Windows 10 BSOD When Extending USB Drive Volume: Possible Macrium Reflect Issue?

[Calby]

Hi,
I don't think this is a HW issue, reather a software issue I guess but I still want to ask you guys to make sure.

I did connect my USB 3 drive to my laptop, then I did go to Computer Manager -> Disk Managment to first delete a partition and then extend the volume to have all of the disk space in one partition.
When I did press extend volume I did get a BSOD.

Here is the dump file: (minidump)
040317-7421-01.dmp

When I did look at WhoCrashed it was talking about "mrcbt.sys" and that are connected to my backup software Macrium Reflect.
And according to that file, mrcbt.sys search trough volumes etc for changes, so the timinig is correct as I was "labbing" with volume and partitions and maybe Macrium can't handle it.
Or am I wrong?

Is that correct? I just want to make sure so it's nothing else that's wrong.
I'm not a pro on reading the dump files.

I have tried to uninstall Macrium Reflect, how can I look if windows are loading mrcbt.sys or not?

 

[Neemobeer]

WhoCrashed works pretty well, I can't grab the dump from onedrive since it's blocked where I'm at currently. Kemical can look at it when he's on or I can when I get home, or upload the dump here.

 

[Calby]

WhoCrashed works pretty well, I can't grab the dump from onedrive since it's blocked where I'm at currently. Kemical can look at it when he's on or I can when I get home, or upload the dump here.

Your like to the place that I could upload it don't work.

 

[Neemobeer]

Zip the dump file

 

[Calby]

Zip the dump file

O sorry I did miss it, here is the file.

 

[Neemobeer]

So the fault is occurring in the mrcbt.sys driver; however, it could be the driver is the problem and I'd verify it's the most current or the memory the driver is trying to reference is corrupt, so you may need to run memtest86+ for about 10 passes and verify you don't have a bad memory stick.

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffff8088babe113c, memory referenced.
Arg2: 0000000000000002, value 0 = read operation, 1 = write operation.
Arg3: fffff80438a05e2c, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)

 

[Calby]

So the fault is occurring in the mrcbt.sys driver; however, it could be the driver is the problem and I'd verify it's the most current or the memory the driver is trying to reference is corrupt, so you may need to run memtest86+ for about 10 passes and verify you don't have a bad memory stick.

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffff8088babe113c, memory referenced.
Arg2: 0000000000000002, value 0 = read operation, 1 = write operation.
Arg3: fffff80438a05e2c, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)

Okej, but I have been running memtest86 for like 2 days ago and it did not show any errors but I'll try it again.
I have 20GB of ram so it will take some time to run it.

So you think that it's my RAM that are the issue?

I got 4GB integrated in the motherboard and 16gb on a stick.
So how should I do, run both over the night or should I disconnect the 16GB stick and then run the memtest86 on just the 4GB and after that plug in the 16gb and run it again?

I did have a other BSOD for some time ago but it was not related to this I think:
BugCheck 9F / DRIVER_POWER_STATE_FAILURE /

 

[Neemobeer]

It could be bad memory or the driver is improperly accessing memory.

 

[Calby]

It could be bad memory or the driver is improperly accessing memory.

Ok, I have booted it to run memtest86 now for the night (it's 18:00 here in Sweden)

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffff8088babe113c, 2, fffff80438a05e2c, 2}

*** WARNING: Unable to verify timestamp for mrcbt.sys
*** ERROR: Module load completed but symbols could not be loaded for mrcbt.sys

Could not read faulting driver name
Probably caused by : mrcbt.sys ( mrcbt+5e2c )

Followup:     MachineOwner

PRIMARY_PROBLEM_CLASS:  AV_INVALID_mrcbt!unknown_function

Hi,
did you try and update the above driver? It's mentioned a few times in the dump file and as you know relates to Macrium Reflect. This page may help in removing it:
Link Removed
As the dump file couldn't read the actual faulting driver you may have to at some point run the driver verifier and see if anything pops up. mrcbt.sys might be crashing due to the unknown faulty driver but if it is we'll find it eventually.

