Continual BSOD with occurrence of 0xC000021A an others

T

TitaniumBoy

New Member
Messages
5
I've just started getting a lot of BSODs in Win 8.1. It started a day or so ago. I did install a second NIC for Hyper-V but I have removed that just to eliminate it from the equation.The crash is random, either away from the machine or working on it. Explorer crashes or hangs, ALL Browsers occasionally error and it'll just crash.


I am also getting errors such as:


error -5 from inflate: (null)
error decompressing shell32.dll


I have had various errors on blue scree noted below, once I reboot it appears okay for a time but is getting slowly worse.


The error on the blue screen is random:


BAD POOL HEADERs
KERNEL_DATA_INPAGE_ERROR
SYSTEM_SERVICE_EXCEPTION
0xC000021A
KERNEL_SECURITY_CHECK_FAILURE







I've run sfc /scannow. Initially this found a few problems that it couldn't fix which is related to "WRP found corrupt files but was unable to fix" I have also run in SAFE MODE same error.


I have also ran Dism /Online /Cleanup-Image /RestoreHealth, which gave me an RPC error and couldn't complete.


chkdsk /f finds no issues.
All Windows updates up-to-date as of today.


I have removed All MalwareBytes software.


I am fast running out of ideas before I reinstall.. but I have a lot of software that I don't want to have to reinstall :( I'm asking for help. I've attached the zip per the forum instructions.


System is:
i5-4660 3.2GHz
8GB DDR3
Gigabyte Z97XGaming 5 motherboard
256Gb SSD (C: drive)
Seagate Technologies 2TB HDD (D: drive)
Seagate Technologies 2TB HDD (F: drive)




Windows 8.1 Pro
Avast 2014.09.2021
Chrome browser of choice
MS Office 2013
 
Last edited:

My Computer

System One

  • OS
    Windows 8.1
Hi TitaniumBoy & Welcome to the forums ^_^,

I have analysed your latest dump files and below has been provided an analysis of the same for informative purposes. Most of the Memory_Management Dump files did not provide any valuable information -
Code: 
3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffd00043a7e140, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800d6a3570b, If non-zero, the instruction address which referenced the bad memory
 address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------

Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff802f9165138
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
 ffffd00043a7e140 
FAULTING_IP: 
CLFS!CClfsLogFcbPhysical::ReserveAndAppendLog+12b
fffff800`d6a3570b 488b8424f0000200 mov     rax,qword ptr [rsp+200F0h]
MM_INTERNAL_CODE:  0
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
BUGCHECK_STR:  AV
PROCESS_NAME:  svchost.exe
CURRENT_IRQL:  0
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
TRAP_FRAME:  ffffd00043a5dec0 -- (.trap 0xffffd00043a5dec0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe000cf7ced58 rbx=0000000000000000 rcx=0000000000000200
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800d6a3570b rsp=ffffd00043a5e050 rbp=ffffd00043a5e750
 r8=ffffc001bde713fc  r9=0000000000000404 r10=ffffc001bde71000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
CLFS!CClfsLogFcbPhysical::ReserveAndAppendLog+0x12b:
fffff800`d6a3570b 488b8424f0000200 mov     rax,qword ptr [rsp+200F0h] ss:0018:ffffd000`43a7e140=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER:  from fffff802f8f960e7 to fffff802f8f64fa0
STACK_TEXT:  
ffffd000`43a5dcd8 fffff802`f8f960e7 : 00000000`00000050 ffffd000`43a7e140 00000000`00000000 ffffd000`43a5dec0 : nt!KeBugCheckEx
ffffd000`43a5dce0 fffff802`f8e789c9 : 00000000`00000000 ffffe000`d072a080 ffffd000`43a5dec0 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x20c37
ffffd000`43a5dd80 fffff802`f8f6f22f : 00000000`00000000 ffffe000`cfeba000 00000000`00000000 ffffd000`43a5dec0 : nt!MmAccessFault+0x7a9
ffffd000`43a5dec0 fffff800`d6a3570b : ffffd000`43a50324 ffffe000`cfeba000 ffffd000`43a5e750 00000000`00000000 : nt!KiPageFault+0x12f
ffffd000`43a5e050 fffff800`d6a5ca0a : ffffe000`cfeba000 ffffe000`cfe32870 ffffe000`cf7cec60 ffffe000`cfee8440 : [COLOR=#ff0000][U][B]CLFS![/B][/U][/COLOR]CClfsLogFcbPhysical::ReserveAndAppendLog+0x12b
ffffd000`43a5e120 fffff800`d6a5ccf3 : ffffe000`cf7cec60 00000000`00000000 ffffe000`cdffc350 00000000`00000000 : CLFS!CClfsRequest::ReserveAndAppendLog+0x2ba
ffffd000`43a5e230 fffff800`d6a5fbd1 : ffffe000`cfe32870 ffffc001`bde6d2c0 ffffc001`bde71000 00000000`00000400 : CLFS!ClfsReserveAndAppendLogInternal+0x1f3
ffffd000`43a5e330 fffff800`d6a5d5b4 : ffffc001`bde6d980 ffffd000`00001600 ffffc001`bde6d980 00000000`00000400 : CLFS!CClfsKernelMarshallingContext::AppendWriteBlockToFlushQueue+0x1d1
ffffd000`43a5e420 fffff800`d6a5d087 : ffffc001`bde6d980 fffff802`f9206314 00000000`00000001 ffffd000`00000001 : CLFS!CClfsKernelMarshallingContext::ReserveAndAppendLog+0x454
ffffd000`43a5e510 fffff800`d6a5cf21 : 00000000`00000000 ffffc001`ba095f70 ffffc001`b935db40 fffff800`00000001 : CLFS!ClfsReserveAndAppendLogAligned+0x157
ffffd000`43a5e5b0 fffff802`f923eb91 : 00000000`00000278 00000000`00000004 ffffd000`3e8c0000 00000000`00000801 : CLFS!ClfsReserveAndAppendLog+0x51
ffffd000`43a5e610 fffff802`f923e959 : ffffc001`ba095f70 00000000`00000000 ffffc001`ba095f70 ffffc001`00000002 : nt!CmpDoTransWriteLogRecord+0x71
ffffd000`43a5e6b0 fffff802`f923e6f4 : ffffc001`00000000 ffffc001`b94dafe4 ffffd000`43a5e768 ffffc001`b935db40 : nt!CmpTransWriteLog+0x55
ffffd000`43a5e710 fffff802`f91f4f4f : 01cf785f`00000004 ffffc001`baadf000 ffffc001`ffffffff ffffc001`bdd68774 : nt!CmAddLogForAction+0x29c
ffffd000`43a5e7b0 fffff802`f91f5a32 : ffffc001`b928e730 ffffd000`43a5e920 ffffc001`00000004 ffffd000`43a5ea10 : nt!CmSetValueKey+0x397
ffffd000`43a5e8c0 fffff802`f8f707b3 : ffffe000`d072a080 ffffd000`43a5eb80 000000b3`5767cfe8 000000b3`5767d3d0 : nt!NtSetValueKey+0x5e2
ffffd000`43a5ea90 00007ffa`0310b18a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
000000b3`5767d338 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`0310b18a

