Windows 7: I need BSOD encryption Help, Windb-script available

DemoDoener · 09 Apr 2010

Hi there,

i built a new machine one or two month ago and installed Windows 7 x64 ultimate.

from the first day i got blue screens without warning. in addition to that, sometimes i get many (up to 10 in 5 minutes) programcrashes (mainly windowsexplorer and firefox) and sometimes i got none or nearly none (one in 2 or 3 hours or so).

after writing down stop-codes (mainly x3B), Stop-Messages (normally System_Service_Exception) and affected files (win32k.sys usually) and after googeling around for finding tools "analysing" BSODs i was still helpless so i decided to post my problem here, hoping, anyone to find who can deal with it.

My System Specs are in my profile, Windb-script is attached.

RAM is checked by Memtest86/Memtest (Ultimate Boot CD) for hours (night) and has no error.
Same with CPU, tested with Prime and another Programm vom UMCD. (i did not use Prime95, because it uses windows so that you could not say if its a crash by windows or by prime95)

The Windb-Script is the latest one. I dont got many crashdumps because i - not knowing what i was doing - probably chose the wrong option. anyway, this one is like most of the others where (x3B, Win32k.sys affected).

I chose this board, because it seems to be very active and has its own crash section. i hope, someone can help me with that. thank you for reading.

DemoDoener

PS: i will attach the logs i made myself from "small" program crashes aswell.

zigzag3143 · 09 Apr 2010

Quote: Originally Posted by DemoDoener

Hi there,

i built a new machine one or two month ago and installed Windows 7 x64 ultimate.

from the first day i got blue screens without warning. in addition to that, sometimes i get many (up to 10 in 5 minutes) programcrashes (mainly windowsexplorer and firefox) and sometimes i got none or nearly none (one in 2 or 3 hours or so).

after writing down stop-codes (mainly x3B), Stop-Messages (normally System_Service_Exception) and affected files (win32k.sys usually) and after googeling around for finding tools "analysing" BSODs i was still helpless so i decided to post my problem here, hoping, anyone to find who can deal with it.

My System Specs are in my profile, Windb-script is attached.

RAM is checked by Memtest86/Memtest (Ultimate Boot CD) for hours (night) and has no error.
Same with CPU, tested with Prime and another Programm vom UMCD. (i did not use Prime95, because it uses windows so that you could not say if its a crash by windows or by prime95)

The Windb-Script is the latest one. I dont got many crashdumps because i - not knowing what i was doing - probably chose the wrong option. anyway, this one is like most of the others where (x3B, Win32k.sys affected).

I chose this board, because it seems to be very active and has its own crash section. i hope, someone can help me with that. thank you for reading.

DemoDoener

PS: i will attach the logs i made myself from "small" program crashes aswell.

We actually need the DMP files. Use these to find them and upload them. http://www.sevenforums.com/crash-loc...d-problem.html

Thanks

Ken

Jonathan_King · 09 Apr 2010

Welcome!

Seems like you have done a bit of testing already. I suggest testing your hard drive also: Hard Drive Diagnostics Tools and Utilities (Storage) - TACKtech Corp.

Where did you get your copy of Windows 7? You may try running the SFC command, and/or a repair install.

DemoDoener · 11 Apr 2010

Hello again.

Thanks for your help, sofar.

i just zipped my minidumps and will attach them to this post.

but i did some more.

i installed ubuntu next to my Windows 7 system and let it run for roundabout 24 hours. i also copied some hundred GB from my usb-disk to my HDDs, a process, Windows 7 got BSODs everytime, before i could finish. No crash or anything happened. However this is probably not a proof but an indication for that the problem is not my system but my Windows 7 (thank god!).

i also did SFC /Scannow. It found problems and could NOT repair them. So, i suppose, this could be the problem causing all the BSODs, because often Systemfiles (i suppose win32k is an important sfc-scannow-related file) were affected.

