Solved Random BSOD errors with ntoskrnl.exe and one instance of tcpip.sys

[NoelDP]

Post the logs as requested.

 

[jamesldavis]

My last logs are posted at bottom of previous pages of dialogs here:
http://www.sevenforums.com/bsod-hel...rs-ntoskrnl-exe-one-instance-tcpip-sys-2.html

 

[NoelDP]

Read post #18 again.

 

[jamesldavis]

Here is the data. The last command did not appear to work.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>dir c:\media64
Volume in drive C has no label.
Volume Serial Number is 368C-FC2B

Directory of c:\media64

04/08/2015 12:35 PM <DIR> .
04/08/2015 12:35 PM <DIR> ..
04/08/2015 12:32 PM <DIR> amd64_microsoft-windows-ehome-samplemedia
_31bf3856ad364e35_6.1.7600.16385_none_b6b9b223710b3802
04/08/2015 12:32 PM <DIR> amd64_microsoft-windows-musicsamples_31bf
3856ad364e35_6.1.7600.16385_none_06495209cbd8e93b
04/08/2015 12:32 PM <DIR> amd64_microsoft-windows-photosamples_31bf
3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be
04/08/2015 12:32 PM <DIR> amd64_microsoft-windows-videosamples_31bf
3856ad364e35_6.1.7600.16385_none_51a21f033003affd
04/08/2015 12:32 PM <DIR> amd64_microsoft-windows-winsatmediasample
s_31bf3856ad364e35_6.1.7600.16385_none_0b34d0642122c1c4
0 File(s) 0 bytes
7 Dir(s) 63,475,822,592 bytes free

C:\Windows\system32>




C:\Windows\system32>DIR C:\Windows\winsxs\media64
Volume in drive C has no label.
Volume Serial Number is 368C-FC2B

Directory of C:\Windows\winsxs\media64

04/07/2015 12:05 PM <DIR> .
04/07/2015 12:05 PM <DIR> ..
04/07/2015 12:05 PM <DIR> amd64_microsoft-windows-ehome-samplemedia
_31bf3856ad364e35_6.1.7600.16385_none_b6b9b223710b3802
04/07/2015 12:05 PM <DIR> amd64_microsoft-windows-musicsamples_31bf
3856ad364e35_6.1.7600.16385_none_06495209cbd8e93b
04/07/2015 12:05 PM <DIR> amd64_microsoft-windows-photosamples_31bf
3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be
04/07/2015 12:05 PM <DIR> amd64_microsoft-windows-videosamples_31bf
3856ad364e35_6.1.7600.16385_none_51a21f033003affd
04/07/2015 12:05 PM <DIR> amd64_microsoft-windows-winsatmediasample
s_31bf3856ad364e35_6.1.7600.16385_none_0b34d0642122c1c4
0 File(s) 0 bytes
7 Dir(s) 63,475,822,592 bytes free

C:\Windows\system32>^A



C:\Windows\system32>DIR C:\Windows\winsxs\me*.*
Volume in drive C has no label.
Volume Serial Number is 368C-FC2B

Directory of C:\Windows\winsxs

04/07/2015 12:05 PM <DIR> media64
0 File(s) 0 bytes
1 Dir(s) 63,475,822,592 bytes free

C:\Windows\system32>

 

[Anak]

C:\Windows\system32>^A
C:\Windows\system32>DIR C:\Windows\winsxs\me*.*

Noel, in James case what does the ^A and me*.* Signify/stand for/mean?

When I do a search for ^A or me*.*; The ^A points to the .evtx and cbs logs James uploaded, and the me*.* points to your repair/re-build file you created for James.

The reason why my search pointed out these conditions is, I wanted to eliminate any down-time in re-d/l'd them again, and I retained them on my machine in case I needed to go over them again.


James this isn't a problem, once we get you back on the road again I purge all diagnostic files.

 

[NoelDP]

The ^A is Ctrl+A - entered by the keyboard
The me*.* was just to find out if there'd been a simple typo - so should have failed.

In this case, it's obvious that the files have been re-extracted, since the creation date for the c:\media64 folder is later than the creation date for the C:\windows\Winsxs\media64 folder (which should not be present!)