Although Bugcheck 50 can look like it's a RAM issue many things can cause bugcheck 50 from hardware errors (usually RAM), faulty driver code, AV suites, faulty system service and a corrupt NTFS Partition.
As the above driver appears in the dump file quite a few times then chances are it's culprit but please finish your testing first as Neemobeer say's it could easily be faulty RAM.

 

[Calby]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffff8088babe113c, 2, fffff80438a05e2c, 2}

*** WARNING: Unable to verify timestamp for mrcbt.sys
*** ERROR: Module load completed but symbols could not be loaded for mrcbt.sys

Could not read faulting driver name
Probably caused by : mrcbt.sys ( mrcbt+5e2c )

Followup:     MachineOwner

PRIMARY_PROBLEM_CLASS:  AV_INVALID_mrcbt!unknown_function

Hi,
did you try and update the above driver? It's mentioned a few times in the dump file and as you know relates to Macrium Reflect. This page may help in removing it:
Link Removed
As the dump file couldn't read the actual faulting driver you may have to at some point run the driver verifier and see if anything pops up. mrcbt.sys might be crashing due to the unknown faulty driver but if it is we'll find it eventually.

Although Bugcheck 50 can look like it's a RAM issue many things can cause bugcheck 50 from hardware errors (usually RAM), faulty driver code, AV suites, faulty system service and a corrupt NTFS Partition.
As the above driver appears in the dump file quite a few times then chances are it's culprit but please finish your testing first as Neemobeer say's it could easily be faulty RAM.

Well I'm running the memtest now, but I don't think it's ram as I did test it before also.

I have uninstalled Macrurium reflect for now.

So bugcheck 50 is hardware issue?
How do I use driver verify?

 

[kemical]

So bugcheck 50 is hardware issue?

It can indicate one yes but I don't think you need to panic it could have just as easily been set off by your AV Kaspersky.

Ok so after uninstalling Macrium Reflect have you had any further bsod's? If you have then please post the dump files .

To use the driver verifier you first need to create a Recovery USB:
Link Removed

Sometimes the verifier can cause bsod loops. If this happens you use the recovery key to boot into safe mode and turn the verifier off. Hopefully any resulting dump files will have culprits name on them.
Link Removed

 

[Calby]

It can indicate one yes but I don't think you need to panic it could have just as easily been set off by your AV Kaspersky.

Ok so after uninstalling Macrium Reflect have you had any further bsod's? If you have then please post the dump files .

To use the driver verifier you first need to create a Recovery USB:
Link Removed

Sometimes the verifier can cause bsod loops. If this happens you use the recovery key to boot into safe mode and turn the verifier off. Hopefully any resulting dump files will have culprits name on them.
Link Removed

No, I did try to reproduce the issue but I could not do that after I did uninstall Reflect.
But I did not try to reproduce the issue when I did have reflect installed either so I don't know if the BSOD was one thing only or not.
But as you do know from my other thread I did have a bsod for a little time ago but it was regarding something else.

Kaspersky have never causing any BSOD for me before.

I'm currently running the memtest86 after that I'll try to run the driver verify.

Is driver verify like memtest86 and runs trough the drivers and then tells you if something is wrong?

Edit:
I did read that I need to run driver verify for 24h can I use the computer when driver verify is running?

 

[kemical]

I'm currently running the memtest86 after that I'll try to run the driver verify.

To be honest if you haven't had a bsod since removing Macrium Reflect then I wouldn't bother. See how you go and if the bsod does return you know what options lay before you.

I did read that I need to run driver verify for 24h can I use the computer when driver verify is running?

The verifier only works on start up so yes you should be fine.

Is driver verify like memtest86 and runs trough the drivers and then tells you if something is wrong?

No. If the verifier produces a bsod then thats great because hopefully the culprit is on there.

