BSoD while starting up

swarfega · 29 Dec 2017

I turned my computer on as I do every morning today but this time I got a BSoD out of the blue. I didn't get a chance to read it, so I'm not sure what the cause of it was.

Computer was running fine all day yesterday and I did not install anything new.

As a side note, MBM has stopped working and keeps popping up saying real time protection is turned off and I can't turn it back on. I have posted this on their forum.

zbook · 29 Dec 2017

Hi swarfega,

There was 1 BSOD mini dump file.
Debugging did not display a definitive misbehaving driver.
The bugcheck was EF
More dumps are needed for the debugging.

There was a BSOD on 11/19/2017 and at that time there was 1 misbehaving hardware driver identified.
It was bugcheck 133 and the misbehaving driver was the wireless driver.

Perform the following steps:
1) open administrative command prompt and type or copy and paste:
2) sfc /scannow
3) dism /online /cleanup-image /restorehealth
4) chkdsk /scan
5) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread
6) backup all files to another drive or to the cloud
7) make a backup image using Macrium:
Macrium Software | Macrium Reflect Free
8) save the backup image to another drive or to the cloud
9) make a brand new restore point
10) Windows driver verifer is a tool that is used to find misbehaving drivers. It will repetitively stimulate drivers to produce BSOD until all misbehaving drivers are fixed or until the tool is turned off.
There are 3 methods to turn off the tool and all are done using the Windows advanced troubleshooting menu:
1) startup options > click reset > select safe mode with command prompt > type: verifier /reset
2) command prompt > Administrator X: \windows\system32\cmd.exe > type: verifier /bootmode resetonbootfail
3) system restore
The methods to turn off windows driver verifier should be done in the order above and only advance if the prior method failed. Using system restore often leads to a loss of the BSOD mini dump file and little progress is made in the troubleshooting.

There may be sluggishness while using windows driver verifier and this is related to the number of drivers being tested and the number of tests boxes that are active.

The tool will be run for 48 hours. After the last BSOD it will be run for an additional 36 hours with typical computer use. If there are no further BSOD that will conclude the troubleshooting with this tool.

Use this link for the test settings:
Driver Verifier-- tracking down a mis-behaving driver. - Microsoft Community

Use this link for the methods to turn off windows driver verifier:
Enable and Disable Driver Verifier in Windows 10 Performance Maintenance Tutorials

After each BSOD please post a new zip into the thread for troubleshooting:
BSOD - Posting Instructions - Windows 10 Forums

Code:

19/11/2017 15:36    Windows Error Reporting    Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 133
P2: 1
P3: 1e00
P4: fffff80072e77370
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\111917-6468-01.dmp
\\?\C:\Windows\TEMP\WER-10125-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER47D7.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER47E8.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER47F8.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_133_5c3bc1c459d63de6dba978fd226e626f70238340_00000000_cab_032c4805

Analysis symbol: 
Rechecking for solution: 0
Report ID: 5b559dd2-8f2d-45d4-8d9c-3aad3779ac3b
Report Status: 4
Hashed bucket:29/12/2017 08:28    Windows Error Reporting    Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: ef
P2: ffffcb0657a325c0
P3: 0
P4: 0
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\122917-5812-01.dmp
\\?\C:\Windows\TEMP\WER-9578-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3827.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3836.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3866.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_ef_e0cc55c18992d2f379963634517e2e12f9feed5b_00000000_cab_02f83865

Analysis symbol: 
Rechecking for solution: 0
Report ID: 25dcfca8-d19c-4c52-9708-6f44b5510d39
Report Status: 4
Hashed bucket:

Code:

19/11/2017 15:36 Windows Error Reporting Fault bucket 0x133_ISR_Qcamain10x64!HIFTargetSleepStateAdjust, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: c209942c-970c-4d9f-b1ee-526edbc4f7a2

Problem signature:
P1: 133
P2: 1
P3: 1e00
P4: fffff80072e77370
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\111917-6468-01.dmp
\\?\C:\Windows\TEMP\WER-10125-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER47D7.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER47E8.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER47F8.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_133_5c3bc1c459d63de6dba978fd226e626f70238340_00000000_cab_0b7cf56c

Analysis symbol: 
Rechecking for solution: 0
Report ID: 5b559dd2-8f2d-45d4-8d9c-3aad3779ac3b
Report Status: 268435456
Hashed bucket:29/12/2017 08:29 Windows Error Reporting Fault bucket 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_c0000005_ntdll.dll!RtlpWaitOnCriticalSection_nt!PspCatchCriticalBreak, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 57fec42a-ba19-4d6f-839f-2754d95b7d74