STACK_COMMAND:  kb
CHKIMG_EXTENSION: !chkimg -lo 50 -db !CLFS
9 errors : !CLFS (fffff800d6a35009-fffff800d6a35f09)
fffff800d6a35000  48  89  74  24  10  57  45  0f  b6 *db  41  0f  b6  f8  44  8b H.t$.WE...A...D.
...
fffff800d6a35020  85 *d7  01  00  00  80  79  01  00 *0b  87  4d  01  00  00  0f ......y....M....
...
fffff800d6a35330  00 *53  69  0f  b6  41  24  a8  3f  74  61  a8  c0  75  5d  0f .Si..A$.?ta..u].
...
fffff800d6a35710  00 *02  00  48  89  44  24  38  c6  44  24  30  01  89  7c  24 ...H.D$8.D$0..|$
...
fffff800d6a35770  0c *e9  00  00  45  32  f6  44  88  b4  24  80  00  00  00  44 ....E2.D..$....D
...
fffff800d6a35820  41 *03  41  8b  d4  e8  0a  f4  ff  ff  eb  72  48  8d  05  dd A.A........rH...
...
fffff800d6a35ab0  56  57  41  54  41  55  41  56  41 *5f  48  81  ec  90  00  00 VWATAUAVA_H.....
...
fffff800d6a35f00  04  89  44  24  40  89  4c  24  34 *68  8b  8b  78  03  00  00 ..D$@.L$4h..x...
MODULE_NAME: memory_corruption
IMAGE_NAME:  memory_corruption
FOLLOWUP_NAME:  memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP:  0
MEMORY_CORRUPTOR:  STRIDE
FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_STRIDE
BUCKET_ID:  MEMORY_CORRUPTION_STRIDE
ANALYSIS_SOURCE:  KM
FAILURE_ID_HASH_STRING:  km:memory_corruption_stride
FAILURE_ID_HASH:  {574dbc1b-92cb-fb09-cb7a-cacc1bb2c511}
Followup: memory_corruption
---------
As you can see from the analysis that the BugCheck occurred while the CLFS.sys was processing the Log files as it is the Common Log File System Driver. Now, since it is provided by Windows, chance of it being at fault is really less. Also, in many of the dump files the process which was running when the BSOD occurred was the MalwareBytes. Below is a list of 3rd party drivers present on your system :-
Code: 
**************************Wed Sep 24 15:33:31.774 2014 (UTC + 5:30)**************************
MBfilt64.sys           Fri Jul 31 09:10:32 2009 (4A7267B0)
point64.sys            Wed May 18 13:37:20 2011 (4DD37E38)
bwcW8x64.sys           Wed Feb 13 22:55:48 2013 (511BCC9C)
e22w8x64.sys           Thu Mar 21 02:54:01 2013 (514A28F1)
athwnx.sys             Mon Apr  1 11:02:05 2013 (51591BD5)
intelppm.sys           Thu Aug 22 14:16:35 2013 (5215CFEB)
mbam.sys               Wed Oct 30 21:41:45 2013 (52712FC1)
ISODrv64.sys           Thu Nov 21 06:52:28 2013 (528D6054)
TeeDriverx64.sys       Thu Mar 13 23:51:52 2014 (5321F740)
iwdbus.sys             Fri Mar 14 03:29:14 2014 (53222A32)
RTKVHD64.sys           Fri Mar 14 16:33:23 2014 (5322E1FB)
[B][U]MBAMSwissArmy.sys      Fri Mar 21 03:42:35 2014 (532B67D3)
[/U][/B]igdkmd64.sys           Mon Mar 31 10:48:10 2014 (5338FA92)
dump_iaStorA.sys       Fri Apr  4 04:30:05 2014 (533DE7F5)
iaStorA.sys            Fri Apr  4 04:30:05 2014 (533DE7F5)
aswHwid.sys            Thu Jun 26 17:01:26 2014 (53AC048E)
aswMonFlt.sys          Thu Jun 26 17:02:51 2014 (53AC04E3)
aswRdr2.sys            Thu Jun 26 17:03:28 2014 (53AC0508)
aswKbd.sys             Thu Jun 26 17:04:01 2014 (53AC0529)
aswSnx.sys             Thu Jun 26 17:04:44 2014 (53AC0554)
aswRvrt.sys            Thu Jun 26 17:05:39 2014 (53AC058B)
aswVmm.sys             Thu Jun 26 17:05:49 2014 (53AC0595)
aswNdisFlt.sys         Thu Jun 26 17:06:26 2014 (53AC05BA)
aswStm.sys             Thu Jun 26 17:17:09 2014 (53AC083D)
aswSP.sys              Wed Jul  2 23:08:12 2014 (53B44384)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Tue Sep 23 21:14:19.410 2014 (UTC + 5:30)**************************
[B][U]mwac.sys               Wed Mar  5 03:17:40 2014 (531649FC)
[/U][/B]
http://www.carrona.org/drivers/driver.php?id=MBfilt64.sys
http://www.carrona.org/drivers/driver.php?id=point64.sys
http://www.carrona.org/drivers/driver.php?id=bwcW8x64.sys
http://www.carrona.org/drivers/driver.php?id=e22w8x64.sys
http://www.carrona.org/drivers/driver.php?id=athwnx.sys
http://www.carrona.org/drivers/driver.php?id=intelppm.sys
http://www.carrona.org/drivers/driver.php?id=mbam.sys
http://www.carrona.org/drivers/driver.php?id=ISODrv64.sys
http://www.carrona.org/drivers/driver.php?id=TeeDriverx64.sys
http://www.carrona.org/drivers/driver.php?id=iwdbus.sys
http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys
http://www.carrona.org/drivers/driver.php?id=MBAMSwissArmy.sys
http://www.carrona.org/drivers/driver.php?id=igdkmd64.sys
http://www.carrona.org/drivers/driver.php?id=dump_iaStorA.sys
http://www.carrona.org/drivers/driver.php?id=iaStorA.sys
http://www.carrona.org/drivers/driver.php?id=aswHwid.sys
http://www.carrona.org/drivers/driver.php?id=aswMonFlt.sys
http://www.carrona.org/drivers/driver.php?id=aswRdr2.sys
http://www.carrona.org/drivers/driver.php?id=aswKbd.sys
http://www.carrona.org/drivers/driver.php?id=aswSnx.sys
http://www.carrona.org/drivers/driver.php?id=aswRvrt.sys
http://www.carrona.org/drivers/driver.php?id=aswVmm.sys
http://www.carrona.org/drivers/driver.php?id=aswNdisFlt.sys
http://www.carrona.org/drivers/driver.php?id=aswStm.sys
http://www.carrona.org/drivers/driver.php?id=aswSP.sys
http://www.carrona.org/drivers/driver.php?id=mwac.sys

