BSOD and system freezes requiring hard reboot Win7x64

NCostanza · 26 Mar 2012

I seem to have a couple of common ones; one refers to attempting to write to a read-only memory area. Another talks about a clock interrupt. I stumbled on the jcgriff2 website with diagnostic tools and went through those steps and have three zip files with the results. I also updated drivers using Uniblue, and updated the Award BIOS, ran a memory check, and chkdsk.

I appreciate any help you guys can give. Since about Windows 95, I haven't really kept up on the technical side so much.

Thanks in advance.

writhziden · 27 Mar 2012

Security software:

Code:

ssscheduler.exe	c:\program files (x86)\mcafee security scan\2.0.181\ssscheduler.exe	4064	8	200	1380	3/26/2012 8:55 PM	2.0.181.0	249.55 KB (255,536 bytes)	1/15/2010 5:49 AM
sdwinsec.exe	c:\program files (x86)\spybot - search & destroy\sdwinsec.exe	2408	8	200	1380	3/26/2012 8:54 PM	1.0.0.12	1.10 MB (1,153,368 bytes)	3/13/2012 8:29 PM
teatimer.exe	c:\program files (x86)\spybot - search & destroy\teatimer.exe	3904	4	200	1380	3/26/2012 8:55 PM	1.6.6.32	2.16 MB (2,260,480 bytes)	3/13/2012 8:29 PM
avastui.exe	c:\program files\avast software\avast\avastui.exe	2224	8	200	1380	3/26/2012 8:55 PM	7.0.1426.0	4.05 MB (4,241,512 bytes)	3/26/2012 8:23 PM
mcsacore.exe	c:\progra~2\mcafee\sitead~1\mcsacore.exe	1832	8	3072	4608	3/26/2012 8:54 PM	3.4.1.118	101.02 KB (103,440 bytes)	2/23/2012 9:52 PM
saui.exe	c:\progra~2\mcafee\sitead~1\saui.exe	3800	8	200	1380	3/26/2012 8:57 PM	3.4.1.195	276.02 KB (282,648 bytes)	2/23/2012 9:52 PM

Remove McAfee items through Start Menu -> Control Panel -> Uninstall a program

Possible out of date drivers:

Code:

PAEAFLT	fffff880`04c44000	fffff880`04c46500	Wed Sep 26 00:32:51 2007 (46f9fd13)	00009ca8		PAEAFLT.sys
SPC230NC	fffff880`05868000	fffff880`058ef000	Thu Jan 03 03:13:47 2008 (477cb55b)	0008cc2c		SPC230NC.SYS

PAEAFLT.sys
SPC230NC.SYS

Code:

Loading Dump File [D:\Kingston\BSODDmpFiles\NCostanza\Windows7_Vista_jcgriff2_2\Windows7_Vista_jcgriff2_2\032612-21406-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02c07000 PsLoadedModuleList = 0xfffff800`02e4b650
Debug session time: Mon Mar 26 20:53:07.121 2012 (UTC - 6:00)
System Uptime: 0 days 0:32:54.777
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck BE, {fffff8800f2091f0, 137df2121, fffff88007a1f9a0, b}

Unable to load image \SystemRoot\System32\Drivers\aswSnx.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSnx.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswSnx.SYS
Probably caused by : luafv.sys ( luafv!LuafvNormalizeNameComponentEx+145 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory.  The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff8800f2091f0, Virtual address for the attempted write.
Arg2: 0000000137df2121, PTE contents.
Arg3: fffff88007a1f9a0, (reserved)
Arg4: 000000000000000b, (reserved)

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xBE

PROCESS_NAME:  À
Í

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88007a1f9a0 -- (.trap 0xfffff88007a1f9a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff9801cf480b0 rbx=0000000000000000 rcx=fffff8a000306000
rdx=0000000000010000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880012d9d1d rsp=fffff88007a1fb30 rbp=fffff8a00f959140
 r8=fffff88001286200  r9=0000000000000044 r10=fffff8a00d1a9e22
r11=fffff880012dbe60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
Ntfs!FindFirstIndexEntry+0x292:
fffff880`012d9d1d 48894618        mov     qword ptr [rsi+18h],rax ds:46c0:00000000`00000018=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c2fe32 to fffff80002c83d40

