Windows 7: Recurring BSOD when adding/uploading files

somesayimemo · 18 Dec 2011

I keep getting the BSOD when trying to add files using programs such as Nero and Aimersoft. I tried attaching a zip file to this posting and once again got a BSOD. Any suggestions would be appreciated.

**yowanvista** · 18 Dec 2011

Quote: Originally Posted by somesayimemo

I keep getting the BSOD when trying to add files using programs such as Nero and Aimersoft. I tried attaching a zip file to this posting and once again got a BSOD. Any suggestions would be appreciated.

Boot in safe mode with networking and upload the attachment.

somesayimemo · 18 Dec 2011

Thanks for the quick reply. Lets see if this works.

**yowanvista** · 18 Dec 2011

Run SFC
SFC /SCANNOW Command - System File Checker

Run a scan of Malwarebytes

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880077cdc40, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+0
fffff880`077cdc40 68eb7c0780      push    0FFFFFFFF80077CEBh

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034b5100
 0000000000000000 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  System

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff880077ceb68 -- (.exr 0xfffff880077ceb68)
ExceptionAddress: fffff880016026b3 (ksecdd!KsecProcessSecurityContext+0x0000000000000293)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000010
Attempt to read from address 0000000000000010

TRAP_FRAME:  fffff880077cec10 -- (.trap 0xfffff880077cec10)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=00000000014c89c0
rdx=fffff880077cee38 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880016026b3 rsp=fffff880077ceda0 rbp=0000000000000000
 r8=fffff880077ceea8  r9=00000000014c89c0 r10=fffffa800555fc70
r11=fffff8a00278f000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac pe cy
ksecdd!KsecProcessSecurityContext+0x293:
fffff880`016026b3 ff5010          call    qword ptr [rax+10h] ds:00000000`00000010=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000330e4fb to fffff80003282c40

