Help with BSOD

Hi. So for some reason, I keep getting blue screened(BSOD) on some new games that I have on my computer(Battlefield,Deadspace2,etc), but on some other games, like WC3:TFH or CS:S, I rarely get blue screens.

I usually ignore them but now it's gotten to the point where i can't play the games for 10 minutes without crashing. So I was wondering how i could fix them.

The computer has rebooted from a bugcheck. The bugcheck was: 0x1000000a (0xa17ae860, 0x0000001c, 0x00000000, 0x804e1726). A dump was saved in: C:\WINDOWS\Minidump\Mini070611-02.dmp.

The computer has rebooted from a bugcheck. The bugcheck was: 0x10000050 (0xa17c2c38, 0x00000001, 0xbf81c3ce, 0x00000000). A dump was saved in: C:\WINDOWS\Minidump\Mini070611-01.dmp.

I have also gotten these other errors:
IRQL_NOT_LESS_OR_EQUAL
and failure with NDSI.SYS PAGE_FAULT_IN_NONPAGED_AREA

I have the .dmp files, so if you ever need them ,I'll be glad to email you them.

 

Welcome to Majorgeeks!

How about you copy the dmp files to your Desktop, zip then attach them to your next post?

If you're really quick, I might have time for a basic debug and appraisal, otherwise you'll have to wait for 8-10 hours or more.

 

Oh I didn't see the attachment feature. Thanks.

 

Here is the file I don't know how to delete my previous post so sorry for the double post.
I didn't realize you had to put them all in a .zip.

 

You can edit a post but only if you do it within 10 minutes here

2 quick questions:
Which Windows version are you running? (I'm seeing conflicting version info in the dumps.)
When did you install the Sunbelt security software?

 

I am using Windows XP Version 2002 SP3.

I wasn't aware that i had Sunbelt security software on my computer. I don't think that i ever downloaded it at all.....

I currently use Ad-aware,Malwarebytes anti-malware, uniblue powersuite, and CCleaner.

 

Hmm, I'll assume that there's been some kind of affiliation going on between Sunbelt and <spit> Uniblue then. 3 drivers that I would normally associate with Sunbelt products were running on your PC.

All the BSOD's point to hardware as being the likely problem. But:

I think you have a malware problem; each dump contains a differently named a*******.sys file that was created at around 11/28/2010 11:39 - none of them get a hit in Google.

You need to visit this post, read it very carefully, follow it exactly, in the correct sequence. Once that's done, move on to the page for your version of Windows and do the same there. Once completed, you will need to create a new thread in the Malware forum and attach the logs from the diagnostic/repair process you just finished.

 

There could also be some other factors into the BSODing.

I installed a new video card a couple years back and I am wondering if the drivers could be conflicting with the system;I'm not sure if i did a clean install.

And it could be of my RAM. I'm using a DDR2 PC2-6400and a DDR2 PC2-5300, DDR2 (non-ECC)

 

Maybe, pull one stick of RAM and continue with the R&R process - those files need investigating!

 

Please also download MBRCheck to your desktop

• Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
• It will show a Black screen with some information that will contain either the below line if no problem is found:
  • Done! Press ENTER to exit...
• Or you will see more information like below if a problem is found:
  • Found non-standard or infected MBR.
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
• Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
• MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
• Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

 

Please follow the instructions given by thisisu in the earlier post, it'll be helpful to see that log.

Ok, I've been conferring with colleagues and have come to the conclusion that the a*******.SYS files are almost certainly part of Daemon Tools/Alcohol 120% or a related CD/DVD emulator. Do you have, or have you ever, had any of those installed?

From other research, I don't think your main cause for the BSOD's is the RAM, I'm leaning towards the motherboard chipset drivers, which make and model motherboard do you have?

As far as the Un|blue software is concerned, I'd uninstall it and ask for a refund based on what it obviously hasn't done for your computer compared to the claims they make for its magical abilities in their advertising (in reality, spawning hundreds of websites, affiliates and spamming forums and wiki's and boasting of how 'wonderful' it is).

What antivirus software do you have installed, other than what looks like Sunbelt, I see no evidence of any?

 

I've done the MBRCheck scan and the file is below.

@Satrow: I do have Daemon tools installed. I currently have Daemon Tools Lite and Magic ISO on my computer.

My motherboard is a MSI k9n6pgm2 V-Class.
It states that it has Nvidia GeForce MCP61P + nForce 430 Chipset Based.

Though im currently using a NVIDIA GeForce GT 220.

I've also included a dxdiag just incase you guys need it.

And also, referring to post #7 by Satrow,should i still do what you said in that post?

Thanks for the help so far guys

 

The NVIDIA MCP61 Chipset/VGA Drivers seem to be the correct ones for you, they're pretty big though, 160MB.

