Various BSOD and file access problems

doveman007 · 11 May 2013

Specs are:
Athlon II X4 630
HD4250 IGP (using part of the 4GB DDR3 RAM)
Asrock 880GMH/US3
Seasonic G360 PSU

I originally installed this Win7 x64 on another board which then died on me, so rather than start from scratch I used a workaround that has served me well before to reset the SATA drivers, etc and transfer it to the Asrock board before reinstalling the correct drivers, etc. I haven't had time to work on it since, so only fired it up the other day to carry on.

The first BSOD happened when I was launching some program or other and referred to NTFS.sys. The second happened when installing/updating ATI Catalyst from 11.11 to 13.4 (it actually was only installing the HDMI Audio driver and Vision Control as the machine is only using onboard HD4250 IGP so the display driver, etc could not be updated) and referred to ATIxxxx.sys).

I uninstalled Ultravnc's mirror driver, Daemon Tools and AMD Overdrive (and any associated drivers), uninstalled all ATI software, disabled DataRAM RAMDisk (which removes the driver from Device Manager). After that, I got a BSOD referring to iswkl.sys, which is the ZoneAlarm taskbar, every time I tried to launch IE, so I uninstalled ZoneAlarm and haven't had another BSOD since but I don't believe ZoneAlarm is incompatible with Win7 (although it appears it may have been at one time judging by this old thread) and I'd like to use it as the person who's system this will be is familiar with it (and I haven't found any particularly good free alternatives and I've tested pretty much everything). Daemon Tools and DataRAM RAMdisk are also needed (although I could use Softperfect RAMDisk instead perhaps).

I've also been getting a lot of refusals trying to delete/overwrite files/folders on both C: and D: with the errors telling me I don't have permission, despite using an Admin account with UAC disabled and Security showing that Administrators have full access rights to said folders. For example, I had a Found.000 folder (with a lock symbol) on C: which I couldn't delete, although I could delete a subfolder and files within it. I did find that the user was in both Administrators and Users group (as well as Remote Desktop Users) which seemed wrong, so I removed it from Users and after booting this morning I was able to deleted Found.000, so maybe that's fixed that problem.

Another weird thing happened when running the SF Diagnostic tool, in that it created the logs in D:\Users\Steve\Desktop, despite Windows using C:\Users\Steve\Desktop. I searched the registry for D:\users and it didn't find anything.

I'm still a bit wary because of all the BSOD that this install still might not be stable and I might just have to start from scratch again but I'd obviously rather avoid that if possible as it took me quite some time to get all the software installed and setup (and I've got more to do yet).

koolkat77 · 11 May 2013

Security App

Crashes indicate zone alarm being a possible cause. Remove it and replace with Microsoft Security Essentials to see if it provides more stability. Uninstallers (removal tools) for common antivirus software

Microsoft Security Essentials and Malwarebytes, both recommended from a strict BSOD perspective.

Microsoft Security Essentials, Free antivirus for windows

Malwarebytes Anti-Malware Free

Information

DO NOT start the free trial of MalwareBytes. Deselect the option when prompted.

mv2.sys Thu Feb 7 03:02:40 2008 (47AA2070)
UltraVnc miniport driver2
http://www.carrona.org/drivers/driver.php?id=mv2.sys

AMD OverDrive

AODDriver2.sys Wed Jun 15 14:38:35 2011 (4DF86F8B)
AMD Overdrive; also in EasyTune6 for Gigabyte motherboard [br] Known BSOD issues in Win7
http://www.carrona.org/drivers/driver.php?id=AODDriver2.sys

(AODDriver2.sys) is either a stand-alone application, or a component of the AMD VISION Engine Control Center. This driver is known to cause BSOD's on some Win7 systems.

Please uninstall all AMD/ATI video stuff from Control Panel...Programs...Uninstall a program
Then, download (but DO NOT install) a fresh copy of the ATI drivers from Global Provider of Innovative Graphics, Processors and Media Solutions | AMD (in the upper right corner of the page)
Use this procedure to install the DRIVER ONLY: ATI video cards - DRIVER ONLY installation procedure

If the device (AODDriver or AODDriver4.01) remains a problem, open Device Manager, select the "View" item.
Then select "Show hidden devices" and scroll down to the Non-Plug and Play Drivers section.
Locate the AODDriver entry, right click on it and select "Uninstall". Reboot for changes to take affect.

Sometimes the driver remains and continues to cause BSOD's.

Daemon Tools/Alcohol %

dtsoftbus01.sys Mon Oct 17 18:12:30 2011 (4E9C1BAE)
Daemon Tools driver [br] Possible BSOD issues in Win7
http://www.carrona.org/drivers/driver.php?id=dtsoftbus01.sys

Uninstall DAEMON Tools and/or Alcohol % software. It uses a driver called sptd.sys which is known to cause BSODs in Windows 7. Uninstall the software using Add/Remove Programs. Reboot the system. Once the program is uninstalled, run sptd.sys uninstaller to remove the driver from your system.

As an alternative, many people recommend the use of Total Mounter or Magic ISO

Please run these tests and report back the results

1. SFC /scannow to check windows for corruption - SFC /SCANNOW Command - System File Checker
2. Disk check for errors on the hard drive - How to Run Disk Check in Windows 7
3. Troubleshoot applications by a clean boot - Troubleshoot Application Conflicts by Performing a Clean Startup
4. Memtest86+ paying close attention to part 3 - RAM - Test with Memtest86+
5. Hard drive test from HDD mfg website - Hard Drive Diagnostic Procedure

BSOD BUGCHECK SUMMARY

Code:

Debug session time: Sat May 11 03:53:16.468 2013 (UTC + 6:00)
Loading Dump File [C:\Users\Koolkat77\SysnativeBSODApps\051013-40341-01.dmp]
Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
System Uptime: 0 days 0:05:02.091
*** WARNING: Unable to verify timestamp for ISWKL.sys
*** ERROR: Module load completed but symbols could not be loaded for ISWKL.sys
Probably caused by : ISWKL.sys ( ISWKL+1d78 )
BugCheck C4, {f6, 3cc, fffffa800787b060, fffff880085c3d78}
BugCheck Info: DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
Bugcheck code 000000c4
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
Arguments: 
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 00000000000003cc, Handle value being referenced.
Arg3: fffffa800787b060, Address of the current process.
Arg4: fffff880085c3d78, Address inside the driver that is performing the incorrect reference.
BUGCHECK_STR:  0xc4_f6
PROCESS_NAME:  ForceField.exe
FAILURE_BUCKET_ID:  X64_0xc4_f6_ISWKL+1d78
SystemManufacturer = To Be Filled By O.E.M.
SystemProductName = To Be Filled By O.E.M.
BiosVersion = P1.80
BiosReleaseDate = 12/27/2011
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sat May 11 03:44:57.245 2013 (UTC + 6:00)
Loading Dump File [C:\Users\Koolkat77\SysnativeBSODApps\051013-42042-01.dmp]
Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
System Uptime: 0 days 0:02:01.479
*** WARNING: Unable to verify timestamp for ISWKL.sys
*** ERROR: Module load completed but symbols could not be loaded for ISWKL.sys
Probably caused by : ISWKL.sys ( ISWKL+1d78 )
BugCheck C4, {f6, 538, fffffa80079b1b30, fffff88008571d78}
BugCheck Info: DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
Bugcheck code 000000c4
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
Arguments: 
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 0000000000000538, Handle value being referenced.
Arg3: fffffa80079b1b30, Address of the current process.
Arg4: fffff88008571d78, Address inside the driver that is performing the incorrect reference.
BUGCHECK_STR:  0xc4_f6
PROCESS_NAME:  ForceField.exe
FAILURE_BUCKET_ID:  X64_0xc4_f6_ISWKL+1d78
SystemManufacturer = To Be Filled By O.E.M.
SystemProductName = To Be Filled By O.E.M.
BiosVersion = P1.80
BiosReleaseDate = 12/27/2011
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Fri May 10 05:16:12.973 2013 (UTC + 6:00)
Loading Dump File [C:\Users\Koolkat77\SysnativeBSODApps\051013-39437-01.dmp]
Built by: 7601.18044.amd64fre.win7sp1_gdr.130104-1431
System Uptime: 0 days 0:06:20.206
*** WARNING: Unable to verify timestamp for AtihdW76.sys
*** ERROR: Module load completed but symbols could not be loaded for AtihdW76.sys
Probably caused by : AtihdW76.sys ( AtihdW76+4446 )
BugCheck 1000007E, {ffffffffc0000005, fffff880071dd446, fffff880031c47e8, fffff880031c4040}
BugCheck Info: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
Bugcheck code 1000007E
Arguments: 
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880071dd446, The address that the exception occurred at
Arg3: fffff880031c47e8, Exception Record Address
Arg4: fffff880031c4040, Context Record Address
PROCESS_NAME:  System
BUGCHECK_STR:  0x7E
FAILURE_BUCKET_ID:  X64_0x7E_AtihdW76+4446
SystemManufacturer = To Be Filled By O.E.M.
SystemProductName = To Be Filled By O.E.M.
BiosVersion = P1.70
BiosReleaseDate = 10/19/2011
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Fri Apr 12 05:31:15.857 2013 (UTC + 6:00)
Loading Dump File [C:\Users\Koolkat77\SysnativeBSODApps\041213-58640-01.dmp]
Built by: 7601.18044.amd64fre.win7sp1_gdr.130104-1431
System Uptime: 0 days 1:08:58.480
Probably caused by : Ntfs.sys ( Ntfs! ?? ::NNGAKEGL::`string'+609f )
BugCheck D1, {fffff88001315e84, 2, 8, fffff88001315e84}
BugCheck Info: DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
Bugcheck code 000000d1
Arguments: 
Arg1: fffff88001315e84, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: fffff88001315e84, address which referenced memory
BUGCHECK_STR:  0xD1
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_0xD1_CODE_AV_BAD_IP_Ntfs!_??_::NNGAKEGL::_string_+609f
SystemManufacturer = To Be Filled By O.E.M.
SystemProductName = To Be Filled By O.E.M.
BiosVersion = P1.70
BiosReleaseDate = 10/19/2011
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

doveman007 · 11 May 2013

Thanks, I've already uninstalled the mentioned apps. I have no problem with Daemon Tools on two other systems but I do uninstall the sptd driver.

I need ZoneAlarm for the Firewall (both incoming and outgoing) so I don't think MSE is a suitable replacement. I'll try installing it again once everything is stable and if it still causes problems, try Comodo which I use on my other systems. I use Avira Antivir for my antivirus on those without problems.

I've done an overnight memtest. I just did sfc /scannow and it reported

Verification 100% complete.
Windows Resource Protection found corrupt files but was unable to fix some of them.

I've attached the CBS.log which doesn't mean much to me but seems to show a lot of errors.

koolkat77 · 11 May 2013

Those logs are not my area of expertise but I will call a friend to this thread.
I'd recommend Avast! av better than Zone alarm, Comodo or Avira.

You could still used MSE till the time your BSOD issues are solved then go back to ZA.

tom982 · 11 May 2013

Hello doveman007 and welcome to the forums

koolkat77 has asked me to take a look at this thread for you. Your CBS log doesn't contain the SFC results so we'll have to look at the archived logs:

Export CBS folder

Click the Start button then click Computer.
Double-click on the C: drive, under the Hard Disk Drives category, and then scroll down to, and double click on the Windows folder.
Find and double click on the Logs folder.
Right-click on the CBS folder, and select Copy.
Go back to your Desktop, right-click on it, and select Paste. You should now see a copy of the CBS folder appear on your Desktop called CBS.
Right-click on this new folder, and navigate through Send to, and select Compressed (zipped) folder.
A new file, also called CBS (CBS.zip), but this time with a different icon, will be created.

Post the CBS.zip folder please!

Tom

doveman007 · 11 May 2013

Hi tom982

Thanks for offering to take a look. CBS folder is attached as requested

tom982 · 12 May 2013

Hi doveman007,

Your CBS log is showing two corrupt files:

Code:

2013-05-11 16:16:30, Info                  CSI    000004e1 [SR] Repairing 1 components
2013-05-11 16:16:30, Info                  CSI    000004e2 [SR] Beginning Verify and Repair transaction
2013-05-11 16:16:30, Info                  CSI    000004e3 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
  Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2013-05-11 16:16:30, Info                  CSI    000004e4 [SR] Cannot repair member file [l:22{11}]"termsrv.dll" of Microsoft-Windows-TerminalServices-RemoteConnectionManager, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-05-11 16:16:30, Info                  CSI    000004e5 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
  Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2013-05-11 16:16:30, Info                  CSI    000004e6 [SR] Cannot repair member file [l:22{11}]"termsrv.dll" of Microsoft-Windows-TerminalServices-RemoteConnectionManager, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-05-11 16:16:30, Info                  CSI    000004e7 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2013-05-11 16:16:30, Info                  CSI    000004e8 Hashes for file member \??\C:\Windows\System32\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
  Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2013-05-11 16:16:30, Info                  CSI    000004e9 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
  Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2013-05-11 16:16:30, Info                  CSI    000004ea [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"termsrv.dll"; source file in store is also corrupted
2013-05-11 16:16:30, Info                  CSI    000004eb Repair results created:
POQ 130 starts:
     0: Set Key Value: Key = [l:168{84}]"\Registry\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Sysprep\Specialize", Value = [l:76{38}]"{6ae3a1a3-4737-ecc5-0218-900956130400}", Type = REG_SZ (1), Data = {l:116 b:43003a005c00570069006e0064006f00770073005c00530079007300740065006d00330032005c00730065007400750070005c007400730073007900730070007200650070002e0064006c006c002c00520043004d00530079007300500072006500700052006500730074006f00720065000000}


POQ 130 ends.
2013-05-11 16:16:30, Info                  CSI    000004ec [SR] Repair complete
2013-05-11 16:16:30, Info                  CSI    000004ed [SR] Committing transaction

SFCFix Script

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

Download SFCFix.exe (by niemiro) and save this to your Desktop.
Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.
Save any open documents and close all open windows.
On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
SFCFix will now process the script.
Upon completion, a files should be created on your Desktop: SFCFix.txt.
Copy (Ctrl + C) and Paste (Ctrl + V) the contents of this file into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.

https://dl.dropboxusercontent.com/u/...007/SFCFix.zip

Tom

doveman007 · 13 May 2013

Hi tom982

Thanks for that. There was so much in the CBS.log I thought there might be tons of problems, so glad it only appears to be two files.

Here's the SFCFIX report:

Code:

SFCFix version 1.5.1.0 by niemiro.
Start time: 2013-05-13 16:08:02.651
Using .zip script file at C:\Users\Steve\Desktop\SFCFix.zip

PowerCopy::
Failed to create new datablock for file or folder C:\Windows\Sysnative\termsrv.dll with error code 1.
Failed to create new datablock for file or folder C:\Windows\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll with error code 1.
The file \\?\C:\Windows\Sysnative\termsrv.dll is in use and must be replaced over a reboot.
The file \\?\C:\Windows\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll is in use and must be replaced over a reboot.
Successfully pended file for replace over reboot: \\?\C:\Windows\Sysnative\termsrv.dll
Successfully pended file for replace over reboot: \\?\C:\Windows\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll
PowerCopy:: directive failed to complete successfully.

Reboot:: directive completed successfully.

PostRebootCorruptionDetection::
Hash failure for file \\?\C:\Windows\Sysnative\termsrv.dll.
Expected: b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=
Found: QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=
Hash failure for file \\?\C:\Windows\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll.
Expected: b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=
Found: QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=
PostRebootCorruptionDetection:: directive failed to complete successfully.

PostRebootRestorePermissions::
Successfully restored ownership for C:\Windows\Sysnative\termsrv.dll
Successfully restored permissions on C:\Windows\Sysnative\termsrv.dll
Successfully restored ownership for C:\Windows\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll
Successfully restored permissions on C:\Windows\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll
PostRebootRestorePermissions:: directive completed successfully.

Failed to process all directives successfully.
SFCFix version 1.5.1.0 by niemiro has completed.
Currently storing 2 datablocks.
Finish time: 2013-05-13 16:10:40.040
----------------------EOF-----------------------

EDIT: There do appear to still be some permission issues. I just tried to install Wordview and it almost completed but when it got to Writing System Registry Values it said:

"Product: Microsoft Office Word Viewer 2003 -- Error 1406. Setup cannot write the value ShowDates to the registry key \Software\Microsoft\Office\11.0\Common\LanguageResources. Verify that you have sufficient permissions to access the registry or contact Microsoft Product Support Services (PSS) for assistance. For information about how to contact PSS, see ."

I had a look and under Current User that path exists to Common\ but there's no LanguageResources (perhaps the installer was trying to create that). The user and Administrators both have Full Control in that path but there's a RESTRICTED user that's set to Read-only.

tom982 · 13 May 2013

Hi Doveman,

I will get back to you as soon as possible with a new fix. In the mean time, can you post your MGADiag log please:

MGADiag

Download MGADiag (by Microsoft) from the link below:

http://go.microsoft.com/fwlink/?linkid=52012
Run the tool by double clicking on the file. Press Continue when prompted
When it has finished, press Copy then Paste (Ctrl+V) this into your next post

Tom

tom982 · 13 May 2013

In addition to the above, if you still have that counterfeit ASUS license installed on your computer I'm afraid we won't be helping you over here either. But I'm more than happy for you to show me otherwise :)