BSODs and unstable Win7

tumblebug · 27 Jan 2011

Hi Carl

I've mentioned it a couple of times in previous posts but I'm already running Virtual PC 2007 now with SP1 and a couple of other little fixes (and I have been from the very beginning) :)

I remember quite alot of unreadable sector messages occuring during a full chkdsk run. I couldn't tell you if the machine fixed those errors or not 'cos I went to bed - its a 400G drive - a lot to check :) I'll run the HD Diag today to see if it gives anymore info. I usually store my files on the office network and/or source control, and since this is a new pc, I haven't accumulated huge pockets of files just yet. I'll try your other ideas with the other drivers as well today - see what happens eh?

Tim

CarlTR6 · 27 Jan 2011

Are you running the Win 7 version of Virtual PC? VMNetSrv.sys is not a Win 7 driver. From what I read, the SP1 is for the Vista/XP version. You can try to run the version you have in the Vista compatibility mode or you can install the Win 7 version.

Win 7 version: Windows Virtual PC: Home Page

Compatibility mode: Compatibility Mode

tumblebug · 27 Jan 2011

Hi Carl

Penny's finally dropped! Just been reading the links and I'll give that a whirl.

Tim

tumblebug · 27 Jan 2011

Update -

Just ran the error checking in HDTune and it found no errors - I tried to run the Hitachi DFT tool but it will not detect my harddrive (or my dvd drive for that matter) to perform the fitness test. I've email Hitachi about that.

Am getting Windows XP Mode and the Win 7 version of Windows Virtual PC - I dont want to mess about with Vista compatabilty modes. It looks like I can use my current VMC file so I (hopefully) won't lose my current crop of work.

CarlTR6 · 27 Jan 2011

tumblebug said:

Hi Carl

Penny's finally dropped! Just been reading the links and I'll give that a whirl.

Tim

LOL! Sometimes communication is difficult when we are not face to face,

tumblebug said:

Update -

Just ran the error checking in HDTune and it found no errors - I tried to run the Hitachi DFT tool but it will not detect my harddrive (or my dvd drive for that matter) to perform the fitness test. I've email Hitachi about that.

Am getting Windows XP Mode and the Win 7 version of Windows Virtual PC - I dont want to mess about with Vista compatabilty modes. It looks like I can use my current VMC file so I (hopefully) won't lose my current crop of work.

That is good news about HDTune. It looks like your hard drive is OK.

I think you have picked the best solution; I would do the same. Maybe your files and work will transfer to the Win 7 version? That would be best and you wouldn't have mess with two version. I have no idea if that is possible.

tumblebug · 27 Jan 2011

Update -

I have Windows Virtual Machine loaded now and Virtual PC 2007 is uninstalled. I managed to get the Windows Virtual Machine to load the old virtual hard disk file so I didn't lose any .net 2003 work from the old virtual machine - yeehaa :)

I did have a BSOD when attempting to uninstal Virtual PC 2007 but I figured that was VPC having its last say before being wiped off the drive forever

I'll see how this performs over the next couple of days and then maybe try your ideas with the other drivers if I still got probems.

Props for the help...

Tim

tumblebug · 28 Jan 2011

Hi Carl

Sorry to keep bugging you about this

At the end of the day - laptop went abit nuts and crashed twice - first time, a number of apps crashed (Word, Firefox) but no actual blue screen, then after the reboot, opened up Word and then blue screen. Dump is attached.

Tim

CarlTR6 · 29 Jan 2011

Darn, Tim, I was hoping that the upgrade would solve your problem. Well, at least you have the latest and greatest Virtual Machine loaded now. Your latest dump is Bugcheck A and blames memory corruption. There is still a possibility that your out of date Toshiba drivers are causing this. Try to update from the Toshiba links provided.

thpdrv.sys Sun Jun 28 22:02:56 2009 - Toshiba HDD Protection. Toshiba Support - Homepage. Update this driver.

