Solved: SAME PROBLEM HERE! please help...

[xartz]

Please Rolling Rog
I have the same problem for ever since I bought the new comp. (Sep 2009)

My BSOD comes when I quickly navigate the explorer. With a lot of other background programs are runninng.
I mean basically during heavy disk usage. And some times when i am not attending the comp it has restarted probably due to the BSOD.

PLEASE HELP ME thank you.

PS>I registered here coz i found this link http://forums.techguy.org/windows-vista/848172-blue-screen-death-page-fault.html while googling. The thread was closed.

windows 7(32)

 

[Rollin' Rog]

I have just looked at the first and last for now -- there is no faulting driver mentioned and the error type is often associated with hardware such as faulty ram.

However I see Folder Lock in your module list as well as virtualization/cloning software and the Comodo Firewall. These programs are not going to play well together.


I would start by uninstalling Folder Lock. All such programs are incompatible with both Vista and Win7 in my experience.

If uninstalling Folder Lock does not resolve the problem -- uninstall the Comodo Firewall as well and just use the Windows Firewall.

Upload any new minidumps for BSODs received after that.

Also check the reliability monitor to see what you installed around 3/22 -- as that is when they seem to have begun.

http://www.addictivetips.com/windows-tips/windows-7-reliability-monitor/


In the future please always start new threads for problems and do not "piggyback"

 

[xartz]

I have just looked at the first and last for now -- there is no faulting driver mentioned and the error type is often associated with hardware such as faulty ram.

However I see Folder Lock in your module list as well as virtualization/cloning software and the Comodo Firewall. These programs are not going to play well together.


I would start by uninstalling Folder Lock. All such programs are incompatible with both Vista and Win7 in my experience.

If uninstalling Folder Lock does not resolve the problem -- uninstall the Comodo Firewall as well and just use the Windows Firewall.

Upload any new minidumps for BSODs received after that.

Also check the reliability monitor to see what you installed around 3/22 -- as that is when they seem to have begun.

http://www.addictivetips.com/windows-tips/windows-7-reliability-monitor/


In the future please always start new threads for problems and do not "piggyback"

Thanks for taking ur time for me !!

> I dont have comodo firewall anymore. (uninstalled few days back)
>I ll try uninstalling folderlock now

Again thanks

 

[xartz]

This is a screen shot of the reliability monitor. But there seems to be no new installations though.
I uninstalled the Folder Lock 6 now. Co crashes yet.
The text file is a remaining file from the folder lock dir, there are some memory addresses in there. Could they be any resemblance to the issue?

Would you be kind to look into the matter if the problem arises again?

PS: As you can see Google Chrome crashes too often. Sometimes 20+ times a day. Is this a bug in Chrome or something wrong in my side?

Thanks

 

[Rollin' Rog]

I'm not sure what the problem with Chrome might be or whether it was related to Comodo or Folder Lock.

But check the informational event on the 27th -- and see if anything was installed there.

If no further issues after Folder Lock is gone then I think you have the answer.

I don't know what the Folder Lock text represents, it appears to some kind of error log. But I would just delete the folder for it one way or another and anything else you see for it that remains after the uninstall.

 

[xartz]

The problem isnt fixed
Windows crashed today once. And this is the last minidump.
What should I do?

EDIT : This time the BSOD didnt say "pagefault in nonpaged area".

 

[Rollin' Rog]

BugCheck 1000007F, {8, 807e9750, 0, 0}

*** WARNING: Unable to verify timestamp for OADriver.sys
*** ERROR: Module load completed but symbols could not be loaded for OADriver.sys
Probably caused by : OADriver.sys ( OADriver+2aa5d )

Looks like your Online Firewall --

I would uninstall that and just use the Windows Firewall.

The problem with this sort of bugcheck is that it is a "double fault" so that there is likely another conflict contributing as well.

Folder Lock does not seem to be fully uninstalled -- either that or it installs malware >>

Module load completed but symbols could not be loaded for WinVd32.sys

http://www.google.com/search?hl=en&...2.sys+folder+lock&aq=o&aqi=&aql=&oq=&gs_rfai=

I would also uninstall Daemon Tools or any cloning wares until this is resolved

Module load completed but symbols could not be loaded for sptd.sys

 

[xartz]

Yes I installed Online Armor Firewall. Ok I 'll try removing that.
How can I remove remaining parts of the Forlderlock? The uninstaller is gone !
Deamon tools also was removed long ago, and only Alcohol is there. I think none of my software is being removed properly!!! Do you think rev Uninstaller etc will help?

