BSOD.. which changes?!

iSamage · 21 Apr 2011

Turned minidumps on and teased another BSOD to attack me on shutdown!
This one stated "INTERNAL_POWER_ERROR" (out of the about 4 different BSODs ive had so far)
I've attached the files created by your program which hopefully come with a minidump!

Gonna try the sfc /scannow now

will report back with the results!

Thanks for helping so far! Oh and BTW, opening Google Chrome now gives me BSOD. Great

Cheers

SORRY. Can't properly upload the files due to rubbish hotel wifi. Here's the link to the file on 2shared:

2shared - download Windows_NT6_BSOD_jcgriff2.zip

mgorman87 · 21 Apr 2011

INTERNAL_POWER_ERROR (a0)
The power policy manager experienced a fatal error.

Code:

This error is caused by the hibernation file size being is too small for the current memory requirements of the computer. To fix this problem, increase the size of the hibernation file by following these steps:
 
Click the Start button.
In the search box, type command prompt.
In the list of results, right-click Command Prompt, and then click Run as administrator.
In the Command Prompt window type:
powercfg /hibernate /size <size%>
where <size%> equals the size of the hibernation file in percentage of total physical memory.
The default size is 75% and can be increased to 100% with:
 
powercfg /hibernate /size 100

...Summary of the dumps:

Code:


Built by: 7601.17514.x86fre.win7sp1_rtm.101119-1850
Debug session time: Thu Apr 21 11:58:00.132 2011 (UTC - 4:00)
System Uptime: 0 days 0:10:12.757
BUGCHECK_STR:  0xA0
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  wininit.exe
FAILURE_BUCKET_ID:  0xA0_nt!PopAllocateIrp+a0
BiosReleaseDate = 09/23/2009
SystemManufacturer = TOSHIBA
SystemProductName = Satellite L300
MaxSpeed:     1660
CurrentSpeed: 1662
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

Code:

