Another Windows 7 user with BSOD problems...

[Sajhino]

My laptop is only about 2 months old and I am already experiencing BSOD quite oftenly. It occurs randomly and I don't know when it will happen again. It happened again today and it's very annoying. I haven't done anything yet (like reinstalling Windows 7, rollback drivers, etc...) for fear I might just mess things up and I don't have much time to waste. So, can anyone here please help me with this?

I have attached the dump file and my laptop's specs in the attached file below. Thanks in advance for anyone who's willing to help me out.

 

[Jonathan_King]

Welcome!

It looks like you may have a couple of problems. A program called Filter Driver ProtectDisc may be causing the issue. Update it, or remove it completely.

Also, you may be infected. Download Malwarebytes, and run a scan.

One other thing, open an elevated command prompt and run sfc /scannow.

Loading Dump File [C:\Users\Jonathan\Desktop\012610-25365-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02e1b000 PsLoadedModuleList = 0xfffff800`03058e50
Debug session time: Tue Jan 26 00:35:36.474 2010 (GMT-5)
System Uptime: 0 days 0:00:17.503
Loading Kernel Symbols
...............................................................
.............................
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8a004ac8000, 0, fffff88003db9c02, 0}

Unable to load image \??\C:\Windows\system32\drivers\acedrv09.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for acedrv09.sys
*** ERROR: Module load completed but symbols could not be loaded for acedrv09.sys
Unable to load image \SystemRoot\System32\Drivers\sptd.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for sptd.sys
*** ERROR: Module load completed but symbols could not be loaded for sptd.sys

Could not read faulting driver name
Probably caused by : acedrv09.sys ( acedrv09+4c02 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a004ac8000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88003db9c02, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c30e0
 fffff8a004ac8000 

FAULTING_IP: 
acedrv09+4c02
fffff880`03db9c02 450fb70452      movzx   r8d,word ptr [r10+rdx*2]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  smss.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88002e6d5f0 -- (.trap 0xfffff88002e6d5f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000001a3 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000020 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88003db9c02 rsp=fffff88002e6d780 rbp=fffffa80060990c8
 r8=00000000000001e8  r9=000000000000003a r10=fffff8a004ac7fc0
r11=00000000fffffd00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac pe cy
acedrv09+0x4c02:
fffff880`03db9c02 450fb70452      movzx   r8d,word ptr [r10+rdx*2] ds:90c8:fffff8a0`04ac8000=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002f0c1e4 to fffff80002e8cf00

