# Solved: blue screen error



## ripulsachdeva (Jun 20, 2010)

Hey all,
i am facing a big prblm wid my pc lately..my computer works fine for a couple of hours nd then cums the blue screen dat says windows will shut down to prevent damage blah blah blah,it doesnt gv me enuf tym to read al of that,n then it restarts,also at the bottom of the blue screen it says sumthng lyk dumping memory..i dnt knw wat it is n need ur help to get out of dis..wud lyk to inform u dat my computer used to make some noise while i was using it frm da last two weeks,then suddnly usd to go away..nw it doesnt make ny noise bt it is cming up wid dat blue screen..nw lemme tel u da config of my system,
4gb ddr3 kingston ram,
1tb wd hdd,
dvd rom,ram,
amd phenom x2 3.2ghz processor...1gb 4670 ati radeon..
p.s : i bought amd cz i heard it is best for games n animation,m an animation student n i play a hell lot of heavy games sch as gta4 n others..bt sum ppl also told me it gets heated quickly n its inferior dan intel.....nw hv i made a mistake by gng fr amd?
plz help me plz plz
if u want i can do a clean


----------



## Jonathan_King (May 30, 2010)

Please follow these directions and post the files here: http://www.jcgriff2.com/BSODpostinstructions.html

That should give me the info I need.


----------



## dustyjay (Jan 24, 2003)

Might also leave out the text speak and opt for English instead please.


----------



## MCROZ (Jan 1, 2003)

Am also suddenly (after 7 months trouble free operation) getting the blue screen and Windows shutdown on an irregular but annoying basis. Suggestion from Windows itself - when it restarts - is that it may be a driver problem but I haven't installed any new HW or SW (except an "automatic" iTunes update.

Frustrating. 

I have of course backed up everything in anticipation of something more major occurring. Tosh Laptop (Satellite L500 with 4mb memory and BIOS V2, WIN 7 Home Premium 6.1.7600) is only 7 months old ...and I have run the basic Tosh diagnostics on CPU, memory and HDD without any signs of problem.

Wondering if this is a WIN problem that may be fixed in a future update (I get those automatically so no obvious issues there....)


----------



## Jonathan_King (May 30, 2010)

There is one known bug in Windows 7 that caused 0xA BSODs, but I personally haven't run across it yet.

Again, for blue screen problems, use these scripts to collect data for me.

http://www.jcgriff2.com/BSODpostinstructions.html


----------



## MCROZ (Jan 1, 2003)

Thanks - will try to do so if it happens again ....


----------



## MCROZ (Jan 1, 2003)

Jonathan_King said:


> There is one known bug in Windows 7 that caused 0xA BSODs, but I personally haven't run across it yet.
> 
> Again, for blue screen problems, use these scripts to collect data for me.
> 
> http://www.jcgriff2.com/BSODpostinstructions.html


Jonathan - I downloaded the Autoruns and EXE files as instructed from jcgriff2.com link but when I attempt to run the EXE file Norton tells me there is a "threat" so I am VERY nervous about proceeding ?

I have had a couple more BSODs in the last 3 days. Is the procedure you suggest absloutely safe to use please ?

EDIT - in fact when Norton suspects a threat it deletes the file so doesn't seem possible to run it ??


----------



## Jonathan_King (May 30, 2010)

Kind of ironic. Norton is known for causing BSODs so first thing I would ask you to remove it. Install Microsoft Security Essentials instead.

Those autoruns are from Microsoft and are safe...no worries there.

Here is the Norton removal tool: ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_Removal_Tool.exe

MSE: www.microsoft.com/Security_Essentials/

Then, download the autoruns and try again.


----------



## MCROZ (Jan 1, 2003)

Hmmmmm ...I know many forum experts hate Norton but I'm not overly comfortable removing what I have paid for (and which hasn't caused any obvious problems in the past). Interestingly a Norton full system scan just fixed 3 "virus" issues so I wonder if one of those may have been causing the blue screen. I'll try again and see if I can override Norton's concern before I take the removal and replace with secuirity essentials route. I was running that until it became obvious it was incompatible with Norton ......

Thanks for your advice so far ....


----------



## Jonathan_King (May 30, 2010)

You're welcome.

I'll wait for the dumps before giving more suggestions, unless you need more help. It may be that the problem is obviously NOT Norton.


----------



## MCROZ (Jan 1, 2003)

OK - I managed to download the EXE by temporarily turning off Norton Insight Protection so will try and run and post the dumps tomorrow. One WIN crash (only) today as far as I can see. WIN restarts itself each time so far but is no longer suggesting reasons for the shutdown (originally it suggested an unspecified driver issue).

