 fffff806`23655000   USBSTOR  USBSTOR.SYS  9CFA0789 (This is a reproducible build file hash, not a timestamp)
fffff806`22dd0000 fffff806`22e59000   USBXHCI  USBXHCI.SYS  80E4450B (This is a reproducible build file hash, not a timestamp)
fffff803`20800000 fffff803`20813000   vdrvroot vdrvroot.sys 0101BCC6 (This is a reproducible build file hash, not a timestamp)
fffff803`20330000 fffff803`203ca000   VerifierExt VerifierExt.sys 1A0E4E4F (This is a reproducible build file hash, not a timestamp)
fffff806`22570000 fffff806`225fc000   Vid      Vid.sys      5684D88D (This is a reproducible build file hash, not a timestamp)
fffff803`209b0000 fffff803`209ca000   volmgr   volmgr.sys   572BA99E (This is a reproducible build file hash, not a timestamp)
fffff803`209d0000 fffff803`20a33000   volmgrx  volmgrx.sys  unavailable (00000000)
fffff803`21590000 fffff803`215fd000   volsnap  volsnap.sys  95545239 (This is a reproducible build file hash, not a timestamp)
fffff803`21580000 fffff803`2158b000   volume   volume.sys   A4E9FDFA (This is a reproducible build file hash, not a timestamp)
fffff806`21e50000 fffff806`21e6a000   vwififlt vwififlt.sys 39396289 (This is a reproducible build file hash, not a timestamp)
fffff803`22050000 fffff803`2206d000   wanarp   wanarp.sys   1766D61C (This is a reproducible build file hash, not a timestamp)
fffff806`21bc0000 fffff806`21bd6000   watchdog watchdog.sys 21474799 (This is a reproducible build file hash, not a timestamp)
fffff806`236d0000 fffff806`23707000   wcifs    wcifs.sys    4E56CC51 (This is a reproducible build file hash, not a timestamp)
fffff803`203d0000 fffff803`204a5000   Wdf01000 Wdf01000.sys B9D7412C (This is a reproducible build file hash, not a timestamp)
fffff803`1ffd0000 fffff803`1ffe3000   WDFLDR   WDFLDR.SYS   3B396780 (This is a reproducible build file hash, not a timestamp)
fffff803`1fe20000 fffff803`1fe31000   werkernel werkernel.sys 958E14B2 (This is a reproducible build file hash, not a timestamp)
fffff803`21470000 fffff803`214a0000   wfplwfs  wfplwfs.sys  60902CBB (This is a reproducible build file hash, not a timestamp)
fffff99f`71ed0000 fffff99f`71f5c000   win32k   win32k.sys   unavailable (00000000)
fffff99f`72000000 fffff99f`722a6000   win32kbase win32kbase.sys unavailable (00000000)
fffff99f`72920000 fffff99f`72cc1000   win32kfull win32kfull.sys unavailable (00000000)
fffff803`206f0000 fffff803`20707000   WindowsTrustedRT WindowsTrustedRT.sys CB95CE3D (This is a reproducible build file hash, not a timestamp)
fffff803`20710000 fffff803`2071b000   WindowsTrustedRTProxy WindowsTrustedRTProxy.sys 514E3023 (This is a reproducible build file hash, not a timestamp)
fffff806`22200000 fffff806`2221f000   winhvr   winhvr.sys   8D332864 (This is a reproducible build file hash, not a timestamp)
fffff806`238b0000 fffff806`238e8000   winquic  winquic.sys  D60F7863 (This is a reproducible build file hash, not a timestamp)
fffff803`20640000 fffff803`2064c000   WMILIB   WMILIB.SYS   59021E3D (This is a reproducible build file hash, not a timestamp)
fffff803`20ba0000 fffff803`20bdd000   Wof      Wof.sys      EE8C7600 (This is a reproducible build file hash, not a timestamp)
fffff806`237c0000 fffff806`237ce000   WpdUpFltr WpdUpFltr.sys 9F7376EA (This is a reproducible build file hash, not a timestamp)
fffff803`204b0000 fffff803`204c0000   WppRecorder WppRecorder.sys 34A54231 (This is a reproducible build file hash, not a timestamp)
fffff803`21dc0000 fffff803`21dcd000   WSDPrint WSDPrint.sys FCE23E82 (This is a reproducible build file hash, not a timestamp)
fffff803`21dd0000 fffff803`21ddd000   WSDScan  WSDScan.sys  ED66A961 (This is a reproducible build file hash, not a timestamp)
fffff806`23760000 fffff806`237b0000   WUDFRd   WUDFRd.sys   2A40F545 (This is a reproducible build file hash, not a timestamp)

x BlueRobot · Sep 19, 2020

I fear that this thread is going to become rather confusing very quickly, so let's focus on the most likely cause of the BSODs which is Kaspersky. Could you please ensure that you remove Kaspersky using their removal tool and continue to the system as you normally would?

x BlueRobot · Sep 19, 2020

Could you please check the following directory for a dump file:

Code:

%systemroot%\MEMORY.DMP

If there is a dump file present, then please zip it and upload it to a file sharing site such as OneDrive, DropBox or Google Drive since it will be too large to attach directly to your post.