The MBR Check log looks clean but I'm sure thisisu will double check at some point and correct me if I'm wrong

I don't think you need to proceed with the Malware checkup

I am quite concerned about your lack of security and no Antivirus on the computer. Having Un|blue installed is not a 'protection' I would entertain.

 

Do you think it's an virus based problem? I had Norton a while back but that was useless,it slowed my computer more than it helped keep it fast and clean.

 

The log itself is clean, I don't want to just throw tools out but I am curious if TDSSKiller would come up clean as well. Some of the latest TDL infections have been able to bypass MBRcheck and prevent TDSSkiller from running.

The only reason I suspected malware because of the error codes the BSODs were showing. Lately, they have been pointing towards an infected mbr. But sometimes 0x50 just means RAM. Although I don't recall seeing 0x1000050.

I think chaslang hit it right on the head with those .sys drivers being related to alcohol 120/Daemon tools so props to him :-D

 

So should i uninstall them?

 

I wouldn't uninstall them yet if you make use of the software; they don't seem to be involved in any way with the BSOD's. If there's any software installed that you no longer use, uninstall it

What you need to do is to install the latest drivers for your motherboard chipset, I linked to those in # 13. They should fix the BSOD's we have seen so far - but could possibly induce errors in related older drivers - we'll deal with those later, should they occur.


To follow up on thisisu's comment, please go to the below link and follow the instructions for running TDSSKiller from Kaspersky:

• TDSSkiller - How to run

Be sure to attach your log from TDSSKiller

 

I've done the TDS check and it only found 1 problem, which was something called a Kernel Driver but it told me to skip it.

Log is below.

 

The "LockedFile.Multi.Generic(sptd)" flagged by TDSSKiller is the a*******.SYS file, sptd is the 'normal' name for it.

Have you installed the latest motherboard drivers yet?

Why is there no antivirus installed? Do you think that Un|blue is protecting you?

 

I dont think i have the latest motherboard drivers installed. I don't know how to find and install them

My nortron antivirus expired a couple months ago and i've never gotten the time to buy a new one. And no, i am fully aware that uniblue does not protect me from viruses. Plus, norton has also caused many problems so i have yet to find a antivirus that does it's job properly and does not cause any further problems.

 

Nvm. I found the link in your #13 post and I'm currently updating it as we speak.

 

Ok

Get the motherboard drivers updated first, then study this:

How to protect yourself from malware!

 

I did the update, but now I'm crashing everytime i log into my account. Hopefully, I was fast enough to get the .dmp files into a zip and transfer it into my flashdrive. Took my like 4 bsods to do it though.

I'm using my laptop to post since I BSOD within 5 minutes of logging in.

DMP files is below.

Oh yea, I didnt know how to update the nVidia MCP61 SATA RAID / AHCI Driver (For floppy driver) because it didn't have any .exe files like the others did, so maybe that is part of the problem.

 

They're only needed for special cases as part of the initial Windows install.

I'll check the logs now.

EDIT: What time did you install the motherboard drivers?

 

Right, I've just given the latest 2 dumps and it's already pointing me back in the direction of a question I asked back in # 5:

If you didn't install it and it doesn't appear in Add/Remove, we'll need to uninstall all Security software until the "sbapifs.sys" and it's relatives are gone.

I want you to start in Safe Mode with Networking please and try to remove the Uniblue software first.

Then uninstall Ad-Aware.

Reboot and report back please.

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini070811-07.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_qfe.101209-1646
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Fri Jul  8 23:15:42.703 2011 (UTC + 1:00)
System Uptime: 0 days 0:00:47.328
Loading Kernel Symbols
...............................................................
............................................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {e413a000, 0, 804dadf8, 1}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!vSrcCopyS32D32Identity+5b )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e413a000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804dadf8, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  e413a000 

FAULTING_IP: 
nt!memmove+33
804dadf8 f3a5            rep movs dword ptr es:[edi],dword ptr [esi]

