BSOD - Report - Help Needed

Playdo · Feb 2, 2011

Over the last two weeks I've encountered a BSOD. Initially Windows wouldn't start at all. After several restores and alterations it is in a state now where the screen turns blue and hangs for a while after logging in. Windows then starts up but there is obviously a problem.

I've attached the files and the extra info is:

- Vista x86 (32-bit)
- Original OS installed on the system
- OEM
- System is approximately 2-3 years old
- OS is approximately 2-3 years old (has not been re-installed)

I did some research into it and found the following information:
http://www.vistax64.com/drivers/287415-finding-faulty-device-driver-vista.html#post1314827

Thank you very much for the help.

richc46 · Feb 2, 2011

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\richc46\AppData\Local\Temp\Temp1_BSOD%20-%20Info[1].zip\Windows_NT6_BSOD_jcgriff2\Mini012111-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6002.18267.x86fre.vistasp2_gdr.100608-0458
Machine Name:
Kernel base = 0x82615000 PsLoadedModuleList = 0x8272cc70
Debug session time: Fri Jan 21 04:58:18.385 2011 (GMT-5)
System Uptime: 0 days 0:01:11.947
Loading Kernel Symbols
...............................................................
....................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1, {8281d2f6, 0, fffe, 0}
Probably caused by : ntkrpamp.exe ( nt!NtOpenKey+0 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->KernelApcDisable field. A negative value indicates that a driver
has disabled APC calls without re-enabling them.  A positive value indicates
that the reverse is true. This check is made on exit from a system call.
Arguments:
Arg1: 8281d2f6, address of system function (system call)
Arg2: 00000000, Thread->ApcStateIndex << 8 | Previous ApcStateIndex
Arg3: 0000fffe, Thread->KernelApcDisable
Arg4: 00000000, Previous KernelApcDisable
Debugging Details:
------------------

FAULTING_IP: 
nt!NtOpenKey+0
8281d2f6 8bff            mov     edi,edi
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  INTEL_CPU_MICROCODE_ZERO
BUGCHECK_STR:  0x1
PROCESS_NAME:  services.exe
CURRENT_IRQL:  0
LAST_CONTROL_TRANSFER:  from 775b5e74 to 8265ffe7
STACK_TEXT:  
8038cd64 775b5e74 badb0d00 00def4c0 00000000 nt!KiServiceExit2+0x16e
WARNING: Frame IP not in any known module. Following frames may be wrong.
00def4fc 00000000 00000000 00000000 00000000 0x775b5e74

