Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Blue Screen Crash


  • Please log in to reply
36 replies to this topic

#1 vodoochild81

vodoochild81

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:01:31 AM

Posted 22 December 2014 - 06:26 AM

I have been getting a blue screen crash where windows is restarted for me. It's says system_service_exception

On here I saw that I should run sfc.exe in CMD as admin to scan for corrupted files...This is what I got. Is there any way I can fix the corrupted files without reinstalling? How can these files get corrupted? Do I have a virus?




Microsoft Windows [Version 6.3.9600]
© 2013 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sfc.exe /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files but was unable to fix some
of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For
example C:\Windows\Logs\CBS\CBS.log. Note that logging is currently not
supported in offline servicing scenarios.

C:\Windows\system32>


In the log this seems to be the parts that says repair could not be complete. Sorry but the text is mumbled up.


CSI 000008c1 Hashes for file member \SystemRoot\WinSxS\amd64_prncacla.inf_31bf3856ad364e35_6.3.9600.17415_none_95dd5540d57f8c01\Amd64\CNBJ2530.DPB do not match actual file [l:36{18}]"Amd64\CNBJ2530.DPB" :
Found: {l:32 b:gSKgtXuoRhmhQwrFs1rUNbjO7QFVr7009W1FWP3KKHI=} Expected: {l:32 b:n520k714Uu3utHa5JGQ6HQYbZphKhlMWq5pEmfnCDuw=}
2014-12-22 06:04:31, Info CSI 000008c2 [SR] Cannot repair member file [l:36{18}]"Amd64\CNBJ2530.DPB" of prncacla.inf, Version = 6.3.9600.17415, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type = [l:24{12}]"driverUpdate", TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-12-22 06:04:31, Info CSI 000008c3 Hashes for file member \SystemRoot\WinSxS\amd64_prncacla.inf_31bf3856ad364e35_6.3.9600.17415_none_95dd5540d57f8c01\Amd64\CNBJ2530.DPB do not match actual file [l:36{18}]"Amd64\CNBJ2530.DPB" :
Found: {l:32 b:gSKgtXuoRhmhQwrFs1rUNbjO7QFVr7009W1FWP3KKHI=} Expected: {l:32 b:n520k714Uu3utHa5JGQ6HQYbZphKhlMWq5pEmfnCDuw=}
2014-12-22 06:04:31, Info CSI 000008c4 [SR] Cannot repair member file [l:36{18}]"Amd64\CNBJ2530.DPB" of prncacla.inf, Version = 6.3.9600.17415, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type = [l:24{12}]"driverUpdate", TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-12-22 06:04:31, Info CSI 000008c5 [SR] This component was referenced by [l:166{83}]"Package_2709_for_KB3000850~31bf3856ad364e35~amd64~~6.3.1.8.3000850-6825_neutral_GDR"
2014-12-22 06:04:32, Info CSI 000008c6 [SR] Repair complete
2014-12-22 06:04:32, Info CSI 000008c7 [SR] Committing transaction
2014-12-22 06:04:32, Info CSI 000008c8 Creating NT transaction (seq 2), objectname [6]"(null)"
2014-12-22 06:04:32, Info CSI 000008c9 Created NT transaction (seq 2) result 0x00000000, handle @0x980
2014-12-22 06:04:32, Info CSI 000008ca@2014/12/22:11:04:32.019 Beginning NT transaction commit...
2014-12-22 06:04:32, Info CSI 000008cb@2014/12/22:11:04:32.029 CSI perf trace:
CSIPERF:TXCOMMIT;10396



BC AdBot (Login to Remove)

 


m

#2 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Quebec, Canada
  • Local time:01:31 AM

Posted 22 December 2014 - 11:31 AM

Hi vodoochild81, welcome to BleepingComputer :)

It looks like the SFC scan couldn't fix every corrupted files on your system. Luckily for us, under Windows 8/8.1, we can use the DISM command to fix these remaining files automatically. Simply open another elevated command prompt (with Admin Rights), like you did for the SFC scan, and enter this command:

Dism /Online /Cleanup-Image /RestoreHealth

From there, give this command all the time it needs to complete, and report back in your next reply with the message it returns once it's done. Also, if you could meanwhile, archive the content of C:\windows\minidump\ and attach it to your next post, I'll take a look at your BSODs crashdump in order to identify what program or driver caused it.

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#3 vodoochild81

vodoochild81
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:01:31 AM

Posted 23 December 2014 - 04:35 PM

Hi vodoochild81, welcome to BleepingComputer :)

It looks like the SFC scan couldn't fix every corrupted files on your system. Luckily for us, under Windows 8/8.1, we can use the DISM command to fix these remaining files automatically. Simply open another elevated command prompt (with Admin Rights), like you did for the SFC scan, and enter this command:

Dism /Online /Cleanup-Image /RestoreHealth

From there, give this command all the time it needs to complete, and report back in your next reply with the message it returns once it's done. Also, if you could meanwhile, archive the content of C:\windows\minidump\ and attach it to your next post, I'll take a look at your BSODs crashdump in order to identify what program or driver caused it.

 

Sorry for the delay! It seems to of worked:

 

Microsoft Windows [Version 6.3.9600]
© 2013 Microsoft Corporation. All rights reserved.

C:\Windows\system32>Dism /Online /Cleanup-Image /RestoreHealth

Deployment Image Servicing and Management tool
Version: 6.3.9600.17031

Image Version: 6.3.9600.17031

[==========================100.0%==========================]
The restore operation completed successfully. The component store corruption was
 repaired.
The operation completed successfully.

