Solved BSOD

[SmurofNeves]

Please id the problem.

 

[Jonathan_King]

If someone feels like running XP dumps, go ahead.

Update or remove Kaspersky: Removal tool for Kaspersky Lab products | Kaspersky Lab United States

Run hardware tests:

SeaTools for Windows | Seagate

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Each of the 3 Prime95 tests: http://www.sevenforums.com/tutorials/100352-cpu-stress-test-prime95.html

 

[SmurofNeves]

Thanks for the reply will do...

 

[SmurofNeves]

I've got another dump on a workstation please have a look...

Looks like klif.sys(Kaspersky) & win32k.sys(no idea)

Please help

 

[Dave76]

Did you follow Jonathan's suggestions?

Did you try to remove Kaspersky?

What were the other test results?

 

[SmurofNeves]

Those are different node's dmp's.. We've got a network going of about 212 machines, using xp & 47 using 7, web filtering using UNTANGLE,mail server,MAN system,SQL SERVER,Intranet sever,ECKO voice server & the Document Server.... All running corporate kaspersky, so for me to uninstall is no option... I can uninstall & re-install but thats that. So what do you think?

These machines have scheduled updates,and I can see via SPICEWORKS when one's updates are not ran or completed.The nodes all seem to be up to date. Its also difficult for me to occupy a node so long running these tests. Have to take the shortest route possible.

 

[Jonathan_King]

Kaspersky is again blamed.

...Summary of the dumps:

[font=lucida console]
Built by: 2600.xpsp_sp3_gdr.101209-1647
Debug session time: Fri May  6 08:54:56.101 2011 (UTC - 4:00)
System Uptime: 0 days 6:56:12.134
Probably caused by : win32k.sys ( win32k!CalcWindowVisRgn+33 )
DEFAULT_BUCKET_ID:  DRIVER_FAULT
BUGCHECK_STR:  0x8E
PROCESS_NAME:  Desktop.exe
FAILURE_BUCKET_ID:  0x8E_win32k!CalcWindowVisRgn+33
BiosReleaseDate = 11/29/2005
SystemProductName =  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 2600.xpsp_sp3_gdr.101209-1647
Debug session time: Tue May  3 02:57:03.935 2011 (UTC - 4:00)
System Uptime: 0 days 1:39:35.668
Probably caused by : win32k.sys ( win32k!_InnerGetClassPtr+18 )
DEFAULT_BUCKET_ID:  DRIVER_FAULT
BUGCHECK_STR:  0x8E
PROCESS_NAME:  explorer.exe
FAILURE_BUCKET_ID:  0x8E_win32k!_InnerGetClassPtr+18
BiosReleaseDate = 11/29/2005
SystemProductName =  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 2600.xpsp_sp3_gdr.101209-1647
Debug session time: Fri Apr 29 04:01:39.054 2011 (UTC - 4:00)
System Uptime: 0 days 2:02:08.325
Probably caused by : win32k.sys ( win32k!HeavyFreePool+bb )
DEFAULT_BUCKET_ID:  DRIVER_FAULT
BUGCHECK_STR:  0x8E
PROCESS_NAME:  OUTLOOK.EXE
FAILURE_BUCKET_ID:  0x8E_win32k!HeavyFreePool+bb
BiosReleaseDate = 11/29/2005
SystemProductName =  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 2600.xpsp_sp3_gdr.101209-1647
Debug session time: Thu Apr 28 04:28:40.961 2011 (UTC - 4:00)
System Uptime: 0 days 0:17:59.569
Probably caused by : ntkrnlpa.exe ( nt!KiTrap0E+cc )
DEFAULT_BUCKET_ID:  DRIVER_FAULT
BUGCHECK_STR:  0xFC
PROCESS_NAME:  explorer.exe
FAILURE_BUCKET_ID:  0xFC_nt!KiTrap0E+cc
BiosReleaseDate = 11/29/2005
SystemProductName =  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 2600.xpsp_sp3_gdr.101209-1647
Debug session time: Mon Apr 11 06:40:55.706 2011 (UTC - 4:00)
System Uptime: 0 days 4:44:22.234
*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys
Probably caused by : klif.sys ( klif+d054 )
DEFAULT_BUCKET_ID:  DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  explorer.exe
FAILURE_BUCKET_ID:  0x50_klif+d054
BiosReleaseDate = 11/29/2005
SystemProductName =  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 2600.xpsp_sp3_gdr.101209-1647
Debug session time: Mon Mar 28 07:21:42.229 2011 (UTC - 4:00)
System Uptime: 0 days 5:59:43.471
Probably caused by : ntkrnlpa.exe ( nt!RtlpInterlockedPopEntrySList+3 )
DEFAULT_BUCKET_ID:  DRIVER_FAULT
BUGCHECK_STR:  0x8E
PROCESS_NAME:  winlogon.exe
FAILURE_BUCKET_ID:  0x8E_nt!RtlpInterlockedPopEntrySList+3
BiosReleaseDate = 11/29/2005
SystemProductName =  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 2600.xpsp_sp3_gdr.101209-1647
Debug session time: Fri Mar 25 03:17:28.050 2011 (UTC - 4:00)
System Uptime: 0 days 1:27:23.677
*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for fltMgr.sys - 
Probably caused by : klif.sys ( klif+6c89 )
DEFAULT_BUCKET_ID:  DRIVER_FAULT
BUGCHECK_STR:  0x8E
PROCESS_NAME:  avp.exe
FAILURE_BUCKET_ID:  0x8E_klif+6c89
BiosReleaseDate = 11/29/2005
SystemProductName =  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 2600.xpsp_sp3_gdr.101209-1647
Debug session time: Thu Mar 17 04:20:02.918 2011 (UTC - 4:00)
System Uptime: 0 days 2:24:56.333
Probably caused by : memory_corruption ( nt!MmZeroPageThread+123 )
BUGCHECK_STR:  0x4E_8f
DEFAULT_BUCKET_ID:  DRIVER_FAULT
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  0x4E_8f_nt!MmZeroPageThread+123
BiosReleaseDate = 11/29/2005
SystemProductName =  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 2600.xpsp_sp3_gdr.101209-1647
Debug session time: Thu Mar  3 05:29:01.714 2011 (UTC - 4:00)
System Uptime: 0 days 0:03:52.400
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for win32k.sys - 
*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys
Probably caused by : klif.sys ( klif+26e8b )
DEFAULT_BUCKET_ID:  DRIVER_FAULT
BUGCHECK_STR:  0xA
PROCESS_NAME:  csrss.exe
FAILURE_BUCKET_ID:  0xA_klif+26e8b
BiosReleaseDate = 11/29/2005
SystemProductName =  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  
[/font]

