Low Battery BSOD?

Caveat said:

Hello all, I experienced a BSOD this morning. I was running on battery and windows closed down due to low battery, so I'm told. But wondering if something else triggered the BSOD as I am not sure about the above because my relatve was actually using computer under limited user account. Please advise of any problems. Any advice is appreciated.

Hi Caveat :)

Please follow these steps in this order,

Uninsall avast using the avast! Uninstall Utility

Download and instal MSE Anti-Malware, Virus, Spyware Protection | Microsoft Security Essentials

---------------
Post back with any results.

Hello Caveat & Welcome to SevenForums!

As Panais said, uninstall your Avast, which is your antivirus, and get another you have trust to. We'll recommend Microsoft Security Essentials (MSE), you can download it HERE

BSOD Summary

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Frederik\AppData\Local\Temp\Rar$DI00.396\071711-20904-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631
Machine Name:
Kernel base = 0xfffff800`02e5d000 PsLoadedModuleList = 0xfffff800`030a2650
Debug session time: Sun Jul 17 20:29:59.062 2011 (UTC + 2:00)
System Uptime: 3 days 10:31:34.202
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff8800456a45d, 0, 30da27}

Unable to load image \SystemRoot\System32\Drivers\aswSnx.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSnx.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswSnx.SYS
Probably caused by : aswSnx.SYS ( aswSnx+2745d )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8800456a45d, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 000000000030da27, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instruktionen ved 0x%08lx refererede hukommelse ved 0x%08lx. Hukommelsen kunne ikke %s.

FAULTING_IP: 
aswSnx+2745d
fffff880`0456a45d 4c396e18        cmp     qword ptr [rsi+18h],r13

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  000000000030da27

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310c100
 000000000030da27 

ERROR_CODE: (NTSTATUS) 0xc0000005 - Instruktionen ved 0x%08lx refererede hukommelse ved 0x%08lx. Hukommelsen kunne ikke %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  wmpnscfg.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88002801540 -- (.trap 0xfffff88002801540)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000000b rbx=0000000000000000 rcx=fffff880045c9d90
rdx=0000000000000484 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800456a45d rsp=fffff880028016d0 rbp=fffff80003083d08
 r8=0000000000000000  r9=0000000000000000 r10=0000000000501902
r11=000000000000000b r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
aswSnx+0x2745d:
fffff880`0456a45d 4c396e18        cmp     qword ptr [rsi+18h],r13 ds:1000:00000000`00000018=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002f285d8 to fffff80002edcd00

