can someone help me analyse a dump file that doesn't make any sense?

[beefpotato]

its a bsod minidump file that doesn't make any sense to me anyway

https://1drv.ms/u/s!An11TDoAW4k1hW3v-jW6EhxWJGJZ

and can you tell me how to fix this hardware.sys BSoD?

-thanks

 

[johnbl]

3 of your window user mode files have been modified.
679 errors : win32kbase (ffff8f0214a32d70-ffff8f0214a37c5f)

basically, a user mode program made a call that ended up calling the file filter manager then to some unknown code address which ended up in a bugcheck.

I would assume you have a virus that inserted a hack. best to do a clean install of window and update the motherboard drivers


you could try to do a fix by booting windows, running cmd.exe as an admin, then
run
sfc.exe /scannow
then run
dism.exe /online /cleanup-image /restorehealth

then do a Malwarebytes scan
you have to find how the malware got installed, it could be scheduled in the task scheduler.

often it is faster to make a new install image of the current windows build and install it so you know you are not infected.

win32k.sys, win32kbase.sys, and win32kfull.sys among other files look like they were modified.
also, your gpu base driver was installed from the local driver store and does not match your version of the NVidia gpu sound driver. Best to reinstall windows, do the windows updates, reboot and do the motherboard drivers and download the GPU drivers from NVidia (reboot after the install, even though it is not required0

 

[beefpotato]

im doing an sfc scan now, and this already is a fresh windows, could the virus be in the other hard drive?(i have an ssd and a hdd)
and what is a malwarebytes scan.
im in safemode so im limited

 

[beefpotato]

3 of your window user mode files have been modified.
679 errors : win32kbase (ffff8f0214a32d70-ffff8f0214a37c5f)

basically, a user mode program made a call that ended up calling the file filter manager then to some unknown code address which ended up in a bugcheck.

I would assume you have a virus that inserted a hack. best to do a clean install of window and update the motherboard drivers


you could try to do a fix by booting windows, running cmd.exe as an admin, then
run
sfc.exe /scannow
then run
dism.exe /online /cleanup-image /restorehealth

then do a Malwarebytes scan
you have to find how the malware got installed, it could be scheduled in the task scheduler.

often it is faster to make a new install image of the current windows build and install it so you know you are not infected.

win32k.sys, win32kbase.sys, and win32kfull.sys among other files look like they were modified.
also, your gpu base driver was installed from the local driver store and does not match your version of the NVidia gpu sound driver. Best to reinstall windows, do the windows updates, reboot and do the motherboard drivers and download the GPU drivers from NVidia (reboot after the install, even though it is not required0

im doing an sfc scan now, and this already is a fresh windows, could the virus be in the other hard drive?(i have an ssd and a hdd)
and what is a malwarebytes scan.
im in safemode so im limited

 

[johnbl]

you have to get another image from a known good source. (directly from Microsoft for windows 100)

-the code was being executed from user mode so it is something that is currently running on your system that made the call.

-most of the time viruses disable the easy methods of fixing the problem.
for example they make sfc.exe not work by putting a hidden copy of the drivers into the local driver store on the machine.

then they disable the dism.exe command by replacing it with another file that does not work.
the dism.exe command tries to get a clean copy of the bad file directly from the Microsoft update server.

often the malware will delete your backups so recovery will not work.

Malwarebytes is a malware scanner, you would just use the trial version,run the scan and then uninstall it afterword.

if you know you had a good install, then you have to figure out how the files got modified.
I would look at any browser extensions, look at any tasks that are scheduled to run in the task scheduler, look at the list of running tasks to see if something should not be running. Kind of time consuming to figure it out, then you have to figure out what changes were made and undo them.
if you find the virus with a Malwarebytes scan you could look up the virus and then do your own fixes.

3 of your window user mode files have been modified.
679 errors : win32kbase (ffff8f0214a32d70-ffff8f0214a37c5f)

basically, a user mode program made a call that ended up calling the file filter manager then to some unknown code address which ended up in a bugcheck.

I would assume you have a virus that inserted a hack. best to do a clean install of window and update the motherboard drivers


you could try to do a fix by booting windows, running cmd.exe as an admin, then
run
sfc.exe /scannow
then run
dism.exe /online /cleanup-image /restorehealth

then do a Malwarebytes scan
you have to find how the malware got installed, it could be scheduled in the task scheduler.

often it is faster to make a new install image of the current windows build and install it so you know you are not infected.

win32k.sys, win32kbase.sys, and win32kfull.sys among other files look like they were modified.
also, your gpu base driver was installed from the local driver store and does not match your version of the NVidia gpu sound driver. Best to reinstall windows, do the windows updates, reboot and do the motherboard drivers and download the GPU drivers from NVidia (reboot after the install, even though it is not required0

im doing an sfc scan now, and this already is a fresh windows, could the virus be in the other hard drive?(i have an ssd and a hdd)
and what is a malwarebytes scan.
im in safemode so im limited

 

[beefpotato]

3 of your window user mode files have been modified.
679 errors : win32kbase (ffff8f0214a32d70-ffff8f0214a37c5f)

basically, a user mode program made a call that ended up calling the file filter manager then to some unknown code address which ended up in a bugcheck.