Thpevm.SYS Mon Jun 29 04:15:37 2009 - TOSHIBA HDD Protection - Shock Sensor Driver is a driver file from TOSHIBA Corporation belonging to TOSHIBA HDD Protection. Toshiba Support - Homepage. Update this driver.

tos_sps64 tos_sps64.sys Wed Jun 24 01:31:09 2009 - Toshiba tos_sps64 Service. Toshiba Support - Homepage. Update.

tosrfec.sys Mon Jun 01 02:58:53 2009 - Toshiba Bluetooth USB Controller driver. Toshiba Support - Homepage. Update.

TVALZFL.sys Fri Jun 19 06:05:44 2009 - TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver Toshiba Support - Homepage. Update.

If there are no updates from the Toshiba link, try renaming tosrfec.sys and TVALZFL.sys. First create a restore point, then, using Windows Explorer, do a search of your hard drive for each of the drivers. Rename them from .sys to .old. Reboot and the drivers will not load. This will break whatever the drivers belong to.

Code:

Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03402000 PsLoadedModuleList = 0xfffff800`0363fe50
Debug session time: Fri Jan 28 03:01:29.479 2011 (GMT-5)
System Uptime: 0 days 0:08:19.000
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff68000045680, 0, 0, fffff800034862e2}

Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+1c2 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff68000045680, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800034862e2, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036aa0e0
 fffff68000045680 

CURRENT_IRQL:  0

FAULTING_IP: 
nt!MiAgeWorkingSet+1c2
fffff800`034862e2 488b19          mov     rbx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  dwm.exe

TRAP_FRAME:  fffff880035167a0 -- (.trap 0xfffff880035167a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000007ffffffff8 rbx=0000000000000000 rcx=fffff68000045680
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800034862e2 rsp=fffff88003516930 rbp=0000000000045680
 r8=0000000000000001  r9=fffffa800cde83f8 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe cy
nt!MiAgeWorkingSet+0x1c2:
fffff800`034862e2 488b19          mov     rbx,qword ptr [rcx] ds:fffff680`00045680=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003471ca9 to fffff80003472740

STACK_TEXT:  
fffff880`03516658 fffff800`03471ca9 : 00000000`0000000a fffff680`00045680 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`03516660 fffff800`03470920 : 00000000`00000000 00000980`00000000 00000000`00001000 fffff800`035a6bfe : nt!KiBugCheckDispatch+0x69
fffff880`035167a0 fffff800`034862e2 : 00000000`00000106 00000000`00000001 00000000`00000002 00000000`00000105 : nt!KiPageFault+0x260
fffff880`03516930 fffff800`034f4a5e : fffffa80`0cde83f8 fffff880`00000001 00000000`00000001 fffff880`03516bb0 : nt!MiAgeWorkingSet+0x1c2
fffff880`03516ae0 fffff800`03486ee2 : 00000000`000001f7 00000000`00000000 fffffa80`00000000 00000000`00000007 : nt! ?? ::FNODOBFM::`string'+0x496d6
fffff880`03516b80 fffff800`03487173 : 00000000`00000008 fffff880`03516c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03516bd0 fffff800`03716c06 : fffffa80`06c72b60 00000000`00000080 fffffa80`06be2420 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`03516d40 fffff800`03450c26 : fffff880`009ea180 fffffa80`06c72b60 fffff880`009f4fc0 9002af11`78011421 : nt!PspSystemThreadStartup+0x5a
fffff880`03516d80 00000000`00000000 : fffff880`03517000 fffff880`03511000 fffff880`03516710 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiAgeWorkingSet+1c2
fffff800`034862e2 488b19          mov     rbx,qword ptr [rcx]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiAgeWorkingSet+1c2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiAgeWorkingSet+1c2