MM_INTERNAL_CODE:  1

CUSTOMER_CRASH_COUNT:  7

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  AeroSnap.exe

LAST_CONTROL_TRANSFER:  from bf8522d0 to 804dadf8

STACK_TEXT:  
9dae972c bf8522d0 e40fa49c e413549c 400004b0 nt!memmove+0x33
9dae9750 bf851e17 00000010 00000000 00000000 win32k!vSrcCopyS32D32Identity+0x5b
9dae9964 bf8bb97f e40d3010 00000000 00000000 win32k!EngCopyBits+0x555
9dae99ac bf8bd16c bf851e5c e3914fa0 e40d3010 win32k!OffCopyBits+0x7d
9dae9a50 bf8bced3 e40d3010 bf9aa3dc e410e010 win32k!vSpCreateShape+0x193
9dae9ad8 bf8bcaba e1cd85c0 00000002 00000001 win32k!bSpUpdateShape+0x3ae
9dae9b34 bf8bc8b9 e1ccc008 00000000 00000000 win32k!bSpUpdateSprite+0x109
9dae9b88 bf87dc42 e1ccc008 00010184 00000000 win32k!GreUpdateSprite+0xe7
9dae9bec bf803bc9 e1e4ea40 00000001 b9014e10 win32k!UpdateRedirectedDC+0xf1
9dae9c04 bf8159bc 01010054 00000001 00000003 win32k!ReleaseCacheDC+0x5f
9dae9c1c bf822dfc b9014e10 00000000 00000001 win32k!xxxSendEraseBkgnd+0x9e
9dae9c3c bf822ec2 b9014e10 e336aa60 9dae9c80 win32k!xxxSimpleDoSyncPaint+0xc6
9dae9c58 bf822ea1 b9014e10 00000004 b90006e8 win32k!xxxInternalDoSyncPaint+0x12
9dae9c80 bf81fc87 b90006e8 00000004 00000000 win32k!xxxInternalDoSyncPaint+0x78
9dae9cdc bf822b2b b90006e8 00000000 00000000 win32k!xxxEndDeferWindowPosEx+0x25c
9dae9cfc bf852f68 b9014e10 00000000 00000000 win32k!xxxSetWindowPos+0x101
9dae9d30 bf8532e1 00000000 00000043 9dae9d64 win32k!xxxShowWindow+0x250
9dae9d54 804dd99f 00010184 00000005 0012f358 win32k!NtUserShowWindow+0xa1
9dae9d54 7c90e514 00010184 00000005 0012f358 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f358 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!vSrcCopyS32D32Identity+5b
bf8522d0 83c40c          add     esp,0Ch

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  win32k!vSrcCopyS32D32Identity+5b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d6f9740

FAILURE_BUCKET_ID:  0x50_win32k!vSrcCopyS32D32Identity+5b

BUCKET_ID:  0x50_win32k!vSrcCopyS32D32Identity+5b

Followup: MachineOwner
---------




Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini070811-06.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_qfe.101209-1646
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Fri Jul  8 23:14:30.218 2011 (UTC + 1:00)
System Uptime: 0 days 0:08:37.975
Loading Kernel Symbols
...............................................................
.......................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {aad49100, 1, f7a1d8bf, 0}


Could not read faulting driver name
*** WARNING: Unable to verify timestamp for sbapifs.sys
*** ERROR: Module load completed but symbols could not be loaded for sbapifs.sys
Probably caused by : sbapifs.sys ( sbapifs+a30c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: aad49100, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: f7a1d8bf, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS:  aad49100 

FAULTING_IP: 
fltMgr!FltpCleanupFileObjectContextForCleanup+6d
f7a1d8bf 8939            mov     dword ptr [ecx],edi