87ca2000 87cea000   ACPI     ACPI.sys     Sat Nov 20 03:37:52 2010 (4CE788E0)
8f6a6000 8f700000   afd      afd.sys      Sat Nov 20 03:40:00 2010 (4CE78960)
8fb4f000 8fb61000   AgileVpn AgileVpn.sys Mon Jul 13 19:55:00 2009 (4A5BC954)
87c0e000 87c17000   amdxata  amdxata.sys  Fri Mar 19 12:19:01 2010 (4BA3A3F5)
87dc5000 87dce000   atapi    atapi.sys    Mon Jul 13 19:11:15 2009 (4A5BBF13)
87dce000 87df1000   ataport  ataport.SYS  Sat Nov 20 03:38:00 2010 (4CE788E8)
93db0000 93dfd000   ATMFD    ATMFD.DLL    Fri Feb 18 23:34:53 2011 (4D5F486D)
87d49000 87d54000   BATTC    BATTC.SYS    Mon Jul 13 19:19:15 2009 (4A5BC0F3)
881f2000 881f9000   Beep     Beep.SYS     Mon Jul 13 19:45:00 2009 (4A5BC6FC)
8fb1b000 8fb29000   blbdrive blbdrive.sys Mon Jul 13 19:23:04 2009 (4A5BC1D8)
82ad0000 82ad8000   BOOTVID  BOOTVID.dll  Mon Jul 13 21:04:34 2009 (4A5BD9A2)
8fdad000 8fdc6000   bowser   bowser.sys   Tue Feb 22 23:47:32 2011 (4D649164)
8fafc000 8fb1b000   cdrom    cdrom.sys    Sat Nov 20 03:38:09 2010 (4CE788F1)
82b1a000 82bc5000   CI       CI.dll       Sat Nov 20 07:05:17 2010 (4CE7B97D)
87fd2000 87ff7000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:11:20 2009 (4A5BBF18)
82ad8000 82b1a000   CLFS     CLFS.SYS     Mon Jul 13 19:11:10 2009 (4A5BBF0E)
8801d000 8807a000   cng      cng.sys      Mon Jul 13 19:32:55 2009 (4A5BC427)
87d41000 87d49000   compbatt compbatt.sys Mon Jul 13 19:19:18 2009 (4A5BC0F6)
8fb38000 8fb45000   CompositeBus CompositeBus.sys Sat Nov 20 04:50:21 2010 (4CE799DD)
9beab000 9beb8000   crashdmp crashdmp.sys Mon Jul 13 19:45:50 2009 (4A5BC72E)
8f7c2000 8f7da000   dfsc     dfsc.sys     Sat Nov 20 03:42:32 2010 (4CE789F8)
88000000 88011000   disk     disk.sys     Mon Jul 13 19:11:28 2009 (4A5BBF20)
9becd000 9bede000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:12:47 2009 (4A5BBF6F)
9bec3000 9becd000   dump_msahci dump_msahci.sys Sat Nov 20 04:50:48 2010 (4CE799F8)
9beb8000 9bec3000   dump_pciidex dump_pciidex.sys Mon Jul 13 19:11:16 2009 (4A5BBF14)
8fd33000 8fd3d000   Dxapi    Dxapi.sys    Mon Jul 13 19:25:25 2009 (4A5BC265)
93cf0000 93d07000   dxg      dxg.sys      Mon Jul 13 19:25:24 2009 (4A5BC264)
82a00000 82a11000   fileinfo fileinfo.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
82bc5000 82bf9000   fltmgr   fltmgr.sys   Mon Jul 13 19:11:13 2009 (4A5BBF11)
93da0000 93da8000   framebuf framebuf.dll Mon Jul 13 19:25:48 2009 (4A5BC27C)
88088000 88091000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:11:14 2009 (4A5BBF12)
87e00000 87e32000   fvevol   fvevol.sys   Sat Nov 20 03:40:22 2010 (4CE78976)
8f600000 8f608000   FwLnk    FwLnk.sys    Sun Nov 19 09:11:12 2006 (45606600)
88352000 88383000   fwpkclnt fwpkclnt.sys Sat Nov 20 03:39:08 2010 (4CE7892C)
8240d000 82444000   hal      halmacpi.dll Sat Nov 20 03:37:38 2010 (4CE788D2)
8fa8b000 8faaa000   HDAudBus HDAudBus.sys Sat Nov 20 04:59:28 2010 (4CE79C00)
883ee000 883f6000   hwpolicy hwpolicy.sys Sat Nov 20 03:37:35 2010 (4CE788CF)
8ffc7000 8ffdf000   i8042prt i8042prt.sys Mon Jul 13 19:11:23 2009 (4A5BBF1B)
8ffdf000 8ffec000   kbdclass kbdclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
851db000 851de000   kdcom    kdcom.dll    Fri Apr 15 07:51:41 2011 (4DA8314D)
