Solved Blue Screens with Taxwise Program

[JackR]

I upgraded to Windows 7 from Vista in mid May and did not have any issues with any applications.
I installed several demo versions of the 2010 and 2011 Taxwise program(CCH Small Firm Services) toward the end of May and started having BSOD issues.
The system only Blue Screens with this application.
I received the demos from and agent for CCH Small Firm Services. Their tech support told me that there are no issues with the software. The connected to my PC and could not find any issues.
I updated many of the drivers in late June. Also replaced Kapersky Antiviris with Microsoft Essentials and am still getting the blue screens

Is Windows 7 . . .
- x64
- the is a retail upgrade of the OS from Vista
- Upgrade one in Early May 2012
- Hardware is 3.5 years old

 

[Anak]

Hi JackR, welcome to 7F!


This is what I found in your report:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MULTIPLE_IRP_COMPLETE_REQUESTS (44)
A driver has requested that an IRP be completed (IoCompleteRequest()), but
the packet has already been completed.  This is a tough bug to find because
the easiest case, a driver actually attempted to complete its own packet
twice, is generally not what happened.  Rather, two separate drivers each
believe that they own the packet, and each attempts to complete it.  The
first actually works, and the second fails.  Tracking down which drivers
in the system actually did this is difficult, generally because the trails
of the first driver have been covered by the second.

Windows Error Reports (WER) shows two faulting applications, versions TWW 10&11 10 might be competing with 11.

I would suggest trying only one at a time to see if you still get a BSOD.
Sometimes different versions of the same program can conflict with each other especially demos because they have been crippled to some degree, but they look perfectly fine to the vendor.

Completely remove all Taxwise demos - you state you installed several - then try one or the other, but not all at the same time.

There is one other possibility; The TWW drivers are not digitally signed, and might be causing problems with Microsoft's authentication protocols especially if Server applications are involved.

The System Requirements; TaxWise seem stringent.
Check, and make sure all of your HP LaserJet Pro M1536 Drivers are the latest.
The fax driver HPEWSFXBULK (2007) could be old.
HP LaserJet Pro M1536 Multifunction Printer series*-* Download drivers and software - HP Business Support Center

And, going over your driver list shows one for a Brother USB Mass-Storage Device (2006), but I don't see it anywhere else, do you really need this? If yes it will need updated, if not remove it.

 

[JackR]

Hello Anak

Thank you for the quick response.

I had already removed TWW10 before I did the first posting. I originally installed TWW10 and got Blue Screens. I then installed TWW11 and also got the Blue screens with that year. So I removed TWW10 but continued to receive the blue screens with TWW11.

Also the demos are working copies of the software with some of the functions such as electronic filing disabled.

Every time I get the Blue Screens, the license file needs to be recreated. I must reinput the install codes.


Per your suggestion, I downloaded and installed the new drivers for the HP LaserJet Pro M1536. I checked the fax driver and it still shows HPEWSFXBULK (2007). The Multifunction device is the only fax machine.

I removed the USB Mass-Storage Device UDB Driver but it keeps in reappearing. Based on another posting, I removed all of the USB Drivers and deleted the infcache.1 file. It recreated all the USB Drivers after I rebooted. The Mass Storage Device was also recreated. I have a Maxtor One Touch II USB drive. It was disconnected when I attempted to recreate the drivers. The only other storage is an HP pocket Media Drive.

I am still receiving the Blue Screens . Any thoughts?

 

[Anak]

Your welcome.

Okay on the new drivers for the HP LaserJet Pro M1536 with similar HPEWSFXBULK driver, it had to be checked to make sure.

For the Brother USB removal:
USB drive or flash problems? How to cleanup and remove old USB storage drivers - TechSpot Forums

As per step 1. If the M1536 is connected by USB it will have to be dis-connected.

Once you download, and then extract the .zip file, a new explorer window will open showing three files:

• Win32
• x64
• Drivecleanup.txt

You have an x64 system. Drag, and drop the x64 file into C:\Windows\System32.
Then run a Elevated CMD prompt with drivecleanup.exe as the command.
You can either leave or remove the x64 file after completion of cleanup.

Remember step 6. Reboot before going any further.

Check to make sure Brother MSD has been removed.
If yes, reinstall, and run either version of TWW to see if you get any BSOD's.

If the M1536 was connected to your machine by USB don't re-install it until after you try running TWW.