STACK_TEXT:  
fffff880`02e6d488 fffff800`02f0c1e4 : 00000000`00000050 fffff8a0`04ac8000 00000000`00000000 fffff880`02e6d5f0 : nt!KeBugCheckEx
fffff880`02e6d490 fffff800`02e8afee : 00000000`00000000 00000000`0000007c 000007fe`ff070000 fffff800`02e1b000 : nt! ?? ::FNODOBFM::`string'+0x42907
fffff880`02e6d5f0 fffff880`03db9c02 : 004e0052`0045004b 00320033`004c0045 004c004c`0044002e fffffa80`03ca0000 : nt!KiPageFault+0x16e
fffff880`02e6d780 004e0052`0045004b : 00320033`004c0045 004c004c`0044002e fffffa80`03ca0000 ffff0000`013b9376 : acedrv09+0x4c02
fffff880`02e6d788 00320033`004c0045 : 004c004c`0044002e fffffa80`03ca0000 ffff0000`013b9376 00630062`006c0063 : 0x4e0052`0045004b
fffff880`02e6d790 004c004c`0044002e : fffffa80`03ca0000 ffff0000`013b9376 00630062`006c0063 002e0071`00740061 : 0x320033`004c0045
fffff880`02e6d798 fffffa80`03ca0000 : ffff0000`013b9376 00630062`006c0063 002e0071`00740061 fffff880`03db9e18 : 0x4c004c`0044002e
fffff880`02e6d7a0 ffff0000`013b9376 : 00630062`006c0063 002e0071`00740061 fffff880`03db9e18 fffff880`02e6d958 : 0xfffffa80`03ca0000
fffff880`02e6d7a8 00630062`006c0063 : 002e0071`00740061 fffff880`03db9e18 fffff880`02e6d958 00000000`00000007 : 0xffff0000`013b9376
fffff880`02e6d7b0 002e0071`00740061 : fffff880`03db9e18 fffff880`02e6d958 00000000`00000007 fffff8a0`00275080 : 0x630062`006c0063
fffff880`02e6d7b8 fffff880`03db9e18 : fffff880`02e6d958 00000000`00000007 fffff8a0`00275080 fffff880`0106c716 : 0x2e0071`00740061
fffff880`02e6d7c0 fffff880`02e6d958 : 00000000`00000007 fffff8a0`00275080 fffff880`0106c716 fffffa80`060990c8 : acedrv09+0x4e18
fffff880`02e6d7c8 00000000`00000007 : fffff8a0`00275080 fffff880`0106c716 fffffa80`060990c8 00000000`00000130 : 0xfffff880`02e6d958
fffff880`02e6d7d0 fffff8a0`00275080 : fffff880`0106c716 fffffa80`060990c8 00000000`00000130 fffff880`02e6d958 : 0x7
fffff880`02e6d7d8 fffff880`0106c716 : fffffa80`060990c8 00000000`00000130 fffff880`02e6d958 00000000`00000006 : 0xfffff8a0`00275080
fffff880`02e6d7e0 fffffa80`060990c8 : 00000000`00000130 fffff880`02e6d958 00000000`00000006 fffff8a0`006ea750 : sptd+0x37716
fffff880`02e6d7e8 00000000`00000130 : fffff880`02e6d958 00000000`00000006 fffff8a0`006ea750 fffff800`031a897c : 0xfffffa80`060990c8
fffff880`02e6d7f0 fffff880`02e6d958 : 00000000`00000006 fffff8a0`006ea750 fffff800`031a897c 00000000`00000001 : 0x130
fffff880`02e6d7f8 00000000`00000006 : fffff8a0`006ea750 fffff800`031a897c 00000000`00000001 fffff800`0303a4b0 : 0xfffff880`02e6d958
fffff880`02e6d800 fffff8a0`006ea750 : fffff800`031a897c 00000000`00000001 fffff800`0303a4b0 00000000`00000001 : 0x6
fffff880`02e6d808 fffff800`031a897c : 00000000`00000001 fffff800`0303a4b0 00000000`00000001 fffff800`0303a4b0 : 0xfffff8a0`006ea750
fffff880`02e6d810 fffff800`031a874f : fffffa80`06099070 fffffa80`05eca258 fffffa80`06099c90 00000000`00001ffb : nt!PsCallImageNotifyRoutines+0xdc
fffff880`02e6d870 fffff800`031a4322 : fffffa80`06099c90 fffffa80`05eca040 fffff880`02e6db10 fffff880`02e6db08 : nt!MiMapViewOfImageSection+0x41f
fffff880`02e6d9b0 fffff800`031a3ebf : fffffa80`00000002 fffffa80`05eca040 fffff880`02e6db10 00000000`00000000 : nt!MiMapViewOfSection+0x372
fffff880`02e6daa0 fffff800`02e8c153 : 00000000`0000005c fffffa80`05ecab60 00000000`0022ee28 00000000`77369301 : nt!NtMapViewOfSection+0x2be
fffff880`02e6db70 00000000`772a013a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0022ee08 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x772a013a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
acedrv09+4c02
fffff880`03db9c02 450fb70452      movzx   r8d,word ptr [r10+rdx*2]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  acedrv09+4c02

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: acedrv09

IMAGE_NAME:  acedrv09.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  45cc7c68

FAILURE_BUCKET_ID:  X64_0x50_acedrv09+4c02

BUCKET_ID:  X64_0x50_acedrv09+4c02

Followup: MachineOwner
---------

 

[Sajhino]

Thanks for the warm welcome.

Ok, so the 1st thing I did was I downloaded the Malwarebytes, updated it and scanned my laptop. And sure enough, 2 items were infected:

Malwarebytes' Anti-Malware 1.44
Database version: 3643
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

27/1/2010 1:38:55 PM
mbam-log-2010-01-27 (13-38-55).txt

Scan type: Full Scan (C:\|)
Objects scanned: 126048
Time elapsed: 32 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files (x86)\Pcsx2\plugins\PadSSSPSX.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

And then I run sfc, and it says:

Windows Resource Protection did not find any integrity violations

And about the Filter Driver ProtectDisc, I don't know what program it is. I can't find it anywhere in my laptop. So I don't know how to update it or uninstall it. Can help me out here?

 

[zigzag3143]

search for acedrv09.systhats the ofending file


Ken J+

 

[Sajhino]

search for acedrv09.systhats the ofending file


Ken J+

Ok, I found it. It's in "C:\Windows\System32\drivers".
And then what do I do with it?
Please help this noob guy here.

 

[Jonathan_King]

I'm not sure what the official way to do it is, but backup the file, and then delete it.

 

[Kari]

You should also delete acedrv09.dll.

Kari

 

[Sajhino]

Ok, so I've backup and deleted the acedrv09.sys and acedrv09.dll and so far nothing bad happens. Hopefully there's no more BSOD and other problems with my laptop. I'll post here again if there's anymore problems.

Thanks for all of your help, guys.

 

[Cybie257]

I began having this problem myself within the last few weeks. Seems to be something installed by MAGIX Music Maker 16 (Downloaded Version at least).

I determined so by the fact of the modified dates with acedrv.sys and acedrv.dll. Went to my uninstall tool and found that this program was installed on that same date.

Hope this helps others if they have installed MAGIX or how I determined the program at fault by using the dates.

-Cybie