BSODs and other app and system failures; can't make sense of "debugging" info

[Buckscaper]

Troubleshooting starter

1. Overview of the problem
My relatively new (6 months) Dell notebook started BSODing not long after I got it (of course, right after I loaded my apps and files) and Dell support was no help - their answer for everything is "restore to factory system". Performance has been degrading - multiple BSODs and app failures including Windows Exporer crashes (just happened when I went into the System Information area for the first time in order to get a list of hardware for this post).

More and more the machine is frequently and persistently accessing the HDD when I am, and when I'm not doing anything - this also frequently causes delays in responses while trying to type, or move cursor. Often, the HDD will spin up for no reason and then BSOD.

I can't find any pattern to the problems.

2. Full description of the problem and symptoms

General info is below. However, a screencap of a portion of the windows error reporting in the System Information area is at
http://www.flickr.com/photos/3...set-72157610695431508/

And screen caps of most BSODs can be found at
http://www.flickr.com/photos/3...ets/72157610695431508/
The pics are numbered - higher number is more recent.

And I have all the mini-dump files that I can attach or send or whatever.

The BSODs and application failures seem random though frequent. Windows Explorer fails for no apparent reason - no pattern to when it happens; FF3 fails in the same way; the BSODs can happen at any time with no warning (or, when I feel the HDD spinning like crazy I can usually expect a BSOD.

Lately, things have stopped working:

- Wireless networking stopped working.
- Some features of touch pad stopped working and I get a "DLL didn't load" message at startup but when I tried checking the driver, it wouldn't let me.
- Systray items sometimes there, sometimes not there, sometimes disappear.



3. Did it work normally at one time, or has the problem always existed?
(tell us if it ever worked right. If it did, tell us any changes that you think could've caused the issue, such as new hardware or software you installed, or a possible virus attack, or anything else you might suspect)

The machine worked mostly OK right after purchase (it still had quirks - like the screen flashing on and off during start up; wireless being quirky, HDD churning like crazy for no apparent reason, huge numbers of apps and services and processes running for reasons I don't know). I loaded my apps and anti-malware-virus-etc apps and that all seemed fine aside from issues mentioned. But like all Windows, it would hang, or freeze on shutdown sometimes, etc. Then the BSODs started.

I have dozens of minixxx.dmp files in a minidump folder but I have no idea what they say because the program that MS says I'm supposed to use to read them doesn't work.

4. Is the problem consistent and repeatable, or entirely random, or semi-random?

I have not noticed ANY trends, or patterns whatsoever.

Here are some recent items:
11/28/2008 6:46 PM Application Hang The program firefox.exe version 1.9.0.3224 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 15fc Start Time: 01c9518952c362bc Termination Time: 15

11/28/2008 6:55 PM Application Hang The program firefox.exe version 1.9.0.3224 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 1648 Start Time: 01c9518a7076de59 Termination Time: 47

12/3/2008 11:32 PM Application Hang The program msinfo32.exe version 6.0.6000.16386 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 1260 Start Time: 01c9559f0100ea5c Termination Time: 0



5. I already tried these steps:
(list any troubleshooting steps you've already tried, along with any results you got. Be as specific as you can.)

I have called Dell tech support several times and spent a ton of time on the phone with them - they started shutting stuff down on my machine like AV and Antimalware and Firewall and told me that was the problem and that I should do a factory restore - they couldn't even figure out how to get into the crash reports. I finally gave up with them.

I have tried using the various reporting and debugging tools in Vista and on MS's tech support website but I really have NO idea what I'm doing and don't understand 98% of what I read.

I have used my antivirus, antimalware and other tools to scan and rescan and have found nothing.


6. My software:

My general PC Configuration is: Dell PC 1420, Vista Home Premium (NOT SP1 - I had to use a restore point after the SP1 update caused constant crashes and app failures), auto-updates via Windows Update. Latest updated version of Avast home edition running, along with Windows Defender, Threatfire, AVG Antispyware Free and RUBotted, Malwarebytes Antimalware. Ran manual scans using all of these within last 4 days in Normal Mode, found nothing however RUBotted systray item keeps throwing up alerts about someone running apps remotely on my machine (it tells me to run Housecall online scan but it won't work on my machine - have tried many different ways many different times) but nothing is being logged and when I go into RUBotted itself, it says all is fine.


