Blue Screen of death when logging in

CommonCents · 10 Mar 2012

Windows 7 . . . - x86 (32-bit) - full retail version? - What is the age of system (hardware)? about 3-4 years old - What is the age of OS installation (have you re-installed the OS?) about a year and half (no)

Issue: Computer was working fine then all of a sudden it went to a blue screen. I have had any hardware or software changes before the issue, it just pop up. I can get in through safe mode though. I've attached the file. If there is anything else i need to do, please let me know.

panais · 10 Mar 2012

Hi and welcome to SF :)

I have analyzed the crash\bsod files and i can see multiple security programs installed in your system.

Have in mind that 2 or more a.v. in the same system in many cases is not double protection but double the problems.

In this order,

a) Remove AVG from your system.

b) Remove Avast from your system.

c) Remove PC Tools Security from your system.

d) Remove Lavasoft\Ad-Aware from your system.

e) Remove Spyware Terminator from your system.

I dont know if i missed anything.

With simple words remove all the security software from your system.

For testing purposes,for the moment download install and use only the Microsoft Security Essentials with windows firewall enable.

Run SFC /SCANNOW Command - System File Checker
You may need to run it 2-3 times to "fix" everything.

Finish with the above steps and post back with results\news.

CommonCents · 10 Mar 2012

for some reason i can't uninstall adaware. the system gets locked up. also the other programs are still showing up in the control panel even though i've uninstalled them. not sure what i'm suppose to do now.

A Guy · 10 Mar 2012

Not to get in panais way, but here are some lists of AV removal tools, and a link to Revo Uninstaller to hopefully help you on removal.

Comprehensive List of Uninstallers or Removal Tools for Antivirus Software | Raymond.CC Blog

Security Software | SingularLabs

Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

A Guy

panais · 11 Mar 2012

CommonCents said:

for some reason i can't uninstall adaware. the system gets locked up. also the other programs are still showing up in the control panel even though i've uninstalled them. not sure what i'm suppose to do now.

For the adaware uninstallation enter in Safe Mode and try to uninstall the program again.

Restart in normal mode and follow A Guy suggestion.

Then download\install CCleaner - Standard and run a Registry\Scan for issues clean up.

Then run again the SFC /SCANNOW Command - System File Checker

quickdraw2011 · 11 Mar 2012

If I can't remove a program in ADD/REMOVE PROGRAMS, I usually remove them using REGISTRY EDITOR.

CommonCents · 11 Mar 2012

Good news is that I got the AV programs removed. I really like that Revo program.

Bad news is, I'm still getting the issue. I can actually login under my name though but after about 5 mins the blue screen shows up. I'm going to post the new dump file later today to see if there was a way to find what the issue is.

CommonCents · 11 Mar 2012

updated file attached

writhziden · 11 Mar 2012

Possible out of date drivers:

Code:

VSTCNXT3	97129000	971de000	Wed Oct 15 18:29:13 2008 (48f68ad9)	000ac12e		VSTCNXT3.SYS
VSTBS23	95f3c000	95f88000	Wed Oct 15 18:30:15 2008 (48f68b17)	000440b7		VSTBS23.SYS
VSTDPV3	97027000	97129000	Wed Oct 15 18:32:04 2008 (48f68b84)	000f0c1e		VSTDPV3.SYS
e1e6032	965a3000	965db000	Tue Mar 24 12:16:11 2009 (49c9236b)	0003ff3e		e1e6032.sys
HCW85BDA	96417000	9656b800	Mon May 11 01:23:35 2009 (4a07d277)	0015bef8		HCW85BDA.sys

VSTCNXT3.SYS
VSTBS23.SYS
VSTDPV3.SYS
e1e6032.sys
HCW85BDA.sys

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\CommonCents\Windows_NT6_BSOD_jcgriff2\031012-33197-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x8304f000 PsLoadedModuleList = 0x831984d0
Debug session time: Sat Mar 10 15:53:39.064 2012 (UTC - 6:00)
System Uptime: 0 days 0:01:17.890
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.....
Unable to load image \SystemRoot\system32\drivers\iaStorV.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for iaStorV.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStorV.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 83a66e74, a7d3370c, 0}

Unable to load image \SystemRoot\System32\Drivers\aswSnx.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSnx.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswSnx.SYS
*** WARNING: Unable to verify timestamp for AVGIDSFilter.sys
*** ERROR: Module load completed but symbols could not be loaded for AVGIDSFilter.sys
Probably caused by : iaStorV.sys ( iaStorV+41e74 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 83a66e74, The address that the exception occurred at
Arg3: a7d3370c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
iaStorV+41e74
83a66e74 8b4704          mov     eax,dword ptr [edi+4]

