[Massacher]

since installing it yesterday.

the first culprit was winamp so i uninstalled that, then randomly while doing stuff in and around the desktop (copying files and whatnot). and now twice while trying to reget my Steam cache. here are the BSODs that i have been getting. the first two only once each, the third i have been getting repeatedly.





here is my HJT log (it gave some errors when i went to use it but it still works):

Logfile of HijackThis v1.99.1
Scan saved at 22:17:24, on 04/20/2008
Platform: Unknown Windows (WinNT 6.00.1905 SP1)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Running processes:
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files (x86)\PowerStrip\PStrip.exe
C:\Program Files (x86)\RivaTuner v2.08\Tools\RivaTunerStatisticsServer\RivaTunerStatisticsServer.exe
C:\Program Files (x86)\RivaTuner v2.08\RivaTuner.exe
C:\Program Files (x86)\Google\Google Talk\googletalk.exe
C:\Program Files (x86)\Valve\Steam\Steam.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdmcks.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [RivaTunerStatisticsServer] "C:\Program Files (x86)\RivaTuner v2.08\Tools\RivaTunerStatisticsServer\RivaTunerStatisticsServer.exe" /s
O4 - HKLM\..\Run: [googletalk] "C:\Program Files (x86)\Google\Google Talk\googletalk.exe" /autostart
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files (x86)\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Startup: PowerStrip.lnk = C:\Program Files (x86)\PowerStrip\PStrip.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files (x86)\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files (x86)\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files (x86)\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files (x86)\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: Ugtrdrto - Unknown owner - (no file)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

edit

forgot to mention its the Ultimate Edition

[Massacher]

okay, this is just beyond frustrating now. 4th re-install and still getting blue screens. why is this happening?
the blue screen this time was the IRQL_NOT_LESS_OR_EQUAL again.

[adyextreme]

Hy y observe you have only old programes. some incompatible with vista does not mather 32/64.
1PowerStrip...bad for vista....2Avast4.not enirely compatible..try Kaspersky instead....3RivaTuner v2.08...do not use twicking tools...install latest oficial drivers...4Spybot-S&D IE Protection..unnecesary prog vista has win defender....5Acrobat 6.0...try using latest..i think v9.....6Free Download Manager...may conflicting with vista....besides you have deleted some services...
best to fix CLEAN INSTALL.... DO NOT INSTALL UNNECESARY SOFTWARE SPECIALY SECURITI OANCE TRY IN FUTURE TO INSTALL ONLY WHAT YOU NEED.... DONT USE OLD PROGS ESPECIALY GNU ....
VISTA IS NOT XP, BE CAREFUL WHAT PROG YOU INSTALL..EVEN THE PRODUCER SAY (VISTA COMPATIBIL) THE MOST OF THE TIMES ARE LIES..... SEARCH THE FORUMS OF ANIE KIND OF PROG'S YOU WANT TO INSTALL,USE IT MAY NOT WORK UNDER VISTA

sory for the bad english hope ill healpt

[Rollin' Rog]

Make sure you have the latest service pack and hotfixes; here's is a google search on one of the more unusual code errors seen in your BSODs:

http://www.google.com/search?client=...utf-8&oe=utf-8


They are random enough to suspect a hardware issue -- especially if you have received them after a clean install.

Vista has a built-in memory checker, try that: run mdsched.exe read the additional info and run the extended tests.

Or build a memtest86 bootable test.

Also, I probably won't see much that you haven't already given the circumstances but >>

1 > create a new folder on the desktop and call it "dumpcheck" or whatever you like
2 > navigate to %systemroot%\minidump and copy the last few minidump files to that folder.%systemroot% is normally c:\windows. They are numbered by date. You can paste that address in address bar to get there.
3 > close the folder and right click on it and select Send to Compressed (zipped) Folder.
4 > use the "manage attachments" in the "advanced" reply window to upload that zip file here as an attachment.

This might point us to a non-system driver causing the error, if one exists for it.

Since almost all bugchecks can be caused by faulty ram, I would recommend you perform memory tests.

Beginners Guides: Diagnosing Bad Memory


Memtest86 - A Stand-alone Memory Diagnostic

[Massacher]

here are the dumpchecks.

i am going to start memory testing.

[Rollin' Rog]

I looked at the last 4 or 5; two of them indicated "memory corruption" and this usually means ram.

One was for a 3rd party utility.



