Windows 8 and 8.1 Forums

Continual BSOD with occurrence of 0xC000021A an others

  1. #1

    Posts : 5
    Windows 8.1

    Continual BSOD with occurrence of 0xC000021A an others

    I've just started getting a lot of BSODs in Win 8.1. It started a day or so ago. I did install a second NIC for Hyper-V but I have removed that just to eliminate it from the equation.The crash is random, either away from the machine or working on it. Explorer crashes or hangs, ALL Browsers occasionally error and it'll just crash.

    I am also getting errors such as:

    error -5 from inflate: (null)
    error decompressing shell32.dll

    I have had various errors on blue scree noted below, once I reboot it appears okay for a time but is getting slowly worse.

    The error on the blue screen is random:


    I've run sfc /scannow. Initially this found a few problems that it couldn't fix which is related to "WRP found corrupt files but was unable to fix" I have also run in SAFE MODE same error.

    I have also ran Dism /Online /Cleanup-Image /RestoreHealth, which gave me an RPC error and couldn't complete.

    chkdsk /f finds no issues.
    All Windows updates up-to-date as of today.

    I have removed All MalwareBytes software.

    I am fast running out of ideas before I reinstall.. but I have a lot of software that I don't want to have to reinstall I'm asking for help. I've attached the zip per the forum instructions.

    System is:
    i5-4660 3.2GHz
    8GB DDR3
    Gigabyte Z97XGaming 5 motherboard
    256Gb SSD (C: drive)
    Seagate Technologies 2TB HDD (D: drive)
    Seagate Technologies 2TB HDD (F: drive)

    Windows 8.1 Pro
    Avast 2014.09.2021
    Chrome browser of choice
    MS Office 2013
    Last edited by TitaniumBoy; 24 Sep 2014 at 15:59. Reason: misspellings and grammar

      My System SpecsSystem Spec

  2. #2

    Posts : 2,097
    Windows 8.1 Industry Pro B-)