I would assume you have a virus that inserted a hack. best to do a clean install of window and update the motherboard drivers


you could try to do a fix by booting windows, running cmd.exe as an admin, then
run
sfc.exe /scannow
then run
dism.exe /online /cleanup-image /restorehealth

then do a Malwarebytes scan
you have to find how the malware got installed, it could be scheduled in the task scheduler.

often it is faster to make a new install image of the current windows build and install it so you know you are not infected.

win32k.sys, win32kbase.sys, and win32kfull.sys among other files look like they were modified.
also, your gpu base driver was installed from the local driver store and does not match your version of the NVidia gpu sound driver. Best to reinstall windows, do the windows updates, reboot and do the motherboard drivers and download the GPU drivers from NVidia (reboot after the install, even though it is not required0

you have to get another image from a known good source. (directly from Microsoft for windows 100)

-the code was being executed from user mode so it is something that is currently running on your system that made the call.

-most of the time viruses disable the easy methods of fixing the problem.
for example they make sfc.exe not work by putting a hidden copy of the drivers into the local driver store on the machine.

then they disable the dism.exe command by replacing it with another file that does not work.
the dism.exe command tries to get a clean copy of the bad file directly from the Microsoft update server.

often the malware will delete your backups so recovery will not work.

Malwarebytes is a malware scanner, you would just use the trial version,run the scan and then uninstall it afterword.

3 of your window user mode files have been modified.
679 errors : win32kbase (ffff8f0214a32d70-ffff8f0214a37c5f)

basically, a user mode program made a call that ended up calling the file filter manager then to some unknown code address which ended up in a bugcheck.

I would assume you have a virus that inserted a hack. best to do a clean install of window and update the motherboard drivers


you could try to do a fix by booting windows, running cmd.exe as an admin, then
run
sfc.exe /scannow
then run
dism.exe /online /cleanup-image /restorehealth

then do a Malwarebytes scan
you have to find how the malware got installed, it could be scheduled in the task scheduler.

often it is faster to make a new install image of the current windows build and install it so you know you are not infected.

win32k.sys, win32kbase.sys, and win32kfull.sys among other files look like they were modified.
also, your gpu base driver was installed from the local driver store and does not match your version of the NVidia gpu sound driver. Best to reinstall windows, do the windows updates, reboot and do the motherboard drivers and download the GPU drivers from NVidia (reboot after the install, even though it is not required0

im doing an sfc scan now, and this already is a fresh windows, could the virus be in the other hard drive?(i have an ssd and a hdd)
and what is a malwarebytes scan.
im in safemode so im limited

so the scan finished with no errors and the dism.exe thing finished successfully
so im now scanning with malwarebytes

 

[beefpotato]

only two malware poped up and they are
PUP.Optional.MailRu
PUP.Optional.MailRu
so i quarantined them

 

[beefpotato]

however there are more dump files that are new
https://1drv.ms/u/s!An11TDoAW4k1hghWfyKS6c8Hbnvz
these are an hour old maybe.

 

[johnbl]

only provide a bugcheck that happens after the malware was removed and the dism.exe command has completed.

I can check to see if you still have modified versions of the win32k files.
you still have the issue that you had something running that was making calls to the modified files.
(unless it was the adware program that Malwarebytes found)

however there are more dump files that are new
https://1drv.ms/u/s!An11TDoAW4k1hghWfyKS6c8Hbnvz
these are an hour old maybe.

 

[beefpotato]

only provide a bugcheck that happens after the malware was removed and the dism.exe command has completed.

I can check to see if you still have modified versions of the win32k files.
you still have the issue that you had something running that was making calls to the modified files.
(unless it was the adware program that Malwarebytes found)

however there are more dump files that are new
https://1drv.ms/u/s!An11TDoAW4k1hghWfyKS6c8Hbnvz
these are an hour old maybe.

so what do i do now?

 

[johnbl]

wait for the next bugcheck if you don't get one then the dism.exe command probably fixed the modified files and Malwarebytes removed the program that installed the bad files. (you could also find the dism.exe log and search it to find the files that it replaced, and assumed it worked if the correct files were replaced)

if you do get a bugcheck, then provide the memory dump (and most likely do a reinstall of windows)

only provide a bugcheck that happens after the malware was removed and the dism.exe command has completed.

I can check to see if you still have modified versions of the win32k files.
you still have the issue that you had something running that was making calls to the modified files.
(unless it was the adware program that Malwarebytes found)

however there are more dump files that are new
https://1drv.ms/u/s!An11TDoAW4k1hghWfyKS6c8Hbnvz
these are an hour old maybe.

so what do i do now?

 

[beefpotato]

ok

 

[beefpotato]

wait for the next bugcheck if you don't get one then the dism.exe command probably fixed the modified files and Malwarebytes removed the program that installed the bad files. (you could also find the dism.exe log and search it to find the files that it replaced, and assumed it worked if the correct files were replaced)

if you do get a bugcheck, then provide the memory dump (and most likely do a reinstall of windows)

only provide a bugcheck that happens after the malware was removed and the dism.exe command has completed.

I can check to see if you still have modified versions of the win32k files.
you still have the issue that you had something running that was making calls to the modified files.
(unless it was the adware program that Malwarebytes found)

however there are more dump files that are new
https://1drv.ms/u/s!An11TDoAW4k1hghWfyKS6c8Hbnvz
these are an hour old maybe.

so what do i do now?

bsod again
https://1drv.ms/u/s!An11TDoAW4k1hgvutpop35JVbPdc

 

[beefpotato]

The other HDD hasn't been messed with, do I disconnect it?
If there is a potential virus

 

[johnbl]

put up a .zip file rather than a .rar file (using a friends laptop and can not install the rar extraction tool, windows can use the .zip file)

 

[Colif]

MERGED QUESTION
Question from beefpotato : "BSoD dumpfile help."

can someone help me take a look at this dumpfile and tell me how to fix it. i just had a BSoD after replacing a faulty motherboard with bent cpu pins, all other parts are functioning correctly, however, I'm not sure about my drives, because when i scan them it immediately gives me an error and i need to fix it, i don't know how

the minidump folder
https://1drv.ms/u/s!An11TDoAW4k1hWuLaJGycrSjBY7w

-Thanks

the .sys file is the storport.sys

its a fresh windows 10 install btw.

there was a missing dump so heres the new link:

https://1drv.ms/u/s!An11TDoAW4k1hWwVSh1DR62ih1qt

 

[Colif]

MERGED QUESTION
Question from beefpotato : "please help I'm desprate, bsods"

im getting a lot of bsods, this has been happening for the past 2 weeks and i tried everything from reinstalling windows to replacing my motherboard.
dump files:
https://1drv.ms/f/s!An11TDoAW4k1hgoxAAmpx3i-c8zf
https://1drv.ms/u/s!An11TDoAW4k1hW3v-jW6EhxWJGJZ

im this close to giving up

thanks

i will ask someone to read them for you

Hi, I ran the dump file(s) through the debugger and got the following information: https://pste.eu/p/xUbU.html

Spoiler

File: 022518-5218-01.dmp (Feb 24 2018 - 17:29:59)
BugCheck: [SYSTEM_SERVICE_EXCEPTION (3B)]
Probably caused by: memory_corruption (Process: CUE.exe)
Uptime: 0 Day(s), 0 Hour(s), 02 Min(s), and 26 Sec(s)

File: 022518-5015-01.dmp (Feb 24 2018 - 17:36:43)
BugCheck: [PAGE_FAULT_IN_NONPAGED_AREA (50)]
Probably caused by: memory_corruption (Process: System)
Uptime: 0 Day(s), 0 Hour(s), 00 Min(s), and 16 Sec(s)

File: 022418-6140-01.dmp (Feb 24 2018 - 15:54:35)
BugCheck: [SYSTEM_SERVICE_EXCEPTION (3B)]
Probably caused by: memory_corruption (Process: MsMpEng.exe)
Uptime: 0 Day(s), 0 Hour(s), 44 Min(s), and 40 Sec(s)

File: 021118-4796-01.dmp (Feb 11 2018 - 15:15:16)
BugCheck: [DRIVER_IRQL_NOT_LESS_OR_EQUAL (D1)]
Probably caused by: tcpip.sys (Process: System)
Uptime: 0 Day(s), 0 Hour(s), 08 Min(s), and 40 Sec(s)

File: 021118-4453-01.dmp (Feb 11 2018 - 14:35:14)
BugCheck: [REFERENCE_BY_POINTER (18)]
Probably caused by: memory_corruption (Process: CUE.exe)
Uptime: 0 Day(s), 0 Hour(s), 13 Min(s), and 12 Sec(s)

The following dump files were 0 bytes long which means they are invalid: 022518-6093-01.dmp, and 021118-8734-01.dmp.

Motherboard: https://www.asus.com/us/Motherboards/ROG-STRIX-Z270H-GAMING/
There are BIOS updates available for your system.

I can't help you with this. Wait for additional replies. Good luck.

Ok thanks

 

[Colif]

I know you want an answer but opening multiple questions is just a way to get conflicting answers. Better to let John figure it out for you

this might be part of it too: http://www.tomshardware.com/answers/id-3646373/cpu-contact-pins-bend.html