Help with Bsod please!!

[jpwwong]

Hi all tech gurus,

I have given up on trying to debug this BSOD myself and am pleading with you guys to provide abit of insight into my system errors!

The BSOD are getting more and more frequent and I don't know what I have done to cause it. I've done a general stress test on my pc (newly built 2 months ago) but have yet to test out memory and GPU so it might be the problem although I think it has something to do with the drivers instead!

I've attached my dump files here, seems like there are a bunch of 'likely causes' as picked up by my dump analyzer.

Any help would be muchly appreciated. Thanks guys.

 

[richc46]

I have reviewed your dump files, it appears that the probable cause is ntkrnlmp.exe.
To be put simply a driver problem.
fffff880`0831a000 fffff880`08325000 secdrv secdrv.SYS Wed Sep 2006
All of your drivers seem to be fairly current except for the above, and it should be replaced.
In addition you should run the driver verifier to learn if any other drivers are potential problems.
http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html
When done run an antivirus scan
In an elevated cmd prompt type sfc /scannow, to correct any corruption.

 Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
Loading Dump File [C:\Users\richc46\AppData\Local\Temp\Temp1_dump%20files[1].zip\060810-36239-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e1d000 PsLoadedModuleList = 0xfffff800`0305ae50
Debug session time: Tue Jun  8 05:27:06.765 2010 (GMT-4)
System Uptime: 0 days 2:01:56.201
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41790, fffffa80012ded50, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa80012ded50
Arg3: 000000000000ffff
Arg4: 0000000000000000
Debugging Details:
------------------
 
BUGCHECK_STR:  0x1a_41790
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  CCC.exe
CURRENT_IRQL:  0
LAST_CONTROL_TRANSFER:  from fffff80002f00ede to fffff80002e8d600
STACK_TEXT:  
fffff880`0ba2df38 fffff800`02f00ede : 00000000`0000001a 00000000`00041790 fffffa80`012ded50 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0ba2df40 fffff800`02ec0cc9 : fffffa80`00000000 000007fe`ee914fff 00000000`00000000 fffff800`0301c888 : nt! ?? ::FNODOBFM::`string'+0x33946
fffff880`0ba2e100 fffff800`02e60734 : ffffffff`ffffffff fffff880`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`0ba2e220 fffff800`03173c4f : fffff8a0`0c24aa50 fffff880`0ba2e520 00000000`00000000 fffffa80`08026b60 : nt!MmCleanProcessAddressSpace+0x228
fffff880`0ba2e270 fffff800`0314c4d1 : 00000000`40010004 fffff880`0ba2e501 000007ff`fff06000 00000000`00000000 : nt!PspExitThread+0x92f
fffff880`0ba2e330 fffff800`02e6a0e3 : 00000000`00000000 fffff800`0318e24f 00000000`00010002 fffff8a0`04425d88 : nt!PsExitSpecialApc+0x1d
fffff880`0ba2e360 fffff800`02e6a520 : 00000000`00000000 fffff880`0ba2e3e0 fffff800`0314c5dc 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`0ba2e3e0 fffff800`02e8c8f7 : 00000000`00000000 000007fe`f21c4650 00000000`02504b01 00000000`1bdfd8d0 : nt!KiInitiateUserApc+0x70
fffff880`0ba2e520 00000000`76d1fdd6 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`1bdfe930 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d1fdd6
 