More later if I can successfully collect and post.


----------



## MCROZ (Jan 1, 2003)

MCROZ said:


> OK - I managed to download the EXE by temporarily turning off Norton Insight Protection so will try and run and post the dumps tomorrow. One WIN crash (only) today as far as I can see. WIN restarts itself each time so far but is no longer suggesting reasons for the shutdown (originally it suggested an unspecified driver issue).
> 
> More later if I can successfully collect and post.


EDIT 31 JULY

Sorry - Norton absloutley will not allow me to save or run that EXE file, and as Norton has today blocked a number of intrusion attempts there is no way I am about to turn it off or remove it. Norton has fixed a windows firewall conflict but I doubt that was anything to do with the BSOD (which seems less common in last 2 days).

At the moment I am living with it and backing up regularly.


----------



## Jonathan_King (May 30, 2010)

Alright let us know if you need more help with the BSOD problem. If you do, be sure to run those scripts and upload the results, and I'll be happy to help you out.

I have an email subscription to this thread, as well as the one in my Subscribed Threads list, so I'll be sure to see your new post should you decide to upload it.


----------



## MCROZ (Jan 1, 2003)

Small update.

I have taken a look at the reliability history within the action monitor. WIN7 Failures started 7/23 and always seem to coincide with an application failure - although application failures seem to start 7/17. I cannot easily see which application(s) is or are regularly failing. I have today downloaded an updated Realtek driver from MS Update (an "optional" update which has been available for a while. I have also checked within the ction center for solutions to problems and have been prompted to update something called Tempro which comes from Toshiba (I am running a Tosh Satellite L500-1WG).

I have also saved the reliability report as an XML file.

I notice that the technical details showing against the WIndows crashes in the relaibility report say - for example - first crash on 7/23 :

The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001a (0x0000000000041790, 0xfffffa800331ba20, 0x000000000000ffff, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 072310-22495-01
]Second crash on 7/23 :

The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xfffffe8003c5d948, 0x0000000000000000, 0xfffff80002dbc0bf, 0x0000000000000007). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 072310-22744-01.
then on 7/25 :

The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff8800100d5dd, 0x0000000000000000, 0x0000040000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 072510-23727-01.
at later date 

The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xfffffca00fe1a650, 0x0000000000000001, 0xfffff80002f6e736, 0x0000000000000007). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 073110-21325-01.
and today:

The computer has rebooted from a bugcheck. The bugcheck was: 0x00000019 (0x0000000000000003, 0xfffffa8003c5d910, 0xfffffe8003c5d910, 0xfffffe8003c5d910). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080110-24133-01.

I also noticed, on 7/23 after the first and second WIN crashes "dwwin.exe stopped working" with this detail (on the same day windows live mail, watson client, Host process for windows services, ConfigFree Switch manager process and Symantec service franework all stopped at about the same time, after the WIN crash):
Faulting application name: dwwin.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc2d6
Faulting module name: MSCTF.dll, version: 6.1.7600.16385, time stamp: 0x4a5bda69
Exception code: 0xc0000005
Fault offset: 0x00007ebc
Faulting process id: 0x10bc
Faulting application start time: 0x01cb2a5c9bacc0e4
Faulting application path: C:\Windows\SysWOW64\dwwin.exe
Faulting module path: C:\Windows\syswow64\MSCTF.dll
Report Id: dd058b50-964f-11df-a473-705ab670bd32


----------



## MCROZ (Jan 1, 2003)

Update

2 more random blue screen crashes - this time on startup.
Blue screen disappears too quickly to capture details but first message was something like "Page fault in non page ........"
Second crash event message was different but unable to capture it.
Coincidentally I got a mesaage that Toshiba Notebook registration reminder had stopped working (this has appeared before) - and WIN reliability monitor records it as folows :

Description
Stopped working
Faulting Application Path:	C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe

Problem signature
Problem Event Name:	CLR20r3
Problem Signature 01:	toshibareminder.exe
Problem Signature 02:	8.0.4.0
Problem Signature 03:	4a7190e1
Problem Signature 04:	System.Xml
Problem Signature 05:	2.0.0.0
Problem Signature 06:	4a275e0f
Problem Signature 07:	2818
Problem Signature 08:	124
Problem Signature 09:	System.InvalidOperationException
OS Version:	6.1.7600.2.0.0.768.3
Locale ID:	2057

Extra information about the problem
Bucket ID:	783849207

Each time I get BSOD windows reboots itself - normally successfully.
Backed up again today and have created all the recommended systems restore and recovery DVDs. Plan to create a system image tomorrow if I can (although can't seem to do that on my extrenal HDD as it is not NTSF formatted for some reason (although hold the regular weekly backup files).

