Several BSOD, ntoskrnl.exe, aswSP.sys, more.

[Gina]

Hello, I've been having BSOD and can't really figure out what is going on. I have done a bunch of googling and just get more confused, lol. Would like some help. I have a Samsung Chronos Series 7 Model NP700Z7C-S01US.

I have had very long boot times for awhile. I do not reboot or turn off the machine very often, so I'm not sure when or why that could have started. The BSOD just started happening. The only thing I can think of that could have caused it are, installing a WD MyCloud into the networking system, which works fine except when I reboot the computer sometimes I get a notification that the mapped networked drives could not connect and all the mapped drives have a big red x on them until I double-click them, then they are ok. I also tried to add my new Sony HT-CT370 sound bar to bluetooth devices on my laptop so I could listen to the music through the soundbar. Windows reported the driver did not install correctly, and I could not get it to work, so I removed the soundbar. I think the soundbar thing may have been what started it, but not sure. My computer gets a lot of beating though, I install and try out software, it is three years old and never been restored to factory. So anything probably could have messed it up.



------------------------------------------------------------------------------------------------------------------------
Just some quick copy and paste from NirView:

The problem seems to be caused by the following file: aswSnx.sys
DRIVER_VERIFIER_DETECTED_VIOLATION
*** aswSnx.sys - Address 0xfffff88001ea05fb base at 0xfffff88001e77000 DateStamp
0x55364a30
-----------------------------------------------
The problem seems to be caused by the following file: aswSP.sys
MEMORY_MANAGEMENT
*** aswSP.sys - Address 0xfffff880039bb7a0 base at 0xfffff88003959000 DateStamp
0x55364d99
-----------------------------------------------
The problem seems to be caused by the following file: iaStor.sys
DRIVER_IRQL_NOT_LESS_OR_EQUAL
*** iaStor.sys - Address 0xfffff8800124cceb base at 0xfffff8800121f000 DateStamp
0x4ed5a567
------------------------------------------------
The problem seems to be caused by the following file: ntoskrnl.exe
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION
*** ntoskrnl.exe - Address 0xfffff80002679a40 base at 0xfffff80002607000 DateStamp
0x5507a73c
------------------------------------------------------
The problem seems to be caused by the following file: ntoskrnl.exe
IRQL_NOT_LESS_OR_EQUAL
*** ntoskrnl.exe - Address 0xfffff80002684a40 base at 0xfffff80002612000 DateStamp
0x5507a73c
---------------------------------------------------
The problem seems to be caused by the following file: ntoskrnl.exe
PAGE_FAULT_IN_NONPAGED_AREA
*** ntoskrnl.exe - Address 0xfffff800026c8a40 base at 0xfffff80002656000 DateStamp
0x5507a73c
---------------------------------------------------------------------------------------------------------------

I have uploaded the files required in the pinned post for the forum. Can anyone help me out? I would appreciate it

Thanks so much!

Gina

 

[Boozad]

Welcome to 7F Gina. I'll see if I can help solve your issues for you.

 DISK KEEPER

Your DiskKeeper driver is causing issues. It's old and needs updating, check for updates here.

fffff800`024b8678  fffff880`01032693Unable to load image \SystemRoot\system32\DRIVERS\excsd.sys, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for excsd.sys
*** ERROR: Module load completed but symbols could not be loaded for excsd.sys[/COLOR]
 excsd+0x3693

0: kd> lmvm excsd
start             end                 module name
fffff880`0102f000 fffff880`010e5000   excsd    T (no symbols)           
    Loaded symbol image file: excsd.sys
    Image path: \SystemRoot\system32\DRIVERS\excsd.sys
    Image name: excsd.sys
    Timestamp:        [COLOR=Red]Fri Sep 23 23:19:01 2011[/COLOR] (4E7D05D5)
    CheckSum:         000198E2
    ImageSize:        000B6000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 RAID

Are you running a RAID setup? Intel Rapid Storage is causing issues.

fffff800`024b8868  fffff880`0124d31f iaStor+0x2e31f
fffff800`024b8870  fffffa80`16df5902
fffff800`024b8878  fffffa80`16784410
fffff800`024b8880  fffffa80`16df59c0
fffff800`024b8888  fffff880`0124d31f iaStor+0x2e31f

 INTEL WIRELESS

Your Intel Wireless WiFi Link Adaptor driver is being flagged. Again it could do with updating, check here for an updated version.