STACK_COMMAND:  .bugcheck ; kb
FOLLOWUP_IP: 
nt!NtOpenKey+0
8281d2f6 8bff            mov     edi,edi
SYMBOL_NAME:  nt!NtOpenKey+0
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
IMAGE_NAME:  ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  4c0e557c
FAILURE_BUCKET_ID:  0x1_nt!NtOpenKey+0
BUCKET_ID:  0x1_nt!NtOpenKey+0
Followup: MachineOwner
---------
kd> lmtsmn
start    end        module name
8068f000 806d5000   acpi     acpi.sys     Sat Apr 11 00:19:03 2009 (49E01A37)
90000000 90048000   afd      afd.sys      Sat Apr 11 00:47:01 2009 (49E020C5)
90048000 9004c200   aswRdr   aswRdr.SYS   Thu Jan 13 03:37:29 2011 (4D2EB9C9)
90113000 90159480   aswSP    aswSP.SYS    Thu Jan 13 03:41:11 2011 (4D2EBAA7)
8e9ed000 8e9f6f00   aswTdi   aswTdi.SYS   Thu Jan 13 03:40:14 2011 (4D2EBA6E)
807ae000 807b6000   atapi    atapi.sys    Sat Apr 11 00:39:09 2009 (49E01EED)
807b6000 807d4000   ataport  ataport.SYS  Sat Apr 11 00:39:10 2009 (49E01EEE)
8071f000 80729000   BATTC    BATTC.SYS    Sat Jan 19 00:32:45 2008 (47918B7D)
8f5f7000 8f5fe000   Beep     Beep.SYS     Sat Jan 19 00:49:10 2008 (47918F56)
8048b000 80493000   BOOTVID  BOOTVID.dll  Sat Jan 19 02:27:15 2008 (4791A653)
988e0000 988ee000   cdd      cdd.dll      unavailable (00000000)
863cf000 863e7000   cdrom    cdrom.sys    Sat Apr 11 00:39:17 2009 (49E01EF5)
804d4000 805b4000   CI       CI.dll       Sat Apr 11 02:25:22 2009 (49E037D2)
865a2000 865c3000   CLASSPNP CLASSPNP.SYS Sat Apr 11 00:39:05 2009 (49E01EE9)
80493000 804d4000   CLFS     CLFS.SYS     Sat Apr 11 00:13:51 2009 (49E018FF)
8071c000 8071e900   compbatt compbatt.sys Sat Jan 19 00:32:47 2008 (47918B7F)
90171000 9017e000   crashdmp crashdmp.sys Sat Apr 11 00:39:12 2009 (49E01EF0)
865c3000 865cc000   crcdisk  crcdisk.sys  Thu Nov 02 04:52:27 2006 (4549B1CB)
900fc000 90113000   dfsc     dfsc.sys     Sat Apr 11 00:14:12 2009 (49E01914)
86591000 865a2000   disk     disk.sys     Sat Apr 11 00:39:14 2009 (49E01EF2)
8f5c2000 8f5e7000   drmk     drmk.sys     Sat Jan 19 01:53:02 2008 (47919E4E)
90189000 90191000   dump_atapi dump_atapi.sys Sat Apr 11 00:39:09 2009 (49E01EED)
9017e000 90189000   dump_dumpata dump_dumpata.sys Sat Apr 11 00:39:09 2009 (49E01EED)
90191000 9019b000   Dxapi    Dxapi.sys    Sat Jan 19 00:36:12 2008 (47918C4C)
8dc56000 8dcf7000   dxgkrnl  dxgkrnl.sys  Thu Sep 24 21:27:14 2009 (4ABC1C72)
8e7cc000 8e7f2c00   e100b325 e100b325.sys Tue Oct 31 18:13:21 2006 (4547CA81)
8656a000 86591000   ecache   ecache.sys   Sat Apr 11 00:40:12 2009 (49E01F2C)
807d4000 807e4000   fileinfo fileinfo.sys Sat Jan 19 00:34:27 2008 (47918BE3)
805b4000 805e6000   fltmgr   fltmgr.sys   Sat Apr 11 00:13:59 2009 (49E01907)
8f5e7000 8f5f0000   Fs_Rec   Fs_Rec.SYS   Sat Jan 19 00:27:57 2008 (47918A5D)
862f9000 86314000   fwpkclnt fwpkclnt.sys Sat Apr 11 00:45:42 2009 (49E02076)
829ce000 82a01000   hal      halmacpi.dll Sat Apr 11 00:13:13 2009 (49E018D9)
8dd03000 8dd90000   HDAudBus HDAudBus.sys Sat Apr 11 00:42:41 2009 (49E01FC1)
8e971000 8e977380   HIDPARSE HIDPARSE.SYS Sat Jan 19 00:53:16 2008 (4791904C)
8e70b000 8e7bf000   HSX_CNXT HSX_CNXT.sys Wed Nov 08 18:53:45 2006 (45526E09)
