Windows 10: Need help with BSOD

After running into the BSOD I checked the memory dump and got these results, unsure on what exactly is going on with it however and would appreciate some help!


nt!KeBugCheckEx:fffff807`4f7f5210 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff8281`ee7ff0f0=000000000000007e1: kd> !analyze -v******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************SYSTEM_THREAD_EXCEPTION_NOT_HANDLED 7eThis is a very common bugcheck. Usually the exception address pinpointsthe driver/function that caused the problem. Always note this addressas well as the link date of the driver/image that contains this address.Arguments:Arg1: ffffffffc0000005, The exception code that was not handledArg2: fffff8074f6c959a, The address that the exception occurred atArg3: ffff980d30016e18, Exception Record AddressArg4: ffff8281ee7ff920, Context Record AddressDebugging Details:------------------KEY_VALUES_STRING: 1 Key : AV.Fault Value: Read Key : Analysis.CPU.mSec Value: 2202 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on DESKTOP-GH95ABH Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.mSec Value: 3798 Key : Analysis.Memory.CommitPeak.Mb Value: 80 Key : Analysis.System Value: CreateObject Key : WER.OS.Branch Value: vb_release Key : WER.OS.Timestamp Value: 2019-12-06T14:06:00Z Key : WER.OS.Version Value: 10.0.19041.1ADDITIONAL_XML: 1OS_BUILD_LAYERS: 1BUGCHECK_CODE: 7eBUGCHECK_P1: ffffffffc0000005BUGCHECK_P2: fffff8074f6c959aBUGCHECK_P3: ffff980d30016e18BUGCHECK_P4: ffff8281ee7ff920EXCEPTION_RECORD: ffff980d30016e18 -- .exr 0xffff980d30016e18ExceptionAddress: fffff8074f6c959a nt!RtlRbRemoveNode+0x000000000000035a ExceptionCode: c0000005 Access violation ExceptionFlags: 00000000NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffffAttempt to read from address ffffffffffffffffCONTEXT: ffff8281ee7ff920 -- .cxr 0xffff8281ee7ff920rax=0000000000000001 rbx=ffffc18634002290 rcx=efffc186406d6f58rdx=ffffc1863ba71978 rsi=0000000000000001 rdi=ffffc186406c5f58rip=fffff8074f6c959a rsp=ffff980d30017058 rbp=ffffc1863ba71978 r8=ffffc186406c5f00 r9=efffc186406d6f58 r10=0000000000000000r11=ffffc186406c5f58 r12=ffffc1863ba66030 r13=ffffc1863ba66000r14=0000000000000000 r15=ffffc18645c35f60iopl=0 nv up ei ng nz na pe nccs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050282nt!RtlRbRemoveNode+0x35a:fffff807`4f6c959a 498b4110 mov rax,qword ptr [r9+10h] ds:002b:efffc186`406d6f68=????????????????Resetting default scopeBLACKBOXBSD: 1 !blackboxbsdBLACKBOXNTFS: 1 !blackboxntfsBLACKBOXPNP: 1 !blackboxpnpBLACKBOXWINLOGON: 1PROCESS_NAME: SystemREAD_ADDRESS: ffffffffffffffff ERROR_CODE: NTSTATUS 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.EXCEPTION_CODE_STR: c0000005EXCEPTION_PARAMETER1: 0000000000000000EXCEPTION_PARAMETER2: ffffffffffffffffEXCEPTION_STR: 0xc0000005BAD_STACK_POINTER: ffff8281ee7ff0e8STACK_TEXT: ffff980d`30017058 fffff807`4f6c90d3 : 00000000`0000002b ffffc186`3ba716c0 00000000`00000000 ffffc186`3ba71970 : nt!RtlRbRemoveNode+0x35affff980d`30017070 fffff807`4f6c8a48 : ffffc186`34002280 ffffc186`3ba66000 ffffc186`34002280 ffff980d`30017178 : nt!RtlpHpVsChunkCoalesce+0x183ffff980d`300170d0 fffff807`4f6c73d4 : ffff980d`00000000 fffff807`00000000 00000000`00000000 00000000`00000000 : nt!RtlpHpVsContextFree+0x188ffff980d`30017170 fffff807`4fdb1019 : ffffc186`000007c0 fffff807`4fa317a7 00000000`00000001 01000000`00100000 : nt!ExFreeHeapPool+0x4d4ffff980d`30017250 fffff807`4f6cea86 : 00000000`00000040 ffff980d`30017558 ffff980d`300173a0 00000000`00000001 : nt!ExFreePool+0x9ffff980d`30017280 fffff807`4f6ce933 : 00000000`00000040 ffff980d`30017558 ffff980d`300173a0 00000000`00000001 : nt!IopFreeIrp+0x136ffff980d`300172c0 fffff807`4fb2cb62 : ffffc186`3fa99800 00000000`00000108 ffff980d`30017540 00000000`00000001 : nt!IoFreeIrp+0x13ffff980d`300172f0 fffff807`4fb2c950 : 00000000`c0000296 ffff980d`30017431 ffff980d`300173b0 ffff980d`30017518 : nt!WmipSendWmiIrp+0xb6ffff980d`30017350 fffff807`4fb2c77e : 00310066`0032002d 00320066`00330034 ffff980d`30017540 00000000`00000030 : nt!WmipQuerySetExecuteSI+0x150ffff980d`30017480 fffff807`65ec3d1b : ffffc186`3d2db800 00000000`00000088 ffff980d`300175f0 ffffc186`3d2db800 : nt!IoWMIQuerySingleInstance+0xaeffff980d`300174f0 fffff807`65ec3bfb : ffffc186`0000000b ffffc186`3d2db800 ffffc186`3d2db800 00000000`00000000 : srvnet!SrvNetQueryInterfaceBoolCapability+0x9bffff980d`30017670 fffff807`65ef880e : ffffc186`408d4470 ffff980d`300177c0 00000000`00000000 00000000`00000004 : srvnet!SrvNetQueryInterfaceCapabilities+0xafffff980d`300176c0 fffff807`65ec38fd : fffff807`00000000 00000000`00000000 ffffc186`34698040 00000000`00000000 : srvnet!SrvNetBuildNetname+0x19affff980d`30017980 fffff807`4f61aa33 : ffffc186`46360ba0 ffffc186`3a935870 ffffc186`3a935870 ffffc186`402ba040 : srvnet!SrvNetUpdateNetNameWorkerRoutine+0x8dffff980d`30017a00 fffff807`4f7034b5 : ffffc186`3be4e2c0 ffffc186`3be4e2c0 fffff807`4f61a9a0 ffffc186`00000000 : nt!IopProcessWorkItem+0x93ffff980d`30017a70 fffff807`4f6a29a5 : ffffc186`3be4e2c0 00000000`00000080 ffffc186`34698040 00000000`00000001 : nt!ExpWorkerThread+0x105ffff980d`30017b10 fffff807`4f7fc868 : ffff8281`ee1e6180 ffffc186`3be4e2c0 fffff807`4f6a2950 ffff980d`3119f740 : nt!PspSystemThreadStartup+0x55ffff980d`30017b60 00000000`00000000 : ffff980d`30018000 ffff980d`30011000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28SYMBOL_NAME: nt!ExFreePool+9IMAGE_NAME: Pool_CorruptionMODULE_NAME: Pool_CorruptionSTACK_COMMAND: .cxr 0xffff8281ee7ff920 ; kbBUCKET_ID_FUNC_OFFSET: 9FAILURE_BUCKET_ID: AV_STACKPTR_ERROR_nt!ExFreePoolOS_VERSION: 10.0.19041.1BUILDLAB_STR: vb_releaseOSPLATFORM_TYPE: x64OSNAME: Windows 10FAILURE_ID_HASH: {919f7ad7-7d58-1f73-a4f5-b922adf1cbe9}Followup: Pool_corruption---------

:)

 

help to remote connect

not sure how to use both programs u 2 suggested, i need more helpful steps thanks

 

BSOD Help!

Disable hardware accel in your browsers. Also aumha.org for bsods listing. Turn on power saving for your gcs(set to oc in games but not webbrowsing)

 

BAD_POOL_HEADER BSOD, Dump File attached


Hi Groggubus,

Welcome to the 10forums

Please remove / disable items from the startup in taskmanager
These programs could interfere with the boot process giving you trouble and increase the boot time.

Daemon tools, Alcohol 120% and Power Archiver Pro uses SCSI Pass Through Direct (SPTD), which is a well known cause for BSOD's.
Please remove Daemon Tools and run the SPTD pass through remover.

1. Uninstall Daemon Tools
2. Download the SPTD standalone installer and follow these steps:
   • Double click the executable to open it
   • Click on the button shown below

If the button is grayed out, like in the image, there is no more SPTD installation on your system, and you can close the window

Please follow this suggestion for the BSOD

1. Please open BitDefender and go to the modules,
2. Go to the firewall settings,
3. Uncheck 'Block port scans in the network',
4. Reboot your system <-- IMPORTANT