As you can see from the highlighted drivers, the MalwareBytes is still present on the system and loading along with Avast Antivirus. I would suggest you to firstly remove the MalwareBytes using this **TOOL**. Once this is done, if the problem still persists then please remove the Avast as well using this **TOOL**.

Also test your RAM using Memtest by following this **GUIDE**.

If the problems continue, I would require a Complete Dump file. The Complete Dump file is located in "C:\Windows\Memory.DMP". It may be a large dump file so I would strongly suggest you to ZIP the dump file before uploading it to a file hoster like Mediafire, OneDrive etc.


Let me know how it goes ^_^
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Hi, Thanks for looking at this. Yes the MB services were still installed however not started. I ran the MB removal tool, first on your list and that seems to have stabilised the system. No crashes in a couple of days. Thank You. I'll leave the thread open for a couple of days more then close if all okay. Loose threads cause crashes... :)
 

My Computer

System One

  • OS
    Windows 8.1
TitaniumBoy said:
Hi, Thanks for looking at this. Yes the MB services were still installed however not started. I ran the MB removal tool, first on your list and that seems to have stabilised the system. No crashes in a couple of days. Thank You. I'll leave the thread open for a couple of days more then close if all okay. Loose threads cause crashes... :)
Click to expand...

Glad to hear that the system has stabilised ^_^.

Let me know in case of any further crashes.
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Typical as soon as I close the thread the things starts crashing again!!! :( I am just gathering information.. I did uninstall the Avast as it was killing the streaming to ANY application via the internet and causing the sound to 'squelch' and stutter through bottlenecked data (throttling).

I have run the removal tool for Avast as well..
 

My Computer

System One

  • OS
    Windows 8.1
I guess this about makes it pretty much certain where the error is then... :( Corsair 8GB (2x4GB) CML8GX3M2A1600C9 Low Profile.

It looks like it's fallen over on the second half of the memory and I assume... maybe you can correct me here the second DIMM? It only 4 months old as well.. a brand new machine - almost..

View attachment 51798

Paul
 

My Computer

System One

  • OS
    Windows 8.1
Looks like bad RAM to me. Remove the bad stick(s) and try running Memtest again.
If it passes then, they try running one of the good sticks in the empty slots (to test to see if the slots are bad).
 

My Computer

System One

  • OS
    Win8.1Pro - Finally!!!
    Computer type
    Laptop
    System Manufacturer/Model
    Samsung/NP780
    CPU
    Came with the laptop (i7 of some sort)
    Motherboard
    Pretty sure that it has one, but haven't checked inside the case!
    Memory
    upgraded to 12 gB from 8 gB
    Graphics Card(s)
    has switchable - Intel/ATI - Used wrong drivers, now ATI card is inop :( Will have to fix it soon!
    Sound Card
    I'm nearly deaf, so this isn't used often
    Monitor(s) Displays
    Touchscreen on laptop/32" Toshiba on HDMI (laid the Sharp TV on a mouse and cracked the screen!)
    Screen Resolution
    800x600
    Hard Drives
    One Samsung 1tB drive - 5400 rpm. Gonna switch to a 7200/10000 rpm or an SSD (if I can find $500 for a 1tB SSD!)
    - Switched to 500 gB Samsung 840 series SSD - WOW!!!
    PSU
    Why do we ask this for laptops?
    Case
    Silver with a neat Samsung logo
    Cooling
    sub-par, gotta get around to working on it soon Worked on it - still sub-par! :(
    Keyboard
    Microsoft Natural - the same one I've used since it orignally came out around 1995
    Mouse
    no Mouse - Trackball!!!!
    Internet Speed
    too slow when I'm waiting for a download to finish
    Browser
    Yes, I use this (Firefox mostly, w/IE next most)
    Antivirus
    Windows Defender and Windows Firewall
    Other Info
    I'm handsome and a snappy dresser :0)
You must log in or register to reply here.
Back
Top