Solved BSOD: How does one run the V2 Log Collector on the BSOD PC?

JeffFinnan · Nov 16, 2024

Code:

DDI compliance checking.
Driver G 2aabba
    mrcbt.sys

No BSOD

verifierQueryDriver-G2aabba.txt

drive.google.com

Must be lmoufilt.sys. One more WDV.

zbook · Nov 16, 2024

Nice work.
lmoufilt.sys is a Logitech driver.
lmoufilt Logicool SetPoint KMDF Mouse Filter Driver c:\windows\system32\drivers\lmoufilt.sys

Please test all drivers except lmoufilt.sys

zbook · Nov 16, 2024

Sorry you had tested the above driver and it did not cause a bsod.

(see post #140)

So the misbehaving driver is another group

These had passed testing:
lhidfilt.sys
lmoufilt.sys

zbook · Nov 16, 2024

Please test this group:

Code:

    mrigflt.sys
    mrcbt.sys
    nvlddmkm.sys
    rt25cx21x64.sys
    iccwdt.sys
    nvvad64v.sys
    nvmoduletracker.sys
    nvvhci.sys
    nvhda64v.sys
    leqdusb.sy
    rtka2dp.sys 
    ignisv2.sys

JeffFinnan · Nov 16, 2024

zbook said:
Sorry you had tested the above driver and it did not cause a bsod.

So the misbehaving driver is another group

These had passed testing:
lhidfilt.sys
lmoufilt.sys

I screwed up. I said the wrong thing here. Even though I checked mrigflt.sys immediately next.

JeffFinnan said:
Must be lmoufilt.sys. One more WDV.

This was the last to be checked

Code:

DDI compliance checking.
Driver G 2aabbb
    mrigflt.sys

This is the winner. Immediate BSOD
V2: DGrp2aabbb_MAIN-COMPUTER-(2024-11-16_20-33-49).zip

I will check al the others except this.

zbook · Nov 16, 2024

Please test all drivers except:

mrigflt.sys

JeffFinnan · Nov 16, 2024

zbook said:
Please test all drivers except:

mrigflt.sys

No BSOD at least with DDI compliance checking.

verifierQuerySettingsNo- mrigflt.txt

drive.google.com

zbook · Nov 16, 2024

Please temporarily uninstall Macrium software.

Restart WDV with all customized tests except:

[ ] 0x00000004 Randomized low resources simulation.
[ ] 0x02000000 Code integrity checks.

Test all drivers.

Code:

Macrium Reflect Home Edition                                                                             7.3                           Paramount Software (UK) Ltd.     1/28/2022              
Macrium Reflect Home Edition                                                                             7.3.6391                      Paramount Software (UK) Ltd.     20220128

Code:

mrigflt    mrigflt    c:\windows\system32\drivers\mrigflt.sys

JeffFinnan · Nov 16, 2024

zbook said:
Please temporarily uninstall Macrium software.

Restart WDV with all customized tests except:

[ ] 0x00000004 Randomized low resources simulation.
[ ] 0x02000000 Code integrity checks.

Test all drivers.

Before seeing this I walked away from my computer for a couple of minutes. Low and behold there is a BSOD without doing anything. Will await some guidance before executing the above.

zbook · Nov 16, 2024

Please post a V2 share link for any BSOD.

JeffFinnan · Nov 16, 2024

zbook said:
Please post a V2 share link for any BSOD.

MAIN-COMPUTER-(2024-11-16_21-21-46).zip

drive.google.com

By the way, I had not reset WDV after all drivers except mrigflt.sys . Should I?

zbook · Nov 16, 2024

The BSOD had occurred during WDV testing:

[X] (0x00020000) DDI compliance checking

The misbehaving driver was

obdrvmonpcrsrv ObDrvMonPCRSrv \??\c:\program files (x86)\outbyte\pc repair\drvmonx64.sys

Uninstall:

Code:

Outbyte Driver Updater                                             2.3.3.29920     Outbyte Computing Pty Ltd            20241110 
Outbyte PC Repair                                                  1.7.242.28648   Outbyte Computing Pty Ltd            20241110

Code:

DrvMonX64.sys Mon Jan  4 07:39:34 2021 (5FF31A96)

JeffFinnan · Nov 16, 2024

zbook said:

Done

zbook · Nov 16, 2024

Please continue with post #148.

JeffFinnan · Nov 16, 2024

zbook said:
Please continue with post #148.

Immediate BSOD
V2: MAIN-COMPUTER-(2024-11-16_22-00-27).zip

zbook · Nov 16, 2024

Please restart WDV with all customized tests except:

Code:

    [ ] 0x00000004 Randomized low resources simulation.
    [ ] 0x00000200 Force pending I/O requests.
    [ ] 0x02000000 Code integrity checks.

JeffFinnan · Nov 16, 2024

zbook said:
Please restart WDV with all customized tests except:

Code:

[ ] 0x00000004 Randomized low resources simulation. [ ] 0x00000200 Force pending I/O requests. [ ] 0x02000000 Code integrity checks.

No BSOD. Very slow to restart.

verifierQueryPost156.txt

drive.google.com

zbook · Nov 16, 2024

Please turn off WDV.

Reinstall Macrium.

Nice work.

Perform Windows updates.

Create a new restore point and Macrium backup image.

zbook · Nov 16, 2024

Drop box can also be reinstalled.