8fc52000 8fc86000   ks       ks.sys       Sat Nov 20 04:50:17 2010 (4CE799D9)
87f92000 87fa5000   ksecdd   ksecdd.sys   Sat Nov 20 03:38:54 2010 (4CE7891E)
88186000 881ab000   ksecpkg  ksecpkg.sys  Mon Jul 13 19:34:00 2009 (4A5BC468)
8fa00000 8fa1c800   mcdbus   mcdbus.sys   Tue Feb 24 05:42:13 2009 (49A3CF05)
82a3a000 82abf000   mcupdate mcupdate.dll Sat Nov 20 07:00:54 2010 (4CE7B876)
8ffec000 8fff9000   mouclass mouclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
87daf000 87dc5000   mountmgr mountmgr.sys Sat Nov 20 03:38:09 2010 (4CE788F1)
8fdc6000 8fdd8000   mpsdrv   mpsdrv.sys   Mon Jul 13 19:52:52 2009 (4A5BC8D4)
8fdd8000 8fdfb000   mrxsmb   mrxsmb.sys   Tue Feb 22 23:47:34 2011 (4D649166)
9be22000 9be5d000   mrxsmb10 mrxsmb10.sys Tue Feb 22 23:47:43 2011 (4D64916F)
9be5d000 9be78000   mrxsmb20 mrxsmb20.sys Tue Feb 22 23:47:39 2011 (4D64916B)
87df1000 87dfb000   msahci   msahci.sys   Sat Nov 20 04:50:48 2010 (4CE799F8)
8f66a000 8f675000   Msfs     Msfs.SYS     Mon Jul 13 19:11:26 2009 (4A5BBF1E)
87cf3000 87cfb000   msisadrv msisadrv.sys Mon Jul 13 19:11:09 2009 (4A5BBF0D)
87f67000 87f92000   msrpc    msrpc.sys    Mon Jul 13 19:11:59 2009 (4A5BBF3F)
8fb45000 8fb4f000   mssmbios mssmbios.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
883de000 883ee000   mup      mup.sys      Mon Jul 13 19:14:14 2009 (4A5BBFC6)
88091000 88148000   ndis     ndis.sys     Sat Nov 20 03:39:19 2010 (4CE78937)
8fb79000 8fb84000   ndistapi ndistapi.sys Mon Jul 13 19:54:24 2009 (4A5BC930)
8fd9d000 8fdad000   ndisuio  ndisuio.sys  Sat Nov 20 05:06:36 2010 (4CE79DAC)
8fb84000 8fba6000   ndiswan  ndiswan.sys  Sat Nov 20 05:07:48 2010 (4CE79DF4)
8fcd8000 8fce9000   NDProxy  NDProxy.SYS  Sat Nov 20 05:07:39 2010 (4CE79DEB)
8f769000 8f777000   netbios  netbios.sys  Mon Jul 13 19:53:54 2009 (4A5BC912)
8f700000 8f732000   netbt    netbt.sys    Sat Nov 20 03:39:22 2010 (4CE7893A)
88148000 88186000   NETIO    NETIO.SYS    Sat Nov 20 03:40:03 2010 (4CE78963)
8f675000 8f683000   Npfs     Npfs.SYS     Mon Jul 13 19:11:31 2009 (4A5BBF23)
8f7b8000 8f7c2000   nsiproxy nsiproxy.sys Mon Jul 13 19:12:08 2009 (4A5BBF48)
82444000 82856000   nt       ntkrpamp.exe Sat Nov 20 03:42:49 2010 (4CE78A09)
87e38000 87f67000   Ntfs     Ntfs.sys     Sat Nov 20 03:39:08 2010 (4CE7892C)
88200000 88207000   Null     Null.SYS     Mon Jul 13 19:11:12 2009 (4A5BBF10)
8fd57000 8fd9d000   nwifi    nwifi.sys    Mon Jul 13 19:51:59 2009 (4A5BC89F)
8f739000 8f758000   pacer    pacer.sys    Mon Jul 13 19:53:58 2009 (4A5BC916)
87d30000 87d41000   partmgr  partmgr.sys  Sat Nov 20 03:38:14 2010 (4CE788F6)
87cfb000 87d25000   pci      pci.sys      Sat Nov 20 03:37:57 2010 (4CE788E5)
87c00000 87c0e000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:11:15 2009 (4A5BBF13)
8807a000 88088000   pcw      pcw.sys      Mon Jul 13 19:11:10 2009 (4A5BBF0E)
82abf000 82ad0000   PSHED    PSHED.dll    Mon Jul 13 21:09:36 2009 (4A5BDAD0)
87c17000 87c204c0   PxHelp20 PxHelp20.sys Tue Oct 20 13:57:50 2009 (4ADDFA1E)
8fb61000 8fb79000   rasl2tp  rasl2tp.sys  Mon Jul 13 19:54:33 2009 (4A5BC939)
8fba6000 8fbbe000   raspppoe raspppoe.sys Mon Jul 13 19:54:53 2009 (4A5BC94D)