7. My hardware

* System brand & model, if it?s a pre-built system such as a Dell, HP, Gateway, etc. If it?s not, fill in as much of the information below as you can.

* Motherboard brand & model
* CPU model (and is it overclocked?)
* Video card(s) brand & model
* RAM modules brand & model (the voltage being supplied to the RAM may also be helpful to know, particularly for high-performance RAM)
* Power supply brand & model
* Feel free to add more hardware details that you think might be relevant to the issue

Detailed PC info from System Information tool (I have the full print out but its way long). I don't know where or how to get answers to the other questions listed above.

Item Value
OS Name Microsoft® Windows Vista? Home Premium
Version 6.0.6000 Build 6000
Other OS Description Not Available
OS Manufacturer Microsoft Corporation
System Name DELL-1420
System Manufacturer Dell Inc.
System Model Inspiron 1420
System Type X86-based PC
Processor Intel(R) Core(TM)2 Duo CPU T5450 @ 1.66GHz, 1667 Mhz, 2 Core(s), 2 Logical Processor(s)
BIOS Version/Date Dell Inc. A04, 11/8/2007
SMBIOS Version 2.4
Windows Directory C:\Windows
System Directory C:\Windows\system32
Boot Device \Device\HarddiskVolume3
Locale United States
Hardware Abstraction Layer Version = "6.0.6000.16407"
User Name Dell-1420\Buck
Time Zone Eastern Standard Time
Total Physical Memory 2,037.43 MB
Available Physical Memory 903.45 MB
Total Virtual Memory 4.19 GB
Available Virtual Memory 2.59 GB
Page File Space 2.28 GB
Page File C:\pagefile.sys


8. Other information that might be relevant
(any other information that might be related to the problem)

I have no idea - this post is already huge. I guess a HijackThis log couldn't hurt so here it is.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:24:07 PM, on 12/3/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16757)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\aestsrv.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Common Files\NeatReceipts\DB Controller\NeatReceiptsDBController.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\STacSV.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ThreatFire\TFService.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Windows\system32\taskeng.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\system32\vssvc.exe
C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\system32\taskeng.exe
C:\Users\Buck\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Windows NT\Accessories\wordpad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\msinfo32.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [DELL Webcam Manager] "C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\System32\msconfig.exe" /auto
O4 - HKLM\..\Run: [TMRUBottedTray] "C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [*WerKernelReporting] %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Rapportexe] "C:\Program Files\Trusteer\Rapport\bin\RapportService.exe" -start -after_boot
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-346352627-793983069-637352272-1011\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Buck')
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - (no file)
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O15 - Trusted Zone: http://www.kaspersky.com
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://prerelease.trendmicro-e...Backup_1278/hcImpl.cab
O20 - Winlogon Notify: GoToAssist - C:\Windows\
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NeatReceipts Database Controller - Digital Business Processes - C:\Program Files\Common Files\NeatReceipts\DB Controller\NeatReceiptsDBController.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Trend Micro RUBotted Service (RUBotted) - Trend Micro Inc. - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 10854 bytes

<br

 

[dclive]

C5 (most of the errors I saw in a quick look) are a bad driver. Here's what the MS folks say:

The kernel attempted to access pageable memory (or perhaps completely invalid memory) when the IRQL was too high. The ultimate cause of this problem is almost certainly a driver that has corrupted the system pool.

In most cases, this bug check results if a driver corrupts a small allocation (less than PAGE_SIZE). Larger allocations result in bug check 0xD0 (DRIVER_CORRUPTED_MMPOOL).

Resolving the Problem
If you have recently installed any new software, check to see if it is properly installed. Check for updated drivers on the manufacturer's website.

To debug this error, use the special pool option of Driver Verifier. If this fails to reveal the driver that caused the error, use the Global Flags utility to enable the special pool by pool tag.

For information about the special pool, consult the Driver Verifier section of the Windows Driver Kit.

__

So run verifier, turn on the above, and reboot and repro the problem. Then send me the dumpfiles made -after- that point in time. Also (again after the reboot) run mpsreports, setup-perf version.

I don't want anything prior to the driver verifier change + reboot.

 

[Buckscaper]

Hi,
Thanks for your reply. I actually didn't understand most of what you wrote :-( but I can follow instructions.

Re Driver Verifier - there is something called "Verifier.exe" in my System32 folder but as soon as I start it I'm presented with choices - none of which I understand. Also, none of what is written above under "Resolving the Problem" makes any sense to me. Special pool? Pool tag? Global flags? Can you provide a bit more instruction? I'll be happy to follow thru.

Also, just FYI I've run the Secunia tool several times in the past couple of months and it's not identified any driver problems - just issues with stuff like Flashplayer and such (which Secunia s*cks at dealing with by the way).

Re "repro the problem" - I can't really - the machine freezes, hangs, crashes, BSODs on its own schedule - I don't know why or when.

Re mpsreports -I see you have a link to it in your signature so I'll use that (but you said to wait until after the verifier, etc.)

Sorry but with respect to this kind of stuff my knowledge level is pretty low - it's the reason I have no success using the MS tech support website - they start recommending using this tool and that tool and using all these codes like /a and \p which I have no idea about and no clue where or how to use them. That's why I've had no luck dealing with this on my own over the last 6 months after pouring thru pages and pages at the MS website and not understanding 99% of what I read.

Also, on the BSOD screencaps I posted - you'll see that sometimes a file is mentioned (win32k.sys, or ntfs.sys, or the page file or "bad pool caller") and plenty of times nothing is mentioned - they're frequently different.

Thank you for your help
Buck

 

[Buckscaper]

Just BSOD'd again. This is what happened:
Turned on PC, waited for Vista to boot.
Opened Opera and went to a popular website to check on possible interactions between 2 medications I am taking.
Navigated site for 2 mins and had to click the "BACK" button. (HDD had been churning and churning but I couldn't figure out why since I was only looking at 1 page on a text-based webpage)
BSOD.
(I haven't had a chance to get the screen cap of the BSOD off my cell phone and up to Flickr yet but here's what it said

IRQL_NOT_LESS_OR_EQUAL
<then a bunch of boilerplate text>
Technical Information:
*** STOP: 0x0000000A (0x7F29AC70, 0x0000000Z, 0x00000000, 0x820C5E77)
<then more boilerplate text about collecting data for crash dump, etc...>

I just rebooted and am on now. HDD is pegged as usual.

 

[dclive]

Enable verifier and reboot, then wait until you crash, then reboot, send me the mpsreports computername.cab file and the *.dmp files.

Verifier defaults should be fine for this attempt.

 

[Buckscaper]

During the reboot after enabling verifier Windows Update decided to install the vista sp1 update. As soon as the computer booted, it crashed. I rebooted and I got a message saying something like "windows explorer has stopped working, restarting" and as soon as the window disappeared, another one took it's place saying the same thing. This happened several times and then BSOD again. I'll email you jpgs of the blue screens.

I used a restore point to go back to before the vista update, rebooted, then was able to run MPSreports and I'm sending the .cab file.

Where do I find the *.dmp file you mentioned?

thanks

 

[Buckscaper]

Oh, and now I can't print. Files get stuck spooling to the printer I choose but it never finishes and actually prints.

 

[Buckscaper]

The blue screen caps that go along with the post 2 above this one can be found here:

http://www.flickr.com/photos/3...ets/72157610695431508/

Pic 165 is the BSOD just before turning on verifier - it identified a file I've never seen before - peauth.sys
Pic 166 is the 1st BSOD after turning on verifier
Pic 167 was immediately after the previous one as soon as the machine rebooted - didn't even get to my log in screen.

"Windows cannot repair this computer automatically" is the message I next got when the machine kept rebooting after the windows update.
Pics 168 & 169 show the top and bottom of an error message I've never seen before.

 

[Buckscaper]

There is no minidump (.dmp) file.

As a matter of fact, there is nothing in the c:\windows\minidump\ folder newer than 11/26/2008. I have no idea how that's possible since the BSODs all say they are creating a crashdump file.

 

[dclive]

Is your swapfile located on c:?

 

[KGB]

Whoa, hold the horses here.

By your software description, are you running more than one AV program?
I see Avast AND AVG in your list. Multiple AV programs do not play well together on the same machine.

Try uninstalling one and see what happens.

 

[dclive]

Originally posted by: dclive
Is your swapfile located on c:?

Post to subscribe to topic.

