Ok, let see what the hell is wrong here... Yesterday alone there were 2 dumps, again coming out of nowhere.
I always install updates as soon as they're available (my ThinkPad updates are installed using its official "System Update" software). Now I start thinking if the latest versions are good or bad to the system. If they cause BSOD, in the future should I not update them as long as the system runs ok?
one more, just 1 minute ago...
Have you started using Driver Verifier as I requested in my original post? The last 3 BSOD's don't mention that Driver Verifier is running
Additionally, since the symbols aren't working correctly, the BSOD doesn't give us any further information.
Please compare this list of older drivers with the original list. These drivers need to be either removed or updated. Anything dated 2007 and earlier probably doesn't know about Win7 - so it's compatibility is in question.
Summary of BSOD:Code:Alidevice.SYS Sun Jul 13 04:10:10 2008 HSX_CNXT.sys Fri Dec 22 14:48:52 2006 HSX_DPV.sys Fri Dec 22 14:50:21 2006 HSXHWAZL.sys Fri Dec 22 14:49:02 2006 mdmxsdk.sys Mon Jun 19 17:26:59 2006 psadd.sys Mon Feb 19 13:56:45 2007 PxHelp20.sys Wed Jun 20 18:26:00 2007 rimmptsk.sys Wed Nov 16 21:28:31 2005 rimsptsk.sys Thu Dec 22 03:02:21 2005 rixdptsk.sys Tue Nov 14 20:35:19 2006 smiif32.sys Mon May 12 05:01:06 2008 sncduvc.SYS Mon Dec 29 04:13:29 2008 tifsfilt.sys Wed Aug 29 08:37:17 2007 timntr.sys Wed Aug 29 08:13:12 2007 Tppwr32v.sys Thu Jun 12 22:27:57 2008 Uim_IM.sys Sat Dec 13 06:02:30 2008 UimBus.sys Sat Dec 13 06:02:24 2008 UimFIO.SYS Sat Dec 13 06:02:25 2008 WinVd32.sys Wed Dec 31 11:26:00 2008 xaudio.sys Tue Nov 28 19:44:50 2006
Code:*** WARNING: Unable to verify timestamp for ntkrnlpa.exe *** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe Built by: 7600.16481.x86fre.win7_gdr.091207-1941 Debug session time: Tue Mar 23 14:41:27.371 2010 (GMT-4) System Uptime: 0 days 3:23:23.415 *** WARNING: Unable to verify timestamp for ntkrnlpa.exe *** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe BUGCHECK_STR: 0x50 ииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииии *** WARNING: Unable to verify timestamp for ntkrnlpa.exe *** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe Built by: 7600.16481.x86fre.win7_gdr.091207-1941 Debug session time: Mon Mar 22 19:11:53.033 2010 (GMT-4) System Uptime: 0 days 6:43:06.077 *** WARNING: Unable to verify timestamp for ntkrnlpa.exe *** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe BUGCHECK_STR: 0x50 ииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииии *** WARNING: Unable to verify timestamp for ntkrnlpa.exe *** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe Built by: 7600.16481.x86fre.win7_gdr.091207-1941 Debug session time: Mon Mar 22 12:27:55.561 2010 (GMT-4) System Uptime: 0 days 0:15:43.605 *** WARNING: Unable to verify timestamp for ntkrnlpa.exe *** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe BUGCHECK_STR: 0x50
I just tried the Driver Verifier once. Windows failed to restart immediately after. BSOD (different from previous memory dump) appeared with one line pointing to "UIM_IM.sys Address 86BC2A97 base at 86BC1000 DateStamp 49439646". I manually shut it down. Then it started into the Startup Repair program and suggested me go back to the last restore point. I yes it and it restarted successfully, I find no extra minidump file in the windows\Minidump directory.
I then googled "UIM_IM.sys" and found it's a driver from Paragon. I did install a Paragon Backup software long ago and already uninstalled it. Can I now just delete that file in windows\system32\drivers, or how can I remove it?
Uninstall the Paragon program.
Then go and check to make sure that the UIM_IM.sys driver is gone from C:\Windows\System32\drivers
It has been uninstalled long ago. UIM_IM.sys is still there.
I'm a firm believer in using uninstall utilities rather than ripping things out by the roots.
But, at times, there is justification for manually removing things.
I'd suggest renaming it to something like UIM_IM.BAK
Also rename these other 2 Paragon drivers:
UimBus.sys Sat Dec 13 06:02:24 2008
UimFIO.SYS Sat Dec 13 06:02:25 2008
Then, use this free utility to locate the entry that's still loading any of the Paragon stuff: Autoruns for Windows
UIM_IM.sys and the other two have been renamed. I've run the verifier several times more, here is what I got:
SPBBCDrv.sys caused a failure to start. It's associated with Symantec, which says it would be false alarm (see here). So I just excluded it from the verifier's checklist.
Restarted again and another driver WinFl32.sys caused a failure. It's generated by a software called "Folder Lock", which I uninstalled last month. So I just renamed it.
Now the system starts successfully. Let's see...
BTW, Autoruns is such a neat handy tool for debugging. Thanks!
STOP using Driver Verifier for now.
If you get another BSOD - then use Driver Verifier.
Include ALL 3rd party drivers (including Symantec/Norton) when using Driver Verifier.
Symantec/Norton can cause false positives - BUT - they can also be your problem.
The test to rule out Norton (after using Driver Verifier) is as follows:
Anti-Virus Removal:
Please do the following:
- download a free antivirus for testing purposes: Free AntiVirus
- uninstall the Norton from your system (you can reinstall it, if so desired, when we're done troubleshooting)
- remove any remnants of Norton using this free tool: Download and run the Norton Removal Tool
- IMMEDIATELY install and update the free antivirus
- check to see if this fixes the BSOD's
Thanks for the instructions. I've stopped the verifier.
Actually since I completely removed the ThinkPad Power Manager and its driver, I haven't experienced another BSOD. Let's see if that's the real cause...
Quote