BSOD again.......

[Jonathan_King]

Let's try a RAM test. Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Boot from the CD, and leave it running for at least 5 or 6 passes.

Please update the following:

PxHelp20.sys Tue Jun 23 19:16:17 2009- http://www.carrona.org/pxhelp20.html
SahdIa32.sys Mon Oct 27 23:55:58 2008-Sonic Solutions Disk Filter Driver
SaibIa32.sys Mon Oct 27 23:56:02 2008

Remove Kaspersky Boot Protector ASAP.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Jonathan\AppData\Local\Temp\Temp2_062310-24304-01.zip\062310-24304-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Mini Kernel Dump does not have thread information
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82a4b000 PsLoadedModuleList = 0x82b93810
Debug session time: Tue Jun 22 23:26:58.408 2010 (UTC - 4:00)
System Uptime: 0 days 1:37:00.625
Loading Kernel Symbols
...................................................Unable to load image Unknown_Module_00000000, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Unknown_Module_00000000
Unable to add module at 00000000

Loading User Symbols
Missing image name, possible paged-out or corrupt data.
Loading unloaded module list
.Missing image name, possible paged-out or corrupt data.
.Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.
.Missing image name, possible paged-out or corrupt data.
.Missing image name, possible paged-out or corrupt data.
.Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.
.Missing image name, possible paged-out or corrupt data.
..Missing image name, possible paged-out or corrupt data.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {82938634, 2, 1, 82ab4daf}

Unable to read KTHREAD address 8a8d6708
Probably caused by : ntkrpamp.exe ( nt!KiTimerExpiration+15d )

Followup: MachineOwner
---------

0: kd> lmntsmr
Unknown option 'r'
start    end        module name
8b5a3000 8b5eb000   ACPI     ACPI.sys     unavailable (00000000)
8b732000 8b73b000   amdxata  amdxata.sys  Tue May 19 13:57:35 2009 (4A12F30F)
8b706000 8b70f000   atapi    atapi.sys    Mon Jul 13 19:11:15 2009 (4A5BBF13)
8b70f000 8b732000   ataport  ataport.SYS  Mon Jul 13 19:11:18 2009 (4A5BBF16)
8b42f000 8b437000   BOOTVID  BOOTVID.dll  unavailable (00000000)
8b479000 8b524000   CI       CI.dll       unavailable (00000000)
8bbac000 8bbd1000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:11:20 2009 (4A5BBF18)
8b437000 8b479000   CLFS     CLFS.SYS     unavailable (00000000)
8b984000 8b9e1000   cng      cng.sys      Mon Jul 13 19:32:55 2009 (4A5BC427)
8bb9b000 8bbac000   disk     disk.sys     Mon Jul 13 19:11:28 2009 (4A5BBF20)
8b76f000 8b780000   fileinfo fileinfo.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
8b73b000 8b76f000   fltmgr   fltmgr.sys   Mon Jul 13 19:11:13 2009 (4A5BBF11)
8b9ef000 8b9f8000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:11:14 2009 (4A5BBF12)
8bb69000 8bb9b000   fvevol   fvevol.sys   Fri Sep 25 22:24:21 2009 (4ABD7B55)
8bd5a000 8bd8b000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:12:03 2009 (4A5BBF43)
82a14000 82a4b000   hal      halmacpi.dll Mon Jul 13 19:11:03 2009 (4A5BBF07)
8bb61000 8bb69000   hwpolicy hwpolicy.sys Mon Jul 13 19:11:01 2009 (4A5BBF05)
80ba0000 80ba8000   kdcom    kdcom.dll    Mon Jul 13 21:08:58 2009 (4A5BDAAA)
8bc00000 8bc0d000   klbg     klbg.sys     Wed Oct 14 13:18:07 2009 (4AD607CF)
8b971000 8b984000   ksecdd   ksecdd.sys   Mon Jul 13 19:11:56 2009 (4A5BBF3C)
8bb0f000 8bb34000   ksecpkg  ksecpkg.sys  Thu Dec 10 23:04:22 2009 (4B21C4C6)
8b413000 8b41e000   mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll unavailable (00000000)
8b6f0000 8b706000   mountmgr mountmgr.sys Mon Jul 13 19:11:27 2009 (4A5BBF1F)
8b5f4000 8b5fc000   msisadrv msisadrv.sys unavailable (00000000)
8b946000 8b971000   msrpc    msrpc.sys    Mon Jul 13 19:11:59 2009 (4A5BBF3F)
8bdec000 8bdfc000   mup      mup.sys      Mon Jul 13 19:14:14 2009 (4A5BBFC6)
8b6e7000 8b6f0000   mv91cons mv91cons.sys Tue Sep 22 17:36:33 2009 (4AB94361)
8ba1a000 8bad1000   ndis     ndis.sys     Mon Jul 13 19:12:24 2009 (4A5BBF58)
8bad1000 8bb0f000   NETIO    NETIO.SYS    Mon Jul 13 19:12:35 2009 (4A5BBF63)
82a4b000 82e5b000   nt       ntkrpamp.exe Sat Feb 27 02:33:35 2010 (4B88CACF)
8b817000 8b946000   Ntfs     Ntfs.sys     Mon Jul 13 19:12:05 2009 (4A5BBF45)
8b666000 8b677000   partmgr  partmgr.sys  Mon Jul 13 19:11:35 2009 (4A5BBF27)
8b631000 8b65b000   pci      pci.sys      Mon Jul 13 19:11:16 2009 (4A5BBF14)
8b6d2000 8b6d9000   pciide   pciide.sys   Mon Jul 13 19:11:19 2009 (4A5BBF17)
8b6d9000 8b6e7000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:11:15 2009 (4A5BBF13)
8b9e1000 8b9ef000   pcw      pcw.sys      Mon Jul 13 19:11:10 2009 (4A5BBF0E)
8b41e000 8b42f000   PSHED    PSHED.dll    unavailable (00000000)
8b780000 8b789300   PxHelp20 PxHelp20.sys Tue Jun 23 19:16:17 2009 (4A416241)
8bb34000 8bb61000   rdyboost rdyboost.sys Mon Jul 13 19:22:02 2009 (4A5BC19A)
8bde3000 8bdec000   SahdIa32 SahdIa32.sys Mon Oct 27 23:55:58 2008 (49068D4E)
8bddb000 8bde3000   SaibIa32 SaibIa32.sys Mon Oct 27 23:56:02 2008 (49068D52)
8bdd3000 8bddb000   spldr    spldr.sys    Mon May 11 12:13:47 2009 (4A084EBB)
8bc11000 8bd5a000   tcpip    tcpip.sys    Mon Jul 13 19:13:18 2009 (4A5BBF8E)
8b65b000 8b666000   vdrvroot vdrvroot.sys Mon Jul 13 19:46:19 2009 (4A5BC74B)
8bd8b000 8bd93380   vmstorfl vmstorfl.sys Mon Jul 13 19:28:44 2009 (4A5BC32C)
8b677000 8b687000   volmgr   volmgr.sys   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
8b687000 8b6d2000   volmgrx  volmgrx.sys  Mon Jul 13 19:11:41 2009 (4A5BBF2D)
8bd94000 8bdd3000   volsnap  volsnap.sys  Mon Jul 13 19:11:34 2009 (4A5BBF26)
8b524000 8b595000   Wdf01000 Wdf01000.sys unavailable (00000000)
8b595000 8b5a3000   WDFLDR   WDFLDR.SYS   unavailable (00000000)
8b5eb000 8b5f4000   WMILIB   WMILIB.SYS   unavailable (00000000)
Missing image name, possible paged-out or corrupt data.

Unloaded modules:
00530048 23b1fd2a   Unknown_Module_00530048
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  235EFCE2
Missing image name, possible paged-out or corrupt data.
00000000 933bf790   Unknown_Module_00000000
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  933BF790
Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.
00000000 c38ef7d0   Unknown_Module_00000000
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  C38EF7D0
Missing image name, possible paged-out or corrupt data.
00016c58 00000000   Unknown_Module_00016c58
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FFFE93A8
Missing image name, possible paged-out or corrupt data.
00000000 933bf790   Unknown_Module_00000000
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  933BF790
Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.
00000002 2722ba61   Unknown_Module_00000002
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  2722BA5F
Missing image name, possible paged-out or corrupt data.
01f95aa0 00000000   Unknown_Module_01f95aa0
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FE06A560
00000000 8c61b008   Unknown_Module_00000000
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  8C61B008
Missing image name, possible paged-out or corrupt data.