fffff800`024b8038  fffff880`1aa7ed10Unable to load image \SystemRoot\system32\DRIVERS\Netwsw00.sys, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for Netwsw00.sys
*** ERROR: Module load completed but symbols could not be loaded for Netwsw00.sys[/COLOR]
 Netwsw00+0x33d10

0: kd> lmvm Netwsw00
start             end                 module name
fffff880`1aa4b000 fffff880`1b59d000   Netwsw00 T (no symbols)           
    Loaded symbol image file: Netwsw00.sys
    Image path: \SystemRoot\system32\DRIVERS\Netwsw00.sys
    Image name: Netwsw00.sys
    Timestamp:        [COLOR=Red]Wed May 08 14:45:41 2013[/COLOR] (518A5705)
    CheckSum:         00B070DE
    ImageSize:        00B52000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 AVAST

Avast is causing issues. Uninstall Avast and install MS Security Essentials and MalwareBytes.

   Note

Make sure you uncheck the 'Enable Free Trial' box when installing.

fffff800`024b8018  fffff880`01c4465aUnable to load image \SystemRoot\system32\DRIVERS\aswNdisFlt.sys, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for aswNdisFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for aswNdisFlt.sys[/COLOR]
 aswNdisFlt+0x965a

Perform the above steps and test the system for stability.

 

[Gina]

Hi Boozad, and thank you so much for responding, and taking the time to look at and analyze my problems.

Ok, I was totally lost on the Diskeeper thing. However, I found something in my Easy Settings that Samsung gives as part of it's utilities for the laptop. Take a look at the expresscache.png I have attached. The "Use Expresscache" is set to 'off'. Should I set it to 'on'? Should I reset the expresscache? I went to Samsung's site and found the driver but it's from 2012. I cannot find a driver for this on Diskeeper's website.

As for RAID, I have no idea. I looked in device manager and did not see anything about RAID. How would I find out? I have one SATA hard drive and one ssd. I couldn't find anything for Intel Rapid Storage, except there is a driver download at the Samsung site for my model, again from 2012.

I'm trying to figure out the wireless adapter driver. It's a bit confusing because the site says I have a Intel(R) Centrino(R) Advanced-N 6235, but when I look up drivers it's for Bluetooth (?)

I have Malwarebytes Pro already, and actually I have a convo going with Avast at the moment. If they can't figure it out, then I will uninstall. I bought a three PC license with them, and I'd rather try to get it fixed than uninstall at the moment.

Thanks so much! I appreciate the help. What should I do with the ExpressCache thing, and how do I find out about RAID?

 

[Boozad]

Hi Gina, I can't see a .PNG file attached to your post so I can't comment just yet. I'll have a look into DiskKeeper for you as I've never heard of it myself.

Can you open Control Panel and click on Add/Remove Programs and see if Intel Rapid Storage is listed. You won't have a RAID setup with the drives you have I wouldn't have thought, but to be sure can you open Device Manager, expand Storage Controllers and take a screenshot and upload in your next post.

Avast has caused countless BSODs (as have many other AC suites) so your success with Avast may be unreliable. I can only advise on that point, your choice of AV is completely up to yourself.

 

[Gina]

Hmmm, I uploaded it to the forum. Let me try again

 

[Gina]

And again....

 

[Boozad]

This could be the cause for the iaStor crashes too. I'll have to look into this but my gut feeling says it's unnecessary bloatware that would be best uninstalled. I'll ask if anybody else knows more about this, sit tight for the time being.

 

[Gina]

Oh, and I looked in Installed Programs, and yes, there is Intel Rapid Technology. There is no icon for it however, it's the generic for a program. I'm tempted to click uninstall and see if it asks to repair. But won't. ;-P

I have Avast installed on my win8 tablet, and hubs has it on his Win7 Laptop and no problems, not even slow boot times. Obviously it's something with my particular set up. I am going to see what they say. I'll decide after that. In the meantime I may just uninstall and see if my boot BSOD goes away, that is when it usually happens.

Here is screenshot of storage controllers.

 

[Gina]

It seems like the ExpressCache is for my 8GB SSD.

OK, thank you for helping, I really appreciate it!!

 

[Boozad]

I've asked for some more eyes to drop in and take a look as I'm not completely familiar with how setups like this work. Someone should be along soon and I think I'll learn as much as you do from this!

 

[Arc]

Hi Gina.

Have you uninstalled Avast already, as suggested by Boozad in #2?

If so, let us see any further BSOD after doing it. It will help us to decide our next courses of actions.

 

[Gina]

Hello Arc, forgive my delay I was going mostly nonstop from Friday to Sunday evening.

I have not uninstalled Avast yet. I barely had time to work on the computer much actually. I was going to wait for Avast to get back with me, but they have not. However I just got their attention on Friday. I have had another BSOD however, and something else interesting.

I rebooted my computer yesterday. It did not give me a BSOD this time. I got a message from Malwarebytes. Screenshot attached. I got a notification that Avast was turned off as well. So my computer booted normally (although slowly) and Avast was turned off when I was fully booted.

I ended up running a few rootkit removers. None were found. One note of interest however: when I ran Avast's aswmbr, my computer gave a BSOD and spontaneously rebooted almost as soon as Avasts's aswmbr began scanning. When I booted again, I started the scan once again and it took all day to run, but just seemed to sit there for a couple of hours. I finally just shut it off. I do not have a dump file for this BSOD, at least BlueScreen Viewer doesn't bring up a dump for yesterday.

Today I got a BSOD on startup. Sigh.

Here's quick snips from today's BSOD from NirBlueScreen Viewer.

A problem has been detected and Windows has been shut down to prevent damage
to your computer.

-----------------------------------
The problem seems to be caused by the following file: Ntfs.sys

SYSTEM_SERVICE_EXCEPTION

*** Ntfs.sys - Address 0xfffff88001628e20 base at 0xfffff88001618000 DateStamp
0x52e1be8a
-----------------------------------------

If I don't hear from Avast by this afternoon, I am going to uninstall, boot and see what happens. I will install MSE in the interim. I'll get back with you after I do that.

Thanks for helping and for your reply,
Gina

 

[Arc]

Hi Gina.

If you report any further BSOD, attach the data following the Blue Screen of Death (BSOD) Posting Instructions otherwise we will not be able to see what is going on there. BSview is not any info actually.

And, hope you will follow us, and your next reply will confirm that you have uninstalled Avast and installed MSE. No further suggestion will take you anywhere with the crasher present in your system. I hope you can understand it.

Have a closer look at the dialog provided by MBAM.

View attachment 359541
​

Take it seriously. Scan the system for possible virus infection with the following programs only, not with Avast or MBAM or even MSE.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

I hope you will decide to continue with us. A delay in replying is not a big deal, but a delay in action is.

 

[Gina]

Hello,

Finally got some health and time this afternoon. Uninstalled Avast, reboot. No BSOD. Installed MSE. Made the boot cd for Windows Defender Offline. (Had already run TDSSKiller, Sophos Virus Removal Tool, McAfee Rootkit Remover, and what I could of Avasts' tool). I could not create the CD on a different computer, I don't have one accessible. I might have access to one in a couple of days.

I can't find a log file at the stated location on the drive, but it didn't seem to find anything during the Quick scan.

When I booted after changing the boot order, I didn't get a BSOD. The boot time is quicker, but it was a good four minutes by count (from start of reboot) before seeing a hit of desktop, and a few more minutes until I got a usable desktop.

I had made some custom views in Event Viewer. This is the last boot time:

Windows has started up:
Boot Duration : 339959ms little over 5.5 minutes I think
IsDegradation : false
Incident Time (UTC) : ‎2015‎-‎05‎-‎18T18:46:28.718400300Z


The only thing I could find in boot degradation other than
File Name : MsMpEng.exe
Friendly Name : Antimalware Service Executable
Total Time : 92541ms
Degradation Time : 84041ms

was something for my Samsung s6 phone that helps with file transfer. Just installed it a few days ago, so not sure if I need it to load at start up or not. Will take a look at it.:
File Name : Samsung Link.exe
Friendly Name : Samsung Link Service
Version : 2.0.0.1503181422
Total Time : 8304ms
Degradation Time : 3304ms

So, now what? Any other ideas? I need to look at startups and services again. I've mostly preened the startups, but I am not sure what services I can stop, so not sure what else to do about boot time. BUT, it's much better, and no BSOD after two boots at least!

 

[Arc]

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs. It will open the system configuration window

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window, with the "general" tab selected.
   • Click the "startup" tab. Click "Disable all"
     • Add back the antivirus there. > Apply > OK.
   • Click on "services" tab. Check the "Hide all Microsoft Services"; Click "Disable all" > Apply > OK
3. Accept then restart.

If the boot time is not improved, try The Boot Time Defrag option using Puran Defrag.

View attachment 359606
​

Is the boot time anyhow improved after doing those? Let us know.