8fbbe000 8fbd5000   raspptp  raspptp.sys  Mon Jul 13 19:54:47 2009 (4A5BC947)
8fbd5000 8fbec000   rassstp  rassstp.sys  Mon Jul 13 19:54:57 2009 (4A5BC951)
8f777000 8f7b8000   rdbss    rdbss.sys    Sat Nov 20 03:42:44 2010 (4CE78A04)
8f662000 8f66a000   rdpencdd rdpencdd.sys Mon Jul 13 20:01:39 2009 (4A5BCAE3)
87fa5000 87fd2000   rdyboost rdyboost.sys Sat Nov 20 04:00:07 2010 (4CE78E17)
8faaa000 8fafc000   Rt86win7 Rt86win7.sys Fri Jan 21 02:33:09 2011 (4D3936B5)
883f6000 883fa980   SAVRKBootTasks SAVRKBootTasks.sys Wed May 26 05:45:02 2010 (4BFCED9E)
8fc2a000 8fc50000   SCSIPORT SCSIPORT.SYS Sat Nov 20 04:50:55 2010 (4CE799FF)
8fc50000 8fc51380   swenum   swenum.sys   Mon Jul 13 19:45:08 2009 (4A5BC704)
8fe00000 8fe30000   SynTP    SynTP.sys    Thu Aug 14 22:02:22 2008 (48A4E3AE)
88208000 88352000   tcpip    tcpip.sys    Sat Nov 20 03:41:36 2010 (4CE789C0)
8f69a000 8f6a6000   TDI      TDI.SYS      Sat Nov 20 03:39:18 2010 (4CE78936)
8f683000 8f69a000   tdx      tdx.sys      Sat Nov 20 03:39:17 2010 (4CE78935)
8fbec000 8fbfd000   termdd   termdd.sys   Sat Nov 20 05:21:10 2010 (4CE7A116)
881ab000 881f2000   tos_sps32 tos_sps32.sys Wed Jun 24 01:36:21 2009 (4A41BB55)
8fe3a000 8ffc64c0   ts_athw  ts_athw.sys  Tue Nov 23 15:56:29 2010 (4CEC2A7D)
93d20000 93d29000   TSDDD    TSDDD.dll    Mon Jul 13 20:01:40 2009 (4A5BCAE4)
8f7da000 8f7fb000   tunnel   tunnel.sys   Sat Nov 20 05:06:40 2010 (4CE79DB0)
883c2000 883c6100   TVALZ_O  TVALZ_O.SYS  Mon Jul 13 22:19:21 2009 (4A5BEB29)
8fc86000 8fc94000   umbus    umbus.sys    Sat Nov 20 05:00:23 2010 (4CE79C37)
8fce9000 8fd00000   usbccgp  usbccgp.sys  Sat Nov 20 05:00:08 2010 (4CE79C28)
8fe30000 8fe31700   USBD     USBD.SYS     Mon Jul 13 19:51:05 2009 (4A5BC869)
8fa7c000 8fa8b000   usbehci  usbehci.sys  Mon Jul 13 19:51:14 2009 (4A5BC872)
8fc94000 8fcd8000   usbhub   usbhub.sys   Sat Nov 20 05:00:34 2010 (4CE79C42)
8fa31000 8fa7c000   USBPORT  USBPORT.SYS  Mon Jul 13 19:51:13 2009 (4A5BC871)
8f608000 8f613000   usbuhci  usbuhci.sys  Mon Jul 13 19:51:10 2009 (4A5BC86E)
87d25000 87d30000   vdrvroot vdrvroot.sys Mon Jul 13 19:46:19 2009 (4A5BC74B)
82a22000 82a2e000   vga      vga.sys      Mon Jul 13 19:25:50 2009 (4A5BC27E)
8f634000 8f655000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:25:49 2009 (4A5BC27D)
8fb29000 8fb38000   VMNetSrv VMNetSrv.sys Wed Jan 24 07:05:29 2007 (45B74B89)
87d54000 87d64000   volmgr   volmgr.sys   Sat Nov 20 03:38:06 2010 (4CE788EE)
87d64000 87daf000   volmgrx  volmgrx.sys  Mon Jul 13 19:11:41 2009 (4A5BBF2D)
88383000 883c2000   volsnap  volsnap.sys  Sat Nov 20 03:38:13 2010 (4CE788F5)
8f758000 8f769000   vwififlt vwififlt.sys Mon Jul 13 19:52:03 2009 (4A5BC8A3)
8f655000 8f662000   watchdog watchdog.sys Mon Jul 13 19:24:10 2009 (4A5BC21A)
87c23000 87c94000   Wdf01000 Wdf01000.sys Mon Jul 13 19:11:36 2009 (4A5BBF28)
87c94000 87ca2000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
8f732000 8f739000   wfplwf   wfplwf.sys   Mon Jul 13 19:53:51 2009 (4A5BC90F)
93aa0000 93cee000   win32k   win32k.sys   Wed Mar 02 22:42:10 2011 (4D6F0E12)
87cea000 87cf3000   WMILIB   WMILIB.SYS   Mon Jul 13 19:11:22 2009 (4A5BBF1A)
8fd3d000 8fd57000   WudfPf   WudfPf.sys   Sat Nov 20 04:58:55 2010 (4CE79BDF)

