BSOD Help Required!

[Talexe]

Multiple BSOD! Help! (Minidump Attached)

Hello! My computer has been crashing with disturbing regularity - it didn't happen at all on my old computer running XP!

Any help from the Minidump would be much appreciated!

 

[zigzag3143]

Hello! My computer has been crashing with disturbing regularity - it didn't happen at all on my old computer running XP!

Any help from the Minidump would be much appreciated!

In both memory was the casue. In the first your ad-aware caused the memory pool to be corrupt. I would un-install it

In the other the VSS (volume shadow service) caused a bad pool header.

Since they both involved memory I would downlaod memtestx86, burn it to cd and run it for 5 passes or more.

Let us know if you need help

ken

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Minidump\050910-21918-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`03406000 PsLoadedModuleList = 0xfffff800`03643e50
Debug session time: Sun May  9 04:47:03.538 2010 (GMT-4)
System Uptime: 0 days 0:02:19.865
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffffa8003c9a9b0, fa8003c9a9b0ffff, fffffa8003c9a9b0}

Unable to load image \SystemRoot\system32\drivers\mfehidk.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
Probably caused by : Pool_Corruption ( nt!ExFreePool+780 )

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffffa8003c9a9b0, the pool entry being checked.
Arg3: fa8003c9a9b0ffff, the read back flink freelist value (should be the same as 2).
Arg4: fffffa8003c9a9b0, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------


OVERLAPPED_MODULE: Address regions for 'cfwids' and 'mfeavfk01.sy' overlap

BUGCHECK_STR:  0x19_3

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  AAWService.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800035a9130 to fffff80003476600

STACK_TEXT:  
fffff880`099bdb78 fffff800`035a9130 : 00000000`00000019 00000000`00000003 fffffa80`03c9a9b0 fa8003c9`a9b0ffff : nt!KeBugCheckEx
fffff880`099bdb80 fffff800`035ab4c1 : fffff8a0`00001900 fffffa80`0449a000 00000000`00000000 fffffa80`04ad8630 : nt!ExFreePool+0x780
fffff880`099bdc10 fffff800`0378d75e : fffffa80`04c1e930 00000000`00000001 fffffa80`20707249 fffffa80`04c1e930 : nt!ExFreePoolWithTag+0x411
fffff880`099bdcc0 fffff800`0347b7b4 : 00000000`00000000 fffffa80`06aa6060 fffffa80`03d12f30 00000000`00000000 : nt!IopDeleteFile+0x14e
fffff880`099bdd50 fffff800`0378d4b4 : fffffa80`06aa6060 00000000`00000000 fffffa80`078bab60 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`099bddb0 fffff800`0378d3b4 : 00000000`00000c84 fffffa80`06aa6060 fffff8a0`00001950 00000000`00000c84 : nt!ObpCloseHandleTableEntry+0xc4
fffff880`099bde40 fffff800`03475853 : fffffa80`078bab60 fffff880`099bdf10 fffff8a0`09062120 fffffa80`044ac010 : nt!ObpCloseHandle+0x94
fffff880`099bde90 fffff800`03471df0 : fffff880`01157e33 00000000`00000000 00000000`00000034 fffff8a0`09062120 : nt!KiSystemServiceCopyEnd+0x13
fffff880`099be028 fffff880`01157e33 : 00000000`00000000 00000000`00000034 fffff8a0`09062120 fffffa80`04c62890 : nt!KiServiceLinkage
fffff880`099be030 00000000`00000000 : 00000000`00000034 fffff8a0`09062120 fffffa80`04c62890 fffff880`099be138 : mfehidk+0xfe33


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExFreePool+780
fffff800`035a9130 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExFreePool+780

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  X64_0x19_3_nt!ExFreePool+780

BUCKET_ID:  X64_0x19_3_nt!ExFreePool+780

Followup: Pool_corruption
---------

 

[Talexe]

Thanks, Ken!

Just out of interest, why would AdAware be causing the problem? I thought it was a pretty stable, reputable bit of software! Though I do say that with little actual expertise.

Will uninstall all the same, download memtestx86 and run it from a CD. Hope it works!

Is this the 'memtest' I'm looking for? http://www.memtest.org/
If I download the 'Pre-Compiled Bootable ISO', does that mean I can copy it straight to a CD without needing to 'burn' it?

 

[zigzag3143]

Thanks, Ken!

Just out of interest, why would AdAware be causing the problem? I thought it was a pretty stable, reputable bit of software! Though I do say that with little actual expertise.