So, well. i think i will try reinstalling the OS but anyway, i would be very glad if someone could tell me anything looking at my minidumps. Just reinstalling might work for me, but i would like to know why it worked

Thanks so far and see ya

DemoDoener

Jonathan_King · 11 Apr 2010

It looks like Avast is causing the problem. Uninstall completely and download a fresh copy, or install Microsoft Security Essentials instead.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Jonathan\AppData\Local\Temp\Temp6_Minidump.zip\040910-10982-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`01c58000 PsLoadedModuleList = 0xfffff800`01e95e50
Debug session time: Fri Apr  9 12:28:21.091 2010 (GMT-4)
System Uptime: 0 days 2:30:17.230
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
......
Unable to load image aswMonFlt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswMonFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for aswMonFlt.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff8800d13b69b, fffff88002174a98, fffff880021742f0}

Probably caused by : aswMonFlt.sys ( aswMonFlt+569b )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8800d13b69b, The address that the exception occurred at
Arg3: fffff88002174a98, Exception Record Address
Arg4: fffff880021742f0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
aswMonFlt+569b
fffff880`0d13b69b 49396a20        cmp     qword ptr [r10+20h],rbp

EXCEPTION_RECORD:  fffff88002174a98 -- (.exr 0xfffff88002174a98)
ExceptionAddress: fffff8800d13b69b (aswMonFlt+0x000000000000569b)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff880021742f0 -- (.cxr 0xfffff880021742f0)
rax=ffebfffffffffffb rbx=0000000000003080 rcx=fffff8800d148b00
rdx=0000000000000000 rsi=fffff8a010a00000 rdi=fffff8a00130d258
rip=fffff8800d13b69b rsp=fffff88002174cd0 rbp=01cad7e885d0ad21
 r8=0000000000000000  r9=000000000000744b r10=ff5ff8a0109fffd8
r11=0000000000004000 r12=fffff8a0012d3000 r13=fffff8a00e5da000
r14=0000000000000000 r15=fffff88001e61f40
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
aswMonFlt+0x569b:
fffff880`0d13b69b 49396a20        cmp     qword ptr [r10+20h],rbp ds:002b:ff5ff8a0`109ffff8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001f000e0
 ffffffffffffffff 

FOLLOWUP_IP: 
aswMonFlt+569b
fffff880`0d13b69b 49396a20        cmp     qword ptr [r10+20h],rbp

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff88001e61f40 to fffff8800d13b69b

STACK_TEXT:  
fffff880`02174cd0 fffff880`01e61f40 : 00000000`00000000 fffff880`0d13b920 00000000`00000000 00000000`00000000 : aswMonFlt+0x569b
fffff880`02174cd8 00000000`00000000 : fffff880`0d13b920 00000000`00000000 00000000`00000000 fffff880`0d13b920 : 0xfffff880`01e61f40


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  aswMonFlt+569b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: aswMonFlt

IMAGE_NAME:  aswMonFlt.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4b0c7123

STACK_COMMAND:  .cxr 0xfffff880021742f0 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_aswMonFlt+569b

BUCKET_ID:  X64_0x7E_aswMonFlt+569b

Followup: MachineOwner
---------

DemoDoener · 12 Apr 2010

Hey again,

thanks for the answer.

i suppose you think avast is the problem, because in this dumpfile "aswMonFlt.sys" is the affected file, is that right?

in this case i'd be not that covinced about, because in most other cases (in dumpfiles, but even more often in bluescreens that were not logged because i had a wrong setup about this) another file was inflicted: Win32k.sys for the - i think - most often example (mini.txt is a windb-report about a win32k.sys bluescreen).

After seeing ubuntu seems to run fine (even being installed on the SSD aswell) and the results of the SFC-scan im afraid i will have to make a re/pair install.

On the other hand.. maybe i should try to uninstall avast and have a look for what happens then. but im not very optimistic that this will help.

so i still would be glad to hear ideas of explanations, if anybody still has one.

But however, i thank you very much for the help so far.

Jonathan_King · 12 Apr 2010

Avast is not known to cause BSODs (unlike AVG and ZoneAlarm), so if you just uninstall it and install a fresh copy, you should be good.

When it points to a system file, like win32k.sys, there is usually another cause.

Windows 7: I need BSOD encryption Help, Windb-script available

I need BSOD encryption Help, Windb-script available problems?