Second BSOD in a week with new win7 64 installation

windows defender is NOT Windows Defender Offline.

They are two 100% different animals. Microsoft, in their infinite wisdom, renamed Microsoft Standalone System Sweeper to Windows Defender Offline. The old name was meaningful.

For more info, see:
Understanding Microsoft Anti-Malware Software 2012 ~ Security Garden

Incidentally, as you noticed from the info I gave in the post on WDO, you are looking at less than 800 kb , in other words, less then 0.8 mbytes. I doubt that such a file will put you over your limit.

I would like to see the results of the previous WDO run.

# **********************INSTRUCTIONS**************************
# STEP 1 ** RUN POWERSHELL AS ADMINISTRATOR ******************
# ************************************************************
#
# WIN key | type POWERSHELL | do NOT hit ENTER |
# in the PROGRAMS list, right-click on WINDOWS POWERSHELL |
# choose "Run as administrator" |
# Click on the YES button (if such appears)
#
# WIN key = key with Microsoft log on top
#
# for the guru:
# WIN | type POWERSHELL | CTRL+SHIFT+ENTER key combo | ALT+Y keycombo
# ************************************************************
# STEP 2 ** COPY AND PASTE ***********************************
# ************************************************************
#
# COPY the script using CTRL+C,
# COPY every line of script down thru both EXIT statements
#
# PASTE into Powershell
#----Right-Click at the PowerShell Prompt
#----(Ctrl+V does not work)
#
# Start copying with first script line without a # at start of the line
# Note: Actually, you can paste the entire file if you rather
#-------Lines starting with a # are ignored by PowerShell
# ************************************************************
# STEP 3 ** SCRIPT OUTPUT & SCRIPT PURPOSE *******************
# ************************************************************
# --The script output and purpose is given at the very front of the script
#
# --The script output and purpose is given at the very front of the script
#
# ************************************************************
# ***************** NOTE - POWERSHELL VERSION*****************
# if you receive this error msg:
#--The system can not find the path specified
# you may need to update your PowerShell
# you must be using Powershell 2.0 or later.
#
# To determine your Powershell version:
#---Run PowerShell
#---enter $host.version
#---you should see at least:
# Major Minor Build Revision
# ----- ----- ----- --------
# 2......0......-1.....-1
#
# If you do not see the above, update your Vista/Win 7.
# ************************************************************
# *************** NOTE - EXECUTION POLICY*********************
# If you haven't set the execution policy, you may need to:
#---Run PowerShell
#---enter SET-EXECUTIONPOLICY -EXECUTIONPOLICY REMOTESIGNED
# ************************************************************

Script:

# ************************************************************
# Zips up your log files from Windows Defender Offline
#  and extended info about the log files
# Places WDOlogs.ZIP on your Desktop
#
# ************************************************************

function New-Zip {
    param([Parameter(Mandatory=$true, Position=0, ValueFromPipeline=$true)]
    [String] $Path, [Switch] $PassThru, [Switch] $Force )
    Process { if (Test-Path $path) {if (-not $Force) { return } }
    Set-Content $path ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))
    $item = Get-Item $path; $item.IsReadOnly = $false;if ($passThru) { $item } } }
function Copy-ToZip {param(
  [Parameter(Mandatory=$true,Position=0,ValueFromPipelineByPropertyName=$true)] [Alias('FullName')] 
  [String]$File, [Parameter(Mandatory=$true,Position=1)] [String]$ZipFile,[Switch]$HideProgress,[Switch]$Force )
  Begin {$ShellApplication = New-Object -ComObject Shell.Application
  if (-not (Test-Path $ZipFile)) {New-Zip $ZipFile};$Path = Resolve-Path $ZipFile
  $ZipPackage =$ShellApplication.Namespace("$Path")}
  Process {$RealFile = Get-Item $File; if (-not $RealFile) { return }        
  if (-not $hideProgress) {$perc +=5; if ($perc -gt 100) { $perc = 0 } 
    Write-Progress "Copying to $ZipFile" $RealFile.FullName -PercentComplete $perc}
  $Flags = 0; if ($force) {$flags = 16 -bor 1024 -bor 64 -bor 512};Write-Verbose $realFile.Fullname
   $ZipPackage.CopyHere($realFile.Fullname, $flags);Start-Sleep -Milliseconds 500}}

$fileinfo = join-path $env:TEMP \wdofileinfo.txt
IF (test-path $fileinfo) {del $fileinfo -ea:silentlycontinue -force:$true}
$dir = $env:windir + '\Microsoft Antimalware\Support'
$a = dir $dir  -rec -force -ea:silentlycontinue | sort-object -property lastwritetime 
$b = $a | where {$_.extension -eq '.log'} |Select  mode, fullname, name, creationtime, lastwritetime,  lastaccesstime, length, extension
$b | out-file -append $fileinfo
$b | foreach ($_.fullname) {get-content -path $_.fullname} | out-file -append $fileinfo 
$ziploc = $env:userprofile + '\desktop\WDOlogs.ZIP'
new-zip $ziploc -verbose:$false -ea:silentlycontinue -force:$true
copy-tozip  $fileinfo $ziploc -verbose:$false -hideprogress:$true
del $fileinfo

EXIT
EXIT

# ************************************************************ 


Attach the resulting wdologs.zip file.

