BSOD Problem - Which Dump file to upload?

[sassofalco]

Hello Team,

My treasured soul-companion lives in the UK, and at this stage this is an initial enquiry on her behalf, so that I can advise her on best options. Of course I will be giving her every encouragement to join the happy band at Seven Forums, and I'm certain she will.

I believe that the laptop she's experiencing difficulties with is an Acer Aspire 5733 Core i3 Windows 7 Home Premium (64 bit).

She had experienced a number of instant 'data protection' shut-downs over the past 3 days, however, last evening [about 15 hours ago] a full-on BSOD happened. Prior to the BSOD event happening, she had been working her way through a number of various methods of initial investigation to try and determine where her problems might be, for example Scannow, Check Disk and System Restore etc., but now with the BSOD, it's apparent that more aggressive tactics are needed.

So that I can give advice about the best options open to her, I need to know which of the Dump files types from here is best uploaded to the Forum for evaluation. As I see it, she has a choice of two;

• Small Memory Dump [Minidump] File on BSOD, or
• Kernel Memory Dump File on BSOD

So, which of the above two is preferred?

​

Your assistance will be most appreciated, and any advice passed on.

My treasured soul-companion is slowly but surely harvesting the crop on her head, and I'm not too keen on bald-headed pates .... mine's bad enough. :banghead:

Tony, and the Sepoys

 

[Northernsoul55]

Hi Tony,

You need her to reconfigure windows to collect the correct info.
You want small memory dumps - "MiniDumps" for analysis

:ar:http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html

And here are the instructions for posting:

:ar: http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

   Tip

Ensure you click the "GRAB ALL" button and then wait for each window to appear in turn and then click OK

Hope this answers your query?

Cheers

Dave

 

[sassofalco]

....Soul-companion prepared for next BSOD crash

Thanks Dave,

....for getting back so promptly. Thankfully your links have set out the sequence for links that I had ex-Forum sent my soul-companion. ....that helps to keep the confidence going and augers well for a successful outcome.

She now sits well attired in jodhpurs, boots and crash helmet, waiting for the next BSOD, and will subsequently post here.

Cheers,
Tony

 

[Northernsoul55]

No problem Tony.
Look forward to seeing the "Bolting Horse" (or BSOD if you prefer).

Cheers

Dave

 

[Jayhen93]

Thank you both for your help so far ...

It's something of an anti-climax as each night so far I've sat here with tin hat on waiting for a crash so I have something to upload ... but all has been peaceful and well behaved.

I'll give it one more day, as I'm planning to spend several hours working online tomorrow, and then I'll close the thread.

fingers firmly crossed

N

 

[Northernsoul55]

Hi Nicola,

I would suggest you run the SF Tool and upload here, as reading Tonys post seem like you have experienced a BSOD already, therefore your system should already have the dump files needed to analyse your issue.

You can check this by navigating to:

C:\windows\minidump

It will look something like this:
View attachment 263081
If you see .dmp files then run the SF Tool (Grab All as in my post above).
:ar: http://www.sevenforums.com/tutorials/92394-sf-diagnostic-tool-using-troubleshooting.html
Then you can post them:
:ar: http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html
and I can take a look for you and you can get rid of the Tin Hat.

Cheers

Dave

 

[Jayhen93]

Hi Dave

SF Tool successfully run, I hope, and folder zipped and attached. For good measure I have included the Scannow text file from the third running thereof.

cheers

N

 

[Northernsoul55]

Hi,

The crash dumps didnt throw up a specific driver:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 18, {0, fffffa8009c9c960, 2, ffffffffffffffff}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+48de1 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
STOP 0x00000018: REFERENCE_BY_POINTER

Usual causes: Device driver, kernel, hardware

Please remove Spybot Search and destroy.
Also remove SuperAntiSpyware.
I would suggest uninstalling all McAfee Family Protection programs and McAfee programs
as the the drivers are very old, also you seem to have two firewalls running which may cause conflicts:

McAfee Firewall and Windows Firewall.

Please remove the McAfee Firewall and ensure the Windows one is active.
(It Might be a part of McAfee Family Protection/McAfee)?
:ar: http://service.mcafee.com/faqdocument.aspx?id=TS100686

mfeavfk mfeavfk.sys Wed Dec 09 21:06:32 2009 (4B201158)
mfehidk mfehidk.sys Wed Dec 09 21:04:39 2009 (4B2010E7)
mfenlfk mfenlfk.sys Wed Dec 09 21:05:24 2009 (4B201114)
mfewfpk mfewfpk.sys Wed Dec 09 21:05:04 2009 (4B201100)

Once done please navigate to the driver folder:
C:\windows\system32\drivers and check that the above drivers are not present
if they are right click and delete each one.

Also I would suggest removing Avast:
:ar: http://www.avast.com/uninstall-utility
As an alternative please install:

Microsoft Security Essentials.
Recommended from a strict BSOD perspective, compatibility & stability
compared to other antiviruses/internet security software.
:ar: http://windows.microsoft.com/en-US/windows/security-essentials-download
Once downloaded and updated run a full system scan.