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  6

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from f7a0c551 to f7a1d8bf

STACK_TEXT:  
9f8b3734 f7a0c551 8ad49000 8a9d7960 8ab57fd8 fltMgr!FltpCleanupFileObjectContextForCleanup+0x6d
9f8b3750 f7a0ec06 8ac94790 9f8b3788 00000012 fltMgr!FltpGetStartingCallbackNode+0x7f
9f8b3770 f7a0f059 9f8b3788 8ab57e58 8ad0af38 fltMgr!FltpPassThrough+0x180
9f8b37a0 804e13eb 8ad1c860 8ab57e48 8ab57e48 fltMgr!FltpDispatch+0x10d
9f8b37b0 805741e9 8ac94778 000000a8 8add5ad0 nt!IopfCallDriver+0x31
9f8b37e0 8056f831 8adb2830 8ad1c860 00110080 nt!IopCloseFile+0x26b
9f8b3814 8056f984 8adb2830 00000001 8add5ad0 nt!ObpDecrementHandleCount+0xd8
9f8b383c 8056f8aa e1002e08 8ac94790 0000014c nt!ObpCloseHandleTableEntry+0x14d
9f8b3884 8056f8f4 0000014c 00000000 00000000 nt!ObpCloseHandle+0x87
9f8b3898 804dd99f 8000014c 9f8b3920 804e34a7 nt!NtClose+0x1d
9f8b3898 804e34a7 8000014c 9f8b3920 804e34a7 nt!KiFastCallEntry+0xfc
9f8b3914 a178130c 8000014c 9f8b39b0 a1781b04 nt!ZwClose+0x11
WARNING: Stack unwind information not available. Following frames may be wrong.
9f8b3920 a1781b04 8000014c 8ac94790 8a7f97d4 sbapifs+0xa30c
9f8b39b0 f7a0c888 89621f5c 9f8b39d0 9f8b3a00 sbapifs+0xab04
9f8b3a10 f7a0e2a0 008b3a54 89621f00 894e2fd8 fltMgr!FltpPerformPreCallbacks+0x2d4
9f8b3a24 f7a1b217 9f8b3a54 f7a196aa 00000000 fltMgr!FltpPassThroughInternal+0x32
9f8b3a3c f7a1b742 9f8b3a54 8a997770 894e2e58 fltMgr!FltpCreateInternal+0x63
9f8b3a70 804e13eb 8ad1c860 894e2e48 894e2e48 fltMgr!FltpCreate+0x258
9f8b3a80 8057985a 8ad0bae8 894dc39c 9f8b3c18 nt!IopfCallDriver+0x31
9f8b3b60 8056d03b 8ad0bb00 00000000 894dc2f8 nt!IopParseDevice+0xa12
9f8b3bd8 805701e7 00000000 9f8b3c18 00000040 nt!ObpLookupObjectName+0x53c
9f8b3c2c 80579eb6 00000000 00000000 00000001 nt!ObOpenObjectByName+0xea
9f8b3ca8 80579f85 031ffeec 00110080 031ffe9c nt!IopCreateFile+0x407
9f8b3d04 8057a0bc 031ffeec 00110080 031ffe9c nt!IoCreateFile+0x8e
9f8b3d44 804dd99f 031ffeec 00110080 031ffe9c nt!NtOpenFile+0x27
9f8b3d44 7c90e514 031ffeec 00110080 031ffe9c nt!KiFastCallEntry+0xfc
031ffef4 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
sbapifs+a30c
a178130c ??              ???

SYMBOL_STACK_INDEX:  c

SYMBOL_NAME:  sbapifs+a30c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: sbapifs

IMAGE_NAME:  sbapifs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4dcab742

FAILURE_BUCKET_ID:  0x50_sbapifs+a30c

BUCKET_ID:  0x50_sbapifs+a30c

Followup: MachineOwner
---------

0: kd> lmvm sbapifs
start    end        module name
a1777000 a1787a80   sbapifs  T (no symbols)           
    Loaded symbol image file: sbapifs.sys
    Image path: sbapifs.sys
    Image name: sbapifs.sys
    Timestamp:        Wed May 11 17:20:18 2011 (4DCAB742)
    CheckSum:         0001BC6D
    ImageSize:        00010A80
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

I uninstalled ccleaner,malwarebytes,uniblue, and ad-aware; though for some, it didnt let me uninstall them through safe mode w/ networking so i had to log in normally and uninstall them. But, now it's worse. I keep BSODing before i even can check the .dmp files. Even during safe mode, I BSOD. I disabled automatic restart so I could write down what happened.

I got this code: STOP: 0x00000050 (0xF7F40F2c, 0x00000000,0xF7F40F2c, 0x00000000)

Should i do a system restore, avoiding the updates I've done and uninstall the programs first then re-update it after?

EDIT: I've also couldn't find anything with the name "Sunbelt" in add/remove programs. Are there other programs associated with it?

 

Yes, you can try a System Restore, if it fails, try it a second time. If it fails twice, try again with a different restore point.

I only wanted you to remove the UniBlue and Ad Aware to begin with, then reboot and test.

The Sunbelt drivers are used by other companies, including Lavasoft recently, maybe others, I haven't had a chance to track them down though.

 

This system restore is extremely irritating....

Tried to do it during safe mode, but it says it was disabled by group policy.
So I did this.
1. Click Start, Run and type regedit.exe and press Enter

2. Navigate to the following key:

HKEY_LOCAL_MACHINE \ Software \ Policies \ Microsoft \ Windows NT \ SystemRestore

In the right-pane:

* Delete the value DisableConfig
* Delete the value DisableSR

Then i tried to enable it , and it said " system restore encountered an error trying to enable disable, please restart computer and try again."

And i try again, and it says the same thing....this is getting retarded..

Then i tried running this "rundll32.exe advpack.dll,LaunchINFSection %Windir%\Inf\sr.inf" to reinstall system restore, and it asks for my xp cd, and i throw it in and I'm looking for the file, I think its " sy.srs" or something like that but before i can try to find it, i get BSOD. It's like its trying to stop me from reinstalling system restore -.-*

 

The biggest problem with disabling SR is that you automatically lose all restore points.

I'm in dire need of some sleep right now, I'll get back to this later and see if I can come up with a workaround that will get us out of this.

 

I don't think I need help anymore with this problem because I just reformatted my system. I hope this solves everything.