James, please follow these instructions exactly!

Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.

Pick the option to use a Command Prompt
At the prompt type
DIR C:\media64
hit the enter key - if you get a 'Not Found' error try
DIR D:\media64
or
DIR E:\media64



The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...



XCOPY <drive>:\media64 <drive>:\windows\winsxs /y /i /s /v /h



(e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )



run the command (it should take almost no time) and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.

Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your reply

 

[Anak]

Thanks Noel!

 

[jamesldavis]

I deleted the old cbs.log so that the new log would contain just the most recent data.

I then followed your instructions exactly again, rebooting to repair, going to DOS and locating the drive with the MEDIA64 directory which in my case comes up as D drive.

So I used the command xcopy D:\media64 d:\windows\winsxs /y /i/ /s /v /h

Copy took a half-second and came back with:
"26 files copied"

I rebooted to Windows, then entered cmd as administrator and ran the sfc /scannow command.

I then rebooted.

RESULTS are the same as the last time I did the procedure and show no errors:

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\Windows\system32>

 

[NoelDP]

- which means that you did it right this time.
SFC is happy now.

 

[jamesldavis]

OK, thanks for all the help. I guess now we wait and see if my Windows remains stables without further BSOD?

 

[jamesldavis]

A new BSOD crash just now. Attached.
15

 

[jamesldavis]

Also, sfc /scannow, shows "no integrity violations"

 

[essenbe]

Could you run the BSOD posting Instructions and upload them here in your next post? http://www.sevenforums.com/bsod-help-support/96879-blue-screen-death-bsod-posting-instructions.html

 

[jamesldavis]

OK, here is the attached file.

James
42

 

[essenbe]

Hi, jamesldavis. This is from the dump dated 4/10/15

BugCheck 19, {3, fffff80003252940, 0, fffff80003252940}
*** WARNING: Unable to verify timestamp for WiseTDIFw64.sys
[COLOR=red]*** ERROR: Module load completed but symbols could not be loaded for WiseTDIFw64.sys[/COLOR]
Probably caused by : Pool_Corruption ( nt!ExFreePool+503 )
Followup: Pool_corruption

the driver is

WiseTDIFw64
start             end                 module name
fffff880`019f1000 fffff880`019ff000   WiseTDIFw64 T (no symbols)           
    Loaded symbol image file: WiseTDIFw64.sys
    Image path: \??\[COLOR=red]C:\Windows\WiseTDIFw64.sys[/COLOR]
    Image name: WiseTDIFw64.sys
    Timestamp:        Thu Feb 26 03:50:37 2015 (54EEEC6D)
    CheckSum:         0000E4F0
    ImageSize:        0000E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

I thought we got rid of all of that stuff in Post # 2 and 3. But, I think it may be more of a problem to uninstall than we think.

 

[jamesldavis]

I did uninstall all the "wise" utilities but apparently it did not all get cleaned out.
25

 

[essenbe]

I read just a little yesterday and from what little I read, it is extremely difficult to get rid of. I only read a little, but I never read about anyone who completely got all of it.

Let's try this. Download the free version of Revo Uninstaller(Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems) as always watch out for the add on programs some free software try to get you to install. Try to uninstall it with Revo. It is a very good uninstall program. See how that does and let me know.

 

[jamesldavis]

I had already run another uninstaller last week and I now have Revo installed but neither it nor any other shows "wise" products in the uninstall list. Also, I do not find any indications of "wise" or other unknowns in the Revo autoruns section.

I found this link: BSOD haunts my dreams * Resolved - Microsoft Community

Where, it was suggested to someone with the same problem, to simply delete the WiseTDIFw64.sys file. So, I renamed it to WiseTDIFw64-sys.xxx and rebooted. There were no complaints during the reboot.

If you have any further suggestions at this point, let me know. Otherwise, I will upload run the BSOD instructions if and when a new crash occurs.

Thanks,

James
25

 

[essenbe]

That will work for me. I hope it works for you, and it very well could. If it does work long enough to where you are sure you are stable, you could just delete the driver you renamed and not have it just sitting there doing nothing.

 

[NoelDP]

If I remember right, some of the Wise stuff is started from the Task Scheduler - check in there and see if that's the case here.