I would like to see if the printers are causing the problem. The only problem with this method is TWW may sense the lack of printers, and won't install.
In that case install the M1536, and see if the removal of the Brother MSD has any affect.

 

[JackR]

Hi Anak

Thank you again

I ran through the steps on removing the USB Devices and it removed most of the devices but the mass storage one is still there.
View attachment 220158

I ran through the steps again to make sure I did not miss anything. The second time I ran the exe. it said no devices removed.

The Pocket Media Drive is an internal drive. I ejected the drive before I ran the exe. Is there anyting else that would need to be disconnected for that drive?

The only external USB items attached when I ran the exe were the wireless mouse and the wired keyboard.

 

[Anak]

Okay with the two runs of USB remover.

Ejection of the Pocket drive should be sufficient.

Okay with the mouse, and keyboard.
Can you search C:\Program Files, and C:\Program Files\x86 to see if Brother is still there?

If it is:
How did you uninstall the Brother MFC?
Can you rerun the uninstaller from the DVD?

 

[JackR]

I do not have a Brother MFC. I am not sure how that driver got installed.
There is nothing under C:\Program Files, and C:\Program Files\x86 for Brother?

I took a look at Add Remove Programs. Retrospect HD is an application that came with The Maxtor External Drive. Would that need to be removed?

 

[Anak]

I do not have a Brother MFC. I am not sure how that driver got installed.
There is nothing under C:\Program Files, and C:\Program Files\x86 for Brother?

Okay to nothing in either Program files.

I took a look at Add Remove Programs. Retrospect HD is an application that came with The Maxtor External Drive. Would that need to be removed?

No.


I was working on this EDIT: when I saw your first post this morning.

When I woke up this morning I thought about whether or not your TWW downloads were correct, you would have to know the MD5, CRC32, SHA1, SHA256, or RIPEMD160 numbers, and have a tool to check.

The MD5, and SHA-1 #'s for TWW10 are here: TWW10.exe Details. Is this file safe? Check the directory

For TWW11 there are two sets: TWW10.exe Details. Is this file safe? Check the directory
Scroll down a bit to see.

For the tool there are several here are just two:
WinMD5 Free - Windows MD5 Utility Freeware
Hash Reporter - Tweaking with Vishal



While I was thinking about that, I thought about how you have to re-enter the license info, and that may be what is causing the BSOD's.

Did you mention that to the TWW rep when s/he was helping you, any response?

This could be a residual effect of any left over Kaspersky files. How did you remove it?
Without knowing the version, I did find this tool: Removal tool for Kaspersky Lab products - 2012 Internet Security
If you have a different version/year we'll have to locate it for you to download, and run to make sure it is gone.

At some point I would like you to run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html, run it at least three times as it states in the instructions, with reboots in between.
This is to see if there are any system files that may be corrupt, and are in conflict with TWW.

After you check the hash #'s, and their okay, run the Kaspersky removal tool, and run SFC\ scannow you could try running either TWW again.

If you still get the BSOD then we have to run a Driver Verifier there are two ways: http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html, and Driver Verifier Settings.
The difference is in the settings after you Select "Create custom settings (for code developers)" and click "Next".

Once or if you get a BSOD stop the verifier, and reboot, then re-run the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html
I would also like to see the Mini-dump file/s. They can be found at %SystemRoot%\Minidump


I can wait for a response for a little while yet this morning, but I have chores, and errands to run.
Please let me know which direction you will take, I would think the steps I have outlined would take several hours to complete especially the Driver Verifiers.

 

[Anak]

I have to go, but I will be checking back later.....about 1 - 2pm EDT.

 

[JackR]

Hi Anak

I checked the hash #s and they do not match. I am dealing with and agent for CCH. They do make some small changes to the logon screen. I confimed with CCH that they are legitimate. I also requested a tww11 demo directly from CCH but do not anticipate receiving it for a week. They were closed this week.

I had already run the Kapersky removal tool but ran it again from your post.

I am running the SFC scans now abnd will run the Driver Verifier. Don't hold off doing anything. Ther is no rush on getting this fixed today

I will let you know the results of the SFC Scans and the Drive Verifier

I appreciate your help.

Thank you again.

Jack

 

[JackR]

I ran the SFC Scans and it not find any issues
I usually get the blue screens when I am closing TWW11. This time I got the blue screen when I opened it.
I am running a backup right now. It looks like it is going to take several hours. I want to be sure that I can log on if there are any issues with the verifier.
I have to go out and will not be back until late tonight.
I will run the verifier then and send you the BSOD posting results (I am sure that it will crash)
Thanks again
Jack

 

[JackR]

Hi Anak

Ran the verifier and the system crashed -the results are attached.