STACK_COMMAND:  kb
FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+33946
fffff800`02f00ede cc              int     3
SYMBOL_STACK_INDEX:  1
SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+33946
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
IMAGE_NAME:  ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb
FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33946
BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33946
Followup: MachineOwner
---------
2: kd> lmtsmn
start             end                 module name
fffff880`0117b000 fffff880`011d2000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`04174000 fffff880`041fe000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04a55000 fffff880`04a6b000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`00e2a000 fffff880`00e35000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`00fd5000 fffff880`00fde000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00e00000 fffff880`00e2a000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`04400000 fffff880`04422000   AtiHdmi  AtiHdmi.sys  Thu Jan 28 20:03:36 2010 (4B6233E8)
fffff880`0476f000 fffff880`047a3000   atikmpag atikmpag.sys Tue Mar 02 22:07:33 2010 (4B8DD275)
fffff880`04ab6000 fffff880`05125000   atipmdag atipmdag.sys Tue Mar 02 22:47:08 2010 (4B8DDBBC)
fffff880`04a00000 fffff880`04a45000   auf6hyqg auf6hyqg.SYS Tue Jul 14 17:12:55 2009 (4A5CF4D7)
fffff880`02e09000 fffff880`02e10000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`0468a000 fffff880`04733000   BHDrvx64 BHDrvx64.sys Fri Apr 23 19:37:13 2010 (4BD22F29)
fffff880`0457e000 fffff880`0458f000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`06ed9000 fffff880`06ef7000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff880`044e2000 fffff880`0457e000   ccHPx64  ccHPx64.sys  Fri Feb 05 16:05:45 2010 (4B6C8829)
fffff960`006c0000 fffff960`006e7000   cdd      cdd.dll      Mon Jul 13 21:25:40 2009 (4A5BDE94)
fffff880`06cd7000 fffff880`06cf4000   cdfs     cdfs.sys     Mon Jul 13 19:19:46 2009 (4A5BC112)
fffff880`01ab9000 fffff880`01ae3000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00d06000 fffff880`00dc6000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`01a53000 fffff880`01a83000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00ca8000 fffff880`00d06000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`01200000 fffff880`01273000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`04a45000 fffff880`04a55000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`06d9f000 fffff880`06dad000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`04441000 fffff880`044c4000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`044c4000 fffff880`044e2000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`04225000 fffff880`04234000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01a3d000 fffff880`01a53000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`04271000 fffff880`04293000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`06db9000 fffff880`06dc2000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`06dad000 fffff880`06db9000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`06dc2000 fffff880`06dd5000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`06d6f000 fffff880`06d7b000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`0523d000 fffff880`05331000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 21:00:14 2009 (4AC5509E)
fffff880`05331000 fffff880`05377000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`04381000 fffff880`043f7000   eeCtrl64 eeCtrl64.sys Fri May 21 17:44:45 2010 (4BF6FECD)
fffff880`08786000 fffff880`087a6000   ENG64    ENG64.SYS    Wed May 05 01:28:11 2010 (4BE101EB)
fffff880`04200000 fffff880`04225000   EraserUtilRebootDrv EraserUtilRebootDrv.sys Fri May 21 17:44:45 2010 (4BF6FECD)
fffff880`02e10000 fffff880`02fc5000   EX64     EX64.SYS     Wed May 05 01:35:11 2010 (4BE1038F)
fffff880`05213000 fffff880`05220000   fdc      fdc.sys      Mon Jul 13 20:00:54 2009 (4A5BCAB6)
fffff880`012ea000 fffff880`012fe000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`0467b000 fffff880`04686000   flpydisk flpydisk.sys Mon Jul 13 20:00:54 2009 (4A5BCAB6)
fffff880`00c00000 fffff880`00c4c000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`01400000 fffff880`0140a000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`01a03000 fffff880`01a3d000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`01600000 fffff880`0164a000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff880`08702000 fffff880`0870b000   gdrv     gdrv.sys     Thu Mar 12 23:22:29 2009 (49B9D175)
fffff880`0522c000 fffff880`05239000   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
fffff800`033f9000 fffff800`03442000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`05377000 fffff880`0539b000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`06d1f000 fffff880`06d38000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`06d38000 fffff880`06d40080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`06d11000 fffff880`06d1f000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`06e11000 fffff880`06ed9000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`01662000 fffff880`0166b000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`0430b000 fffff880`04381000   IDSvia64 IDSvia64.sys Thu May 27 04:07:18 2010 (4BFE2836)