Unloaded modules:
9be78000 9be85000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000D000
9be85000 9be90000   dump_pciidex
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000B000
9be90000 9be9a000   dump_msahci.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000A000
9be9a000 9beab000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
8fd00000 8fd0d000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000D000
8fd0d000 8fd18000   dump_pciidex
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000B000
8fd18000 8fd22000   dump_msahci.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000A000
8fd22000 8fd33000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
883c7000 883d4000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000D000
88011000 8801c000   dump_pciidex
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000B000
883d4000 883de000   dump_msahci.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000A000
82a11000 82a22000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
883c7000 883cf000   spldr.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00008000
883cf000 883de000   Soluto.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000F000

iSamage · 21 Apr 2011

Wow. I will try what the top box says and get back with the results! :)

iSamage · 21 Apr 2011

Okay, tried doing that in the command prompt and got this:

Hibernation failed with the following error: The request is not supported.

The following items are preventing hibernation on this system.
There are one or more legacy drivers installed:
VgaSave
An internal system component has disabled hibernation

Help?

This is keeping me in suspense!

**cluberti** · 21 Apr 2011

That is the "legacy" Standard VGA driver that gets installed for video when Windows is unable to find or install the correct driver. When the standard vga driver is installed, you cannot hibernate, so you'll need to get the right video driver installed to continue.

iSamage · 22 Apr 2011

This is probably kicking up as im in safe mode, I do have the correct drivers for my video card, they come through windows update. I'll boot in normal windows and try that hibernate trick, see what happens.

(I only assume it will work then since i will be using the correct video drivers :P )

iSamage · 22 Apr 2011

Okay, booted in normal mode and succesfully icreased the hiberfile size to 100%. I then opened Dr.Web's CureIt in normal windows mode and instantly in an express scan it eradicated a Trojan and a Backdoor TSS from a process in memory. All was going well.... then I got the famous (in my eyes now anyway) ataport.sys BSOD! Then booted in safe mode and tried shutting down, got the INTERNAL_POWER_ERROR BSOD again!

ERGH!

Should I upload minidump info for these BSODs? Would your program collect information for the both of them or does it just collect info on the latest occurance??

Thanks for any help

mgorman87 · 22 Apr 2011

Did you run this scan yet
How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

iSamage · 22 Apr 2011

mgorman87 said:

Did you run this scan yet
How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

Yeahh, I tried that as soon as you told me about it but all it does is crash at 80% loading

That's in safe mode and windows normal mode

mgorman87 · 22 Apr 2011

iSamage said:

mgorman87 said:

Did you run this scan yet
How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

Yeahh, I tried that as soon as you told me about it but all it does is crash at 80% loading

That's in safe mode and windows normal mode

Strange. I would continue running system scans. Try to do a full scan and not a quick scan. You probably still have infection on your system. Also, see if you can do any pre-boot scans that scan the hard drive before windows loads. Check out http://www.ultimatebootcd.com/ it has some virus scans that you can run from the CD