BugCheck 3B, {c0000005, fffff80001c56b4d, fffffa600a537230, 0}

Probably caused by : memory_corruption ( nt!MiComputeImagePteIndex+3d )

----------------------------------------------------------
BugCheck A, {fffffa9a42516618, 2, 1, fffff80001d45d23}

Unable to load image \SystemRoot\system32\DRIVERS\symsnap.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for symsnap.sys
*** ERROR: Module load completed but symbols could not be loaded for symsnap.sys
Probably caused by : symsnap.sys ( symsnap+7e1a )

Path found: C:\ WINDOWS\ system32\ drivers\ symsnap.sys
Version: 6.0.1.21380
Company: StorageCraft
Product: StorageCraft Volume Snap-Shot Development Edition
Description: StorageCraft Volume Snap-Shot

===============================================

You might try swapping out ram modules if you have more than 1.

[Massacher]

i tested each memory stick, in slot 1 with Memtest86+ v2.01, using the Standard test, all returned with no errors.

the details of stick 1 in slot 1 are:

S/N: 200732507052
P/N: 78.01G9I.9L4
1GB UNB PC2-6400 CL5

the details of stick 2 in slot 2 are:

S/N: 200807407573
P/N: 78.01G9I.9H4
1GB UNB PC2-6400 CL5

the details of stick 3 in slot 3 are:

S/N: 200732507051
P/N: 78.01G9I.9L4
1GB UNB PC2-6400 CL5

the details of stick 4 in slot 4 are:

S/N: 200807407572
P/N: 78.01G9I.9H4
1GB UNB PC2-6400 CL5

so i think that rules out that it's the memory?

edit: i looked in Services (services.msc), for SymSnap.sys and i found 2 entries containing this name.
Symantec SymSnap VSS Provider and SymSnap Service. the SymSnap Service is disabled, as i disabled it in msconfig, since i only use Norton Ghost when i need to ghost or restore something. the VSS Provider is on automatic. could this be the cause?

[Rollin' Rog]

Verify you have actually done a completely "clean" install and had these BSODs continue?

Can you bypass your wireless connection and still receive these BSODs?

What repeating errors are you seeing in the Event Viewer Systems log (run: eventvwr.msc)



>>> You might also want to give "Driver Verifier" a shot:

Windows has a built in driver tester that may find something.
Before using it you must ensure that you can start in Safe Mode and return from it. If verifier issues a STOP screen, rebooting in Safe Mode is the only way to reset it.

In its default configuration verifier tests "unsigned" drivers, but you can have it test all drivers under maximum conditions.

There's less to it than meets the eye in this MS article:

http://support.microsoft.com/default...b;en-us;244617

To run verifier simply go to Start > run and enter:

verifier.exe

and select "standard configuration" and follow the prompts.
It will run on the next reboot. If it finds something you will get a Blue Screen STOP message.
Ignore the STOP parameters -- they are specific to verifier. The only thing important is the driver file name if it finds one.

If you get a STOP screen you will have to reboot to Safe Mode and run verifier again and have it "delete existing settings"

If you do not get a STOP message you can run it again checking all drivers; driver verifier will continue to run on every boot up until you run:

verifier /reset

or use the graphical interface to delete existing settings.

[Massacher]

Originally Posted by Rollin' Rog

Verify you have actually done a completely "clean" install and had these BSODs continue?

Can you bypass your wireless connection and still receive these BSODs?

it is a clean install, hardly anything installed in Vista at all.
my connection isn't wireless...it is a ADSL2/2+ using ethernet.
i haven't gotten any BSODs today, though i haven't been in Vista all that much, infact i rarely use it, and when i do, it is for games that use DX10 and when i want to use my entire memory capacity.

i will try Driver Verifier if i receive any more BSODs. do i go into safe mode with networking on or just standard safe mode?

To run verifier simply go to Start > run and enter:

verifier.exe

i do this in safe mode?

[Rollin' Rog]

Standard Safe Mode -- you don't need to be online.

Typically the BSOD will continue every startup in normal mode until you reset verifier.

The only reason why you might want Safe Mode with Networking is if you wanted to download a new driver update and couldn't boot in normal mode.

By the way if you don't need more than 4gb (approximately) ram -- there really isn't much to recommmend 64 bit Windows.