fffff880`04759000 fffff880`0476f000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`01b69000 fffff880`01b90000   Ironx64  Ironx64.SYS  Tue Apr 27 20:48:23 2010 (4BD785D7)
fffff880`00f9b000 fffff880`00fbb000   jraid    jraid.sys    Thu Oct 29 04:14:20 2009 (4AE94EDC)
fffff880`047e9000 fffff880`047f8000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`06d41000 fffff880`06d4f000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`00bcd000 fffff800`00bd7000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`0870b000 fffff880`08715000   kerneld  kerneld.amd64 Wed Feb 17 13:47:03 2010 (4B7C39A7)
fffff880`0460f000 fffff880`04652000   ks       ks.sys       Mon Jul 13 20:00:31 2009 (4A5BCA9F)
fffff880`015cc000 fffff880`015e6000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`017c4000 fffff880`017ef000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`051f7000 fffff880`051fc200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`06d5c000 fffff880`06d6f000   LHidFilt LHidFilt.Sys Wed Jun 17 12:49:39 2009 (4A391EA3)
fffff880`06a44000 fffff880`06a59000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`06d8b000 fffff880`06d9f000   LMouFilt LMouFilt.Sys Wed Jun 17 12:49:43 2009 (4A391EA7)
fffff880`06a00000 fffff880`06a23000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`06d7b000 fffff880`06d8b000   LUsbFilt LUsbFilt.Sys Wed Jun 17 12:49:46 2009 (4A391EAA)
fffff880`00c50000 fffff880`00c94000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`06dd5000 fffff880`06de3000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`04600000 fffff880`0460f000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`06d4f000 fffff880`06d5c000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00fbb000 fffff880`00fd5000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`06ef7000 fffff880`06f0f000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`06f0f000 fffff880`06f3c000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`06f3c000 fffff880`06f8a000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`06f8a000 fffff880`06fad000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`013e3000 fffff880`013ee000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`011d2000 fffff880`011dc000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`01339000 fffff880`01397000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`04300000 fffff880`0430b000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`0140a000 fffff880`0141c000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`01672000 fffff880`01764000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04a8f000 fffff880`04a9b000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`051c8000 fffff880`051f7000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`045e9000 fffff880`045fe000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`04086000 fffff880`04095000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`04000000 fffff880`04045000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01764000 fffff880`017c4000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`013ee000 fffff880`013ff000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`042f4000 fffff880`04300000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02e1d000 fffff800`033f9000   nt       ntkrnlmp.exe Sat Feb 27 02:55:23 2010 (4B88CFEB)
fffff880`01429000 fffff880`015cc000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`02e00000 fffff880`02e09000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`04664000 fffff880`0467b000   nusb3hub nusb3hub.sys Mon Oct 26 10:19:44 2009 (4AE5B000)
fffff880`0517c000 fffff880`051ab000   nusb3xhc nusb3xhc.sys Mon Oct 26 10:19:48 2009 (4AE5B004)
fffff880`0404e000 fffff880`04074000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`051ab000 fffff880`051c8000   parport  parport.sys  Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`011e9000 fffff880`011fe000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00efc000 fffff880`00f2f000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`01015000 fffff880`0101c000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00f8b000 fffff880`00f9b000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`015e6000 fffff880`015f7000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`08274000 fffff880`0831a000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`04234000 fffff880`04271000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00c94000 fffff880`00ca8000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`04a6b000 fffff880`04a8f000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`04a9b000 fffff880`04ab6000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`047a3000 fffff880`047c4000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`047c4000 fffff880`047de000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`042a3000 fffff880`042f4000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`047de000 fffff880`047e9000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`01bf7000 fffff880`01c00000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`0141c000 fffff880`01425000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`015f7000 fffff880`01600000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`00dc6000 fffff880`00e00000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`06a59000 fffff880`06a71000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`05125000 fffff880`0517c000   Rt64win7 Rt64win7.sys Thu Mar 04 08:42:52 2010 (4B8FB8DC)
