BSOD twice upon waking- code 0x3B on win7 64 bit retail.

[maskedmuffin]

Hi there:

I received a couple of BSOD screens when walking up from sleep over last few days, and decided to do some digging around in this forum.

I am a neophyte at windows debugging, installed the windbg/symbols and ran it to get pertinent stats out of the minidump generated from BSOD. I also turned on driver verifier so remains to be seen what future potential BSOD will reveal.

This is windows 7 x64 full retail on a p6x58d premium board system built in jan 2010, 6gb of memory running at 1033mhz and geforce gtx 470, operating on hardware raid (mirror) using intel raid controller and 2 wd blue hard drives (and a couple of ssds not pertinent to the windows installation). Rapid storage tech from intel indicates that both hard drives can be verified following the bsod and checkdisk. I had installed the OS in december 2011 after setting up new RAID.

The BSOD just started recently; i thought i might have been the new bitcasa service that i got invite for creating unlimited "cloud" storage in mydocuments, so i unlinked the service from my system, and bsod still happened

I have also attached a screenshot of the dmp screen analysis from bluescreenview apart from the zip file indicating that ntfs.sys and ntoskrnl.exe both failed
bugcheckcode is 0x3b

Any assistance would be greatly appreciated!

 

[writhziden]

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [H:\BSODDmpFiles\maskedmuffin\012612-34413-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03051000 PsLoadedModuleList = 0xfffff800`03296670
Debug session time: Thu Jan 26 05:51:07.788 2012 (UTC - 7:00)
System Uptime: 0 days 16:51:03.834
Loading Kernel Symbols
...............................................................
................................................................
.................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff800033cc238, fffff8800f8f3d50, 0}

Probably caused by : ntkrnlmp.exe ( nt!IopParseDevice+848 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800033cc238, Address of the instruction which caused the bugcheck
Arg3: fffff8800f8f3d50, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!IopParseDevice+848
fffff800`033cc238 4983781800      cmp     qword ptr [r8+18h],0

CONTEXT:  fffff8800f8f3d50 -- (.cxr 0xfffff8800f8f3d50)
rax=0000000000000000 rbx=0000000000000005 rcx=0000000000000000
rdx=0000000000000000 rsi=fffffa800bae79c0 rdi=fffffa800cedf630
rip=fffff800033cc238 rsp=fffff8800f8f4730 rbp=fffffa800db31cc8
 r8=0000000100000001  r9=0000000000000000 r10=fffffa800b8f0580
r11=fffff8800f8f48b8 r12=fffffa800b8f0580 r13=0000000000100080
r14=fffffa800db31b10 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!IopParseDevice+0x848:
fffff800`033cc238 4983781800      cmp     qword ptr [r8+18h],0 ds:002b:00000001`00000019=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff800033cc238

STACK_TEXT:  
fffff880`0f8f4730 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopParseDevice+0x848


FOLLOWUP_IP: 
nt!IopParseDevice+848
fffff800`033cc238 4983781800      cmp     qword ptr [r8+18h],0

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!IopParseDevice+848

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

STACK_COMMAND:  .cxr 0xfffff8800f8f3d50 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!IopParseDevice+848

BUCKET_ID:  X64_0x3B_nt!IopParseDevice+848

Followup: MachineOwner
---------

Possible causes are Memory problems... Corrupted hard disk system files... Corrupted System Files... Graphics Driver...
Thanks to Dave76 for help understanding possible causes.



While a .dmp file is useful, the other files generated by the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html provide a lot more information to allow us to better assist you.



Do the following steps and test after each to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

• If you are overclocking anything, please stop.
  
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
  
  
• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html
  
  
  
• Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors. Post back if it continues to show errors after the third run or if the first run comes back with no integrity violations.
  
  
  
• Re-install or install the latest driver for your display card using the following steps.
  
  1. Download the latest drivers for your display card(s)
  2. Click Start Menu
  3. Right Click My Computer/Computer
  4. Click Manage
  5. Click Device Manager from the list on the left
  6. Expand Display adapters
  7. Do the following for each adapter (in case you have multiple display cards)
     • Right click the adapter
     • Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
     • Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
  8. Restart your computer after uninstalling drivers for all display cards
  9. Install the latest driver for the display cards once Windows starts
  
  Alternatively:
  1. Login as an adminstrative user
  2. Download the latest drivers for your display card(s)
  3. Click Start Menu
  4. Click Control Panel
  5. Click Hardware and Sound
  6. Click Device Manager (the last link under Devices and Printers)
  7. Expand Display adapters
  8. Do the following for each adapter (in case you have multiple display cards)
     • Right click the adapter
     • Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
     • Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
  9. Restart your computer after uninstalling drivers for all display cards
  10. Install the latest driver for the display cards once Windows starts

