SOLVED BSOD Every 30 Minutes or so / Reference by Pointer /

[GritBuilder]

Hi all, I've been getting BSOD errors with "Reference by Pointer" as the stop code. I downloaded WinDbg and BlueScreenView and to gain some insight, but I am still lost on what the issue is. WinDbg hints that the issue may be related to ntkrnlmp.exe and while BlueScreenView hints that the issue may be ntoskrnl.exe. I believe both .exe files are general and I wasn't able to pin-point what the issue was. I'd appreciate it if anyone can help!

Here's a link to Google Drive with the minidump files:

BSOD Minidump - Google Drive

drive.google.com

 

[ubuysa]

The stack trace in the dumps shows that some sort of PnP operation is in place at the time of the bug check and this stop code is almost always a driver. I would unplug all USB attached devices and see whether the problem stops. If it does then plugging them back in one at a time should reveal the problem device. Once you've identified the device check for an updated driver.

 

[GritBuilder]

The stack trace in the dumps shows that some sort of PnP operation is in place at the time of the bug check and this stop code is almost always a driver. I would unplug all USB attached devices and see whether the problem stops. If it does then plugging them back in one at a time should reveal the problem device. Once you've identified the device check for an updated driver.

Thanks for the tip! I'm out of town now, but I'll try your suggestion when I get back.

 

[GritBuilder]

The stack trace in the dumps shows that some sort of PnP operation is in place at the time of the bug check and this stop code is almost always a driver. I would unplug all USB attached devices and see whether the problem stops. If it does then plugging them back in one at a time should reveal the problem device. Once you've identified the device check for an updated driver.

hi ubuysa, I checked the attached USB devices and I only had a keyboard, mouse, and scanner connected. I updated the drivers for the scanner and I thought the problem was resolved, but I received another BSOD. I uploaded the new minidump file (122621-73062-01) to the shared google drive folder. Here's a link to it again: https://drive.google.com/drive/folders/13Y47eUVp3R5SMW039omlvxQYxcBFc8ns?usp=sharing

The next thing I'm going to try is to disconnect the scanner and see if any BSOD occur. I will keep you updated, but let me know if you notice anything in the new minidump file. I highly doubt the keyboard or mouse will cause a BSOD, but let me know if you feel I should try swapping those out.

 

[ubuysa]

hi ubuysa, I checked the attached USB devices and I only had a keyboard, mouse, and scanner connected. I updated the drivers for the scanner and I thought the problem was resolved, but I received another BSOD. I uploaded the new minidump file (122621-73062-01) to the shared google drive folder. Here's a link to it again: https://drive.google.com/drive/folders/13Y47eUVp3R5SMW039omlvxQYxcBFc8ns?usp=sharing

The next thing I'm going to try is to disconnect the scanner and see if any BSOD occur. I will keep you updated, but let me know if you notice anything in the new minidump file. I highly doubt the keyboard or mouse will cause a BSOD, but let me know if you feel I should try swapping those out.

The latest minidump is exactly the same as the others. It would be useful to see your System and Application logs, there may well be clues in there. If you're not sure how to do that here's how...

1. Enter the command eventvwr in the Run command box to open the event viewer.
2. If the left-hand pane expand the Windows Logs folder.
3. Right-click on Application and select Save All Events As...
4. Pick any filename you like (but include Application in there so I know which log is which). An evtx suffix will be added automatically.
5. Now do the same for your System log (include System in the filename).
6. Upload the two files, they may well be small enough to upload directly to here.

 

[GritBuilder]

Thanks for the detailed instructions! I attached both files to my shared google folder:

BSOD Minidump - Google Drive

drive.google.com

Please let me know if you need any more information from me.

This is probably irrelevant information at this point, but I unplugged the scanner and another BSOD occurred.

 

[Trouble]

this stop code is almost always a driver

Agreed, and in keeping with that idea (my two cents), I couldn't help but notice
SmbCo10X64.sys
SRTSP64.SYS
SRTSPX64.SYS
SYMEFASI64.SYS
SYMEVENT64x86.SYS
SymEvnt.sys
symnets.sys

You can google those if you like, but I think you'll find that they are either explicitly or tangentially associated with Symantec (perhaps Norton??) software products.

Now I'm a little bias, in that I have a multi-year history with BSODs and that particular software vendor, going back to XP at least, probably well before, when I used to do a bit of crash dump analysis on a different forum.
AND
While it has certainly been a while and I've not kept abreast of more recent cause versus effect data, I think if I had a mysterious BSOD event, reoccurring with some frequency, as you seem to have....
I think I would start there
Symantec provides a removal tool

Download and run the Norton Remove and Reinstall tool for Windows

Norton Remove and Reinstall tool helps to uninstall and reinstall most Norton products such as Norton Security, Norton 360, and Norton Internet Security on Windows computers.

support.norton.com

AND
There seems to be another perhaps newer product called Symantec Cleanwipe (perhaps you could google that as well).
It certainly sounds tantalizing, but it may or may not be applicable.

As I said
Just my two cents. In any event... Best Wishes.