fffff880`06ab9000 fffff880`06cd6300   RTKVHD64 RTKVHD64.sys Tue Dec 08 05:20:05 2009 (4B1E2855)
fffff880`06a71000 fffff880`06a7d000   RtNdPt60 RtNdPt60.sys Sun Jul 19 22:27:32 2009 (4A63D614)
fffff880`0114c000 fffff880`0117b000   SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
fffff880`0831a000 fffff880`08325000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`05220000 fffff880`0522c000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`04095000 fffff880`040b2000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`0165a000 fffff880`01662000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`0101d000 fffff880`01143000   sptd     sptd.sys     Sun Oct 11 16:55:14 2009 (4AD24632)
fffff880`01ae3000 fffff880`01b69000   SRTSP64  SRTSP64.SYS  Wed Feb 24 18:59:29 2010 (4B85BD61)
fffff880`01b90000 fffff880`01ba4000   SRTSPX64 SRTSPX64.SYS Wed Feb 24 18:59:48 2010 (4B85BD74)
fffff880`0866a000 fffff880`08702000   srv      srv.sys      Tue Dec 08 03:32:55 2009 (4B1E0F37)
fffff880`08364000 fffff880`083cd000   srv2     srv2.sys     Mon Jul 13 19:25:02 2009 (4A5BC24E)
fffff880`08325000 fffff880`08352000   srvnet   srvnet.sys   Tue Dec 08 03:32:26 2009 (4B1E0F1A)
fffff880`05239000 fffff880`0523a480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`0127c000 fffff880`012ea000   SYMDS64  SYMDS64.SYS  Mon Aug 17 19:35:30 2009 (4A89E942)
fffff880`012fe000 fffff880`01339000   SYMEFA64 SYMEFA64.SYS Wed Apr 21 17:47:39 2010 (4BCF727B)
fffff880`02fc7000 fffff880`02ffd000   SYMEVENT64x86 SYMEVENT64x86.SYS Thu Aug 13 18:28:21 2009 (4A849385)
fffff880`04074000 fffff880`04086000   SymIMv   SymIMv.sys   Fri Apr 30 22:12:21 2010 (4BDB8E05)
fffff880`040fe000 fffff880`04174000   SYMTDIV  SYMTDIV.SYS  Tue May 04 00:38:27 2010 (4BDFA4C3)
fffff880`01801000 fffff880`019fe000   tcpip    tcpip.sys    Mon Jul 13 19:25:34 2009 (4A5BC26E)
fffff880`08352000 fffff880`08364000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`00e35000 fffff880`00e42000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`00fde000 fffff880`00ffc000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`040cd000 fffff880`040e1000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`004d0000 fffff960`004da000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`04733000 fffff880`04759000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`04652000 fffff880`04664000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`06cf4000 fffff880`06d11000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`05211000 fffff880`05212f00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`05200000 fffff880`05211000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`0458f000 fffff880`045e9000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`053a8000 fffff880`053fe000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`0539b000 fffff880`053a8000   usbuhci  usbuhci.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`011dc000 fffff880`011e9000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`01bc4000 fffff880`01bd2000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`01bd2000 fffff880`01bf7000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`0164a000 fffff880`0165a000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`01000000 fffff880`01015000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00f2f000 fffff880`00f8b000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01397000 fffff880`013e3000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`040b2000 fffff880`040cd000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`017ef000 fffff880`017ff000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00e49000 fffff880`00eed000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00eed000 fffff880`00efc000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`04045000 fffff880`0404e000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00030000 fffff960`0033f000   win32k   win32k.sys   Mon Jul 13 19:40:16 2009 (4A5BC5E0)
fffff880`01143000 fffff880`0114c000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`06a23000 fffff880`06a44000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)
Unloaded modules:
fffff880`01ba4000 fffff880`01bc4000   ENG64.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`02e12000 fffff880`02fc7000   EX64.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`08715000 fffff880`08786000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01a83000 fffff880`01a91000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01a91000 fffff880`01a9d000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01a9d000 fffff880`01aa6000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01aa6000 fffff880`01ab9000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000

