[Win8.1 x64] BSOD when laptop Lenovo Flex 14 is left idle

[Dplc17]

Hello there!

A year ago my laptop (Lenovo Flex 14) started to get slower. BSOD started months after. However, I noticed that BSOD only happened during times when I left my laptop idle for more than 20 minutes. I tried to follow the steps for posting and got the SysnativeFileCollectionApp + SysnativeFileCollectionApp.zip (see attached) but I was getting errors in running the PERFMON System Health Report. It wrote " An error occurred while attempting to generate the report. The operator has refused the request."

I hope someone can help me with my problem. Thank you in advanced!

P.S. I also performed a sfc/scannow and got the CBS log file. It said that there were problems but the computer was not able to repair them. I just can't understand what it all means O.O. Attached the CBS.log file too if ever it helps.

 

[xilolee]

Hi Dplc17. :welcome:

I can't see newer dumps (there are two from 2015): maybe your laptop needs to be cleaned (i.e., remove the dust inside the laptop and from its fans).
If that won't help, try to remove/uninstall "umonit64.exe" (Gene USB Monitor or Change Icon ???) and daemon tools.

 

[Dplc17]

Hi xilolee! Thanks for replying! (Apologies for the late reply!)

I tried cleaning my laptop and I also removed daemon tools. It didn't seem to help. How can I safely remove "umonit64.exe"? Not sure if this means something but I checked and it was located in C:\Windows|SysWOW64 and D:\drivers\Cardreader\common.

 

[jcgriff2]

I tried cleaning my laptop and I also removed daemon tools. It didn't seem to help. How can I safely remove "umonit64.exe"? Not sure if this means something but I checked and it was located in C:\Windows|SysWOW64...

Do you know what "umonit64.exe" belongs to? i.e., what app? If not, please go to \windows\syswow64, look for "umonit64.exe"; RIGHT-click on it; select "properties" &/or "details" tab and see if any information is listed.

\windows\syswow64 is a very strange place for a 3rd party EXE file to be located in. \Program Files(x86) is normally where an installer installs x86 executable (EXE) files.

\windows\syswow64 is pure 32-bit (x86); is only accessed by x86 apps running in an x64 environment; is the x86 equivalent of \windows\system32 (pure x64). Usually the apps look for ..\system32, but Windows redirects x86 apps to \syswow64.

If "umonit64.exe" is just a leftover piece of an uninstalled app, then it is probably OK to delete. Or you can reinstall the app + uninstall it hoping it will take "umonit64.exe" with it this time.

BTW - how did "umonit64.exe" come to light in this thread? Did you experience some type of error and a pop-up screen subsequently named it? Or...?

If you do end up deleting "umonit64.exe" be sure to create a system restore point first - https://www.sysnative.com/forums/wi...e-restore-point-windows-10-8-1-8-7-vista.html

Regards. . .

jcgriff2

 

[xilolee]

How can I safely remove "umonit64.exe"? Not sure if this means something but I checked and it was located in C:\Windows|SysWOW64 and D:\drivers\Cardreader\common.

If it's a driver for the Card Reader in your laptop, leave it there.
Maybe its location in c:\windows\syswow64 sounded suspicious to me...
If you don't have a card reader in your laptop, then it could be malware and it needs to be removed.

 

[Dplc17]

I looked at the properties of UMonit64..exe and it said it was a ChangeIcon MFC Application. I decided not to delete it since I think its part of the Genesys USB Mass Storage Device based on my research (?).

@jcgriff2 I was just asking about UMonit64.exe because xilolee suggested to delete it. I did not have any pop-up screens pertaining to that file. The main problem that I am having is the BSOD when left idle for 30 mins.

Also, I decided to install Malwarebytes hoping that it can solve my problem. However when I do a full system scan, I always get a BSOD after 15-30 mins. I tried it for 5-6 times, still the same result. I don't understand what's wrong with my laptop. T.T Could it be a hardware problem?

 

[writhziden]

Event[5]:
Log Name: System
Source: mfehidk
Date: 2017-03-08T12:52:15.131
Event ID: 516
Task: N/A
Level: Warning
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: Lenovo-Flex14
Description:
Process **\MCUPDA~1.EXE pid (3116) contains signed but untrusted code, but was allowed to perform a privileged operation with a McAfee driver.

Your system may be infected. I just found the above. Check the following link for more information: McAfee Corporate KB - Event ID 514'/'516'/'519, Warning, Process '*''*''\'VSTSKMGR.EXE pid '('XXXX')' contains signed but untrusted code '('Troubleshooting')' KB71083