[SOLVED] Blue Screen Error 0x000000C5 ?

[LucyX]

Hello everyone,
My computer often encounters a blue screen error 0x000000C5,
I upgraded hard drive + RAM, however it will be stable for about 1 week then it keeps crashing again.
Lately, this error has appeared continuously.
Hoping someone can point me to the solution. Thanks so much.
Error Picture: https://drive.google.com/file/d/13CbiAAWGuQMhyABRdzsl0UpLzx99m-3c/view?usp=sharing

 

[Colif]

The DRIVER_CORRUPTED_EXPOOL bug check has a value of 0x000000C5. This indicates that the system attempted to access invalid memory at a process IRQL that was too high.

can you set up windows to create a small minidump?
Follow this to step 4 & then do step 6 & then step 9
https://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html

A file will be created in c windows/minidump after the next BSOD

1. Open Windows File Explore
2. Navigate to C:\Windows\Minidump
3. Copy the mini-dump files out onto your Desktop
4. Use a program like winrar or winzip
5. Select those files on your Desktop, right click them and choose 'Send to' -
6. Upload the zip file to the Cloud (OneDrive, DropBox . . . etc.)
7. Then post a link here to the zip file, so we can take a look for you . . .

it could be a driver, its not an error I see a lot (but I don't see many win 7 PC)

what are specs of the PC?

 

[LucyX]

Hi Colif,

Here is my minidump file and my PC specs: https://drive.google.com/drive/folders/1nZNmV3N4tbDSwshfaxNk-fAqElweA7ph?usp=sharing
Please tell me why this error occurs and how to fix it,

 

[Colif]

i normally do win 10 ones so I will try not to forget this is a WIn 7 pc

I wasn't expecting 24. My converter takes way longer if I give it more than 5 at a time. So I broke it into chunks.
It took longer than I was expecting

Conversion of dumps

report - Click run as fiddle to see report
6 -10 - report - Click run as fiddle to see report
10 - 15 - report - Click run as fiddle to see report
16-20 - report - Click run as fiddle to see report
21-24 - report - Click run as fiddle to see report

Spoiler

File: 101722-14726-01.dmp (Oct 17 2022 - 12:44:13)
BugCheck: [DRIVER_CORRUPTED_EXPOOL (C5)]
Probably caused by: ntkrnlmp.exe (Process: 45de073220d50c)
Uptime: 2 Day(s), 15 Hour(s), 56 Min(s), and 21 Sec(s)

File: 101722-14352-01.dmp (Oct 17 2022 - 14:24:06)
BugCheck: [IRQL_NOT_LESS_OR_EQUAL (A)]
Probably caused by: memory_corruption (Process: CCSystemDiagno)
Uptime: 0 Day(s), 1 Hour(s), 28 Min(s), and 24 Sec(s)

File: 101722-13759-01.dmp (Oct 17 2022 - 17:25:30)
BugCheck: [SYSTEM_SERVICE_EXCEPTION (3B)]
Probably caused by: ntkrnlmp.exe (Process: wuauclt.exe)
Uptime: 0 Day(s), 3 Hour(s), 00 Min(s), and 51 Sec(s)

File: 101422-25615-01.dmp (Oct 14 2022 - 15:13:20)
BugCheck: [IRQL_NOT_LESS_OR_EQUAL (A)]
Probably caused by: memory_corruption (Process: audiodg.exe)
Uptime: 0 Day(s), 0 Hour(s), 14 Min(s), and 34 Sec(s)

File: 101422-25287-01.dmp (Oct 14 2022 - 15:13:20)
BugCheck: [ ()]
Probably caused by: (Process: https://www.google.com/search?q=)
Uptime: 0 Day(s), 0 Hour(s), 14 Min(s), and 34 Sec(s)


File: 101422-22386-01.dmp (Oct 14 2022 - 12:16:45)
BugCheck: [BAD_POOL_HEADER (19)]
Probably caused by: Unknown_Image (Process: taskeng.exe)
Uptime: 1 Day(s), 0 Hour(s), 05 Min(s), and 27 Sec(s)

