Blue Screen Crash, Event ID 41, kernel-power

[Jonathan_King]

Please install SunBelt Antivirus, if you have it installed.

BugCheck F5, {6d, fffffa8006ac82e0, fffffa8006ac8280, 0}

Unable to load image \SystemRoot\system32\DRIVERS\sbapifs.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for sbapifs.sys
*** ERROR: Module load completed but symbols could not be loaded for sbapifs.sys
Probably caused by : sbapifs.sys ( sbapifs+1fe3 )

Then download and install Microsoft Security Essentials.

 

[epawelko]

Forgive my ignorance but what is the code box you have posted in your previous reply?

I'm noticing that the last dump file is dated 5-30 and I've had additional shut downs on 5-31 & this morning.

 

[Tews]

Your .dmp file is pointing to sbapifs.sys as the cause of your problem ... This is a driver for Sun Belts software... If you are using any software by Sun Belt, uninstall it and test ... Also, this has also been reported as malware, so you will want to run your antivirus/antimalware software, just to be sure....

View attachment 76598

 

[Jonathan_King]

Forgive my ignorance but what is the code box you have posted in your previous reply?

I'm noticing that the last dump file is dated 5-30 and I've had additional shut downs on 5-31 & this morning.

It's a piece of a Windbg analysis. Here is the whole thing. if you're interested.

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Jonathan\AppData\Local\Temp\Temp1_053010-25927-01(2).zip\053010-25927-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02c5c000 PsLoadedModuleList = 0xfffff800`02e99e50
Debug session time: Sun May 30 08:37:19.073 2010 (GMT-4)
System Uptime: 0 days 0:24:47.309
Loading Kernel Symbols
...............................................................
................................................................
............................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F5, {6d, fffffa8006ac82e0, fffffa8006ac8280, 0}

Unable to load image \SystemRoot\system32\DRIVERS\sbapifs.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for sbapifs.sys
*** ERROR: Module load completed but symbols could not be loaded for sbapifs.sys
Probably caused by : sbapifs.sys ( sbapifs+1fe3 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

FLTMGR_FILE_SYSTEM (f5)
An unrecoverable failure occured inside the filter manager.
Arguments:
Arg1: 000000000000006d, The reason for the failure
Arg2: fffffa8006ac82e0
Arg3: fffffa8006ac8280
Arg4: 0000000000000000

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xF5

PROCESS_NAME:  tldejpeg4.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff880010fbd1d to fffff80002ccc600

STACK_TEXT:  
fffff880`02792798 fffff880`010fbd1d : 00000000`000000f5 00000000`0000006d fffffa80`06ac82e0 fffffa80`06ac8280 : nt!KeBugCheckEx
fffff880`027927a0 fffff880`0235afe3 : fffffa80`00000000 fffffa80`05f709d0 fffff880`02792888 fffff800`00000010 : fltmgr! ?? ::FNODOBFM::`string'+0x1329
fffff880`027927e0 fffffa80`00000000 : fffffa80`05f709d0 fffff880`02792888 fffff800`00000010 fffff880`02792850 : sbapifs+0x1fe3
fffff880`027927e8 fffffa80`05f709d0 : fffff880`02792888 fffff800`00000010 fffff880`02792850 fffff880`0235b02f : 0xfffffa80`00000000
fffff880`027927f0 fffff880`02792888 : fffff800`00000010 fffff880`02792850 fffff880`0235b02f fffff880`01107a00 : 0xfffffa80`05f709d0
fffff880`027927f8 fffff800`00000010 : fffff880`02792850 fffff880`0235b02f fffff880`01107a00 fffffa80`05f70900 : 0xfffff880`02792888
fffff880`02792800 fffff880`02792850 : fffff880`0235b02f fffff880`01107a00 fffffa80`05f70900 fffffa80`01a38c10 : 0xfffff800`00000010
fffff880`02792808 fffff880`0235b02f : fffff880`01107a00 fffffa80`05f70900 fffffa80`01a38c10 fffffa80`05f70920 : 0xfffff880`02792850
fffff880`02792810 fffff880`01107a00 : fffffa80`05f70900 fffffa80`01a38c10 fffffa80`05f70920 00000000`00000000 : sbapifs+0x202f
fffff880`02792818 fffffa80`05f70900 : fffffa80`01a38c10 fffffa80`05f70920 00000000`00000000 fffff880`010f8242 : fltmgr!FltpOperationFlags
fffff880`02792820 fffffa80`01a38c10 : fffffa80`05f70920 00000000`00000000 fffff880`010f8242 fffffa80`05f70920 : 0xfffffa80`05f70900
fffff880`02792828 fffffa80`05f70920 : 00000000`00000000 fffff880`010f8242 fffffa80`05f70920 00000000`00000000 : 0xfffffa80`01a38c10
fffff880`02792830 00000000`00000000 : fffff880`010f8242 fffffa80`05f70920 00000000`00000000 fffffa80`00000000 : 0xfffffa80`05f70920