TRAP_FRAME:  a7d3370c -- (.trap 0xffffffffa7d3370c)
ErrCode = 00000000
eax=88d33770 ebx=00000000 ecx=0000000e edx=88d33700 esi=88d33700 edi=00000000
eip=83a66e74 esp=a7d33780 ebp=a7d33790 iopl=0         nv up ei ng nz na po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010283
iaStorV+0x41e74:
83a66e74 8b4704          mov     eax,dword ptr [edi+4] ds:0023:00000004=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  FreeAgentServi

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8308658e to 83a66e74

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
a7d33790 8308658e 88018d00 88d33770 897fe240 iaStorV+0x41e74
a7d337a8 838f440f a7d33854 a53248b0 a53248d4 nt!IofCallDriver+0x63
a7d337d4 916f9ba4 897fe240 897d41b8 36a61a1a fltmgr!FltIsVolumeWritable+0x77
a7d33838 838eabf5 000000a4 00000005 01000008 aswSnx+0x2ba4
a7d3386c 838eb417 897fe918 00000005 245d21e6 fltmgr!FltpDoInstanceSetupNotification+0x69
a7d338b8 838eb7d1 88182008 897fe240 00000005 fltmgr!FltpInitInstance+0x25d
a7d33928 838eb8d7 88182008 897fe240 00000005 fltmgr!FltpCreateInstanceFromName+0x285
a7d33994 838f4cde 88182008 897fe240 00000005 fltmgr!FltpEnumerateRegistryInstances+0xf9
a7d339e4 838e97f4 897fe240 896be008 8971a0a8 fltmgr!FltpDoFilterNotificationForNewVolume+0xe0
a7d33a28 8308658e 88d337c8 897fe240 897ca6c0 fltmgr!FltpCreate+0x206
a7d33a40 96eb040a 8971a0a8 897ca6c0 88b38658 nt!IofCallDriver+0x63
a7d33a70 8308658e 897ca6c0 896be008 8971a104 AVGIDSFilter+0x440a
a7d33a88 83295367 8ff3da77 a7d33c30 00000000 nt!IofCallDriver+0x63
a7d33b60 83274b6e 88018d00 a5dcba38 897a7908 nt!IopParseDevice+0xed7
a7d33bdc 83284f80 00000000 a7d33c30 00000040 nt!ObpLookupObjectName+0x4fa
a7d33c38 8327ba5e 016bc368 85dcba38 00000001 nt!ObOpenObjectByName+0x165
a7d33cb4 8329f2d6 016bc3c4 c0100080 016bc368 nt!IopCreateFile+0x673
a7d33d00 8308d21a 016bc3c4 c0100080 016bc368 nt!NtCreateFile+0x34
a7d33d00 77c77094 016bc3c4 c0100080 016bc368 nt!KiFastCallEntry+0x12a
016bc3cc 00000000 00000000 00000000 00000000 0x77c77094


STACK_COMMAND:  kb

FOLLOWUP_IP: 
iaStorV+41e74
83a66e74 8b4704          mov     eax,dword ptr [edi+4]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  iaStorV+41e74

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: iaStorV

IMAGE_NAME:  iaStorV.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c11870e

FAILURE_BUCKET_ID:  0x8E_iaStorV+41e74

BUCKET_ID:  0x8E_iaStorV+41e74

Followup: MachineOwner
---------

AVGIDSFilter was in the stack. I suspect this crash was due to AVG. Remove AVG using the AVG Remover. It appears that Revo did not remove all remnants of the software. Replace with either
Microsoft Security Essentials - Free Antivirus for Windows
or the
Good and Free system security combination.
Update your Intel drivers using the Intel® Driver Update Utility
Update your Hauppauge drivers.

Before using Revo, did you read the instructions for it carefully? Revo is a great tool, but used incorrectly, it can cause system problems.

Also, thanks for noticing Avast, panais. Nice catch!

panais · 11 Mar 2012

In addition of writhziden advice,

I can see also Avast in the stack,so use also this http://files.avast.com/files/eng/aswclear5.exe to remove any avast fragments.

Code:

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 83a66e74, a7d3370c, 0}

Unable to load image \SystemRoot\System32\Drivers\aswSnx.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSnx.SYS <---< Avast
*** ERROR: Module load completed but symbols could not be loaded for aswSnx.SYS
*** WARNING: Unable to verify timestamp for AVGIDSFilter.sys <---< Avg
*** ERROR: Module load completed but symbols could not be loaded for AVGIDSFilter.sys
Probably caused by : iaStorV.sys ( iaStorV+41e74 )

Followup: MachineOwner