Vista core dumps on shutdown

NickLea · Oct 27, 2010

Hi,

My Vista 32bit PC tried to install the most recent Windows update as part of the shutdown procedure (may be un-related) and part way through the shutdown it core dumped.

It re-starts OK in full Windows mode but then core dumps again when I shut down

Thankfully, I did a system backup this morning so have that available on a remote drive.

I am no PC wizz. Long, technical phrases make my eyes glaze over and my brain dribble! If there's log files etc. that I can post that may help, please include any instructions on generating or locating them!

Many thanks

NickLea · Oct 27, 2010

I really must read the stickies! I'll see if I can find the dump and compress/attach

NickLea · Oct 27, 2010

Mini core dump attached

Hi,

This replaces my recent post "Vista core dumps on shutdown"

niemiro · Oct 27, 2010

I am sorry to mess you around, but we actually use this sticky now!

http://www.vistax64.com/crashes-debugging/282419-blue-screen-death-bsod-posting-instructions.html

After posting that, someone will be with you very shortly!

Richard

richc46 · Oct 27, 2010

STOP 0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED Usual causes: Insufficient disk space, Device driver, Video card, BIOS, Breakpoint in startup without having a debugger attached, Hardware incompatibility, Faulty system service, 3rd party remote control, Memory

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
Loading Dump File [C:\Users\richc46\AppData\Local\Temp\Temp1_Mini102710-01[2].zip\Mini090210-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6002.18267.x86fre.vistasp2_gdr.100608-0458
Machine Name:
Kernel base = 0x82a15000 PsLoadedModuleList = 0x82b2cc70
Debug session time: Thu Sep  2 10:40:58.382 2010 (GMT-4)
System Uptime: 0 days 1:31:56.162
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
Unable to load image \SystemRoot\System32\DRIVERS\srvnet.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for srvnet.sys
*** ERROR: Module load completed but symbols could not be loaded for srvnet.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 9ee85df1, 9d8c5890, 0}
Unable to load image \SystemRoot\System32\Drivers\avgtdix.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for avgtdix.sys
*** ERROR: Module load completed but symbols could not be loaded for avgtdix.sys
Probably caused by : srvnet.sys ( srvnet+bdf1 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 9ee85df1, The address that the exception occurred at
Arg3: 9d8c5890, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
 
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP: 
srvnet+bdf1
9ee85df1 8b08            mov     ecx,dword ptr [eax]
TRAP_FRAME:  9d8c5890 -- (.trap 0xffffffff9d8c5890)
ErrCode = 00000000
eax=00000000 ebx=879f0018 ecx=9d8c5914 edx=00000000 esi=879ef148 edi=879f0180
eip=9ee85df1 esp=9d8c5904 ebp=9d8c592c iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
srvnet+0xbdf1:
9ee85df1 8b08            mov     ecx,dword ptr [eax]  ds:0023:00000000=????????
Resetting default scope
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x8E
PROCESS_NAME:  avgnsx.exe
CURRENT_IRQL:  0
LAST_CONTROL_TRANSFER:  from 9ee8211c to 9ee85df1
STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
9d8c592c 9ee8211c 879f0018 9ee8a3a8 879f0018 srvnet+0xbdf1
9d8c5948 9ee81fc6 009f0018 879f0180 879f0018 srvnet+0x811c
9d8c5970 9ee80c83 009f0018 9d8c5b04 89a41f98 srvnet+0x7fc6
9d8c5ab8 908f17cf 879f0018 00000000 893eb2bc srvnet+0x6c83
9d8c5ae8 908f7b48 89a41f98 008c5b04 8999eda0 afd!WskProTLEVENTReceive+0xa8
9d8c5b1c 90870e56 891138c8 85dd16e0 00000820 afd!WskTdiEHReceive+0x1f2
9d8c5b7c 908711ac 0099ed28 00000000 af9e9a7c avgtdix+0x4e56
9d8c5b94 90871cd1 0099ed28 af9e9a7c 00000089 avgtdix+0x51ac
9d8c5bd0 9086d2a4 89cff8f0 892cfc08 88eb8348 avgtdix+0x5cd1
9d8c5c1c 9086f57f 88eb8348 89cff8f0 9d8c5c44 avgtdix+0x12a4
9d8c5c2c 82a599c6 88eb8348 89cff8f0 89cff8f0 avgtdix+0x357f
9d8c5c44 82c5b7a3 892cfc08 89cff8f0 89cff960 nt!IofCallDriver+0x63
9d8c5c64 82c5bf48 88eb8348 892cfc08 00000000 nt!IopSynchronousServiceTail+0x1d9
9d8c5d00 82c5d012 88eb8348 89cff8f0 00000000 nt!IopXxxControlFile+0x6b7
9d8c5d34 82a5fc7a 000002d8 000003a0 00000000 nt!NtDeviceIoControlFile+0x2a
9d8c5d34 77d15e74 000002d8 000003a0 00000000 nt!KiFastCallEntry+0x12a
0166fd58 00000000 00000000 00000000 00000000 0x77d15e74
 
STACK_COMMAND:  kb
FOLLOWUP_IP: 
srvnet+bdf1
9ee85df1 8b08            mov     ecx,dword ptr [eax]
SYMBOL_STACK_INDEX:  0
SYMBOL_NAME:  srvnet+bdf1
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: srvnet
IMAGE_NAME:  srvnet.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  4b22304e
FAILURE_BUCKET_ID:  0x8E_srvnet+bdf1
BUCKET_ID:  0x8E_srvnet+bdf1
Followup: MachineOwner
---------

Many of your reports indicate problems with avgtdix.sys. This driver is part of your antivirus software.
Solution,
Uninstall your AVG antivirus and install Microsoft Security Essentials. Use the AVG uninstall tool if one is available.

