Just Suffered My First Blue Screen Of Death In 10 Years

I'm on Windows 8.1 I'd just restarted the computer. It seemed to come on normally. Then I dragged a bunch of files into the recycle bin and at that moment an Apple Software Update box appeared but didn't load fully so all I could see were the words Apple Software Update at the top. Then a couple of popups appeared at the corner of my screen saying Windows 10 files detected. I tried to close the popups so I could open GWX Control Panel and that's when I got the BSOD. It said something like "your computer's suffered an error and needs to restart, we're just collecting some error info and then we'll restart for you , here's the error code if you want to look it up online" (didn't have time to take it down though). Had to wait until the error info was finished collecting (it was counting up in percentages), and then it restarted. After it had come back on fully, a message came up again telling me that the computer had suffered an error and asking if I wanted to send the info to Microsoft to help improve the product. I said no and everything's been OK since, except for my black rectangle flickering in media player classic home cinema problem. Should I be really worried? Since I didn't have time to take down the error code, is there a way I can look it up?

 

See if you can carefully follow the instructions here, attach the resulting zip file back here and I'll see what I can pin down.

 

I'm as far as step 2. I didn't save to Documents though, just saved to Desktop. It seems to be taking ages to complete. There was a dialog with a green progress bar for a while. Once that completed, I assumed everything would be finished. But instead I've got this blue window with yellow text that says waiting for tasks to complete and keeps saying waiting for tasks to complete over and over again, and I've got two other windows that look like command prompts. One says SysnativeFileCollectionApp9 and the other says SysnativeFileCollectionApp10 How much longer should I have to wait until the folder and the zipped version are created?

Edit: Sorry, never mind. It's finished now. The folder and the zipped version were saved in Documents. I assumed they'd be saved on Desktop since that's where I saved the app. But anyway, I'll complete the next steps now.

 

Nope, I have run into trouble now. I'd just pasted perfmon /report into the elevated command prompt and hit enter. A window came up with the title Resource and Performance Monitor, seemed to freeze, and then a message appeared in it saying "Error: An error occurred while attempting to generate the report. The operator or administrator has refused the request."

 

OK. Just tried again. Pasted perfmon /report into the elevated command prompt again and this time it worked. So I've now got a file called perfmonreport.html

 

· OS - Windows 10, 8.1, 8, 7, Vista ?
· x86 (32-bit) or x64 ?
· What was original installed OS on system? Windows 8.1
· Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)?
· Age of system (hardware) About 2 years.
· Age of OS installation - have you re-installed the OS? No.

· CPU
Intel Celeron N2830 @ 2.16GHz
Bay Trail-M 22nm Technology
· Video Card
Intel HD Graphics (Acer Incorporated [ALI])
· MotherBoard - (if NOT a laptop)
· Power Supply - brand & wattage (if laptop, skip this one)

· System Manufacturer
Acer
· Exact model number (if laptop, check label on bottom)
Is there a way to find out the model number through software? The label came off ages ago.
· Laptop or Desktop?

 

Oops, I was thinking of the wrong label. I've found the right one now but it's faded and worn and I can't make out the first few characters of the model number. So I'll still need to access it through software.

 

Don't worry about the PerfMon report, can you zip the folder in Documents (Right-click > Send to > Compressed folder) and attach the zip file, please?

 

No need to zip it myself. The SysnativeBSODCollectionApp did that. It created a folder and a zipped version of the folder and put them both in documents. Is it OK though to just post it as is? Are you sure there's no personally identifiable information in any of the files?

 

There's no personally identifiable information that I've ever noticed (I've worked with 0000's of mindumps and many 000's of the collected zips).

 

OK then, here ya go.

 

So now it's been over 2 days, I'm guessing everything's OK, right?

 

I wouldn't say that yet, I've had 3 'random' BSODs in ~8 months, all caused by the same driver that I would have immediately removed, had I bothered checking sooner. Generally, 7-10 days clear is enough to give a provisional all clear.

You BSOD sub-type is not a common one, there's also an oddity in the Callstack which makes me think it might just have been Windows having an off-moment.

General troubleshooting for the commoner sub-types would begin with updating/removing any older 3rd party drivers/filters that work closely with Windows kernel, or uninstalling the software that they belong to, if they don't have a version that's newer than the age of your Windows Service Pack level release (17 Aug 2013 for W8.1).

