BSOD Issue after DBAN and fresh Windows 7 Install

[MrsN]

Hi - this is my first post and I've left this as long as I could stand before needing to turn to someone (anyone!) for help.

I don't know very much about the technical side of computers so please bear with me if I have to question any instructions I don't understand!


My laptop is 3 years old (Toshiba Satellite P200-1FC) and has been having a problem with system freezes and BSOD's. It started about 2 months ago when I was uploading photos from my camera's SD card onto my laptop. I had a lot of photos from my wedding from different family members so was using all different memory cards to get all photos on my laptop. Suddenly the folder I was viewing photos in froze - BSOD then came along swiftly.
Didn't think too much of it the first time so tried again and it happened everytime I reached a particular section of photos in a folder.

Around this same time I had thought that the Norton 360 I was running had picked up some viruses as it was behaving a little strangely (turning itself off and telling me a full scan had completed in seconds!)
After trying a few things I decided to wipe the hard drive using DBAN and start over with Windows 7.
My laptop had originally been installed with Vista - which I wasn't so fond of so Windows 7 seemed a good idea.


So I started right from scratch about a month ago and installed Windows 7 Enterprise (32bit)and got my Norton 360 back on the system but removed MBAM at the request of Norton as they said it could interfere with Norton products.


Now I am having BSOD's here and there but it always seems to relate to running any media based programs - windows live movie maker, viewing videos on windows media player or dealing with photos.


Is anyone able to give any advice on what the problem might be? (BSOD zip file attached)


Thanks!!


Natalie.

 

[yowanvista]

but removed MBAM at the request of Norton as they said it could interfere with Norton products.

MBAM has no conflicts with Norton at all.
Download Malwarebytes and run a full scan, your system seems to be infected
The symantec engine used by N360 caused your BSODs, I'd recommend completely removing Norton and reinstalling from scratch, your N360 has corrupt install

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7A, {c0501af0, c0000185, 261ae8c0, a035e830}

Unable to load image \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20110722.040\NAVEX15.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NAVEX15.SYS
*** ERROR: Module load completed but symbols could not be loaded for NAVEX15.SYS
*** WARNING: Unable to verify timestamp for SRTSP.SYS
*** ERROR: Module load completed but symbols could not be loaded for SRTSP.SYS
Probably caused by : NAVEX15.SYS ( NAVEX15+5b8af )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: c0501af0, lock type that was held (value 1,2,3, or PTE address)
Arg2: c0000185, error status (normally i/o status code)
Arg3: 261ae8c0, current process (virtual address for lock type 3, or PTE)
Arg4: a035e830, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

Debugging Details:
------------------


ERROR_CODE: (NTSTATUS) 0xc0000185 - The I/O device reported an I/O error.

DISK_HARDWARE_ERROR: There was error with disk hardware

BUGCHECK_STR:  0x7a_c0000185

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  dllhost.exe

CURRENT_IRQL:  0

TRAP_FRAME:  ac8475d0 -- (.trap 0xffffffffac8475d0)
ErrCode = 00000000
eax=a035e838 ebx=0005e830 ecx=00000002 edx=00000000 esi=a035e830 edi=986bbed0
eip=82a8f8d8 esp=ac847644 ebp=ac84764c iopl=0         nv up ei ng nz ac pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010297
nt!memcpy+0x128:
82a8f8d8 8b448ef8        mov     eax,dword ptr [esi+ecx*4-8] ds:0023:a035e830=00000000
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82af9e35 to 82b34f2c