 

[GritBuilder]

Agreed, and in keeping with that idea (my two cents), I couldn't help but notice
SmbCo10X64.sys
SRTSP64.SYS
SRTSPX64.SYS
SYMEFASI64.SYS
SYMEVENT64x86.SYS
SymEvnt.sys
symnets.sys

You can google those if you like, but I think you'll find that they are either explicitly or tangentially associated with Symantec (perhaps Norton??) software products.

Now I'm a little bias, in that I have a multi-year history with BSODs and that particular software vendor, going back to XP at least, probably well before, when I used to do a bit of crash dump analysis on a different forum.
AND
While it has certainly been a while and I've not kept abreast of more recent cause versus effect data, I think if I had a mysterious BSOD event, reoccurring with some frequency, as you seem to have....
I think I would start there
Symantec provides a removal tool

Download and run the Norton Remove and Reinstall tool for Windows

Norton Remove and Reinstall tool helps to uninstall and reinstall most Norton products such as Norton Security, Norton 360, and Norton Internet Security on Windows computers.

support.norton.com

AND
There seems to be another perhaps newer product called Symantec Cleanwipe (perhaps you could google that as well).
It certainly sounds tantalizing, but it may or may not be applicable.

As I said
Just my two cents. In any event... Best Wishes.

I uninstalled Norton 360 per the Norton website and now I just need to play the waiting game. I'll keep you guys updated!

 

[Trouble]

OK.... at least there should be less to sort through if the BSOD isn't resolved.

You may find it necessary, even after the removal tool to perform a little seek and destroy to confirm that the drivers are gone.
Have a look in
C:\Windows\System32\drivers
IF any remain you may have to drive a stake through their little hearts by renaming the extension from .sys to something like .OLD
Thereby effectively breaking them

 

[GritBuilder]

OK.... at least there should be less to sort through if the BSOD isn't resolved.

You may find it necessary, even after the removal tool to perform a little seek and destroy to confirm that the drivers are gone.
Have a look in
C:\Windows\System32\drivers
IF any remain you may have to drive a stake through their little hearts by renaming the extension from .sys to something like .OLD
Thereby effectively breaking them

I checked the C:\Windows\System32\drivers folder and only found the SmbCo10X64.sys file. Apparently it's a driver for the killer network control drivers, but I am unsure what that means. Should I rename it?

Also, I received another BSOD after I uninstalled Norton 360. Still very confused at what the issue can be.

 

[Trouble]

Should I rename it?

Nope just leave it.

I received another BSOD after I uninstalled Norton 360.

Can you tell if it is the same as the others?

 

[GritBuilder]

Can you tell if it is the same as the others?

The BSOD had the same "REFERENCE BY POINTER" message. I ran a dmp file through both WinDbg and BlueScreenView; everything seems to be the same. The only difference I noticed was that the 122721-51625-01 file was a bigger file size, but I didn't notice any major differences. I uploaded all files in my minidump folder into my shared google folder.

BSOD Minidump - Google Drive

drive.google.com

 

[Trouble]

This is probably irrelevant information at this point, but I unplugged the scanner and another BSOD occurred.

What kind of "scanner" is it?
You seem to have multiple errors associated with USBAppControl as well as WorkFlowAppControl
Both of which, it would seem, are associated with C:\Program Files (x86)\Brother\iPrint&Scan\

You've got some errors in your application log suspiciously around the same time as some critical BugCheck / Kernel Power events in your system log.
Maybe a hint? IDK.
Probably worth looking into.

 

[GritBuilder]

What kind of "scanner" is it?

The scanner I'm currently using is a Epson Perfection V600 Photo. I do not have a scanner from Brother connected to my computer. However, the previous owner of the computer did use that scanner. Should I try uninstalling it from the device manager or will that introduce more issues?

 

[Trouble]

I believe I'd look about in the programs menu and see if Brother might have included an uninstaller.
OR
Check control panel programs and features and look to see if it is present in the list and can be uninstalled from there
OR
Maybe have a look into something like the free version of RevoUninstaller and see if that might do the trick.

I suppose you could boot the whole folder into the recycle bin and reboot the system and see where any moaning and groaning might come from.
It could take a while to tidy up, as there could be any number of scheduled task or other events that may throw up a notification or two before you can get it sorted.

Maybe do a little research reference Brother devices and see if they might have a one size fits all solution / uninstaller / clean-up tool.

Knowing the exact make and model number of the former printer might help a lot. There may even be a member or two about, who may have some specific experience with Brother devices.

 

[GritBuilder]

I believe I'd look about in the programs menu and see if Brother might have included an uninstaller.
OR
Check control panel programs and features and look to see if it is present in the list and can be uninstalled from there
OR
Maybe have a look into something like the free version of RevoUninstaller and see if that might do the trick.

I suppose you could boot the whole folder into the recycle bin and reboot the system and see where any moaning and groaning might come from.
It could take a while to tidy up, as there could be any number of scheduled task or other events that may throw up a notification or two before you can get it sorted.

Maybe do a little research reference Brother devices and see if they might have a one size fits all solution / uninstaller / clean-up tool.

Knowing the exact make and model number of the former printer might help a lot. There may even be a member or two about, who may have some specific experience with Brother devices.

