Multiple blue screens

Ninebreaker · 25 May 2011

Hi

After my windows 7 instalation became corrupt and i could no longer use the windows file browser i re installed windows fresh but sicne then i have been experiancing major instability in my system and random restarts and blue screens half of these blue screens dont even produce a blue screen but still create a dump file.

I have used the basic who crashed program to try and identify the reason for this 2 out of the 3 dumps i have point to ntoskrnl.exe being at fualt and one states iswkl.exe to at fualt i will upload these 3 files in .rar format.

system information

windows 7 home premium 64 bit
1gb ATI Radeon HD 5850
AMD Phenom ll x6 1090T Black edition (overclocked to 3.72 Ghz)
Asus N4a89GTD Pro
Asus PCE-N13 Internal 802.11N WiFi Adapter
G.skill 8GB 1600Mhz 2x4 GB (speeds edited)

i have also removed all non factory changes doen to these and the instability remains.

software

EPU
Turbo evo
Avast
Zone alarm
Catalyst controle center

I am reasonably knowlagable with computers and I have checked most hardware posabilities such as damaged RAM but cannot find anything wrong thus far but i am coming to the end of the line with possible software related problems.

If any more information is required feel free to ask.

zigzag3143 · 25 May 2011

Ninebreaker said:

Hi

After my windows 7 instalation became corrupt and i could no longer use the windows file browser i re installed windows fresh but sicne then i have been experiancing major instability in my system and random restarts and blue screens half of these blue screens dont even produce a blue screen but still create a dump file.

I have used the basic who crashed program to try and identify the reason for this 2 out of the 3 dumps i have point to ntoskrnl.exe being at fualt and one states iswkl.exe to at fualt i will upload these 3 files in .rar format.

system information

windows 7 home premium 64 bit
1gb ATI Radeon HD 5850
AMD Phenom ll x6 1090T Black edition (overclocked to 3.72 Ghz)
Asus N4a89GTD Pro
Asus PCE-N13 Internal 802.11N WiFi Adapter
G.skill 8GB 1600Mhz 2x4 GB (speeds edited)

i have also removed all non factory changes doen to these and the instability remains.

software

EPU
Turbo evo
Avast
Zone alarm
Catalyst controle center

I am reasonably knowlagable with computers and I have checked most hardware posabilities such as damaged RAM but cannot find anything wrong thus far but i am coming to the end of the line with possible software related problems.

If any more information is required feel free to ask.

These crashes are Related to ISWKL.sys ZoneAlarm ForceField from Check Point Software Technologies. I also would remove Avast

I would remove it and use the win 7 firewall and Microsoft security essentials

http://files.avast.com/files/eng/aswclear5.exe

http://www.microsoft.com/security_essentials/

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\052511-28782-01 - Copy.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16792.amd64fre.win7_gdr.110408-1633
Machine Name:
Kernel base = 0xfffff800`02c5d000 PsLoadedModuleList = 0xfffff800`02e9ae50
Debug session time: Wed May 25 13:07:47.911 2011 (GMT-4)
System Uptime: 0 days 0:06:04.254
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {f6, 364, fffffa800b4c2060, fffff880052fdd78}

Unable to load image ISWKL.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ISWKL.sys
*** ERROR: Module load completed but symbols could not be loaded for ISWKL.sys
Probably caused by : ISWKL.sys ( ISWKL+1d78 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 0000000000000364, Handle value being referenced.
Arg3: fffffa800b4c2060, Address of the current process.
Arg4: fffff880052fdd78, Address inside the driver that is performing the incorrect reference.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_f6

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  ForceField.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800031573dc to fffff80002ccd700

STACK_TEXT:  
fffff880`0adb2fe8 fffff800`031573dc : 00000000`000000c4 00000000`000000f6 00000000`00000364 fffffa80`0b4c2060 : nt!KeBugCheckEx
fffff880`0adb2ff0 fffff800`0316cae4 : 00000000`00000364 fffffa80`0b4c2060 00000000`00000004 fffff880`0adb4000 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`0adb3030 fffff800`02f27fa0 : 00000000`0000003e fffff880`0adb3238 fffff880`0adb3700 00000000`00000030 : nt!VfCheckUserHandle+0x1b4
fffff880`0adb3110 fffff800`02fde420 : fffff880`0adb3700 fffffa80`00001000 fffffa80`069c28d0 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x20a4e
fffff880`0adb31e0 fffff800`02ccc953 : 00000000`00000364 fffffa80`0b752b60 fffff880`0adb38e0 fffff800`00000030 : nt!NtQueryInformationProcess+0x37f
fffff880`0adb3650 fffff800`02cc8ef0 : fffff800`0315c1a3 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0adb3858 fffff800`0315c1a3 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiServiceLinkage
fffff880`0adb3860 fffff880`052fdd78 : fffff980`2055cf80 fffff880`0adb3ca0 00000000`00000010 fffff8a0`02d42000 : nt!VfZwQueryInformationProcess+0x63
fffff880`0adb38b0 fffff980`2055cf80 : fffff880`0adb3ca0 00000000`00000010 fffff8a0`02d42000 fffff880`0adb3968 : ISWKL+0x1d78
fffff880`0adb38b8 fffff880`0adb3ca0 : 00000000`00000010 fffff8a0`02d42000 fffff880`0adb3968 00000000`00000000 : 0xfffff980`2055cf80
fffff880`0adb38c0 00000000`00000010 : fffff8a0`02d42000 fffff880`0adb3968 00000000`00000000 00000000`00000000 : 0xfffff880`0adb3ca0
fffff880`0adb38c8 fffff8a0`02d42000 : fffff880`0adb3968 00000000`00000000 00000000`00000000 00000000`00000000 : 0x10
fffff880`0adb38d0 fffff880`0adb3968 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff8a0`02d42000
fffff880`0adb38d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff880`0adb3968


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ISWKL+1d78
fffff880`052fdd78 8bc8            mov     ecx,eax

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  ISWKL+1d78

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ISWKL

IMAGE_NAME:  ISWKL.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d5a8e7c

FAILURE_BUCKET_ID:  X64_0xc4_f6_ISWKL+1d78

BUCKET_ID:  X64_0xc4_f6_ISWKL+1d78

Followup: MachineOwner
---------

Ninebreaker · 26 May 2011

Thank you i will try this i will post in a few days from now if this has fxed the problem