 

[penfold007]

Please update the following:

PxHelp20.sys Tue Jun 23 19:16:17 2009- http://www.carrona.org/pxhelp20.html
SahdIa32.sys Mon Oct 27 23:55:58 2008-Sonic Solutions Disk Filter Driver
SaibIa32.sys Mon Oct 27 23:56:02 2008

Remove Kaspersky Boot Protector ASAP.
 
have no idea how to update the 3 .sys files you mention, or how to disable or remove kaspersky boot protector.
I will however do passes with memtester

 

[Jonathan_King]

Update any programs you might have that are listed here: pxHelp20.sys programs

 

[penfold007]

the only program on that list I have is Roxio easy media creator, but it is the latest version (2010 pro) and is up to date???

so would it be better if I just uninstalled roxio??

plus any idea how to remove kaspersky boot protector??

quick update, just found an update from roxio dated jan 2010

 

[Jonathan_King]

Try removing it until we get the BSODs taken care of.

As for Kaspersky, make sure you have nothing related to it installed. Check in Programs and Features.

You may try running this tool: http://support.kaspersky.com/downloads/utils/kavremover10.zip

 

[penfold007]

you meen completely remove kaspersky and all its features?????
but wont that leave m pc vulnerable?

by the way there was an update for roxio dated jan 2010 and I've installed it, memtester has just finised its second pass and started its 3rd with no errors up to now, I'm talking to you through my little 2nd pc at the mo while memtest is working

 

[penfold007]

please advise regarding Kaspersky. Do you mean completely uninstall it? if so would that not leave my pc open and vulnerable

by the way memtester has completed 3 passes now and will leave it rinning for a few hours as have to go out for a while.

 

[Tews]

For testing purposes, completely remove Kaspersky with the removal tool as JK suggested... You can install MS Security Essentials while you are trouble shooting ...

 

[CarlTR6]

Kaspersky is a known cause of BSOD's on some Win 7 systems - as are all third party anti-malware suites.

 

[penfold007]

I've now tested the ram and its sailed through, been going all afternoon, about 6 to 7 hours. havnt uninstalled kaspersky yet, but here is the latest minidump

my next step would be kaspersky uninstallation

 

[CarlTR6]

In addition to uninstalling Kaspersky, don't forget to update the drivers Jonathan pointed out.

 PxHelp20.sys Tue Jun 23 19:16:17 2009- [URL="http://www.carrona.org/pxhelp20.html"]pxHelp20.sys programs[/URL]
SahdIa32.sys Mon Oct 27 23:55:58 2008-Sonic Solutions Disk Filter Driver
SaibIa32.sys Mon Oct 27 23:56:02 2008

 

[penfold007]

have you any idea where I can get the latest drivers for those??
I've looked at the list and the only program I have on my machine is Roxio 2010 pro, this has been updated to the latest service pack from roxio this afternoon, so if those drivers are not with the update I havn't a clue how to update them.
also I uploaded the latest minidump, did it show anything else??

 

[penfold007]

OK, I think I'm up to date with the instructions. Kaspersky is gone, and microsoft essential is on. The only program I had in that list was Roxio 2010 pro, and thats been updated. Have run memtest all afternoon, from mid day til about 6pm, 8 or 9 complete passes with no errors.
Whats next?

 

[penfold007]

have had 2 more BSOD's tonight, one came back saying gdrv.sys
the other the same as before, I'm tearing my hair out with this..... does anything work with Windows 7??
here are the last 2 minidumps

 

[Jonathan_King]

Try a system files check.