8e608000 8e70b000   HSX_DPV  HSX_DPV.sys  Wed Nov 08 18:55:07 2006 (45526E5B)
86323000 8636d000   HSXHWBS2 HSXHWBS2.sys Wed Nov 08 18:54:01 2006 (45526E19)
86397000 863aa000   i8042prt i8042prt.sys Sat Jan 19 00:49:17 2008 (47918F5D)
8d609000 8dc56000   igdkmd32 igdkmd32.sys Wed Jan 02 11:48:24 2008 (477BC058)
80782000 80789000   intelide intelide.sys Thu Nov 02 04:51:35 2006 (4549B197)
86314000 86323000   intelppm intelppm.sys Sat Jan 19 00:27:20 2008 (47918A38)
863aa000 863b5000   kbdclass kbdclass.sys Sat Jan 19 00:49:14 2008 (47918F5A)
80403000 8040a000   kdcom    kdcom.dll    Sat Apr 11 02:25:29 2009 (49E037D9)
8636d000 86397000   ks       ks.sys       Sat Apr 11 00:38:47 2009 (49E01ED7)
86004000 86075000   ksecdd   ksecdd.sys   Mon Jun 15 08:48:53 2009 (4A364335)
8040a000 8047a000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Sat Apr 11 02:23:19 2009 (49E03757)
8e7bf000 8e7cc000   modem    modem.sys    Sat Jan 19 00:57:16 2008 (4791913C)
9019b000 901aa000   monitor  monitor.sys  Sat Jan 19 00:52:19 2008 (47919013)
8e7f3000 8e7fe000   mouclass mouclass.sys Sat Jan 19 00:49:14 2008 (47918F5A)
8079e000 807ae000   mountmgr mountmgr.sys Sat Jan 19 00:49:13 2008 (47918F59)
8e9b5000 8e9c0000   Msfs     Msfs.SYS     Sat Jan 19 00:28:08 2008 (47918A68)
806de000 806e6000   msisadrv msisadrv.sys Sat Jan 19 00:32:51 2008 (47918B83)
8e801000 8e830000   msiscsi  msiscsi.sys  Sat Apr 11 00:40:07 2009 (49E01F27)
86180000 861ab000   msrpc    msrpc.sys    Sat Apr 11 00:37:32 2009 (49E01E8C)
8e90b000 8e915000   mssmbios mssmbios.sys Sat Jan 19 00:32:55 2008 (47918B87)
8655b000 8656a000   mup      mup.sys      Sat Apr 11 00:14:12 2009 (49E01914)
86075000 86180000   ndis     ndis.sys     Sat Apr 11 00:45:52 2009 (49E02080)
8e893000 8e89e000   ndistapi ndistapi.sys Sat Jan 19 00:56:24 2008 (47919108)
8e89e000 8e8c1000   ndiswan  ndiswan.sys  Sat Apr 11 00:46:31 2009 (49E020A7)
8e957000 8e968000   NDProxy  NDProxy.SYS  Sat Jan 19 00:56:28 2008 (4791910C)
90095000 900a3000   netbios  netbios.sys  Sat Jan 19 00:55:45 2008 (479190E1)
9004d000 9007f000   netbt    netbt.sys    Sat Apr 11 00:45:35 2009 (49E0206F)
861ab000 861e6000   NETIO    NETIO.SYS    Sat Apr 11 00:46:21 2009 (49E0209D)
8e9c0000 8e9ce000   Npfs     Npfs.SYS     Sat Apr 11 00:14:01 2009 (49E01909)
900f2000 900fc000   nsiproxy nsiproxy.sys Sat Jan 19 00:55:50 2008 (479190E6)
82615000 829ce000   nt       ntkrpamp.exe Tue Jun 08 10:36:44 2010 (4C0E557C)
8640a000 8651a000   Ntfs     Ntfs.sys     Sat Apr 11 00:14:34 2009 (49E0192A)
8f5f0000 8f5f7000   Null     Null.SYS     Sat Jan 19 00:49:12 2008 (47918F58)
9007f000 90095000   pacer    pacer.sys    Sat Apr 11 00:45:51 2009 (49E0207F)
8dde8000 8de00000   parport  parport.sys  Sat Jan 19 00:49:32 2008 (47918F6C)
8070d000 8071c000   partmgr  partmgr.sys  Sat Apr 11 00:39:19 2009 (49E01EF7)
806e6000 8070d000   pci      pci.sys      Sat Apr 11 00:19:16 2009 (49E01A44)
80797000 8079e000   pciide   pciide.sys   Sat Apr 11 00:39:10 2009 (49E01EEE)
80789000 80797000   PCIIDEX  PCIIDEX.SYS  Sat Apr 11 00:39:09 2009 (49E01EED)
8f595000 8f5c2000   portcls  portcls.sys  Sat Apr 11 00:42:48 2009 (49E01FC8)
8047a000 8048b000   PSHED    PSHED.dll    Sat Apr 11 02:25:32 2009 (49E037DC)
8e9ce000 8e9d7000   rasacd   rasacd.sys   Sat Jan 19 00:56:31 2008 (4791910F)
8e87c000 8e893000   rasl2tp  rasl2tp.sys  Sat Jan 19 00:56:33 2008 (47919111)
8e8c1000 8e8d0000   raspppoe raspppoe.sys Sat Apr 11 00:46:30 2009 (49E020A6)
8e8d0000 8e8e4000   raspptp  raspptp.sys  Sat Jan 19 00:56:34 2008 (47919112)
8e8e4000 8e8f9000   rassstp  rassstp.sys  Sat Apr 11 00:46:40 2009 (49E020B0)
900b6000 900f2000   rdbss    rdbss.sys    Sat Apr 11 00:14:26 2009 (49E01922)
8e9a5000 8e9ad000   RDPCDD   RDPCDD.sys   Sat Jan 19 01:01:08 2008 (47919224)
8e9ad000 8e9b5000   rdpencdd rdpencdd.sys Sat Jan 19 01:01:09 2008 (47919225)
8f402000 8f594780   RTKVHDA  RTKVHDA.sys  Fri Dec 01 00:38:47 2006 (456FBFE7)
86400000 8640a000   serenum  serenum.sys  Sat Jan 19 00:49:29 2008 (47918F69)
863b5000 863cf000   serial   serial.sys   Sat Jan 19 00:49:34 2008 (47918F6E)
863e7000 863fb000   smb      smb.sys      Sat Apr 11 00:45:22 2009 (49E02062)
86553000 8655b000   spldr    spldr.sys    Thu Jun 21 20:29:17 2007 (467B17DD)
8e830000 8e871000   storport storport.sys Sat Apr 11 00:39:19 2009 (49E01EF7)
8e909000 8e90a380   swenum   swenum.sys   Sat Jan 19 00:49:20 2008 (47918F60)
8620f000 862f9000   tcpip    tcpip.sys    Wed Jun 16 09:45:41 2010 (4C18D585)
8e871000 8e87c000   TDI      TDI.SYS      Sat Jan 19 00:57:10 2008 (47919136)
8e9d7000 8e9ed000   tdx      tdx.sys      Sat Apr 11 00:45:56 2009 (49E02084)
8e8f9000 8e909000   termdd   termdd.sys   Sat Apr 11 00:51:14 2009 (49E021C2)
988c0000 988c9000   TSDDD    TSDDD.dll    Sat Jan 19 01:01:09 2008 (47919225)
865f7000 86600000   tunmp    tunmp.sys    Sat Jan 19 00:55:40 2008 (479190DC)
865ec000 865f7000   tunnel   tunnel.sys   Thu Feb 18 06:28:13 2010 (4B7D244D)
8e915000 8e922000   umbus    umbus.sys    Sat Jan 19 00:53:40 2008 (47919064)
9016f000 90170700   USBD     USBD.SYS     Sat Jan 19 00:53:17 2008 (4791904D)
8ddd9000 8dde8000   usbehci  usbehci.sys  Sat Apr 11 00:42:52 2009 (49E01FCC)
8e922000 8e957000   usbhub   usbhub.sys   Sat Apr 11 00:43:14 2009 (49E01FE2)
8dd9b000 8ddd9000   USBPORT  USBPORT.SYS  Sat Apr 11 00:42:55 2009 (49E01FCF)
9015a000 9016f000   USBSTOR  USBSTOR.SYS  Sat Apr 11 00:42:55 2009 (49E01FCF)
8dd90000 8dd9b000   usbuhci  usbuhci.sys  Sat Jan 19 00:53:20 2008 (47919050)
8e978000 8e984000   vga      vga.sys      Sat Jan 19 00:52:06 2008 (47919006)
8e984000 8e9a5000   VIDEOPRT VIDEOPRT.SYS Sat Jan 19 00:52:10 2008 (4791900A)
80729000 80738000   volmgr   volmgr.sys   Sat Jan 19 00:49:51 2008 (47918F7F)
80738000 80782000   volmgrx  volmgrx.sys  Sat Apr 11 00:39:25 2009 (49E01EFD)
8651a000 86553000   volsnap  volsnap.sys  Sat Apr 11 00:39:37 2009 (49E01F09)
900a3000 900b6000   wanarp   wanarp.sys   Sat Jan 19 00:56:31 2008 (4791910F)
8dcf7000 8dd03000   watchdog watchdog.sys Sat Apr 11 00:22:43 2009 (49E01B13)
80606000 80682000   Wdf01000 Wdf01000.sys Sat Jan 19 00:52:21 2008 (47919015)
80682000 8068f000   WDFLDR   WDFLDR.SYS   Sat Jan 19 00:52:19 2008 (47919013)
986a0000 988a3000   win32k   win32k.sys   Mon Oct 18 09:31:09 2010 (4CBC4C1D)
806d5000 806de000   WMILIB   WMILIB.SYS   Sat Jan 19 00:53:08 2008 (47919044)

You have given me 3 reports, 2 the same and one different. My suggestions are based on the composite of the two

Scan your computer for computer viruses.
Check your hard disk for errors.
Install all Windows updates

Update Drivers

Code:

e100b325.sys Tue Oct 31 18:13:21 2006
intelide.sys Thu Nov 02 04:51:35 2006
crcdisk.sys  Thu Nov 02 04:52:27 2006
HSX_CNXT.sys Wed Nov 08 18:53:45 2006
HSXHWBS2.sys Wed Nov 08 18:54:01 2006
HSX_DPV.sys  Wed Nov 08 18:55:07 2006
RTKVHDA.sys  Fri Dec 01 00:38:47 2006

The reports that you have submitted reveal clues to the cause of your problem. They do not give a definitive answer. The more reports that we receive the more clues are made available improving our chances of finding a solution to your problem. Each remedy suggested must be performed regardless of placement in this report or other variables. You may have to experience several more BSODs until the final answer is discovered.

If overclocking restore normal settings

SFC /scannow
System Files - SFC Command

Scan with your Anti Virus

Update outdated listed drivers. If I have inadvertently listed any Microsoft Drivers, they can be ignored.

How to Find Drivers
search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone - will help you search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- - if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.
- The most common drivers are listed on this page: http://www.carrona.org/dvrref.html
- - Driver manufacturer links are on this page: http://www.carrona.org/drvrdown.html
and here
http://www.edbott.com/weblog/the-vista-master-driver-list/
To remove any left over driver remnants, especially from graphics cards, use driver sweeper
www.guru3d.com/category/driversweeper/
You can also locate information about your driver using this information
http://www.sevenforums.com/tutorials/96442-device-manager-finding-unknown-devices.html

Run the upgrade advisor to help discover hardware problems
www.microsoft.com/Windows/windows-7/get/upgrade-advisor.aspx

Test Hard Drive HD Diagnostic or this test Hard Drive Diagnostics Tools and Utilities (Storage) - TACKtech Corp.

After performing all of the above, post back with any new BSOD reports, or indicate that the attempted repairs were successful.
If any links do not work, if clicked, please copy and paste to browser address bar.
It is very important to remember that the dump reports only give clues as to the problem and although it is very easy to analyze only one or two, usually more are needed. If you experience additional BSOD after installing a current version of the driver in question, be sure to post so that we can use the additional information to assist you in preventing the BSOD's

Playdo · Feb 2, 2011

Hi Rich. I previously did a Kapersky boot scan which found the trojan: Backdoor.win32.Psychward.gq. This was removed. I then did a secondary boot scan (Avira). No viruses were found.

I also installed all Windows updates. I haven't checked my hard disk for errors. How do I do this?

I will update those 7 drivers.

richc46 · Feb 2, 2011

Hi
Also download and run malwarebytes, you may be surprised.
If you read my above post, there is a link for the HD test.

Playdo · Feb 3, 2011

Hard Drive test:

Seagate test used on my WD hard drive as recommended in HD Diagnostic.

- C Drive: Passed all tests.

- Generic USB SD: Fail: Short Generic/Long Generic

- Generic USB CF: Fail: Short Generic/Long Generic

- Model IU (umlaut over the U) (Firmware revision: RAEEDOR) I'm not sure what drive this is but I presume it's the CD ROM:
Fail: Short DST/Long DST/Short Generic/Long Generic

I don't undersand how to update those drivers. I updated five using the device manager. I could not find the last two:

intelide.sys Thu Nov 02 04:51:35 2006
crcdisk.sys Thu Nov 02 04:52:27 2006

As mentioned the PC does not shut down. It just hangs on a blue screen for a while after logging in.

richc46 · Feb 3, 2011

Forget about those two drivers, those are Microsoft drivers. Just be sure that you use automatic update. You willl get new MS drivers as needed.

Ok if you get any other BSODs just post them

Playdo · Feb 3, 2011

Yes, it's set to automatic update. What could be the cause of the blue screen issue that I have?

Playdo · Feb 3, 2011

Apologies, I think I was suppose to perform SFC/scannow? (I presumed it was only if the PC was overclocked).

The results of the System Health Report showed that the RAM was too low. Could this make the drivers take a long time to load, causing the blue screen?

What's the purpose of that Extract Files From Vista DVD link? The PC came without an original Vista CD. It came with the manufacturers re-installation CD and a restore setting directly on the PC.

Btw Malwarebytes showed no viruses.

richc46 · Feb 3, 2011

Playdo said:
Apologies, I think I was suppose to perform SFC/scannow? (I presumed it was only if the PC was overclocked).

The results of the System Health Report showed that the RAM was too low. Could this make the drivers take a long time to load, causing the blue screen?

What's the purpose of that Extract Files From Vista DVD link? The PC came without an original Vista CD. It came with the manufacturers re-installation CD and a restore setting directly on the PC.

Btw Malwarebytes showed no viruses.

Yes, RAM could be the cause of all this. I will give a Memory test, lets be sure that the problem does not go further than appears now.
The SFC will find and repair any System corruption that it finds. If any is found run 3 times.
LOL the extract file was not for you. Im working on several BSODs
Download memtest86 and test RAM
www.sevenforums.com/tutorials/105647-ram-test-memtest86.html
Run for 8 passes
If passes try a good stick in each slot for 3 passes
If fails do the same for 8 passes.

BSOD - Report - Help Needed

Playdo

My Computer

System One

richc46

My Computer

System One

Playdo

My Computer

System One

richc46

My Computer

System One

Playdo

My Computer

System One

richc46

My Computer

System One

Playdo

My Computer

System One

Playdo

My Computer

System One

richc46

My Computer

System One