Windows 7 - BSOD's

I have had a number of BSOD's over the past two months, and I can't seem to pin it down. I actually had a BSOD while running utility that I downloaded from this site, but it went fine the second time.

I am running a Samsung Q430, Core i5 - 450M, Nvidia 310M. I have replaced the HDD with a Seagate Momentus XT 500GB 7200RPM drive, and replaced the memory, it is running 8GB of DDR3 PC3-8500F.

I am running 64bit Win7 Enterprise. The BSODs started after the HDD/RAM was installed, which was followed by a clean install of Win7 Enterprise 64bit. They are seemingly random. The HDD firmware is up to date (ST23). I have tried putting in the original RAM for a number of days, it made no difference.

I have run CHKDSK, a memtest, and the seagate utlities, it returned no errors. I tried the windows driver verifier, but when it hit the bad driver it would BSOD, but it wasn't able to write the dump file, which makes me think the issue is HDD or SATA controller related.

For some reason 'perfmon /report' just hung on gathering data for 60 seconds... I ran what I thought it would generate and attached that, as well as the zip file with the output from the bsod utility.

I ran a utility to wipe out all the Nvidia drivers, and reinstalled them. That didn't appear to be the issue.

Thanks in advance for your help,

Grant

gmc74 said:

I have had a number of BSOD's over the past two months, and I can't seem to pin it down. I actually had a BSOD while running utility that I downloaded from this site, but it went fine the second time.

I am running a Samsung Q430, Core i5 - 450M, Nvidia 310M. I have replaced the HDD with a Seagate Momentus XT 500GB 7200RPM drive, and replaced the memory, it is running 8GB of DDR3 PC3-8500F.

I am running 64bit Win7 Enterprise. The BSODs started after the HDD/RAM was installed, which was followed by a clean install of Win7 Enterprise 64bit. They are seemingly random. The HDD firmware is up to date (ST23). I have tried putting in the original RAM for a number of days, it made no difference.

I have run CHKDSK, a memtest, and the seagate utlities, it returned no errors. I tried the windows driver verifier, but when it hit the bad driver it would BSOD, but it wasn't able to write the dump file, which makes me think the issue is HDD or SATA controller related.

For some reason 'perfmon /report' just hung on gathering data for 60 seconds... I ran what I thought it would generate and attached that, as well as the zip file with the output from the bsod utility.

I ran a utility to wipe out all the Nvidia drivers, and reinstalled them. That didn't appear to be the issue.

Thanks in advance for your help,

Grant

Ok where to start


1-SPTD.sys Daemon tools alcohol120) A HUGE BSOD cause.

Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads
[/quote]
You can use MagicDisc as an alternative.

Freeware MagicISO Virtual CD/DVD-ROM(MagicDisc) Overview

2-abiyozzl.SYS absolutely no refernce to this in google. may be a virus. Should at least be renamed to *.old.

3-athrx.sys Your wifi driver. Needs to be updated and re-installed.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\101810-18922-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03017000 PsLoadedModuleList = 0xfffff800`03254e50
Debug session time: Mon Oct 18 20:24:50.783 2010 (GMT-5)
System Uptime: 0 days 0:00:28.360
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {40, 0, fffffa800ab80220, 0}

Unable to load image \SystemRoot\system32\DRIVERS\athrx.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for athrx.sys
*** ERROR: Module load completed but symbols could not be loaded for athrx.sys
Probably caused by : athrx.sys ( athrx+40829 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000040, acquiring a spinlock when not at DISPATCH_LEVEL.
Arg2: 0000000000000000, current IRQL,
Arg3: fffffa800ab80220, spinlock address
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_40

CURRENT_IRQL:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from fffff800035113dc to fffff80003087740