EDIT - I have thought about doing a system restore to a date prior to 7/23 but seems no restore point before 7/27 exists - as I haven't turned system restore off seems that may also at some point have crashed. Am wondering if the TOSH reminder exe is the problem and whether I should remove it (if I can find it ...)


----------



## reventon (Aug 2, 2010)

Hi,

May I just step in at this point.

First, my credentials (as sadly I have not found the time to post here before). I post at several forums under the name *reventon* and I can be mostly found here and here.

The system information collection application that *Jonathan_King* asked you to run was written by *jcgriff2* - a Microsoft MVP who is renowned as the "father" of BSOD debugging as it is done on the forums.

I have no doubt at all that the application is safe to run.

The only reason Norton is flagging it is because it is has not been run by many Norton Users (yes, Norton "phones home" with the names of programs that you run and other information) and therefore has not been investigated fully by their team.

As for Norton being a potential BSOD cause - that much is easy to prove:

http://www.techsupportforum.com/mic...g-problem-new-system-w-symantec-endpoint.html

http://www.techsupportforum.com/mic...bernate-dell-vostro-1500-1-a.html#post2393701

http://www.techsupportforum.com/mic...point-11-0x7e-vista-x64-bsod.html#post2104254

There is of course a possibility that Norton is fine in this situation, but when we see that you have that installed and we have no other information to work on... well that is always going to be our first recommendation.

If you are then worried about your system being left open to infection I suggest you have a look at Microsoft Security Essentials - it is free and it's performance is at least equal to Norton/Symantec products.

See here for an AV comparison: http://arstechnica.com/security/news/2009/10/av-comparatives-picks-six-malware-removal-winners.ars

Microsoft Security Essentials -> http://www.microsoft.com/Security_Essentials/

Regards,
Reventon


----------



## MCROZ (Jan 1, 2003)

OK - all advice appreciated.

This TOSH laptop was brand new in January and was running trouble free WIN 7 (with Norton Internet Security) until 23 July. I did in fact instal MS Secuity essentials as soon as I set up the laptop (and while it was in fact running the 30 day free trial McAfee that came bundled from Toshiba), but when I replaced McAfee with Norton obviously I couldn't keep 2 real time AV progs and so removed it.

What troubles me is why everything was OK until 23 July.

I am intrigued by any possible connection with the Toshiba exe that keeps trying to run at startup and get me to register the laptop. I did that successfully in January and have no need to repeat it. Intriguingly I noticed that a "config" file related to this Toshiba prog seems to have been created on 23 July ...but *2009* not 2010. I am wondering if something is screwed up in the Toshiba code so that it thinks the laptop came out of warranty on 23 July 2010 .....which of course it didn't.

Tosh forum was unavailable last night and sadly they don't seem to have any realtime chat facility with techies (as do Norton, for example...)

I'm assuming I can safely remove the Tosh warranty/registration prog as I have their email confirming warranty status from January 2010.

I'm not a Norton Bigot of any kind (just a simple home PC user) but when a program has run effectively under WIN7 for 7 months I'm nervous of removing it - even though I accept MS Security essentials is probably just as good. I guess, however, I could try that as a temporary action and run the system information collection apps and go from there .....Incidentally I also run Norton Utilities 14 (and regularly use it to clean disks ...although I am conscious that it is unwise to use it to clean registry).

Would be interested first, though, if any of the "bug" messages that I have posted make any sense to the experts ?

One last easy question. If I am forced into a complete restore/clean WIN7 instal (I have the original disk supplied by Tosh, plus the recovery and system restore disks and (I hope) a WIN 7 backup file on external HDD )....will this restore (from WIN backup fie) my entire WIN Livemail set up and saved emails etc ...or should I back up Livemail (is that simple ?) as a separate exercise ????

Sticking with it ......so far !!


----------



## reventon (Aug 2, 2010)

Well, apart from the error about the Toshiba application (which is pretty obvious) I cannot determine much else without the info.


----------



## MCROZ (Jan 1, 2003)

How about if you look at minidump files in the C:\Windows\Minidump folder ...I seem to have 15 of those from 23 July through to 2 August ? Presume I can zip and attach ?


----------



## MCROZ (Jan 1, 2003)

Short update

BSOD continues on an irregular basis.