STACK_TEXT:  
ac847434 82af9e35 0000007a c0501af0 c0000185 nt!KeBugCheckEx+0x1e
ac8474a4 82afd716 ac8474f8 82bc0240 ac847518 nt!MiWaitForInPageComplete+0x302
ac847534 82ae6967 82bc0240 a035e830 850b5128 nt!MiIssueHardFault+0x3b3
ac8475b8 82a973d8 00000000 a035e830 00000000 nt!MmAccessFault+0x2656
ac8475b8 82a8f8d8 00000000 a035e830 00000000 nt!KiTrap0E+0xdc
ac84764c 9e45b8af 986bbed0 a035e830 00000008 nt!memcpy+0x128
WARNING: Stack unwind information not available. Following frames may be wrong.
ac84767c 9e46039f 0005e830 00000008 986bbed0 NAVEX15+0x5b8af
ac8476a0 9e478003 00000008 986bbed0 00000000 NAVEX15+0x6039f
ac8476dc 9e467cc6 00000002 9efb2d28 9e7d0c1a NAVEX15+0x78003
ac847708 9e466456 00000000 0000007f 986b9100 NAVEX15+0x67cc6
ac84774c 9e40876f 9e56f570 8f846d68 00000000 NAVEX15+0x66456
ac84778c 9e40f286 ac8477f0 9e56f570 8f846ca0 NAVEX15+0x876f
ac8477f8 9dc8d23f acba8190 8f846ca0 8f846d68 NAVEX15+0xf286
ac847854 9dc7caad 8f846e68 8f846c88 00000005 SRTSP+0x5823f
ac8478d4 9dc7ddee 00000001 00000002 8f846c88 SRTSP+0x47aad
ac8478ec 9dc7ecfa 9bd3f580 8f846c88 82b18b87 SRTSP+0x48dee
ac847908 9dc7edd3 8f846c88 ac8479a4 00000000 SRTSP+0x49cfa
ac84792c 9dc5a68e ac19a8b0 858ca008 858ca0c0 SRTSP+0x49dd3
ac847980 88c0d324 858ca068 ac8479a4 00000000 SRTSP+0x2568e
ac8479e8 88c10512 008ca008 858ca008 1000000c fltmgr!FltpPerformPostCallbacks+0x24a
ac8479fc 88c10b46 858ca008 865055a0 ac847a3c fltmgr!FltpProcessIoCompletion+0x10
ac847a0c 88c1129c 858aded8 865055a0 858ca008 fltmgr!FltpPassThroughCompletion+0x98
ac847a3c 88c248c9 ac847a5c 00000000 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x33a
ac847a88 82a8d593 858aded8 858d7008 85942c0c fltmgr!FltpCreate+0x2db
ac847aa0 82c9c2ad b2d529d6 ac847c48 00000000 nt!IofCallDriver+0x63
ac847b78 82c7bab5 858ab5e0 85aba298 9b0aa750 nt!IopParseDevice+0xed7
ac847bf4 82c8bec6 00000000 ac847c48 00000040 nt!ObpLookupObjectName+0x4fa
ac847c50 82c829a4 0168de50 84aba298 00000001 nt!ObOpenObjectByName+0x165
ac847ccc 82c88b2a 0168deb0 00100021 0168de50 nt!IopCreateFile+0x673
ac847d14 82a941ea 0168deb0 00100021 0168de50 nt!NtOpenFile+0x2a
ac847d14 77a470b4 0168deb0 00100021 0168de50 nt!KiFastCallEntry+0x12a
0168debc 00000000 00000000 00000000 00000000 0x77a470b4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NAVEX15+5b8af
9e45b8af ??              ???

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  NAVEX15+5b8af

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NAVEX15

IMAGE_NAME:  NAVEX15.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4dcc44a1

FAILURE_BUCKET_ID:  0x7a_c0000185_NAVEX15+5b8af

BUCKET_ID:  0x7a_c0000185_NAVEX15+5b8af

Followup: MachineOwner
---------

 

[MrsN]

Hi Yowanvista.

Thanks for taking the time to help me out with this.

I did as you said and uninstalled N360. Then I downloaded MBAM and did a full scan - it took 34 mins and found nothing.
Would you still suggest I now reinstall N360 or should I try to find these suspected infections some other way?

Thanks,

Natalie.

 

[yowanvista]

Hi Yowanvista.

Thanks for taking the time to help me out with this.

I did as you said and uninstalled N360. Then I downloaded MBAM and did a full scan - it took 34 mins and found nothing.
Would you still suggest I now reinstall N360 or should I try to find these suspected infections some other way?

Thanks,

Natalie.

Yes reinstall it

 

[MrsN]

Okay. Have done as you suggested so I hope the dreaded BSOD's will stop now. Only time will tell...

 

[MrsN]

The BSOD's are back again.....

Happened suddenly a few days ago when I left the laptop idle for about an hour - came back and it crashed. Then it happened again yesterday when looking through .jpegs and again today.

Don't know what to do! Any help would be appreciated.

 

[yowanvista]

Upload a new .zip file by following the 'Bsod posting instructions'

 

[MrsN]

Thanks Yowan.
Info is attached.

 

[yowanvista]

Dumps blame a possible problem in the disk controller
Run http://www.sevenforums.com/tutorials/433-disk-check.html
And SeaTools
| Seagate

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: c0516e18, lock type that was held (value 1,2,3, or PTE address)
Arg2: c0000185, error status (normally i/o status code)
Arg3: 665ff820, current process (virtual address for lock type 3, or PTE)
Arg4: a2dc36a6, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

Debugging Details:
------------------


ERROR_CODE: (NTSTATUS) 0xc0000185 - The I/O device reported an I/O error.

