BSOD 1033--at my wits' end

kksdragons · 04 Dec 2010

And not that many wits left!

Attached is the diagnostic info you requested. In addition:

Is Windows 7 . . .
- x86 (32-bit)
- the original installed OS on the system? XP3
- an OEM or full retail version? new OEM I purchased and installed

- What is the age of system (hardware)? c. 2 years or so
- What is the age of OS installation (have you re-installed the OS?) Installed 7 Pro over XP3 not quite a month ago.

Other notes:

PC is homebuilt.
I tried doing a reinstall (per your instructions) but it blew up and said it couldn't access the files or something was corrupted. (Yes, cleaned disk.)
Ran sfc /scannow and at 46%, I got Windows Resource Protection couldnot perform the requested operation. (!)
Per reports in the zip file, I don't know why it doesn't find an AV. I have AVG installed, updated and it's running fine (except it keeps having to do the same updates everytime the system crashes and needs to be restored).
I know I have a device problem with "1394 OHCI Compliant Host Controller" but since I don't know what it is (and can't seem to update the driver), I'm stuck. If you can tell me how to update the driver (Code 10 so it's not starting), I'd appreciate it. Can't seem to find anything diffinitive online. (This can't be the problem causing the BSODs--that'd be too easy.)
And I've had issues with permissions for a lot of my own folders and files! I have Admin permissions but still get "you don't have permission to access this..." a lot. (I work from home on this PC and back up client files to my slave and an external HD and I can't access them????). CanNOT seem to fix this!! I am truly hating the security crap in Win 7. About ready to go back to XP3!

Also having these issues repeatedly but not sure if they're related to or causing the BSODs:

Faulting application name: SearchIndexer.exe, version: 7.0.7600.16385, time stamp: 0x4a5bd212
Faulting module name: ESENT.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdf7c
Exception code: 0xc0000005
Fault offset: 0x00000000001a9e84
Faulting process id: 0x1d0
Faulting application start time: 0x01cb931b5686a09d
Faulting application path: C:\Windows\system32\SearchIndexer.exe
Faulting module path: C:\Windows\system32\ESENT.dll
Report Id: bba62ec9-ff11-11df-8f10-002354a99570
-System
-Provider[ Name] Microsoft-Windows-Kernel-Power[ Guid] {331C3B3A-2005-44C2-AC5E-77220C37D6B4}
EventID41Version2Level1Task63Opcode0Keywords0x8000000000000002-TimeCreated[ SystemTime] 2010-12-04T16:07:57.947221900Z
EventRecordID15157Correlation-Execution[ ProcessID] 4[ ThreadID] 8
ChannelSystemComputerdragon-1-Security[ UserID] S-1-5-18

-EventData
BugcheckCode26BugcheckParameter10x5002BugcheckParameter20xfffff70001080000BugcheckParameter30x5642BugcheckParameter40x40005643fffffffeSleepInProgressfalsePowerButtonTimestamp0

Plus a slew of other errors.

PLEASE help this frustrated granny!!!

Thanks!

(I'm just happy it hasn't crashed while doing all this!)

CarlTR6 · 04 Dec 2010

Hi, kks, and welcome to the forum.

To begin your troubleshooting, I recommend that you uninstall AVG using this removal tool: Tool (64 bit). If you AVG Identity Protection installed, remove it with tool: Tool. AVG is a known cause of BSOD's on some Win 7 systems. Download and install Microsoft Security Essentials in its place.

You have an almost guaranteed BSOD maker on your system:

Code:

ASACPI.sys   Sun Mar 27 22:30:36 2005

The 2005 version of this driver is a known BSOD cause. It is an XP driver and will not work with Win 7.
Please visit this link: ASUSTeK Computer Inc.-Support- download_item_mkt
Scroll down to the Utilities category, then scroll down to the "ATK0110 driver for WindowsXP/Vista/Windows 7 32&64-bit " (it's about the 8th item down).
Download and install it.
Go to C:\Windows\System32\drivers to check and make sure that the ASACPI.sys file is date stamped from 2009 or 2010 (NOT 2005).

Because one of your dumps indicates your NTFS file system, I suggest that you run Check Disk.

Run CHKDSK /R /F from an elevated (Run as adminstrator) Command Prompt. Please do this for each hard drive on your system.
When it tells you it can't do it right now - and asks you if you'd like to do it at the next reboot - answer Y (for Yes) and press Enter. Then reboot and let the test run. It may take a while for it to run, but keep an occasional eye on it to see if it generates any errors. See "CHKDSK LogFile" below in order to check the results of the test.