SFC seems to have repaired the files successfully, best to re-check:

Run SFC again to check the integrity of all Windows 7 system files:
Click on the Start > Type in search cmd
Right click cmd at top and Run as Administrator
Type SFC /scannow at the prompt
(Note: there is a space between SFC and /scannow)
:ar: http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Also please Run chkdsk /f/r in an elevated command prompt.
Click on the Start > Type in search cmd
Right click cmd at top and Run as Administrator
At the command prompt please type: chkdsk /f/r
(Note: there is a space between chkdsk and /f/r)
:ar: http://www.sevenforums.com/tutorials/433-disk-check.html

Please ensure you have all the latest Windows updates installed (Look at Optional Updates also)

Free up the startup/Disable Startup Programs:
Click on the Start button
Type msconfig , click the resulting link. It will open the System Configuration window.
Select the “Startup” tab.
Deselect all items other than the antivirus or any other essential items.
Apply > OK
Click the "Services" tab, click the "Hide All Microsoft Services" box, then click Disable All.
Click OK, then restart the computer.

   Note

You can reapply any Start up items needed after the issue has been resolved if you wish

The following drivers Pre-date Windows 7 and need to be updated if possible.
What OS did you have installed Prior to Win 7?
I have linked to the sites that may help, Windows update may help.
Try the Acer site first as it will have a lot of updates needed below, be sure to update:

Chipset/AHCI/AMT drivers/Broadcom/Synaptics.

:ar: http://www.acer.co.uk/ac/en/GB/content/drivers

The website is a tad strange to navigate:
Type "Aspire 5733" into the "Enter a model name" section and click Search,
a pop up will appear for your OS, choose Win 7 64 bit,
then scroll down and the drivers are at the bottom
(Also see BIOS Tab as an Update is available - see below)

Drivers Pre-dating Windows 7:

adpu320.sys
Adaptec .NET Ultra320 Driver
Dated: 28/02/2007
adpahci.sys
Adaptec Windows SATA Storport Driver
Dated: 01/05/2007
adp94xx.sys
Adaptec HostRAID SAS Driver
Dated: Kernel 05/12/2008
arc.sys
Adaptec RAID Storport Driver
Dated: Kernel 24/05/2007

ebdrv Broadcom NetXtreme II Kernel 31/12/2008

lsi_fc.sys
LSI Logic Fusion-MPT FC Driver (StorPort)
Dated: Kernel 09/12/2008
Pages - Find Support By Product
nfrd960.sys
IBM ServeRAID Controller Driver
Dated: Kernel 06/06/2006
IBM Support Portal: Support home
SiSRaid2.sys
SiS RAID Stor Miniport Driver
Dated: Kernel 24/09/2008 19:28:20
sisraid4.sys
SiS AHCI Stor-Miniport Driver
Dated: Kernel 01/10/2008 22:56:04

I also suggest updating your BIOS from the Acer Site as I suspect it will be old
Version 1.10 is the latest, download the .zip file, extract and you want the windows version:

   Warning

Please follow the manufacturer's instructions carefully when updating the BIOS, as incorrectly updated, may render your computer unusable!!

Post back any results/observations
Cheers
Dave

 

[Jayhen93]

Dear Dave

Thank you for such a thorough review. I shall digest it slowly and tackle it properly at the end of the week when I will have more time, and energy!

The only things I can say at this stage is that I bought the Acer, new, just over a year ago, with Windows 7 already loaded so am not aware of its previous; and McAfee was an accident - which I thought I had cleaned up, but obviously not thoroughly enough!

cheers

N

 

[Northernsoul55]

No problem, shout if you hit any snags.

Cheers
Dave

 

[Jayhen93]

Dear Dave

I had hoped to be posting an update with simply a 'no probs' ending, but ...

but first:

I have removed all vestiges of McAfee. As I never installed it, just d/l accidently, I had already used CCleaner to remove the main parts, so used the McAfee consumer Products Removal Tool (MCPR) to clean out the remnants (from: How to uninstall or reinstall supported McAfee products using the Consumer Products Removal tool (MCPR)) Registry checked and nothing McAfee left.

I ran SFC Scannow again, with much the same report as before - something awry with DFDWiz.exe.

I have not replaced my various security programmes, as I have been running them happily for some time and am loathe to switch to something I'm not so familiar with at the moment.

My windows updates are all up to date. The only optional one I am ignoring is the Bing thing, which I do not want. I keep a wary eye on the startup and remove the obvious things that creep in, but I am a bit careful with this now since partially disabling my Citrix set up once by cleaning startup too zealously. I need Citrix functioning for work.

I ran the Acer Update programme that came pre-installed and it found nothing to update

So I was contemplating the list of drivers on the Acer site, and wondering where to put them. For example the Chipset driver listed first on the Acer list doesn't seem to match anything I can see in my Device Manager.

Some of my drivers may be old because I am running a few fairly ancient pieces of hardware, eg Canon ip4200 printer, CanoScan LiDE 50F scanner, and an old wireless HP keyboard (HID keyboard device).

