BSOD, Shortly after every login

ToxicCookie said:

Been having problems with the computer ever since getting on it today, and for most part been unable to use it. When I first got home and got on, I kept losing internet, even though another computer in the house still had internet. Tried to restart to resolve it, and since then I've had BSODs after every start up. It only happens after logging in, and as long as I'm not in Safe Mode. If not, it will just take a little while, around 2 minutes or less.
However, if I turn on the computer and wait a while before logging in, I get the BSOD instantly.
Along with the BSOD is the error message; Page fault in nonpaged area

Been trying to find a way to open the .dmp files, but haven't found a way to do it while in Safe Mode. Attached a zip with 5 dump files I've got.

Also, have been doing the standard stuff;
Turning power switch off and let it rest for a while and changing settings in BIOS back to standard just in case. Used a basic registry search with CCleaner without results also. (Can't install in Safe Mode, so unable to get other programs to search with). (Will try to use fail safe settings in bios, brb)

OS: Windows 7 Ultimate SP1 x64 with Norwegian language
The computer is self built and old, so no original OS on it. During the years since 2006, have had Windows XP, Windows Vista Home Premium x64 and my current. Have reinstalled all OSes multiple times, but the current build probably dates back to early 2010.

Hardware; All internal hardware is from 2006, except several items replaced summer 2008.
2006;
Samsung SpinPoint T133S 400GB SATA2
Creative SB Audigy 4
Chieftec Strømforsyning ATX 400W, 120mm

2008;
MSI P35 NEO-F, P35, Socket-775, DDR2
Corsair TWIN2X 6400C4 DDR2, 2048MB CL4
Intel Core 2 Quad Q6600 2.4GHz
HIS Radeon HD 2600 XT 512MB GDDR3

Tried following the BSOD - Posting Instructions thread, but was unable to run the System Health Report. When writing "perfmon /report" in the Start field, I could see the shortcut and launch it, but got an error message. It's written in Norwegian, but it more or less says that the system can't find the chosen path.

Thanks for helping.

These are related to SDMonSvc.exe (sybot search and destroy) I would remove it to test.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Dump Files\060111-53875-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`02c5c000 PsLoadedModuleList = 0xfffff800`02ea1e90
Debug session time: Wed Jun  1 12:16:51.148 2011 (GMT-4)
System Uptime: 0 days 0:02:51.992
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8a004a00000, 0, fffff80002cd3122, 2}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+448c6 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a004a00000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002cd3122, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f0d0e8
 fffff8a004a00000 

FAULTING_IP: 
nt!memcpy+132
fffff800`02cd3122 4c8b4c0a10      mov     r9,qword ptr [rdx+rcx+10h]

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  SDMonSvc.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88008ad9730 -- (.trap 0xfffff88008ad9730)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=00000000069e6018
rdx=fffff89ffe019fd4 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cd3122 rsp=fffff88008ad98c8 rbp=fffff88008ad9ca0
 r8=000000000e696ada  r9=0030003100420030 r10=00000000007d0039
r11=0000000003760058 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!memcpy+0x132:
fffff800`02cd3122 4c8b4c0a10      mov     r9,qword ptr [rdx+rcx+10h] ds:fffff8a0`049ffffc=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c86ca0 to fffff80002cdc640

STACK_TEXT:  
fffff880`08ad95c8 fffff800`02c86ca0 : 00000000`00000050 fffff8a0`04a00000 00000000`00000000 fffff880`08ad9730 : nt!KeBugCheckEx
fffff880`08ad95d0 fffff800`02cda76e : 00000000`00000000 fffff8a0`04a00000 00000000`1191ba00 fffff8a0`0177a02c : nt! ?? ::FNODOBFM::`string'+0x448c6
fffff880`08ad9730 fffff800`02cd3122 : fffff800`02fa887c 00000000`00aed860 00000000`00000000 fffff880`08ad99b8 : nt!KiPageFault+0x16e
fffff880`08ad98c8 fffff800`02fa887c : 00000000`00aed860 00000000`00000000 fffff880`08ad99b8 fffff8a0`010bf864 : nt!memcpy+0x132
fffff880`08ad98d0 fffff800`02fbc3f1 : 00000000`00000000 00000000`00000000 fffff8a0`ffffffff fffff800`03082100 : nt!CmpQueryKeyValueData+0x3b3
fffff880`08ad9960 fffff800`02fbc9b7 : fffffa80`00000000 fffff880`00000004 fffffa80`00000001 00000000`03760020 : nt!CmEnumerateValueKey+0x211
fffff880`08ad9a50 fffff800`02cdb8d3 : ffffffff`ffffffff 35b00000`00000004 00000000`00000001 00000000`03760020 : nt!NtEnumerateValueKey+0x256
fffff880`08ad9bb0 00000000`77b0144a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0229e7e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b0144a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+448c6
fffff800`02c86ca0 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+448c6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7951a

FAILURE_BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+448c6

BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+448c6

Followup: MachineOwner
---------

Uninstalled Spybot - Search & Destroy 1.6 + 2 with Revo Uninstaller, and that did the trick.
It's a while since I installed it, so can't see why it would start bothering me now, but could be problems with the 2 different installs.

Either way, thank you so much for the help

ToxicCookie said:

Uninstalled Spybot - Search & Destroy 1.6 + 2 with Revo Uninstaller, and that did the trick.
It's a while since I installed it, so can't see why it would start bothering me now, but could be problems with the 2 different installs.

Either way, thank you so much for the help

Sometimes apps conflict well after their install. Perhaps a new install did the trick. Anyway it is my pleasure

Hmm, guess that could be it. Still, no processes were supposed to run at start up from Spybot (At least I hadn't enabled TeaTimer or anything like that), but I guess they've made it do something on start up.
Either way, think I'll rather have my soon-needed reformat before I get Spybot again, just in case

ToxicCookie said:

Hmm, guess that could be it. Still, no processes were supposed to run at start up from Spybot (At least I hadn't enabled TeaTimer or anything like that), but I guess they've made it do something on start up.
Either way, think I'll rather have my soon-needed reformat before I get Spybot again, just in case

Dont blame you. I re-install clean every 4 months.

Huh, now I'm a bit impressed. Wrote reason as to why I uninstalled Spybot yesterday when I did, and have gotten a reply from the Spybot team already.

Sent this;
SDMonSvc.exe is causing BSOD on every login that's not Safe Mode.
Forced to uninstall to fix.

Reply;
Hello,

Thank you very much for providing feedback towards our Spybot 2.0.3 Beta.

We were able to reproduce the problem and will try to fix it.

---
Guess I can get back to Spybot along with the next update