STACK_TEXT:  
fffff880`02800cb8 fffff800`02f285d8 : 00000000`0000001e ffffffff`c0000005 fffff880`0456a45d 00000000`00000000 : nt!KeBugCheckEx
fffff880`02800cc0 fffff800`02edc382 : fffff880`02801498 00000000`00000001 fffff880`02801540 00000000`0030da0f : nt! ?? ::FNODOBFM::`string'+0x4987d
fffff880`02801360 fffff800`02edaefa : 00000000`00000000 00000000`0030da27 ffff0001`a0a10000 00000000`00000001 : nt!KiExceptionDispatch+0xc2
fffff880`02801540 fffff880`0456a45d : 00000000`00002478 00000000`00000001 fffff800`03083d08 00000000`00501902 : nt!KiPageFault+0x23a
fffff880`028016d0 00000000`00002478 : 00000000`00000001 fffff800`03083d08 00000000`00501902 00000000`0000030a : aswSnx+0x2745d
fffff880`028016d8 00000000`00000001 : fffff800`03083d08 00000000`00501902 00000000`0000030a 00000000`00000003 : 0x2478
fffff880`028016e0 fffff800`03083d08 : 00000000`00501902 00000000`0000030a 00000000`00000003 fffff880`028017a0 : 0x1
fffff880`028016e8 00000000`00501902 : 00000000`0000030a 00000000`00000003 fffff880`028017a0 fffff800`02fbf9b6 : nt!PspLoadImageNotifyRoutine+0x8
fffff880`028016f0 00000000`0000030a : 00000000`00000003 fffff880`028017a0 fffff800`02fbf9b6 00000000`00000004 : 0x501902
fffff880`028016f8 00000000`00000003 : fffff880`028017a0 fffff800`02fbf9b6 00000000`00000004 00000000`0030da0f : 0x30a
fffff880`02801700 fffff880`028017a0 : fffff800`02fbf9b6 00000000`00000004 00000000`0030da0f 00000000`00000002 : 0x3
fffff880`02801708 fffff800`02fbf9b6 : 00000000`00000004 00000000`0030da0f 00000000`00000002 fffff800`02ebe13a : 0xfffff880`028017a0
fffff880`02801710 fffff800`031f8eb4 : 00000000`00000000 fffff800`03083d00 00000000`00002478 fffff800`030081de : nt!EtwpTraceKernelEvent+0xa6
fffff880`02801760 fffff800`031f98a8 : fffffa80`09f5ec10 fffff880`028018e0 fffff880`02801900 00000000`00000001 : nt!EtwpTraceLoadImage+0x64
fffff880`02801840 fffff800`031cc779 : 00000000`00000000 fffff880`02801ca0 00000000`00000001 fffffa80`170eb230 : nt!PsCallImageNotifyRoutines+0xdc
fffff880`028018a0 fffff800`031ca5c6 : fffffa80`23017890 fffffa80`23017890 00000000`14050800 00000000`00000000 : nt!DbgkCreateThread+0x151
fffff880`02801a80 fffff800`02ece795 : fffff800`0304fe80 00000000`00000000 fffff800`031ca538 fffffa80`23017890 : nt!PspUserThreadStartup+0x8e
fffff880`02801ae0 fffff800`02ece717 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartUserThread+0x16
fffff880`02801c20 00000000`7764c500 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartUserThreadReturn
00000000`0012f868 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7764c500


STACK_COMMAND:  kb

FOLLOWUP_IP: 
aswSnx+2745d
fffff880`0456a45d 4c396e18        cmp     qword ptr [rsi+18h],r13

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  aswSnx+2745d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: aswSnx

IMAGE_NAME:  aswSnx.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4e11a5d7

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_aswSnx+2745d

BUCKET_ID:  X64_0x1E_c0000005_aswSnx+2745d

Followup: MachineOwner
---------

Quite easy one to analyse, upload any upcoming BSOD .dmp's if any.

Best Regards,
FredeGail

Hello.
panais: I ran Avast scan a bit ago and came up clean. Then I uninstalled it.
Note: I installed Avast Free to run a boot scan a couple days ago. Boot scan picked up "win32 killapp-w pup" and that was placed in vault. No problems while in vault.

I have been running MSE on this computer since I bought it in Nov 2010. I ran a scan with MSE a bit ago and came up clean.

FredeGail: I am glad this is easy to analyze, but not sure what to do with your post, if anything. I did read it through and in a couple places it says: "Followup: MachineOwner". If this is meant to be for me to follow up on then I am at a loss as to what to do. Would you mind telling me if I have a problem and if it can be fixed? And how to go about fixing it? Knowledge level is not low and not high either, but none in this area.

Thanks for taking an interest in this. And Thanks for the welcome to the forums. I have been a member for a while now but mostly a reader and not active much recently.

Regards
Caveat

Saw some info searching for aswSnx.SYS and guessing my problem was Avast and solution was to uninstall Avast as both of you pointed out I should do. Please confirm. Thanks.

Follow the excellent advice you have received.

The main thing is to get a rid of Avast.

That's basically the thing!

Best Regards,
FredeGail

Caveat just follow these steps,

Uninstall,Remove avast from your computer using the avast! Uninstall Utility because avast causes problems in your computer.

And because is not right and not safe to stay without antivirus download and instal MSE Anti-Malware, Virus, Spyware Protection | Microsoft Security Essentials

Thats it,your finish,you dont need to do anything else!! :)

Caveat said:

Hello,
Thank you both for clearing this up for me. I really do appreciate it.

Regards
Caveat

Your welcome! :)