Windows 7: Sudden multiple BSOD - error 0x0000001e - Windows Home Prem 64-bit

lilacdragon · 09 Feb 2012

Hello, I'm a newbie to this, I have a 4-month-old Acer Aspire M1930 which is my work computer (I'm self employed). Two days ago, it suddenly started BSOD randomly as I try to attach a file to an email, or browse to locate an image, or even use the file search function.
After a forced shutdown pressing the main on/off switch, it will re-boot normally, and seems ok till suddenly, it goes again in the middle of some task.

I hadn't installed any new programs just before it started doing this but I did notice my MacAfeeSecurity Suite had done a major update, and Windows Update had also been busy.

Since MacAfee seems to have got even heavier in its eating up memory recently, (I've had Photoshop saying not enough memory, a couple of times) I took the plunge and got rid of MacAfee. I installed an AFG trial version instead. I also cleared out a lot of old files on the C drive and checked Acer and Windows for any recent updates.

But the BSOD is still happening....
...what can I do?

Dump files attached; (Great tutorial, jcgriff2!)
here's a summary of my System Specs:
Acer Aspire M1930 running Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
Intel(R) Core(TM) i3-2100 CPU @ 3.10GHz with an Intel(R) HD Graphics Family card. The hard drive is ST3500418AS Fixed hard disk media
C: Local Fixed Disc NFTS 222.95 GB
D: Local Fixed Disc NFTS 223.71 GB.
The computer is 4 months old and the OS was pre-installed.

Thanks so much....
Frances

Dave76 · 10 Feb 2012

Welcome to Seven Forums.

Did you run the McAfee Removal tool?
If not then follow the instructions on this link, there will be remnants still on your system.
How to uninstall or reinstall supported McAfee products using the McAfee Consumer Products Removal tool (MCPR.exe)

I recommend to un-install AVG for testing purposes.
Also run the AVG Remover(64bit) 2012 from this link:
AVG Download Tools site

Install MSE (free) while analyzing the crashes.
Microsoft Security Essentials*- Free Antivirus for Windows
Update it after it is installed.

You have 7 crashes in you dump file.

Starting from the oldest:
STOP 0x000000BE: ATTEMPTED_WRITE_TO_READONLY_MEMORY
Usual causes: Device driver, Memory

STOP 0x0000001E: KMODE_EXCEPTION_NOT_HANDLED
Usual causes: Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS
This indicates that a kernel-mode program generated an exception which the error handler did not catch.

Code:

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
SYMBOL_NAME:  afd! ?? ::GFJBLGFE::`string'+1370
MODULE_NAME: afd
IMAGE_NAME:  afd.sys - Ancillary Function Driver for WinSock
FAILURE_BUCKET_ID:  X64_0xBE_afd!_??_::GFJBLGFE::_string_+1370
-------------------------------------------------------------------------------------------------------------------------------------------------------
KMODE_EXCEPTION_NOT_HANDLED (1e)
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036bd100
MODULE_NAME: ksecdd
IMAGE_NAME:  ksecdd.sys - Kernel Security Support Provider Interface
--------------------------------------------------------------------------------------------------------------------------------------------------------
KMODE_EXCEPTION_NOT_HANDLED (1e)
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036ff100
MODULE_NAME: ksecdd
IMAGE_NAME:  ksecdd.sys - Kernel Security Support Provider Interface 
--------------------------------------------------------------------------------------------------------------------------------------------------------

The remaining crashes are the same as the last two.

All your drivers are up to date.

Check the Acer support site for a BIOS update.

From your System Event Logs:

Code:

Event[47]:
  Log Name: System
  Source: Service Control Manager
  Date: 2012-02-09T21:33:20.199
  Event ID: 7026
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: lilac
  Description: 
The following boot-start or system-start driver(s) failed to load: 
Beep
KSecPkg
msahci

Event[87]:
  Log Name: System
  Source: Service Control Manager
  Date: 2012-02-09T21:33:10.542
  Event ID: 7000
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: lilac
  Description: 
The Link-Layer Topology Discovery Mapper I/O Driver service failed to start due to the following error: 
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Event[144]:
  Log Name: System
  Source: Microsoft-Windows-WMPNSS-Service
  Date: 2012-02-09T21:21:22.000
  Event ID: 14319
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: lilac
  Description: 
Service 'WMPNetworkSvc' did not start because Group Policy is preventing Windows Media Player from sharing media with other devices.

