Kernel_mode_exception_not_handled_m

Hello, I need you help once again

On Mon 9/16/2013 11:18:17 AM GMT my computer crashed. No bsod, just a restart.

On Fri 9/20/2013 11:30:28 AM GMT my computer crashed. No bsod, just a restart.

That happened while I was surfing with google chrome. I don't know what exactly triggers the crash so I can't reproduce it. As you can see there are 4 days between the 2 crashes so it seems kinda random.

Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M

 

XP BSODs are difficult, often impossible, to diagnose accurately.

Carrona's studies are at odds with the About article, "Usual causes: Insufficient disk space, Device driver, Video card, BIOS, Breakpoint in startup without having a debugger attached, Hardware incompatibility, Faulty system service, 3rd party remote control, Memory" <- that's in order of frequency. http://www.carrona.org/bsodindx.html#0x0000008E

3x dumps were attached, all 0x8E's, each one when running Chrome, so most likely network/firewall/security software/hardware related. 2 of them had font elements in the call stacks, that may increase the chance that malware is involved, vulnerable fonts being a common target for malware.

Update the network card/chipset drivers: http://www.majorgeeks.com/files/details/atheros_ar8121ar8113_pci_e_ethernet_controller.html

Download the latest version of Private Firewall: http://www.majorgeeks.com/files/details/privatefirewall.html

Uninstall your current Private Firewall:

After rebooting, install the latest version downloaded earlier.

There may be an Avast! configuration problem involved this, you could uninstall it and use MSE for testing: http://www.majorgeeks.com/files/details/microsoft_security_essentials_for_windows.html

Information only, 3rd party drivers loaded:

Code:

[COLOR=RED][B]ASACPI.sys        Fri Aug 13 03:52:52 2004 (411C2D04)[/B][/COLOR]
Asus ATK0110 ACPI Utility (a known [COLOR=RED]BSOD[/COLOR] maker in Win7 and Win8).  Also a part of many Asus utilities  (Win8 versions available from Windows Update as an Optional Update - but check Asus first!)
[url=http://www.carrona.org/drivers/driver.php?id=ASACPI.sys]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]ASACPI.sys[/COLOR][/B][/url]
 
monfilt.sys       Wed Jan  4 07:41:48 2006 (43BB7C3C)
 
[color=#777777][color=#4b0082]monfilt.sys[/color] - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.[/color]
 
intelppm.sys      Sun Apr 13 19:31:31 2008 (48025183)
Intel Processor driver
[url=http://www.carrona.org/drivers/driver.php?id=intelppm.sys]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]intelppm.sys[/COLOR][/B][/url]
 
viahduaa.sys      Fri Jul 25 13:09:23 2008 (4889C273)
VIA High Definition Audio Function Driver
[url=http://www.carrona.org/drivers/driver.php?id=viahduaa.sys]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]viahduaa.sys[/COLOR][/B][/url]
 
l1e51x86.sys      Wed Dec  2 03:09:22 2009 (4B15DA62)
 
[color=#777777][color=#4b0082]l1e51x86.sys[/color] - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.[/color]
 
AtihdXP3.sys      Fri May 11 09:22:55 2012 (4FACCC5F)
AMD High Definition Audio Function Driver
[url=http://www.carrona.org/drivers/driver.php?id=AtihdXP3.sys]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]AtihdXP3.sys[/COLOR][/B][/url]
 
pwipf6.sys        Fri May 25 15:32:32 2012 (4FBF9800)
Webroot Desktop Firewall
[url=http://www.carrona.org/drivers/driver.php?id=pwipf6.sys]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]pwipf6.sys[/COLOR][/B][/url]
 
ati2cqag.dll      Fri Nov 16 19:39:03 2012 (50A69657)
ATI Video
[url=http://www.carrona.org/drivers/driver.php?id=ati2cqag.dll]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]ati2cqag.dll[/COLOR][/B][/url]
 
atiok3x2.dll      Fri Nov 16 19:46:23 2012 (50A6980F)
ATI Video
[url=http://www.carrona.org/drivers/driver.php?id=atiok3x2.dll]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]atiok3x2.dll[/COLOR][/B][/url]
 
atikvmag.dll      Fri Nov 16 19:50:09 2012 (50A698F1)
ATI Video
[url=http://www.carrona.org/drivers/driver.php?id=atikvmag.dll]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]atikvmag.dll[/COLOR][/B][/url]
 