 

[maskedmuffin]

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [H:\BSODDmpFiles\maskedmuffin\012612-34413-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03051000 PsLoadedModuleList = 0xfffff800`03296670
Debug session time: Thu Jan 26 05:51:07.788 2012 (UTC - 7:00)
System Uptime: 0 days 16:51:03.834
Loading Kernel Symbols
...............................................................
................................................................
.................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff800033cc238, fffff8800f8f3d50, 0}

Probably caused by : ntkrnlmp.exe ( nt!IopParseDevice+848 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800033cc238, Address of the instruction which caused the bugcheck
Arg3: fffff8800f8f3d50, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!IopParseDevice+848
fffff800`033cc238 4983781800      cmp     qword ptr [r8+18h],0

CONTEXT:  fffff8800f8f3d50 -- (.cxr 0xfffff8800f8f3d50)
rax=0000000000000000 rbx=0000000000000005 rcx=0000000000000000
rdx=0000000000000000 rsi=fffffa800bae79c0 rdi=fffffa800cedf630
rip=fffff800033cc238 rsp=fffff8800f8f4730 rbp=fffffa800db31cc8
 r8=0000000100000001  r9=0000000000000000 r10=fffffa800b8f0580
r11=fffff8800f8f48b8 r12=fffffa800b8f0580 r13=0000000000100080
r14=fffffa800db31b10 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!IopParseDevice+0x848:
fffff800`033cc238 4983781800      cmp     qword ptr [r8+18h],0 ds:002b:00000001`00000019=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff800033cc238

STACK_TEXT:  
fffff880`0f8f4730 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopParseDevice+0x848


FOLLOWUP_IP: 
nt!IopParseDevice+848
fffff800`033cc238 4983781800      cmp     qword ptr [r8+18h],0

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!IopParseDevice+848

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

STACK_COMMAND:  .cxr 0xfffff8800f8f3d50 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!IopParseDevice+848

BUCKET_ID:  X64_0x3B_nt!IopParseDevice+848

Followup: MachineOwner
---------

Possible causes are Memory problems... Corrupted hard disk system files... Corrupted System Files... Graphics Driver...
Thanks to Dave76 for help understanding possible causes.



While a .dmp file is useful, the other files generated by the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html provide a lot more information to allow us to better assist you.



Do the following steps and test after each to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

• If you are overclocking anything, please stop.
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html
• Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors. Post back if it continues to show errors after the third run or if the first run comes back with no integrity violations.
• Re-install or install the latest driver for your display card using the following steps.
  1. Download the latest drivers for your display card(s)
  2. Click Start Menu
  3. Right Click My Computer/Computer
  4. Click Manage
  5. Click Device Manager from the list on the left
  6. Expand Display adapters
  7. Do the following for each adapter (in case you have multiple display cards)
     • Right click the adapter
     • Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
     • Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
  8. Restart your computer after uninstalling drivers for all display cards
  9. Install the latest driver for the display cards once Windows starts
  
  Alternatively:
  1. Login as an adminstrative user
  2. Download the latest drivers for your display card(s)
  3. Click Start Menu
  4. Click Control Panel
  5. Click Hardware and Sound
  6. Click Device Manager (the last link under Devices and Printers)
  7. Expand Display adapters
  8. Do the following for each adapter (in case you have multiple display cards)
     • Right click the adapter
     • Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
     • Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
  9. Restart your computer after uninstalling drivers for all display cards
  10. Install the latest driver for the display cards once Windows starts

thank you writhziden for this comprehensive writeup.

I just logged in via my asus expressgate on my p6x58d, because after i posted this last night i had rebooted and before booting into windows i got a really quick flash of a BSOD before it rebooted.
I then used my win7 cd to get into recovery console, where it tried to use startup fixer to fix the errors, and then upon rebooting automatically it once again gave me this really quick flash of BSOD

Is there any way i can harness his BSOD that occurs right after the "windows loading" splash screen occurs? Something perhaps in the bios i can change? i have that p6x58d premium as mentioned.

It now appears i am unable to login to windows, when before it was just 2 intermittent BSODs! This going to make troubleshooting much more difficult.
I do have ulimtate bootcd on a mem stick and cd, so perhaps i could run the memtest from it no?

I have a hunch that my mbr might have gotten messed up, but it *boggles* my mind how this could happen when i have hardware raid setup through the ICH raid controller! I mean wouldnt windows 7 when hitting that "repair and recovery" console try to simply repair any bad system files and/or partition MBR by loading off of the mirrored hard drive?! Isnt that what the entire purpose of mirroring is!?

What i really would like to be able to perform is load into the recovery console and pick out a prior recovery state, from say 1/24 (2 days ago, before i noticed the 2 BSODS) and load that into my computer. It wont even let me do that! Instead when i run the win7 repair cd it automatically tries to run a repair, and then prompt for reboot.

 

[maskedmuffin]

Okay i was able to figure out what the bsod was by using the f8 key when win7 was attempting to boot

file
\boot\bcd

status 0x000000f
info: error occurred when attempting to read boot config


I ran bcd rebuild in windows RC in following manner

{
bcdedit /export c:bcd_backup #to backup prior to making changes
c:
cd boot
attrib bcd -s -h -r
ren \boot\bcd bcd.old
bootrec /rebuildbcd

}
and when i next rebooted i ensured to hit f8 so i could disable the "reboot" upon critical error:

this is what i found

STOP: 0x0000001e,(0xFFFFFFFFC0000005,0xFFFFF80003096356,0X0000000000000000,0X0000000000000000)

so we are back to that dreaded stop error

 

[writhziden]

If you use the http://www.sevenforums.com/tutorials/666-advanced-boot-options.html, can you get into the http://www.sevenforums.com/tutorials/668-system-recovery-options.html by selecting Repair Your Computer?

 

[maskedmuffin]

If you use the http://www.sevenforums.com/tutorials...t-options.html, can you get into the http://www.sevenforums.com/tutorials...y-options.html by selecting Repair Your Computer?

yes; i just booted into safe mode and apparently it rolled back to a state mid afternoon yesterday before these issues began.

I just set advanced system settings under startup and recovery to *not* automatically restart on system failure.

i will try to work on getting some of those zip files you requested up.

in the interim; i ran system file checker 3 times -> no integrity issues

i am now going to set the computer to run disk checker as you recommended
i will follow up with the memtest86 using ultimate bootcd

regarding my graphics drivers, they are the latest for the gtx 470
8.17.12.8562 is what it says in safe mode (unfortunately unable to bring up the nvidia control panel in this mode, however these drivers translate to the geforce 285.62 driver listed @ NVIDIA DRIVERS 285.62 WHQL

 

[writhziden]

You still may want to re-install the latest graphics drivers after doing the tests and disk check. The disk check is probably most important to being able to run Windows at the moment. You will want to repeat any disk checks that come back saying that Windows made changes to the file system. Repeat until it finds no problems with the file system.

If you still are unable to boot Windows normally at that point, uninstall your display/graphics card driver and try to start in normal mode. Then install the latest driver for it. The display card driver may be corrupt and causing conflicts with the system.

 

[maskedmuffin]

You still may want to re-install the latest graphics drivers after doing the tests and disk check. The disk check is probably most important to being able to run Windows at the moment. You will want to repeat any disk checks that come back saying that Windows made changes to the file system. Repeat until it finds no problems with the file system.

If you still are unable to boot Windows normally at that point, uninstall your display/graphics card driver and try to start in normal mode. Then install the latest driver for it. The display card driver may be corrupt and causing conflicts with the system.

thanks writhziden for continued support.

I ran chkdisk /f last night following reboot from safe mode, no issues detected over night

i enabled driver verifier after it rebooted back into safe mode.

Then it tried to boot in normal mode with selective startup enabled , disabling problem programs.

came across this error:

"bad pool caller"
stop: 0x000000c2
(0x0000000000000009d, 0x0000000000000419,0x0000000000000000, 0xfffff880021653F0)
driver: smartdefragdriver.sys

this seems to indicate iobit's smart defrag, which i had running (even w/ selective startup).
this program has been running in background optimizing my raid volume since new OS installation a month back, with nary a problem.
The two BSOD that i noticed precipitating these problems were pointing to ntfs.sys and ntoskml.exe if i recall correctly (see originating post), however ntfs certainly could be pointing to the file system, which defrag works on correcT?

next step: i will try to get back into safe mode and somehow disable smartdefrag software and/or uninstall

if anyone else has suggestions on this particular issue would be all ears as well!

 

[writhziden]

It is common for third party defrag tools to cause NTFS.SYS related crashes. I would recommend removing smart defrag at least for testing purposes.

 

[maskedmuffin]

It is common for third party defrag tools to cause NTFS.SYS related crashes. I would recommend removing smart defrag at least for testing purposes.

i removed iobit smartdefrag and rebooted
this time the computer booted properly

i then was able to load intel matrix software which handles the RAID info, and i wanted to *verify* my 2 drives on the single win7 raid volume, clicked verify..and *poof* i got that stop error again, the kernel one (INVALID_KERNEL_HANDLE (93)):

This time i attached the minidump file, which outlines that "kernexplorer64.sys"was potential culprit

this seemingly points to ad-aware, which i also had installed

*sigh*..so now i will uninstall adaware..why do i get the feeling that one after the other it is going to prompt me to uninstall all software (avg, visual studio 2010, etc) thati have on my computer?

