Blue Screens with Taxwise Program

JackR · 07 Jul 2012

I ran the SFC Scans and it not find any issues
I usually get the blue screens when I am closing TWW11. This time I got the blue screen when I opened it.
I am running a backup right now. It looks like it is going to take several hours. I want to be sure that I can log on if there are any issues with the verifier.
I have to go out and will not be back until late tonight.
I will run the verifier then and send you the BSOD posting results (I am sure that it will crash)
Thanks again
Jack

JackR · 07 Jul 2012

Hi Anak

Ran the verifier and the system crashed -the results are attached.

The blue screen showed an issue with NLem64nt.sys. I googled that and found the following posting

Unexpected Server 2008 R2 Std Restarts - MULTIPLE_IRP_COMPLETE_REQUESTS

Jack

Anak · 08 Jul 2012

JackR said:

Hi Anak

I checked the hash #s and they do not match. I am dealing with and agent for CCH. They do make some small changes to the logon screen. I confimed with CCH that they are legitimate. I also requested a tww11 demo directly from CCH but do not anticipate receiving it for a week. They were closed this week.

When you say logon screen do you mean the Operating System (OS) when you boot the machine? If so, legitimate or not that seems rather presumptuous of them.

JackR said:

Hi Anak

Ran the verifier and the system crashed -the results are attached.

The blue screen showed an issue with NLem64nt.sys. I googled that and found the following posting

Unexpected Server 2008 R2 Std Restarts - MULTIPLE_IRP_COMPLETE_REQUESTS

Jack

That sounds familiar, and that OP's running TWW also. That wasn't you that posted that, was it?

It brings us back to the bug check I posted in post#2 only a little different this time with an iaStor reference:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 44, {fffffa8008601c10, eae, 0, 0}

Unable to load image \SystemRoot\system32\drivers\iaStor.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for iaStor.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStor.sys
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : CLASSPNP.SYS ( CLASSPNP!TransferPktComplete+1ce )

Followup: MachineOwner

See if the suggestions in this thread help:https://www.sevenforums.com/crashes-d...ml#post1350270, If not I'm going to ask for help from the Team.

I'll be checking back, but will be busy from 10am edt to late.

JackR · 08 Jul 2012

Hi Anak

When you say logon screen do you mean the Operating System (OS) when you boot the machine? If so, legitimate or not that seems rather presumptuous of them.

I beleive that the initial screen that is presented when you open the application is customized. I am waiting to get an actual copy direct from CCH. I will then be able to compare them.

That sounds familiar, and that OP's running TWW also. That wasn't you that posted that, was it?

It was not me. I googled nlem64nt.sys.

I ran the TDSSKiller and it found 11 items which it copied to quarantine. See attached. I still received the BSOD

See if you can update the Storage drivers in Safe Mode (some installers will allow this) - and try the storage drivers from http://downloadcenter.intel.com to make sure you get the most current version.

I will try updating the storage drivers next but will not be able to do it right away.

I am going to be leaving at 9AM and will be away for a few days. Hopefully I will have received the TWW11 demo direct from the Vendor(CCH)by then.

Thanks again for your help.

Anak · 08 Jul 2012

Okay on the actual copy from CCH.

That's odd, those 11 files look like they should be legit.
I noticed the bonjour service listed. That can be a problem for win 7, can you live without it for a while to test?

Have a safe trip! Hoping for the demo.

EDIT:

Forgot to mention....

You can send those files, and report to Kaspersky for analysis: How to detect and remove unknown rootkits, scroll down to How to disinfect a compromised system, below the screen shot.

And, you can try, and use your HP update tool, and or support assistant to check for that iastor file: Frequently Asked Questions About Downloading HP Software HP Pavilion Elite d5100t ATX CTO Desktop PC - HP Customer Care (United States - English)

JackR · 28 Jul 2012

Hi Anak

I ended up getting the Demo Disk directly from Taxwise and the same blue screen issue occured. I worked with the TaxWise tech support and it looks as if the problem is solved. There were a few things going on.

1. User Account Contol (UAC) was on when I installed the software- The tech thinks that some of the dll's either did not install or did not install properly.

2. Taxwise installs a Print Driver. The print driver that came with the Demo was unsigned. After reloading the software and downloading the updates, the software worked properly. The update included a signed driver.

Thank you for your help with this issue

Anak · 28 Jul 2012

Hi Jack,

That's good news, I'm glad you were able to get it sorted out.

1.) I can't recall if we tried to install TWW by right click "Run as Administrator". In any event turning off UAC is nearly the same.
User Account Control Step-by-Step Guide
User Account Control in Windows 7 Best Practices
Run as Administrator Discussion

2.) Back in my post#2 I touched on driver problems:

There is one other possibility; The TWW drivers are not digitally signed, and might be causing problems with Microsoft's authentication protocols especially if Server applications are involved.

Your welcome, I'm glad I was here to help you!