 

[jpwwong]

Thanks for the reply! Having done a google search, it is recommended that I completely remove secdrv.SYS as it might be a malware.

Any thoughts on whether I should remove it completely? Or rather, where/how should I update the problem driver?

 

[jcgriff2]

Hi -

The bugcheck on the dump -

0x1a = memory management error

The dump has the appearance of memory corruption, which I believe is being caused by Daemon Tools/ Alcohol 120 common boot driver sptd.sys, which then spawns (dynamically allocates) drivers such as -

[FONT=lucida console] [COLOR=navy]auf6hyqg.SYS[/COLOR]      Tue Jul 14 17:12:55 2009 (4A5CF4D7)[/FONT]

Remove Daemon/ Alcohol.

Your next issue will likely be with the 3rd party firewall found in NIS/ N360. I would advise removing NIS/ N360.

NIS/ N360 Removal -- jcgriff2.com

For info, secdrv.sys is a Macrovision security driver and should not be touched, despite its 2006 timestamp.

Regards. . .

jcgriff2

.

 

[jpwwong]

Ok. I've not touched the secdrv.sys and deleted daemon. Lets see whether it works.

Does anyone have another alternative virtual emulation program to use?

 

[ttran]

Besides Daemon tool and Alcohol 120%, Virtual CD is alternative one. However, I think you should run your computer without any virtualizing programs to see if it ok (just recommend), because I've tried all of them and got BSOD for all
I've heard about using Portable apps (without installing) to mount CD or DVD image files, don't know if there is one:sarc:

 

[Jonathan_King]

I believe MagicDisc does not use SPTD.sys. That's the only program I recommend you use.

 

[jpwwong]

Alright i'll give it a try. Thanks alot guys - really appreciate the help.

 

[jpwwong]

Hey guys,

Sorry to be asking again, but I've deleted daemon as instructed above but I am still getting BSOD. Attached are my newest dump files. FYI I have not deleted NIS yet as I have yet to find another substitute for it so if someone can confirm that NIS in indeed the culprit for the BSOD?

Thanks guys.

 

[Jonathan_King]

Hey guys,

Sorry to be asking again, but I've deleted daemon as instructed above but I am still getting BSOD. Attached are my newest dump files. FYI I have not deleted NIS yet as I have yet to find another substitute for it so if someone can confirm that NIS in indeed the culprit for the BSOD?

Thanks guys.

:roflmao:

jcgriff2 is very possibly the best BSOD analyst in the world, and I'm serious about that. I don't think you will find any other analyst that disagrees with his conclusions!

Believe me, if there is something that suggests a BSOD in the dmp file, he will pick up on it.

 

[Jonathan_King]

Looking at your new dmps, I still see SPTD.sys. Please run this SPTD installer/uninstaller, and uninstall it completely: DuplexSecure - Downloads

sptd.sys     Sun Oct 11 16:55:14 2009 (4AD24632)

[font=lucida console]
BugCheck 1A, {41790, fffffa80012d2150, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
BugCheck 1A, {41790, fffffa8000d7b350, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
[/font]

 

[jpwwong]

Sorry if I sounded skeptical on my previous post - I did not mean to invalidate jcgriff2's analysis. Thank you for your uninstaller - i will try it again and remove NIS this time.

Thanks for your feedback.

 

[jpwwong]

I want to thank you Jonathan_king and jcgriff2 for your help in my problem. 4 days on and no BSOD! Seems to have worked! Thanks again, much appreciated.

 

[Jonathan_King]

Thank you, in return. You don't realize how few people report their solutions, especially in the Crashes section. People solve their problem and forget about whoever helped them.

You are in the <10% that take the time to report later.

 

[jpwwong]

Hi Guys,

Been having BSODs again, this time less frequent. I have removed daemon and NIS as instructed (i think) and now I think its something else thats crashing. Having read the dump, I'm just afraid that it is my HDD that is telling me that it's failing, so if it is then i'll change it before it does any damage!

Can someone help me out by analyzing the files please? Thanks!!

 

[Jonathan_King]

Please remove Kaspersky, for troubleshooting purposes. Here is a removal tool: http://support.kaspersky.com/downloads/utils/kavremover10.zip

Replace with Microsoft Security Essentials.

You may try a check disk as well. Open a command prompt and run chkdsk /r.

