BSOD after win update including MS office and security updates

[antifm]

I want to start by saying a few things to help weed this out. This is a production machine in my office so:
It never sees porn
it has no cracked files installed
no one touches it but me lol
it never leaves the desk
its only 2 years old
its an everyday use laptop
purchased new
never over clocked
never installed TOO MUCH on it
only using about 1/4 of its capacity

About a week ago, wonderful know-it-all microsoft sent out their usual Win Updates and i installed the nominal ones
Update for Security
Update for Microsoft office 2010
and nothing else

Later evening i shut it off until next morning. At which point, BSOD arrived after logging into UAC.
Restarts and wants safe mode or others.
If i choose normal - Again im hit with BSOD
if i choose SAFE MODE - im good

I went into the updates under (add remove progs ) and wanted to remove them.
Since they are updates, windows need to restart FULLY in normal to FINISH removing
but each time it tries,
1st i get BSOD
then since it notices something strange about the update removals, it reinstalls them
which causes yet another BSOD. so im stuck in an infinite loop.
I can reach normal mode but only via certain circumstances which i havent been able to 100% repeat consecutively.

Im still not sure of everything you need via a report from me so forgive me if i DIDNT supply something in information

EDIT-------
the first time the BSOD arrive actually was, after the updates and restart, i went to open Microsoft Word Starter 2010 via a .docx file and the BSOD showed.

Each time after that, where i was able to have windows running in NORMAL mode,
i was able to repeate the process of causing a BSOD simply by trying to open Mircosoft Word starter


The two main UPDATES that took place before this via windows update were

Adobe Reader....x
Microsoft Office 2010 Updates

 

[ICIT2LOL]

Hello and welcome antifm Mate have you tried a system restore back to before the updates? Do that in safe mode and then set the updates to as I have mine in pic and when you get the pop up for updates again you can then download them one at a time if you want any you don't want right click on them and hide them.

 

[Arc]

On another note, for the perspective of dump analysis, all your recent BSODs are stop 0x51. As per Carrona.org, the probable causes of such a BSOD is Hardware failure, File system corruption, Security issues.

So I would suggest you some checks .......

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

Stress test the Graphics Card using Furmark.
Video Card - Stress Test with Furmark

Stress test the CPU.
Hardware - Stress Test With Prime95

Test your HDD using WD Support / Downloads / SATA & SAS / WD VelociRaptor

Uninstall ISOMounter.

And, when a person uses multiple instances of Real Time Protection programs installed, they will have security issues, it is not any big deal. No need to use AVG, when you have MSE installed. Get rid og AVG, its crap. Then Scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Let us know the results.

_________________________________________________________________________

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 51, {1, fffff8a000e3f010, 4bd9000, 374}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+9dba )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

REGISTRY_ERROR (51)
Something has gone badly wrong with the registry.  If a kernel debugger
is available, get a stack trace. It can also indicate that the registry got
an I/O error while trying to read one of its files, so it can be caused by
hardware problems or filesystem corruption.
It may occur due to a failure in a refresh operation, which is used only
in by the security system, and then only when resource limits are encountered.
Arguments:
Arg1: 0000000000000001, (reserved)
Arg2: fffff8a000e3f010, (reserved)
Arg3: 0000000004bd9000, depends on where Windows bugchecked, may be pointer to hive
Arg4: 0000000000000374, depends on where Windows bugchecked, may be return code of
    HvCheckHive if the hive is corrupt.

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x51

PROCESS_NAME:  sftlist.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800035f5da8 to fffff800032c4b80