Here are your 3rd party drivers, RED = OLD:

npf.sys Fri Jun 25 17:50:58 2010 (4C24DE72)
NetGroup Packet Filter Driver, part of the WinPcap packet capture library (list of programs that use it: http://www.winpcap.org/misc/links.htm ) Also believed to be associated with Netgear's NETGEARGenie, related to Netgear's router firmware. If Netgear, you will likely find wpcap.dll and packet.dll in \system32 WinPcap - http://www.winpcap.org/contact.htm. Netgear tftp2.exe firmware upgrade instructions - http://kb.netgear.com/app/answers/d...n-a-router-without-the-setup-cd-recovery-tool Netgear firmware related BSOD thread - http://www.techsupportforum.com/forums/f299/bsod-win7-laptop-when-entering-sleep-mode-939698.html
http://www.carrona.org/drivers/driver.php?id=npf.sys
GEARAspiWDM.sys Thu May 3 20:56:17 2012 (4FA2E2E1)
CD-ROM Class Filter Driver by Gear Software. Also comes with iTunes http://www.gearsoftware.com
http://www.carrona.org/drivers/driver.php?id=GEARAspiWDM.sys
speedfan.sys Sat Dec 29 20:59:35 2012 (50DF59B7)
SpeedFan http://www.almico.com/sfdownload.php
http://www.carrona.org/drivers/driver.php?id=speedfan.sys
LMDriver.sys Tue Jul 16 19:58:57 2013 (51E597F1)
Acer Launch Manager Wireless Driver http://us.acer.com/ac/en/US/content/drivers
http://www.carrona.org/drivers/driver.php?id=LMDriver.sys
RadioShim.sys Tue Jul 16 19:58:57 2013 (51E597F1)
Acer Launch Manager Shim for HID-KMDF Interface layer http://us.acer.com/ac/en/US/content/drivers
http://www.carrona.org/drivers/driver.php?id=RadioShim.sys
intelppm.sys Thu Aug 22 09:46:35 2013 (5215CFEB)
Intel Processor driver http://downloadcenter.intel.com/Default.aspx also at
http://www.carrona.org/drivers/driver.php?id=intelppm.sys
uxstyle.sys Mon Sep 23 12:19:02 2013 (524023A6)
The Within Network UxStyle Kernel Driver http://uxstyle.com/
http://www.carrona.org/drivers/driver.php?id=uxstyle.sys
iaioi2ce.sys Mon Nov 4 22:23:49 2013 (52781E75)
Intel I2C Controller Driver E https://downloadcenter.intel.com/ [br]or [br]OEM
http://www.carrona.org/drivers/driver.php?id=iaioi2ce.sys
iwdbus.sys Tue Dec 17 22:47:38 2013 (52B0D48A)
Intel WIDI Bus Enumerator driver[br]Related to Intel Widi - Wireless Display http://downloadcenter.intel.com/SearchResult.aspx?lang=eng&keyword="widi"
http://www.carrona.org/drivers/driver.php?id=iwdbus.sys
Rt630x64.sys Wed Dec 18 03:30:14 2013 (52B116C6)
Realtek PCI/PCIe Adapters http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=7&PFid=10&Level=3&Conn=2
http://www.carrona.org/drivers/driver.php?id=Rt630x64.sys
TXEIx64.sys Sun Jan 12 13:08:31 2014 (52D293CF)
Intel(R) Trusted Execution Engine Interface https://downloadcenter.intel.com OR OEM
http://www.carrona.org/drivers/driver.php?id=TXEIx64.sys
IntcDAud.sys Wed Jan 15 09:12:07 2014 (52D650E7)
Intel Graphics Media Accelerator HD Driver http://downloadcenter.intel.com/
http://www.carrona.org/drivers/driver.php?id=IntcDAud.sys
btath_bus.sys Mon Jan 20 14:20:21 2014 (52DD30A5)
Atheros BlueTooth driver Official site: http://www.qualcomm.com/drivers [br] Unofficial site: http://www.atheros.cz [br] Also check at OEM
http://www.carrona.org/drivers/driver.php?id=btath_bus.sys
athwbx.sys Fri Feb 14 10:35:18 2014 (52FDF166)
Qualcomm Atheros AR9485WB-EG Wireless Network Adapter (Version: 10.0.0.274 is the first one after the release of Win8.1). Although I do not recommend drivers from places other than the manufacturer's website - this is the exception to that rule. Please scan with an anti-virus before opening any file that you download from the internet. Also the driver for Qualcomm Atheros AR9002WB-1NG Wireless Network Adapter & likely others as well. Official site: http://www.qualcomm.com/drivers Unofficial site: http://www.atheros.cz