Please carry out following procedure. Afterwards, then run the enclosed script and attach results.

MEMORY DUMPS - REQUIREMENTS


Enable automatic management of the Paging file
WIN + PAUSE/BREAK key combo |
Advanced system settings (left-hand side) |
Advanced tab, Performance section, Settings |
Advanced tab, Virtual Memory section, Change |
checkmark Automatically manage paging file size for all drives |
OK | OK | OK



STARTUP AND RECOVERY SETTINGS
WIN + PAUSE/BREAK key combo |
Advanced system settings (left-hand side) |
Advanced tab, Startup and Recovery section, Settings |
System Failure section | checkmark Write an Event to the system log
| uncheck Automatically restart |


Under Write debugging information, select Small memory dump |
in the Small dump directory: box, enter %SystemRoot%\Minidump| OK

If Overwrite any existing file is checked, then:
Ø Under Write debugging information, select Kernel memory dump
Ø Uncheck Overwrite any existing file
Ø Under Write debugging information, select Small memory dump
Ø OK button
If you get a crazy message from Win 7 about your paging file being too small, then just ignore the message since we have already made sure that the paging file is set to be managed by Win 7.

ENABLE THE WINDOWS ERROR REPORTING SERVICE
WIN key | type SERVICES.MSC | ENTER |
Scroll down to Windows Error Reporting Service |
Rt-clk on Windows Error Reporting Service | Properties |
General tab | for Startup type, choose Automatic |
In Service status, Start button (unless grayed out) | OK


ASSURE THAT CCLEANER IS NOT DELETING DUMPS
CCLEANER | Cleaner icon | Windows tab | System category |
Uncheck Memory Dumps
· WINDOWS ERROR REPORTING SERVICE must NOT be disabled!
· WIN | Services.msc | Enter
· Under Name, locate Windows Error Reporting Service
· If Status is not Started, then
Right-click on Windows Error Reporting Service |choose START
· If Startup Type is not Automatic, then
Right-click on Windows Error Reporting Service |
choose Properties | General tab |
set Startup type to Automatic
· Close Services.msc (I like to use ALT + F4)

After a crash, the minidump file will be in %SystemRoot%\Minidump
%SystemRoot% is generally C:\Windows

=====================================================
=====================================================

Script:

# **************************************************************
# Puts MiniDumpSettings.TXT in your user profile folder
# WIN | type %userprofile%\ then click on MiniDumpSettings.TXT
# to view the important minidump settings
# WIN = key with Microsoft logo on top
# **************************************************************
gwmi Win32_OSRecoveryConfiguration | 
select minidumpdirectory, expandedminidumpdirectory, overwriteexistingdebugfile, kerneldumponly,`
debuginfotype, autoreboot, writedebuginfo, writetosystemlog | fl > $env:userprofile\desktop\minidumpsettings.txt

EXIT
EXIT 


Ctrl + V will NOT work.

Right-click will work. You do realize that first you must use select the info to be pasted, then use CTRL+C to copy the selected info to the clipboard. Now when you right-click, what is in the clipboard gets pasted.

You can make your selection, then open NOTEPAD and paste into notepad (the info will still be in the clipboard, even after the paste) to make sure that your copied the selection to the clipboard.

Please review the following:


# **********************INSTRUCTIONS**************************
# STEP 1 ** RUN POWERSHELL AS ADMINISTRATOR ******************
# ************************************************************
#
# WIN key | type POWERSHELL | do NOT hit ENTER |
# in the PROGRAMS list, right-click on WINDOWS POWERSHELL |
# choose "Run as administrator" |
# Click on the YES button (if such appears)
#
# WIN key = key with Microsoft log on top
#
# for the guru:
# WIN | type POWERSHELL | CTRL+SHIFT+ENTER key combo | ALT+Y keycombo
# ************************************************************
# STEP 2 ** COPY AND PASTE ***********************************
# ************************************************************
#
# COPY the script using CTRL+C,
# COPY every line of script down thru both EXIT statements
#
# PASTE into Powershell
#----Right-Click at the PowerShell Prompt
#----(Ctrl+V does not work)
#
# Start copying with first script line without a # at start of the line
# Note: Actually, you can paste the entire file if you rather
#-------Lines starting with a # are ignored by PowerShell