File: 101422-15724-01.dmp (Oct 14 2022 - 18:34:06)
BugCheck: [IRQL_NOT_LESS_OR_EQUAL (A)]
Probably caused by: memory_corruption (Process: sim9sync.exe)
Uptime: 0 Day(s), 0 Hour(s), 27 Min(s), and 50 Sec(s)

File: 101422-15522-01.dmp (Oct 14 2022 - 19:53:05)
BugCheck: [IRQL_NOT_LESS_OR_EQUAL (A)]
Probably caused by: memory_corruption (Process: CCProfileServe)
Uptime: 0 Day(s), 0 Hour(s), 15 Min(s), and 04 Sec(s)

File: 101422-15381-01.dmp (Oct 14 2022 - 17:48:26)
BugCheck: [DRIVER_CORRUPTED_EXPOOL (C5)]
Probably caused by: Pool_Corruption (Process: CCWriteArchive)
Uptime: 0 Day(s), 2 Hour(s), 34 Min(s), and 09 Sec(s)

File: 101422-15038-01.dmp (Oct 14 2022 - 19:24:58)
BugCheck: [DRIVER_CORRUPTED_EXPOOL (C5)]
Probably caused by: Pool_Corruption (Process: CCTlgServer.ex)
Uptime: 0 Day(s), 0 Hour(s), 50 Min(s), and 21 Sec(s)


File: 101422-14040-01.dmp (Oct 14 2022 - 20:33:56)
BugCheck: [BAD_POOL_HEADER (19)]
Probably caused by: Unknown_Image (Process: csrss.exe)
Uptime: 0 Day(s), 0 Hour(s), 40 Min(s), and 15 Sec(s)

File: 101022-16894-01.dmp (Oct 10 2022 - 13:37:23)
BugCheck: [DRIVER_IRQL_NOT_LESS_OR_EQUAL (D1)]
Probably caused by: NETIO.SYS (Process: SearchFilterHo)
Uptime: 0 Day(s), 0 Hour(s), 29 Min(s), and 59 Sec(s)

File: 101022-14710-01.dmp (Oct 10 2022 - 13:06:27)
BugCheck: [IRQL_NOT_LESS_OR_EQUAL (A)]
Probably caused by: memory_corruption (Process: UltraViewer_De)
Uptime: 1 Day(s), 15 Hour(s), 01 Min(s), and 09 Sec(s)

File: 100522-17347-01.dmp (Oct 5 2022 - 12:38:04)
BugCheck: [IRQL_NOT_LESS_OR_EQUAL (A)]
Probably caused by: ntkrnlmp.exe (Process: System)
Uptime: 3 Day(s), 21 Hour(s), 07 Min(s), and 19 Sec(s)

File: 100522-15428-01.dmp (Oct 5 2022 - 14:41:03)
BugCheck: [SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007E)]
Probably caused by: ntkrnlmp.exe (Process: System)
Uptime: 0 Day(s), 2 Hour(s), 02 Min(s), and 15 Sec(s)


File: 100522-15100-01.dmp (Oct 5 2022 - 17:39:03)
BugCheck: [IRQL_NOT_LESS_OR_EQUAL (A)]
Probably caused by: memory_corruption (Process: sqlservr.exe)
Uptime: 0 Day(s), 0 Hour(s), 14 Min(s), and 26 Sec(s)

File: 100522-14445-01.dmp (Oct 5 2022 - 17:23:40)
BugCheck: [IRQL_NOT_LESS_OR_EQUAL (A)]
Probably caused by: memory_corruption (Process: SearchIndexer.)
Uptime: 0 Day(s), 2 Hour(s), 41 Min(s), and 41 Sec(s)

File: 100522-14383-01.dmp (Oct 5 2022 - 20:16:52)
BugCheck: [IRQL_NOT_LESS_OR_EQUAL (A)]
Probably caused by: memory_corruption (Process: w3wp.exe)
Uptime: 0 Day(s), 1 Hour(s), 18 Min(s), and 16 Sec(s)

