Several BSODs - 9f (seems to occur around standby mode), e6

[shadedgrey63]

I was worried it might be a hardware problem. Here it is. Just out of curiosity, when you ask for the.dmp, do you want only that file, or all of it that I've been giving you?

Seriously? I was just about to post and had another e6 BSOD. I'm getting the files together again...

I suppose it's worth mentioning that Device Manager says I have a Realtek network adapter. Don't ask why I didn't notice earlier, lol.

 

[writhziden]

Ah, here we go. You had a different cause this time:

--------------------------------------------
--------------------START-------------------
--------------------------------------------
Loading Dump File [D:\Kingston\BSODDmpFiles\shadedgrey63\061012-25334-01.dmp]

Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64

System Uptime: 0 days 10:11:50.695

BugCheck A, {0, 2, 0, fffff80003299925}

*** WARNING: Unable to verify timestamp for SBFWIM.sys

*** ERROR: Module load completed but symbols could not be loaded for [B][COLOR="Red"]SBFWIM.sys[/COLOR][/B]

Probably caused by : pacer.sys ( pacer!PcFilterRequestComplete+68 )

IRQL_NOT_LESS_OR_EQUAL (a)

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

STACK_TEXT:  
fffff880`09515488 fffff800`03294769 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx

fffff880`09515488 fffff800`03294769 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`09515490 fffff800`032933e0 : fffff980`25430f10 fffff800`032a3fb6 fffff880`009b2180 fffff880`009e7e10 : nt!KiBugCheckDispatch+0x69

fffff880`09515490 fffff800`032933e0 : fffff980`25430f10 fffff800`032a3fb6 fffff880`009b2180 fffff880`009e7e10 : nt!KiBugCheckDispatch+0x69
fffff880`095155d0 fffff800`03299925 : 00000000`00000000 fffffa80`068d5630 00000000`00000007 fffff980`00000004 : nt!KiPageFault+0x260
fffff880`09515760 fffff880`01a7e1c6 : fffff880`00000000 fffff980`00000000 fffff880`00000000 fffffa80`00000003 : nt!KeSetEvent+0x1e3
fffff880`095157d0 fffff880`01a7e631 : fffff980`25430f00 fffff980`25e62c01 fffff880`009e7da0 fffff980`25e62c90 : ndis!ndisOidRequestComplete+0x446
fffff880`09515860 fffff880`04f4e078 : fffff980`25430f10 fffff980`26152f20 fffff880`009e7da0 fffff880`095159d0 : ndis!NdisFOidRequestComplete+0x91
fffff880`095158e0 fffff880`01a7dfbf : 00000000`00000000 00000000`00000000 00000000`c0000000 fffff980`25e62c01 : pacer!PcFilterRequestComplete+0x68
fffff880`09515910 fffff880`01ac927c : fffff880`00000000 00000000`00000000 fffff980`25430f10 00000000`00000000 : ndis!ndisOidRequestComplete+0x23f
fffff880`095159a0 fffff880`01ac94fe : fffff980`2f368f50 00000000`00000000 fffffa80`0b70a1a0 fffffa80`0b70a1a0 : ndis!ndisMOidRequestCompleteInternal+0xdc
fffff880`09515a20 fffff880`01b165e9 : fffffa80`0b70a1a0 fffff980`09f3eb30 fffff880`01adf110 00000000`c0000001 : ndis!ndisCompleteLegacyRequest+0x10e
fffff880`09515a80 fffff880`00c29dd7 : fffff980`09f3ec88 00000000`c0000001 fffff980`1a8848d0 fffff980`09f3ec88 : ndis!NdisMSetInformationComplete+0xa9
fffff880`09515ac0 fffff980`09f3ec88 : 00000000`c0000001 fffff980`1a8848d0 fffff980`09f3ec88 00000000`00000000 : SBFWIM+0x8dd7
fffff880`09515ac8 00000000`c0000001 : fffff980`1a8848d0 fffff980`09f3ec88 00000000`00000000 fffff880`09515c00 : 0xfffff980`09f3ec88
fffff880`09515ad0 fffff980`1a8848d0 : fffff980`09f3ec88 00000000`00000000 fffff880`09515c00 fffff980`09f3ec88 : 0xc0000001
fffff880`09515ad8 fffff980`09f3ec88 : 00000000`00000000 fffff880`09515c00 fffff980`09f3ec88 fffff880`01b0a9bb : 0xfffff980`1a8848d0
fffff880`09515ae0 00000000`00000000 : fffff880`09515c00 fffff980`09f3ec88 fffff880`01b0a9bb 00000000`00000000 : 0xfffff980`09f3ec88


FAILURE_BUCKET_ID:  X64_0xA_pacer!PcFilterRequestComplete+68

CPUID:        "Intel(R) Core(TM) i7 CPU         860  @ 2.80GHz"
MaxSpeed:     2800
CurrentSpeed: 2793

--------------------------------------------
---------------------END--------------------
--------------------------------------------

The crash blames pacer.sys, but that is a Windows driver. The likely cause is the other driver on the Memory Stack: SBFWIM.sys, your Sunbelt/GFI Firewall Software. I think we found the problem. You have remnants of an old security program from Sunbelt/GFI on the system, and it is probably conflicting with Microsoft Security Essentials.