 

[yowanvista]

Please upgrade to the latest version of kaspersky, the older ones have known causes of BSODs with Windows 7
Product Updates

 

[SmurofNeves]

Yowan, the installed version is the latest one on their site (ver:6.0.4.1424) for workstations... I've updated the NT server to the new ver...Aswell as the AdministrationKit on our TECH-server got a new ver... Uninstalled Kaspersky using their latest removel tool.

BUT

now re-installing the product is the issue... The server says that the product is already installed. So I removed the NET AGENT aswell and rebooted but to no avail. So then I used REGEDIT and still found KASPERSKY entry's, I removed these manually and ran the Remover tool again. Restarted but still the installation claims that kaspersky is still aboard.We've got the older remover tool aswell and tried using that but the remover errors out saying there are no kaspersky anti-virus installed.

What to do,what to do?

Please assist.:huh:

 

[Jonathan_King]

Run: Removal tool for Kaspersky Lab products | Kaspersky Lab United States

 

[SmurofNeves]

Thats the one I ran...Same site(Original product site) as Yowan provided.

I'll upload the txt. as a result... It shows errors

 

[SmurofNeves]

Have a look

 

[SmurofNeves]

Busy updating the AdministrationKit on the main server, will give it a go again after the update. But can someone please tell me what is the 64bit doing in the txt. I've got no idea what that says.

The removel tool I'm running here is ver: 1.0.171

 

[Jonathan_King]

I am not familiar with the Kaspersky install process, but might I suggest trying the "Repair" option instead of "Install"?

 

[SmurofNeves]

Thanks for all the help guys, I got it sorted. Theres a setting on the server saying don't install if previous software is detected, I unticked it and it overwrote the current installation. But what I don't get is why the removeltool didn't remove all reg entries. The update on the AdministrationKit is major. Thanks again for all your help.

 

[SmurofNeves]

This is solved.