The old scanner that I no longer use is a Brother DS-640. I followed the steps located at this website: https://support.brother.com/g/b/faqend.aspx?c=us&lang=en&prod=ds640_us_eu_as&faqid=faq00000071_011
I did the steps listed in both Case 1 and Case 2. I believe the uninstaller removes both the driver and Brother Utilities software. I also uninstalled the Brother iPrint&Scan application from Windows by using the Add & Remove Apps feature in Windows.

I thought I fixed the issue because I did not receive a BSOD for over an hour, but unfortunately got hit with another BSOD with the "REFERENCE BY POINTER" stop code. The newest dmp file is named 122721-51281-01 and I uploaded it to my Google Drive. I also added the last dmp file before I uninstalled all the Brother driver and software (122721-51203-01).

BSOD Minidump - Google Drive

drive.google.com

I'm thinking I may have to delete leftover registry keys, but I definitely don't feel comfortable doing that because I messed up one of my computers last time and needed to do a clean install of windows. However, I'm starting to think it may be easier to do a clean install of windows, haha.

 

[ubuysa]

The scanner I'm currently using is a Epson Perfection V600 Photo. I do not have a scanner from Brother connected to my computer. However, the previous owner of the computer did use that scanner. Should I try uninstalling it from the device manager or will that introduce more issues?

I'm late back to the party, sorry. That's an excellent catch @Trouble, I neglected to look at the loaded modules in the dump. The Application log does confirm that Norton 360 is (was) installed and running however. IMO almost all third party anti-malware tools are just a faster way to a BSOD. I've come across a huge number of BSODs that were caused by third party anti-malwre products. I too have had a very long experience with Norton (right back from the Peter Norton Tools days) and it all went downhill when Symantec acquired them. Uninstalling Norton 360 was a good move even if it didn't solve your problem.

That reference to Brother rings some bells having looked through your System and Application logs...

There are a number of error messages relating to something called WorkflowAppControl, one of these references a local IP address of 192.168.254.22 and only you will know what device that is. A quick web search suggests that WorkflowAppControl may be associated with the Brother iPrint&Scan feature. Perhaps the old Brother scanner was at address 192.168.254.22??

In your System log, at pretty much the same time as the WorkflowAppControl errors in the Application log (within a few seconds) there is an error for the ServiceControlManager failing to start the LMS service. This is the Intel Local Manageability Service (it's part of the Pro/SET tools I think?) and it helps manage application's access to network services. There is a link here with the WorkflowAppControl errors for device 192.168.254.22 I think?

It's around 5 seconds after these WorkflowAppControl and ServiceControlManager messages that we see the 0x18 bug check (it's reported in the System log).

This would all gell with the PnP functions in the stack trace of all your dumps, it sounds as though there may be a driver for the old Brother scanner lying around and causing problems? You can get a list of all your drivers, and their status (running or stopped etc.) by opening an elevated PowerShell session and entering the command driverquery /fo list /v | out-file -filepath c:\drivers.txt.

That will create a text file in the root of your C: drive called drivers.txt. If you scan through there you should be able to find any Brother drivers still present and whether they are running or not.

 

[GritBuilder]

You can get a list of all your drivers, and their status (running or stopped etc.) by opening an elevated PowerShell session and entering the command driverquery /fo list /v | out-file -filepath c:\drivers.txt.

If I do find any leftover Brother drivers then can I simply delete them from the folder path?

I did more googling and came across this reddit thread:
https://www.reddit.com/r/techsupport/comments/qb3uf8
The symptoms seems similar to mine and the solution was to uninstall Dell SupportAssist. I'm going to give that a try today and keep you guys updated.

Also wanted to say thanks for all the help and insight, @ubuysa and @Trouble! I'm learning a lot through you two.

 

[Trouble]

Saw the same thing yesterday when I did a broad search using

FAILURE_ID_HASH:  {b6b47bfd-ed1b-fc56-3b01-ddc037f9c59f}

as my search string, which seems to be consistent across most if not all of your dump files.
Basically what I found is that many things get blamed from "malware" to the Intel Management Engine to, as you've seen any number of Dell support and analysis utilities.

Something you might use that may help with furthering the diagnosis is a program called Autoruns

Autoruns - Sysinternals

See what programs are configured to startup automatically when your system boots and you login.

docs.microsoft.com

It's not installable, just download it, unzip it and right click Autoruns64.exe and choose run as administrator.
Immediately use the "Options" item from the menu bar and make sure that you are hiding empty items and items associated with Windows and Microsoft, then click the Refresh Icon.

It has a number of tabs across the top.
The Everything tab can be a little daunting but you can scroll through and get a general overview.
For your purposes you might want to focus on the Driver, Print Monitors, Scheduled Tasks and Services tabs
But feel free to examine each individual tab paying attention to the Publisher and Image Path columns to help get a sense of what might be going on.

 

[GritBuilder]

@ubuysa and @Trouble
I uninstalled Dell SupportAssist from the computer using Revo Uninstaller and that seemed to have worked. There were two versions of it and I removed both. It seems to have resolved the BSOD issue for now. Thanks again for all the help!