Don't know if this is a contributing factor but my NOD32 antivirus shows that there is a win32 Olmarik trojan in the system memory but it's unable to clean it. Even Spyware terminator wont catch it. I saw in some sites it's really looong process to remove it. Is there any easy ways?

thanks

 

[Rollin' Rog]

You might try reinstalling Folder Lock, then booting up in Safe Mode and uninstalling it from there.

I'm not really familiar with the Revo uninstaller, but it probably won't hurt to give it a try. It may need the original program to be reinstalled first though to have access to its uninstall information.

For the trojan issue there is not much I can do for you -- I would recommend trying a post in the Malware forum with a HijackThis scanlog -- but they are very busy there and you may or may not get timely help.

 

[xartz]

Rev uninstaller completely removed folder lock (i saw it remove the registry keys and remaining files.)
We'll see if the problem persists. (no crashed today, but dont close the thread for a while)

Is removing Olmarik trojan really necessary? i saw that it's not easy. Can you recomend a software that i can use for that?

Thanks

 

[Rollin' Rog]

The really tough trojans (and this may be one) require special tools which I do not run -- but the folks in the Malware forum (if you can get one) do.


But have a look at some of the free programs available. >> http://www.techsupportalert.com/best-free-rootkit-scanner-remover.htm

 

[xartz]

Well i poped the question in the geekstogo.com waiting for someone to help.
I wonder why the NOD 32 virus scanner cant remove it (any virus scanner for that matter) . Be fore i installed nod 32 recently i tried norton and avast. They didnt even recognize it.

 

[xartz]

CRASH BSOD again. <<<<PFN_LIST_CURRUPT>>>>

Happened when shutting down. This isnt ending. What is wrong?

Now the firefox opened a unknown site i didnt even click.
Finding the Best Spyware Blocker.
/?xurl=http://a67990067.cn/5a11RN8L7C3xRpc247663dfc21baad73734f16e53860ff7735Z&xref=http://classicalguitarist.net/search.php
Could this be that Olmarik?

Trojan aside, lets fix this BSOD issue. And Thanks Rollin Rog for helping me out this far. I very much appreciate it.

 

[Rollin' Rog]

I've just pasted the whole minidump here so you can see what I see running. You have unidentifiable drivers running -- some of which are associated with the clone ware you are still running -- but some may be the Trojan.

The red highlighted modules are "unknown" -- no hits in a Google search. The Blue highlighted one is for "sandboxie" -- possibly an issue here.

The nominal fault is a memory corruption one -- but it could be caused by the trojan. However you should run a memory checker to verify the ram >> http://www.sevenforums.com/tutorials/715-memory-diagnostics-tool.html

And verify that you are not overheating.

The process running when the BSOD occured was Sidebar -- so you might want to disable that for the time being; remove all cloning software, and try some of those rootkit scanners.


Loading Dump File [C:\Documents and Settings\Rollin' Rog\Desktop\040910-21543-01\040910-21543-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x84214000 PsLoadedModuleList = 0x8435c810
Debug session time: Fri Apr 9 10:38:16.201 2010 (GMT-7)
System Uptime: 0 days 8:28:26.888
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
......
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 00000000, page frame number
Arg3: 00000000, current page state
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: sidebar.exe

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from 842fd6dc to 842f0d10

STACK_TEXT:
9efe2748 842fd6dc 0000004e 00000099 00000000 nt!KeBugCheckEx+0x1e
9efe2760 842bd34f c0802000 9efe2808 894d4920 nt!MiBadShareCount+0x24
9efe27ac 842b433b 894d4730 88ecf218 894d4730 nt!MiDeletePfnList+0x312
9efe2c14 842b9098 894d4730 894d4730 00000000 nt!MiDeleteAddressesInWorkingSet+0x118
9efe2c40 8445cd22 b1607a27 88ecf218 40010004 nt!MmCleanProcessAddressSpace+0x8c
9efe2cb4 84491151 00000000 871c9c38 00000001 nt!PspExitThread+0x683
9efe2ccc 842bc123 871c9c38 9efe2cf8 9efe2d04 nt!PsExitSpecialApc+0x22
9efe2d1c 842574e4 00000001 00000000 9efe2d34 nt!KiDeliverApc+0x28b
9efe2d1c 773964f4 00000001 00000000 9efe2d34 nt!KiServiceExit+0x64
WARNING: Frame IP not in any known module. Following frames may be wrong.
0978fe18 00000000 00000000 00000000 00000000 0x773964f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiBadShareCount+24
842fd6dc cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiBadShareCount+24

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc007

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x4E_99_nt!MiBadShareCount+24