BUCKET_ID:  X64_0xA_nt!MiAgeWorkingSet+1c2

Followup: MachineOwner
---------

2: kd> lmtsmn
start             end                 module name
fffff880`00f76000 fffff880`00fcd000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`0402b000 fffff880`040b5000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04795000 fffff880`047ab000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`0763f000 fffff880`07770000   agrsm64  agrsm64.sys  Tue Jul 21 14:03:31 2009 (4A6602F3)
fffff880`012ea000 fffff880`012f5000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`04726000 fffff880`0476e000   Apfiltr  Apfiltr.sys  Fri Nov 27 08:39:59 2009 (4B0FD6AF)
fffff880`07a25000 fffff880`07a30000   asyncmac asyncmac.sys Mon Jul 13 20:10:13 2009 (4A5BCCE5)
fffff880`012ac000 fffff880`012b5000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`012b5000 fffff880`012df000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff960`00930000 fffff960`00991000   ATMFD    ATMFD.DLL    Tue Oct 19 23:05:45 2010 (4CBE5C89)
fffff880`040e4000 fffff880`041a5000   ATSwpWDF ATSwpWDF.sys Wed May 19 23:31:31 2010 (4BF4AD13)
fffff880`00da4000 fffff880`00db0000   BATTC    BATTC.SYS    Mon Jul 13 19:31:01 2009 (4A5BC3B5)
fffff880`04367000 fffff880`0436e000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`02fa8000 fffff880`02fb9000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`027d7000 fffff880`027f5000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`00600000 fffff960`00627000   cdd      cdd.dll      Tue Nov 02 00:59:22 2010 (4CCF9AAA)
fffff880`055e2000 fffff880`055ff000   cdfs     cdfs.sys     Mon Jul 13 19:19:46 2009 (4A5BC112)
fffff880`04303000 fffff880`0432d000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00e03000 fffff880`00ec3000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`01a50000 fffff880`01a80000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00cfe000 fffff880`00d5c000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`05800000 fffff880`05804500   CmBatt   CmBatt.sys   Mon Jul 13 19:31:03 2009 (4A5BC3B7)
fffff880`01000000 fffff880`01073000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`00fed000 fffff880`00ff6000   compbatt compbatt.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`05805000 fffff880`05815000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`05400000 fffff880`0540e000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`02e00000 fffff880`02e83000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`02f8d000 fffff880`02fa8000   ctxusbm  ctxusbm.sys  Mon Sep 07 14:09:28 2009 (4AA54C58)
fffff880`02f6f000 fffff880`02f8d000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`02f60000 fffff880`02f6f000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01a3a000 fffff880`01a50000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0555a000 fffff880`0557c000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`026b7000 fffff880`026ca000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`024af000 fffff880`026b7000   dump_iaStor dump_iaStor.sys Fri Jan 15 15:21:57 2010 (4B50CE65)
fffff880`077c6000 fffff880`077d2000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`0446e000 fffff880`04562000   dxgkrnl  dxgkrnl.sys  Mon Nov 01 22:51:31 2010 (4CCF7CB3)
fffff880`04562000 fffff880`045a8000   dxgmms1  dxgmms1.sys  Mon Nov 01 22:50:56 2010 (4CCF7C90)
fffff880`04400000 fffff880`0444f000   e1k62x64 e1k62x64.sys Wed Sep 29 16:02:28 2010 (4CA39B54)
fffff880`027a1000 fffff880`027d7000   fastfat  fastfat.SYS  Mon Jul 13 19:23:28 2009 (4A5BC1F0)
fffff880`01341000 fffff880`01355000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`012f5000 fffff880`01341000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`015d9000 fffff880`015e3000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`01a00000 fffff880`01a3a000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`013b3000 fffff880`013fd000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`039de000 fffff800`03a27000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`046e2000 fffff880`04706000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`045a8000 fffff880`045b9000   HECIx64  HECIx64.sys  Thu Sep 17 15:54:16 2009 (4AB293E8)