 

[Calby]

To be honest if you haven't had a bsod since removing Macrium Reflect then I wouldn't bother. See how you go and if the bsod does return you know what options lay before you.


The verifier only works on start up so yes you should be fine.


No. If the verifier produces a bsod then thats great because hopefully the culprit is on there.

Ok,
It's my secound bsod for a short time now on a brand new system.
Aldo it was indicating on two different things so I guess that I can't trough it on the system yet.

Edit:
I'm confused how Driver verify are working?
I have understand that I'll run it and reboot, but are the Driver verify running in the background and working it's way trough the drivers or is it just seeing the drivers that I'm currently using?

 

[kemical]

I would wait and see if you have a further bsod, also try running these scans:

File scans
Right click on the Start menu icon and from the revealed list choose 'admin command prompt'. Type:
sfc /scannow
press enter and await results

In the same command prompt and after the above scan has finished type:
dism /online /cleanup-image /restorehealth
Press enter and await results (longer this time).

If the first scan found files it could not repair but the second scan is successful, run the first scan again using the same command prompt box and this time it should repair the files found.

 

[Calby]

I would wait and see if you have a further bsod, also try running these scans:

File scans
Right click on the Start menu icon and from the revealed list choose 'admin command prompt'. Type:
sfc /scannow
press enter and await results

In the same command prompt and after the above scan has finished type:
dism /online /cleanup-image /restorehealth
Press enter and await results (longer this time).

If the first scan found files it could not repair but the second scan is successful, run the first scan again using the same command prompt box and this time it should repair the files found.

Ok I'll try that.

I did take a look at Event viewer and I did find this; this error was created 15:44 and the BSOD was around 15:49 - I was thinking, correct me if I'm wrong, but I was working witht the file system at that disk in the disk management with the external harddrive that did had issues according to event viewer that could make a part in the BSOD or?

A corruption was discovered in the file system structure on volume E:.

The exact nature of the corruption is unknown. The file system structures need to be scanned and fixed offline.

Volume E: (\Device\HarddiskVolume6) needs to be taken offline to perform a Full Chkdsk. Please run "CHKDSK /F" locally via the command line, or run "REPAIR-VOLUME <drive:>" locally or remotely via PowerShell.

I also do have this in the event viewer and I can't understand what it is, but this ones are not in the same time window as the BSOD, but as far as I can tell this Warnings has poped up many times in the event viewer:

The driver \Driver\WUDFRd failed to load for the device USB\VID_138A&PID_0097\ba8a84ed5416.

The driver \Driver\WUDFRd failed to load for the device BTHLEDevice\{00001812-0000-1000-8000-00805f9b34fb}_Dev_VID&02046d_PID&b018_REV&0009_fa1429319bba\8&619c779&0&001f.

 

[kemical]

And this is brand new laptop? I'd hand it back and ask for something that works

Volume E: (\Device\HarddiskVolume6) needs to be taken offline to perform a Full Chkdsk. Please run "CHKDSK /F" locally via the command line, or run "REPAIR-VOLUME <drive:>" locally or remotely via PowerShell.

Run a chkdsk on your E drive. This guide will help: Link Removed Use the command prompt method about halfway down.

 

[Calby]

And this is brand new laptop? I'd hand it back and ask for something that works

Well, I'm outside my remorse period so I can't sadly, but do you really think it's something wrong with it?
Can it just bee the RAM or something like that?
I did replace the original one in the computer to a 16GB that should work with it, I have never been running the computer on the original stick as it's only 4GB and the intergreated is 4GB totally 8GB of ram.

I have done sfc and dism /online /cleanup-image /restorehealth now and it did not show any errors.

 

[kemical]

but do you really think it's something wrong with it?

Well as you haven't had a blue screen since removing the driver then it looks promising. So no I don't think there's anything seriously wrong. Also the Event viewer can lead you into thinking that something is really wrong.
Unless your having issues then stay out of the Event Viewer as it tends to confuse.