DISK_HARDWARE_ERROR: There was error with disk hardware

BUGCHECK_STR:  0x7a_c0000185

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

TRAP_FRAME:  8a6c9428 -- (.trap 0xffffffff8a6c9428)
ErrCode = 00000000
eax=a2dc36a4 ebx=a64ce024 ecx=82c953f4 edx=a2d862b8 esi=a2d862b8 edi=a64ce920
eip=82ccfbdf esp=8a6c949c ebp=8a6c94a4 iopl=0         nv up ei ng nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010282
nt!CmpDoCompareKeyName+0x17:
82ccfbdf f6400220        test    byte ptr [eax+2],20h       ds:0023:a2dc36a6=00
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82aeee35 to 82b29f2c

STACK_TEXT:  
8a6c928c 82aeee35 0000007a c0516e18 c0000185 nt!KeBugCheckEx+0x1e
8a6c92fc 82af2716 8a6c9350 82bb5240 8a6c9370 nt!MiWaitForInPageComplete+0x302
8a6c938c 82adb967 82bb5240 a2dc36a6 84d51f28 nt!MiIssueHardFault+0x3b3
8a6c9410 82a8c3d8 00000000 a2dc36a6 00000000 nt!MmAccessFault+0x2656
8a6c9410 82ccfbdf 00000000 a2dc36a6 00000000 nt!KiTrap0E+0xdc
8a6c94a4 82c3cd31 8a6c955c 000376a0 00000290 nt!CmpDoCompareKeyName+0x17
8a6c94cc 82c400b3 a2d862b8 8a6c955c 8a6c9534 nt!CmpCompareInIndex+0x3b
8a6c94ec 82c37284 a2d862b8 000001ec 8a6c955c nt!CmpFindSubKeyInLeafWithStatus+0x65
8a6c9508 82c376df a2d862b8 a64ce024 8a6c955c nt!CmpFindSubKeyInLeaf+0x1a
8a6c9538 82c374e9 a2d862b8 00234020 002b6d30 nt!CmpAddToLeaf+0xe4
8a6c9588 82c3aa2e 000003b8 002b6d30 8a6c98ac nt!CmpAddSubKey+0x259
8a6c95f0 82c79d3c a2d862b8 000003b8 84c83008 nt!CmpDoCreate+0x3ab
8a6c97a0 82c70ab5 b12c6130 84ae64d0 84c83008 nt!CmpParseKey+0xff7
8a6c981c 82c80ec6 800019e8 8a6c9870 00000240 nt!ObpLookupObjectName+0x4fa
8a6c9878 82c4ca08 8a6c9a54 84ae64d0 00000000 nt!ObOpenObjectByName+0x165
8a6c9958 82c4ce4f 8a6c9a7c 000f003f 8a6c9a54 nt!CmCreateKey+0x2b2
8a6c9980 82a891ea 8a6c9a7c 000f003f 8a6c9a54 nt!NtCreateKey+0x1f
8a6c9980 82a86cdd 8a6c9a7c 000f003f 8a6c9a54 nt!KiFastCallEntry+0x12a
8a6c9a14 8fce5457 8a6c9a7c 000f003f 8a6c9a54 nt!ZwCreateKey+0x11
8a6c9aa8 8fce6781 800026ac 00000829 00000000 discache!DispCreateObjectLru+0xba
8a6c9b2c 8fce766b 800007d4 8a6c9b80 8a6c9bd4 discache!DisCreateObjectRecord+0x12b
8a6c9bc0 8fce3be2 800007d4 800026c0 00000001 discache!DisCreateFileObjectRecord+0xf8
8a6c9c28 82c3570c 000017d8 0772f15c 0000033c discache!ScQueryAttributeInformation+0x170
8a6c9c4c 82ca1884 000017d8 0772f15c 0000033c nt!ExQueryAttributeInformation+0x4d
8a6c9d18 82a891ea 000017d8 0772f138 0772f15c nt!NtQueryInformationFile+0x1ab
8a6c9d18 774f70b4 000017d8 0772f138 0772f15c nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0772f714 00000000 00000000 00000000 00000000 0x774f70b4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
discache!DispCreateObjectLru+ba
8fce5457 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  13

SYMBOL_NAME:  discache!DispCreateObjectLru+ba

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: discache

IMAGE_NAME:  discache.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc214

FAILURE_BUCKET_ID:  0x7a_c0000185_discache!DispCreateObjectLru+ba

BUCKET_ID:  0x7a_c0000185_discache!DispCreateObjectLru+ba

Followup: MachineOwner
---------