The blue screen showed an issue with NLem64nt.sys. I googled that and found the following posting

Unexpected Server 2008 R2 Std Restarts - MULTIPLE_IRP_COMPLETE_REQUESTS

Jack

 

[Anak]

Hi Anak

I checked the hash #s and they do not match. I am dealing with and agent for CCH. They do make some small changes to the logon screen. I confimed with CCH that they are legitimate. I also requested a tww11 demo directly from CCH but do not anticipate receiving it for a week. They were closed this week.

When you say logon screen do you mean the Operating System (OS) when you boot the machine? If so, legitimate or not that seems rather presumptuous of them.

Hi Anak

Ran the verifier and the system crashed -the results are attached.

The blue screen showed an issue with NLem64nt.sys. I googled that and found the following posting

Unexpected Server 2008 R2 Std Restarts - MULTIPLE_IRP_COMPLETE_REQUESTS

Jack

That sounds familiar, and that OP's running TWW also. That wasn't you that posted that, was it?

It brings us back to the bug check I posted in post#2 only a little different this time with an iaStor reference:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 44, {fffffa8008601c10, eae, 0, 0}

Unable to load image \SystemRoot\system32\drivers\iaStor.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for iaStor.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStor.sys
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : CLASSPNP.SYS ( CLASSPNP!TransferPktComplete+1ce )

Followup: MachineOwner

See if the suggestions in this thread help:http://www.sevenforums.com/crashes-debugging/157184-bsod-related-iastor-sys.html#post1350270, If not I'm going to ask for help from the Team.

I'll be checking back, but will be busy from 10am edt to late.

 

[JackR]

Hi Anak

When you say logon screen do you mean the Operating System (OS) when you boot the machine? If so, legitimate or not that seems rather presumptuous of them.

I beleive that the initial screen that is presented when you open the application is customized. I am waiting to get an actual copy direct from CCH. I will then be able to compare them.

That sounds familiar, and that OP's running TWW also. That wasn't you that posted that, was it?

It was not me. I googled nlem64nt.sys.

I ran the TDSSKiller and it found 11 items which it copied to quarantine. See attached. I still received the BSOD

See if you can update the Storage drivers in Safe Mode (some installers will allow this) - and try the storage drivers from http://downloadcenter.intel.com to make sure you get the most current version.

I will try updating the storage drivers next but will not be able to do it right away.

I am going to be leaving at 9AM and will be away for a few days. Hopefully I will have received the TWW11 demo direct from the Vendor(CCH)by then.

Thanks again for your help.

 

[Anak]

Okay on the actual copy from CCH.

That's odd, those 11 files look like they should be legit.
I noticed the bonjour service listed. That can be a problem for win 7, can you live without it for a while to test?

Have a safe trip! Hoping for the demo.



EDIT:

Forgot to mention....

You can send those files, and report to Kaspersky for analysis: How to detect and remove unknown rootkits, scroll down to How to disinfect a compromised system, below the screen shot.


And, you can try, and use your HP update tool, and or support assistant to check for that iastor file: Frequently Asked Questions About Downloading HP Software HP Pavilion Elite d5100t ATX CTO Desktop PC - HP Customer Care (United States - English)

 

[JackR]

Hi Anak

I ended up getting the Demo Disk directly from Taxwise and the same blue screen issue occured. I worked with the TaxWise tech support and it looks as if the problem is solved. There were a few things going on.

1. User Account Contol (UAC) was on when I installed the software- The tech thinks that some of the dll's either did not install or did not install properly.

2. Taxwise installs a Print Driver. The print driver that came with the Demo was unsigned. After reloading the software and downloading the updates, the software worked properly. The update included a signed driver.

Thank you for your help with this issue

 

[Anak]

Hi Jack,

That's good news, I'm glad you were able to get it sorted out.

1.) I can't recall if we tried to install TWW by right click "Run as Administrator". In any event turning off UAC is nearly the same.
User Account Control Step-by-Step Guide
User Account Control in Windows 7 Best Practices
Run as Administrator Discussion

2.) Back in my post#2 I touched on driver problems:

There is one other possibility; The TWW drivers are not digitally signed, and might be causing problems with Microsoft's authentication protocols especially if Server applications are involved.

Your welcome, I'm glad I was here to help you!