BSOD after rebooting

rlslagle · 21 Aug 2012

Hi guys,
I am having issues getting the BSOD. It has happened fairly frequently over the past few days. I think it happens more commonly right after a re-start after a windows update. I have tried restoring the computer to a previous date. I have also ran Malwarebytes anti-malware. It shows 2 infected files with the information as follows:
1: Vendor: Trojan.Agent Category: File Item: c:\Windows\svchost.exe Other:
2: Vendor: Trojan.Agent Category: Memory process Item: c:\Windows\svchost.exe Other: 1652
I don't know if that has anything to do with it or not. anti-malware says the system must be rebooted to completely get rid of the files. After it reboots, if I run the anti-malware, I get the same results, but usually a different number under other. Sometimes, after the reboot, it will load most everything and then go to the BSOD.
I have attached the Seven Forums zip file from the SF Diag Tool v4.
I'm hoping you can help.
Thank you in advance,
rlslagle

**Capt.Jack Sparrow** · 24 Aug 2012

Hello there!

The dump files weren't very helpful since it was pointing to core Windows files which may not be the problem.

Enable Driver Verifier Using Driver Verifier to identify issues with Drivers and post us with the updated dump files it will find us the precise drivers iffy it caused by software.

Run SFC Scan SFC /SCANNOW Command - System File Checker

Disable some of the Startup items because there are like tons of them follow this article Troubleshoot Application Conflicts by Performing a Clean Startup

BSOD BUGCHECK SUMMARY

Code:


Loading Dump File [C:\Documents and Settings\Shyam\_jcgriff2_\dbug\__Kernel__\082112-58453-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
Debug session time: Tue Aug 21 22:49:43.222 2012 (GMT+5)
System Uptime: 0 days 0:03:27.079
BugCheck 1E, {ffffffffc0000096, fffff80002ec34aa, 0, 0}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+1ba )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x1E
FAILURE_BUCKET_ID:  X64_0x1E_nt!KeStackAttachProcess+1ba
Bugcheck code 0000001E
Arguments ffffffff`c0000096 fffff800`02ec34aa 00000000`00000000 00000000`00000000
BiosVersion = F.65
BiosReleaseDate = 12/15/2010
SystemManufacturer = Hewlett-Packard
SystemProductName = HP G60 Notebook PC
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Documents and Settings\Shyam\_jcgriff2_\dbug\__Kernel__\082112-34289-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
Debug session time: Wed Aug 22 02:43:09.114 2012 (GMT+5)
System Uptime: 0 days 0:05:06.971
BugCheck 1E, {ffffffffc0000005, fffff800031916ea, 1, 18}
Probably caused by : ntkrnlmp.exe ( nt!ObpCreateHandle+29a )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x1E
PROCESS_NAME:  iexplore.exe
FAILURE_BUCKET_ID:  X64_0x1E_nt!ObpCreateHandle+29a
Bugcheck code 0000001E
Arguments ffffffff`c0000005 fffff800`031916ea 00000000`00000001 00000000`00000018
BiosVersion = F.65
BiosReleaseDate = 12/15/2010
SystemManufacturer = Hewlett-Packard
SystemProductName = HP G60 Notebook PC
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Documents and Settings\Shyam\_jcgriff2_\dbug\__Kernel__\082012-33009-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
Debug session time: Tue Aug 21 07:12:51.408 2012 (GMT+6)
System Uptime: 0 days 0:03:03.265
BugCheck 1E, {ffffffffc0000096, fffff80002f104aa, 0, 0}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+1ba )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x1E
FAILURE_BUCKET_ID:  X64_0x1E_nt!KeStackAttachProcess+1ba
Bugcheck code 0000001E
Arguments ffffffff`c0000096 fffff800`02f104aa 00000000`00000000 00000000`00000000
BiosVersion = F.65
BiosReleaseDate = 12/15/2010
SystemManufacturer = Hewlett-Packard
SystemProductName = HP G60 Notebook PC
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

rlslagle · 27 Aug 2012

Thank you for your help. I followed your instructions above. The SFC Scan results showed no problems. I also tried the clean start up. I didn't get any results with trying removing different start up processes. I ended up starting all of them and still did not get BSOD. I finally got the BSOD once 3 days later. I just got the BSOD twice in the last few minutes. I was using the laptop earlier today and I closed the lid with Internet Explorer 8 running. It goes into sleep mode when I close the lid. When I came back to it later, the BSOD was there when I opened the lid. I tried restarting in normal mode and it went to BSOD again. I am now in safe mode with networking. I am attaching the new dmp files.
Thanks again,
rlslagle

**Capt.Jack Sparrow** · 28 Aug 2012

rlslagle said:

Thank you for your help. I followed your instructions above. The SFC Scan results showed no problems. I also tried the clean start up. I didn't get any results with trying removing different start up processes. I ended up starting all of them and still did not get BSOD. I finally got the BSOD once 3 days later. I just got the BSOD twice in the last few minutes. I was using the laptop earlier today and I closed the lid with Internet Explorer 8 running. It goes into sleep mode when I close the lid. When I came back to it later, the BSOD was there when I opened the lid. I tried restarting in normal mode and it went to BSOD again. I am now in safe mode with networking. I am attaching the new dmp files.
Thanks again,
rlslagle

Hi there!