File: 100522-14149-01.dmp (Oct 5 2022 - 18:57:38)
BugCheck: [DRIVER_CORRUPTED_EXPOOL (C5)]
Probably caused by: Pool_Corruption (Process: CCTlgServer.ex)
Uptime: 0 Day(s), 1 Hour(s), 18 Min(s), and 02 Sec(s)

File: 090922-26863-01.dmp (Sep 9 2022 - 13:40:22)
BugCheck: [IRQL_NOT_LESS_OR_EQUAL (A)]
Probably caused by: ntkrnlmp.exe (Process: taskmgr.exe)
Uptime: 0 Day(s), 18 Hour(s), 06 Min(s), and 22 Sec(s)


File: 090922-26176-01.dmp (Sep 9 2022 - 16:16:41)
BugCheck: [SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007E)]
Probably caused by: ntkrnlmp.exe (Process: System)
Uptime: 0 Day(s), 2 Hour(s), 35 Min(s), and 21 Sec(s)

File: 090822-33134-01.dmp (Sep 8 2022 - 17:23:01)
BugCheck: [IRQL_NOT_LESS_OR_EQUAL (A)]
Probably caused by: ntkrnlmp.exe (Process: svchost.exe)
Uptime: 0 Day(s), 23 Hour(s), 46 Min(s), and 44 Sec(s)

File: 090822-27658-01.dmp (Sep 8 2022 - 19:33:03)
BugCheck: [DRIVER_IRQL_NOT_LESS_OR_EQUAL (D1)]
Probably caused by: srv.sys (Process: System)
Uptime: 0 Day(s), 2 Hour(s), 09 Min(s), and 32 Sec(s)

File: 080222-30482-01.dmp (Aug 2 2022 - 12:09:20)
BugCheck: [PAGE_FAULT_IN_NONPAGED_AREA (50)]
Probably caused by: srv.sys (Process: System)
Uptime: 0 Day(s), 18 Hour(s), 26 Min(s), and 51 Sec(s)

All the processes mentioned in brackets are victims, not cause

Crash 5 dump file from the top was corrupt
crash 12 from top is 1st one to actually mention a driver
NETIO.sys is used by windows to talk to internet drivers.

Almost all the dumps only have 1 line of dump text and don't actually show any clue what was cause.
I think its all drivers.

last 2 crashes blame srv.sys which is part of windows used to talk to network

So the only clues I have is it is possibly network drivers

its going to take me a while to identify all the drivers. I don't have a description for a lot of them so once I have looked them all up on Google to see what they are

Do you get them from SIemens? I don't see machines like yours very often.

I upgraded hard drive + RAM

i wonder if it matters that the 2 sticks aren't exactly the same

Size	Speed	Manufacturer	Part No.
	0MHz
8192MB	2133MHz	Samsung	M378A1K43CB2-CRC
	0MHz
8192MB	2133MHz	Samsung	M378A1K43BB2-CRC

though its likely the difference is one is the next years model of same ram

We might have to run driver verifier, i will find instructions.

 

[Colif]

instead of trying to work out what all the Siemens drivers do, it looks like you use intel lan drivers.
Try running this and see if it supports 7 and/or has any drivers - https://www.intel.com.au/content/www/au/en/support/intel-driver-support-assistant.html

 

[LucyX]

Do you get them from SIemens?

Yes, My computer is supplied by Siemens and it is working at a factory.

 

[LucyX]

So the only clues I have is it is possibly network drivers

If so should I try reinstalling the network driver?

 

[LucyX]

Try running this and see if it supports 7 and/or has any drivers - https://www.intel.com.au/content/www/au/en/support/intel-driver-support-assistant.html

I tried but the result is "
Sorry, something went wrong while trying to scan"

Thank you so much for your help, and what should I do next to solve this problem...