I have also posted dump files on MS forum but so far no analysis.
I am also now suspicious of NIS as 2 BSODs recently occurred while either a scan was running or I was investigating history of scans etc with NIS open.
I installed MS Security essentials and (temporarily at least) turned off all Norton activites except the Norton Firewall. This enabled me to save the exe file you suggest and I will try to provide details here ...so that is the next plan. I found, incidentally, that MS Security then itself crashed in the midle of a scan, leaving me unprotected - so I have now gone back to Norton - at least the devil I know and which is protecting me from virus even if it's messing with BSODs.
Trying to cover all bases.
Last BSOD certainly contained "Page Fault on Non Paged Area" message.

As before - appreciate all expert help and interest.
Thanks


----------



## MCROZ (Jan 1, 2003)

Hope I followed the instructions correctly.
Here is the performance report. As the dumps folder exceeds 1.96mb I have to split it into multiple zips - sorry


----------



## MCROZ (Jan 1, 2003)

Guys...despite the suggestion that post zip size limit is 1.96MB I am getting this message after splitting the Windows7 dump folder into four separate zips -each below that size....

Your file of 1.29 MB bytes exceeds the forum's limit of 500.0 KB for this filetype.

Any ideas .....I guess I split into multiple zips...hope that's OK.


----------



## reventon (Aug 2, 2010)

Yes.. sorry.. the 1.96 Meg limit refers to another forum. Split it into however many zips you need to.


----------



## MCROZ (Jan 1, 2003)

really struggling ...one text file alone won't zip below 500 ,,,it's the $evtx_sys_dump file which is 11730KB ?????

As you mentioned you are active on other forums ...should we switch forums ? No way I can upload that file under this forum limits I think ?

Need to close down in a short while - been at this for 3 hours already this morning and have to go to lunch soon !


----------



## reventon (Aug 2, 2010)

Download WinRAR.

32-bit -> http://www.rarlab.com/rar/wrar393.exe

or

64 bit -> http://www.rarlab.com/rar/winrar-x64-393.exe

Then install and run the program. Navigate to and select the Windows7 dump folder. Then click Add (top left).

Then down the bottom left of the Setup Window you will see an option to *Split into Volumes*. Input 500000 in the box and then press ok.

Then upload all the 500kb RAR files.


----------



## MCROZ (Jan 1, 2003)

Genius !

In fact the limit for those files is 400 (!) but here, I hope, they are.
If anything is missing please shout - now I know how to do this I can run the whole thing again if necessary .....
Really appreciate your help so far.
Am off to get lunch now - back later...
MC


----------



## reventon (Aug 2, 2010)

Hi,

Here is the basic summary of your BSODs so far - edited to show only the dumps that were informative.

```
[FONT=lucida console][SIZE=3]
[SIZE=2]BugCheck 50, {fffffca00e98e010, 1, fffff8800787122d, 7}
Probably caused by : [/SIZE][SIZE=2][COLOR=red]EX64.SYS[/COLOR][/SIZE][SIZE=2] ( EX64+6822d )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 50, {fffffca00211b010, 0, fffff8800713b9b2, 7}
Probably caused by : [/SIZE][SIZE=2][COLOR=red]SRTSP64.SYS[/COLOR][/SIZE][SIZE=2] ( SRTSP64+489b2 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 50, {fffffe8007374ae4, 0, fffff880014ade25, 7}
Probably caused by : [/SIZE][SIZE=2][COLOR=blue]Ntfs.sys[/COLOR][/SIZE][SIZE=2] ( Ntfs!NtfsOpenFile+2f9 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 50, {fffffca0122f4020, 1, fffff880012ee7ac, 7}
Probably caused by : [/SIZE][SIZE=2][COLOR=red]SYMDS64.SYS[/COLOR][/SIZE][SIZE=2] ( SYMDS64+57ac )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck [/SIZE][SIZE=2][COLOR=blue]24[/COLOR][/SIZE][SIZE=2], {1904fb, fffff880046f7ad8, fffff880046f7340, fffff88001534b39}
Probably caused by : [/SIZE][SIZE=2][COLOR=blue]Ntfs.sys[/COLOR][/SIZE][SIZE=2] ( Ntfs!TxfCleanupIsoSnapshots+19 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/SIZE] [/SIZE][/FONT]
```
Red drivers are part of Norton.

I would also suspect Norton in the following network errors:


```
[FONT=lucida console]
[SIZE=2]Event[1767]:
  Log Name: System
  Source: Service Control Manager
  Date: 2010-08-02T15:53:40.478
  Event ID: 7031
  Description: 
The Network Connections service terminated unexpectedly.

Event[1773]:
  Log Name: System
  Source: Service Control Manager
  Date: 2010-08-02T15:52:39.950
  Description: 
The WLAN AutoConfig service terminated unexpectedly.

Event[1779]:
  Log Name: System
  Source: Service Control Manager
  Date: 2010-08-02T15:52:39.950
  Description: 
The HomeGroup Listener service terminated unexpectedly.[/SIZE]  
[/FONT]
```
Both the fact that *Ntfs.sys* (the filesystem driver) was blamed for at least 2 of the dumps and that one of them was a *0x24* NTFS_FILE_SYSTEM BSOD made me curious about what your hard drive was like.

