Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Latest News:    Emotet Returns with Thanksgiving Theme and Better Phishing Tricks

Featured Deal: Get 98% off the Ultimate Cisco Certification Bundle: Lifetime Access Deal

Photo

Random BSOD 0x1A MEMORY_MANAGEMENT

Started by Demonslay335 , Jan 13 2016 07:53 PM

  • Please log in to reply
7 replies to this topic

#1 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,581 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:USA
  • Local time:08:32 PM

Posted 13 January 2016 - 07:53 PM

We're a bit stumped on a customer's PC that was brought in for random BSODs. They claimed it would happen every 10 minutes no matter what they were running, but we had the hardest time reproducing it until recently. It can bluescreen during Prime95, running COD, or even just on idle. We've tried each RAM stick individually, swapping RAM slots, running MemTest for a day with no errors, and tested the hard drive with Seagate SeaTools. I've updated all drivers for the motherboard that seemed to do with USB 3.0, chipset, or any other Intel drivers. Monitored the CPU and never see it go to an overtemp.

 

Attached are the requested zip files.

 

Windows 10 x64 - not sure what previous OS was, it was upgraded

Probably retail version since it is a custom build

Guessing only a few years old

 

Intel Core i5 6570K (Ivy Bridge)

MSI Radeon HD7900

ASRock Z77 Extreme6

Corsair TX750 PSU

 

OS Install from systeminfo: 12/19/15 (don't know if that reports the Windows 10 upgrade date or original install)

 

Custom build desktop.

 

I'm suspecting USB ports/drivers, we've tried swapping devices around and had less BSODs when nothing is plugged into the USB 3.0 ports, but I'd like confirmation to make sure we're not fighting the wrong cause. I'm out of RAM to try swapping at the moment, so it may be a few days to get stock before I can try that.

 

I've started DriverVerifier, and it didn't crash on boot. It did BSOD after sitting for awhile, but it was the same 0x1A error, nothing relating to a the verifier.

 

Thanks for any help. I'd like to learn how to better analyze the dumps myself eventually, but have not had time or the disk space for all of the symbols (cursed SSD, lol).

 

Attached Files


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.

BC AdBot (Login to Remove)

 

#2 jcgriff2

jcgriff2

  • BSOD Kernel Dump Expert
  • 1,109 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:New Jersey Shore
  • Local time:10:32 PM

Posted 14 January 2016 - 12:30 AM

Hi. . .

 

Thank you for the files.

 

Good troubleshooting/instincts in suspecting that USB was somehow involved. Windbg proves you right.
 
This USB related driver is listed in all 33 dumps as a probable cause -

FNETTBOH_305.SYS     Fri May 13 01:09:28 2011 (4DCCBD08)

 http://www.sysnative.com/drivers/driver.php?id=FNETTBOH_305.SYS

 

It's old for a Windows 10 system.  It likely was written for Windows 7.
 
 Look for a driver update. If none are available, uninstall the software or device.

 

Then test - see if BSODs persist.

 

It's rather unusual and rare to see a 0x1a bugcheck in a case like this, but not unheard of.

 

Regards. . .

 

jcgriff2

 

 

Windbg output

Spoiler

 


Edited by jcgriff2, 14 January 2016 - 04:40 PM.

Microsoft MVP 2009-2015
Microsoft Windows Insider MVP 2018 - Present

#3 Demonslay335

Demonslay335

    Ransomware Hunter

  • Topic Starter

  • Security Colleague
  • 3,581 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:USA
  • Local time:08:32 PM

Posted 14 January 2016 - 09:25 AM

Thanks for the quick response.

 

Looking at the link you sent, it's a goofy "XFastUSB" program; I recalled seeing that popup when I plugged certain devices and just dismissed it as one of those annoying auto-import programs at first (no I don't want to import all the picture assets from my tools to the customer's album, lol). 

 

They have v3.02.31 installed, and there appears to be a v3.02.38 update. It's not even listed on the page for the motherboard1! I'll give that a try and let you know.

 

1 Correction, it isn't listed on the Windows 10 downloads page for the board I just found, only the Windows 7 through 8.1 downloads. If it continues BSOD after the update, I'll just fully uninstall it.


Edited by Demonslay335, 14 January 2016 - 09:47 AM.

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.

#4 jcgriff2

jcgriff2

  • BSOD Kernel Dump Expert
  • 1,109 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:New Jersey Shore
  • Local time:10:32 PM

Posted 14 January 2016 - 04:48 PM

Hi. . .

 

Definitely try the  v3.02.38 driver update. You never know -- it just may work fine with Windows 10, even though not specified to do so.

 

Please do post back after the driver update to let us know how things turned out. The follow-up would be greatly appreciated. Thank you.

 

Regards. . .

 

John


Microsoft MVP 2009-2015
Microsoft Windows Insider MVP 2018 - Present

#5 Demonslay335

Demonslay335

    Ransomware Hunter

  • Topic Starter

  • Security Colleague
  • 3,581 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:USA
  • Local time:08:32 PM

Posted 14 January 2016 - 05:03 PM

Sure thing. So far no BSODs today while we've played with it, but I'd like to give this one a good 24 hours on the test before calling it good. I'm putting more emphasis on switching up the USB devices and ports to really stress it.

 

I'm always weary on giving back a system like this when I had no reliable way of reproducing the issue, where I'm not 100% sure if it fixed it yet. I'll let it continue testing through the night and report in the morning; I'd advise the customer to uninstall the program if it gives another BSOD on him probably.

 

I'll let you know if I deem it stable in the morning. Thanks for the help. :)


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.

#6 jcgriff2

jcgriff2

  • BSOD Kernel Dump Expert
  • 1,109 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:New Jersey Shore
  • Local time:10:32 PM

Posted 14 January 2016 - 06:29 PM

Hi. . .

 

My pleasure to try and help.

 

To add further stress to the system for testing purposes, you may want to run Driver Verifier again and let it run in the background.  The majority of dumps that you submitted were in fact VERIFIER_ENABLED.

 

http://www.bleepingcomputer.com/forums/t/576333/driver-verifier-bsod-related-windows-10-81-8-7-vista/

 

Regards. . .

 

John


Microsoft MVP 2009-2015
Microsoft Windows Insider MVP 2018 - Present

#7 Demonslay335

Demonslay335

    Ransomware Hunter

  • Topic Starter

  • Security Colleague
  • 3,581 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:USA
  • Local time:08:32 PM

Posted 15 January 2016 - 03:44 PM

Ok, we have deemed the system stable, and the customer is picking up. I advised he remove the program if it does happen to continue bluescreening.

 

Thanks for the help! Case closed. :)


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.

#8 jcgriff2

jcgriff2

  • BSOD Kernel Dump Expert
  • 1,109 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:New Jersey Shore
  • Local time:10:32 PM

Posted 15 January 2016 - 08:48 PM

You're welcome!

 

Regards. . .

 

jcgriff2


Microsoft MVP 2009-2015
Microsoft Windows Insider MVP 2018 - Present
Back to Windows Crashes and Blue Screen of Death (BSOD) Help and Support


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users


  1. BleepingComputer.com
  2. → Microsoft Windows Support
  3. → Windows Crashes and Blue Screen of Death (BSOD) Help and Support
  4. Privacy Policy
  5. Rules ·