Solved Sudden multiple BSOD - error 0x0000001e - Windows Home Prem 64-bit

lilacdragon · Feb 9, 2012

Hello, I'm a newbie to this, I have a 4-month-old Acer Aspire M1930 which is my work computer (I'm self employed). Two days ago, it suddenly started BSOD randomly as I try to attach a file to an email, or browse to locate an image, or even use the file search function.
After a forced shutdown pressing the main on/off switch, it will re-boot normally, and seems ok till suddenly, it goes again in the middle of some task.

I hadn't installed any new programs just before it started doing this but I did notice my MacAfeeSecurity Suite had done a major update, and Windows Update had also been busy.

Since MacAfee seems to have got even heavier in its eating up memory recently, (I've had Photoshop saying not enough memory, a couple of times) I took the plunge and got rid of MacAfee. I installed an AFG trial version instead. I also cleared out a lot of old files on the C drive and checked Acer and Windows for any recent updates.

But the BSOD is still happening....
...what can I do?

Dump files attached; (Great tutorial, jcgriff2!)
here's a summary of my System Specs:
Acer Aspire M1930 running Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
Intel(R) Core(TM) i3-2100 CPU @ 3.10GHz with an Intel(R) HD Graphics Family card. The hard drive is ST3500418AS Fixed hard disk media
C: Local Fixed Disc NFTS 222.95 GB
D: Local Fixed Disc NFTS 223.71 GB.
The computer is 4 months old and the OS was pre-installed.

Thanks so much....
Frances

Dave76 · Feb 10, 2012

Welcome to Seven Forums.

Did you run the McAfee Removal tool?
If not then follow the instructions on this link, there will be remnants still on your system.
How to uninstall or reinstall supported McAfee products using the McAfee Consumer Products Removal tool (MCPR.exe)

I recommend to un-install AVG for testing purposes.
Also run the AVG Remover(64bit) 2012 from this link:
AVG Download Tools site

Install MSE (free) while analyzing the crashes.
Microsoft Security Essentials*- Free Antivirus for Windows
Update it after it is installed.

You have 7 crashes in you dump file.

Starting from the oldest:
STOP 0x000000BE: ATTEMPTED_WRITE_TO_READONLY_MEMORY
Usual causes: Device driver, Memory

STOP 0x0000001E: KMODE_EXCEPTION_NOT_HANDLED
Usual causes: Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS
This indicates that a kernel-mode program generated an exception which the error handler did not catch.

Code:

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
SYMBOL_NAME:  afd! ?? ::GFJBLGFE::`string'+1370
MODULE_NAME: afd
IMAGE_NAME:  afd.sys - Ancillary Function Driver for WinSock
FAILURE_BUCKET_ID:  X64_0xBE_afd!_??_::GFJBLGFE::_string_+1370
-------------------------------------------------------------------------------------------------------------------------------------------------------
KMODE_EXCEPTION_NOT_HANDLED (1e)
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036bd100
MODULE_NAME: ksecdd
IMAGE_NAME:  ksecdd.sys - Kernel Security Support Provider Interface
--------------------------------------------------------------------------------------------------------------------------------------------------------
KMODE_EXCEPTION_NOT_HANDLED (1e)
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036ff100
MODULE_NAME: ksecdd
IMAGE_NAME:  ksecdd.sys - Kernel Security Support Provider Interface 
--------------------------------------------------------------------------------------------------------------------------------------------------------

The remaining crashes are the same as the last two.

All your drivers are up to date.

Check the Acer support site for a BIOS update.

From your System Event Logs:

Code:

Event[47]:
  Log Name: System
  Source: Service Control Manager
  Date: 2012-02-09T21:33:20.199
  Event ID: 7026
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: lilac
  Description: 
The following boot-start or system-start driver(s) failed to load: 
Beep
KSecPkg
msahci

Event[87]:
  Log Name: System
  Source: Service Control Manager
  Date: 2012-02-09T21:33:10.542
  Event ID: 7000
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: lilac
  Description: 
The Link-Layer Topology Discovery Mapper I/O Driver service failed to start due to the following error: 
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Event[144]:
  Log Name: System
  Source: Microsoft-Windows-WMPNSS-Service
  Date: 2012-02-09T21:21:22.000
  Event ID: 14319
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: lilac
  Description: 
Service 'WMPNetworkSvc' did not start because Group Policy is preventing Windows Media Player from sharing media with other devices.

Run sfc/scannow as recommended by JaidynM.

Then run memtest86+ for a minimum on 7 full passes with all RAM cards installed, best to run overnight.
Stop the test if you get any errors.
RAM - Test with Memtest86+

Let us know the results.

lilacdragon · Feb 10, 2012

Hi, Dave 76.
Thank you SO much for looking at this for me.

The second problem is now the terror of my computer life....
What is ksecdd.sys, and how do I repair it?

The first problem has never happened again. Should I be worried about that, too?

Frances

JaidynM · Feb 10, 2012

Try running an sfc/scannow command in an elevated command prompt. If errors are found, run it twice more with each scan followed by a reboot.
SFC /SCANNOW Command - System File Checker

Dave76 · Feb 10, 2012

Check my previous post, I have been updating as I find information.

The ksecdd.sys - Kernel Security Support Provider Interface is a Windows driver and likely the result and not the cause of the crash.

Run the McAfee removal tool.

Then un-install AVG, run it's removal tool.

Install MSE while we're working on this crash.

lilacdragon · Feb 10, 2012

Hi, JaidynM.
OK... done that. (Great tutorial by Brink

)
I now have this in the black pop-up:
C:\Windows\system32>sfc /scannow
"Verification 100% complete.
Windows Resource Protection did not find any integrity violations"

Has it fixed the problem? ..or just, can't see it?

Thanks so much. I really appreciate your help.
Frances

lilacdragon · Feb 10, 2012

Oh... I've just seen your new message, too, Dave76.
Thanks so much...

I'll try all these things and get back to you.
You guys are fantastic.
Frances

Dave76 · Feb 10, 2012

Looks like the SFC (System File Checker) is clear, no issues found.

Run the anti-virus removal tools and the memtest86+.

Let us know the results.

I will continue here:

Your Application Event Logs:

Code:

Event[14]:
  Log Name: Application
  Source: Microsoft-Windows-WMI
  Date: 2012-02-09T21:34:47.000
  Event ID: 10
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: lilac
  Description: 
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 
"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" 
because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Go to this MS link and follow the instructions there.
Event ID 10 is logged in the Application log after you install Service Pack 1 for Windows 7 or Windows Server 2008 R2

JaidynM · Feb 10, 2012

lilacdragon said:
Hi, JaidynM.
OK... done that. (Great tutorial by Brink )
I now have this in the black pop-up:
C:\Windows\system32>sfc /scannow
"Verification 100% complete.
Windows Resource Protection did not find any integrity violations"

Has it fixed the problem? ..or just, can't see it?

Thanks so much. I really appreciate your help.
Frances

Brink sure does make great tutorials.

Anyway, as Dave said the 'no integrity violations' means that no errors were found. In that department, you should be fine.

lilacdragon · Feb 11, 2012

Good morning, Dave and JaidynM.

I erased all traces of AVG and MacAfee using the tools.

Since I was disconnected from the internet, I didn't install the MS antivirus (was that wrong?)
I ran the memtest86+ all night and got 14 totally clean passes.
The results screen said:
Cached 2985M RSVD Mem 620K Mem map e820 Cache on ECC off Test Std
Pass 14 Errors and Ecc Errors 0

I reinstalled the AFG trial and checked my emails etc.. no problems..
Turned off Firefox and Windows LiveMail
Then I wondered whether I should update my Firefox so I right-clicked on it in the Start Menu but the moment I made a selection in the dialog box, I got BSOD.

I've rebooted, checked in here, just re-read your last message, Dave, and done the MS Event ID 10 repair.
I ran Acer Update and it said no new updates available; but did it also check the BIOS? I looked on their website BIOS page but I wasn't sure which one to choose; it warned me not to download anything unless I knew what I was doing... which I don't...

Any thoughts on what I should try next?

Frances

JaidynM · Feb 11, 2012

First of all, have you got any BSOD's of late?

lilacdragon · Feb 11, 2012

Hi, JaidynM.

I've been very wary of doing anything on the computer today... yes, it gave me BSOD this morning after I finished the memtest 86+, that's the BSOD I described above.

Since I repaired the MS EventID10, I haven't had one but I have only used the computer with the very minimum number of programs running together. For example, I've written an email before connecting to the internet. And turned off Photoshop before loading Excel.

I haven't tried any drop-down menus or inserting images.

Do you think I should? I'm trying to avoid BSODs in case they damage my machine or lose my data ...am I worrying needlessly?

Frances

Dave76 · Feb 12, 2012

Do you have any Image backups?

If not D/L the free Macrium Reflect and image your OS and Data partitions.
Best to keep the image file on a separate HDD or external HDD, if you have one.
You will need to store it in a separate partition from the one you want to restore.

Use your system normally, if you get any crashes upload the complete crash files.

lilacdragon · Feb 12, 2012

Hi, Dave.

Do you have any Image backups?

Is that the same as what my Windows Backup and Restore calls a "system image"? In that case, yes, I do.
I have two, one I made yesterday and one I made shortly after buying the computer (before I'd installed much at all).
I also made myself a set of "system repair discs" at that time; and I back up all my data once a week using the Windows Backup, onto an external HDD.

Should I use any of these? Would they help?

I know this sounds pathetically ignorant, but I don't really know what to expect if I do.
May I ask you a few "very silly noob questions", please? I want to learn, if I can...

1. I'm assuming the most recent system image and Restore Points will have the errors that are causing my problem embedded in them, is that right?
So I shouldn't use either of those unless desperate?

2. What is the difference between using a System Restore point, a System Image, and a System Repair Disc Set? What are the indications for using one rather than another?

3. What would I need to re-install if I used any of these early ones? - and would I lose any data files from my Data partition?

I'm sorry to take up your time. If there's a thread I should be reading to learn these things please just post it and feel free to do this:

icnic:

Many thanks,
Frances

lilacdragon · Feb 12, 2012

Oh dear, I spoke too soon.
It is crashing again - 4 times in the last hour, each time when I try to attach or upload something. The dialog box outline appears, blank white inside, then the BSOD...

After the second crash while trying to attach a file to an email, I made the crash zip file (attached).
But I got BSOD each time I tried to upload it here, so I put it on a flash drive and I'm using my husband's laptop to reach this forum.

All ideas very welcome!
Frances

Dave76 · Feb 13, 2012

lilacdragon said:
Hi, Dave.

Do you have any Image backups?

Click to expand...

Is that the same as what my Windows Backup and Restore calls a "system image"? In that case, yes, I do.
I have two, one I made yesterday and one I made shortly after buying the computer (before I'd installed much at all).
I also made myself a set of "system repair discs" at that time; and I back up all my data once a week using the Windows Backup, onto an external HDD.

It's the Windows backup utility.
There have been reports of it not working, when you try to restore the backup, if it has been moved from the default storage file location and/or stored on an external HDD.
Since it is all you have, we can try to get it to work if needed.

This Windows Seven Tutorial explains how to recover the Windows 7 image if it is not working as it should.
How to Restore your System with a Broken Windows 7 System Image

For the above reasons I prefer to use a third party app like Macrium Reflect. It is a very good free program used by many here on Seven Forums.
The backup image can be stored anywhere and be used to restore your OS easily.
I recommend to use it for your next backup image, after your system is stable.
This Tutorial explains how to use it.
Imaging with free Macrium Reflect

lilacdragon said:
Should I use any of these? Would they help?

I know this sounds pathetically ignorant, but I don't really know what to expect if I do.
May I ask you a few "very silly noob questions", please? I want to learn, if I can...

It is always a good practice to have backup images.
For now let's see if we can get your system stable before you try any backup restore options.

lilacdragon said:
1. I'm assuming the most recent system image and Restore Points will have the errors that are causing my problem embedded in them, is that right?
So I shouldn't use either of those unless desperate?

Yes, the recent restore points and system image will likely have the same issues.
Check your Restore Points and see what the dates are, we may try one, if it is before the issues began.

lilacdragon said:
2. What is the difference between using a System Restore point, a System Image, and a System Repair Disc Set? What are the indications for using one rather than another?

System Restore point and System Image are similar.
System restore point will re-set your OS to the date that the restore point was made, basically the programs, drivers and settings at that time. Leaving your data intact.
A System Image will return your OS to the exact state it was in on the day you made the System Backup, any programs and data from that point until now will be lost.

These Seven Forums Tutorials will help explain the functions and how to use them:
How to Do a System Restore in Windows 7
How to Do a System Image Recovery in Windows 7

If you have all of your personal data in a separate partition or HDD, then that data will not be changed or removed. This is why we recommend to keep your personal data in a separate partition or HDD from your OS.

System Repair Disc are a set of tools that can help you recover your OS.
Here is information on what the System Repair Disc can do:
How to Create a Windows 7 System Repair Disc

lilacdragon said:
3. What would I need to re-install if I used any of these early ones? - and would I lose any data files from my Data partition?

This is explained above, you will lose any installed programs or data stored on the OS partition.

lilacdragon said:
I'm sorry to take up your time. If there's a thread I should be reading to learn these things please just post it and feel free to do this:icnic:

Many thanks,
Frances

Your welcome, the linked tutorials will help explain how these tools work.
There are many excellent Windows Seven Forums Tutorials in the 'Tutorials' forum.

Let me know if you have any questions.

I'll run the dump files a little later.

Dave76 · Feb 13, 2012

This is a Kernel Security Support Provider Interface blamed crash, so the prime suspect is your Anti-virus.

