[CloudE Computing]

Hello,

Rollin' Rog - I hope you're listening.

I'm asking for help with my Bluescreen error. (I am attaching a picture of the bluescreen.) Tech Info: 0x0000007F (0x00000008, 0x803D3130, 0x00000000, 0x00000000)

I am running Vista Home Premium on a Dell Studio 1737. The error/BSOD comes up when I am connected to SonicWall VPN and using a wireless internet connection.

I also am attaching a copy of my minidump folder. Please note that even though during the past three days the problem has occurred for me about 10 times, the last minidump recorded was on Jan. 8, 2009.

Please let me know what other information might be needed and thank you for your help.

Jonathan

[Rollin' Rog]

Don't know why you stopped getting dump files -- but the last 2 are indeed 7F errors and the program involved seems to be this one >>

http://www.file.net/process/dne2000.sys.html << Just for info -- do not run any "scans" off that page.

BugCheck 1000007F, {8, 803d3130, 0, 0}

Unable to load image \SystemRoot\system32\DRIVERS\NETw5v32.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for NETw5v32.sys
*** ERROR: Module load completed but symbols could not be loaded for NETw5v32.sys
Probably caused by : dne2000.sys ( dne2000+13135 )

What can I say? Reinstall the program or decide whether it is really something you need at all.

If you need it, and reinstalling doesn't help -- I would contact the vendor.

This appears to be a related vendor site, but I will leave you to determine that or the applicability of their fixes and suggestions .>

http://www.citrix.com/lang/English/lp/lp_1680845.asp

[CloudE Computing]

I'm noob enough to not know which program this involves. Can you tell me which one it is or how I can figure it out? And thank you again.

[CloudE Computing]

I uninstalled and reinstalled the software. That seems to have done it. (I'm just playing a waiting game now.) Thank you for your help.

[Rollin' Rog]

You're most welcome and good luck. I wouldn't have known which program it might have been without a HJT log anyway.

[CloudE Computing]

Hello,

I was wrong. The blue screen struck again today. I was not at my computer when the BSOD popped up, but I saw it restart. I believe the program triggering it is my SonicWall VPN. This program is essential to my ability to do my work. I uninstalled the program and ran a "scrubbing" program that removed all traces of the DNE. Then I reinstalled it from scratch. I ran it for most of yesterday (hence the "Solved"), but this morning the computer reset again. (NOTE: I checked th minidump folder - but again, there was no file for any date more recent than Jan. 8.)

Once again I am at a loss and I look to you for help.

Thank you again and please let me know if you have any additional suggestions. I will gladly send you any more information that you think might help.

Best regards and my gratitude,

Jonathan

[Rollin' Rog]

Let's see if we can figure out why no new dumps are being created. For an error like this one they should be.

Run sysdm.cpl and select Advanced > Startup and Recovery.

Under System Failure a check should be in "write an event to the system log" (this does not actually involve the minidump folder, but the event viewer log)

If you still find no minidump log after the below, check the Event Viewer > System log for "Save Dump" entries and copy that.

>> Make sure "Automatically Restart" is UN checked (this will stop things on the Blue Screen and allow you to read the data). If nothing else, copy the error parameters and look for a driver file that might be mentioned.

>> Under "Write debugging information", make sure "Small memory dump" is selected.

>> Under "small dump directory" make sure the path reads %SystemRoot%\Minidump


Some types of BSODs do not always produce dump files -- usually because the hard drive is taken out of action when they occur.

We need to know if the same file driver and BSOD type is occuring here.

For general purposes you should probably test the ram and run chkdsk on the drive.

For ram testing you can run mdsched.exe. When presented witht the User Interface after reboot, press F1 for advanced options and run the extended test.

The log for chkdsk will be available in the Event Viewer Applications log > Wininet entry after reboot. This can be copied to a text file for uploading.

Also, let me see a HijackThis Scanlog >>

Download and install HijackThis. Run it and select "do a system scan and save the log file". Then copy/paste the contents of the log to a reply

http://www.trendsecure.com/portal/en...ols/hijackthis

[CloudE Computing]

Hello and thank you again. I have tried to do everything that you told me to, but had only partial success following your directions. The following are the results:

1) I checked – and confirmed – that under Advanced > Startup and Recovery and further under System Failure there is (and has been) a check in "write an event to the system log." (I think I understand from what you wrote that this does not solve the minidump problem.)

