Windows 10 1803 Pro Surface Book Gen1 bluescreen


#1

Hi there,

I’m using Glaswire Elite & I’m getting bluescreens every 2-3 days.
I’ve analyzed the last minidump & the following results are shown:

Crash Dump Analysis provided by OSR Open Systems Resources, Inc.
Online Crash Dump Analysis Service

Windows 8 Kernel Version 17134 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 17134.1.amd64fre.rs4_release.180410-1804
Machine Name:
Kernel base = 0xfffff80093696000 PsLoadedModuleList = 0xfffff80093a44170
Debug session time: Tue Sep 4 18:00:44.660 2018 (UTC - 4:00)
System Uptime: 1 days 7:42:46.500


  •                                                                         *
    
  •                    Bugcheck Analysis                                    *
    
  •                                                                         *
    

DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending
component can usually be identified with a stack trace.
Arg2: 0000000000000501, The DPC time count (in ticks).
Arg3: 0000000000000500, The DPC time allotment (in ticks).
Arg4: fffff80093ae3378

Debugging Details:

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: 0x133

PROCESS_NAME: Veeam.EndPoint

CURRENT_IRQL: d

LAST_CONTROL_TRANSFER: from fffff8009386ce35 to fffff8009383eca0

STACK_TEXT:
fffff80095c6cbc8 fffff8009386ce35 : 0000000000000133 0000000000000000 0000000000000501 0000000000000500 : nt!KeBugCheckEx
fffff80095c6cbd0 fffff800936e7f5a : 00012393de94ded9 fffff80093568180 0000000000000282 0000000000000000 : nt!KeAccumulateTicks+0x182595
fffff80095c6cc30 fffff8009360d51b : 00012393de93f04b 0000000000005001 0000000000000000 fffff8009366cbb0 : nt!KeClockInterruptNotify+0x9da
fffff80095c6cf40 fffff8009377ac75 : fffff8009366cbb0 fffff80095c62920 0000000000000000 0000000000000000 : hal!HalpTimerClockIpiRoutine+0x1b
fffff80095c6cf70 fffff8009384055a : fffff80095c62430 fffff8009366cbb0 fffff80095c62860 0000000000000000 : nt!KiCallInterruptServiceRoutine+0xa5
fffff80095c6cfb0 fffff80093840a47 : 0000000000000000 fffff80093840a54 0000000000000000 00001f8000000200 : nt!KiInterruptSubDispatchNoLockNoEtw+0xea
fffff80095c623b0 fffff800938472e0 : fffff800936f4259 fffff80095c625c9 0000000000000000 ffff6f878c6efc46 : nt!KiInterruptDispatchNoLockNoEtw+0x37
fffff80095c62548 fffff800936f4259 : fffff80095c625c9 0000000000000000 ffff6f878c6efc46 fffff80095c62900 : nt!guard_dispatch_icall
fffff80095c62550 fffff800936f4662 : fffff80095c62920 ffff974ba06358c0 ffff6f8700000001 fffff80000000000 : nt!MiWalkPageTablesRecursively+0x299
fffff80095c62630 fffff800936f4662 : fffff80095c62920 ffff974ba5d031a8 0000000000000002 0000000000000000 : nt!MiWalkPageTablesRecursively+0x6a2
fffff80095c62710 fffff800936f2367 : fffff80095c62920 ffff974ba5d2e818 0000000000000003 0000000000000000 : nt!MiWalkPageTablesRecursively+0x6a2
fffff80095c627f0 fffff80093727b24 : fffff80095c62920 fffff80000000001 0000000000000000 0000000000000000 : nt!MiWalkPageTables+0x1e7
fffff80095c628e0 fffff8009372734d : ffff94800000aff8 00000006a06395c8 00000000003d9cf3 00000000004d9cf3 : nt!MiDeleteSystemPageTables+0xac
fffff80095c62a20 fffff8009389823f : 0000000000100000 0000000000100000 0000000000000000 fffff80093768571 : nt!MiReturnSystemVa+0x105
fffff80095c62b40 fffff8009376833b : 0000000000000000 0000000000000001 0000000000000001 0000000000000000 : nt!MiExpandNonPagedPool+0xe3e5b
fffff80095c62c20 fffff800937978d6 : 0000000000100000 0000000000000000 0000000000000000 0000000000000000 : nt!MiFindNonPagedPoolVa+0x10b
fffff80095c62cb0 fffff800937977ef : fffff80093a7aa40 0000000000000003 0000000000000000 0000000000000000 : nt!MiAllocatePoolPages+0xda
fffff80095c62d10 fffff800938853cb : 0000000000000000 fffff80095c62df1 0000000100000000 0000000000100000 : nt!ExAllocateHeapPages+0x27
fffff80095c62d50 fffff80093980937 : 0000000000000000 0000000044435747 0000000000000000 0000000044435747 : nt!ExpAllocateBigPool+0x11e5bb
fffff80095c62e50 fffff806ee6f424e : ffff818d3b656290 ffff818d3b685f20 ffff818d44435747 ffff818d395fff10 : nt!ExAllocatePoolWithTag+0x927
fffff80095c62f40 ffff818d3b656290 : ffff818d3b685f20 ffff818d44435747 ffff818d395fff10 0000000000000000 : gwdrv+0x424e
fffff80095c62f48 ffff818d3b685f20 : ffff818d44435747 ffff818d395fff10 0000000000000000 fffff806ee6f25b7 : 0xffff818d3b656290 fffff80095c62f50 ffff818d44435747 : ffff818d395fff10 0000000000000000 fffff806ee6f25b7 ffff818d3b656290 : 0xffff818d3b685f20
fffff80095c62f58 ffff818d395fff10 : 0000000000000000 fffff806ee6f25b7 ffff818d3b656290 ffff818d545e2290 : 0xffff818d44435747 fffff80095c62f60 0000000000000000 : fffff806ee6f25b7 ffff818d3b656290 ffff818d545e2290 ffff818d44435747 : 0xffff818d395fff10

STACK_COMMAND: kb

FOLLOWUP_IP:
gwdrv+424e
fffff806`ee6f424e ?? ???

SYMBOL_STACK_INDEX: 14

SYMBOL_NAME: gwdrv+424e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: gwdrv

IMAGE_NAME: gwdrv.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 5567e7ec

FAILURE_BUCKET_ID: X64_0x133_gwdrv+424e

BUCKET_ID: X64_0x133_gwdrv+424e

Followup: MachineOwner


#2

Lately when I have seen reports like this it has almost always been a GlassWire database corruption. Let’s see if this is the problem in your case.

First backup your database if you want: https://www.glasswire.com/userguide/#Backup_Settings

Next uninstall GlassWire in add/remove programs. Please don’t use a third party uninstaller or it will not work.

Please reboot! It’s important to reboot, or the fix will fail.

Now download our latest software and install it using the “clean install” option.

Please let me know if it solves the issue. If it does not please send us the .dmp file on your desktop using a cloud service like Dropbox, etc… https://www.glasswire.com/contact/


#3

Thanks your for response!

I’ve uninstalled everything through apps/features, rebooted the machine & did a install with checked clean install option. I’ve have to wait for some days of usage because the event occured only every 2-3 days. I’ll definitively give an update on this thread.

Regards
Stephan


#4

Hi there, the problem seems still to be there.
Last night another crashdump was created.

I will provide you the mini dump file.