Multiple BSOD's no obvious pattern

chuckc · 27 Jan 2013

For the last several weeks, I've started experiencing multiple bsod's. Since the laptop was 2 years old, I opted (after malware scans) just to wipe the drive and use HP's recovery tools to reimage to new condition. However, the BSOD's continued. Ran Memtest overnight with no errors. Ran Norton Recovery tool from USB boot, no malware/viruses found. Uninstalled norton and installed Microsoft Security essentials, but BSOD's continue.
Only thing unusual in this machine is an upgraded Seagate momentus xt hybrid drive and upgraded wireless card to access 5.2 ghz band.
Machine was getting fairly hot, so disassembled before the reimage and cleaned out a fairly dirty fan, temps great now.
Transfering files seems more troublesome, either usb/network (wired)/or eSATA), but that may just be a red herring.
Any help would be very much appreciated.

Arc · 27 Jan 2013

Symantec Extended File Attributes.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff88001109ad4, fffff8800889cd70, 0}

Probably caused by : SYMEFA64.SYS ( SYMEFA64+3ead4 )

Followup: MachineOwner
---------

Uninstall Norton and all Symentec products using Norton Removal tool.

HP Mobile Data Protection System Disk Filter

Code:

fffff880`0889cb98  fffff880`01d2b18fUnable to load image \SystemRoot\system32\DRIVERS\hpdskflt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for hpdskflt.sys
*** ERROR: Module load completed but symbols could not be loaded for hpdskflt.sys
 hpdskflt+0x218f

Probably it is contributing to all the disk errors. Better you uninstall it. Follow Clean Up Factory Bloatware, with a special reference to the point #13.

13. Consider a Clean Reinstall - Factory OEM Windows 7 which is often better than getting a new computer considering how pre-installed bloatware can corrupt Windows 7 even if it's completely cleaned up. If you stick with the tools and methods given you will get and keep a perfect install.

Intel Rapid Storage.

Code:

fffff880`0889cae8  fffff880`012ec656Unable to load image \SystemRoot\system32\DRIVERS\iaStor.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for iaStor.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStor.sys
 iaStor+0x50656

And it is very old.

Code:

fffff880`0129c000 fffff880`014a6000   iaStor   T (no symbols)           
    Loaded symbol image file: iaStor.sys
    Image path: \SystemRoot\system32\DRIVERS\iaStor.sys
    Image name: iaStor.sys
    Timestamp:        Tue Apr 13 22:14:16 2010 (4BC49F60)
    CheckSum:         00090C73
    ImageSize:        0020A000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Download and install this one.

Free up the startup.

Click on the Start button
Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
Select the “Startup” tab.
Deselect all items other than the antivirus.
Apply > OK
Accept the restart.

Let us know the results.

chuckc · 27 Jan 2013

Done.

Did remove norton with the NRT, but reran just in case.

I was trying to avoid a clean install as the machine came with a corel paintshop pro that I wanted to keep, but if this keeps up I'll be forced to. May do a longer memtest as well.

I've came across this site several times trying to troubleshoot this myself. Very impressive community if I may say so. Will let you know how the changes went.

chuckc · 28 Jan 2013

more crashing, did do a java update today as well.

Arc · 29 Jan 2013

From the latest dumps, in both of those,

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff88007b49000, 1, fffff88001646f31, 0}


Could not read faulting driver name
Probably caused by : Ntfs.sys ( Ntfs!memset+61 )

Followup: MachineOwner
---------

And the HP Mobile Data Protection System Disk Filter is present there.

Code:

fffff880`01d5f000 fffff880`01d69000   hpdskflt   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\hpdskflt.sys
    Image name: hpdskflt.sys
    Timestamp:        Wed Apr 11 01:20:35 2012 (4F848F0B)
    CheckSum:         00015631
    ImageSize:        0000A000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Again I am suggesting, you need to follow the post #2

HP Mobile Data Protection System Disk Filter

Code:

fffff880`0889cb98  fffff880`01d2b18fUnable to load image \SystemRoot\system32\DRIVERS\hpdskflt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for hpdskflt.sys
*** ERROR: Module load completed but symbols could not be loaded for hpdskflt.sys
 hpdskflt+0x218f

Probably it is contributing to all the disk errors. Better you uninstall it. Follow Clean Up Factory Bloatware, with a special reference to the point #13.

13. Consider a Clean Reinstall - Factory OEM Windows 7 which is often better than getting a new computer considering how pre-installed bloatware can corrupt Windows 7 even if it's completely cleaned up. If you stick with the tools and methods given you will get and keep a perfect install.

Otherwise, it is tough to stop the Ntfs.sys errors with a possible cause present.

chuckc · 29 Jan 2013

Sorry, thought I did but turns out it can be alittle tricky and reinstall itself.

For anyone else finding this tread later, instructions on how to get rid of the HP Mobile Data Protection System:

Uninstalling HP Mobile Data Protection Sensor - HP Support Forum - 1311745

holding off on the reinstall, but if I get another blue screen, will do

Also, left memtest86+ running for 9 hours or so, and it was on the 7th cycle. Came back a 1/2 hour later, and the system had rebooted and I was at the windows logon screen. Anyone know if memtest would reboot for any valid reason? Hate to throw money at the problem, but may replace the memory.

chuckc · 05 Feb 2013

OK, after one week and dumping norton, updating the intel storage drivers and finally getting the HP Mobile Data Protection System Disk Filter gone, no crashes!!!! I'll mark this one as solved. Thanks for your help...and its prompted me to start working with windbg

Arc · 05 Feb 2013

You are welcome :)
If you need practice with windbg, start taking threads