Please run the computer for several days.

Then post a new V2 share link.

If there are no major problems seen in the collected files then that will complete the troubleshooting.

These were the latest tests with drivers.

Code:

Verifier Flags: 0x01bfedbb

  Standard Flags:

    [X] 0x00000001 Special pool.
    [X] 0x00000002 Force IRQL checking.
    [X] 0x00000008 Pool tracking.
    [X] 0x00000010 I/O verification.
    [X] 0x00000020 Deadlock detection.
    [X] 0x00000080 DMA checking.
    [X] 0x00000100 Security checks.
    [X] 0x00000800 Miscellaneous checks.
    [X] 0x00020000 DDI compliance checking.

  Additional Flags:

    [ ] 0x00000004 Randomized low resources simulation.
    [ ] 0x00000200 Force pending I/O requests.
    [X] 0x00000400 IRP logging.
    [X] 0x00002000 Invariant MDL checking for stack.
    [X] 0x00004000 Invariant MDL checking for driver.
    [X] 0x00008000 Power framework delay fuzzing.
    [X] 0x00010000 Port/miniport interface checking.
    [X] 0x00040000 Systematic low resources simulation.
    [X] 0x00080000 DDI compliance checking (additional).
    [X] 0x00200000 NDIS/WIFI verification.
    [X] 0x00800000 Kernel synchronization delay fuzzing.
    [X] 0x01000000 VM switch verification.
    [ ] 0x02000000 Code integrity checks.

  Internal Flags:

    [X] 0x00100000 Extended Verifier flags (internal).

    [X] Indicates flag is enabled.

  Boot Mode:

    Persistent

  Rules:

    All rules are using default settings

  Extensions:

    wdm: rules.all
    ndis: rules.default

  Verified Drivers:

    amdkmpfd.sys
    envirtahci.sys
    iastorvd.sys
    secnvme.sys
    vlflt.sys
    hswultpep.sys
    cruwblocker.sys
    secnvmef.sys
    gemma.sys
    atc.sys
    asio3.sys
    nvlddmkm.sys
    ialpss2_i2c_adl.sys
    teedriverw10x64.sys
    flxhcic.sys
    rt25cx21x64.sys
    wdfserial.sys
    vtsio.sys
    iccwdt.sys
    smbich.sys
    ialpss2_gpio2_adl.sys
    nvvad64v.sys
    nvmoduletracker.sys
    nvvhci.sys
    flxhcih.sys
    nvhda64v.sys
    rtkvhd64.sys
    rtkbtfilter.sys
    leqdusb.sys
    vwkeyboarddriver.sys
    wacomrouterfilter.sys
    lhidfilt.sys
    lhideqd.sys
    lmoufilt.sys
    battmondrv.sys
    btwdpan.sys
    amuhubftr.sys
    rtka2dp.sys
    rtkavrcp.sys
    rtkhfp.sys
    dot4.sys
    dot4prt.sys
    genestor.sys
    dump_diskdump.sys
    dump_secnvme.sys
    dump_dumpfve.sys
    trufos.sys
    bdprivmon.sys
    bddci4.sys
    bstkdrv_nxt.sys
    googledrivefs31626.sys
    ignisv2.sys
    speedfan.sys
    semav6msr64.sys
    ndis.sys
    netadaptercx.sys
    mbbcx.sys
    wificx.sys
    wdiwifi.sys

JeffFinnan · Nov 20, 2024

System apparently running well. It has been running continuously many days now with a couple of reboots here and there.
Lots of free time now not have to run WDVs left and right.

Windows Update checks have shown nothing. However, this sneaks in unnoticed under Other updates: Windows Configuration Update (KB5035942) today's date.
----------------------------------------------------------------

Back in Post Post 98

2) Uninstall:

ptimon PTIMon c:\windows\system32\drivers\ptimon.sys

(plan to reinstall after troubleshooting has completed)

I did uninstall this. Never reinstalled. Not sure how. I do not know what it does.
-----------------------------------------------------------

Back in Post Post 99

Download and install:

voidtools

www.voidtools.com www.voidtools.com

I did this. Not sure what it, Everything, does or whether we used it for anything. I found this.

"Everything" is search engine that locates files and folders by filename instantly for Windows.

Unlike Windows search "Everything" initially displays every file and folder on your computer (hence the name "Everything"). You type in a search filter to limit what files and folders are displayed.

-----------------------------------------------------------------------

The bad memory module.

I am thinking that this was bad and Windows managed around it. We only found it because of unrelated driver issues as tried to figure out what the problem or problems were. Is that correct?

On a related note. When I found that I needed a USB driver that was not too big to have it properly boot up, I had to buy a five pack. That was all that was immediately available locally. At the time I was thinking I only needed one. I ended up using every drive for some sort of software.

-----------------------------------------------------------------------

This may may be something I should post as new thread.

I noticed while we were in the all the spelunking. The recent files list disappears on reboot. I have gone through and made sure everything through different routs is properly checked. I really like the recent files. The recent files list shows all just fine. It just gets erased on restart. Pinned items on jump lists remain but the recent files disappear. Interestingly the recent files in an Excel jump list reappear if I open an existing Excel file.

Solved BSOD: How does one run the V2 Log Collector on the BSOD PC?

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Similar threads