2) I was able to open the Event Viewer. However, I am unsure as to how to identify "Save Dump" entries and so I’m not sure if I copied it correctly. (In the hopes of helping, I took a screen shot of my “Event Viewer” and pasted it into a WORD document which is attached.) If you could – and my apologies for having to ask – please provide me with the minutiae of what to do in order to copy the files/folder then I will do so. I did create an “.evtx” file, but it is 13 MB in size. So I tried again, this time copying only the files in the event viewer from the last time it bluescreened. (I know the time of the last BSOD incident because under "Write debugging information", "kernel memory dump" had – prior to your instructions – been selected. This saved a MAMMOTH – 382 MB – “MEMORY.DMP” file in my C: drive.) Anyway, I saved the Event files from that time in a smaller “.evtx” file. Unfortunately, I am unable to attach the file.


3) I confirm that I did all of the following:

> Made sure "Automatically Restart" is UN checked (this will stop things on the Blue Screen and allow you to read the data). If nothing else, copy the error parameters and look for a driver file that might be mentioned.
[NOTE: During one blue screen error, I took a photo and pasted it above. (Please see my first entry.) I did not get a blue screen error today so I have no new information and cannot “copy the error parameters and look for a driver file that might be mentioned.”]

> Under "Write debugging information", I selected "Small memory dump."

> Under "small dump directory" I made sure the path reads %SystemRoot%\Minidump


4) I ran the extended RAM test. No problems/errors were found.

5) I could not locate the log for chkdsk in the Event Viewer Applications log > Wininet entry after reboot. Again, any specifics here would help.

Not sure where it can from or what I did to generate it, but there is now a file on my Desktop titled, “LocaleMetaData.” It, however, is 10 MB so I cannot send it to you.

6) Here is a copy of the HijackThis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:14:54 PM, on 2/8/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Program Files\Norton AntiVirus\Engine\16.2.0.7\ccSvcHst.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Dell\DellDock\DellDock.exe
C:\Windows\Explorer.EXE
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe
C:\Program Files\Logitech\SetPoint\LBTWiz.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Dell Remote Access\ezi_ra.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVpnClient.exe
C:\Program Files\PdaNet 4.12\PdaNet.exe
C:\Program Files\PdaNet 4.12\PdaNetUm.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\mmc.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.2.0.7\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Dell Webcam Central] "C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" /mode2
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [Dell DataSafe Online] "C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe" /m
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "c:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Bluetooth Connection Assistant] LBTWIZ.EXE -silent
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [HotSync] "C:\Program Files\PalmSource\Desktop\HotSync.exe" -AllUsers
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe
O4 - Startup: PdaNet Desktop.lnk = C:\Program Files\PdaNet 4.12\PdaNet.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Dell Remote Access.lnk = ?
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe
O4 - Global Startup: SonicWALL Global VPN Client.lnk = C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVpnClient.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_2ba5baa4\aestsrv.e xe
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - Dell Inc. - c:\ProgramData\SingleClick Systems\Advanced Networking Service\hnm_svc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe
O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.2.0.7\ccSvcHst.exe
O23 - Service: SonicWall VPN Client Service (RampartSvc) - SonicWALL, Inc. - C:\Program Files\SonicWALL\SonicWALL Global VPN Client\RampartSvc.exe
O23 - Service: SupportSoft Sprocket Service (DellSupportCenter) (sprtsvc_DellSupportCenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_2ba5baa4\STacSV.ex e
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe

--
End of file - 10138 bytes

[Rollin' Rog]

You need to be looking at the Applications log for Wininit (mispelled it previously). See attachment.

BSOD screens, unfortunately do not always show the driver itself.

Sorry, again, "SaveDump" is the XP version of the System Log Event error. In Vista it is called "BugCheck" See the 2nd attachment. I had to dig for a recent one of my own. Unfortunately these don't seem to show a driver either.

>> Regarding the lack of minidumps now -- are you using any "cleanup" tool such as CrapCleaner? These will remove them.

Remember you want the "small" memory dump, not the big one. I can't work with those. If you had the "large" dump selected previously, that would explain the lack of minidumps.

You might try the "Clean boot" again -- just leave the Sonic VPN drivers enabled and HIDE the Microsoft ones -- so they are not disabled.

[CloudE Computing]

Hello and thank you very for your time.

I returned to your first response and found the solution was the DNE. I uninstalled the VPN and also ran a "scrubbing" removal tool. Then, I followed the instructions on the CYRIX link. I reinstalled the software and - so far - no problems.

I continue to be grateful for the time you gave to helping me.

I wish you continued success in helping others. May the puzzles be interesting to you and may you find all the answers.

Thank you.

[Rollin' Rog]

You're most welcome; glad to see you sorted it out and thanks for the kind words.