Seems like one of the dump is pointing to SynTP.sys i.e. Synaptics Touchpad Driver" I would recommend to remove the current version and download and install a new version.

BSOD BUGCHECK SUMMARY

Code:


Loading Dump File [C:\Documents and Settings\Shyam\_jcgriff2_\dbug\__Kernel__\082712-40217-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
Debug session time: Tue Aug 28 03:59:37.941 2012 (GMT+5)
System Uptime: 2 days 11:13:50.673
BugCheck A, {2000000dc, 2, 1, fffff80002ec4405}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+115 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0xA
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_0xA_nt!KeStackAttachProcess+115
Bugcheck code 0000000A
Arguments 00000002`000000dc 00000000`00000002 00000000`00000001 fffff800`02ec4405
BiosVersion = F.65
BiosReleaseDate = 12/15/2010
SystemManufacturer = Hewlett-Packard
SystemProductName = HP G60 Notebook PC
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Documents and Settings\Shyam\_jcgriff2_\dbug\__Kernel__\082712-30279-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
Debug session time: Tue Aug 28 04:03:07.501 2012 (GMT+6)
System Uptime: 0 days 0:02:49.233
BugCheck 1E, {ffffffffc0000096, fffff80002f0a4aa, 0, 0}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+1ba )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x1E
FAILURE_BUCKET_ID:  X64_0x1E_nt!KeStackAttachProcess+1ba
Bugcheck code 0000001E
Arguments ffffffff`c0000096 fffff800`02f0a4aa 00000000`00000000 00000000`00000000
BiosVersion = F.65
BiosReleaseDate = 12/15/2010
SystemManufacturer = Hewlett-Packard
SystemProductName = HP G60 Notebook PC
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Documents and Settings\Shyam\_jcgriff2_\dbug\__Kernel__\082412-32198-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
Debug session time: Sat Aug 25 03:58:53.481 2012 (GMT+5)
System Uptime: 0 days 0:00:33.292
*** WARNING: Unable to verify timestamp for SynTP.sys
*** ERROR: Module load completed but symbols could not be loaded for SynTP.sys
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR:  0x7E
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_0x7E_VRF_SynTP+d323
Bugcheck code 1000007E
Arguments ffffffff`80000003 fffff800`02ed5fd0 fffff880`03bf6598 fffff880`03bf5df0
BiosVersion = F.65
BiosReleaseDate = 12/15/2010
SystemManufacturer = Hewlett-Packard
SystemProductName = HP G60 Notebook PC
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

rlslagle · 28 Aug 2012

It was interesting, but when I went into the device manager and told it to update the driver, it said my current driver was the most up-to-date. However, I went to Synaptics website and found that their current version of the driver is 15.2.20 while my current one is 13.2.2.0. So I have now downloaded the new driver.

I don't want to seem like a n00b, but how would you recommend me proceeding with deleting the old driver. I have checked in the programs and features and I can uninstall the "synaptics pointing device driver" there as a software uninstall. Or I can uninstall it through the control panel-system-device manager.

Thanks again,
rlslagle

**Capt.Jack Sparrow** · 28 Aug 2012

rlslagle said:

It was interesting, but when I went into the device manager and told it to update the driver, it said my current driver was the most up-to-date. However, I went to Synaptics website and found that their current version of the driver is 15.2.20 while my current one is 13.2.2.0. So I have now downloaded the new driver.

I don't want to seem like a n00b, but how would you recommend me proceeding with deleting the old driver. I have checked in the programs and features and I can uninstall the "synaptics pointing device driver" there as a software uninstall. Or I can uninstall it through the control panel-system-device manager.

Thanks again,
rlslagle

Yes make sure you have a external mouse since once you remove it the touchpad may stop working until you install the new drivers. :)

rlslagle · 29 Aug 2012

Hello,
I uninstalled the synaptics pointer device driver. In order to finish uninstalling it, the computer had to reboot. It went directly to the BSOD after rebooting. I restarted the computer and it booted normally.
I installed the new driver (which also installed Skrybe) and the computer went to BSOD several times. I had to boot in safe mode and uninstall the new driver. I am now operating in regular mode and the touchpad is operational without the synaptics pointing device driver installed.
I have attached the latest dmp files.
Thank you,
rlslagle

rlslagle · 01 Sep 2012

I haven't had the BSOD in a couple of days. seems this may be resolved. Thank you.