BSOD while running Driver Verifier, probable reason netbt.sys

[didoto]

Hello,

I have been experiencing lots of BSODs lately, all at random and all showing different reasons.

At first, I thought that I had a memory problem - so, I removed one of the RAM modules and the laptop worked OK for a few days. However, today the BSODs started again.

I ran Driver Verifier for a few hours and started getting BSOD after BSOD.

I checked the minidump and (from what I saw), the reason is probably netbt.sys:

==================================================
Dump File : 071912-64475-01.dmp
Crash Time : 7/19/2012 1:34:55 PM
Bug Check String : DRIVER_CORRUPTED_EXPOOL
Bug Check Code : 0x000000c5
Parameter 1 : fffffa80`29e73608
Parameter 2 : 00000000`00000002
Parameter 3 : 00000000`00000001
Parameter 4 : fffff800`027b690d
Caused By Driver : netbt.sys
Caused By Address : netbt.sys+288bf608
File Description :
Product Name :
Company :
File Version :
Processor : x64
Crash Address : ntoskrnl.exe+70040
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump1\071912-64475-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 7600
Dump File Size : 301,811
==================================================

Before running Driver Verifier, I was getting a BAD_POOL_HEADER 0x19 BSODs.

I'm running Windows Home Premium x64 on a Toshiba Qosmio X500 laptop. The OS is OEM.

I have also attached the jcgriff + perfmon reports and the minidump txt export (just in case).

Thanks in advance for all the help you can provide me with

 

[HonorGamer]

I am not seeing the .dmp files in the files you have attached. Please attach that file also.

 

[didoto]

I apologize, I zipped it and attached it now.

 

[HonorGamer]

Try and update your Drivers - Download NVIDIA Drivers

Do you a Fingerprint USB device?

If so try removing that and uninstalling the drivers for it.

 

[HonorGamer]

Also do a windows update, and make sure you have the latest updates.

 

[didoto]

Yes, I have the fingerprint device, will remove it.

Windows is getting regularly updated, so this shouldn't be a problem.

Do you think that netbt.sys has actually something to do with the problem or it's more like a coincidence (or a false alarm)?

 

[HonorGamer]

Sometimes when a crash dump says: "probably caused by: (such an such file)" it isn't it. Just depends, but we are eliminating every possiblity so we can figure this out. I am actually new to BSOD analyzing so as we go I'm learning also.

Also try updating your Intel Storage Drivers

and Intel Processor drivers

And let me know from there.

 

[didoto]

Will do that now.

In the meantime, another BSOD happened - this time for a completely different reason.

I was in Safe mode, running a scan with MS Security Essentials (just in case).

I have attached the new minidump as well - might be helpful.

Thanks!

==================================================
Dump File : 071912-17877-01.dmp
Crash Time : 7/19/2012 3:35:19 PM
Bug Check String : SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000007e
Parameter 1 : ffffffff`c0000005
Parameter 2 : fffff800`027bf07a
Parameter 3 : fffff880`02389828
Parameter 4 : fffff880`02389090
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+1a307a
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7600.17017 (win7_gdr.120503-2030)
Processor : x64
Crash Address : ntoskrnl.exe+1a307a
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump1\071912-17877-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 7600
Dump File Size : 270,627
==================================================

 

[HonorGamer]

This could be a hardware problem.

Try these following things and post back results:

CHKDSK /R /F:
Run CHKDSK /R /F from an elevated (Run as adminstrator) Command Prompt. Please do this for each hard drive on your system.
When it tells you it can't do it right now - and asks you if you'd like to do it at the next reboot - answer Y (for Yes) and press Enter. Then reboot and let the test run. It may take a while for it to run, but keep an occasional eye on it to see if it generates any errors. See "CHKDSK LogFile" below in order to check the results of the test.

Elevated Command Prompt:
Go to Start and type in "cmd.exe" (without the quotes)
At the top of the Search Box, right click on Cmd.exe and select "Run as administrator"

CHKDSK LogFile:
Go to Start and type in "eventvwr.msc" (without the quotes) and press Enter
Expand the Windows logs heading, then select the Application log file entry.
Double click on the Source column header.
Scroll down the list until you find the Chkdsk entry (wininit for Windows 7) (winlogon for XP).
Copy/paste the results into your next post.

 

[HonorGamer]

Also, please do a full virus scan either using avast! Free Antivirus | Download Antivirus Protection Software or Microsoft Security Essentials - Free Antivirus for Windows .

Then use Malwarebytes : Free anti-malware download to do a complete scan

Also remove ALL programs associated with Daemon Tools. They could be one cause of it.

 

[didoto]

Here's the result from CHKDSK on drive C: (the CHKDSK on D: is currently running but since the OS is on C:, maybe D: is not that important):

　
Checking file system on C:
The type of the file system is NTFS.
Volume label is WINDOWS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
443648 file records processed. File verification completed.
3276 large file records processed. 0 bad file records processed. 0 EA records processed. 76 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
562180 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
443648 file SDs/SIDs processed. Cleaning up 261 unused index entries from index $SII of file 0x9.
Cleaning up 261 unused index entries from index $SDH of file 0x9.
Cleaning up 261 unused security descriptors.
Security descriptor verification completed.
59267 data files processed. CHKDSK is verifying Usn Journal...
34213448 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
443632 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
4507093 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.
77941076 KB total disk space.
59234300 KB in 213144 files.
130592 KB in 59268 indexes.
0 KB in bad sectors.
547812 KB in use by the system.
65536 KB occupied by the log file.
18028372 KB available on disk.
4096 bytes in each allocation unit.
19485269 total allocation units on disk.
4507093 allocation units available on disk.
Internal Info:
00 c5 06 00 27 28 04 00 e9 62 07 00 00 00 00 00 ....'(...b......
08 05 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 ....L...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.


Regarding the scans - I have scanned the laptop with both Security Essentials and Malwarebytes, there were indeed a few Trojans but they were removed successfully.

 

[HonorGamer]

Its possible that your MSE is corrupt so uninstall and download a fresh copy: Microsoft Security Essentials - Free Antivirus for Windows

And Make sure you uninstalled all of the Daemon Tools programs on your computer, They are known for causing BSODs

 

[didoto]

Daemon Tools have been removed will download MSE again and report the results.

Once again, thanks for the help

 

[HonorGamer]

Your welcome!

And just be on the safe side Run a http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Afterwards use your computer like normal, and if another BSOD happens post back in this thread.

 

[didoto]

I have used Memtest already - no errors was shown.

2 mins ago, I got another BSOD - 0x1E - this happened while I was in the middle of a full scan with MSE.

Running the scan again now.

Judging from your experience and knowledge, would you think it's more of a hardware problem than a software one (driver, malware, etc)?

I'm a bit at a loss because I don't know whether to try reinstalling Windows or get a new laptop.

I use the machine for work purposes and I can't afford to be delayed any longer...

 

[HonorGamer]

Well for now just post up the .dmp file and i will give it another shot on what the problem is.

 

[didoto]

That's another problem which I forgot to mention - in more than 50% of the cases when a BSOD happens, there's no minidump file. The system just stucks at a message like "Initializing hard drive for a system dump" (or something like that, I'm quoting by memory) and that's it. When I reboot and check the minidump folder, there's no dump from the latest BSOD...

 

[HonorGamer]

That's odd. Well I am going back over the other files to find stuff that i missed. I will post back ASAP.

 

[HonorGamer]

Update your Nvidia drivers also: Drivers - Download NVIDIA Drivers

 

[didoto]

Will update the Nvidia drivers too.

Full MSE scan ended - it found a few threats which were successfully removed. Not sure if they were real or not because all were in the /sun/java/deployment folder... Maybe it was a false alarm. Anyway, MSE cleaned everything.