Solved BSOD increasingly frequent crashes; varying error messages.

[givolini]

Hi.

In the last months, I've been experiencing an increasing number of BSOD crashes, which now happen on a daily bases.
In addition to that, my system (Windows 7 pro 64 bit) for some reason stopped saving minidump files, as of last september. I am therefore enclosing my Event Viewer administrative logs too.

Thanks for the help,
Giorgio

 

[Golden]

Please setup so that dmp files are created:
http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html

When the system BSOD's agaon, use this to gather the information and post here:
http://www.sevenforums.com/bsod-help-support/96879-blue-screen-death-bsod-posting-instructions.html

 

[givolini]

Hello again.

I couldn't get the system to generate minidump files, so I thought I might as wel reinstall the O.S. (clean install, preceded by partition formatting).

I've already got two blue screens since the reinstall, so now I'm enclosing all the necessary info.
Thanks again for your help.

 

[Golden]

fffff880`0318b8a8  fffff880`03aa1ad2Unable to load image \??\C:\Windows\system32\drivers\aswMonFlt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for [COLOR="red"][B]aswMonFlt.sys[/B][/COLOR]
*** ERROR: Module load completed but symbols could not be loaded for aswMonFlt.sys
 aswMonFlt+0x1bad2

Avast is blamed for this crash. Completely uninstall Avasts (it is a known cause of BSOD on some systems) and replace it with MSE:
Microsoft Security Essentials - Microsoft Windows

Also, as a precaution, please scan your system using the FREE version of Malwarebytes:
Malwarebytes : Downloads

 

[givolini]

I did as you suggested.
Before Avast, I've been using Bitdefender: another nightmarish experience (must be the 64bit O.S., I don't know).
Anyway, should any other BSOD come up in the newt days, I'll post it.
Thanks a lot.

 

[givolini]

One more BSOD

Hello again.

One more blue screen.

I've uninstalled Avast using the Avast uninstaller in safe mode and replaced it with MS Essentials; run Malwarebytes too.

What is it, now?
Thanks!!

 

[givolini]

... and again

yet one more BSOD.

Enclosing files again.

 

[Golden]

fffff880`03f8e858  fffff880`0113eec5*** WARNING: Unable to verify timestamp for MpFilter.sys
*** ERROR: Module load completed but symbols could not be loaded for [COLOR="Red"][B]MpFilter.sys[/B][/COLOR]
 MpFilter+0x3ec5

MpFilter.sys is a core file of MSE. Did you install MSE in Safe Mode?

Did you perform a scan with Malwarebytes as suggested? Is Windows completed updated?

 

[givolini]

MpFilter.sys is a core fileof MSE. Did you install MSE in Safe Mode?
No, did I have too?

Did you perform a scan with Malwarebytes as suggested? Is Windows completed updated?
Yes to both

I did notice MSE acting strange: sometimes, on startup, it won‘t activate and I‘ll have to update manually to have it started.
Perhaps I should reinstall?

 

[brovins]

I had the same happen to me. BSOD right?

What I did is update all my drivers and it worked fine.

 

[Golden]

I did notice MSE acting strange: sometimes, on startup, it won‘t activate and I‘ll have to update manually to have it started.
Perhaps I should reinstall?

Yes. Uninstall, then reinstall - no need for Safe Mode.

 

[givolini]

two more BSOD

I've uninstalled/reinstalled Microsoft Essentials.
For a day, it was fine.
Now, two more BSOD.
Enclosing files as usual.
Thanks

p.s. it seems there still is something wrong with the antivirus: real time protection is disabled, and it keeps saying it needs virus definition to be updated.

 

[Golden]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005003, The subtype of the bugcheck.
Arg2: fffff70001080000
Arg3: 0000000000007f63
Arg4: 00010e210000ffc6

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_5003

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  [B][COLOR="Red"]MsMpEng.exe[/COLOR][/B]

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

LAST_CONTROL_TRANSFER:  from fffff80002eef4ec to fffff80002e86bc0

MsMpEng.exe is a core process of Windows Defender. Please do the following:
1. Click Start

2. In the search box, type cmd
3. In the list that appears, right-click on cmd.exe and choose Run as administrator
4. In the command window that opens, type sfc /scannow and hit enter.

Report the output from the command window once it finishes.

More detail: http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

 

[givolini]

Here's the report

 

[givolini]

Sorry: the command window said something like "Windows resources protection: inpossible to restore some of the damaged files found. Details in the CBS.log file"

 

[Golden]

I'll ask NoelDP to have a look at this for you.

 

[NoelDP]

The failing replacement isn't exactly critical

 Line 72320: 2014-01-09 12:00:05, Info                  CSI    0000030b [SR] Repairing 1 components
 Line 72321: 2014-01-09 12:00:05, Info                  CSI    0000030c [SR] Beginning Verify and Repair transaction
 Line 72324: 2014-01-09 12:00:05, Info                  CSI    0000030e [SR] Cannot repair member file [l:18{9}]"img17.jpg" of Microsoft-Windows-Shell-Wallpaper-Architecture, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 72327: 2014-01-09 12:00:05, Info                  CSI    00000310 [SR] Cannot repair member file [l:18{9}]"img17.jpg" of Microsoft-Windows-Shell-Wallpaper-Architecture, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 72328: 2014-01-09 12:00:05, Info                  CSI    00000311 [SR] This component was referenced by [l:216{108}]"Microsoft-Windows-Branding-Professional-Client-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.BPSC Namespace"
 Line 72333: 2014-01-09 12:00:05, Info                  CSI    00000314 [SR] Could not reproject corrupted file [ml:520{260},l:82{41}]"\??\C:\Windows\Web\Wallpaper\Architecture"\[l:18{9}]"img17.jpg"; source file in store is also corrupted
 Line 72342: 2014-01-09 12:00:05, Info                  CSI    00000316 [SR] Repair complete

... but Windows can get sniffy about these things, so I'll post a fix protocol in a few minutes.

 

[NoelDP]

...By the way, Golden - MsMPeng is also part of MSE. perhaps running removal tools for BitDefender and Avast would be a good idea?

 

[NoelDP]

I've uploaded a file - gviaa.zip - to my SkyDrive at Noel's SkyDrive
Please download and save it.
Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
Close all windows (it would be a good idea to print these instructions!)
Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.
Pick the option to use a Command Prompt
At the prompt type
DIR C:\gviaa
hit the enter key - if you get a 'Not Found' error try
DIR D:\gviaa
or
DIR E:\gviaa

The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...

XCOPY <drive>:\gviaa <drive>:\windows\winsxs /y /i /s /v /h

(e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )

run the command (it should take almost no time)and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.
Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your SkyDrive Public folder, and post a new link
Also run a new MGADiag report, and post the result.

 

[givolini]

... wow Thank you so much for taking the time.

I'll print these instructions now.

Btw, I've already run the Avast revomal tool in Safe mode. As far as Bitdefender is concerned, that was an incredibly unpleasant experience that belongs to the past. I have reinstalled everything just a few days ago (but not Bit Defender).

p.s.: there seems to be just an image in the zipped folder. Is that right?
p.s. 2: I do not have a SkyDrive folder. Is it ok if I post the CBS.log file here like the first time?