http://www.carrona.org/drivers/driver.php?id=athwbx.sys
SynRMIHID.sys Thu Feb 20 01:29:36 2014 (53055A80)
Synaptics I2C Touchpad Driver OEM or http://www.synaptics.com/en/drivers.php
http://www.carrona.org/drivers/driver.php?id=SynRMIHID.sys
btfilter.sys Fri Feb 21 08:31:00 2014 (53070EC4)
Atheros Bluetooth Driver Official site: http://www.qualcomm.com/drivers Unofficial site: http://www.atheros.cz
http://www.carrona.org/drivers/driver.php?id=btfilter.sys
igdkmd64.sys Fri Mar 7 16:08:56 2014 (5319EF18)
Intel Graphics driver http://downloadcenter.intel.com/Default.aspx
http://www.carrona.org/drivers/driver.php?id=igdkmd64.sys
RTKVHD64.sys Tue Mar 25 10:39:24 2014 (53315CDC)
Realtek High Definition Audio Function Driver http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=8&PFid=14&Level=3&Conn=2
http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys
tap0901.sys Wed Nov 5 13:16:32 2014 (545A2330)
TAP-Win32 Adapter V9 or OpenVPN driver or COMODO http://openvpn.net/index.php/open-source/downloads.html or http://forums.comodo.com/index.php?action=dlattach;topic=17220.0;attach=17692 Requires registration
http://www.carrona.org/drivers/driver.php?id=tap0901.sys
ElbyCDIO.sys Wed Dec 17 23:30:51 2014 (5492122B)
CDRTools/ElbyCDIO/DVD Region Killer/VirtualCloneDrive (elby CloneDVD™ 2)/AnyDVD http://cdrecord.berlios.de/private/cdrecord.html AnyDVD here: http://www.slysoft.com/en/support.html
http://www.carrona.org/drivers/driver.php?id=ElbyCDIO.sys
HWiNFO64A.SYS Tue Mar 31 10:51:32 2015 (551A6E24)
HWiNFO32 Kernel Driver http://www.hwinfo.com/download32.html
http://www.carrona.org/drivers/driver.php?id=HWiNFO64A.SYS
AnyDVD.sys Mon Apr 27 20:05:44 2015 (553E8888)
AnyDVD by SlySoft, Inc http://www.slysoft.com/en/download.html
http://www.carrona.org/drivers/driver.php?id=AnyDVD.sys
aswRvrt.sys Mon Apr 25 12:38:50 2016 (571E01CA)
Avast! Revert driver (Likely a boot driver) http://support.avast.com/
http://www.carrona.org/drivers/driver.php?id=aswRvrt.sys
aswMonFlt.sys Mon Apr 25 12:38:58 2016 (571E01D2)
avast! File System Minifilter Driver http://support.avast.com/
http://www.carrona.org/drivers/driver.php?id=aswMonFlt.sys
aswHwid.sys Mon Apr 25 12:39:01 2016 (571E01D5)
avast! HWID driver http://support.avast.com/
http://www.carrona.org/drivers/driver.php?id=aswHwid.sys
aswRdr2.sys Mon Apr 25 12:39:27 2016 (571E01EF)
avast! TDI Redirect Driver http://www.avast.com/en-eu/index
http://www.carrona.org/drivers/driver.php?id=aswRdr2.sys
aswKbd.sys Mon Apr 25 12:39:28 2016 (571E01F0)
avast! Keyboard Filter Driver http://support.avast.com/
http://www.carrona.org/drivers/driver.php?id=aswKbd.sys
aswSnx.sys Mon Apr 25 12:39:31 2016 (571E01F3)
avast! Virtualization Driver http://support.avast.com/
http://www.carrona.org/drivers/driver.php?id=aswSnx.sys
aswSP.sys Mon Apr 25 12:59:07 2016 (571E068B)
avast! Self Protection Driver http://support.avast.com/
http://www.carrona.org/drivers/driver.php?id=aswSP.sys
aswStm.sys Mon Apr 25 13:06:19 2016 (571E083B)
avast! Antivirus Stream Filter driver http://support.avast.com/
http://www.carrona.org/drivers/driver.php?id=aswStm.sys
aswVmm.sys Thu Aug 4 11:30:08 2016 (57A31930)
avast! VM Monitor driver http://support.avast.com/
http://www.carrona.org/drivers/driver.php?id=aswVmm.sys