Anyway, I was having a chat about that and other things this morning with the light of my life in QLD, and, as you do, took a wander with him around Japan on google maps when - boof - the lights went out and darkness descended!

No blue screen no alarm bells, just switched off. First such incident since 1st April.

So here is another zip file with stuff. I can't be certain but there does seem to be a relationship between using graphics, eg google maps, picasa, skype and the crashes. I hope maybe there is something more telling in this one.

Kind regards

N

 

[koolkat77]

Start Menu\Programs\Auslogics	Public:Start Menu\Programs\Auslogics	Public
Start Menu\Programs\Auslogics\Disk Defrag	Public:Start Menu\Programs\Auslogics\Disk Defrag	Public
Start Menu\Programs\avast! Free Antivirus	Public:Start Menu\Programs\avast! Free Antivirus	Public
Start Menu\Programs\Spybot - Search & Destroy 2	Public:Start Menu\Programs\Spybot - Search & Destroy 2	Public

So you've been using 2 antivirus software? McAfee and avast! ?

Running multiple AV's can cause stuff such as BSOD. The assumptions you make about your PC and why they're probably wrong

We do not recommend 3rd party Disk defrag software, please uninstall Auslogics software. http://www.sevenforums.com/tutorials/11733-disk-defragmenter-open-use.html

Spybot S&D has issues with windows 7, please remove it as well.

Uninstall the above software this way:

• Download and install Revo Uninstaller free from here: Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

• Opt for "Advanced Mode" and uninstall the software (also delete the leftover registry entries) then, reinstall the latest version available from the mfg website or a good source like filehippo.com

Upload your CBS log following instructions step 4 here: http://www.sevenforums.com/windows-...4840-windows-update-posting-instructions.html

4. Log Collection

The steps that we have done have limited automated fixing capabilities, however they are excellent diagnostic tools and generate very informative logs.
Navigate to the following folder:
C:\Windows\Logs
Right-click and on the CBS folder and select Copy.
Minimise all open windows and right-click on your Desktop, then select Paste.
Right-click on the CBS folder on your Desktop and select Send to > Compressed (zipped) folder.
A file, CBS.zip should appear on your Desktop.

• Heat:

Only use the laptop on a hard surface with nothing blocking any of the vents.

Use a laptop cooling pad if possible

Blow out all vents with canned air (DO NOT use a vacuum cleaner or an air compressor, they can damage the components).

Ensure that the fan comes on and is blowing air out of the vent (may not happen at startup, but should happen after using it for a while).
​

• For monitoring heat of the system, use Speccy or HWMonitor:

Speccy System Information
HWMonitor​

• Post a screen shot using Crystal Disk Info:
  CrystalDiskInfo Standard Edition
• How to Upload and Post a Screenshot and File in Seven Forums

• Make a hard drive test from the hard drive manufacturers website: Hard Drive Diagnostic Procedure

• Keep less stuff at the start-up. Only anti-virus, this helps avoid driver conflicts and improves time to log in to windows.

http://www.sevenforums.com/tutorials/1401-startup-programs-change.html

http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html​

 

[Jayhen93]

Thank you KoolKat

I shall read this carefully and consider when I'm not about to dash out to work.

But for the meantime, herewith CBS log and a screenshot. I'm assuming you wanted the screenshot of the Speccy numbers, if it was something else, please say.

cheers for now

N

 

[NoelDP]

 Line 7459: 2013-04-12 11:22:27, Info                  CSI    000002fd [SR] Beginning Verify and Repair transaction
 Line 7460: 2013-04-12 11:22:27, Info                  CSI    000002fe [SR] Cannot repair member file [l:20{10}]"DFDWiz.exe" of Microsoft-Windows-Disk-Failure-Diagnostic-User-Resolver, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing

I'll post a fix for that error a little later - trying to play catchup at the moment!

 

[koolkat77]

 Line 7459: 2013-04-12 11:22:27, Info                  CSI    000002fd [SR] Beginning Verify and Repair transaction
 Line 7460: 2013-04-12 11:22:27, Info                  CSI    000002fe [SR] Cannot repair member file [l:20{10}]"DFDWiz.exe" of Microsoft-Windows-Disk-Failure-Diagnostic-User-Resolver, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing

I'll post a fix for that error a little later - trying to play catchup at the moment!

@ Noel

@ OP, have you completed all the steps mentioned in my post?

 

[NoelDP]

Thanks for the nudge, KK!
(I spent an hour looking for that post the other night to deal with it - but could I find it?....)

Sorry for the delays....


I've uploaded a file - j93aa.zip - to my SkyDrive at Noel's SkyDrive
Please download and save it.
Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
Close all windows (it would be a good idea to print these instructions!)
Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.
Pick the option to use a Command Prompt
At the prompt type
DIR C:\j93aa
hit the enter key - if you get a 'Not Found' error try
DIR D:\j93aa
or
DIR E:\j93aa

The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...

XCOPY <drive>:\j93aa <drive>:\windows\winsxs /y /i /s /v /h

(e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )

run the command (it should take almost no time)and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.
Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your SkyDrive Public folder, and post a new link
Also run a new MGADiag report, and post the result.