Various crash, BSOD scenarios

[benjis78]

I left the machine on wireless networking and it crashed twice in six minutes, the second time it crashed it was sitting at the logon screen. The Realtek LAN error message came back. I think it must be appearing any time a LAN cable is connected. I am going to leave it hooked up to LAN for a while and see if it crashes. Tomorrow I will try switching out the vmnetadapter drivers.

 

[TimStitt]

Hi Ben,

Thanks for the updates, see my replies below.
Centrino Wireless Drivers: go here and select Windows 7 64bit.

Sigverif.exe: Maybe I ran this before I can't remember, I really thought it was automatic. As you've worked out, you can just run the Sigverif.exe and follow the prompts, then open the sigverif.txt file. I have the same version as you installed now, with no crashes so far. Have you checked all locations for the drivers, there may be more than one installed and try to replace them with the previous versions as well. There is nothing in the VMWARE website that I can find about the issue, so you may be the only one.... but hang in there.

Your wife: Must have went to same wife school as mine.... but don't tell her I said that.

Genome Research Institute in Singapore: Really? This country never ceases to amaze me.

When the Blue Screen occurs: Ok, continue to monitor this and see if you can locate when it occurs (i.e, the trigger). you may consider disabling the vmware network adapters until you need them. you can do this in Device manager or in Network Connections (by right clicking).

Our to do list

• Continue to monitor the crashes, find the trigger
• Advise if crashes still occur when the VMware network adapter is disabled
• Replace your drivers with the one that I posted 4.0.3.0 to ensure that yours is not corrupt (do this for all instances of the driver sa there is likely to be more than one copy))
• If Blue screen is still occuring, repeat the last steps with the previous driver I posted. If still occuring, repeat steps with the earliest driver that I posted.
• Check MS update to ensure that installing updates from Microsoft and not just Windows is enabled. Install all updates.
• Upgrade all hardware from the HP and Intel links provided (do this after the above step as the drivers listed on the MS update site may not be the latest)

If we can;t find anything after the above, then we need to look at re-installing VMware.

I'm out for the rest of the day, will check again tonight.

Timo

 

[benjis78]

Thanks for your help.

 

[TimStitt]

Thanks for your help.

My pleasure, it's what we do here

I forgot to add to our To-Do list, we need to also verify if running with your antivirus and firewall off causes the BSOD. I know this is risky business, so be safe and only open a browser web page like google and do a search. What we want to do is 'use' all our network adapters but not risk our system security.

You may also consider connecting to another PC on your network (if you have this set up). The different connection methods use different ports (e.g. basic internet surfing is port 80, and TCP ports are 135-139). This sort of test may show us if a particular activity causes a crash OR it may pinpoint the Firewall as the problem causing windows to block the vmware driver (also a common scenario).

If your up to it, feel free to conduct an complete isolation test where you disable all adapters except one and test for a blue screen scenario. Then test with another adapter enabled only. Then test back to the first adapter with the firewall enabled and then disabled, etc etc in an attempt to isolate the problem. This is ridiculously slow (after years in IT support, I know!); but it's usually fairly accurate technique in finding the problem.

 

[benjis78]

Hi Timo,
Yes. Using wireless networking, I browsed the sevenforums site with antivirus/firewall turned off and got a BSOD within a few minutes.

Ben

 

[benjis78]

What I do not know is if windows firewall is still running. I thought ZoneAlarm disables it upon installation.

 

[benjis78]

I was wrong. Windows firewall was on for both public and private areas. What problems might be caused by running two firewalls at the same time? I am now testing the wireless networking in the absence of both firewalls.

 

[TimStitt]

What I do not know is if windows firewall is still running. I thought ZoneAlarm disables it upon installation.

Good news on the 3rd party firewall test, we can rule it out. To answer your question about the windows firewall. You can find Windows firewall in control panel or just type firewall.cpl into RUN or SEARCH and press ENTER.

I'll await the results of your other tests.

Good luck mate.

 

[benjis78]

Hi Timo,
I installed the latest intel centrino wireless driver, but just as the Realtek driver did yesterday, the intel updater hung for > 10 minutes. Before powering down the computer I verified in the driver properties that it was the updated. I double checked after restarting as well. The computer then lasted > 30 minutes without BSOD (turned ZoneAlarm back on), but hung on shutdown forcing me to power off.

I then logged on as administrator and replaced the vmnetadapter.sys drivers with the most recent version you gave me. I did this is in programfiles\vmware\workstation and windows\system32. When I tried to replace the copy in system32\driverrepository, windows told me I did not have permission. Still logged in as adminstrator, I selected properties of the particular repository subfolder. I chose security->advanced and tried to change permissions, I remember the window said SYSTEM was the current owner. I think I changed permission and it said I would have to close and click properties on the repository subfolder again for the changes to take effect. After I closed and right clicked for properties, the computer crashed almost immediately (I don't remember if I saw a blue screen at this time).

Upon restart, I logged back in as administrator using wireless networking, opened seven forums, BSOD in less than 3 min. Restarted, admin + wireless, disabled zonealarm, opened sevenforums, BSOD in less than 3 min. Restarted, admin + wired LAN, disabled zone alarm no blue screen. Restarted, logged on as my user + wired LAN, zone alarm enabled no BSOD. Windows firewall was shut down and remained shut down during all of this time.

 

[TimStitt]

Hi Timo,
I installed the latest intel centrino wireless driver, but just as the Realtek driver did yesterday, the intel updater hung for > 10 minutes. Before powering down the computer I verified in the driver properties that it was the updated. I double checked after restarting as well. The computer then lasted > 30 minutes without BSOD (turned ZoneAlarm back on), but hung on shutdown forcing me to power off.

I then logged on as administrator and replaced the vmnetadapter.sys drivers with the most recent version you gave me. I did this is in programfiles\vmware\workstation and windows\system32. When I tried to replace the copy in system32\driverrepository, windows told me I did not have permission. Still logged in as adminstrator, I selected properties of the particular repository subfolder. I chose security->advanced and tried to change permissions, I remember the window said SYSTEM was the current owner. I think I changed permission and it said I would have to close and click properties on the repository subfolder again for the changes to take effect. After I closed and right clicked for properties, the computer crashed almost immediately (I don't remember if I saw a blue screen at this time).

Upon restart, I logged back in as administrator using wireless networking, opened seven forums, BSOD in less than 3 min. Restarted, admin + wireless, disabled zonealarm, opened sevenforums, BSOD in less than 3 min. Restarted, admin + wired LAN, disabled zone alarm no blue screen. Restarted, logged on as my user + wired LAN, zone alarm enabled no BSOD. Windows firewall was shut down and remained shut down during all of this time.

Nice work.

The no BSOD's uniquely include
- Use of Wireless connection method, which is strange because the dump said a realtek driver and the wireless adapter is not realtek. Perhaps the names are close. Could you please verify the drivers attached to the wireless adapter and what their names are?

Also, were the vmware adapters disabled during the tests (see my pic, I have disabled one)?
View attachment 84589

The hanging on driver installations is worrying. what does the event log say?

I know that BSOD's are a harrowing and long process, so I like to let you know where we're going and what choices are left as we narrow down the suspects. So....

Action Plan
Check current assumptions of wireless adapter
- Test with the VMware network adapters disabled.
- Test with Wireless adapter disabled for a longer period of time.
- Post name of wireless device and attached drivers (we'll then check that these are correct)

What we've been doing here is matching the actual tests to the Event Log results and thus ascertaining if the dump report shows the cause or if something else is producing that result in the dump. In my mind we are now down to 2 possible suspects (wireless and VMware adapters, which were our original suspects except that now we are close to proving it) as we've ruled everything else out as potentials causes. Normally we can fix a BSOD like yours by removing the device, rolling back the suspect driver or updating the driver to the latest (fixed) version. On some occasions the BSOD only occurs in unique circumstances in which case the road ahead is limited.

The road ahead
If we prove that the wireless device is in fact the one that I linked to earlier (i.e. not a realtek device) and the correct drivers are loaded for it, then it looks to be a corrupt installation. The next question is "of what?" Windows or Vmware. All that is left to us (in order) is:
1. A strip and re-install of VMWARE
2. Contact the Vendor/s of the suspect driver and wait for their response
3. A windows Repair Install
4. A fresh windows install

 

[benjis78]

Hi Timo,
A quick update while I read what you have written above. I disabled the two vmnetadapters listed in my device manager. The computer still gives rapid BSOD on wireless networking but not wired LAN.

 

[benjis78]

Here is the Wireless network adapter
Intel Centrino Advanced-N 6200 AGN
File version 13.2.1.5 (installed today) driver files:
NETw5s64.sys
vwifibus.sys
NETw5c64.dll
NETw5r64.dll

 

[benjis78]

OK, this is strange. There is another wireless adapter. I didn't recognize it as one in device manager, but when I look at the network connections (as in your last pic) it shows a wireless signal icon. This is called Microsoft virual WiFi miniport adapter. It is enabled but not connected on IPv4 or IPv6. It shows 131,330 packets sent and 0 received.

 

[benjis78]

Timo,
I spent awhile sifting through the event viewer looking for something about the drivers I have installed for Realtek LAN and Intel wireless. I am not seeing anything, but I probably don't know how to navigate through the viewer effectively.

There is a new event starting this morning that is happening constantly (550 times).
Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

I have attached a new version of the event log. I have to go to lab and perform an experiment. Actually should have started it earlier this morning. Oh well.

Ben

 

[TimStitt]

Timo,
I spent awhile sifting through the event viewer looking for something about the drivers I have installed for Realtek LAN and Intel wireless. I am not seeing anything, but I probably don't know how to navigate through the viewer effectively.

There is a new event starting this morning that is happening constantly (550 times).
Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

I have attached a new version of the event log. I have to go to lab and perform an experiment. Actually should have started it earlier this morning. Oh well.

Ben

Just before I duck off - It'll take a fair while to go through those event logs (although the info is great). Could you please post the event numbers of the problematic ones, so I can find them fast.

In regards to the Failed extract of third-party root list, at a quick guess your Certificate Revocation List (CRL) has an expired certificate or the database is out of date. Here's the official Microsoft Fix for those two scenarios'. The CRL may have become corrupt during a BSOD.

The good thing is that we know that the VMware driver being blocked by Microsoft causes the BSOD, we now have proven that it occurs only when it interacts with the wireless adapter interaction, however we don't know (yet) why the dump file gets it wrong (as I'm now sure it does) and says the LAN adapter. With the new information, I will need to compare the Wireless driver details to the DUMP log to see if I can find any new info. Thanks for confirming that the wireless adapter is the one we thought it was.

The problem is that there are 'no' new wireless drivers, you have the latest. Therefore the only choice left for us (with the wireless adapter is to find older drivers) that may not be affected by this new problem that you've discovered. See if you can locate those and install them.
I will get back to you tomorrow with any new info from the dump and logs.

At this stage, I would seriously consider:
- Looking for older Wireless Drivers (check your installation disk if you have one)
- Opening a support call with VMware, they may have to re-write their drivers and/or may be aware of the issue already.
- Reinstalling VMware

 

[benjis78]

Hi Timo,
I had said the wireless associated rapid BSODs occurred even when the VMware network adapters were disabled.

I haven't yet tried disabling the Microsoft virual WiFi miniport adapter. In terms of the wireless adapter, I can first try and install the version on my HP system recovery disks.

What kind of event's numbers would you like me to look for on my event viewer?

Thanks,
Ben

 

[Capt.Jack Sparrow]

Hello,

Great suggestions Timo !! I one small thing i would recommend to uninstall Zone Alarm since its notorious for BSOD. Saw in your thread that you had Zone Alarm installed i have seen lot of causes where Zone Alarm used to cause BSOD. Use the Removal Tool to clear the left over entries check this link for more information on removal BSOD vs. Internet Security !! « Captain Debugger

Good Luck,
Captain

 

[TimStitt]

Hello,

Great suggestions Timo !! I one small thing i would recommend to uninstall Zone Alarm since its notorious for BSOD. Saw in your thread that you had Zone Alarm installed i have seen lot of causes where Zone Alarm used to cause BSOD. Use the Removal Tool to clear the left over entries check this link for more information on removal BSOD vs. Internet Security !! « Captain Debugger

Good Luck,
Captain

@benjis78 - I must have missed th bit about the adapters mate, so much to read.
- RE: The event errors, the list you gave me has every event in it. If you could just take a quick look and jot down any event numbers that are errors.
- Also I'll wait the results of my last suggestions.
@Capt - I thought this too, so I asked benjis78 to disable it and it and the BSOD's still occurred.
A mini synopsis of where we're at. What we've managed to prove is that the 'most likely' culprit in the dump (the lan adapter) is incorrect. Also we are finding that updating the drivers is not getting us there, so I've asked benjis78 to try previous drivers and contact vendors and consider a vmware re-install to cover corruption there. benjis78 may very well be the first person with this error/bug.

 

[benjis78]

Hi Timo,
Yes, my mother always said I was special. This must apply to computer bugs too.
Attached are text files of event IDs corresponding to error messages for EventSys and EventApp from 7-9-2010 onwards located in the system event files I attached to post #34. I have filtered out event IDs for the constant CAPl2 error in EventApp and listed it only once.

Ben

 

[benjis78]

Hi Timo,
Today I installed an older wireless adapter (2 versions before mine). Like before, the install hanged. I think this is because they are not the HP authorized drivers. Strangely enough, on my HP software page list, it doesn't even list drivers for my intel wireless adapter. But, the pre-installed HP monitoring software recognizes I have an intel adapter and showed it was updated on 7-7-10. I have been using my wireless connection without a crash for more than half an hour. I am getting ready to re-enable my vmware wireless adapters and see if the system goes haywire.


I also updated skype and zone alarm because I saw they were associated with the "Failed extract of "third-party root list from auto update cab" error message. This comes from a source called CAPI2. I read the link you gave me, but the download (meant for XP) was dead. I spent some time reading posts on a microsoft technet forum about the error. It seems like a mess which ultimately microsoft should be responsible for dealing with. In my event viewer, I enabled a new log of applications and service logs -> Microsoft -> Windows -> CAPI2 -- Operational. There are CAPI2 errors being generated every couple of seconds.

Ben