STACK_TEXT:  
fffff880`030cc608 fffff800`035113dc : 00000000`000000c4 00000000`00000040 00000000`00000000 fffffa80`0ab80220 : nt!KeBugCheckEx
fffff880`030cc610 fffff800`035227af : 00000000`00000205 00000001`00000000 fffffa80`00000000 fffff880`0b2ec756 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`030cc650 fffff880`0b288829 : fffff980`07b64f88 fffff880`04a86000 00000000`00000080 fffff880`0b2b5203 : nt!VerifierKeAcquireSpinLockAtDpcLevel+0xa0
fffff880`030cc6b0 fffff980`07b64f88 : fffff880`04a86000 00000000`00000080 fffff880`0b2b5203 fffffa80`00000020 : athrx+0x40829
fffff880`030cc6b8 fffff880`04a86000 : 00000000`00000080 fffff880`0b2b5203 fffffa80`00000020 fffff880`0337f980 : 0xfffff980`07b64f88
fffff880`030cc6c0 00000000`00000080 : fffff880`0b2b5203 fffffa80`00000020 fffff880`0337f980 00000020`00000003 : 0xfffff880`04a86000
fffff880`030cc6c8 fffff880`0b2b5203 : fffffa80`00000020 fffff880`0337f980 00000020`00000003 fffff980`07886430 : 0x80
fffff880`030cc6d0 fffffa80`00000020 : fffff880`0337f980 00000020`00000003 fffff980`07886430 fffff980`07886430 : athrx+0x6d203
fffff880`030cc6d8 fffff880`0337f980 : 00000020`00000003 fffff980`07886430 fffff980`07886430 00000000`0a7e0000 : 0xfffffa80`00000020
fffff880`030cc6e0 00000020`00000003 : fffff980`07886430 fffff980`07886430 00000000`0a7e0000 fffffa80`0a7e0039 : 0xfffff880`0337f980
fffff880`030cc6e8 fffff980`07886430 : fffff980`07886430 00000000`0a7e0000 fffffa80`0a7e0039 fffff880`00000000 : 0x20`00000003
fffff880`030cc6f0 fffff980`07886430 : 00000000`0a7e0000 fffffa80`0a7e0039 fffff880`00000000 00000000`00000001 : 0xfffff980`07886430
fffff880`030cc6f8 00000000`0a7e0000 : fffffa80`0a7e0039 fffff880`00000000 00000000`00000001 fffff980`10fa0760 : 0xfffff980`07886430
fffff880`030cc700 fffffa80`0a7e0039 : fffff880`00000000 00000000`00000001 fffff980`10fa0760 fffff880`030ccbc0 : 0xa7e0000
fffff880`030cc708 fffff880`00000000 : 00000000`00000001 fffff980`10fa0760 fffff880`030ccbc0 fffffa80`067fd040 : 0xfffffa80`0a7e0039
fffff880`030cc710 00000000`00000001 : fffff980`10fa0760 fffff880`030ccbc0 fffffa80`067fd040 fffff880`04a86000 : 0xfffff880`00000000
fffff880`030cc718 fffff980`10fa0760 : fffff880`030ccbc0 fffffa80`067fd040 fffff880`04a86000 fffff880`0b288ed6 : 0x1
fffff880`030cc720 fffff880`030ccbc0 : fffffa80`067fd040 fffff880`04a86000 fffff880`0b288ed6 fffffa80`0ab80030 : 0xfffff980`10fa0760
fffff880`030cc728 fffffa80`067fd040 : fffff880`04a86000 fffff880`0b288ed6 fffffa80`0ab80030 fffff880`0b2b0000 : 0xfffff880`030ccbc0
fffff880`030cc730 fffff880`04a86000 : fffff880`0b288ed6 fffffa80`0ab80030 fffff880`0b2b0000 fffff980`07880003 : 0xfffffa80`067fd040
fffff880`030cc738 fffff880`0b288ed6 : fffffa80`0ab80030 fffff880`0b2b0000 fffff980`07880003 fffff980`07b64f88 : 0xfffff880`04a86000
fffff880`030cc740 fffffa80`0ab80030 : fffff880`0b2b0000 fffff980`07880003 fffff980`07b64f88 fffffa80`0ab80030 : athrx+0x40ed6
fffff880`030cc748 fffff880`0b2b0000 : fffff980`07880003 fffff980`07b64f88 fffffa80`0ab80030 00000000`00000000 : 0xfffffa80`0ab80030
fffff880`030cc750 fffff980`07880003 : fffff980`07b64f88 fffffa80`0ab80030 00000000`00000000 00000000`00000000 : athrx+0x68000
fffff880`030cc758 fffff980`07b64f88 : fffffa80`0ab80030 00000000`00000000 00000000`00000000 fffff880`0b2b3974 : 0xfffff980`07880003
fffff880`030cc760 fffffa80`0ab80030 : 00000000`00000000 00000000`00000000 fffff880`0b2b3974 fffffa80`0ab80030 : 0xfffff980`07b64f88
fffff880`030cc768 00000000`00000000 : 00000000`00000000 fffff880`0b2b3974 fffffa80`0ab80030 fffff880`00000000 : 0xfffffa80`0ab80030


STACK_COMMAND:  kb

FOLLOWUP_IP: 
athrx+40829
fffff880`0b288829 ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  athrx+40829

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: athrx

IMAGE_NAME:  athrx.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c7f6929

FAILURE_BUCKET_ID:  X64_0xc4_40_VRF_athrx+40829

BUCKET_ID:  X64_0xc4_40_VRF_athrx+40829

Followup: MachineOwner
---------

Thanks for the quick reply, I really appreciate your assistance.

I removed demon tools, and ran the sptd uninstaller you linked to.

I can't find 'abiyozzl.SYS' on my system anywhere, do you know where you saw that reference?

I am in the process of updating the wireless driver.

Thanks again for the help, I will let you know how it turns out.

Grant

Thanks Carl.

I searched, and none of those SYS files are still on my system, in fact, I went through all the .sys files to see if there was anything strange, and I didn't find anything. I did some research after zigzag's post, those are created by sptd.sys. I removed sptd and daemon tool, so these are gone too.

The secugen driver is for a USB fingerprint reader, I am removing that as well.

I downloaded and updated Malwarebytes, it is running. I had another BSOD about an hour ago.

It came back clean -

Malwarebytes' Anti-Malware 1.46
Malwarebytes

Database version: 5165

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

11/21/2010 2:03:55 PM
mbam-log-2010-11-21 (14-03-55).txt

Scan type: Full scan (C:\|)
Objects scanned: 501457
Time elapsed: 1 hour(s), 20 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Attached is a zip of the minidump

Is that good, or do you want me to run the utility I ran yesterday and upload that?

Thanks again for the help!

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: C:\Symbols;C:\websymbols;C:\Windows\symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03009000 PsLoadedModuleList = 0xfffff800`03246e50
Debug session time: Sun Nov 21 12:04:19.662 2010 (UTC - 7:00)
System Uptime: 1 days 15:53:50.864
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details
Loading unloaded module list
...............................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck DE, {2, fffff8a00edf7bf0, fffff8a00edf7bf1, 10de668c0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+2d260 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

POOL_CORRUPTION_IN_FILE_AREA (de)
A driver corrupted pool memory used for holding pages destined for disk.
This was discovered by the memory manager when dereferencing the file.
Arguments:
Arg1: 0000000000000002
Arg2: fffff8a00edf7bf0
Arg3: fffff8a00edf7bf1
Arg4: 000000010de668c0

Debugging Details:
------------------


DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xDE

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff8000301e3f3 to fffff80003079740

STACK_TEXT:  
fffff880`08dee1d8 fffff800`0301e3f3 : 00000000`000000de 00000000`00000002 fffff8a0`0edf7bf0 fffff8a0`0edf7bf1 : nt!KeBugCheckEx
fffff880`08dee1e0 fffff800`0305eb82 : 00000000`00000000 fffffa80`0d4a7800 00000000`00000000 fffff880`08dee400 : nt! ?? ::FNODOBFM::`string'+0x2d260
fffff880`08dee2d0 fffff800`0304b4e1 : fffffa80`07108c98 fffff800`031f44f0 fffff8a0`00000000 fffff880`00000000 : nt!CcPurgeCacheSection+0x172
fffff880`08dee340 fffff800`0309e076 : fffffa80`0d4a7850 fffff800`031f44f0 00000000`00000001 fffffa80`0d4a7850 : nt!CcPurgeAndClearCacheSection+0x75
fffff880`08dee3f0 fffff880`0161ef5c : 00000000`00000000 00000000`00000000 fffff8a0`0ecad140 00000000`00000000 : nt!CcSetFileSizesEx+0x2c6
fffff880`08dee470 fffff880`016966a0 : 00000000`00000000 fffff8a0`0ecad140 00000000`00000000 fffffa80`0d690801 : Ntfs!NtfsSetBothCacheSizes+0x50
fffff880`08dee4d0 fffff880`01694732 : fffffa80`0d6908f0 fffffa80`0b5d5570 fffffa80`0d690800 00000000`00000000 : Ntfs!NtfsDeleteAllocation+0x2cc
fffff880`08dee5b0 fffff880`016908d1 : fffffa80`0d6908f0 fffffa80`07774f70 fffff8a0`0ecad010 00000000`00002020 : Ntfs!NtfsReplaceAttribute+0x16e
fffff880`08dee6a0 fffff880`016a38c5 : fffffa80`0d6908f0 fffffa80`07774c60 fffff8a0`0ecad3a8 fffff8a0`0ecad000 : Ntfs!NtfsOverwriteAttr+0x585
fffff880`08dee800 fffff880`016a3eff : fffffa80`0d6908f0 fffffa80`07774c60 fffff8a0`0ecad3a8 fffff880`00000078 : Ntfs!NtfsOpenAttributeInExistingFile+0x6e5
fffff880`08dee990 fffff880`016b4e76 : fffffa80`0d6908f0 fffffa80`07774c60 fffff8a0`0ecad3a8 00000000`00000705 : Ntfs!NtfsOpenExistingPrefixFcb+0x1ef
fffff880`08deea80 fffff880`016af28d : fffffa80`0d6908f0 fffffa80`07774c60 fffff880`08deec60 fffff880`08deeca8 : Ntfs!NtfsFindStartingNode+0x5e6
fffff880`08deeb50 fffff880`01618c0d : fffffa80`0d6908f0 fffffa80`07774c60 fffff880`028144b0 fffffa80`06e1e800 : Ntfs!NtfsCommonCreate+0x3dd
fffff880`08deed30 fffff800`030715c7 : fffff880`02814420 00000000`00000000 00000000`00000000 00000000`0018f360 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`08deed60 fffff800`03071581 : 00000000`00000000 fffffa80`0d16e060 fffff880`08def000 fffff800`0308901a : nt!KySwitchKernelStackCallout+0x27
fffff880`028142f0 fffff800`0308901a : fffffa80`077ea8b0 fffffa80`0d16e060 fffffa80`0ad48000 fffff880`0440e691 : nt!KiSwitchKernelStackContinue
fffff880`02814310 fffff880`01618b2f : fffff880`01618bf0 fffff880`02814420 fffff880`02814400 fffff880`016ba32d : nt!KeExpandKernelStackAndCalloutEx+0x29a
fffff880`028143f0 fffff880`016b59c0 : 00000000`00000000 00000000`00000000 fffff880`02814640 fffffa80`07774c60 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`02814450 fffff880`0155123f : fffffa80`09b9e030 fffffa80`07774c60 00000000`00000000 fffffa80`077ba8d0 : Ntfs!NtfsFsdCreate+0x1b0
fffff880`02814600 fffff880`015702b9 : fffffa80`07774c60 fffffa80`07a67010 fffffa80`07774c00 fffffa80`077ba8d0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`02814690 fffff800`0337c807 : 00000000`00000005 fffff800`0337c260 fffffa80`06d1da50 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`02814740 fffff800`03372e84 : fffffa80`0779acd0 00000000`00000000 fffffa80`0dc1bb10 0000004e`300aba01 : nt!IopParseDevice+0x5a7
fffff880`028148d0 fffff800`03377e4d : fffffa80`0dc1bb10 fffff880`02814a30 fffffa80`00000040 fffffa80`067f0f30 : nt!ObpLookupObjectName+0x585
fffff880`028149d0 fffff800`0337e917 : fffffa80`0767db80 00000000`00000005 0003b11d`0001f801 fffff800`0307f9a2 : nt!ObOpenObjectByName+0x1cd
fffff880`02814a80 fffff800`03388520 : 00000000`039fe148 00000000`40100080 00000000`00000000 00000000`039fe160 : nt!IopCreateFile+0x2b7
fffff880`02814b20 fffff800`03078993 : 00000000`73a62450 00000000`039feae0 00000000`73a62450 00000000`039feae0 : nt!NtCreateFile+0x78
fffff880`02814bb0 00000000`77c102aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`039fe0d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c102aa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+2d260
fffff800`0301e3f3 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+2d260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0xDE_nt!_??_::FNODOBFM::_string_+2d260

BUCKET_ID:  X64_0xDE_nt!_??_::FNODOBFM::_string_+2d260

Followup: MachineOwner
---------

CarlTR6 said:

That is good news. Keep Malwarebytes installed it is a good, solid program and works very well with Win 7. I use it as an on demand scanner.

Yeah, I used to run ad-aware, I hear this is as good or better. I will be keeping it around.

If I can't get this resolved by next weekend, I think I am going to get an optical to hdd kit, pull the dvd drive and replace it with an SSD. Reinstall everything on that, and use this drive for app storage... half of me wants to avoid that, the other half wants the SSD.

I removed the secugen drivers, I was testing it for work, so the device hasn't been installed for a while.