STACK_TEXT:  
fffff880`07a1f838 fffff800`02c2fe32 : 00000000`000000be fffff880`0f2091f0 00000001`37df2121 fffff880`07a1f9a0 : nt!KeBugCheckEx
fffff880`07a1f840 fffff800`02c81e6e : 00000000`00000001 fffff880`0f2091f0 00000000`00000000 fffff8a0`0f9591f0 : nt! ?? ::FNODOBFM::`string'+0x4521e
fffff880`07a1f9a0 fffff880`012d9d1d : fffffa80`07676e40 fffff8a0`0f959140 fffff8a0`00010000 fffff8a0`0d1a9de0 : nt!KiPageFault+0x16e
fffff880`07a1fb30 fffff880`012c316d : fffff8a0`0f209140 00000000`00000088 fffff8a0`0f959390 fffff8a0`0f959140 : Ntfs!FindFirstIndexEntry+0x292
fffff880`07a1fbc0 fffff880`012c19ce : fffffa80`07676e40 fffff8a0`0f959390 fffff8a0`0f959140 fffffa80`07676e40 : Ntfs!NtfsRestartIndexEnumeration+0xed
fffff880`07a1fde0 fffff880`012c2ff1 : fffff880`07a202f0 00000000`00000008 fffffa80`04cbf3e0 fffffa80`07abfc10 : Ntfs!NtfsQueryDirectory+0x94e
fffff880`07a20180 fffff880`012c58ef : fffffa80`07676e40 00000000`00000000 fffff880`07a20280 00000000`00000000 : Ntfs!NtfsCommonDirectoryControl+0xa1
fffff880`07a201c0 fffff880`010bcbcf : fffffa80`07abffb0 fffffa80`07abfc10 fffffa80`07676e40 fffff880`07a201e8 : Ntfs!NtfsFsdDirectoryControl+0x10f
fffff880`07a20230 fffff880`010bfaea : 00000000`00000000 00000000`00000000 fffffa80`075a5100 fffffa80`07ec4730 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`07a202c0 fffff880`010dd978 : fffffa80`051026b0 00000000`00000022 fffffa80`04cbe800 fffffa80`07ec47e0 : fltmgr!FltPerformSynchronousIo+0x2ca
fffff880`07a20360 fffff880`05981d71 : 00000000`00000000 00000000`00000020 fffff880`07a20420 fffff880`07a204b0 : fltmgr!FltQueryDirectoryFile+0x98
fffff880`07a203a0 fffff880`010dd8c2 : 00000000`0000001f fffffa80`07037b40 fffffa80`08cf4e90 fffff800`02c99edf : luafv!LuafvNormalizeNameComponentEx+0x145
fffff880`07a204a0 fffff880`010ddafe : 00000000`00000001 00000000`0000001f fffffa80`05136650 00000000`000007ff : fltmgr!FltpCallNormalizeNameComponentHandler+0x82
fffff880`07a20500 fffff880`010def81 : fffff880`0000002c 00000000`0000002c 00000000`00000020 00000000`00000000 : fltmgr!FltpExpandShortNames+0x14e
fffff880`07a20560 fffff880`010dee1e : fffffa80`07037b40 fffffa80`075a0000 00000000`00000000 00000000`00000000 : fltmgr!FltpGetNormalizedFileNameWorker+0xc1
fffff880`07a205a0 fffff880`010c04fb : fffffa80`04cbe800 fffffa80`04b85e20 fffffa80`048da000 fffff880`07a21000 : fltmgr!FltpCreateFileNameInformation+0xee
fffff880`07a20600 fffff880`010cbb44 : fffff8a0`0ce28000 fffffa80`04b85e20 fffffa80`075a51a0 fffff8a0`0c1418d8 : fltmgr!FltpGetFileNameInformation+0x26b
fffff880`07a20680 fffff880`0407d22a : fffffa80`07037b40 00000000`00000000 fffffa80`05136802 fffff8a0`0ce28250 : fltmgr!FltGetFileNameInformation+0x184
fffff880`07a20710 fffffa80`07037b40 : 00000000`00000000 fffffa80`05136802 fffff8a0`0ce28250 00000000`00000005 : aswSnx+0xe22a
fffff880`07a20718 00000000`00000000 : fffffa80`05136802 fffff8a0`0ce28250 00000000`00000005 00000000`00000000 : 0xfffffa80`07037b40


STACK_COMMAND:  kb

FOLLOWUP_IP: 
luafv!LuafvNormalizeNameComponentEx+145
fffff880`05981d71 488b8c2410010000 mov     rcx,qword ptr [rsp+110h]

SYMBOL_STACK_INDEX:  b

SYMBOL_NAME:  luafv!LuafvNormalizeNameComponentEx+145

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: luafv

IMAGE_NAME:  luafv.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc295

FAILURE_BUCKET_ID:  X64_0xBE_luafv!LuafvNormalizeNameComponentEx+145

BUCKET_ID:  X64_0xBE_luafv!LuafvNormalizeNameComponentEx+145

Followup: MachineOwner
---------

The latest crash points to avast! but the memory stack indicates hard disk errors.

Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log.
For any drives that do not give the message:
Windows has checked the file system and found no problems
run disk check again as above. In other words, if it says:
Windows has made corrections to the file system
after running the disk check, run the disk check again.
Run the Western Digital Data Lifeguard Diagnostic tests

NCostanza · 28 Mar 2012

Thank you so much. I never would have suspected McAfee. Since I posted, I opened up the box and airspray cleaned the dust. There wasn't much since I do this regularly. I also disabled the screensaver, and the power options. I also checked for updates for the drivers you mentioned on the Pixart site to no avail. I then ran the chkdsk again, and am attaching the results. The good news is that, "knock on wood", the machine hasn't BSOD'd since I did those things.

Since there were no problems found with CHKDSK, I'm not sure I need to run the Western Digital diagnostic tests, but I will and post back what happens with that.

Thanks again. This is first time I've had hope we might get this things straightened out in awhile.

writhziden · 28 Mar 2012

You're welcome. Let us know how the system responds after you have completed the steps and had a chance to put it through the usual steps that caused problems in the past.

NCostanza · 29 Mar 2012

The Data Lifeguard test ran without finding any problems. My machine has not crashed since I made those changes. If everything stabilizes, for another 48 hours or so, I'll comeback and mark it solved. Thanks again for your help.

writhziden · 29 Mar 2012

You're welcome. Thanks for keeping us updated. :)

NCostanza · 02 Apr 2012

No more problems. Thanks again!

writhziden · 02 Apr 2012

Yeah, that clinging McAfee software (I call it clinging because it installs as a secondary install with other software like Adobe) can sometimes cause crashes if it interferes with your main security software. Glad it is resolved. :)