ativvaxx.dll      Fri Nov 16 19:58:46 2012 (50A69AF6)
ATI Video
[url=http://www.carrona.org/drivers/driver.php?id=ativvaxx.dll]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]ativvaxx.dll[/COLOR][/B][/url]
 
ati3duag.dll      Fri Nov 16 20:23:40 2012 (50A6A0CC)
ATI Video
[url=http://www.carrona.org/drivers/driver.php?id=ati3duag.dll]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]ati3duag.dll[/COLOR][/B][/url]
 
ati2mtag.sys      Fri Nov 16 20:24:05 2012 (50A6A0E5)
ATI Video
[url=http://www.carrona.org/drivers/driver.php?id=ati2mtag.sys]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]ati2mtag.sys[/COLOR][/B][/url]
 
ati2dvag.dll      Fri Nov 16 20:24:31 2012 (50A6A0FF)
ATI Video
[url=http://www.carrona.org/drivers/driver.php?id=ati2dvag.dll]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]ati2dvag.dll[/COLOR][/B][/url]
 
aswRvrt.sys       Thu May  9 09:46:58 2013 (518B6282)
Avast! Revert driver[br](Likely a boot driver)
[url=http://www.carrona.org/drivers/driver.php?id=aswRvrt.sys]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]aswRvrt.sys[/COLOR][/B][/url]
 
aswFsBlk.SYS      Thu May  9 09:47:15 2013 (518B6293)
avast! File System Access Blocking Driver
[url=http://www.carrona.org/drivers/driver.php?id=aswFsBlk.SYS]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]aswFsBlk.SYS[/COLOR][/B][/url]
 
aswMonFlt.sys     Thu May  9 09:47:20 2013 (518B6298)
avast! File System Minifilter Driver
[url=http://www.carrona.org/drivers/driver.php?id=aswMonFlt.sys]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]aswMonFlt.sys[/COLOR][/B][/url]
 
AswRdr.SYS        Thu May  9 09:47:25 2013 (518B629D)
avast! TDI RDR Driver
[url=http://www.carrona.org/drivers/driver.php?id=AswRdr.SYS]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]AswRdr.SYS[/COLOR][/B][/url]
 
aswTdi.SYS        Thu May  9 09:47:25 2013 (518B629D)
avast! TDI Filter Driver
[url=http://www.carrona.org/drivers/driver.php?id=aswTdi.SYS]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]aswTdi.SYS[/COLOR][/B][/url]
 
aswVmm.sys        Thu Jun 27 16:35:53 2013 (51CC5BD9)
avast! VM Monitor driver
[url=http://www.carrona.org/drivers/driver.php?id=aswVmm.sys]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]aswVmm.sys[/COLOR][/B][/url]
 
aswSP.SYS         Thu Jun 27 16:36:59 2013 (51CC5C1B)
avast! Self Protection Driver
[url=http://www.carrona.org/drivers/driver.php?id=aswSP.SYS]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]aswSP.SYS[/COLOR][/B][/url]
 
aswSnx.SYS        Thu Jun 27 16:37:10 2013 (51CC5C26)
avast! Virtualization Driver
[url=http://www.carrona.org/drivers/driver.php?id=aswSnx.SYS]http://www.carrona.org/drivers/driver.php?id=[B][COLOR="BLUE"]aswSnx.SYS[/COLOR][/B][/url]

Dump details:

Code:

Unable to load image win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf862272, aa736ae4, 0}

Probably caused by : win32k.sys ( win32k+62272 )

Followup: MachineOwner
---------

3: kd> !analyze -v; !sysinfo cpuspeed; !sysinfo SMBIOS; lmtsmn; q
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf862272, The address that the exception occurred at
Arg3: aa736ae4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k+62272
bf862272 f6412180        test    byte ptr [ecx+21h],80h

TRAP_FRAME:  aa736ae4 -- (.trap 0xffffffffaa736ae4)
.trap 0xffffffffaa736ae4
ErrCode = 00000000
eax=e22e8008 ebx=00000000 ecx=fffffffc edx=00000000 esi=aa736b80 edi=e2750c40
eip=bf862272 esp=aa736b58 ebp=aa736b68 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
win32k+0x62272:
bf862272 f6412180        test    byte ptr [ecx+21h],80h     ds:0023:0000001d=??
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  chrome.exe

LAST_CONTROL_TRANSFER:  from bf862346 to bf862272

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
aa736b68 bf862346 e3f284e8 00000000 aa736bdc win32k+0x62272
aa736b88 bf8e0c67 00000000 00000000 00000000 win32k+0x62346
aa736bac bf8e115f aa736bdc 00000000 e2436f58 win32k+0xe0c67
aa736bd4 bf84fbfb e129f820 e2436f58 00000000 win32k+0xe115f
aa736c00 bf84f88e e4f1a428 00000000 00000000 win32k+0x4fbfb
aa736c18 bf84df46 e4f1a428 00000000 00000000 win32k+0x4f88e
aa736c30 bf84b0f7 e4f1a428 00000000 88d0cda0 win32k+0x4df46
aa736c4c 805d1e6b 8561d798 00000000 89c2b820 win32k+0x4b0f7
aa736cf0 805d2153 00000000 aa736d4c 804ff99b nt!PspExitThread+0x409
aa736cfc 804ff99b 89c2b820 aa736d48 aa736d3c nt!PsExitSpecialApc+0x23
aa736d4c 80541853 00000001 00000000 aa736d64 nt!KiDeliverApc+0x1af
aa736d4c 7c90e514 00000001 00000000 aa736d64 nt!KiServiceExit+0x59
0608fdcc 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k+62272
bf862272 f6412180        test    byte ptr [ecx+21h],80h

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k+62272

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5202f409

FAILURE_BUCKET_ID:  0x8E_win32k+62272

BUCKET_ID:  0x8E_win32k+62272
=========================================
BugCheck 1000008E, {c0000005, bf862272, aad73ae4, 0}

Probably caused by : win32k.sys ( win32k!PFEOBJ::vFreepfdg+45 )

Followup: MachineOwner
---------

3: kd> !analyze -v; !sysinfo cpuspeed; !sysinfo SMBIOS; lmtsmn; q
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf862272, The address that the exception occurred at
Arg3: aad73ae4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k!PFEOBJ::vFreepfdg+45
bf862272 f6412180        test    byte ptr [ecx+21h],80h

TRAP_FRAME:  aad73ae4 -- (.trap 0xffffffffaad73ae4)
.trap 0xffffffffaad73ae4
ErrCode = 00000000
eax=e12c50a0 ebx=00000000 ecx=0000c000 edx=00000000 esi=aad73b80 edi=e3564420
eip=bf862272 esp=aad73b58 ebp=aad73b68 iopl=0         nv up ei pl nz ac po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010213
win32k!PFEOBJ::vFreepfdg+0x45:
bf862272 f6412180        test    byte ptr [ecx+21h],80h     ds:0023:0000c021=??
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  chrome.exe

LAST_CONTROL_TRANSFER:  from bf862346 to bf862272

STACK_TEXT:  
aad73b68 bf862346 e3f89278 00000000 aad73bdc win32k!PFEOBJ::vFreepfdg+0x45
aad73b88 bf8e0c67 00000000 00000000 00000000 win32k!RFONTOBJ::bDeleteRFONT+0x1d
aad73bac bf8e115f aad73bdc 00000000 e1bcb670 win32k!PUBLIC_PFTOBJ::bLoadAFont+0x21f
aad73bd4 bf84fbfb e276a828 e1bcb670 00000000 win32k!PFTOBJ::bUnloadWorkhorse+0x112
aad73c00 bf84f88e e354a660 00000000 00000000 win32k!vCleanupPrivateFonts+0x4d
aad73c18 bf84df46 e354a660 00000000 00000000 win32k!NtGdiCloseProcess+0xb9
aad73c30 bf84b0f7 e354a660 00000000 88cd9850 win32k!GdiProcessCallout+0x102
aad73c4c 805d1e6b 86e4dda0 00000000 891b2958 win32k!W32pProcessCallout+0x5c
aad73cf0 805d2153 00000000 aad73d4c 804ff99b nt!PspExitThread+0x409
aad73cfc 804ff99b 891b2958 aad73d48 aad73d3c nt!PsExitSpecialApc+0x23
aad73d4c 80541853 00000001 00000000 aad73d64 nt!KiDeliverApc+0x1af
aad73d4c 7c90e514 00000001 00000000 aad73d64 nt!KiServiceExit+0x59
WARNING: Frame IP not in any known module. Following frames may be wrong.
05e9ff34 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!PFEOBJ::vFreepfdg+45
bf862272 f6412180        test    byte ptr [ecx+21h],80h

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!PFEOBJ::vFreepfdg+45

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5202f409

FAILURE_BUCKET_ID:  0x8E_win32k!PFEOBJ::vFreepfdg+45

BUCKET_ID:  0x8E_win32k!PFEOBJ::vFreepfdg+45
======================================
BugCheck 1000008E, {c0000005, bf86601e, aa12ca4c, 0}

Unable to load image pwipf6.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for pwipf6.sys
*** ERROR: Module load completed but symbols could not be loaded for pwipf6.sys
Probably caused by : pwipf6.sys ( pwipf6+e742 )

Followup: MachineOwner
---------

1: kd> !analyze -v; !sysinfo cpuspeed; !sysinfo SMBIOS; lmtsmn; q
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf86601e, The address that the exception occurred at
Arg3: aa12ca4c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k!PFEOBJ::vFreepfdg+45
bf86601e f6412180        test    byte ptr [ecx+21h],80h

TRAP_FRAME:  aa12ca4c -- (.trap 0xffffffffaa12ca4c)
.trap 0xffffffffaa12ca4c
ErrCode = 00000000
eax=e2b844e8 ebx=00000000 ecx=6d6f6469 edx=00000000 esi=aa12cae8 edi=e1650750
eip=bf86601e esp=aa12cac0 ebp=aa12cad0 iopl=0         ov up ei ng nz na po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010a83
win32k!PFEOBJ::vFreepfdg+0x45:
bf86601e f6412180        test    byte ptr [ecx+21h],80h     ds:0023:6d6f648a=??
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  chrome.exe

LAST_CONTROL_TRANSFER:  from bf8660f2 to bf86601e

STACK_TEXT:  
aa12cad0 bf8660f2 e25eed08 00000000 aa12cb44 win32k!PFEOBJ::vFreepfdg+0x45
aa12caf0 bf8e0cb7 00000000 00000000 00000000 win32k!RFONTOBJ::bDeleteRFONT+0x1d
aa12cb14 bf8e11af aa12cb44 00000000 e17471e0 win32k!PUBLIC_PFTOBJ::bLoadAFont+0x21f
aa12cb3c bf84fbeb e2054390 e17471e0 00000000 win32k!PFTOBJ::bUnloadWorkhorse+0x112
aa12cb68 bf84f8a3 e3905930 00000000 00000000 win32k!vCleanupPrivateFonts+0x4d
aa12cb80 bf84df28 e3905930 00000000 00000000 win32k!NtGdiCloseProcess+0xb9
aa12cb98 bf84b0d9 e3905930 00000000 8920b578 win32k!GdiProcessCallout+0x102
aa12cbb4 805d1e6b 88df9210 00000000 8920b578 win32k!W32pProcessCallout+0x5c
aa12cc58 805d2232 00000000 8920b578 00000000 nt!PspExitThread+0x409
aa12cc78 805d240d 8920b578 00000000 ffffffff nt!PspTerminateThreadByPointer+0x52
aa12cca4 f6296742 00000000 00000000 aa12cd64 nt!NtTerminateProcess+0x105
WARNING: Stack unwind information not available. Following frames may be wrong.
aa12cd64 7c90e514 badb0d00 0012fdc8 00000000 pwipf6+0xe742
aa12cd68 badb0d00 0012fdc8 00000000 00000000 0x7c90e514
aa12cd6c 0012fdc8 00000000 00000000 00000000 0xbadb0d00
aa12cd70 00000000 00000000 00000000 00000000 0x12fdc8


STACK_COMMAND:  kb

FOLLOWUP_IP: 
pwipf6+e742
f6296742 ??              ???

SYMBOL_STACK_INDEX:  b

SYMBOL_NAME:  pwipf6+e742

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: pwipf6

IMAGE_NAME:  pwipf6.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4fbf9800

FAILURE_BUCKET_ID:  0x8E_pwipf6+e742

BUCKET_ID:  0x8E_pwipf6+e742

 

Memtest didn't display any errors.

I updated my Bios (first time ever, success :-D) and my sound drivers. I checked all my other drivers and I believe they are updated.

I removed and reinstalled privatefirewall. I also checked for malware with the help of another thread from this forum, the apps didnt show any malware at all.

I also reinstalled avast but I'll follow your tip and install MSE (I hope it's a light av, with 2gb of ram i must be cautious). I will also surf from another browser for the next days.

If it crashes again I'll either reply here or make a new thread depending on how many days have passed.

 

Sounds good, did you update the network drivers from the MG link i gave earlier - they could be 3 years newer than the current (2009) ones