STACK_COMMAND:  kb

FOLLOWUP_IP: 
sbapifs+1fe3
fffff880`0235afe3 ??              ???

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  sbapifs+1fe3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: sbapifs

IMAGE_NAME:  sbapifs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a807d11

FAILURE_BUCKET_ID:  X64_0xF5_sbapifs+1fe3

BUCKET_ID:  X64_0xF5_sbapifs+1fe3

Followup: MachineOwner
---------

 

[epawelko]

[FONT=&quot]I have uninstalled Norton, ran the Norton Utility followed by installing Microsoft Essentials. A full scan shows nothing plus a Malwarebyte scan is also negative. My computer just shut down & rebooted. This time I ran the SF Diagnostic Tool and uploaded the results. Does it point to what my problem may be?[/FONT]
[FONT=&quot] [/FONT]
[FONT=&quot]Many thanks![/FONT]

 

[CarlTR6]

Your .dmp file is pointing to sbapifs.sys as the cause of your problem ... This is a driver for Sun Belts software... If you are using any software by Sun Belt, uninstall it and test ... Also, this has also been reported as malware, so you will want to run your antivirus/antimalware software, just to be sure....

View attachment 76598

If you have not uninstalled any Sunbelt software as Tews recommended, please do so. Two of your last three dumps point to sbapifs.sys. The process Sunbelt ActiveProtection Filter belongs to the software SBAPIFS or VIPRE Antivirus + Antispyware or CounterSpy by Sunbelt Software.

Your latest dmp is an F5 error and may be related to the above. Let's eliminate this possibility and see what you have from there.

STOP 0x000000F5: FLTMGR_FILE_SYSTEM

The FLTMGR_FILE_SYSTEM bug check has a value of 0x000000F5. This indicates that an unrecoverable failure occurred in the Filter Manager.

BSOD Index

 

[epawelko]

[FONT=&quot]I’m at a loss here because I have no software from Sunbelt, never did. All I had was Norton Internet Security 2010 and Ad-Aware Pro and I’ve uninstalled both and replaced it with Microsoft Essentials. [/FONT]
[FONT=&quot] [/FONT]
[FONT=&quot]Question: I see the dump files are dated through 5-30 prior to when I removed Ad-Aware Pro and rename the sbapifs extension to .bak. My startup & recovery setting is set to Kernel memory dump & %SystemRoot%\MEMORY.DMP with check marks for ‘write an event to the system log’ & ‘Overwrite any existing file’. Is it possible these are old dump files and are not being updated following the crashes?[/FONT]

 

[Jonathan_King]

You can delete the dmps in the minidump folder now. Then you know any future files there are new.

 

[epawelko]

I have deleted the dump files in the minidump folder. My machine crashed again but there are no files in the mindump folder. [FONT=&quot]My startup & recovery setting is set to Kernel memory dump & %SystemRoot%\MEMORY.DMP with check marks for ‘write an event to the system log’ & ‘Overwrite any existing file’. When the machine boots from a crash, it goes into normal mode. What can I do to get the information needed to find the cause of these crashes?
[/FONT]

 

[CarlTR6]

Change kernel memory dump to small memory dump. Uncheck overwrite any existing file.

 

[epawelko]

Change kernel memory dump to small memory dump. Uncheck overwrite any existing file.

I changed to these settings, my computer crashed and the dump folder is still empty. Anything more that I can do?

 

[CarlTR6]

You settings should look similar to this:

 

[epawelko]

You settings should look similar to this:

Thank you! I changed the first item "time to display list of operating systems" from 30 seconds to your recommended 10 seconds.

The size of my small memory dump is listed as 256kb, not 128kb as in your example.

And thank you for being so patient and helping me locate the cause of these crashes!

 

[CarlTR6]

You are welcome.

I think the 256kb vs. 128kb is because you have Win 7 64 bit and I have Win 7 32 bit.

Please fill out your system information. Go to your User CP at the top of the page, look in the left column and click on Edit system specs. Filling in your specs will help us help you.

You can make this easier by downloading Speccy.

I think we are definitely going need dump files.

 

[epawelko]

I have followed all instructions given and for some reason, my computer is not producing dump files after it crashes. I've had three crashes today. These crashes usually take place when the machine is idle and lately, it seems 10 minutes after I've completed some tasks. There is no blue screen and no error codes given.

 

[Jonathan_King]

Make sure your Advanced System Settings window looks like this:

View attachment 76932

 

[epawelko]

Make sure your Advanced System Settings window looks like this:

View attachment 76932

My advanced system files look like this and I have followed all instructions but no new dump files are being created. My computer just rebooted and the minidump folder is empty.

 

[epawelko]

[FONT=&quot]Is there anything more that I can do to find the cause of the problem?

The Advanced System Settings are set as described above but there are still no files in the minidump folder after a system shutdown. Event log shows Kernel-Power, Event ID 41, Task Category 63. Event logs have lots of entries so I’m including a few in hopes that it may help pinpoint the problem.[/FONT]

[FONT=&quot][FONT=&quot]-[/FONT] <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">[/FONT]
[FONT=&quot][FONT=&quot]-[/FONT] <System>[/FONT]
[FONT=&quot] <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" /> [/FONT]
[FONT=&quot] <EventID>41</EventID> [/FONT]
[FONT=&quot] <Version>2</Version> [/FONT]
[FONT=&quot] <Level>1</Level> [/FONT]
[FONT=&quot] <Task>63</Task> [/FONT]
[FONT=&quot] <Opcode>0</Opcode> [/FONT]
[FONT=&quot] <Keywords>0x8000000000000002</Keywords> [/FONT]
[FONT=&quot] <TimeCreated SystemTime="2010-06-09T12:31:13.680424900Z" /> [/FONT]
[FONT=&quot] <EventRecordID>86481</EventRecordID> [/FONT]
[FONT=&quot] <Correlation /> [/FONT]
[FONT=&quot] <Execution ProcessID="4" ThreadID="8" /> [/FONT]
[FONT=&quot] <Channel>System</Channel> [/FONT]
[FONT=&quot] <Computer>epawelko-PC</Computer> [/FONT]
[FONT=&quot] <Security UserID="S-1-5-18" /> [/FONT]
[FONT=&quot] </System>[/FONT]
[FONT=&quot][FONT=&quot]-[/FONT] <EventData>[/FONT]
[FONT=&quot] <Data Name="BugcheckCode">0</Data> [/FONT]
[FONT=&quot] <Data Name="BugcheckParameter1">0x0</Data> [/FONT]
[FONT=&quot] <Data Name="BugcheckParameter2">0x0</Data> [/FONT]
[FONT=&quot] <Data Name="BugcheckParameter3">0x0</Data> [/FONT]
[FONT=&quot] <Data Name="BugcheckParameter4">0x0</Data> [/FONT]
[FONT=&quot] <Data Name="SleepInProgress">false</Data> [/FONT]
[FONT=&quot] <Data Name="PowerButtonTimestamp">0</Data> [/FONT]
[FONT=&quot] </EventData>[/FONT]
[FONT=&quot] </Event>[/FONT]