And sure enough:

```
[FONT=lucida console]
[SIZE=2]Event[1666]:
  Log Name: System
  Source: Ntfs
  Date: 2010-08-02T19:59:29.038
  Event ID: 55
  Description: 
[B]The file system structure on the disk is corrupt and unusable.[/B] Please run the chkdsk utility on the volume WINDOWS.

Event[1901]:
  Log Name: System
  Source: Ntfs
  Date: 2010-08-02T12:08:56.400
  Description: 
[B]The file system structure on volume C: cannot be corrected.[/B] Please run the chkdsk utility on the volume C:.[/SIZE]   
[/FONT]
```
You have had about 144 of these errors over the past 5 days.

*To run chkdsk:*

START -> type *cmd.exe* -> Right-click -> run as admin -> type *chkdsk /r /f* -> Press *Y* at prompt -> restart computer.

Also to check the drive's physical state run *SeaTools*

Download *SeaTools for DOS* from here: http://www.seagate.com/ww/v/index.j...toid=720bd20cacdec010VgnVCM100000dd04090aRCRD

Save to a USB drive and then use the BIOS to boot from the USB drive instead of the Hard Drive.

After it has detected the drive, select Basic Tests, then Long Test and let it run.

*Out of date drivers*

```
[FONT=lucida console]
[SIZE=2]igdkmd64.sys Fri Aug 28 03:07:00 2009 (4A96A114) - Intel Graphics
Rt64win7.sys Sat May 23 02:52:30 2009 (4A16BC2E) - Realtek Networking[/SIZE]
[/FONT]
```
While these are not way out of date, they could still use an update.

Intel Driver Updates (their "Update Utility" is good) -> http://downloadcenter.intel.com/Default.aspx

Realtek Network -> http://www.realtek.com/downloads/downloadsView.aspx?Langid=1&PNid=7&PFid=10&Level=3&Conn=2

*Other Problems*

*HP Printing:*

```
[FONT=lucida console]
[SIZE=2]Event[693]:
  Log Name: System
  Source: Service Control Manager
  Date: 2010-08-03T00:58:04.832
  Event ID: 7023
  Description: 
The [/SIZE][SIZE=2][COLOR=blue]Pml Driver HPZ12[/COLOR][/SIZE][SIZE=2] service terminated with the following error: 
Invalid access to memory location.[/SIZE]
[/FONT]
```
When I looked into this problem I came across this article - http://blogger.ziesemer.com/2007/11/hp-net-driver-hpz12-service-causing.html

I recommend you temporarily uninstall all drivers and software associated with the HP Digital Imaging module.

*BIOS:*

```
[FONT=lucida console]
[SIZE=2]Event[6273]:
  Log Name: System
  Source: ACPI
  Date: 2010-07-27T10:48:54.748
  Description: 
: The embedded controller (EC) did not respond within the specified timeout period. This may indicate that there is an error in the EC hardware or firmware or that the BIOS is accessing the EC incorrectly. 
[B]You should check with your computer manufacturer for an upgraded BIOS.[/B] In some situations, this error may cause the computer to function incorrectly.[/SIZE] 
[/FONT]
```


```
[FONT=lucida console][SIZE=2]BIOS Version: TOSHIBA V2.10, [B]06/05/2010[/B][/SIZE][/FONT]
```
No need to update the BIOS here. I am still interested as to what the cause of this error was, although it does appear to be a one-off event.

*Appcrash:*

```
[FONT=lucida console]
[SIZE=2]Event[273]:
  Log Name: Application
  Source: Application Error
  Date: 2010-08-03T00:52:32.000
  Event ID: 1005
  Task: Application Crashing Events
  Level: Error
  Description: 
Windows cannot access the file C:\Windows\SysWOW64\rsaenh.dll. Windows closed the program Internet Explorer because of this error.

Program: Internet Explorer
File: C:\Windows\SysWOW64\rsaenh.dll

Additional Data
Error value: C0000428
Disk type: 3[/SIZE]  
[/FONT]
```
The error you see there means:


> *STATUS_INVALID_IMAGE_HASH*
> The hash for image rsaenh.dll cannot be found in the system catalogs. The image is likely corrupt or the victim of tampering.