fffff880`077e0000 fffff880`077f9000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`07600000 fffff880`07608080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`077d2000 fffff880`077e0000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`041a5000 fffff880`0426d000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`01bc1000 fffff880`01bca000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`05fa9000 fffff880`05fc7000   i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`010a4000 fffff880`012ac000   iaStor   iaStor.sys   Fri Jan 15 15:21:57 2010 (4B50CE65)
fffff880`04a41000 fffff880`051bbce0   igdkmd64 igdkmd64.sys Wed Feb 10 19:56:24 2010 (4B7355B8)
fffff880`0476e000 fffff880`04794c00   Impcd    Impcd.sys    Wed Feb 10 18:01:59 2010 (4B733AE7)
fffff880`0777f000 fffff880`077c6000   IntcDAud IntcDAud.sys Fri Jan 08 06:51:38 2010 (4B471C4A)
fffff880`02fdf000 fffff880`02ff5000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`05fc7000 fffff880`05fd6000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`07626000 fffff880`07634000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`00b9a000 fffff800`00ba4000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`045b9000 fffff880`045fc000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`015ae000 fffff880`015c8000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01660000 fffff880`0168b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`075fa000 fffff880`075ff200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`0270e000 fffff880`02723000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`026ca000 fffff880`026ed000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00ca6000 fffff880`00cea000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`07770000 fffff880`0777f000   modem    modem.sys    Mon Jul 13 20:10:48 2009 (4A5BCD08)
fffff880`07400000 fffff880`0740e000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`05fd6000 fffff880`05fe5000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`07609000 fffff880`07616000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00c5c000 fffff880`00c76000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`0432d000 fffff880`0435e000   MpFilter MpFilter.sys Tue Sep 14 20:19:28 2010 (4C901110)
fffff880`07a00000 fffff880`07a10000   MpNWMon  MpNWMon.sys  Tue Sep 14 20:19:30 2010 (4C901112)
fffff880`02400000 fffff880`02418000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`02418000 fffff880`02445000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`02445000 fffff880`02493000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`0540e000 fffff880`05431000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`012df000 fffff880`012ea000   msahci   msahci.sys   Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`043cc000 fffff880`043d7000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00fd6000 fffff880`00fe0000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`01355000 fffff880`013b3000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`02f55000 fffff880`02f60000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`01baf000 fffff880`01bc1000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`016c8000 fffff880`017ba000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`05815000 fffff880`05821000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`02776000 fffff880`02789000   ndisuio  ndisuio.sys  Mon Jul 13 20:09:25 2009 (4A5BCCB5)