 

[shadedgrey63]

So how can I remove it? The BSODs started while I had Norton 360 (had it for years), and thinking it was the cause, I uninstalled it and started using Microsoft Security Essentials.

 

[writhziden]

When did you have Sunbelt/GFI installed?

You can go into C:\Windows\System32\Drivers and rename the following:

SBFWIM.sys -> SBFWIM.sys.bak
SbFw.sys -> SbFw.sys.bak
SBREdrv.sys -> SBREdrv.sys.bak

 

[shadedgrey63]

The thing is, I really don't think I ever did. I wonder if I'm infected...but I have a few scanners and they all find nothing.

Should I still try your instructions?

 

[writhziden]

You have three drivers there that all belong to Sunbelt/GFI software. I would be surprised if they are viruses masquerading as security software, but I suppose it is possible. If you are sure you never had the software installed, then you may want to consider posting a thread in the security forum on these forums. They'll give you steps to get things put right.

System Security - Windows 7 Forums

 

[shadedgrey63]

Wait a minute...I was googling a bunch and came across this: "Several Sunbelt Software drivers have been left on the system following the removal of AdAware." (Always a BSOD on shutdown - Page 3)

So it seems I found why I have those files - I used to use Adaware. I'm glad I figured out why they're there. Should I rename those files, then?

EDIT: I used a program recommended to remove the files, VCleaner, and it looks like they're gone. I have a good feeing that it solved the problem, but I'll give it a few days before I mark this solved. Thank you for your help. I know it took a while, but your constantly looking at logs and finding those Sunbelt files, let me find a way to, hopefully, solve my problem. Thank you.

 

[writhziden]

Good troubleshooting! I had no idea Adaware was affiliated with Sunbelt/GFI (probably Sunbelt and then branched off to make their own security program). I will add that to my knowledge. Thank you very much.

Let us know how things are going in a few days and when you are confident the problem is solved, you may mark the thread solved.

 

[shadedgrey63]

Turns out that I just missed them when I was looking earlier. They're still there. I tried deleting them, but that rendered my wifi useless, so I promptly restored them. Could you help me again?

Edit: Huh, it seems like after using those extra uninstallers provided by Lavasoft/Sunbelt, I was able to manually delete the drivers with no affect on my internet acces. Yay! I shall most definitely inform you if I have another BSOD, but I think I'm in the clear.

 

[writhziden]

Good news! I was going to provide some other steps, but it looks like you resolved it yourself. Nicely done!!!

Let us know when you are sure the problem is solved.

 

[shadedgrey63]

Ugh, guess what? I had another BSOD right before I got up. I got the files together again. I hope you wouldn't mind helping.

 

[writhziden]

You need to update your Ethernet driver:

Rt64win7.sys Thu Feb 26 02:04:13 2009 (49A65B0D)

Rt64win7.sys is your Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC and can be updated from your HP support site: Original Realtek Networking Controller Driver HP Pavilion Elite HPE-350t CTO Desktop PC - HP Customer Care (United States - English)


If you still have problems after doing the above, I would recommend looking into all the software you have running on startup: http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Make sure to leave your antivirus software enabled in startup and services.

 

[shadedgrey63]

I recently had a BSOD. So I ran a clean boot and it no longer takes like, a minute for the desktop to load up/programs to open when clicked. I've been complaining about that for a about year, haha. I'll leave it on for a few days and see what happens.

 

[writhziden]

Good news about the faster startup! Keep us posted on whether the blue screens still occur and/or if you determine what startup/service item is causing them if one of those is the culprit.

 

[shadedgrey63]

There was no problem for around five days, so I added back about half of the services to start up. But while I was restarting, the system got stuck on the shutting down screen for over 45 minutes, so eventually I just hit the power button to power down then boot up. I wonder if the system was already starting the services before it shut down, and that caused it (meaning one of the re-added services is the problem), or if this is a whole separate issue. :banghead:

 

[writhziden]

Hard to say. It may have hung trying to save the settings for the services.

Are they now enabled? Have you had further issues with half the services enabled?


Also, since you did a hard shutdown, I would advise a http://www.sevenforums.com/tutorials/433-disk-check.html with Automatically fix file system errors checked. Hard shutdowns often corrupt the hard disk and cause file system errors that Windows needs to correct.

 

[shadedgrey63]

Yes, they are. It was storming last night so I shut my computer down until I got up. It shut down fine that time (and when restarting today to do the disc check as well). So it seems it was a fluke the night before last.

I've had no problems yet with having the first half enabled. But I'm giving it at least a few more days before I test the other half. Is it possible that two may not work well together? (Just curious. ) I suppose I should test the start up items as well, if no services seem to be a problem. The only item enabled right now is Microsoft Security Essentials. I usually have most of them disabled anyway.

 

[writhziden]

There is always a chance two will not work well together, but you will probably just find one that is causing problems. Let us know what you find as you go through the steps.

 

[shadedgrey63]

Okay, I enabled half of the still-disabled. The shutdown went fine, but the start up seemed a little slower, which makes sense. I'll know the results of this group within another few days.

EDIT: That was fast. Good thing I wrote down the ones I enabled, because clearly one of them's causing it.

 

[writhziden]

Alright, nice work tracking it down. Let us know when you find which one.