The rsaenh.dll module is part of the Cryptographic service - as Internet Explorer was running it it was most likely dealing with web encryption. As it was dealing with network traffic I suspect Norton in this crash aswell, although it could also be related to the *NTFS* errors as the error message mentions file corruption.

Now, note when the above error occured - 00:52 this morning. Then just after that the following happened:

```
[FONT=lucida console]
  [SIZE=2]Date: 2010-08-03T00:53:43.124
  Event ID: 7036
  Description: 
The Problem Reports and Solutions Control Panel Support service entered the stopped state.

  Date: 2010-08-03T00:55:35.000
  Event ID: 1074
  Description: 
The process Explorer.EXE has initiated the restart of computer MARTIN-TOSH on behalf of user Martin-TOSH\Martin for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: restart[/SIZE] 
[/FONT]
```
I am guessing the computer froze completely and then either you forced a shutdown or you managed to shutdown via Task Manager or similar?

*And another Appcrash*:
Note what program was running at the time of the following crash. Also, notice what module was "faulting" - an OS component. Norton is far more likely to be the cause here.

```
[FONT=lucida console]
[SIZE=2]Event[350]:
  Log Name: Application
  Source: Application Error
  Date: 2010-08-02T23:41:08.000
  Description: 
Faulting application name: ccSvcHst.exe, version: 109.0.0.107, time stamp: 0x4a92f9d9
Faulting module name: rsaenh.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdae0
Exception code: 0xc0000006
Fault offset: 0x0002f5f5
Faulting process id: 0xbec
Faulting application start time: 0x01cb3293cc1e905f
Faulting application path: [/SIZE][SIZE=2][COLOR=red][B]C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.4.131\ccSvcHst.exe[/B][/COLOR][/SIZE][SIZE=2]
Faulting module path: C:\Windows\system32\rsaenh.dll[/SIZE]
[/FONT]
```
*ToshibaReminder.exe ?*

Lastly, you theorised that it was the Toshiba Registration Reminder starting up again around the 23rd July that did you in. Well look at this error from the 20th July

```
[FONT=lucida console]
[SIZE=2]Event[4085]:
  Log Name: Application
  Source: Windows Error Reporting
  [/SIZE][SIZE=2][COLOR=blue]Date: 2010-07-20T10:52:54.000[/COLOR][/SIZE][SIZE=2]
  Description: 
Fault bucket 1267341287, type 5
Event Name: BEX64
Response: Not available
Cab Id: 0

Problem signature:
P1: explorer.exe
P2: 6.1.7600.16450
P3: 4aebab8d
P4: StackHash_5ddc
P5: 0.0.0.0
P6: 00000000
P7: 000003fef09fa5a0
P8: [/SIZE] [SIZE=2][COLOR=red][B]c0000005[/B][/COLOR][/SIZE][SIZE=2]
P9: 0000000000000008
P10: [/SIZE]
[/FONT]
```
The above represents a Windows Explorer crash/freeze - the red highlighted exception code means that there was a STATUS_ACCESS_VIOLATION - Norton is famous for causing that type of error.

You also have many similar errors going right back to the install date of Windows in February.

Going back to your problems with *toshibareminder.exe* - you were right, the first recorded error mentioning that program occured on the 24th.

```
[FONT=lucida console]
[SIZE=2]Event[3238]:
  Log Name: Application
  Source: Windows Error Reporting
  Date: 2010-07-24T00:28:59.000
  Event ID: 1001
  Description: 
Fault bucket 783849207, type 5
Event Name: CLR20r3
Response: Not available

Problem signature:
P1: toshibareminder.exe
P2: 8.0.4.0
P3: 4a7190e1
P4: System.Xml
P5: 2.0.0.0
P6: 4a275e0f
P7: 2818
P8: 124
P9: System.InvalidOperationException[/SIZE] 
[/FONT]
```
As there have been many related errors since then you should find and uninstall this program immediately.

I think all the above will do for starters. If you still have problems after fixing all of the above we will deal with them as they come up.