Code:

Debug session time: Sat Aug  6 00:27:22.125 2016 (UTC + 1:00)
Loading Dump File [C:\Users\Me\SysnativeBSODApps\080616-21625-01.dmp]
Built by: 9600.18289.amd64fre.winblue_ltsb.160328-1315
System Uptime: 0 days 0:09:38.078
Probably caused by : ntkrnlmp.exe ( nt! ?? ::OKHAJAOM::`string'+269a )
BugCheck C000021A, {ffffc001bc665c00, 0, 0, 0}
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0xC000021A]WINLOGON_FATAL_ERROR (c000021a)[/url]
Bugcheck code c000021A
Arguments:
Arg1: ffffc001bc665c00, String that identifies the problem.
Arg2: 0000000000000000, Error Code.
Arg3: 0000000000000000
Arg4: 0000000000000000
Arg2: 0000000000000000, Error Code.
PROCESS_NAME:  services.exe
BUGCHECK_STR:  0xc000021a_rpcss.dll_Critical_Service_Terminated
FAILURE_BUCKET_ID:  0xc000021a_rpcss.dll_Critical_Service_Terminated_nt!_??_::OKHAJAOM::_string_
MaxSpeed:  2160
CurrentSpeed: 2167
BiosVersion = V1.03
BiosReleaseDate = 05/09/2014
SystemManufacturer = Acer
SystemProductName = Aspire ES1-511
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

 

Well at least the old ones are in the minority. What do you recommend I do next?

 

^^ This.

 

Oh. Well then your post was confusing because you said my BSOD sub-type was NOT a common one.

 

I don't know how to update drivers. I don't think I've ever done it before. And I wouldn't know which ones to remove, or how.

 

Reading and link-clicking the RED sections above should give you some clues as to what the old drivers are or what software they belong to. Searching for the driver name on your PC and checking the Properties for ownership details should also help.

Device Manager is where you can update drivers manually, right-click the hardware device, Update driver, Let me choose - select the folder you unzipped those drivers to - or use the software/driver installer, if it comes that way.

Add/ Remove Programs or Programs and Features is where you can uninstall software.

 

Sorry but I'm quite lost. The first old driver does appear to be associated with Netgear. I did find wpcap.dll and packet.dll in system32 but I don't know how to update npf.sys The link where you're apparently supposed to be able to update it is only a contact page. I'm not having any problems with my router (if router means the thing I access the net with) so that firmware upgrade link doesn't apply to me, I don't think. The BSOD thread doesn't apply either as that concerns a Windows 7 laptop, and mine is Windows 8.1 Also that laptop was BSODing when going into sleep mode. I didn't try to put my computer in sleep mode, just restarted it.

I don't know how to update the second driver either. I can't tell whether it definitely came with iTunes, and the update link is just the manufacturer's main website. I don't know how to find the particular driver in order to update it.

I tried updating speedfan.sys by installing the latest version of speedfan but it didn't work. The driver still had the same date on it.

I couldn't update the two Acer drivers. When I entered my serial number on the Acer website, the only driver the site offered to update was a card reader thing. I don't know what a card reader is.

And I don't think the sixth driver is old. It's dated the 22nd of August 2013. I thought drivers had to be dated before the 17th to be old.

 

Searching for the driver name on your PC and checking the Properties for ownership details should also help. npf.sys/winpcap might belong to any networking -related software you have, PeerBlock, Private WiFi, FileZilla, or any of the unknown to me software titles you have installed.

If you can't update something, uninstall it. Once troubleshooting is over, you've reached 7-10 days of no freezes/BSODs, you can replace them one at a time, over the course of several weeks. Any you don't need on a regular basis that are only small downloads, uninstall them until you do need them.

You're correct on intelppm.sys (unless I got the RTM and Gold dates mixed), but then, I didn't write the debugging tools that output the data in that format, though I should have checked it more thoroughly, excuse us please.

 

How though? You mean in identifying what programs the driver is assocuated with? How would I do that? I'm not sure I know how to check ownership. All I can see when I check any file are permissions.

I'm fine with temporarily uninstalling stuff I don't regularly use, I just wanna make sure I'm uninstalling the right things.

 

When looking at the Properties of a driver, you might be able to get details from the Digital Signature or the Details tab might include the Product name/version or the Copyright holder.

Using DriverView (set it to <View> Hide MS drivers, Choose to add the Modified and Created dates Columns and <Options> Read Digital Signatures and then click the Refresh button), you may be able to see a company name, you can use Search Google, use the Modified Date/time to find other files (from the same installation, check installed Programs dates in Control Panel?) created on your PC at the same time.