Un-install AFG and/or AVG, don't install it again, so we can verify if it is the cause of the crashes.
It is AFG?
I thought you meant AVG, haven't heard of AFG.

You still have these AVG drivers showing up.
Run the AVG removal tool again: AVG Download Tools site

Code:

avgfwd6a avgfwd6a.sys Mon May 23 06:33:25 2011 (4DD98F35)
AVGIDSDriver AVGIDSDriver.Sys Mon Jul 11 06:36:37 2011 (4E1A2975)
AVGIDSEH AVGIDSEH.Sys Mon Jul 11 06:36:50 2011 (4E1A2982)
AVGIDSFilter AVGIDSFilter.Sys Mon Jul 11 06:37:05 2011 (4E1A2991)
avgldx64 avgldx64.sys Fri Oct 07 11:55:41 2011 (4E8E783D)
avgmfx64 avgmfx64.sys Mon Aug 08 11:41:46 2011 (4E3F5AFA)
avgrkx64 avgrkx64.sys Tue Sep 13 12:02:34 2011 (4E6ED5DA)
avgtdia  avgtdia.sys  Mon Jul 11 06:46:53 2011 (4E1A2BDD)

Install MSE for testing purposes. It won't have any issue with Windows 7 as it is from MS.
Microsoft Security Essentials*- Free Antivirus for Windows
Install the updates and run the 'Full Scan'.

When you have MSE installed and updated, through Windows update, Download and install Malwarebytes.
Be sure to update it before running the 'Perform Full Scan'.

Let us know the results.

Both of the recent crashes are the same Stop code and driver.
STOP 0x0000001E: KMODE_EXCEPTION_NOT_HANDLED
Usual causes: Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS

Code:

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
0xC0000005: STATUS_ACCESS_VIOLATION - A memory access violation occurred. 
[COLOR="Red"]IMAGE_NAME:  ksecdd.sys - Windows Kernel Security Support Provider Interface[/COLOR]
-------------------------------------------------------------------------------------------------------------------------------

From your System Event Log:

Code:

Event[39]:
  Log Name: System
  Source: Service Control Manager
  Date: 2012-02-12T14:44:38.684
  Event ID: 7026
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: lilac
  Description: 
The following boot-start or system-start driver(s) failed to load: 
Beep
[COLOR="Red"]KSecPkg[/COLOR]
msahci

A lot of these:

Code:

Event[256]:
  Log Name: System
  Source: Service Control Manager
  Date: 2012-02-12T13:53:12.348
  Event ID: 7001
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: lilac
  Description: 
The Server service depends on the Server SMB 1.xxx Driver service which failed to start because of the following error: 
The system cannot find the file specified.

lilacdragon · Feb 13, 2012

Hi, Dave.

AVG now completely removed using their tool.
MSE now installed, updated, and complete scan - all completely clean, nothing found
Malwarebytes now installed, updated, and complete scan - all completely clean, nothing found.

I checked System Restore; there are numerous restore points after all the problems started, but only two before that - when the computer was almost brand new. Oct 25th and Oct 22nd 2011.
But I have copies of all the programs I installed since then, somewhere. So if necessary I can go that route.

What are your thoughts on this missing file, and KsecPkg ?

Frances

Dave76 · Feb 14, 2012

Use your system normally and post any crash dumps if you crash.

Have seen AVG cause crashes in some systems, with luck this might be the case.

Will keep those two restore points in mind, may need to use them later.
If you want to get your system stable in less time you can use one of the restore points and re-install your programs.

lilacdragon · Feb 14, 2012

Hi, Dave.
I'm posting the new crash files using a laptop, again, because I now know exactly how to create a BSOD - this occurs each time, precisely when I try to select an item, in a pop-up window, to insert into an email or the forum file-uploader. BSOD occurs the splitsecond after the (empty, white) dialog box window appears on the screen.

So it isn't AVG or MacAfee.

I'm considering the Restore Point but I'd really like you to win this one for me! Any thoughts on whether I can fix the KSecPKg error? The report says that 4 plug and play devices including that one, are disabled. To my knowledge I've never disabled anything... What if I follow the message about "enabling" them, what will that do?

Thanks so much for your help so far, I really appreciate this.
Frances

Solved Sudden multiple BSOD - error 0x0000001e - Windows Home Prem 64-bit

New member

My Computer My Computer

At a glance

Endeavor to Persevere

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

BSOD Dump Analyst

My Computer My Computer

At a glance

Endeavor to Persevere

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Endeavor to Persevere

My Computer My Computer

At a glance

BSOD Dump Analyst

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

BSOD Dump Analyst

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Endeavor to Persevere

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Endeavor to Persevere

My Computer My Computer

At a glance

Endeavor to Persevere

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Endeavor to Persevere

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer