BSOD caused by file watchdog.sys (apparently..)

Hello,

I'm running Windows 7 64 bit on a fresh new system with no re-installment of OS.

I've been having a BSOD and would be really glad if u could help me out...

Attached is my file collection app zip, I didn't attach the perfmon log because my OS is not in English and therefore the log isn't also...
I also attached the minidump from the windows driver verifier.


Thank you!

The Unturtle said:

Hello,

I'm running Windows 7 64 bit on a fresh new system with no re-installment of OS.

I've been having a BSOD and would be really glad if u could help me out...

Attached is my file collection app zip, I didn't attach the perfmon log because my OS is not in English and therefore the log isn't also...
I also attached the minidump from the windows driver verifier.


Thank you!

This crash was caused by asacpi.sys. This file is used by Asus utilites and various others. Yours is old and needs to be updated. That should resolve this issue

Run a system file check to verify and repair your system files.
To do this type cmd in search, then right click to run as administrator, then
SFC /SCANNOW

Let us know the results from the report at the end.

Ken


Analysis

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\072610-23774-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e13000 PsLoadedModuleList = 0xfffff800`03050e50
Debug session time: Sun Jul 25 17:43:17.265 2010 (GMT-4)
System Uptime: 0 days 0:01:00.826
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {f6, e4, fffffa800768fa70, fffff8801068e257}

Unable to load image \SystemRoot\system32\DRIVERS\ASACPI.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ASACPI.sys
*** ERROR: Module load completed but symbols could not be loaded for ASACPI.sys
Probably caused by : ASACPI.sys ( ASACPI+1257 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 00000000000000e4, Handle value being referenced.
Arg3: fffffa800768fa70, Address of the current process.
Arg4: fffff8801068e257, Address inside the driver that is performing the incorrect reference.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_f6

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  FourEngine.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000330d3dc to fffff80002e83600

STACK_TEXT:  
fffff880`07dbc578 fffff800`0330d3dc : 00000000`000000c4 00000000`000000f6 00000000`000000e4 fffffa80`0768fa70 : nt!KeBugCheckEx
fffff880`07dbc580 fffff800`03322ae4 : 00000000`000000e4 fffffa80`0768fa70 00000000`00000002 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`07dbc5c0 fffff800`030df580 : fffff800`03178840 fffff880`07dbc7f0 00000000`00000000 fffffa80`061b7d00 : nt!VfCheckUserHandle+0x1b4
fffff880`07dbc6a0 fffff800`0315b425 : 00000000`00000000 00000000`000f0001 00000000`00000000 fffff800`0315b400 : nt! ?? ::NNGAKEGL::`string'+0x20e1e
fffff880`07dbc770 fffff800`03322878 : fffffa80`0785e3a8 fffff800`03325bcc fffffa80`061b7c10 fffffa80`061b7c10 : nt!ObReferenceObjectByHandle+0x25
fffff880`07dbc7c0 fffff880`1068e257 : fffff980`161c0cf0 00000000`00000002 fffffa80`061b7d60 00000000`00000000 : nt!VerifierObReferenceObjectByHandle+0x48
fffff880`07dbc810 fffff980`161c0cf0 : 00000000`00000002 fffffa80`061b7d60 00000000`00000000 fffffa80`061b7d88 : ASACPI+0x1257
fffff880`07dbc818 00000000`00000002 : fffffa80`061b7d60 00000000`00000000 fffffa80`061b7d88 00000000`00000000 : 0xfffff980`161c0cf0
fffff880`07dbc820 fffffa80`061b7d60 : 00000000`00000000 fffffa80`061b7d88 00000000`00000000 00000000`00000001 : 0x2
fffff880`07dbc828 00000000`00000000 : fffffa80`061b7d88 00000000`00000000 00000000`00000001 00000000`00000000 : 0xfffffa80`061b7d60


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ASACPI+1257
fffff880`1068e257 83462001        add     dword ptr [rsi+20h],1

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  ASACPI+1257

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ASACPI

IMAGE_NAME:  ASACPI.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a0b72fd

FAILURE_BUCKET_ID:  X64_0xc4_f6_VRF_ASACPI+1257

BUCKET_ID:  X64_0xc4_f6_VRF_ASACPI+1257

Followup: MachineOwner
---------

Old drivers that need updating

Code:

                    
AsIO.sys        fffff880`0340f000    fffff880`03416000    0x00007000    0x47663d55    12/17/2007 05:11:49                        
mcdbus.sys        fffff880`04b39000    fffff880`04b75880    0x0003c880    0x49a3cd1f    2/24/2009 06:34:07                        
spldr.sys        fffff880`015c6000    fffff880`015ce000    0x00008000    0x4a0858bb    5/11/2009 12:56:27                        
ASACPI.sys    ASACPI.sys+1257    fffff880`1068d000    fffff880`10695000    0x00008000    0x4a0b72fd    5/13/2009 21:25:17                        
amdxata.sys        fffff880`00de4000    fffff880`00def000    0x0000b000    0x4a12f2eb    5/19/2009 13:56:59                        
RTKVHD64.sys        fffff880`06800000    fffff880`069ac900    0x001ac900    0x4a16e924    5/22/2009 14:04:20

The system file check returned "Windows Resource Protection did not find any integrity violations".

How can I update my asacpi.sys file?

OK, I went to ASUSTeK Computer Inc.-Support- and put my motherboard model (P5QL-EM) but I'm not sure which file to download.. Is it the chipset one?

It's not that... I've installed a different one and that didn't fix it..

Dinesh said:

Jonathan_King said:

Dinesh said:

This bsod is caused by AVG anti virus. Uninstall it and switch to other AV.

Dinesh how did you find that? ASACPI.sys is the likely cause...deal with that then post the new dumps should they come.

Watchdog.exe is a process from AVG. So I guessed it could be the reason.

The BSOD said watchdog.exe once, I'm not really sure if that's the corrupt file.

The Unturtle said:

OK, I went to ASUSTeK Computer Inc.-Support- and put my motherboard model (P5QL-EM) but I'm not sure which file to download.. Is it the chipset one?

So which of the files should I download? chipset? bios update?