[othersteve]

Hey guys,

So I thought I had this one solved, but apparently not, as it just happened again to me today. It occurs about once every other day, mostly when I've got a lot of things open at once. I have already run a Memtest86+ on the RAM, as well as hard drive diagnostics, and both passed with no problems. I also updated to the latest BIOS, as well as the newest video driver for my card. I'm completely stumped. I tried analyzing my minidumps, but I'm not very good at that apparently as I really couldn't make heads or tails from the results.

My computer is a Dell Dimension E521:
AMD Athlon X2 3800+
2 GB DDR2 RAM
GeForce 7300 LE

I am running Trend Micro Internet Security 2007, office, web browsers, business accounting software (sometimes), Google Desktop w/ sidebar, and that's generally about it. I'm completely at a loss.

Help me, TSG! Thank you in advance.

Steve

[Rollin' Rog]

I can run a debugging utility on the dump files if you do this:

1 > create a new folder on the desktop and call it "dumpcheck" or whatever you like
2 > navigate to %systemroot%\minidump and copy the last few minidump files to that folder.%systemroot% is normally c:\windows. They are numbered by date. You can paste that address in address bar to get there.
3 > close the folder and right click on it and select Send to Compressed (zipped) Folder.
4 > use the "manage attachments" in the "advanced" reply window to upload that zip file here as an attachment.

This might point us to a 3rd party driver causing the error, if one exists for it.

[othersteve]

Hey Rollin',

Thanks man. I'll be back at work on the computer tomorrow, so I'll definitely do that then.

Steve

[Rollin' Rog]

Okeedoke

You might as well post a HijackThis scanlog too, while you are at it:

Download and install HijackThis using the "self extractor". Run it and select "do a system scan and save the log file". Then copy/paste the contents of the log to a reply

http://www.thespykiller.co.uk/files/hijackthis_sfx.exe

[cuttlefish]

Had the same BSOD myself a couple of days back - started in safe mode, did a system restore and all fine again!

Not a pretty sight is it? Yer pucker factor gets up around the nine mark!

[othersteve]

Yeah, I tried system restore and all that a while back... not really sure what's up. Either way, here's the minidumps you asked for.

Also, I have attached a HijackThis log, though I'm sure I'm wasting your time with it, because I actually specialize in computer security and I go through it almost weekly.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:40 AM, on 7/20/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\Windows\STTRAY.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\system32\hpu4prop.bin
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\WorldCard\Bin\OlDock.exe
C:\PROGRA~1\Penpower\iScan2\Bin\iScan3.exe
C:\PROGRA~1\Penpower\IDEVIC~1\Bin\IDEVIC~1.EXE
C:\Windows\SnapTrap.exe
C:\PROGRA~1\WORLDC~1\Bin\DuetCtrl.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\LocalComputerEase\mm.exe
C:\Program Files\LocalComputerEase\mmr.exe
C:\Program Files\Maxthon2\Maxthon.exe
C:\Program Files\LocalComputerEase\mm.exe
C:\Program Files\LocalComputerEase\mmr.exe
E:\Tools\HijackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.othersteve.com/startusab.html?zip=40218
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=4061219
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: AutorunsDisabled
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cpso-support-new/S...dObjSigned.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://www.mycomputerease.com/Citrix...a32/WFICAT.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1166732393937
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://www.driveragent.com/files/driveragent.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security 2007\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security 2007\PcScnSrv.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security 2007\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security 2007\tmproxy.exe

Thanks again for the help.

Steve

[othersteve]

Also, FYI:

"ComputerEase" is our accounting software. So although these:

C:\Program Files\LocalComputerEase\mm.exe
C:\Program Files\LocalComputerEase\mmr.exe
C:\Program Files\LocalComputerEase\mm.exe
C:\Program Files\LocalComputerEase\mmr.exe

May look malicious, they're actually not.

Though it is interesting that two different instances were running here. I closed one of them. :P

[Rollin' Rog]

The majority of faults look like this:

BugCheck 10000050, {ffff74e9, 0, 81c81733, 0}

Probably caused by : afd.sys ( afd!AfdFastDatagramSend+5ba )

BugCheck 1000008E, {c0000005, 81c81733, 95abb880, 0}

Probably caused by : afd.sys ( afd!AfdFastDatagramSend+5ba )

Although some are occuring in a Trend driver. It's possible something Trend is doing is contributing to this.

All seem to involve browser (Maxon or IE) or google desktop processes.


Afd.sys is a networking (winsock related) driver.

http://www.file.net/process/afd.sys.html
http://www.google.com/search?hl=en&s...om&btnG=Search

It would be interesting to see if you could get any stops without a network connection.

My gut feeling is there is a memory resource problem caused by some networking activity.

Why don't you try doing some "clean boot" troubleshooting to see if any running startups are involved in this:

Run msconfig and select the "Services" tab. Check "Hide Microsoft Services" and then disable the rest. Also uncheck "load startup group" on the general page.

See this link for detailed information:


http://support.microsoft.com/kb/929135

Now restart and test the issue at hand

If no problems, run msconfig and recheck half the disabled items on the Services tab. Test again. If the problem recurs, UNcheck half the items you just checked to narrow down the culprit.

If the problem didn't occur, check the other half, so all the Services are enabled -- proceed to do this on the startup tab as well.

Get the idea? You want to isolate the problem to a specific startup if possible.

Note: if you already have items unchecked under msconfig > startups and are in “selective” startup mode – you should note what these are before beginning. They will need to be de-selected again.

[othersteve]

Rollin',

Thanks again man. I'll start the testing this afternoon and I'll let you know how it goes. This seems to be quite a tricky issue, so if I come to a clear culprit, I will be certain to fill everyone in completely in case others run into the same situation.

Also, FWIW, my feeling regarding the Trend issue was that since it is involved in real-time scanning, it might be blamed by the system when trying to access files in the problematic memory location, but that it probably has very little to do with the actual issue. It seems like you feel the same way about it being something more foundational than that, but I thought I'd offer my hunch anyway.

[Rollin' Rog]

I would probably start by either uninstalling or disabling Trend completely.

You should be able to complete disable it using the msconfig method.

There were 2 similar to this:

BugCheck 10000050, {b70f1055, 0, 81c81733, 0}

*** WARNING: Unable to verify timestamp for tmtdi.sys
*** ERROR: Module load completed but symbols could not be loaded for tmtdi.sys

Could not read faulting driver name
Probably caused by : tmtdi.sys ( tmtdi+e1e4 )

Some of these checks show up times greater than 2 days -- so there could be a memory leak involved.

......