fffff880`047cf000 fffff880`047fe000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`05508000 fffff880`0551d000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`01be8000 fffff880`01bf7000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`017ba000 fffff880`017ff000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01600000 fffff880`01660000   NETIO    NETIO.SYS    Thu Apr 08 22:43:59 2010 (4BBE946F)
fffff880`05822000 fffff880`05f81000   NETw5s64 NETw5s64.sys Wed Jan 13 11:37:13 2010 (4B4DF6B9)
fffff880`07a10000 fffff880`07a25000   NisDrvWFP NisDrvWFP.sys Tue Sep 14 20:20:25 2010 (4C901149)
fffff880`043d7000 fffff880`043e8000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02f49000 fffff880`02f55000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`03402000 fffff800`039de000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`0140b000 fffff880`015ae000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`0435e000 fffff880`04367000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`02723000 fffff880`02776000   nwifi    nwifi.sys    Mon Jul 13 20:07:23 2009 (4A5BCC3B)
fffff880`040be000 fffff880`040e4000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00d8f000 fffff880`00da4000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00d5c000 fffff880`00d8f000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00ff6000 fffff880`00ffd000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00c76000 fffff880`00c86000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`015c8000 fffff880`015d9000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`07a69000 fffff880`07b0f000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`07616000 fffff880`07626000   point64  point64.sys  Tue Jun 29 04:54:31 2010 (4C29B4C7)
fffff880`0551d000 fffff880`0555a000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00cea000 fffff880`00cfe000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`047ab000 fffff880`047cf000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`04600000 fffff880`0461b000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`0461b000 fffff880`0463c000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`0463c000 fffff880`04656000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`02ef8000 fffff880`02f49000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`04656000 fffff880`04661000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`043b1000 fffff880`043ba000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`043ba000 fffff880`043c3000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`043c3000 fffff880`043cc000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01b75000 fffff880`01baf000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`02789000 fffff880`027a1000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`0740e000 fffff880`075f9a80   RTKVHD64 RTKVHD64.sys Fri Oct 30 06:17:58 2009 (4AEABD56)
fffff880`04706000 fffff880`04726000   sdbus    sdbus.sys    Fri Oct 09 22:41:20 2009 (4ACFF450)
fffff880`07b0f000 fffff880`07b1a000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`05f9d000 fffff880`05fa9000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`0169b000 fffff880`016b8000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`01b6d000 fffff880`01b75000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`05431000 fffff880`054a2000   spsys    spsys.sys    Mon May 11 13:20:58 2009 (4A085E7A)
fffff880`0426d000 fffff880`04303000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`07b59000 fffff880`07bc0000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`07b1a000 fffff880`07b47000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`04661000 fffff880`04662480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01802000 fffff880`019ff000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`07b47000 fffff880`07b59000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`05fe5000 fffff880`05fef000   tdcmdpst tdcmdpst.sys Thu Jul 30 04:39:35 2009 (4A715C47)