Open an elevated command prompt and enter sfc /scannow.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Jonathan\AppData\Local\Temp\Temp1_062310-25786-01.zip\062310-25786-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82a1e000 PsLoadedModuleList = 0x82b66810
Debug session time: Wed Jun 23 16:54:56.262 2010 (UTC - 4:00)
System Uptime: 0 days 0:01:31.870
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 000000f6, Referencing user handle as KernelMode.
Arg2: 000000ac, Handle value being referenced.
Arg3: a1ffc8e8, Address of the current process.
Arg4: aacc5cb6, Address inside the driver that is performing the incorrect reference.

Debugging Details:
------------------

*** ERROR: Module load completed but symbols could not be loaded for gdrv.sys

BUGCHECK_STR:  0xc4_f6

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  GUI.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 82d52f03 to 82afad10

STACK_TEXT:  
a6dd0a04 82d52f03 000000c4 000000f6 000000ac nt!KeBugCheckEx+0x1e
a6dd0a24 82d57766 000000ac a1ffc8e8 ab011968 nt!VerifierBugCheckIfAppropriate+0x30
a6dd0ab8 82c422b4 000000ac aa9c0fe0 00000000 nt!VfCheckUserHandle+0x14f
a6dd0ae8 82c4216e 000000ac 000f001f 00000000 nt!ObReferenceObjectByHandleWithTag+0x13b
a6dd0b0c 82d60736 000000ac 000f001f 00000000 nt!ObReferenceObjectByHandle+0x21
a6dd0b34 aacc5cb6 000000ac 000f001f 00000000 nt!VerifierObReferenceObjectByHandle+0x21
WARNING: Stack unwind information not available. Following frames may be wrong.
a6dd0bb8 aacc54e6 9e8ee978 00000000 00000000 gdrv+0xcb6
a6dd0bdc 82d4d6c3 00000004 00000020 9e7471a8 gdrv+0x4e6
a6dd0c00 82a5a473 00000000 a001af68 9e8ee978 nt!IovCallDriver+0x258
a6dd0c14 82c5bf2e 9e7471a8 a001af68 a001afd8 nt!IofCallDriver+0x1b
a6dd0c34 82c78d11 9e8ee978 9e7471a8 00000000 nt!IopSynchronousServiceTail+0x1f8
a6dd0cd0 82c7b4ec 9e8ee978 a001af68 00000000 nt!IopXxxControlFile+0x6aa
a6dd0d04 82a6144a 000000a8 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
a6dd0d04 778664f4 000000a8 00000000 00000000 nt!KiFastCallEntry+0x12a
0012ef78 00000000 00000000 00000000 00000000 0x778664f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
gdrv+cb6
aacc5cb6 3bc3            cmp     eax,ebx

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  gdrv+cb6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: gdrv

IMAGE_NAME:  gdrv.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49b9d04c

FAILURE_BUCKET_ID:  0xc4_f6_VRF_gdrv+cb6

BUCKET_ID:  0xc4_f6_VRF_gdrv+cb6

Followup: MachineOwner
---------

 

[penfold007]

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>sfc /scannow
Beginning system scan. This process will take some time.
Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection did not find any integrity violations.
C:\Windows\system32>

 

[reventon]

Hi,

It is looking like it is a hardware fault.

I see you have already done memtest, so can you try testing your CPU with Prime95

Prime95 Setup:
Download from: Free Software - GIMPS
- extract the contents of the zip file to a location of your choice
- double click on the executable file
- select "Just stress testing"
- select the "Blend" test. If you've already run MemTest overnight you may want to run the "Small FFTs" test instead.
- "Number of torture test threads to run" should equal the number of CPU's times 2 (if you're using hyperthreading).
The easiest way to figure this out is to go to Task Manager...Performance tab - and see the number of boxes under CPU Usage History
Then run the test for 6 to 24 hours - or until you get errors (whichever comes first).
The Test selection box and the stress.txt file describes what components that the program stresses.

Regards,
Reventon

 

[penfold007]

OK I'm running the prime test now. If it passes the prime, could the motherboard be at fault?
PS how do you tell if it has failed with the prime 95 program??
it shows 4 cpu's (worker 1 to 4- self test) then test 1-2-3-4-5-6 and so on..... but how do you tell if its failed one?

 

[Jonathan_King]

Yes, it could. Also PSU.

 

[penfold007]

I've replaced the psu, well not replaced but used another one I had spare