BUCKET_ID: 0x4E_99_nt!MiBadShareCount+24

Followup: MachineOwner
---------

2: kd> .trap (display trapframe)
*** WARNING: Unable to verify timestamp for TSDDD.dll
*** ERROR: Module load completed but symbols could not be loaded for TSDDD.dll
*** WARNING: Unable to verify timestamp for cdd.dll
*** ERROR: Module load completed but symbols could not be loaded for cdd.dll
*** WARNING: Unable to verify timestamp for sptd.sys
*** ERROR: Module load completed but symbols could not be loaded for sptd.sys
*** WARNING: Unable to verify timestamp for amdxata.sys
*** ERROR: Module load completed but symbols could not be loaded for amdxata.sys
*** WARNING: Unable to verify timestamp for spldr.sys
*** ERROR: Module load completed but symbols could not be loaded for spldr.sys
*** WARNING: Unable to verify timestamp for speedfan.sys
*** ERROR: Module load completed but symbols could not be loaded for speedfan.sys
*** WARNING: Unable to verify timestamp for giveio.sys
*** ERROR: Module load completed but symbols could not be loaded for giveio.sys
*** WARNING: Unable to verify timestamp for ehdrv.sys
*** ERROR: Module load completed but symbols could not be loaded for ehdrv.sys
*** WARNING: Unable to verify timestamp for OAmon.sys
*** ERROR: Module load completed but symbols could not be loaded for OAmon.sys
*** WARNING: Unable to verify timestamp for sp_rsdrv2.sys
*** ERROR: Module load completed but symbols could not be loaded for sp_rsdrv2.sys
*** WARNING: Unable to verify timestamp for OADriver.sys
*** ERROR: Module load completed but symbols could not be loaded for OADriver.sys
*** WARNING: Unable to verify timestamp for aqi1cvjp.SYS
*** ERROR: Module load completed but symbols could not be loaded for aqi1cvjp.SYS
*** WARNING: Unable to verify timestamp for eamon.sys
*** ERROR: Module load completed but symbols could not be loaded for eamon.sys
*** WARNING: Unable to verify timestamp for L1E62x86.sys
*** ERROR: Module load completed but symbols could not be loaded for L1E62x86.sys
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
*** WARNING: Unable to verify timestamp for nvBridge.kmd
*** ERROR: Module load completed but symbols could not be loaded for nvBridge.kmd
*** WARNING: Unable to verify timestamp for RTKVHDA.sys
*** ERROR: Module load completed but symbols could not be loaded for RTKVHDA.sys
*** WARNING: Unable to verify timestamp for drmk.sys
*** ERROR: Module load completed but symbols could not be loaded for drmk.sys
*** WARNING: Unable to verify timestamp for epfwwfpr.sys
*** ERROR: Module load completed but symbols could not be loaded for epfwwfpr.sys
*** WARNING: Unable to verify timestamp for LMIRfsDriver.sys
*** ERROR: Module load completed but symbols could not be loaded for LMIRfsDriver.sys
*** WARNING: Unable to verify timestamp for peauth.sys
*** ERROR: Module load completed but symbols could not be loaded for peauth.sys
*** WARNING: Unable to verify timestamp for secdrv.SYS
*** ERROR: Module load completed but symbols could not be loaded for secdrv.SYS
*** WARNING: Unable to verify timestamp for SbieDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for SbieDrv.sys
*** WARNING: Unable to verify timestamp for ups2501.sys
*** ERROR: Module load completed but symbols could not be loaded for ups2501.sys
*** WARNING: Unable to verify timestamp for 000.fcl
*** ERROR: Module load completed but symbols could not be loaded for 000.fcl
*** WARNING: Unable to verify timestamp for TuneUpUtilitiesDriver32.sys
*** ERROR: Module load completed but symbols could not be loaded for TuneUpUtilitiesDriver32.sys
*** WARNING: Unable to verify timestamp for 078YAJ65.sys
*** ERROR: Module load completed but symbols could not be loaded for 078YAJ65.sys
Couldn't resolve error at 'display trapframe)'

Note the time stamp here >> 078YAJ65 078YAJ65.sys Thu Mar 11 06:11:57 2010 (4B98FA2D)

For what it's worth you could probably solve this problem is the least time by doing a clean install -- followed by a greater awareness of the risks of untrustworth downloads and installs -- particularly from Torrent apps.

 

[xartz]

The minidumps are giving unique problems each time. I doubt there could be RAM problem 'couse the whole machine is still new. (bought last September) but I was facing the BSOD from the begining as I can remember. Could there be a hardware conflict? This is not a branded machine.

Yeah I installed sandboxie yesterday. But its system level driver cant be blamed for all the previous crashes though. And the problem was there even before i installed any cloning apps.

This is really getting tricky. I dont like to bother you sending boring minidumps everytime a BSOD comes. But it cashed again today. what should i do. send that as well?