Outdated Drivers

Code:

 siwinacc.sys Mon Nov 01 15:21:31 2004 
[B]ASACPI.sys   Wed Oct 18 01:44:46 2006 [/B]
siremfil.sys Wed Oct 18 18:20:04 2006 
peauth.sys   Mon Oct 23 04:55:32 2006 
vsmraid.sys  Wed May 30 17:15:38 2007 
nvraid.sys   Wed Jun 06 16:34:41 2007 
nvmfdx32.sys Sat Nov 17 18:46:42 2007 
RTKVHDA.sys  Thu Dec 20 05:00:35 2007

The reports that you have submitted reveal clues to the cause of your problem. They do not give a definitive answer. The more reports that we receive the more clues are made available improving our chances of finding a solution to your problem. You may have to experience several more BSODs until the final answer is discovered.

If overclocking restore normal settings

SFC /scannow
System Files - SFC Command

Update outdated listed drivers. If I have inadvertently listed any Microsoft Drivers, they can be ignored. If the list is extensive I have included the driver verifier test so that you may determine which drivers are in need of immediate attention.

Asacpi.sys is a driver from the Austek Computer Corp. Your driver is very old and is known to cause BSOD's in current Windows versions; it must be updated
http://support.asus.com/download/download.aspx?SLanguage=en-us

Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done:
www.duplexsecure.com/en/downloads

Uninstall your current Anti Virus and replace with Microsoft Security Essentials.
www.microsoft.com/Security_Essentials/

Scan with your Anti Virus

How to Find Drivers
search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone - will help you search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- - if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.
- The most common drivers are listed on this page: http://www.carrona.org/dvrref.html
- - Driver manufacturer links are on this page: http://www.carrona.org/drvrdown.html
To remove any left over driver remnants, especially from graphics cards, use driver sweeper
www.guru3d.com/category/driversweeper/

After performing all of the above, post back with any new BSOD reports, or indicate that the attempted repairs were successful.
If any links do not work, if clicked, please copy and paste to browser address bar.
These reports are not definitive but merely point the way to a solution. It is very important to remember that the dump reports only give clues as to the problem and although it is very easy to analyze only one or two, usually more are needed. If you experience additional BSOD after installing a current version of the driver in question, be sure to post so that we can use the additional information to assist you in preventing the BSOD's

NickLea · Oct 27, 2010

Many thanks Richard,

This is the "proper" diagnostic as per niemiro's instruction. I hope it will help you a bit more!

richc46 · Oct 27, 2010

Dont really need that other report. Your dumps were rather conclusive. After you follow my instructions, if you continue the have BSOD, post correctly and I will check it again.

NickLea · Oct 27, 2010

Great stuff - I'll follow your instruction - many thanks for your help, Richard

richc46 · Oct 27, 2010

Take your time.

These are the important ones

Anti Virus
SPTD Daemon
ASACPI.

Take care of them first. Then test. If working good, do the rest at your own pace. If you delay too long you will get more BSODs in the future.

NickLea · Oct 27, 2010

Uninstalled AVG and interestingly, the required re-boot to finish the uninstall worked without core dumping (whereas it had been in a loop of core dump, re-boot, shut-down, core dump....).

Installed MS Security Essentials.
Full scan - no issues
Updated asus chip set driver.
Ran registry checker which, predictably, found 250+ errors that it could fix for a price! (Used CCleaner instead).
Ran SCF - no issues found
I have no virtual CD software, but installed SPTD. I had to re-boot to finish the application so I assume it's does it's stuff in background.

As far as I'm concerned, I'm up and running again. The finger of suspicion has to point at AVG given the re-boot following uninstalling succeeded, thankfully, the Windows update also re-appeared and successfully installed.

Richard, you mention you included a driver verifier. I can't see any obvious link to a utility, were you referring to the list of out-of-date drivers you provided? If there is a tool I can download it would help me verify what drivers I have left to update.

Best regards

Nick

richc46 · Oct 27, 2010

You do not want the verifier, it will give you BSOD's; that is how it works. I did not give it to you because you do not have those many outdated drivers, only a handful.
Better just to replace those few.
Do not understand about SPTD, it has to be removed, it was found in your system.

NickLea · Oct 28, 2010

Not sure about the source of that sptd.sys file. The only thing that I can think of is I naively bought and installed a game from eBay (a couple of years ago) that turned-out to be a hacked pirate copy. I uninstalled it but guess it could have used some sort of virtual CD as it ran without CD once installed.

It's been removed now and everything seems to be behaving as it should.

There's an annoying issue with Start-up prompting me to open a file (that appears to be an empty text file) but I'll post that in a more appropriate forum.

richc46 · Oct 28, 2010

I am really happy that we were able to solve the big problem. I look forward to the challenge of your next post; maybe I can help there too.

NickLea · Oct 28, 2010

I'm sure you can & will! Many thanks, Richard.

Vista core dumps on shutdown

My Computer

My Computer

Attachments

My Computer

Banned

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer