Help with Bsod please!!

Jonathan_King · 13 Jun 2010

Looking at your new dmps, I still see SPTD.sys. Please run this SPTD installer/uninstaller, and uninstall it completely: DuplexSecure - Downloads

Code:

sptd.sys     Sun Oct 11 16:55:14 2009 (4AD24632)

Code:


BugCheck 1A, {41790, fffffa80012d2150, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
BugCheck 1A, {41790, fffffa8000d7b350, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨

jpwwong · 13 Jun 2010

Sorry if I sounded skeptical on my previous post - I did not mean to invalidate jcgriff2's analysis. Thank you for your uninstaller - i will try it again and remove NIS this time.

Thanks for your feedback.

jpwwong · 18 Jun 2010

I want to thank you Jonathan_king and jcgriff2 for your help in my problem. 4 days on and no BSOD! Seems to have worked! Thanks again, much appreciated.

Jonathan_King · 18 Jun 2010

Thank you, in return. You don't realize how few people report their solutions, especially in the Crashes section. People solve their problem and forget about whoever helped them.

You are in the <10% that take the time to report later.

jpwwong · 27 Jun 2010

Hi Guys,

Been having BSODs again, this time less frequent. I have removed daemon and NIS as instructed (i think) and now I think its something else thats crashing. Having read the dump, I'm just afraid that it is my HDD that is telling me that it's failing, so if it is then i'll change it before it does any damage!

Can someone help me out by analyzing the files please? Thanks!!

Jonathan_King · 27 Jun 2010

Please remove Kaspersky, for troubleshooting purposes. Here is a removal tool: http://support.kaspersky.com/downloa...vremover10.zip

Replace with Microsoft Security Essentials.

You may try a check disk as well. Open a command prompt and run chkdsk /r.

BSOD BUGCHECK SUMMARY

Code:


Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sat Jun 19 21:06:31.715 2010 (UTC - 4:00)
System Uptime: 0 days 2:04:56.135
BugCheck 1A, {41790, fffffa80012f6750, ffff, 0}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : win32k.sys ( win32k+b3bbd )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  everest.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sat Jun 19 05:13:14.463 2010 (UTC - 4:00)
System Uptime: 0 days 4:39:30.883
BugCheck 1A, {41790, fffffa8000d7c850, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  avp.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sun Jun 27 01:50:07.260 2010 (UTC - 4:00)
System Uptime: 0 days 3:10:51.662
BugCheck 24, {c08a2, 0, 0, 0}
Probably caused by : Ntfs.sys ( Ntfs!NtfsPagingFileIo+155 )
BUGCHECK_STR:  0x24
PROCESS_NAME:  sidebar.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sat Jun 19 12:10:56.289 2010 (UTC - 4:00)
System Uptime: 0 days 4:07:26.710
BugCheck 1A, {41790, fffffa8001340550, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  wlcomm.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨

jpwwong · 27 Jun 2010

Thanks Jonathan_king.

Is there a reason why I cannot use 3rd party security programs? FIrst it was NIS, then now its Kaspersky.

I know MSE is free and recommended, but would like the option to use other programs as well to protect my PC.

From your above analysis, is everest causing a problem as well?

Also, I can assume that nothing is wrong with my HDD right?

Thanks again

Jonathan_King · 27 Jun 2010

We can make no assumptions about your hard drive at this point. BSOD work is tricky, and there are a lot of possible factors.

As for Everest, it was running at the time of one of the crashes. If it was running in all of them, or most of them, I might suspect it. With just a single crash, I wouldn't worry about it.

As for third-party security programs. They are notorious for causing crashes in Vista and 7. An expert speculates it might have something to do with the additional security levels in Vista/7, that did not exist in XP.

BSOD work requires some level of guessing, speculation, and troubleshooting. We seek to eliminate as many factors as possible.

For the purposes of troubleshooting, let's remove Kaspersky. To be honest, I don't see why you want another program beside MSE, though. It is free and provides excellent security. Furthermore, it is very lightweight, meaning it does not slow your computer down as much as the bigger suites, such as Norton, Kaspersky, and McAfee.

jpwwong · 28 Jun 2010

Done with removing Kaspersky and installed MSE. Crashed 3 times today lol. Latest minidumps hopefully will tell something!

Thanks.

ttran · 28 Jun 2010

Has your processor been at 100% utilization lately? If you went to the Task Manager in Windows and looked at your processes tab, you may have noticed a process called msmpeng.exe eating up all your available CPU.

I don't know if this is true, but this is how I think and truly appologize if it is wrong. I can see the process running at the time computer crashed was MsMpEng.exe, that when I googled gave me the result that it belong to Window Defender as well as part of Window live One care.
Therefore turning Window Defender off or exclude it from scanning are the choices
Here is the article;
What is msmpeng.exe and how to remove it

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\TUANTR~1\AppData\Local\Temp\Rar$DI00.888\062810-16426-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*e:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e53000 PsLoadedModuleList = 0xfffff800`03090e50
Debug session time: Mon Jun 28 12:10:15.577 2010 (UTC + 7:00)
System Uptime: 0 days 0:46:59.623
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8000d4ce50, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8000d4ce50
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  MsMpEng.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002f36ede to fffff80002ec3600

STACK_TEXT:  
fffff880`0732f968 fffff800`02f36ede : 00000000`0000001a 00000000`00041790 fffffa80`00d4ce50 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0732f970 fffff800`02f04fca : 00000000`00000000 00000000`0974ffff fffffa80`00000000 fffffa80`05849060 : nt! ?? ::FNODOBFM::`string'+0x33946
fffff880`0732fb30 fffff800`02ec2853 : ffffffff`ffffffff 00000000`0207f128 00000000`0207f120 fffffa80`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`0732fc20 00000000`77c8009a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0207f0e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c8009a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+33946
fffff800`02f36ede cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+33946

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33946

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33946

Followup: MachineOwner
---------

Also, perform check disk
Disk Check

Code:

BugCheck 24, {c08a2, 0, 0, 0}

Probably caused by : Ntfs.sys ( Ntfs!NtfsPagingFileIo+155 )

Followup: MachineOwner
---------