For running exe files , use Task Manager, right-click the exe and select Go to Services (this will show which, if any, Service is associated with the exe), for Services (I think W8.x/10 'lost' this option), right click the Service and select Go to Process.

You could use Autoruns to disable something from starting automatically, start it <Options> Hide empty locations, Hide Windows entries, <Scan options> Verify code signatures. Click the Refresh button. Find the entry you're looking for, uncheck it. Reboot.

Note: as with trying out anything you're unfamiliar with, ensure you have a recent verified image and/or a recent System Restore point and a Recovery disk to hand, you never know when something unexpected might happen.

http://www.howtogeek.com/school/sysinternals-pro/ <- might be useful

 

Ah, I think I was confused about what ownership meant then. Usually when I think of ownership, I'm thinking of who has permission to do what with a file, like when I try to delete a file but I'm told I need administrative permission. I see what you mean now. The details tab on each driver did provide me with a product name, but none of the names were familiar. I hadn't deliberately installed any of them myself so I'm a little afraid of uninstalling things I didn't install in the first place. npf.sys didn't tell me anything beyond the fact it's linked to WinPcap but it didn't list any other specific programs. GEARAspiWDM.sys belongs to CD DVD Filter. I don't know what that is. I could uninstall SpeedFan no problem, I know I didn't always have that. I'm not sure uninstalling would do any good though as like I said before, updating the program didn't change the date on speedfan.sys But the last two drivers, LMDriver.sys and RadioShim.sys both belong to the Launch Manager which doesn't sound like something I should be messing with.

DriverView gives me the same information for npf.sys as standard properties does. Again, the only product name is WinPcap, and the modified and created dates both say 2011. I've only had the computer since 2014 and that's the earliest the Control Panel tells me any programs were installed.

The modified and created dates on GEARAspiWDM.sys are very confusing. The modified date is three years earlier than the created date. Anyway, on the created date, 6/23/15, according to Control Panel, I installed 7-Zip, Macrium Reflect, MediaMonkey, PuTTY, WinSCP, and PeaZip.

The modified and created dates on LMDriver.sys and RadioShim.sys both say 2013.

So, unfortunately, I'm still having no luck figuring out what programs to uninstall.

What do you mean by Recovery Disk? Do you mean one that should have come with the computer when I bought it? If so, then none did. All I got was the computer. No disks.

That's kinda like a mini-textbook. Could you point out specific lessons I could read?

 

Start by studying the section on Autoruns: http://www.howtogeek.com/school/sysinternals-pro/lesson6/

Recovery disk, a recovery or repair disc that allows you to boot your PC and make repairs or restore your OS, restore your image/backup set.

 

I had a look through that. But I don't know what programs I need to stop from running automatically. I still don't know how to identify what programs all those old drivers are associated with.

I could do that. Would take me some time though. I'll have to look back on an old thread and relearn how to do it.

 

You might be able to find some clues by using the Programs and Publishers search facilities here: http://www.shouldiremoveit.com/programs.aspx

You might also be able to find clues about specific files/drivers by using a search engine on that site, try "driver/file name site: shouldiremoveit.com". Example: npf.sys site:shouldiremoveit.com

A repair/recovery disc (and backups/images) is something every PC user should have.

 

Well shouldiremoveit says only 9% remove WinPcap and the overall sentiment is very good. Couldn't find anything on GEARAspiWDM.sys Regarding Launch Manager, 26% remove it and the overall sentiment is fair.

 

But it's nothing to do with what others might or might not do, it's about discovering the source/publisher and therefore the software, updating or removing that software. Do YOU really need it? Is it worth removing temporarily, for troubleshooting purposes?

It's really up to you what you do, your PC, not mine, not anyone else's.

 

Well thanks for all the help and advice but I'll probably just skip it then. Those drivers are just too difficult to pin down. I can't figure out exactly what npf.sys belongs to. Might just be WinPcap, might be something more specific. GEARAspiWDM.sys APPARENTLY belongs to CD DVD Filter. I don't know what that is, I didn't install it. I can't find it with Everything. Updating SpeedFan didn't update speedfan.sys I don't THINK I wanna mess with Launch Manager. I don't really know what it is or what it does. It's been about 10 days now since the BSOD and I haven't had any others or any freezes. So unless there is one in the near future, I think I'll just quit worrying about it for now.

 

"Mr. Wembley, it happened again."

 

So nothing much to worry about then?

 

The person helping you - satrow - probably hasn't seen that post and unzipped it and looked at it yet. They haven't been online a couple of days, so maybe just wait.

 

Suffered another one last night. One of those driver not less or equal ones.