I was trying to verify my raid drive when the bsod occurred so that, following the verification, which takes a few hours, i could then create a restore point from there that i could easily restore into (as you know it is not possible to create restore points in safe mode)

by the way, my memory diagnostic tool which i ran this afternoon came back peachy, no issues.

attached is the zipped dmp file:
below is the readout from windbg in copy-paste format
-----------------------------------------------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\012812-34320-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols2*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0300b000 PsLoadedModuleList = 0xfffff800`03250670
Debug session time: Sat Jan 28 20:57:23.506 2012 (UTC - 8:00)
System Uptime: 0 days 0:09:51.552
Loading Kernel Symbols
...............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 93, {363c, fffff8a000001630, fffff8a0094088f0, 1}

Unable to load image \??\C:\Program Files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for KernExplorer64.sys
*** ERROR: Module load completed but symbols could not be loaded for KernExplorer64.sys
Probably caused by : KernExplorer64.sys ( KernExplorer64+1277 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

INVALID_KERNEL_HANDLE (93)
This message occurs if kernel code (server, redirector, other driver, etc.)
attempts to close a handle that is not a valid handle.
Arguments:
Arg1: 000000000000363c, The handle that NtClose was called with.
Arg2: fffff8a000001630,
Arg3: fffff8a0094088f0
Arg4: 0000000000000001

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR: 0x93

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff800032df3b3 to fffff80003087c40

STACK_TEXT:
fffff880`0cb2b7c8 fffff800`032df3b3 : 00000000`00000093 00000000`0000363c fffff8a0`00001630 fffff8a0`094088f0 : nt!KeBugCheckEx
fffff880`0cb2b7d0 fffff800`03362375 : 00000000`00000000 fffffa80`00000000 00000000`00000000 fffff880`0b47db00 : nt! ?? ::NNGAKEGL::`string'+0x21481
fffff880`0cb2b8a0 fffff880`0b47d277 : fffffa80`054ecb30 00000000`c00000bb fffffa80`06767010 00000000`00000000 : nt!ObReferenceObjectByHandle+0x25
fffff880`0cb2b8f0 fffffa80`054ecb30 : 00000000`c00000bb fffffa80`06767010 00000000`00000000 fffff880`0cb2b9b0 : KernExplorer64+0x1277
fffff880`0cb2b8f8 00000000`c00000bb : fffffa80`06767010 00000000`00000000 fffff880`0cb2b9b0 fffff880`0cb2b9c0 : 0xfffffa80`054ecb30
fffff880`0cb2b900 fffffa80`06767010 : 00000000`00000000 fffff880`0cb2b9b0 fffff880`0cb2b9c0 fffff980`21562ff8 : 0xc00000bb
fffff880`0cb2b908 00000000`00000000 : fffff880`0cb2b9b0 fffff880`0cb2b9c0 fffff980`21562ff8 00000000`00000000 : 0xfffffa80`06767010


STACK_COMMAND: kb

FOLLOWUP_IP:
KernExplorer64+1277
fffff880`0b47d277 ?? ???

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: KernExplorer64+1277

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: KernExplorer64

IMAGE_NAME: KernExplorer64.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4d4abb8a

FAILURE_BUCKET_ID: X64_0x93_VRF_KernExplorer64+1277

BUCKET_ID: X64_0x93_VRF_KernExplorer64+1277

Followup: MachineOwner
---------

 

[writhziden]

Good step to remove ad-aware. AVG is also known to cause blue screen crashes on some systems, so I would not be surprised if that does need to be removed at some point in the future. Do not worry about it yet unless you already removed it. If you do remove it at some point, use the AVG Remover and replace the software with Microsoft Security Essentials - Free Antivirus for Windows to run with Windows firewall.

 

[maskedmuffin]

Good step to remove ad-aware. AVG is also known to cause blue screen crashes on some systems, so I would not be surprised if that does need to be removed at some point in the future. Do not worry about it yet unless you already removed it. If you do remove it at some point, use the AVG Remover and replace the software with Microsoft Security Essentials - Free Antivirus for Windows to run with Windows firewall.

thanks for the tip on the official avg remover. using the uninstaller left so many links splayed across my computer, i dont know what i would have done without an official uninstaller.

Over the last 24 hours I was able to get into my computer through restore, then remove the smartdefrag/avg/ad-aware , ensure that only the most essential services i use startup through msconfig options, and then update my computer's security via MSE and windows update.

Now i have just completed creating a manual restore point going forward.

shall monitor the BSODs going forward.

 

[writhziden]

Good idea to create a restore point. Let us know if you need any further help or you need us to analyze a set of crash files.