[Massacher]

okay, i ran verifier.exe in default mode and it verified the drivers.
i rebooted into safe mode to reset it using "Delete existing settings".
no Blue Screen STOP messages appeared on the first run.

once i was back in regular XP i ran it again this time choosing to verify all drivers. rebooted and again no Blue Screen STOP message.

then when i was back in regular XP i ran it again to "Delete existing settings" and it said no changes had been made. so i went into safe mode to do the same and it deleted the existing settings. as i shutdown regular XP to do this i got a Blue Screen STOP message with a error telling me that a driver attempted to corrupt the system on the kernel stack and it had a error code of 0x0000004 and a long string of other numbers and letters after it.

so i guess it found the problem?

so what do i do now?

[Rollin' Rog]

If this was the error parameter -- it was a verifier detected error:

0x000000C4: DRIVER_VERIFIER_DETECTED_VIOLATION

However that does not tell us the driver.

If this was the error, first time I've seen one: >> 0x00000004: INVALID_DATA_ACCESS_TRAP

http://www.microsoft.com/technet/pro....mspx?mfr=true

Zip and upload the minidump created and we should be able to read it.

[Massacher]

okay here is the minidump, from XP, i hope that is what you meant?

[Massacher]

i did a full clean install of both XP and Vista x64 over the last few days. i got things back to running how i require them to. upon installing Norton Ghost 14, in Vista, i got a BSOD with IRQL_NOT_LESS_OR_EQUAL. upon restoring my Steam directory (which contains HL2, Ep1 and Ep2 only), i got a BSOD with PAGE_FAULT_IN_NON_PAGED_AREA, so i found the culprit!

also today when installing Age of Conan i got a BSOD, no specific error, just the standard blue screen, i didn't really look and i can't remember now. anyway that game is buggy at the moment, so no surprise that this happened.

here is a dump check. btw how do you view these files so they are legible?



edit: i checked event viewer and the majority of the errors were caused by Avast scanning some MSN Messenger log files and other MSN Messenger files.

AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of C:\Users\Massacher\AppData\Local\Microsoft\Messenger\massacher@hotmail.com\ SharingMetadata\Working\database_3AA8_1D99_A81D_552B\fsr.log failed, 00000005.

and also of course Age of Conan.exe:

Faulting application AgeOfConan.exe, version 1.0.0.0, time stamp 0x483ebab0, faulting module AgeOfConan.exe, version 1.0.0.0, time stamp 0x483ebab0, exception code 0xc0000005, fault offset 0x00b9fe0b, process id 0xfb8, application start time 0x01c8c6f8049175fa.

explorer also caused an error:

The program Explorer.EXE version 6.0.6001.18000 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 7c8 Start Time: 01c8c637f912615d Termination Time: 0

[Rollin' Rog]

Sorry I missed your June 2 follow- up. The "XP" crash was with Nivida.

The recent Vista 64 bit crashes are pretty much duplicates of what we've seen before -- memory and pool corruption.

However these are clearly occuring AFTER you have installed new, possibly incompatible, programs -- and you should be very slow about doing this after a clean install.

One of the errors was an exact repeat of this one:

BugCheck A, {fffffa9a42516618, 2, 1, fffff80001d45d23}

Unable to load image \SystemRoot\system32\DRIVERS\symsnap.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for symsnap.sys
*** ERROR: Module load completed but symbols could not be loaded for symsnap.sys
Probably caused by : symsnap.sys ( symsnap+7e1a )

Path found: C:\ WINDOWS\ system32\ drivers\ symsnap.sys
Version: 6.0.1.21380
Company: StorageCraft
Product: StorageCraft Volume Snap-Shot Development Edition
Description: StorageCraft Volume Snap-Shot

By the way "page fault in non-paged" area means the read or write error is occuring in physical ram memory itself. In this case I can see that there is an issue with registry data that has been paged out to ram.

The Non-Paged area. Parts of the System which are so important that they may never be paged out - the area of RAM used for these is called in XP the ‘Non-Paged area’. Because this mainly contains core code of the system, which is not likely to contain serious faults, a Blue Screen referring to ‘Page Fault in Non-Paged area’ probably indicates a serious hardware problem with the RAM modules, or possibly damaged code resulting from a defective Hard disk. It is, though, possible that external utility software (e.g. Norton) may put modules there too, so if such faults arise when you have recently installed or updated something of this sort, try uninstalling it.

>> http://www.aumha.org/win5/a/xpvm.php