 

[Buckscaper]

Answers in order since my last post:
1. Everything is on C: because there were only 2 factory set-up partitions - c: for everything and d: for Dell's restore in case full factory reset is needed.
2. There is only 1 AV running - Avast. The AVG is their free anti-spyware (not antivirus) product and it plays nice with Avast.

 

[Buckscaper]

By the way, and not that this is "news" my HDD is pegged - 100% activity according to the resource monitor (I don't understand anything else this screen shows other than what the graphs look like when activity is off the charts).

It's been doing this since I turned the machine on a couple of hours ago - this type of activity is usually followed by a BSOD but not always.

The file that is going like crazy all this time is c:\System Volume Information\{d17...............} --between the braces is a ton of numbers and letters

There are a couple of other files similar to that one but together they result in a HDD that has been running at 100% for the better part of 2-3 hours.

Just thought this type of info may help.

thanks

 

[dclive]

Originally posted by: Buckscaper
By the way, and not that this is "news" my HDD is pegged - 100% activity according to the resource monitor (I don't understand anything else this screen shows other than what the graphs look like when activity is off the charts).

It's been doing this since I turned the machine on a couple of hours ago - this type of activity is usually followed by a BSOD but not always.

The file that is going like crazy all this time is c:\System Volume Information\{d17...............} --between the braces is a ton of numbers and letters

There are a couple of other files similar to that one but together they result in a HDD that has been running at 100% for the better part of 2-3 hours.

Just thought this type of info may help.

thanks

Does booting in safe mode help?

If you boot using a BartPE USB stick or BartPE CD, and you browse to that location (basically anything in the SVI folder) what do you see?

Sounds to me like you've been either hacked or infected. Without a memory dump there's not much for me to look at.

If it's an OEM model I'd just restore from their image and be done with it. If you want we can keep going down this path, but I need a dump file.

 

[Buckscaper]

Originally posted by: dclive

Does booting in safe mode help?

Which issue are you referring to regarding booting in safe mode helping? I do it after a crash usually to initiate the disk checking process but I can't stay in that environment because I can't do anything there - even with networking - because so many things don't work. I'm never in safe mode for long but it's never crashed in there if that's what you are asking.

If you boot using a BartPE USB stick or BartPE CD, and you browse to that location (basically anything in the SVI folder) what do you see?

I don't follow you on this - if there's a procedure you think I should do please instruct me and I will. I don't know what you mean by "that location".

Sounds to me like you've been either hacked or infected. Without a memory dump there's not much for me to look at.

I found MEMORY.DMP in c: but it is 273Mb so I won't be sending that (if I delete it, will the next BSOD create a new one that is smaller. I will send you the Nov 26th (last) minidump - maybe you'll be able to tell something from that.

If I've been hacked or infected, I'd really appreciate if you could help me figure out what/where/how because I scan with several systems, have a NAT router and I don't click on the web willy nilly.

Can you tell me how to fix the issue with the minidumps not being created? Since June, in the Startup and Recovery section of Advanced features of the System control panel, "Write an event to the system log" has been checked along with "Kernel Memory Dump" selected from the drop down, with the dump file shown as %SystemRoot%\MEMORY.DMP and it is set to Overwrite any existing file.

Is there any other type of log or way to get the info you want? When I BSOD again I want to be able to give you what you need.

If it's an OEM model I'd just restore from their image and be done with it. If you want we can keep going down this path, but I need a dump file.

That's what I've been trying to avoid - I'm out of commission tooooo long when I do that.

Thank you.

 

[dclive]

Para1: If you can boot correctly in safe mode then it seems likely you have a driver issue (rather than a hardware issue, although it's certainly possible). Use MSCONFIG to enable all MS services and disable everything else, then reboot in normal mode to see if you can repro the problem.

(you did use verifier to turn on enhanced monitoring for all non-signed drivers, right?)

P2: Google building a BartPE boot cd for more info. Since you can boot OK in safe mode this probably isn't worthwhile now; just boot in safe mode and then clean out or rename that folder. "That location" is the SIV folder you mentioned.

P3: Switch from kernel to minidumps. If I can't get enough from minidumps we're stuck with kernel dumps, so you'd zip them then put them somewhere.

P4: You should only need one antivirus tool. I suggest Symantec's 10.x or 11.x productline, but that's just me.

P5: See P3.

P6: ...

P7: But it would give you a clean path to restore.