Regards,
Reventon

BUGCHECK SUMMARY 

```
[FONT=lucida console]
[SIZE=2]Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Tue Aug  3 19:08:33.094 2010 (GMT+12)
System Uptime: 0 days 0:47:25.060
*** WARNING: Unable to verify timestamp for EX64.SYS
*** ERROR: Module load completed but symbols could not be loaded for EX64.SYS
Probably caused by : EX64.SYS ( EX64+6822d )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  ccsvchst.exe
Bugcheck code 00000050
Arguments fffffca0`0e98e010 00000000`00000001 fffff880`0787122d 00000000`00000007
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Tue Aug  3 18:20:40.056 2010 (GMT+12)
System Uptime: 0 days 0:00:29.022
Probably caused by : memory_corruption ( nt!MiApplyCompressedFixups+40 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  TemproSvc.exe
Bugcheck code 00000050
Arguments fffffca0`01698412 00000000`00000000 fffff800`02f6b0cc 00000000`00000007
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Tue Aug  3 10:34:55.199 2010 (GMT+12)
System Uptime: 0 days 0:25:25.165
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )
BUGCHECK_STR:  0x1a_41790
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  MicroUpdater.e
Bugcheck code 0000001A
Arguments 00000000`00041790 fffffa80`0331ba50 00000000`0000ffff 00000000`00000000
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Tue Aug  3 10:09:00.544 2010 (GMT+12)
System Uptime: 0 days 1:06:46.510
Probably caused by : ntkrnlmp.exe ( nt!PfpFlushBuffers+6f )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  System
Bugcheck code 00000050
Arguments fffffe80`0aec3000 00000000`00000000 fffff800`03128b9f 00000000`00000007
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Tue Aug  3 08:06:44.866 2010 (GMT+12)
System Uptime: 0 days 0:16:46.832
*** WARNING: Unable to verify timestamp for SRTSP64.SYS
*** ERROR: Module load completed but symbols could not be loaded for SRTSP64.SYS
Probably caused by : SRTSP64.SYS ( SRTSP64+489b2 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  SearchProtocol
Bugcheck code 00000050
Arguments fffffca0`0211b010 00000000`00000000 fffff880`0713b9b2 00000000`00000007
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Mon Aug  2 11:00:33.936 2010 (GMT+12)
System Uptime: 0 days 0:00:38.903
Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+6378 )
BUGCHECK_STR:  0x1a_31
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  TemproSvc.exe
Bugcheck code 0000001A
Arguments 00000000`00000031 fffffa80`082d3c70 fffff880`0b7ca000 fffff8a0`01da8412
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Mon Aug  2 10:59:27.422 2010 (GMT+12)
System Uptime: 0 days 0:00:35.388
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+100 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  ccSvcHst.exe
Bugcheck code 00000050
Arguments fffffca0`01ac37c0 00000000`00000000 fffff800`02df5f8c 00000000`00000007
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sun Aug  1 22:45:46.275 2010 (GMT+12)
System Uptime: 0 days 0:00:34.241
Probably caused by : Pool_Corruption ( nt!ExFreePool+536 )
BUGCHECK_STR:  0x19_3
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  svchost.exe
Bugcheck code 00000019
Arguments 00000000`00000003 fffffa80`03c5d910 fffffe80`03c5d910 fffffe80`03c5d910
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sun Aug  1 22:44:39.127 2010 (GMT+12)
System Uptime: 0 days 0:09:31.957
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+40e4b )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  iexplore.exe
Bugcheck code 00000050
Arguments fffffc00`02cd85fa 00000000`00000008 fffffc00`02cd85fa 00000000`00000007
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sat Jul 31 23:10:16.757 2010 (GMT+12)
System Uptime: 0 days 1:21:54.723
Probably caused by : ntkrnlmp.exe ( nt!CmpAllocateKeyControlBlock+72 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  rundll32.exe
Bugcheck code 00000050
Arguments fffffca0`0fe1a650 00000000`00000001 fffff800`02f6e736 00000000`00000007
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Fri Jul 30 08:17:00.801 2010 (GMT+12)
System Uptime: 0 days 0:00:31.767
Probably caused by : Ntfs.sys ( Ntfs!NtfsOpenFile+2f9 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  System
Bugcheck code 00000050
Arguments fffffe80`07374ae4 00000000`00000000 fffff880`014ade25 00000000`00000007
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Fri Jul 30 08:15:31.729 2010 (GMT+12)
System Uptime: 0 days 8:31:55.696
*** WARNING: Unable to verify timestamp for SYMDS64.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMDS64.SYS
Probably caused by : SYMDS64.SYS ( SYMDS64+57ac )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  ccsvchst.exe
Bugcheck code 00000050
Arguments fffffca0`122f4020 00000000`00000001 fffff880`012ee7ac 00000000`00000007
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Wed Jul 28 19:47:26.337 2010 (GMT+12)
System Uptime: 0 days 0:00:28.304
Probably caused by : ntkrnlmp.exe ( nt!ObpQueryNameString+51 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  svchost.exe
BUGCHECK_STR:  0x7E
Bugcheck code 1000007E
Arguments ffffffff`c0000005 fffff800`02fa92e9 fffff880`02fe04a8 fffff880`02fdfd10
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Tue Jul 27 21:37:06.424 2010 (GMT+12)
System Uptime: 0 days 0:00:35.391
Probably caused by : Ntfs.sys ( Ntfs!TxfCleanupIsoSnapshots+19 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  ccsvchst.exe
BUGCHECK_STR:  0x24
Bugcheck code 00000024
Arguments 00000000`001904fb fffff880`046f7ad8 fffff880`046f7340 fffff880`01534b39
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Mon Jul 26 00:24:07.268 2010 (GMT+12)
System Uptime: 0 days 0:00:29.235
Probably caused by : fltmgr.sys ( fltmgr!FltpProcessOperationStatusCallbacks+2d )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x1E
PROCESS_NAME:  ccsvchst.exe
Bugcheck code 0000001E
Arguments ffffffff`c0000005 fffff880`0100d5dd 00000000`00000000 00000400`00000000
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sat Jul 24 11:20:58.923 2010 (GMT+12)
System Uptime: 0 days 0:00:33.030
Probably caused by : Pool_Corruption ( nt!ExFreePool+536 )
BUGCHECK_STR:  0x19_3
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  ccsvchst.exe
Bugcheck code 00000019
Arguments 00000000`00000003 fffffa80`03c5e150 fffffe80`03c5e150 fffffa80`03c5e150
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sat Jul 24 11:20:00.424 2010 (GMT+12)
System Uptime: 0 days 0:00:32.266
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29771 )
BUGCHECK_STR:  0x1a_5003
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  GoogleUpdate.e
Bugcheck code 0000001A
Arguments 00000000`00005003 fffff700`01080000 00000000`00000590 00000000`75dc7005
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sat Jul 24 11:18:57.363 2010 (GMT+12)
System Uptime: 0 days 11:32:04.330
Probably caused by : ntkrnlmp.exe ( nt!PfpFlushBuffers+255 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  System
Bugcheck code 00000050
Arguments fffffe80`07bd68c0 00000000`00000000 fffff800`030d4d85 00000000`00000007
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Fri Jul 23 23:07:16.215 2010 (GMT+12)
System Uptime: 0 days 0:00:26.182
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+233 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  svchost.exe
Bugcheck code 00000050
Arguments fffffe80`03c5d948 00000000`00000000 fffff800`02dbc0bf 00000000`00000007
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Fri Jul 23 22:23:13.350 2010 (GMT+12)
System Uptime: 0 days 0:05:18.316
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )
BUGCHECK_STR:  0x1a_41790
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  svchost.exe
Bugcheck code 0000001A
Arguments 00000000`00041790 fffffa80`0331ba20 00000000`0000ffff 00000000`00000000
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``[/SIZE][/FONT]
```