Elevated Command Prompt:
Go to Start and type in "cmd.exe" (without the quotes)
At the top of the Search Box, right click on Cmd.exe and select "Run as administrator"

CHKDSK LogFile:
Go to Start and type in "eventvwr.msc" (without the quotes) and press Enter
Expand the Windows logs heading, then select the Application log file entry.
Double click on the Source column header.
Scroll down the list until you find the Chkdsk entry (wininit for Windows 7) (winlogon for XP).

Copy/paste the results into your next post.

Code:

Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a56000 PsLoadedModuleList = 0xfffff800`02c93e50
Debug session time: Sat Dec  4 10:40:04.498 2010 (GMT-5)
System Uptime: 0 days 7:25:41.371
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5002, fffff70001080000, 5642, 40005643fffffffe}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29f42 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005002, The subtype of the bugcheck.
Arg2: fffff70001080000
Arg3: 0000000000005642
Arg4: 40005643fffffffe

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_5002

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002b35e43 to fffff80002ac6740

STACK_TEXT:  
fffff880`066569c8 fffff800`02b35e43 : 00000000`0000001a 00000000`00005002 fffff700`01080000 00000000`00005642 : nt!KeBugCheckEx
fffff880`066569d0 fffff800`02ae09c6 : 00000000`00000000 00000000`07e1bff8 fffff880`06656c20 fffff680`0003f0d8 : nt! ?? ::FNODOBFM::`string'+0x29f42
fffff880`06656ac0 fffff800`02ac482e : 00000000`00000000 00000000`01f5d110 00000000`00000001 00000000`01f5ae60 : nt!MmAccessFault+0x5c6
fffff880`06656c20 000007fe`eb173abf : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`019bbbf0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`eb173abf


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+29f42
fffff800`02b35e43 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+29f42

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+29f42

BUCKET_ID:  X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+29f42

Followup: MachineOwner
---------

Debug session time: Fri Dec  3 13:49:30.114 2010 (GMT-5)
System Uptime: 0 days 0:08:24.987
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88002db6588, fffff88002db5df0, fffff80002aafd4e}

Probably caused by : fileinfo.sys ( fileinfo!FIStreamCleanup+4a )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88002db6588
Arg3: fffff88002db5df0
Arg4: fffff80002aafd4e

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88002db6588 -- (.exr 0xfffff88002db6588)
ExceptionAddress: fffff80002aafd4e (nt!ExfAcquirePushLockExclusive+0x000000000000001e)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88002db5df0 -- (.cxr 0xfffff88002db5df0)
rax=fffffa80036feb60 rbx=fffff8a00da9e820 rcx=fff7fa800547ad78
rdx=0000000000000008 rsi=0000000000000000 rdi=fff7fa800547ad78
rip=fffff80002aafd4e rsp=fffff88002db67c0 rbp=0000000000000000
 r8=ffffffffffffffff  r9=ffffffffffffffff r10=fffff880009e9960
r11=fffff88002db6820 r12=0000000000000703 r13=0000000000000000
r14=fffffa800441dc28 r15=fffff8a00db05ac0
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!ExfAcquirePushLockExclusive+0x1e:
fffff800`02aafd4e 488b19          mov     rbx,qword ptr [rcx] ds:002b:fff7fa80`0547ad78=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cb70e0
 ffffffffffffffff 

FOLLOWUP_IP: 
fileinfo!FIStreamCleanup+4a
fffff880`010c36fa 488b4308        mov     rax,qword ptr [rbx+8]

FAULTING_IP: 
nt!ExfAcquirePushLockExclusive+1e
fffff800`02aafd4e 488b19          mov     rbx,qword ptr [rcx]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff880010c36fa to fffff80002aafd4e

STACK_TEXT:  
fffff880`02db67c0 fffff880`010c36fa : fffff8a0`0da9e820 00000000`00000000 fffff8a0`0da9e820 00000000`00000000 : nt!ExfAcquirePushLockExclusive+0x1e
fffff880`02db6840 fffff880`00c4365e : fffff8a0`0391a640 00000000`00000000 ffffffff`ffffffff fffffa80`0441dc70 : fileinfo!FIStreamCleanup+0x4a
fffff880`02db6890 fffff880`00c5f22d : fffff8a0`0da9e7d8 fffff880`00c35000 00000000`00000000 fffff880`012c1d81 : fltmgr!DoFreeContext+0x7e
fffff880`02db68c0 fffff880`00c5abc1 : fffffa80`05f57010 00000000`00000130 fffff8a0`0db057b0 fffff8a0`0db057b0 : fltmgr! ?? ::NNGAKEGL::`string'+0x1196
fffff880`02db68f0 fffff880`00c5ab7b : fffffa80`05f57010 fffff8a0`0db05ac0 fffffa80`05f57010 fffff8a0`0db06000 : fltmgr!CleanupStreamListCtrl+0x21
fffff880`02db6920 fffff800`02d6e896 : 00000000`00000001 00000000`00000000 fffff8a0`0db05ac0 00000000`00000000 : fltmgr!DeleteStreamListCtrlCallback+0x6b
fffff880`02db6950 fffff880`012c8bcc : fffff8a0`0db057b0 fffffa80`036feb60 fffff880`02db6a28 00000000`00000706 : nt!FsRtlTeardownPerStreamContexts+0xe2
fffff880`02db69a0 fffff880`012c88d5 : 00000000`00000000 00000000`00000000 fffff800`02c24500 00000000`00000001 : Ntfs!NtfsDeleteScb+0x108
fffff880`02db69e0 fffff880`0123bcb4 : fffff8a0`0db056b0 fffff8a0`0db057b0 fffff800`02c24500 fffff880`02db6b52 : Ntfs!NtfsRemoveScb+0x61
fffff880`02db6a20 fffff880`012c62dc : fffff8a0`0db05680 fffff800`02c245a0 fffff880`02db6b52 fffffa80`06259a40 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`02db6a50 fffff880`01244882 : fffffa80`06259a40 fffffa80`06259a40 fffff8a0`0db05680 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xdc
fffff880`02db6ad0 fffff880`012dd813 : fffffa80`06259a40 fffff800`02c245a0 fffff8a0`0db05680 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`02db6b10 fffff880`012b738f : fffffa80`06259a40 fffff8a0`0db057b0 fffff8a0`0db05680 fffffa80`048bd180 : Ntfs!NtfsCommonClose+0x353
fffff880`02db6be0 fffff800`02a8c961 : 00000000`00000000 fffff880`04768500 fffffa80`036feb01 fffff880`00000003 : Ntfs!NtfsFspClose+0x15f
fffff880`02db6cb0 fffff800`02d23c06 : 79726f67`65746143 fffffa80`036feb60 00000000`00000080 fffffa80`036e9040 : nt!ExpWorkerThread+0x111
fffff880`02db6d40 fffff800`02a5dc26 : fffff880`009e8180 fffffa80`036feb60 fffff880`009f2f40 00720062`0069004c : nt!PspSystemThreadStartup+0x5a
fffff880`02db6d80 00000000`00000000 : fffff880`02db7000 fffff880`02db1000 fffff880`02db69f0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  fileinfo!FIStreamCleanup+4a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: fileinfo

IMAGE_NAME:  fileinfo.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc481

STACK_COMMAND:  .cxr 0xfffff88002db5df0 ; kb

FAILURE_BUCKET_ID:  X64_0x24_fileinfo!FIStreamCleanup+4a

BUCKET_ID:  X64_0x24_fileinfo!FIStreamCleanup+4a

Followup: MachineOwner
---------

1: kd> lmtsmn
start             end                 module name
fffff880`00f5a000 fffff880`00fb1000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`0380d000 fffff880`03897000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04b33000 fffff880`04b49000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`03b61000 fffff880`03b78000   amdk8    amdk8.sys    Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`00c2a000 fffff880`00c35000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`04ad9000 fffff880`04ae1000   ASACPI   ASACPI.sys   Sun Mar 27 22:30:36 2005 (42476C4C)
fffff880`06762000 fffff880`0676d000   asyncmac asyncmac.sys Mon Jul 13 20:10:13 2009 (4A5BCCE5)
fffff880`00e9a000 fffff880`00ea3000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00c00000 fffff880`00c2a000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`03c08000 fffff880`043fd000   atikmdag atikmdag.sys Tue Oct 26 22:29:53 2010 (4CC78EA1)
fffff880`03b78000 fffff880`03bc3000   atikmpag atikmpag.sys Tue Oct 26 22:14:23 2010 (4CC78AFF)
fffff960`00920000 fffff960`00981000   ATMFD    ATMFD.DLL    unavailable (00000000)
fffff880`010a4000 fffff880`010ae000   AVGIDSEH AVGIDSEH.Sys Mon Sep 13 18:46:38 2010 (4C8EA9CE)
fffff880`03aec000 fffff880`03b3b000   avgldx64 avgldx64.sys Mon Sep 06 20:49:29 2010 (4C858C19)
fffff880`02acc000 fffff880`02adb000   avgmfx64 avgmfx64.sys Mon Sep 06 20:49:14 2010 (4C858C0A)
fffff880`013f0000 fffff880`013fa000   avgrkx64 avgrkx64.sys Mon Sep 06 20:49:37 2010 (4C858C21)
fffff880`02b90000 fffff880`02bf1000   avgtdia  avgtdia.sys  Tue Nov 09 15:13:33 2010 (4CD9AB6D)
fffff880`02ae4000 fffff880`02aeb000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`03adb000 fffff880`03aec000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`033a6000 fffff880`033c4000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`00710000 fffff960`00737000   cdd      cdd.dll      unavailable (00000000)
fffff880`02aa2000 fffff880`02acc000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00d09000 fffff880`00dc9000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`01074000 fffff880`010a4000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00cab000 fffff880`00d09000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0112c000 fffff880`0119f000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`04b23000 fffff880`04b33000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`05c0c000 fffff880`05c1a000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`03a3a000 fffff880`03abd000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`03abd000 fffff880`03adb000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`03989000 fffff880`03998000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`0121b000 fffff880`01231000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`05d73000 fffff880`05d95000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`05c26000 fffff880`05c2f000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`05c1a000 fffff880`05c26000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`05c2f000 fffff880`05c42000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`05c00000 fffff880`05c0c000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`04666000 fffff880`0475a000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 21:00:14 2009 (4AC5509E)
fffff880`0475a000 fffff880`047a0000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`04aaf000 fffff880`04abc000   fdc      fdc.sys      Mon Jul 13 20:00:54 2009 (4A5BCAB6)
fffff880`010ba000 fffff880`010ce000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`05cba000 fffff880`05cc5000   flpydisk flpydisk.sys Mon Jul 13 20:00:54 2009 (4A5BCAB6)
fffff880`00c35000 fffff880`00c81000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`01211000 fffff880`0121b000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`0103a000 fffff880`01074000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`0148b000 fffff880`014d5000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`02feb000 fffff800`03034000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`047a0000 fffff880`047c4000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`05cda000 fffff880`05d36000   HdAudio  HdAudio.sys  Mon Jul 13 20:06:59 2009 (4A5BCC23)
fffff880`05db7000 fffff880`05dd0000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`05dd0000 fffff880`05dd8080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`05da9000 fffff880`05db7000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`032de000 fffff880`033a6000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`015f3000 fffff880`015fc000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`04ae1000 fffff880`04aff000   i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`04aff000 fffff880`04b0e000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff800`00bb9000 fffff800`00bc3000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`02a45000 fffff880`02a88000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`013d6000 fffff880`013f0000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01460000 fffff880`0148b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`05d95000 fffff880`05d9a200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`04a2e000 fffff880`04a43000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`047c4000 fffff880`047e7000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00c8a000 fffff880`00c97000   mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Mon Jul 13 21:29:09 2009 (4A5BDF65)
fffff880`05c42000 fffff880`05c50000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`04a0b000 fffff880`04a1a000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`05dd9000 fffff880`05de6000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00dd9000 fffff880`00df3000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`033c4000 fffff880`033dc000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`03200000 fffff880`0322d000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`0322d000 fffff880`0327b000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`0327b000 fffff880`0329e000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`02b49000 fffff880`02b54000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00fba000 fffff880`00fc4000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`010ce000 fffff880`0112c000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`0397e000 fffff880`03989000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`015e1000 fffff880`015f3000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`014ef000 fffff880`015e1000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04b6d000 fffff880`04b79000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`04b79000 fffff880`04ba8000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`05cc5000 fffff880`05cda000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`038c6000 fffff880`038d5000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`02a00000 fffff880`02a45000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01400000 fffff880`01460000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`02b54000 fffff880`02b65000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`03972000 fffff880`0397e000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02a0f000 fffff800`02feb000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`01233000 fffff880`013d6000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`02adb000 fffff880`02ae4000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`038a0000 fffff880`038c6000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`04abc000 fffff880`04ad9000   parport  parport.sys  Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`00e0d000 fffff880`00e22000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00fc4000 fffff880`00ff7000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00e93000 fffff880`00e9a000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00dc9000 fffff880`00dd9000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`01200000 fffff880`01211000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`04475000 fffff880`0451b000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`05de6000 fffff880`05df6000   point64  point64.sys  Tue Jun 29 04:54:31 2010 (4C29B4C7)
fffff880`05d36000 fffff880`05d73000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00c97000 fffff880`00cab000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`04b49000 fffff880`04b6d000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`04ba8000 fffff880`04bc3000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`04bc3000 fffff880`04be4000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`04be4000 fffff880`04bfe000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`03921000 fffff880`03972000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`04a00000 fffff880`04a0b000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`02b2e000 fffff880`02b37000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`02b37000 fffff880`02b40000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`02b40000 fffff880`02b49000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01000000 fffff880`0103a000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`04621000 fffff880`04639000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`03998000 fffff880`039ee000   Rt64win7 Rt64win7.sys Wed Jun 23 05:10:45 2010 (4C21CF95)
fffff880`0451b000 fffff880`04526000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`04b0e000 fffff880`04b1a000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`038d5000 fffff880`038f2000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`014e5000 fffff880`014ed000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`06607000 fffff880`0669d000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`04565000 fffff880`045cc000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`04526000 fffff880`04553000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`04a1a000 fffff880`04a1b480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01601000 fffff880`017fe000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`04553000 fffff880`04565000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`02b83000 fffff880`02b90000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`02b65000 fffff880`02b83000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`0390d000 fffff880`03921000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`005e0000 fffff960`005ea000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`03b3b000 fffff880`03b61000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`0669d000 fffff880`066f1000   udfs     udfs.sys     Mon Jul 13 19:23:37 2009 (4A5BC1F9)
fffff880`04a1c000 fffff880`04a2e000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`05da7000 fffff880`05da8f00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`04a9e000 fffff880`04aaf000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`05c60000 fffff880`05cba000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`0463e000 fffff880`04649000   usbohci  usbohci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`04a48000 fffff880`04a9e000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`05d9b000 fffff880`05da7000   usbprint usbprint.sys Mon Jul 13 20:38:18 2009 (4A5BD37A)
fffff880`00e00000 fffff880`00e0d000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`02aeb000 fffff880`02af9000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`02af9000 fffff880`02b1e000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`014d5000 fffff880`014e5000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00e22000 fffff880`00e37000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00e37000 fffff880`00e93000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`0119f000 fffff880`011eb000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`038f2000 fffff880`0390d000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`02b1e000 fffff880`02b2e000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00ea7000 fffff880`00f4b000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f4b000 fffff880`00f5a000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`03897000 fffff880`038a0000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`000c0000 fffff960`003cf000   win32k   win32k.sys   unavailable (00000000)
fffff880`04b1a000 fffff880`04b23000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`00fb1000 fffff880`00fba000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`04600000 fffff880`04621000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)

Unloaded modules:
fffff880`066f1000 fffff880`06762000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`011eb000 fffff880`011f9000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`010ae000 fffff880`010ba000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`00ff7000 fffff880`01000000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`02a8f000 fffff880`02aa2000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04600000 fffff880`0463e000   1394ohci.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000

kksdragons · 04 Dec 2010

Hi Carl! And thanks so much for your reply!

I've d/l'd the AVG removal tool and MS SE. Thought I'd try to update the ASUS driver first. Can't seem to update the driver... when I try thru Device Mgr, MS seems to like the (old-2006) version it has. There was no installer... just point to the new file on my DT and MS will not update!

Before I start on the rest of you instructions, how do I update this )$$#)& driver?? I'm afraid to just copy/paste the new file in the sys32/drivers folder and screw something else up.

KK:)

CarlTR6 · 04 Dec 2010

Don't update through Device Manager, download the update to your desktop, unzip and and click on the .exe file.

kksdragons · 05 Dec 2010

Took a few tries (on almost everything) but finally got all your above suggestions done. There are still a slew of errors, e.g. "{Registry Hive Recovered} Registry hive (file): '\??\Volume{34456367-e6cb-11df-813d-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{EF528856-4665-43E9-A2E8-5980643EBB1E}' was corrupted and it has been recovered. Some data might have been lost."