C:\Windows\system32>

 

as far as the minidump...it wont let me archive or send it because of the security on it. Is there a way to change that? I am guessing what caused this was either my video cards because I was using the ASUS GPU tweak to push the performance for video gaming. Which was causing some crashes in games. Or it was because I tried updating my BIOS in Windows with Asus's easy update. Which it didn't even do anything. It just said "installing"



#4 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Quebec, Canada
  • Local time:01:31 AM

Posted 23 December 2014 - 04:36 PM

From my experience, SYSTEM_SERVICE_EXCEPTIONS (0x3b) BSODs are often caused by the GPU, so it wouldn't surprise me at all if your graphical tweaks and performance tests caused Windows to crash with that error :)

Edited by Aura., 23 December 2014 - 04:37 PM.

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#5 vodoochild81

vodoochild81
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:01:31 AM

Posted 23 December 2014 - 04:48 PM

From my experience, SYSTEM_SERVICE_EXCEPTIONS (0x3b) BSODs are often caused by the GPU, so it wouldn't surprise me at all if your graphical tweaks and performance tests caused Windows to crash with that error :)

 

wow, on top of corrupting files? Should I update my bios ? It is an Asus Rampage Extreme. I don't get why they have an EZ update but I heard never really works for anyone. I think its easy to update the bios through a flash drive



#6 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Quebec, Canada
  • Local time:01:31 AM

Posted 23 December 2014 - 04:50 PM

Your corrupted files should have been fixed by the DISM command. To be sure of it, restart your computer and launch a new SFC /scannow. Also, updating your BIOS can be a risky operation because if you do a single mistake or misclick while it happens, you can mess up your whole computer and render it completely unbootable. Personally, I advice you not to do it. I suggest you to remove any tweaks you have on your graphic card, make sure it's running on the latest drivers and see if you get more BSODs.

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#7 vodoochild81

vodoochild81
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:01:31 AM

Posted 23 December 2014 - 10:58 PM

Your corrupted files should have been fixed by the DISM command. To be sure of it, restart your computer and launch a new SFC /scannow. Also, updating your BIOS can be a risky operation because if you do a single mistake or misclick while it happens, you can mess up your whole computer and render it completely unbootable. Personally, I advice you not to do it. I suggest you to remove any tweaks you have on your graphic card, make sure it's running on the latest drivers and see if you get more BSODs.

 

Yes I ran the SFC/Scannow and it said all was good and fixed. thanks...however, I got a new blue screen error. I didn't even touch my computer after we ran that fix...It said "IRQL_NOT_LESS_OR_EQUAL" ... This is getting weird. I don't get it, this machine is a month old and I already have so many issues.

 

 I am coming from like 12 years of exclusive Mac use and I think my computer has crashed more then my Macs have the entire time. I thought. Is this a Windows 8.1 thing?  Because even in Bootcamp on my 2008 Mac Pro it never crashed or blue screened once...So I wonder if there is something wrong with 8.1 or the hardware itself.



#8 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Quebec, Canada
  • Local time:01:31 AM

Posted 23 December 2014 - 11:03 PM

Can you create a new folder on your desktop, then go to in the following folder C:\windows\minidump\. From there, copy and paste every files there is in your new folder on the desktop. Archive that folder using Windows in-built .zip feature or any other archiver, then attach the archive to your next post.

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#9 vodoochild81

vodoochild81
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:01:31 AM

Posted 23 December 2014 - 11:08 PM

Can you create a new folder on your desktop, then go to in the following folder C:\windows\minidump\. From there, copy and paste every files there is in your new folder on the desktop. Archive that folder using Windows in-built .zip feature or any other archiver, then attach the archive to your next post.

 

Will do, but I did some research and read that I can view it in bluescreenviewer or use slimcleaner to detect the faulty drive or hardware. Is that what you are going to do? I ask so in the future I can do this myself. Will def love to have you look at it too.



#10 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Quebec, Canada
  • Local time:01:31 AM

Posted 23 December 2014 - 11:10 PM

BlueScreenViewer will not give the exact driver that caused the BSOD, hence why I use WinDbg for that :) Also, I would stay away from every programs that says that they'll update your drivers, boost your system performance, speed up your boot time, etc. They're mostly all junk and doesn't work at all. You're way better without them.

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#11 vodoochild81

vodoochild81
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:01:31 AM

Posted 23 December 2014 - 11:16 PM

I tried uploading the .rar and it said I am not permitted to upload this kind of file. I then tried to upload the individual files and it said the same error. Am I too new?



#12 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Quebec, Canada
  • Local time:01:31 AM

Posted 23 December 2014 - 11:17 PM

Right-click on the folder where the files are, and select Send to ... then select Compressed Archive. Then it should work :)

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#13 vodoochild81

vodoochild81
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:01:31 AM

Posted 23 December 2014 - 11:19 PM

That worked. I guess it was WinRAR that was messing it up. I had no idea you can compress files right from the windows right click menu. Just like in OSX.

Attached Files

  • Attached File  Dump.zip   70.29KB   4 downloads


#14 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Quebec, Canada
  • Local time:01:31 AM

Posted 23 December 2014 - 11:30 PM

Unfortunately, it looks like the BSODs are attributed to a very generic driver, ntkrnlmp.exe, that have no particuliar attachement except to the Windows OS itself. I can't personally rely on the BSOD crash dump to find the source of that BSOD. However I have a few question, did you buy this computer refurbished or from a third-party person, or in store, brand new?

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#15 vodoochild81

vodoochild81
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:01:31 AM

Posted 23 December 2014 - 11:32 PM

Unfortunately, it looks like the BSODs are attributed to a very generic driver, ntkrnlmp.exe, that have no particuliar attachement except to the Windows OS itself. I can't personally rely on the BSOD crash dump to find the source of that BSOD. However I have a few question, did you buy this computer refurbished or from a third-party person, or in store, brand new?

 

It was build custom built at Microcenter. Do you need to know all the parts?






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users