We won't be able to debug the latest crash properly without a full kernel memory dump.

c7c4c7 · Sep 19, 2020

There is a memory.dmp but its associated with another minidump.

I'm in the middle of getting all the updates applied. The machine continues to have BSOD's. Until I get all the updates applied, I would like to let this thread set idle for a day.

I agree that this could get confusing, I tend to do things methodically so I know what caused what and not just throw things up against the wall and see if something sticks. If I do too many things at once I have no idea what might cause additional problems or what fixed the problem.

Please be patient

c7c4c7 · Sep 23, 2020

The machine has been stable now for about 3 days. I applied all the updates, took a while because te reserve partition kept running out of space. I finally added 100 MB to reserve partition and got everything else applied, I did nothing else.
Both Kaspersky and Malwarebytes are still on the machine.

I am curious why Kaspersky was such a heavy suspect, is it known to cause problems?

zbook · Sep 23, 2020

When available please update the thread with the results from post #2.

The logs displayed drive problems.

c7c4c7 · Sep 24, 2020

Here is the output of the Disk test(s). Not aware of any log for the Seagate test, but it passed as well. Samsun Magician sees no errors either
Please explain my earlier question about Kaspersky

zbook · Sep 24, 2020

Please upload new Sysnative log collector results.

Had there be drives temporarily connected since 4/2020?

What was done with each of the three drivers displayed in post #2?

Code:

Event[201]:
  Log Name: System
  Source: disk
  Date: 2020-09-15T12:41:38.275
  Event ID: 7
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Marilyn-PC
  Description:
The device, \Device\Harddisk1\DR1, has a bad block.

Code:

Event[954]:
  Log Name: System
  Source: disk
  Date: 2020-09-08T14:08:57.065
  Event ID: 7
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Marilyn-PC
  Description:
The device, \Device\Harddisk1\DR1, has a bad block.

Code:

Event[1022]:
  Log Name: System
  Source: disk
  Date: 2020-09-05T10:23:25.793
  Event ID: 7
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Marilyn-PC
  Description:
The device, \Device\Harddisk1\DR1, has a bad block.

Code:

Event[1459]:
  Log Name: System
  Source: disk
  Date: 2020-08-31T05:38:40.595
  Event ID: 7
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Marilyn-PC
  Description:
The device, \Device\Harddisk1\DR1, has a bad block.

Code:

Event[2129]:
  Log Name: System
  Source: disk
  Date: 2020-08-10T05:58:21.757
  Event ID: 7
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Marilyn-PC
  Description:
The device, \Device\Harddisk1\DR1, has a bad block.

Code:

Event[7332]:
  Log Name: System
  Source: disk
  Date: 2020-06-05T12:42:52.097
  Event ID: 7
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Marilyn-PC
  Description:
The device, \Device\Harddisk1\DR1, has a bad block.

Code:

Event[10820]:
  Log Name: System
  Source: disk
  Date: 2020-04-28T08:59:18.247
  Event ID: 7
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Marilyn-PC
  Description:
The device, \Device\Harddisk1\DR1, has a bad block.

x BlueRobot · Sep 24, 2020

c7c4c7 said:
I am curious why Kaspersky was such a heavy suspect, is it known to cause problems?

Please see my post here - Need help with Random BSOD

I can provide further details if you wish as well.

In addition to the above, almost all of your crashes were related to your network stack and Kaspersky is known to cause network-related issues since it attaches its drivers into the network driver stack.

c7c4c7 · Sep 24, 2020

I think I'm done here. The problem has been resolved, the machine has not suffered any more problems since all the updates have been applied.

In response to the question about the hard drive. There was a thumb drive installed to move files around

I appreciate all of the input from everyone

Thanks

[SOLVED] Need help with Random BSOD

BSOD Enthusiast

Attachments

Member

Sysnative Staff, BSOD Kernel Dump Senior Analyst

Administrator

Member

BSOD Enthusiast

Member

BSOD Enthusiast

Member

BSOD Enthusiast

Attachments

Member

Administrator

Administrator

BSOD Enthusiast

BSOD Enthusiast

Member

BSOD Enthusiast

Attachments

Member

Administrator

BSOD Enthusiast