Not sure what this is but it's happened several times.

Here is the info from the chkdsk on my C drive:

Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
Attribute record of type 0x80 and instance tag 0x4 is cross linked
starting at 0x32d97b for possibly 0x1 clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x4
in file 0x20ffb is already in use.
Deleting corrupt attribute record (128, "")
from file record segment 135163.
215552 file records processed. File verification completed.
113 large file records processed. 0 bad file records processed. 2 EA records processed. 78 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
267214 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
215552 file SDs/SIDs processed. Cleaning up 251 unused index entries from index $SII of file 0x9.
Cleaning up 251 unused index entries from index $SDH of file 0x9.
Cleaning up 251 unused security descriptors.
Security descriptor verification completed.
Inserting data attribute into file 135163.
25833 data files processed. CHKDSK is verifying Usn Journal...
33886384 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
215536 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
229546887 free clusters processed. Free space verification is complete.
Windows has made corrections to the file system.
976657407 KB total disk space.
58040256 KB in 128200 files.
82944 KB in 25833 indexes.
0 KB in bad sectors.
346659 KB in use by the system.
65536 KB occupied by the log file.
918187548 KB available on disk.
4096 bytes in each allocation unit.
244164351 total allocation units on disk.
229546887 allocation units available on disk.
Internal Info:
00 4a 03 00 bc 59 02 00 1a 37 04 00 00 00 00 00 .J...Y...7......
ae 6a 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 .j..N...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.

BUT, I haven't seen a BSOD for several hours so feel I'm (we're) making progress!:) What next? (I suppose all the permission issues should go in a new thread?)

I appreciate your help, Greg! You rock!

CarlTR6 · 05 Dec 2010

Glad to hear your system is doing better. At least we are making progress. And you are welcome for the help.

Check Disk found some problems and corrected them. You have no bad sectors; so your hard drive is probably OK. Good job. Now I suggest that you run SFC. Open a command prompt as an Administrator. Tyep the command sfc /scannow. If it finds problems, run it at least three times.

Yes, the permission issues should go in a new thread.

kksdragons · 05 Dec 2010

Hi Greg,

I think I spoke too soon.

Woke up to a black screen with hi-res white arrow in the middle. Had to do a hard re-boot. LOTS of Event errors and still that BSOD 1033, plus a new one this AM I hadn't seen but it went by too fast for me to see what it was. I've run SFC several times and the corruption errors don't weem to be getting fixed. Seems like a fresh install/repair would be the best option but my PC now doesn't seem to like the darn Win 7 disc.

Maybe I should go back to XP3?

Attached is a zip file with four CBS logs from SFC runs, one from yesterday, three from today. Maybe you can understand all the gobblygook. Also added a file of some of the serious Events that are most prevalent as well as a function error I've been seeing.

Anything you can suggest, just let me know.

And, thank you for your service (military, not my computer issues).

CarlTR6 · 05 Dec 2010

Darn, and just when I thought things were getting better.

You are welcome for the service. It was an honor to have served my country for most of my life. There of my four kids also served. We are an Army family. :)

You forgot to attach the files. What is wrong with your Win 7 disk? If you can, do a repair install. Repair Install

kksdragons · 05 Dec 2010

Attachment 120966I must have forgotten to attach the zip.

My other half was in the 173rd Airborne in 'Nam so he was Army too. Silver Star and Purple Heart. And to think, it was "only" deemed a "police action!"

Did you see action there? (Was going to PM you about your service but couldn't figure out how to do that.)

Re: a repair install, See #2 in my original post.

My heartfelt thanks to your kids, too. Are they all home and safe? Middle East service?

Thanks, Carl!

CarlTR6 · 06 Dec 2010

Good morning, KK. If you got a BSOD with that crash, it did not get uploaded. I read through the error logs; but I could not pick out a cause. See if you can run SFC /SCANNOW from an elevated command prompt.

I thank you other half for his service. He did very well to have been awarded the Silver Star. I did not serve in Viet Nam. During that time, I was in other exotic and wonderful places. My oldest daugher and her hubby are ring knockers and they served their commitments and got out. My oldest son served as a helicopter pilot in the Gulf War, Kosovo, and the Iraq War. He recently retired from the Army. My youngest son was killed during a Bosnia rotation. Hence the Gold Star Flag in my sig. He was also a helicopter pilot.