STACK_TEXT:  
fffff880`0774e908 fffff800`035f5da8 : 00000000`00000051 00000000`00000001 fffff8a0`00e3f010 00000000`04bd9000 : nt!KeBugCheckEx
fffff880`0774e910 fffff800`03560115 : 00000000`00256a99 00000000`00025ec7 fffff8a0`00e3f010 00000000`00000004 : nt! ?? ::NNGAKEGL::`string'+0x9dba
fffff880`0774e970 fffff800`0355feec : fffff8a0`00e3f010 fffff8a0`00e3f010 fffff8a0`00e5f0c0 00000000`00006b76 : nt!HvMarkDirty+0x176
fffff880`0774e9d0 fffff800`035475d8 : fffff8a0`00e3f010 00000000`024674e0 fffff8a0`08fffa24 fffff8a0`094a94e4 : nt!HvMarkCellDirty+0x150
fffff880`0774ea20 fffff800`03546ae4 : 00000000`00000000 00000000`024674e0 fffff8a0`00e3f010 01ceb353`d19406d6 : nt!CmpMarkKeyDirty+0x138
fffff880`0774ea60 fffff800`035468e8 : 00000000`00000000 00000000`024674e0 fffff8a0`01934380 01ceb353`d19406d6 : nt!CmpFreeKeyByCell+0x44
fffff880`0774eaa0 fffff800`03547125 : fffff8a0`04307230 fffff880`0774eb01 00000000`024674e0 fffff8a0`0000000f : nt!CmDeleteKey+0x250
fffff880`0774eb60 fffff800`032c3e13 : fffffa80`09964060 fffff880`00000000 fffff8a0`04307230 00010000`00000000 : nt!NtDeleteKey+0x1f1
fffff880`0774ec20 00000000`77981e1a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`011ee188 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77981e1a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::NNGAKEGL::`string'+9dba
fffff800`035f5da8 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::NNGAKEGL::`string'+9dba

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  51fb06cd

FAILURE_BUCKET_ID:  X64_0x51_nt!_??_::NNGAKEGL::_string_+9dba

BUCKET_ID:  X64_0x51_nt!_??_::NNGAKEGL::_string_+9dba

Followup: MachineOwner
---------

 

[antifm]

i have my machine still in safemode but i cant find a way to uninstall ISOmount. Any leads?
i did a g-search but i keep finding other results, not HOW TO REMOVE it

 

[Arc]

You may try Revo Uninstaller Freeware. Do it in advanced mode.

 

[ICIT2LOL]

Arc beat me to it that should do it as it is more in depth uninstall than the Windows feature.

 

[antifm]

two things here
1 - the videos audio is so low i cant hear it
2 - its in another language andi cant undersand it

also i still have no idea how to actually FIND ISOMount


i am searching with Revo but i dont see it.
tried scanning the machine with REVO but even that list is incredibly long with long paths,
so im not sure how to find that file or process now

 

[Arc]

You find anything saying Native Instruments? WinCD Emu?

Name    ISO Mounter
Manufacturer    Native Instruments GmbH
Status    OK
PNP Device ID    ROOT\SCSIADAPTER\0000
Driver    c:\windows\system32\drivers\niwincdemu.sys (, 109.08 KB (111,696 bytes), 11/17/2012 8:44 AM)

niwincdemu    ISO Mounter driver    c:\windows\system32\drivers\niwincdemu.sys    Kernel Driver    Yes    Manual    Running    OK    Normal    No    Yes

 

[antifm]

nothing for wincd EMU
but yes i see native instruments and thats something that is supposed to be running. Thats safe and purposly there.

However the problem is i have no idea how to use this tool to SEARCH and FIND anything.

when i open it
Basically it looks like its showing me my desktop.

ill check it again when i get home however, removing ISOMounter becuse its used by NI isnt really something id like to do here
because if my impression is correct, that program needs that to be running
its for MIDI controlled Dj equipment

 

[ICIT2LOL]

Now I don't know if it is ok Arc but what about looking in regedit HKEYS_CURRENT_USER & LOCAL_MACHINE as in pic.

I have looked for a manufacturer of that software bit there are far too many hits for all sorts of things maybe it is just listed as IsoMount? If so easily dealt with after a registry backup.

The other software is an audio programming software and maybe it needs reinstalling??

