BSOD: Driver_corrupted_expool while working, crashing during youtube

agentzen · 19 Apr 2017

Hey there, I seem to have two issues but I'm not sure they're related.

I work virtually from home using Cisco Anyconnect. Recently, my computer (my actual computer, not remote desktop) has been crashing with the error: Driver_Corrupted_Expool multiple times a day. Besides connecting to work remotely there is nothing I'm doing at work that seems to trigger it.

I've also in the past few months noticed crashing while watching youtube videos (not when working/using Cisco Anyconnect). Most recently this happened last night (April 18th) some time after 5PM. When my computer crashes from a youtube video, generally the screen goes black, the audio stops and I'm unable to do anything to recover it beyond restarting the computer. This is a difficult problem to re-create, but watching youtube videos full screen seems to do the trick.

I don't watch youtube videos at work so not sure if they're related.

I have already done a clean install of older video card drivers (using DDU safe mode for the clean install). I've also updated my Audio driver, Chipset driver, and updated BIOS last night, but I'm still crashing. I had a presentation to do at work today so I had my video output just coming from my MOBO (thinking this might have something to do with GPU drivers) and uninstalled GPU drivers in device manager in hopes that I might be able to prevent my system from crashing but.. again it crashed during work with Driver_Corrupted_Expool message.

If the problems are unrelated, I can deal with youtube crashes, but the BSOD during work is a problem I need to solve ASAP.

Editing to add: I've looked at bluescreenview and the driver corrupted expool and system service exception bugs seem to happen while working. The thread stuck in device driver bug seems to happen while off work and likely watching youtube. I've not had any crashes while gaming.

Please help!

Ztruker · 19 Apr 2017

Latest dump shows a problem with Cisco AnyConnect - acsock64.sys.

Code:

BugCheck C5, {760e0002, 2, 0, fffff8036d0d8850}
*** WARNING: Unable to verify timestamp for acsock64.sys
*** ERROR: Module load completed but symbols could not be loaded for acsock64.sys
Probably caused by : memory_corruption
Followup:     memory_corruption
---------

I looked at several different dumps and they are all the same.

Is there a newer version of the Cisco VPN software you can install? Maybe talk to your IT folks and see what they say?

You could test your ram but most likely it's the Cisco software that is causing the memory_corruption. If you would like to test your ram, an overnight run should do it with 8GB.
===================================================
Follow this tutorial: MemTest86+ - Test RAM - Windows 10 Forums

MemTest86+ is a diagnostic tool designed to test Random Access Memory (RAM) for faults. MemTest86+ will verify that:

RAM will accept and keep random patterns of data sent to it
There are no errors when different parts of memory try to interact
There are no conflicts between memory addresses

Memtest86+ runs from bootable media to isolate the RAM from the system, no other components are taken into account during the test.

Warning

MemTest86+ needs to run for at least 8 passes to be anywhere near conclusive, anything less will not give a complete analysis of the RAM.

If you are asked to run MemTest86+ by a Ten Forums member make sure you run the full 8 passes for conclusive results. If you run less than 8 passes you will be asked to run it again.

Note

MemTest86+ has been known to discover errors in RAM in later passes than the eighth pass. This is for information only; if you feel there is a definite problem with the RAM and 8 passes have shown no errors feel free to continue for longer.

Running 8 passes of MemTest86+ is a long and drawn out exercise and the more RAM you have the longer it will take. It's recommended to run MemTest86+ just before you go to bed and leave it overnight.

Take a picture when done and post in the forum please.

agentzen · 19 Apr 2017

I figured it might be Cisco. There does appear to be newer versions available from Cisco but not from IT. I uninstalled and ran IT's reinstall tool for Cisco Anyconnect but unfortunately didn't check to see what version I had uninstalled. I'll have to see if I have similar issues tomorrow and see what IT says from there.

Any insight into the dumps from 12/17 to 2/7? These were thread stuck in device driver errors. I had another one last night, in the zip its 020717-3250-01.dmp

Ztruker · 19 Apr 2017

12/17 indicates a video problem:

Code:

BugCheck 100000EA, {ffffb984c5d28800, 0, 0, 0}
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys

Driver Description: ATI Video driver (remove the Catalyst Control Center and only install the Display Driver)
Driver Update Site: http://support.amd.com/us/Pages/AMDSupportHub.aspx

Same for the ones in January and February.

Did you remove a video card? It looks like you now have a Intel(R) HD Graphics 530.

agentzen · 19 Apr 2017

Sort of. I had started using two monitors on Friday when the Driver_corrupted_expool bug began. I needed the two monitors specifically for this week and would have continued using them but the bsods on monday and tuesday had me thinking the two displays were causing the bug.

In addition to that the crashing on 12/17 and in Jan and Feb and brief research into what showed on my screen during those bsods had me thinking the GPU/drivers might be the issue.

In an effort to salvage a training session I was leading and really needed two monitors for I switched to integrated graphics in my bios, uninstalled drivers for my GPU and tried to run two monitors off of the integrated graphics. Still crashed. So thats why I came here.

Now I remember that IT had us install a new quick connect type program that interacts with Cisco which has a reinstall tool added into it. I'm hoping its a newer version of Cisco than I had previously.

agentzen · 19 Apr 2017

After taking a look at System Restore, I was able to determine that the version of Cisco AnyConnect I was using was 4.2.01035. I did some research and found release notes for AnyConnect 4.2.X. I've found that the build directly after this resolved an issue that they describe as BSOD on Windows 8.1 and Windows 10. I using an updated version now so hopefully this is solved.

I ran DDU to get rid of any remnants of AMD drivers and re-installed what I've heard is a solid driver and unselected any additional software during the install process. Hoping that issue is solved as well. Will report back or mark as solved.

Ztruker · 20 Apr 2017

Lot of good work on your part, hope it pays off. Good luck.

agentzen · 20 Apr 2017

Thank you for your help. No crashing today after 9 hours of using Cisco VPN. I still have an issue with my screen going black, audio cutting out, and the computer locking up randomly when watching full screen youtube videos, but I'm not getting a BSOD so I'll keep working on that. Otherwise marking this solved.