BSOD BUGCHECK SUMMARY

[font=lucida console]
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sat Jun 19 21:06:31.715 2010 (UTC - 4:00)
System Uptime: 0 days 2:04:56.135
BugCheck 1A, {41790, fffffa80012f6750, ffff, 0}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : win32k.sys ( win32k+b3bbd )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  everest.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sat Jun 19 05:13:14.463 2010 (UTC - 4:00)
System Uptime: 0 days 4:39:30.883
BugCheck 1A, {41790, fffffa8000d7c850, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  avp.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sun Jun 27 01:50:07.260 2010 (UTC - 4:00)
System Uptime: 0 days 3:10:51.662
BugCheck 24, {c08a2, 0, 0, 0}
Probably caused by : Ntfs.sys ( Ntfs!NtfsPagingFileIo+155 )
BUGCHECK_STR:  0x24
PROCESS_NAME:  sidebar.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sat Jun 19 12:10:56.289 2010 (UTC - 4:00)
System Uptime: 0 days 4:07:26.710
BugCheck 1A, {41790, fffffa8001340550, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  wlcomm.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
[/font]

 

[jpwwong]

Thanks Jonathan_king.

Is there a reason why I cannot use 3rd party security programs? FIrst it was NIS, then now its Kaspersky.

I know MSE is free and recommended, but would like the option to use other programs as well to protect my PC.

From your above analysis, is everest causing a problem as well?

Also, I can assume that nothing is wrong with my HDD right?

Thanks again

 

[Jonathan_King]

We can make no assumptions about your hard drive at this point. BSOD work is tricky, and there are a lot of possible factors.

As for Everest, it was running at the time of one of the crashes. If it was running in all of them, or most of them, I might suspect it. With just a single crash, I wouldn't worry about it.

As for third-party security programs. They are notorious for causing crashes in Vista and 7. An expert speculates it might have something to do with the additional security levels in Vista/7, that did not exist in XP.

BSOD work requires some level of guessing, speculation, and troubleshooting. We seek to eliminate as many factors as possible.

For the purposes of troubleshooting, let's remove Kaspersky. To be honest, I don't see why you want another program beside MSE, though. It is free and provides excellent security. Furthermore, it is very lightweight, meaning it does not slow your computer down as much as the bigger suites, such as Norton, Kaspersky, and McAfee.

 

[jpwwong]

Done with removing Kaspersky and installed MSE. Crashed 3 times today lol. Latest minidumps hopefully will tell something!

Thanks.

 

[ttran]

Has your processor been at 100% utilization lately? If you went to the Task Manager in Windows and looked at your processes tab, you may have noticed a process called msmpeng.exe eating up all your available CPU.

I don't know if this is true, but this is how I think and truly appologize if it is wrong. I can see the process running at the time computer crashed was MsMpEng.exe, that when I googled gave me the result that it belong to Window Defender as well as part of Window live One care.
Therefore turning Window Defender off or exclude it from scanning are the choices
Here is the article;
What is msmpeng.exe and how to remove it

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\TUANTR~1\AppData\Local\Temp\Rar$DI00.888\062810-16426-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*e:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e53000 PsLoadedModuleList = 0xfffff800`03090e50
Debug session time: Mon Jun 28 12:10:15.577 2010 (UTC + 7:00)
System Uptime: 0 days 0:46:59.623
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8000d4ce50, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8000d4ce50
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  [COLOR=Red]MsMpEng.exe[/COLOR]

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002f36ede to fffff80002ec3600

STACK_TEXT:  
fffff880`0732f968 fffff800`02f36ede : 00000000`0000001a 00000000`00041790 fffffa80`00d4ce50 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0732f970 fffff800`02f04fca : 00000000`00000000 00000000`0974ffff fffffa80`00000000 fffffa80`05849060 : nt! ?? ::FNODOBFM::`string'+0x33946
fffff880`0732fb30 fffff800`02ec2853 : ffffffff`ffffffff 00000000`0207f128 00000000`0207f120 fffffa80`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`0732fc20 00000000`77c8009a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0207f0e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c8009a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+33946
fffff800`02f36ede cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+33946

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33946

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33946

Followup: MachineOwner
---------

Also, perform check disk
http://www.sevenforums.com/tutorials/433-disk-check.html

BugCheck 24, {c08a2, 0, 0, 0}

Probably caused by : Ntfs.sys ( Ntfs!NtfsPagingFileIo+155 )

Followup: MachineOwner
---------