When's the last time you received a blue screen? Because your most recent bsod log is dated back on March 31st. The one before that was March 22nd.

 

Oops. Your most recent one is actually Wed Jan 28 16:16:39.356 2015 (UTC - 5:00). The previously mentioned March dates above are from 2014. Sorry for any confusion.

 

Thanks for the quick reply.

The last time was 10th April for sure.

 

Visit How to Check Computer is set to collect dumps please. Let me know if you had to change any of the settings here

 

This is a screenshot of the settings had. I've now changed 'Write Debugging Information' from Kernel memory dump to small memory dump.

Thanks.

 

Ok, that's good.
In the meantime, you can zip and attach the C:\Windows\MEMORY.DMP file for analysis.

 

I think that file might be too big to attach directly here (it's about 286MB zipped).

 

You're right. Try OneDrive or Google Drive.

 

Here's a link:

https://onedrive.live.com/redir?resid=F767E04F2F7142AB!126

 

Hi I am going to speak to a colleague for more information about the dump file you provided.

In the meantime, please do the following:

run Chkdsk:

Chkdsk (there are various ways to run Chkdsk):

Method 1:

Start > Search bar > Type cmd (right click run as admin to execute Elevated CMD)

Elevated CMD should now be opened, type the following:

chkdsk x: /r

x implies your drive letter, so if your hard drive in question is letter c, it would be:

chkdsk c: /r

Restart system and let chkdsk run.

Method 2:


Open the "Computer" window
Right-click on the drive in question
Select the "Tools" tab
In the Error-checking area, click <Check Now>.

If you'd like to get a log file that contains the chkdsk results, do the following:

Press Windows Key + R and type powershell.exe in the run box

Paste the following command and press enter afterwards:

get-winevent -FilterHashTable @{logname="Application"; id="1001"}| ?{$_.providername –match "wininit"} | fl timecreated, message | out-file Desktop\CHKDSKResults.txt

This will output a .txt file on your Desktop containing the results of the chkdsk.

 

chkdsk results:

 

Have you received any bsod's since you changed the system from full to mini dmps?

If so please zip up and attach or rerun the data collection app

 

I haven't. I will do if it happens again.

 

That full dump is corrupt all I can tell is that it was BBC 124 meaning a processor core hung but without a driver or memory list there are no clues as to why.

 

Some other steps you can do in the meantime:

Remove this last trace of McAfee that is causing a lot of errors using these steps below

Start > Search bar > Type cmd (right click run as admin to execute Elevated CMD)

Elevated CMD should now be opened, type the following in the order listed below:

1. taskkill /f /im 025363~1.exe
2. del /a/f/q C:\Users\Benjamin\AppData\Local\Temp\025363~1.EXE
3. sc stop 0253631352147901mcinstcleanup
4. sc delete 0253631352147901mcinstcleanup
5. exit

McAfee Application Installer Cleanup (0253631352147901)	0253631352147901mcinstcleanup	Stopped	Auto	Own Process	c:\users\benjamin\appdata\local\temp\025363~1.exe -cleanup -nolog	Ignore	LocalSystem	0

      6168   07/05/2014      21:42:25  "C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_025363~1.EXE_8c363bf08c99d3baef34b851a42d1b0584d3ed2_0106a3dc\Report.wer"
      6268   22/11/2014      16:07:34  "C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_025363~1.EXE_8c363bf08c99d3baef34b851a42d1b0584d3ed2_01121d4f\Report.wer"
      6382   11/09/2014      18:35:09  "C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_025363~1.EXE_8c363bf08c99d3baef34b851a42d1b0584d3ed2_01175179\Report.wer"
      6168   08/06/2014      09:53:54  "C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_025363~1.EXE_8c363bf08c99d3baef34b851a42d1b0584d3ed2_016f85e1\Report.wer"
      6660   02/04/2015      20:32:53  "C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_025363~1.EXE_8c363bf08c99d3baef34b851a42d1b0584d3ed2_01a40d96\Report.wer"

__

Let's uninstall Avast antivirus too. -> Run the following tool from Safe Mode. - https://www.avast.com/en-us/uninstall-utility

The device, avast! Firewall NDIS Filter Miniport, is reporting "tv_ConfigMgrErr19". This device will not be available until the issue is resolved. The Plug and Play ID for this device is 15.

	A device has a configuration problem that prevents it from working properly.
Details:	The device, CD-ROM Drive, is reporting "52". This device will not be available until the issue is resolved. The Plug and Play ID for this device is DTSOFTBUS-REV1\DTCDROM-REV1\1-79F5D87-3-00.

    283200   22/04/2013      15:38:56  "C:\Program Files (x86)\DAEMON Tools Lite\dtsoftbus01.sys"

And lastly, for now, please uninstall Daemon Tools while we are working together.

 

Thanks again.