Problem signature:
P1: ef
P2: ffffcb0657a325c0
P3: 0
P4: 0
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\122917-5812-01.dmp
\\?\C:\Windows\TEMP\WER-9578-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3827.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3836.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3866.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_ef_e0cc55c18992d2f379963634517e2e12f9feed5b_00000000_cab_0b186755

Analysis symbol: 
Rechecking for solution: 0
Report ID: 25dcfca8-d19c-4c52-9708-6f44b5510d39
Report Status: 268435456
Hashed bucket:

Qcamain10x64.sys

Qualcomm Atheros Extensible Wireless LAN device driver

Download - http://www.killernetworking.com/supp...iver-downloads
Support - http://www.killernetworking.com/about/contact

Code:

Name    [00000001] Qualcomm Atheros QCA61x4A Wireless Network AdapterAdapter Type    Ethernet 802.3Product Type    Qualcomm Atheros QCA61x4A Wireless Network AdapterInstalled    YesPNP Device ID    PCI\VEN_168C&DEV_003E&SUBSYS_86CD1043&REV_32\4&3B8F663&0&00E2Last Reset    29/12/2017 08:34Index    1Service Name    Qcamain10x64IP Address    Not AvailableIP Subnet    Not AvailableDefault IP Gateway    Not AvailableDHCP Enabled    YesDHCP Server    Not AvailableDHCP Lease Expires    Not AvailableDHCP Lease Obtained    Not AvailableMAC Address    ‪D8:FB:5E:32:CA:AD‬Memory Address    0xDF200000-0xDF3FFFFFIRQ Channel    IRQ 4294967281Driver    c:\windows\system32\drivers\qcamain10x64.sys (4.0.2.262, 2.24 MB (2,344,448 bytes), 29/09/2017 13:40)

Code:

Qcamain10x64 Qcamain10x64.sys Thu Oct 27 02:21:19 2016 (5811AAEF)

Ztruker · 29 Dec 2017

Along with what zbook found, I saw this:

The msinfo32.nfo WER data (Windows Error Report) has a ton of MBAM errors in it. Many, many Application errors and many Windows Error Reporting.

Code:

29/12/2017 08:55
Application Error
Faulting application name: mbamservice.exe, version: 3.1.0.595, time stamp: 0x59f745cb
Faulting module name: MwacControllerImpl.dll, version: 3.0.0.216, time stamp: 0x5a1c446b
Exception code: 0xc0000409
Fault offset: 0x000000000019a548
Faulting process ID: 0x1958
Faulting application start time: 0x01d38081a2232424
Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
Faulting module path: C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacControllerImpl.dll
Report ID: f188d3ed-7082-4a37-beac-ed022f06c02a
Faulting package full name: 
Faulting package-relative application ID:

Code:

29/12/2017 08:55
Windows Error Reporting
Fault bucket 1887324125158754350, type 5
Event Name: BEX64
Response: Not available
Cab Id: 0
Problem signature:
P1: mbamservice.exe
P2: 3.1.0.595
P3: 59f745cb
P4: MwacControllerImpl.dll
P5: 3.0.0.216
P6: 5a1c446b
P7: 000000000019a548
P8: c0000409
P9: 0000000000000002
P10: 
Attached files:
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7CE4.tmp.mdmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D63.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D61.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D71.tmp.txt
\\?\C:\Windows\Temp\WER7D73.tmp.appcompat.txt
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mbamservice.exe_27789efbba106baf4968ff1c3f72695624086f5_080664ac_cab_09eb7d90\memory.hdmp
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_mbamservice.exe_27789efbba106baf4968ff1c3f72695624086f5_080664ac_26bb834c
Analysis symbol: 
Rechecking for solution: 0
Report ID: f188d3ed-7082-4a37-beac-ed022f06c02a
Report Status: 268435456
Hashed bucket: ac7d56d013c13bd4ca311f4ad81cc82e

Also hundreds of these as well:

Code:

06/12/2017 08:33
Application Error
Faulting application name: ATKEX_cmd.exe, version: 0.0.0.0, time stamp: 0x00000000
Faulting module name: KERNELBASE.dll, version: 10.0.16299.15, time stamp: 0x2cd1ce3d
Exception code: 0x0eedfade
Fault offset: 0x001008b2
Faulting process ID: 0x3630
Faulting application start time: 0x01d36e6ce69bd5f5
Faulting application path: C:\Program Files\Realtek\Audio\HDA\ATKEX_cmd.exe
Faulting module path: C:\Windows\System32\KERNELBASE.dll
Report ID: 513ee64f-eee3-40db-97e7-70d4f21dfc1d
Faulting package full name: 
Faulting package-relative application ID:

I know you are working on MBAM but I would uninstall it for now as it may be contributing to your problem. Also check for a newer driver for your Realtek Soundblaster card/device.

Note: Looks like there waas an update released today, 12/29/2017: Creative Support