fffff880`0401e000 fffff880`0402b000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`04000000 fffff880`0401e000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`02ee4000 fffff880`02ef8000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff880`01b61000 fffff880`01b6d000   thpdrv   thpdrv.sys   Sun Jun 28 22:02:56 2009 (4A4820D0)
fffff880`01b5f000 fffff880`01b60f80   Thpevm   Thpevm.SYS   Mon Jun 29 04:15:37 2009 (4A487829)
fffff880`01ae5000 fffff880`01b5f000   tos_sps64 tos_sps64.sys Wed Jun 24 01:31:09 2009 (4A41BA1D)
fffff880`05ff6000 fffff880`05fff000   tosrfec  tosrfec.sys  Mon Jun 01 02:58:53 2009 (4A237C2D)
fffff880`05f8e000 fffff880`05f9d000   tpm      tpm.sys      Mon Jul 13 19:21:48 2009 (4A5BC18C)
fffff960`00440000 fffff960`0044a000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`02fb9000 fffff880`02fdf000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`01ae0000 fffff880`01ae4e00   TVALZ    TVALZ.SYS    Mon Jul 13 22:18:54 2009 (4A5BEB0E)
fffff880`05fef000 fffff880`05ff6000   TVALZFL  TVALZFL.sys  Fri Jun 19 06:05:44 2009 (4A3B62F8)
fffff880`04663000 fffff880`04675000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`0557c000 fffff880`05599000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`04684000 fffff880`04685f00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`0444f000 fffff880`04460000   usbehci  usbehci.sys  Fri Dec 04 02:26:02 2009 (4B18B98A)
fffff880`054ae000 fffff880`05508000   usbhub   usbhub.sys   Fri Dec 04 02:26:39 2009 (4B18B9AF)
fffff880`0468c000 fffff880`046e2000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`04675000 fffff880`04684000   usbrpm   usbrpm.sys   Mon Jul 13 20:35:14 2009 (4A5BD2C2)
fffff880`05599000 fffff880`055b4000   USBSTOR  USBSTOR.SYS  Mon Jul 13 20:06:34 2009 (4A5BCC0A)
fffff880`055b4000 fffff880`055e1200   usbvideo usbvideo.sys Wed Mar 03 23:40:57 2010 (4B8F39D9)
fffff880`00fe0000 fffff880`00fed000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`01bca000 fffff880`01bd4000   vfilter  vfilter.sys  Thu Jul 08 22:18:29 2010 (4C3686F5)
fffff880`0436e000 fffff880`0437c000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`0437c000 fffff880`043a1000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`0168b000 fffff880`0169b000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00db0000 fffff880`00dc5000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00c00000 fffff880`00c5c000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01a94000 fffff880`01ae0000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`04a00000 fffff880`04a3c000   vpchbus  vpchbus.sys  Tue Sep 22 21:32:32 2009 (4AB97AB0)
fffff880`01bd4000 fffff880`01be8000   vpcnfltr vpcnfltr.sys Tue Sep 22 21:32:30 2009 (4AB97AAE)
fffff880`051bc000 fffff880`051d9000   vpcusb   vpcusb.sys   Tue Sep 22 21:32:39 2009 (4AB97AB7)
fffff880`02e8d000 fffff880`02ee3580   vpcvmm   vpcvmm.sys   Thu Dec 31 02:27:33 2009 (4B3C5265)
fffff880`05f81000 fffff880`05f8e000   vwifibus vwifibus.sys Mon Jul 13 20:07:21 2009 (4A5BCC39)
fffff880`043e8000 fffff880`043fe000   vwififlt vwififlt.sys Mon Jul 13 20:07:22 2009 (4A5BCC3A)
fffff880`02493000 fffff880`0249d000   vwifimp  vwifimp.sys  Mon Jul 13 20:07:28 2009 (4A5BCC40)
fffff880`015e3000 fffff880`015fe000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`043a1000 fffff880`043b1000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00ec3000 fffff880`00f67000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f67000 fffff880`00f76000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`040b5000 fffff880`040be000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00080000 fffff960`00390000   win32k   win32k.sys   Tue Oct 19 23:08:46 2010 (4CBE5D3E)
fffff880`00fcd000 fffff880`00fd6000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`026ed000 fffff880`0270e000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)
fffff880`07bc0000 fffff880`07bf1000   WUDFRd   WUDFRd.sys   Mon Jul 13 20:06:06 2009 (4A5BCBEE)