 

[Colif]

i wonder whats included in the package for your device - https://support.industry.siemens.co...nd-simatic-field-pg?dti=0&pnid=26135&lc=en-US

It is difficult to work out what intel lan chip it might have
https://cache.industry.siemens.com/...ipc547g_operating_instructions_enUS_en-US.pdf
it just says intel gigabyte - https://support.industry.siemens.co.../simatic-ipc547g-available-now?dti=0&lc=en-LU

Might need to run this to confirm I am not going in the wrong direction
https://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html
it tests drivers, it will cause a BSOD and create a minidump when it finds a driver it doesn't like.

Its downside is it can cause boot loops. Its part of windows but can still break it.

 

[LucyX]

If so, please wait for me, tomorrow I will start suggesting to run Driver Verifier.
Because this is the supervisory computer of a line, frequent start-ups are disruptive.

 

[LucyX]

Hey Colif,
I know Driver Verifier can cause serious errors,
I'm afraid, can my computer work normally after the blue screen appears?
Is it necessary to back up all data, licenses, before Enable Driver Verifier?

Moreover, I am planning to reinstall Windows 7, do you think this can solve the problem?

 

[Colif]

clean install probably fix it.

I can understand not running Driver Verifier

 

[LucyX]

So according to Colif, should I run Driver Verifier or clean install?

 

[Colif]

clean install safer on a pc you need to be up as much possible.

 

[LucyX]

If that's the case, I'll probably choose the clean install option
Because this is a very important computer.
Thank you so much for taking the time to assist me.

 

[LucyX]

Hi Colif,

I am intending to do a Clean Install in one of two ways.

1. https://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html
2. https://www.sevenforums.com/tutorials/1649-clean-install-windows-7-a.html

But I'm concerned, because it's Windows 7 OEM_COA_NSLP
I couldn't find the OEM key, when I tried to use ShowKeyPlus, it showed that:
OEM key: Server 2012 R2 OEM marker present in firmware"
-->https://drive.google.com/drive/folders/1I4GYajVa0n7IBb6ON1Z73Xe5FGgRaez_?usp=sharing

With my computer, am I required to have an OEM key for Clean Install ?

Looking forward to your guidance, Colif.

 

[Colif]

I don't have any experience with computers like yours so I am not sure about support. It should have a key of some type that would have come along with its purchase. It being in a factory makes me think there should be some record of purchase and maybe paperwork somewhere?
I don't suppose the sticker is in the actual PC? in the past they used to be stuck on OEM PC. Sounds like it could be: https://support.industry.siemens.co...tially-covers-the-product-key-?dti=0&lc=en-IE

You may need to contact Siemens

Page 171 here might help - https://cache.industry.siemens.com/...ipc547g_operating_instructions_enUS_en-US.pdf

 

[Colif]

Dec 29 2017	Winmon.sys
Jan 16 2018	WinmonFS.sys

these appear to be a rootkit
https://stackoverflow.com/questions...windows-system32-drivers-folder-please-help-m

so its probably just as well you reinstalling

 

[LucyX]

Why are you talking about Winmon.sys to me?
I don't really understand what you mean

 

[Colif]

its a file running on your PC. It took me a while to work through identifying all the Siemens files and it was right at end.

I just thought I advise you that there was a rootkit running on it. A virus

 

[LucyX]

Ah, I saw it, Colif,
So should I remove Winmon.sys now or Clean Install?

 

[Colif]

i would run anti virus programs and make sure its all gone. It might have been the cause of BSOD.

If you can remove it all, wait and see if you BSOD.

 

[Colif]

this is part of it too -

Sep 07 2021

WinmonProcessMonitor.sys

I would run this and see if it finds anything - https://www.bitdefender.com.au/solutions/free.html

 

[LucyX]

I can't install Bitdefender because of the following error:
- https://drive.google.com/drive/folders/1UhtiSdYL-qZ5_2eOJL8NXqSgcqHuxAwu?usp=sharing

It leads me to the link: https://www.bitdefender.com/consumer/support/answer/45383/

But my computer cannot update.
So can you suggest another software for me?

 

[Colif]

I suspect a lot of them might have similar restrictions.
clean install might be safest option after all.

Sorry to waste your time.