STACK_TEXT:  
fffff880`077cdb88 fffff800`0330e4fb : 00000000`0000001e ffffffff`c0000005 fffff880`077cdc40 00000000`00000000 : nt!KeBugCheckEx
fffff880`077cdb90 fffff800`032d6bb4 : 00000000`00000000 00000000`00000000 00000000`00000040 00000000`00000001 : nt!KipFatalFilter+0x1b
fffff880`077cdbd0 fffff800`032aea7c : 00000000`00000000 00000000`00000000 00000000`00000040 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x83d
fffff880`077cdc10 fffff800`032ae4fd : fffff800`033c5c24 fffff880`077cf460 00000000`00000000 fffff800`03206000 : nt!_C_specific_handler+0x8c
fffff880`077cdc80 fffff800`032ad2d5 : fffff800`033c5c24 fffff880`077cdcf8 fffff880`077ceb68 fffff800`03206000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`077cdcb0 fffff800`032be361 : fffff880`077ceb68 fffff880`077ce3c0 fffff880`00000000 fffff880`077cef90 : nt!RtlDispatchException+0x415
fffff880`077ce390 fffff800`032822c2 : fffff880`077ceb68 fffff880`077cefc0 fffff880`077cec10 fffff880`077cefe0 : nt!KiDispatchException+0x135
fffff880`077cea30 fffff800`03280e3a : 00000000`00000000 00000000`00000010 00000000`00000000 fffff880`077cefc0 : nt!KiExceptionDispatch+0xc2
fffff880`077cec10 fffff880`016026b3 : fffff880`00000000 fffff880`077cee18 00000000`00000000 fffff880`077cef90 : nt!KiPageFault+0x23a
fffff880`077ceda0 fffff880`016126a6 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000001 : ksecdd!KsecProcessSecurityContext+0x293
fffff880`077ceea0 fffff880`01b393a4 : 00000000`00000000 fffff8a0`00000000 fffffa80`058d7a00 00000000`00000000 : ksecdd!InitializeSecurityContextW+0x66
fffff880`077cef00 fffff880`01b3a22e : 00000000`000221b8 00000000`000221b8 00000000`00000100 01ccbd32`70bc9c07 : tcpip!WfpAlepCreateTokenFromLogonId+0x1c4
fffff880`077cf020 fffff880`01b39122 : fffffa80`0606aa90 fffffa80`058d7ae0 fffffa80`0606aa90 fffffa80`05f369a0 : tcpip!WfpAleCreateTokenFromLogonId+0x2e
fffff880`077cf0a0 fffff880`01b39795 : 00000000`00000000 fffffa80`058d7ae0 00000000`00000000 fffffa80`0606aa90 : tcpip!WfpAlepSetSecurity+0x282
fffff880`077cf170 fffff880`01b5a890 : 00000000`00004800 fffff800`0357a4f4 00000000`0000fffc fffffa80`06118970 : tcpip!WfpAleProcessSecureSocketControl+0xa5
fffff880`077cf300 fffff880`01b5a227 : 00000000`00000000 fffff880`01b51973 fffff880`077cf570 fffffa80`05f369a0 : tcpip!TcpSetSockOptEndpoint+0x150
fffff880`077cf400 fffff800`0328f618 : 80000800`00000000 80000800`00000001 00000000`00000000 00000000`00000000 : tcpip!TcpTlEndpointIoControlEndpointCalloutRoutine+0x107
fffff880`077cf460 fffff880`01b5a2b0 : fffff880`01b5a120 00000000`00000000 fffff880`019d1500 00000000`00000001 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`077cf540 fffff880`030c4056 : fffffa80`0b7acb01 fffffa80`0bccfee0 fffffa80`0b7acb20 00000000`00000000 : tcpip!TcpTlEndpointIoControlEndpoint+0x70
fffff880`077cf5b0 fffff880`030c36e0 : 00000000`980000c8 00000000`00000000 fffffa80`0bccfee0 fffffa80`057dc690 : afd!WskProTLControlRequest+0x136
fffff880`077cf640 fffff880`030c3afb : fffffa80`0b482440 fffffa80`0bccfee0 fffffa80`057dc690 fffff800`03423a08 : afd!WskProControlSocketCore+0x110
fffff880`077cf6c0 fffff880`02fc36c0 : fffffa80`00000468 fffffa80`0b482440 00000000`00000000 00000000`000007ff : afd!WskProAPIControlSocket+0x9b
fffff880`077cf730 fffff880`02fc2de6 : 00000000`00000001 fffff880`030d5400 00000000`00000000 00000000`00000700 : mrxsmb!SmbWskSetSocketOptions+0x1f0
fffff880`077cf7f0 fffff880`02fbb082 : fffffa80`05c57010 fffffa80`06157001 00000000`00000080 fffffa80`05c57010 : mrxsmb!SmbWskInitiateAsynchronousConnect+0x1a6
fffff880`077cf940 fffff880`02fc13a9 : 00000000`00000000 00000000`0000000d fffffa80`06157010 00000000`00000000 : mrxsmb!RxCeInitiateConnectRequest+0x52
fffff880`077cf970 fffff880`02fc1ba5 : fffff880`02fd5f00 fffffa80`06157010 fffff880`0301b110 00000000`aaaaaaaa : mrxsmb!RxCeBuildConnectionOverMultipleTransports+0x659
fffff880`077cfb00 fffff880`030011b1 : fffff880`0301c4a8 00000000`00000080 fffff880`0301b110 fffffa80`061570b0 : mrxsmb!RxCeInitiateConnection+0x151
fffff880`077cfb40 fffff800`0351dfee : fffff880`0301c4a8 fffff880`0301c8f8 fffff880`077cfc00 fffffa80`0b91a000 : rdbss!RxpWorkerThreadDispatcher+0x1a1
fffff880`077cfc00 fffff800`032745e6 : fffff880`009f3180 fffffa80`0b91a040 fffffa80`0887a840 fffff880`01664384 : nt!PspSystemThreadStartup+0x5a
fffff880`077cfc40 00000000`00000000 : fffff880`077d0000 fffff880`077ca000 fffff880`077cdca0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ksecdd!KsecProcessSecurityContext+293
fffff880`016026b3 ff5010          call    qword ptr [rax+10h]

SYMBOL_STACK_INDEX:  9

SYMBOL_NAME:  ksecdd!KsecProcessSecurityContext+293

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ksecdd

IMAGE_NAME:  ksecdd.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7930b

FAILURE_BUCKET_ID:  X64_0x1E_ksecdd!KsecProcessSecurityContext+293

BUCKET_ID:  X64_0x1E_ksecdd!KsecProcessSecurityContext+293

Followup: MachineOwner
---------

somesayimemo · 18 Dec 2011

I ran SFC and did a full scan with Malwarebytes and both came up ok with no problems detected.

somesayimemo · 18 Dec 2011

I'm not sure how much this will help but I just noticed that I am unable to replicate the BSOD while in safe mode. However when I boot in normal mode, I can replicate it at any time.

**yowanvista** · 19 Dec 2011

Quote: Originally Posted by somesayimemo

I'm not sure how much this will help but I just noticed that I am unable to replicate the BSOD while in safe mode. However when I boot in normal mode, I can replicate it at any time.

Try a Clean Boot configuration and disable any useless/unnecessary startup programs
Troubleshoot Application Conflicts by Performing a Clean Startup

somesayimemo · 22 Dec 2011

Thank you for getting back to me. I tried the clean boot and did everything the tutorial said but couldn't locate the cause. Since I've only had this computer for about a month and had very little stored on it, I just restored it to factory settings and reinstalled me applications. Since then, its been three days with no BSOD so I think I'm good.

Thanks for all your help.

Windows 7: Recurring BSOD when adding/uploading files

Recurring BSOD when adding/uploading files problems?