 

[antifm]

ok guys, couple things here firstly @ICit2lol the file he is talking about is ISOMounter (notice the er on the end) ISOMount (without the er) has TONS of results im sure the ISOMount(er) is correct here but its something that applies to a regular program i use almost daily. Also, i did a system restore, found ONe bug in malwarebytes, and removed it Uninstalled AVG later this week (friday night) ill run the stress tests on the machine but to date, like right now, this is what GOOD is happening Links open quicker (MUCH QUICKER) even from emails system hasnt gone into BSOD in the last 36 hours of restarts So far things look good from here. Ill report more Saturday afternoon when stress tests are done oh yea one more thing i was able to cause the machine to go into BSOD simply by trying to open a DOCX file with Microsoft Word Starter last night is was able to open that same file and program and no issues took place

 

[ICIT2LOL]

Sorry antifm but I saw IsoMount in post #7 and took it to be that

A couple you might try if MBAM found a bit of malware are these two won't take long to do


http://www.superantispyware.com/


http://www.bleepingcomputer.com/download/adwcleaner/

download from bleeping computer

 

[antifm]

ok so a strange occurance this morning when starting up the laptop
i have this machine setup with TWO account logins.
One was a test at something a long time ago. It never worked so i dont use it
That one (test account lets say, and test account has no password) has very minimal access to items and limited items installed under it.

The other account (main account called "liqid" ) has admin level access and everything is installed under that one.

So i started the laptop this morning,
clicked the appropriate USER account icon to log into
entered the password for it (because this one has a password)
and walked away
when i came back and hour later, i noticed the ALTERNATE (test account) desktop was loaded

with a balloon message at the bottom telling me that for some reason, windows could not log into
my usual account settings bla bla, try restarting / trying later, and so on
It also says to check the windows event logs for details


Ok so i tried again - log into the admin account
and same deal. it automatically goes into the test account settings.
Alright then - lets look at the windows EVENT logs

..... i see no errors.....
actually thats not totally true
There is a couple errors but not related to this

Error 1 -The AVGIDSAgent service terminated with service-specific error %%-536953637
(This is an AVG related issue and i uninstalled AVG the other day)

Error 2 - The McAfee Site Advisor Service service failed to start due to the follow error: The System cannot find the file specified
(DUH! i dont know why McAfee is on my machine because i never want that garbage installed)

Error 3 - The Windows Image Acquisition (WIA) service depends on the Shell Hardware Detection service which failed to start because of the following error:
The service cannot be started. because it is disabled or because it has no enable devices associated to it.
(im not sure what that is all about)

Now it seems for some reason that AVG never fully removed itself? i dont know why,
So now im trying a full shutdown and restart to see if i can get into the "liqid" admin level account to remove this (AGAIN) because i just tried it otherwise, and the system wont let me remove it via control panel because "other users are logged into this machine.

the strange thing is that i know for sure i uninstalled AVG a few days ago

 

[Arc]

AVG is nicely present there:

 Start Menu\Programs\AVG    Public:Start Menu\Programs\AVG    Public

avgidsdriver    AVGIDSDriver    c:\windows\system32\drivers\avgidsdrivera.sys    File System Driver    No    System    Stopped    OK    Normal    No    No
avgidsha    AVGIDSHA    c:\windows\system32\drivers\avgidsha.sys    File System Driver    Yes    Boot    Running    OK    Normal    No    Yes
avgldx64    AVG AVI Loader Driver    c:\windows\system32\drivers\avgldx64.sys    File System Driver    No    System    Stopped    OK    Normal    No    No
avgloga    AVG Logging Driver    c:\windows\system32\drivers\avgloga.sys    File System Driver    Yes    Boot    Running    OK    Normal    No    Yes
avgmfx64    AVG Mini-Filter Resident Anti-Virus Shield    c:\windows\system32\drivers\avgmfx64.sys    File System Driver    Yes    Boot    Running    OK    Normal    No    Yes
avgrkx64    AVG Anti-Rootkit Driver    c:\windows\system32\drivers\avgrkx64.sys    File System Driver    Yes    Boot    Running    OK    Normal    No    Yes
avgtdia    AVG TDI Driver    c:\windows\system32\drivers\avgtdia.sys    Kernel Driver    Yes    System    Running    OK    Normal    No    Yes
avgtp    avgtp    \??\c:\windows\system32\drivers\avgtpx64.sys    Kernel Driver    Yes    System    Running    OK    Normal    No    Yes

And McAfee ....

Start Menu\Programs\McAfee Family Protection    Public:Start Menu\Programs\McAfee Family Protection    Public

Told about the ISO Mounter earlier.

Lots of garbage there. You need to clean them up. Better do it all in a single go.

IMHO you should try this .....

:ar: http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

 

[ICIT2LOL]

Have to agree with Arc mate this is just not going anywhere.