Unloaded modules:
fffff880`01a80000 fffff880`01a8e000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`040e8000 fffff880`042f0000   dump_iaStor.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`042f0000 fffff880`04303000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000

tumblebug · 30 Jan 2011

Hi Carl

Yeah - I'd thought we'd cracked it too. Anyhoo...

According the (australian) Toshiba website (Support :: Toshiba) and the "Toshiba Software Installer", I've got all the latest 64bit drivers for everything. The only thing I've not done is the BIOS update. So I've renamed those two drivers, tosrfec.sys and TVALZFL.sys,and rebooted.

During the above process, IE8 shutdown and restarted, and I tried to start an app called "Toshiba Service Centre" it crashed straightaway. Then I got a BSOD when rebooting after renaming the drivers (dump attached).

Given the amount of Toshiba-related utilities on here, I'm suspecting that one or more of these apps aren't playing properly with Win7. There is quite alot of stuff running in the background which I think I don't need (fingerprint scanners and the like).

tumblebug · 30 Jan 2011

I thought I'd post the output of HijackThis too so you can see what's loading and if you think anything is not needed here. There's lots of "file missing" messages there

Code:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:46:43 AM, on 24/01/2011
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
C:\Windows\Samsung\PanelMgr\SSMMgr.exe
C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
C:\Program Files (x86)\Citrix\ICA Client\WFCRUN32.EXE
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe
C:\windows\SysWOW64\Macromed\Flash\FlashUtil10l_ActiveX.exe
C:\Program Files\WhoCrashed\whocrashedex.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com by TOSHIBA
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: BHOHOOK - {030AC7B6-E7EC-40F1-8FB2-C0FD344DE0B9} - C:\Program Files\TOSHIBA\TFPU\x86\TFPUPWDBankBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CmjBrowserHelperObject Object - {AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Program Files (x86)\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IMSS] "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
O4 - HKLM\..\Run: [TOSDCR] %ProgramFiles%\TOSHIBA\PasswordUtility\TOSDCR.exe
O4 - HKLM\..\Run: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
O4 - HKLM\..\Run: [TUSBSleepChargeSrv] %ProgramFiles(x86)%\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\windows\Samsung\PanelMgr\ssmmgr.exe /autorun
O4 - HKLM\..\Run: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Online plug-in.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Program Files (x86)\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O13 - Gopher Prefix: 
O15 - Trusted Zone: http://*.drnick
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E3089160-E8AD-4C5B-B47C-ADDF3DF660DD} (PjAdoInfo4 Class) - http://drnick/pwa/_layouts/pwa/objects/pjclient.cab
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} (JuniperSetupClientControl Class) - https://mia.bt.com/dana-cached/sc/Ju...etupClient.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cirrusau.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{0B6A48AB-14DF-465F-A249-2A0E007B16B5}: Domain = cirrusau.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{0B6A48AB-14DF-465F-A249-2A0E007B16B5}: NameServer = 172.17.0.206
O17 - HKLM\System\CCS\Services\Tcpip\..\{60BD32C6-18A8-453D-A35D-B40262ADA0CE}: Domain = cirrusau.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cirrusau.local
O17 - HKLM\System\CS1\Services\Tcpip\..\{0B6A48AB-14DF-465F-A249-2A0E007B16B5}: Domain = cirrusau.local
O17 - HKLM\System\CS1\Services\Tcpip\..\{0B6A48AB-14DF-465F-A249-2A0E007B16B5}: NameServer = 172.17.0.206
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = cirrusau.local
O17 - HKLM\System\CS2\Services\Tcpip\..\{0B6A48AB-14DF-465F-A249-2A0E007B16B5}: Domain = cirrusau.local
O17 - HKLM\System\CS2\Services\Tcpip\..\{0B6A48AB-14DF-465F-A249-2A0E007B16B5}: NameServer = 172.17.0.206
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - LSI Corporation - C:\Program Files\LSI SoftModem\agr64svc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: AuthenTec Fingerprint Service (ATService) - AuthenTec, Inc. - C:\Program Files\Fingerprint Sensor\ATService.exe
O23 - Service: ConfigFree WiMAX Service (cfWiMAXService) - TOSHIBA CORPORATION - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: ShrewSoft DNS Proxy Daemon (dtpd) - Unknown owner - C:\Program Files\ShrewSoft\VPN Client\dtpd.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: @%windir%\system32\inetsrv\iisres.dll,-30007 (IISADMIN) - Unknown owner - C:\windows\system32\inetsrv\inetinfo.exe (file missing)
O23 - Service: ShrewSoft IKE Daemon (iked) - Unknown owner - C:\Program Files\ShrewSoft\VPN Client\iked.exe
O23 - Service: ShrewSoft IPSEC Daemon (ipsecd) - Unknown owner - C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: TOSHIBA Modem region select service (RSELSVC) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\rselect\RSelSvc.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: TOSHIBA HDD Protection (Thpsrv) - Unknown owner - C:\windows\system32\ThpSrv.exe (file missing)
O23 - Service: TMachInfo - TOSHIBA Corporation - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - Unknown owner - C:\windows\system32\TODDSrv.exe (file missing)
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: TOSHIBA eco Utility Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TECO\TecoService.exe
O23 - Service: TOSHIBA HDD SSD Alert Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
O23 - Service: TPCH Service (TPCHSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: @%windir%\system32\inetsrv\iisres.dll,-20001 (WMSVC) - Unknown owner - C:\windows\system32\inetsrv\wmsvc.exe (file missing)
--
End of file - 15682 bytes