Repeated blue screen, sysdata.xml WERInternalMetadata.xml

Question

I have been getting the blue screen very often over the past week. 

I have attached a zip of the DMP files from minidumps here: 

https://onedrive.live.com/redir?resid=780DC375ACBE3DD1!108&authkey=!ADJL1uHrjcC46As&ithint=file%2czip

and MSinfo32 file here:

https://onedrive.live.com/redir?resid=780DC375ACBE3DD1!109&authkey=!AMDgM7DRtlMStCQ&ithint=file%2cnfo

System specs: 

Manufacturer: Toshiba

Model: Portege R835

Processor: Intel Corei5-2435M CPU@ 2.40 GHz

RAM: 4GB

64 bit OS

^^^This is information that I saw people ask for in related posts, if more is needed please ask.

Thanks in advance for any help.

Answer 1

When did you install Personal Banking Professional Edition Latest Version: 7.0.6?

http://www.cmbchina.com/cmbpb/v36/pb.htm

I'm not sure when that was installed, my dad used to use this computer and it looks like something he would have installed while he was using it.

I believe Malwarebytes was upgraded to the Pro version previously on this computer.

The System Information file I attached was obtained in Safe mode with networking.

Here is the report I got from DriverView: 

https://onedrive.live.com/redir?resid=780DC375ACBE3DD1!115&authkey=!ACnj2qSH-RBvdYY&ithint=file%2ctxt

System log: 

https://onedrive.live.com/redir?resid=780DC375ACBE3DD1!111&authkey=!AHY2YGWi4FT9nGE&ithint=file%2cevtx

And Application log:

https://onedrive.live.com/redir?resid=780DC375ACBE3DD1!113&authkey=!ACYdzAWy9nG7vbs&ithint=file%2cevtx

Answer 2

Two things of note. As you can see below, it seems that Microsoft Security Essentials did not uninstall completely, leaving MpFilter.sys, behind to cause issues.

Please refer to the link below, for instructions about effectively uninstalling MSE.

How to manually uninstall Microsoft Security Essentials 2.0.1963 if you cannot uninstall it by using the Add or Remove Programs item.

https://support.microsoft.com/en-us/kb/2483120

Secondly, DgiVecp.sys, may not be compatible with your OS. Download "autoruns" and use it to locate and disable the driver, after making certain that all Microsoft entries have been hidden, to eliminate the possibility of a mistake.(instructions in the youtube video link below.)

Note: You can follow the same methods to delete, DgiVecp.sys, if you encounter no adverse effects from disabling the driver.

Autoruns for Windows

v13.01

https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

How to use Autoruns.

https://www.youtube.com/watch?v=HhtSDsQYi28

Unloaded modules:

fffff88007fbc000 fffff88007fce000   mwac.sys

    Timestamp: unavailable (00000000)

    Checksum:  00000000

    ImageSize:  00012000

fffff88007fce000 fffff88007ff4000   MBAMSwissArm

    Timestamp: unavailable (00000000)

    Checksum:  00000000

    ImageSize:  00026000

fffff88007f8c000 fffff88007fb2000   MBAMSwissArm

    Timestamp: unavailable (00000000)

    Checksum:  00000000

    ImageSize:  00026000

fffff88005837000 fffff88005841000   mbam.sys

    Timestamp: unavailable (00000000)

    Checksum:  00000000

    ImageSize:  0000A000

fffff88007f09000 fffff88007f1b000   mwac.sys

    Timestamp: unavailable (00000000)

    Checksum:  00000000

    ImageSize:  00012000

fffff88002fb0000 fffff88002fe1000   MpFilter.sys<=== MSE

    Timestamp: unavailable (00000000)

    Checksum:  00000000

    ImageSize:  00031000

fffff88007ef1000 fffff88007f09000   NisDrvWFP.sy

    Timestamp: unavailable (00000000)

    Checksum:  00000000

    ImageSize:  00018000

fffff88007f1b000 fffff88007f8c000   spsys.sys

    Timestamp: unavailable (00000000)

    Checksum:  00000000

    ImageSize:  00071000

fffff8800587a000 fffff8800588a000   DgiVecp.sys

    Timestamp: unavailable (00000000)

    Checksum:  00000000

Note: I have no information in these dumps, or have I ever come across any instance where CMBProtector.dat was conflicting with anything, but I suggest that you follow the same methods above to disable it, and stop it from loading if you are inclined to do so.

Below, is more information about CMBProtector.dat, and it's related driver, CertClient.dat

http://www.sysnative.com/forums/bsod-processing-apps-download-information-discussions/3808-non-drivers-listed-98-a.html

Answer 3

When did you install Personal Banking Professional Edition Latest Version: 7.0.6?

http://www.cmbchina.com/cmbpb/v36/pb.htm

The security protection with this software has the potential to conflict with Microsoft Security Essentials and / or Malwarebytes. Did your latest blue screen problems start about the time you installed your Personal Banking software?

You have Malwarebytes. Is this software the Pro or Free version? The Pro version will conflict with Microsoft Security Essentials. I have not encountered your Personal Banking software previously but it would be no surprise to learn that Malwarebytes Pro conflicts with the Personal Banking software.

Was the copy of your System Information file obtained in safe mode or normal mode?

You appear to be missing some windows Updates.

Please download and run Driver View and upload a copy of the report it produces to your OneDrive. To get a report on all drivers select Edit, Select All followed by File, Save Selected Items.

http://www.nirsoft.net/utils/driverview.html

Please upload and share with everyone copies of your System and Application logs from your Event Viewer to your OneDrive and post a link here.

To access the System log select Start, Control Panel, Administrative Tools, Event Viewer, from the list in the left side of the window expand Windows Logs and select System. Place the cursor on System, select Action from the Menu and Save All Events as (the default evtx file type) and give the file a name. Do the same for the Applications log. Do not provide filtered files. Do not place the cursor in the list of reports before selecting Action from the menu. Do not clear logs whilst you have a continuing problem.

Answer 4

MBAM is likely conflicting with Microsoft Security Essentials. Remove either MSE or MBAM, then uninstall and reinstall the other.

Hi, I tried this and my computer stayed up for a bit longer than usual, but then got the blue screen again.

I've updated the zip file with the new DMP files here: 

https://onedrive.live.com/redir?resid=780DC375ACBE3DD1!108&authkey=!ADJL1uHrjcC46As&ithint=file%2czip

Thanks again for the help.

Answer 5

Unable to load image ??\C:\windows\system32\drivers**\mwac.sys**, Win32 error 0n2

*** WARNING: Unable to verify timestamp for mwac.sys

*** ERROR: Module load completed but symbols could not be loaded for mwac.sys

Probably caused by : fwpkclnt.sys ( fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+20a )

MBAM is likely conflicting with Microsoft Security Essentials. Remove either MSE or MBAM, then uninstall and reinstall the other.