[FONT=&quot][FONT=&quot]-[/FONT] <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">[/FONT]
[FONT=&quot][FONT=&quot]-[/FONT] <System>[/FONT]
[FONT=&quot] <Provider Name="Application Popup" /> [/FONT]
[FONT=&quot] <EventID Qualifiers="49152">1060</EventID> [/FONT]
[FONT=&quot] <Level>2</Level> [/FONT]
[FONT=&quot] <Task>0</Task> [/FONT]
[FONT=&quot] <Keywords>0x80000000000000</Keywords> [/FONT]
[FONT=&quot] <TimeCreated SystemTime="2010-06-09T12:31:13.462024600Z" /> [/FONT]
[FONT=&quot] <EventRecordID>86480</EventRecordID> [/FONT]
[FONT=&quot] <Channel>System</Channel> [/FONT]
[FONT=&quot] <Computer>epawelko-PC</Computer> [/FONT]
[FONT=&quot] <Security /> [/FONT]
[FONT=&quot] </System>[/FONT]
[FONT=&quot][FONT=&quot]-[/FONT] <EventData>[/FONT]
[FONT=&quot] <Data /> [/FONT]
[FONT=&quot] <Data>\??\C:\Windows\system32\drivers\SBREdrv.sys</Data> [/FONT]
[FONT=&quot] <Binary>000000000200300000000000240400C0000000006B0300C000000000000000000000000000000000</Binary> [/FONT]
[FONT=&quot] </EventData>[/FONT]
[FONT=&quot] </Event>[/FONT]

[FONT=&quot][FONT=&quot]-[/FONT] <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">[/FONT]
[FONT=&quot][FONT=&quot]-[/FONT] <System>[/FONT]
[FONT=&quot] <Provider Name="EventLog" /> [/FONT]
[FONT=&quot] <EventID Qualifiers="32768">6008</EventID> [/FONT]
[FONT=&quot] <Level>2</Level> [/FONT]
[FONT=&quot] <Task>0</Task> [/FONT]
[FONT=&quot] <Keywords>0x80000000000000</Keywords> [/FONT]
[FONT=&quot] <TimeCreated SystemTime="2010-06-09T12:31:23.000000000Z" /> [/FONT]
[FONT=&quot] <EventRecordID>86475</EventRecordID> [/FONT]
[FONT=&quot] <Channel>System</Channel> [/FONT]
[FONT=&quot] <Computer>epawelko-PC</Computer> [/FONT]
[FONT=&quot] <Security /> [/FONT]
[FONT=&quot] </System>[/FONT]
[FONT=&quot][FONT=&quot]-[/FONT] <EventData>[/FONT]
[FONT=&quot] <Data>6:59:18 AM</Data> [/FONT]
[FONT=&quot] <Data>[/FONT][FONT=&quot]‎[/FONT][FONT=&quot]6/[/FONT][FONT=&quot]‎[/FONT][FONT=&quot]9/[/FONT][FONT=&quot]‎[/FONT][FONT=&quot]2010[/FONT][FONT=&quot]</[/FONT][FONT=&quot]Data[/FONT][FONT=&quot]>[/FONT]
[FONT=&quot] <Data /> [/FONT]
[FONT=&quot] <Data /> [/FONT]
[FONT=&quot] <Data>55360</Data> [/FONT]
[FONT=&quot] <Data /> [/FONT]
[FONT=&quot] <Data /> [/FONT]
[FONT=&quot] <Binary>DA0706000300090006003B001200CA01DA070600030009000A003B001200CA01600900003C000000010000006009000000000000B00400000100000000000000</Binary> [/FONT]
[FONT=&quot] </EventData>[/FONT]
[FONT=&quot] </Event>[/FONT]

[FONT=&quot][FONT=&quot]-[/FONT] <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">[/FONT]
[FONT=&quot][FONT=&quot]-[/FONT] <System>[/FONT]
[FONT=&quot] <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" /> [/FONT]
[FONT=&quot] <EventID>3</EventID> [/FONT]
[FONT=&quot] <Version>0</Version> [/FONT]
[FONT=&quot] <Level>2</Level> [/FONT]
[FONT=&quot] <Task>2</Task> [/FONT]
[FONT=&quot] <Opcode>14</Opcode> [/FONT]
[FONT=&quot] <Keywords>0x8000000000000010</Keywords> [/FONT]
[FONT=&quot] <TimeCreated SystemTime="2010-06-09T12:31:15.646028400Z" /> [/FONT]
[FONT=&quot] <EventRecordID>415</EventRecordID> [/FONT]
[FONT=&quot] <Correlation /> [/FONT]
[FONT=&quot] <Execution ProcessID="4" ThreadID="168" /> [/FONT]
[FONT=&quot] <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel> [/FONT]
[FONT=&quot] <Computer>epawelko-PC</Computer> [/FONT]
[FONT=&quot] <Security UserID="S-1-5-18" /> [/FONT]
[FONT=&quot] </System>[/FONT]
[FONT=&quot][FONT=&quot]-[/FONT] <EventData>[/FONT]
[FONT=&quot] <Data Name="SessionName">Microsoft Security Essentials OOBE</Data> [/FONT]
[FONT=&quot] <Data Name="FileName">C:\ProgramData\Microsoft\Microsoft Security Essentials\Support\MSSEOOBE.etl</Data> [/FONT]
[FONT=&quot] <Data Name="ErrorCode">3221225485</Data> [/FONT]
[FONT=&quot] <Data Name="LoggingMode">5</Data> [/FONT]
[FONT=&quot] </EventData>[/FONT]
[FONT=&quot] </Event>[/FONT]

[FONT=&quot][FONT=&quot]-[/FONT] <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">[/FONT]
[FONT=&quot][FONT=&quot]-[/FONT] <System>[/FONT]
[FONT=&quot] <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" /> [/FONT]
[FONT=&quot] <EventID Qualifiers="49152">7001</EventID> [/FONT]
[FONT=&quot] <Version>0</Version> [/FONT]
[FONT=&quot] <Level>2</Level> [/FONT]
[FONT=&quot] <Task>0</Task> [/FONT]
[FONT=&quot] <Opcode>0</Opcode> [/FONT]
[FONT=&quot] <Keywords>0x8080000000000000</Keywords> [/FONT]
[FONT=&quot] <TimeCreated SystemTime="2010-06-09T12:31:23.633242400Z" /> [/FONT]
[FONT=&quot] <EventRecordID>86499</EventRecordID> [/FONT]
[FONT=&quot] <Correlation /> [/FONT]
[FONT=&quot] <Execution ProcessID="456" ThreadID="460" /> [/FONT]
[FONT=&quot] <Channel>System</Channel> [/FONT]
[FONT=&quot] <Computer>epawelko-PC</Computer> [/FONT]
[FONT=&quot] <Security /> [/FONT]
[FONT=&quot] </System>[/FONT]
[FONT=&quot][FONT=&quot]-[/FONT] <EventData>[/FONT]
[FONT=&quot] <Data Name="param1">SMB MiniRedirector Wrapper and Engine</Data> [/FONT]
[FONT=&quot] <Data Name="param2">Redirected Buffering Sub Sysytem</Data> [/FONT]
[FONT=&quot] <Data Name="param3">%%31</Data> [/FONT]
[FONT=&quot] </EventData>[/FONT]
[FONT=&quot] </Event>[/FONT]

[FONT=&quot][FONT=&quot]-[/FONT] <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">[/FONT]
[FONT=&quot][FONT=&quot]-[/FONT] <System>[/FONT]
[FONT=&quot] <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" /> [/FONT]
[FONT=&quot] <EventID Qualifiers="49152">7001</EventID> [/FONT]
[FONT=&quot] <Version>0</Version> [/FONT]
[FONT=&quot] <Level>2</Level> [/FONT]
[FONT=&quot] <Task>0</Task> [/FONT]
[FONT=&quot] <Opcode>0</Opcode> [/FONT]
[FONT=&quot] <Keywords>0x8080000000000000</Keywords> [/FONT]
[FONT=&quot] <TimeCreated SystemTime="2010-06-09T12:31:23.633242400Z" /> [/FONT]
[FONT=&quot] <EventRecordID>86498</EventRecordID> [/FONT]
[FONT=&quot] <Correlation /> [/FONT]
[FONT=&quot] <Execution ProcessID="456" ThreadID="460" /> [/FONT]
[FONT=&quot] <Channel>System</Channel> [/FONT]
[FONT=&quot] <Computer>epawelko-PC</Computer> [/FONT]
[FONT=&quot] <Security /> [/FONT]
[FONT=&quot] </System>[/FONT]
[FONT=&quot][FONT=&quot]-[/FONT] <EventData>[/FONT]
[FONT=&quot] <Data Name="param1">IP Helper</Data> [/FONT]
[FONT=&quot] <Data Name="param2">Network Store Interface Service</Data> [/FONT]
[FONT=&quot] <Data Name="param3">%%1068</Data> [/FONT]
[FONT=&quot] </EventData>[/FONT]
[FONT=&quot] </Event>[/FONT]