I tried step 1 of the sequence and got this error message

I've uninstalled Daemon Tools but I'm a bit apprehensive about getting rid of avast as it's the main antivirus software I have on my machine.

 

Thanks again.

I tried step 1 of the sequence and got this error message

Don't worry about the output messages. :smile:

 

Try using this tool to remove McAfee remnants: How to uninstall or re-install supported McAfee products using the Consumer Products Removal tool

Removing/disabling 3rd party AV is common to both BSOD and Malware issues, Remove Avast and run their removal tool, install MSE instead during troubleshooting: https://www.avast.com/uninstall-utility
Microsoft Security Essentials - Microsoft Windows

 

Hi again.

After a couple of weeks of no issues I've started having regular blue screen crashes over the past couple of days. I've attached another Sysnative zip (hopefully it should have recorded the crashes correctly this time).

If you could take another look I'd really appreciate it.

 

They are all WHEA_UNCORRECTABLE_ERROR (124) errors
Which means either the CPU has developed a problem on 1 core, the CPU is overheating or a driver is causing a internal loop and causing the core to hang.

In the unloaded module list in all 4 are chrome and Trusteer Rapport drivers, I'm not overly familiar with Rapport what are you using for and is it something you can uninstall for testing?

Unloaded modules:
fffff880`09398000 fffff880`093a9000   WinUsb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff880`093a9000 fffff880`093df000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00036000
fffff880`09287000 fffff880`092ee000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09386000 fffff880`093ed000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09287000 fffff880`092ee000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09386000 fffff880`093ed000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09287000 fffff880`092ee000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09386000 fffff880`093ed000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09287000 fffff880`092ee000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09386000 fffff880`093ed000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09287000 fffff880`092ee000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09386000 fffff880`093ed000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09287000 fffff880`092ee000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09386000 fffff880`093ed000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09287000 fffff880`092ee000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09386000 fffff880`093ed000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09287000 fffff880`092ee000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09386000 fffff880`093ed000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09287000 fffff880`092ee000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09386000 fffff880`093ed000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09287000 fffff880`092ee000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09386000 fffff880`093ed000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09287000 fffff880`092ee000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09386000 fffff880`093ed000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09287000 fffff880`092ee000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09386000 fffff880`093ed000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09287000 fffff880`092ee000   rapportiaso6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00067000
fffff880`09386000 fffff880`093f7000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00071000
fffff880`05206000 fffff880`05246000   RtsUStor.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00040000
fffff880`018a4000 fffff880`018b2000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff880`018b2000 fffff880`018be000   dump_pciidex
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff880`018be000 fffff880`018c9000   dump_msahci.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000B000
fffff880`018c9000 fffff880`018dc000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00013000
fffff880`018dc000 fffff880`01906000   cdrom.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0002A000
fffff880`01822000 fffff880`01845000   aswFW.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00023000

 

Rapport is a bit of software my bank recommended installing to make online banking more secure. I can't remember the last time I had an update for it though.

https://www.trusteer.com/ProtectYourMoney

 

Rapport can be really tricky - uninstall it during testing, once you can get rid of the BSODs, you might want to try installing the latest version of Rapport again.

 

Ok I've uninstalled. Hopefully this improves things.

 

After uninstalling Rapport my crashes have unfortunately persisted. I have noticed that this seems to happen when I am watching youtube videos. I don't know if this indicates some sort of graphics issue.

I've attached another report (created today) so if anyone could take another look it would be much appreciated.

 

The latest dmp file is from the 13th?

Have you checked the temps?


D/L and run Hardware Monitor do something intense like a virus scan or gaming for a bit, Alt+Tab back to HWM expand all the trees and use the Win7 snipping tool to grab a screen shot of the HWM window, post the screen shot using the paperclip button in the advanced message box(Go Advanced button).

 

Sorry, what did you mean by temps?

I've attached a screenshot of HWM taken whilst running an MSE virus scan. I've also now uninstalled Avast!.

Thanks.

 

Avast antivirus drivers still present as well :/
Not to sound rude or anything, but what is the point in asking for our help if you don't follow our recommendations?

aswHwid.sys        Tue Apr 21 08:01:20 2015 (55364A20)
aswMonFlt.sys      Tue Apr 21 08:00:52 2015 (55364A04)
aswRdr2.sys        Tue Apr 21 08:01:31 2015 (55364A2B)
aswRvrt.sys        Tue Apr 21 08:00:59 2015 (55364A0B)
aswSnx.sys         Tue Apr 21 08:01:36 2015 (55364A30)
aswSP.sys          Tue Apr 21 08:16:09 2015 (55364D99)
aswStm.sys         Tue Apr 21 08:18:49 2015 (55364E39)
aswVmm.sys         Tue Apr 21 08:15:40 2015 (55364D7C)

 

Temps look ok there since you have notice watching videos triggers the problem you may want to monitor HWM while watching Utube Max temp for a E350 is 90c.