    Hi TitaniumBoy & Welcome to the forums ^_^,

    I have analysed your latest dump files and below has been provided an analysis of the same for informative purposes. Most of the Memory_Management Dump files did not provide any valuable information -
    3: kd> !analyze -v
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arg1: ffffd00043a7e140, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff800d6a3570b, If non-zero, the instruction address which referenced the bad memory
    Arg4: 0000000000000000, (reserved)
    Debugging Details:
    Could not read faulting driver name
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff802f9165138
    unable to get nt!MmNonPagedPoolStart
    unable to get nt!MmSizeOfNonPagedPoolInBytes
    fffff800`d6a3570b 488b8424f0000200 mov     rax,qword ptr [rsp+200F0h]
    PROCESS_NAME:  svchost.exe
    ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
    TRAP_FRAME:  ffffd00043a5dec0 -- (.trap 0xffffd00043a5dec0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=ffffe000cf7ced58 rbx=0000000000000000 rcx=0000000000000200
    rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff800d6a3570b rsp=ffffd00043a5e050 rbp=ffffd00043a5e750
     r8=ffffc001bde713fc  r9=0000000000000404 r10=ffffc001bde71000
    r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    fffff800`d6a3570b 488b8424f0000200 mov     rax,qword ptr [rsp+200F0h] ss:0018:ffffd000`43a7e140=????????????????
    Resetting default scope
    LAST_CONTROL_TRANSFER:  from fffff802f8f960e7 to fffff802f8f64fa0
    ffffd000`43a5dcd8 fffff802`f8f960e7 : 00000000`00000050 ffffd000`43a7e140 00000000`00000000 ffffd000`43a5dec0 : nt!KeBugCheckEx
    ffffd000`43a5dce0 fffff802`f8e789c9 : 00000000`00000000 ffffe000`d072a080 ffffd000`43a5dec0 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x20c37
    ffffd000`43a5dd80 fffff802`f8f6f22f : 00000000`00000000 ffffe000`cfeba000 00000000`00000000 ffffd000`43a5dec0 : nt!MmAccessFault+0x7a9
    ffffd000`43a5dec0 fffff800`d6a3570b : ffffd000`43a50324 ffffe000`cfeba000 ffffd000`43a5e750 00000000`00000000 : nt!KiPageFault+0x12f
    ffffd000`43a5e050 fffff800`d6a5ca0a : ffffe000`cfeba000 ffffe000`cfe32870 ffffe000`cf7cec60 ffffe000`cfee8440 : CLFS!CClfsLogFcbPhysical::ReserveAndAppendLog+0x12b
    ffffd000`43a5e120 fffff800`d6a5ccf3 : ffffe000`cf7cec60 00000000`00000000 ffffe000`cdffc350 00000000`00000000 : CLFS!CClfsRequest::ReserveAndAppendLog+0x2ba
    ffffd000`43a5e230 fffff800`d6a5fbd1 : ffffe000`cfe32870 ffffc001`bde6d2c0 ffffc001`bde71000 00000000`00000400 : CLFS!ClfsReserveAndAppendLogInternal+0x1f3
    ffffd000`43a5e330 fffff800`d6a5d5b4 : ffffc001`bde6d980 ffffd000`00001600 ffffc001`bde6d980 00000000`00000400 : CLFS!CClfsKernelMarshallingContext::AppendWriteBlockToFlushQueue+0x1d1
    ffffd000`43a5e420 fffff800`d6a5d087 : ffffc001`bde6d980 fffff802`f9206314 00000000`00000001 ffffd000`00000001 : CLFS!CClfsKernelMarshallingContext::ReserveAndAppendLog+0x454
    ffffd000`43a5e510 fffff800`d6a5cf21 : 00000000`00000000 ffffc001`ba095f70 ffffc001`b935db40 fffff800`00000001 : CLFS!ClfsReserveAndAppendLogAligned+0x157
    ffffd000`43a5e5b0 fffff802`f923eb91 : 00000000`00000278 00000000`00000004 ffffd000`3e8c0000 00000000`00000801 : CLFS!ClfsReserveAndAppendLog+0x51
    ffffd000`43a5e610 fffff802`f923e959 : ffffc001`ba095f70 00000000`00000000 ffffc001`ba095f70 ffffc001`00000002 : nt!CmpDoTransWriteLogRecord+0x71
    ffffd000`43a5e6b0 fffff802`f923e6f4 : ffffc001`00000000 ffffc001`b94dafe4 ffffd000`43a5e768 ffffc001`b935db40 : nt!CmpTransWriteLog+0x55
    ffffd000`43a5e710 fffff802`f91f4f4f : 01cf785f`00000004 ffffc001`baadf000 ffffc001`ffffffff ffffc001`bdd68774 : nt!CmAddLogForAction+0x29c
    ffffd000`43a5e7b0 fffff802`f91f5a32 : ffffc001`b928e730 ffffd000`43a5e920 ffffc001`00000004 ffffd000`43a5ea10 : nt!CmSetValueKey+0x397
    ffffd000`43a5e8c0 fffff802`f8f707b3 : ffffe000`d072a080 ffffd000`43a5eb80 000000b3`5767cfe8 000000b3`5767d3d0 : nt!NtSetValueKey+0x5e2
    ffffd000`43a5ea90 00007ffa`0310b18a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    000000b3`5767d338 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`0310b18a
    CHKIMG_EXTENSION: !chkimg -lo 50 -db !CLFS
    9 errors : !CLFS (fffff800d6a35009-fffff800d6a35f09)
    fffff800d6a35000  48  89  74  24  10  57  45  0f  b6 *db  41  0f  b6  f8  44  8b H.t$.WE...A...D.
    fffff800d6a35020  85 *d7  01  00  00  80  79  01  00 *0b  87  4d  01  00  00  0f ......y....M....
    fffff800d6a35330  00 *53  69  0f  b6  41  24  a8  3f  74  61  a8  c0  75  5d  0f .Si..A$.?ta..u].
    fffff800d6a35710  00 *02  00  48  89  44  24  38  c6  44  24  30  01  89  7c  24 ...H.D$8.D$0..|$
    fffff800d6a35770  0c *e9  00  00  45  32  f6  44  88  b4  24  80  00  00  00  44 ....E2.D..$....D
    fffff800d6a35820  41 *03  41  8b  d4  e8  0a  f4  ff  ff  eb  72  48  8d  05  dd A.A........rH...
    fffff800d6a35ab0  56  57  41  54  41  55  41  56  41 *5f  48  81  ec  90  00  00 VWATAUAVA_H.....
    fffff800d6a35f00  04  89  44  24  40  89  4c  24  34 *68  8b  8b  78  03  00  00 ..D$@.L$4h..x...
    MODULE_NAME: memory_corruption
    IMAGE_NAME:  memory_corruption
    FOLLOWUP_NAME:  memory_corruption
    FAILURE_ID_HASH_STRING:  km:memory_corruption_stride
    FAILURE_ID_HASH:  {574dbc1b-92cb-fb09-cb7a-cacc1bb2c511}
    Followup: memory_corruption
    As you can see from the analysis that the BugCheck occurred while the CLFS.sys was processing the Log files as it is the Common Log File System Driver. Now, since it is provided by Windows, chance of it being at fault is really less. Also, in many of the dump files the process which was running when the BSOD occurred was the MalwareBytes. Below is a list of 3rd party drivers present on your system :-
    **************************Wed Sep 24 15:33:31.774 2014 (UTC + 5:30)**************************
    MBfilt64.sys           Fri Jul 31 09:10:32 2009 (4A7267B0)
    point64.sys            Wed May 18 13:37:20 2011 (4DD37E38)
    bwcW8x64.sys           Wed Feb 13 22:55:48 2013 (511BCC9C)
    e22w8x64.sys           Thu Mar 21 02:54:01 2013 (514A28F1)
    athwnx.sys             Mon Apr  1 11:02:05 2013 (51591BD5)
    intelppm.sys           Thu Aug 22 14:16:35 2013 (5215CFEB)
    mbam.sys               Wed Oct 30 21:41:45 2013 (52712FC1)
    ISODrv64.sys           Thu Nov 21 06:52:28 2013 (528D6054)
    TeeDriverx64.sys       Thu Mar 13 23:51:52 2014 (5321F740)
    iwdbus.sys             Fri Mar 14 03:29:14 2014 (53222A32)
    RTKVHD64.sys           Fri Mar 14 16:33:23 2014 (5322E1FB)
    MBAMSwissArmy.sys      Fri Mar 21 03:42:35 2014 (532B67D3)
    igdkmd64.sys           Mon Mar 31 10:48:10 2014 (5338FA92)
    dump_iaStorA.sys       Fri Apr  4 04:30:05 2014 (533DE7F5)
    iaStorA.sys            Fri Apr  4 04:30:05 2014 (533DE7F5)
    aswHwid.sys            Thu Jun 26 17:01:26 2014 (53AC048E)
    aswMonFlt.sys          Thu Jun 26 17:02:51 2014 (53AC04E3)
    aswRdr2.sys            Thu Jun 26 17:03:28 2014 (53AC0508)
    aswKbd.sys             Thu Jun 26 17:04:01 2014 (53AC0529)
    aswSnx.sys             Thu Jun 26 17:04:44 2014 (53AC0554)
    aswRvrt.sys            Thu Jun 26 17:05:39 2014 (53AC058B)
    aswVmm.sys             Thu Jun 26 17:05:49 2014 (53AC0595)
    aswNdisFlt.sys         Thu Jun 26 17:06:26 2014 (53AC05BA)
    aswStm.sys             Thu Jun 26 17:17:09 2014 (53AC083D)
    aswSP.sys              Wed Jul  2 23:08:12 2014 (53B44384)
    **************************Tue Sep 23 21:14:19.410 2014 (UTC + 5:30)**************************
    mwac.sys               Wed Mar  5 03:17:40 2014 (531649FC)

    As you can see from the highlighted drivers, the MalwareBytes is still present on the system and loading along with Avast Antivirus. I would suggest you to firstly remove the MalwareBytes using this **TOOL**. Once this is done, if the problem still persists then please remove the Avast as well using this **TOOL**.

    Also test your RAM using Memtest by following this **GUIDE**.

    If the problems continue, I would require a Complete Dump file. The Complete Dump file is located in "C:\Windows\Memory.DMP". It may be a large dump file so I would strongly suggest you to ZIP the dump file before uploading it to a file hoster like Mediafire, OneDrive etc.

    Let me know how it goes ^_^
      My System SpecsSystem Spec

  3. #3

    Posts : 5
    Windows 8.1

    Hi, Thanks for looking at this. Yes the MB services were still installed however not started. I ran the MB removal tool, first on your list and that seems to have stabilised the system. No crashes in a couple of days. Thank You. I'll leave the thread open for a couple of days more then close if all okay. Loose threads cause crashes...
      My System SpecsSystem Spec

  4. #4

    Posts : 2,097
    Windows 8.1 Industry Pro B-)

    Quote Originally Posted by TitaniumBoy View Post
    Hi, Thanks for looking at this. Yes the MB services were still installed however not started. I ran the MB removal tool, first on your list and that seems to have stabilised the system. No crashes in a couple of days. Thank You. I'll leave the thread open for a couple of days more then close if all okay. Loose threads cause crashes...
    Glad to hear that the system has stabilised ^_^.

    Let me know in case of any further crashes.
      My System SpecsSystem Spec

  5. #5

    Posts : 5
    Windows 8.1

    You are welcome and thanks for you help.. Will now close the thread
      My System SpecsSystem Spec

  6. #6

    Posts : 2,097
    Windows 8.1 Industry Pro B-)

    Quote Originally Posted by TitaniumBoy View Post
    You are welcome and thanks for you help.. Will now close the thread
    Glad to hear that it has been resolved ^_^

      My System SpecsSystem Spec

  7. #7

    Posts : 5
    Windows 8.1

    Typical as soon as I close the thread the things starts crashing again!!! I am just gathering information.. I did uninstall the Avast as it was killing the streaming to ANY application via the internet and causing the sound to 'squelch' and stutter through bottlenecked data (throttling).

    I have run the removal tool for Avast as well..
      My System SpecsSystem Spec

  8. #8

    Posts : 5
    Windows 8.1

    I guess this about makes it pretty much certain where the error is then... Corsair 8GB (2x4GB) CML8GX3M2A1600C9 Low Profile.

    It looks like it's fallen over on the second half of the memory and I assume... maybe you can correct me here the second DIMM? It only 4 months old as well.. a brand new machine - almost..

    Attachment 51798

      My System SpecsSystem Spec

  9. #9

    Posts : 5,139
    Win8.1Pro - Finally!!!

    Looks like bad RAM to me. Remove the bad stick(s) and try running Memtest again.
    If it passes then, they try running one of the good sticks in the empty slots (to test to see if the slots are bad).
      My System SpecsSystem Spec

Continual BSOD with occurrence of 0xC000021A an others

Similar Threads
Thread Forum
BSOD error 0xc000021a while on Chrome
Hello guys, I was on chrome and all of a sudden I got a BSOD with the error code 0xc000021a Dump file attached, thanks for all your help in advance. This community has always been amazing at helping me fix my BSOD issues. I appreciate it! :) 57719 The full memory dump...
BSOD Crashes and Debugging
(BSOD) 0xc000021a, unable to boot
I would like to say I'm sorry in advance. I'm unable to use the required programs to neatly bundle and zip the crashlogs. This is my only computer in the house at the moment and I'm am only able to write this from a live usb of Unbutu I flashed at university. As the title suggests, I can't boot...
BSOD Crashes and Debugging
Sporadic BSOD 0xC000021A at shutdown
As stated in title.
BSOD Crashes and Debugging
BSOD on restartWindows 8.1 Pro 0xc000021a
I just upgraded my PC from Windows 7 to 8.1 and now I am getting BSOD with code 0xc000021a whenever I restart my PC. Please help! Many thanks
BSOD Crashes and Debugging
BSOD caused by ntoskrnl.exe 0xc000021a on Windows 8.1 Pro
Hi I've been experiencing BSODs for the past week and was using Windows 8. As many system files was corrupted I thought it was causing by my faulty hard drive. So, I freshly installed Windows 8.1 Pro x64 on my PC. Then, I installed all required drivers, Avast! Free Antivirus, Comodo Firewall and...
BSOD Crashes and Debugging
BSOD on restart Windows 8.1 0xc000021a WINLOGON_FATALERROR
Greetings, I receive a BSOD everytime I restart windows 8.1 or whenever windows restarts automatically to install updates (although it finishes updating successfully on reboot) with error code 0xc000021a. Besides that, the PC works normally. A few days ago the problem was reversed, i.e. Windows...
BSOD Crashes and Debugging
Nightmare time trying to sort out 0Xc000021a BSOD on W8
Hello everyone, my friend has asked me to have a look at his HP "Envy" ultrabook running Windows 8, as it's stuck in a boot up "loop" whilst displaying an error code (0XC000021a) I had a bit of shock, when I found out it doesn't have a DVD drive! Cue, several hours reading up how to install...
BSOD Crashes and Debugging

Eight Forums Android App Eight Forums IOS App Follow us on Facebook