Will uninstall all the same, download memtestx86 and run it from a CD. Hope it works!

It was back in xp and I used it. I am unsure if memory cased Ad-aware, or if ad-aware caused memory. The memtest should clear that up

 

[Talexe]

Conveniently, I got another BSOD after restarting having uninstalled AdAware! I've attached the updated Minidump and here's the entry from Event Viewer if that's at all useful.

Log Name: System
Source: Microsoft-Windows-Kernel-Power
Date: 09/05/2010 22:46:08
Event ID: 41
Task Category: (63)
Level: Critical
Keywords: (2)
User: SYSTEM
Computer: Admin-PC
Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
<EventID>41</EventID>
<Version>2</Version>
<Level>1</Level>
<Task>63</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000002</Keywords>
<TimeCreated SystemTime="2010-05-09T21:46:08.343617300Z" />
<EventRecordID>23885</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>Admin-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BugcheckCode">59</Data>
<Data Name="BugcheckParameter1">0xc0000005</Data>
<Data Name="BugcheckParameter2">0xfffff800034ab7a9</Data>
<Data Name="BugcheckParameter3">0xfffff88009539ed0</Data>
<Data Name="BugcheckParameter4">0x0</Data>
<Data Name="SleepInProgress">false</Data>
<Data Name="PowerButtonTimestamp">0</Data>
</EventData>
</Event>

 

[Talexe]

Sorry for the double post, but I have the results of my memtestx86! Left it on all day while I was at school - it ran for a whopping 14 passes and found 0 errors! That confused me, but I guess it means it isn't a hardware problem?

I hope it ran correctly - I didn't do any configuration and just let it run from boot without me touching it. I couldn't see a way of capturing the screen, but I used the distinctly newby tactic of photographing the screen if anyone wants to see it.

So good news, but the mystery is unsolved! Help!

 

[Jonathan_King]

I can't figure out what are the latest dmps. Please delete all the dmps in your minidump folder, and upload the new ones as they come.

 

[Talexe]

Okay. I had a new one after a bit of use this afternoon, but before I could post my dumps the computer crashed again! It's starting to seem like a hopeless battle. Are there any indications from the existing dumps as to the problem? Also, does the memtestx86 score rule out hardware problems?

EDIT: Is there any way to post the dumps via safe mode? Otherwise I'll just have to try to be speedy - or lucky.

 

[Jonathan_King]

Sure, but you will need to use Safe Mode With Networking instead of normal safe mode.

 

[Talexe]

Deleted old dumps as you requested. Attached is one new one! Please help - I want my (normally) lovely computer back! Thanks in advance!

 

[Jonathan_King]

Uninstall McAfee and run this removal tool: http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

Then install Microsoft Security Essentials.

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Jonathan\AppData\Local\Temp\Temp1_Minidump (2).zip\Minidump\051210-19203-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`03400000 PsLoadedModuleList = 0xfffff800`0363de50
Debug session time: Wed May 12 15:34:36.987 2010 (GMT-4)
System Uptime: 0 days 0:03:33.940
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 135, {ffffffffc0000005, fffff88007da2d80, fffff8800113b300, fffff8a000207ab0}

Unable to load image \SystemRoot\system32\drivers\mfehidk.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
Probably caused by : mfehidk.sys ( mfehidk+4d2c9 )

Followup: MachineOwner
---------

 

[Talexe]

Thanks! I don't want to sound smug, but I never did trust my dad's faith in McAfee! I'll keep you updated on progress.

 

[Jonathan_King]

Thanks! I don't want to sound smug, but I never did trust my dad's faith in McAfee! I'll keep you updated on progress.

IMO, McAfee is bloated junkware. 100% guaranteed to slow down your system, and will cause loads of problems or your money back!

 

[Talexe]

How sure are you that the problem will be solved now?

In the glorious event that it is, what happens from here? Is there likely to be any lasting damage to my system from all these 'critical errors'? Are there any measures I can take to make sure this doesn't happen again?

 

[Jonathan_King]

No, BSODs are stop errors designed to shut down the computer before hardware damage occurs.

I have a good guess removing McAfee will do it, but nothing is ever certain.

 

[Talexe]

Thanks once again! I currently have SpyBot - Search and Destroy enabled. Will this conflict with Microsoft Security Essentials?

 

[Jonathan_King]

It shouldn't, but I'll keep that in mind if you have any more problems.