Run sfc/scannow as recommended by JaidynM.

Then run memtest86+ for a minimum on 7 full passes with all RAM cards installed, best to run overnight.
Stop the test if you get any errors.
RAM - Test with Memtest86+

Let us know the results.

lilacdragon · 10 Feb 2012

Hi, Dave 76.
Thank you SO much for looking at this for me.

The second problem is now the terror of my computer life....
What is ksecdd.sys, and how do I repair it?

The first problem has never happened again. Should I be worried about that, too?

Frances

JaidynM · 10 Feb 2012

Try running an sfc/scannow command in an elevated command prompt. If errors are found, run it twice more with each scan followed by a reboot.
SFC /SCANNOW Command - System File Checker

Dave76 · 10 Feb 2012

Check my previous post, I have been updating as I find information.

The ksecdd.sys - Kernel Security Support Provider Interface is a Windows driver and likely the result and not the cause of the crash.

Run the McAfee removal tool.

Then un-install AVG, run it's removal tool.

Install MSE while we're working on this crash.

lilacdragon · 10 Feb 2012

Hi, JaidynM.
OK... done that. (Great tutorial by Brink

)
I now have this in the black pop-up:
C:\Windows\system32>sfc /scannow
"Verification 100% complete.
Windows Resource Protection did not find any integrity violations"

Has it fixed the problem? ..or just, can't see it?

Thanks so much. I really appreciate your help.
Frances

lilacdragon · 10 Feb 2012

Oh... I've just seen your new message, too, Dave76.
Thanks so much...

I'll try all these things and get back to you.
You guys are fantastic.
Frances

Dave76 · 10 Feb 2012

Looks like the SFC (System File Checker) is clear, no issues found.

Run the anti-virus removal tools and the memtest86+.

Let us know the results.

I will continue here:

Your Application Event Logs:

Code:

Event[14]:
  Log Name: Application
  Source: Microsoft-Windows-WMI
  Date: 2012-02-09T21:34:47.000
  Event ID: 10
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: lilac
  Description: 
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 
"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" 
because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Go to this MS link and follow the instructions there.
Event ID 10 is logged in the Application log after you install Service Pack 1 for Windows 7 or Windows Server 2008 R2

JaidynM · 10 Feb 2012

Quote: Originally Posted by lilacdragon

Hi, JaidynM.
OK... done that. (Great tutorial by Brink

)
I now have this in the black pop-up:
C:\Windows\system32>sfc /scannow
"Verification 100% complete.
Windows Resource Protection did not find any integrity violations"

Has it fixed the problem? ..or just, can't see it?

Thanks so much. I really appreciate your help.
Frances

Brink sure does make great tutorials.

Anyway, as Dave said the 'no integrity violations' means that no errors were found. In that department, you should be fine.

lilacdragon · 11 Feb 2012

Good morning, Dave and JaidynM.

I erased all traces of AVG and MacAfee using the tools.

Since I was disconnected from the internet, I didn't install the MS antivirus (was that wrong?)
I ran the memtest86+ all night and got 14 totally clean passes.
The results screen said:
Cached 2985M RSVD Mem 620K Mem map e820 Cache on ECC off Test Std
Pass 14 Errors and Ecc Errors 0

I reinstalled the AFG trial and checked my emails etc.. no problems..
Turned off Firefox and Windows LiveMail
Then I wondered whether I should update my Firefox so I right-clicked on it in the Start Menu but the moment I made a selection in the dialog box, I got BSOD.

I've rebooted, checked in here, just re-read your last message, Dave, and done the MS Event ID 10 repair.
I ran Acer Update and it said no new updates available; but did it also check the BIOS? I looked on their website BIOS page but I wasn't sure which one to choose; it warned me not to download anything unless I knew what I was doing... which I don't...

Any thoughts on what I should try next?

Frances

Windows 7: Sudden multiple BSOD - error 0x0000001e - Windows Home Prem 64-bit

Sudden multiple BSOD - error 0x0000001e - Windows Home Prem 64-bit problems?