----------



## MCROZ (Jan 1, 2003)

*What can I say - thank you VERY much for taking the time to give this such detailed and expert analysis*.

It' s a lot for me (pretty much non-technical although I have found my way around the forums a few times in the past) to take in but I will do what I can until I get in too deep !

CHKDISK did in fact run without me prompting it twice in the last 3 or 4 days and the second time it fixed a ton of errors and problems ..... as you suggest I will run again. Bit nervous about starting up from USB and running Seatools (I have had bad experiences with older PCs starting in any "unusual" way but if I need to give that a go I will.

I will also look into the HP Digital Imaging issue - I know that some part of the HP suite was renowned for crashing IE in the past and I had successfully disabled that particular part. Obviously don't want to lose my normal print functions, however.

I responded to a TOSH BIos update message a few days ago (after the initial crashes) and have also updated the Realtek driver in the last week (prompted by Microsoft update).

*I guess the message is still to get rid of Norton ?* When I "turned off" all Norton functions this morning (having installed MS Security essentials - which then stopped working .....) I discovered I couldn't turn back on the Norton IS basic functions ...I then went through the repair/fix routines and it eventually cam back to life after what seemed like a lot of intervention .....after Secuity Essentials crashed I got VERY scared that I was open to infection .......is the answer to instal the MS and then completely remove Norton .....ie just turning it off causes another problem ?

I have disabled the TOSH remnder from startup but it didn't appear in control panel in the "uninstall" section ...I think I see it on C Drive, however, so I will get rid of it too.

Again REALLY appreciate your help so far. Very many thanks. Hopefully others watching this thread and with similar problems (I noticed a lot of threads on same subject on MS forum) will have some hope !

EDIT - couldn't find any obvious Intel driver updates (I didn't link anyhting to do with wired networking was relevant in my case) and no obvious way to identify an update for realtek (I assume the update I applied via MS Update would have been to the current one).

I had in fact had that IE hanging error related to HP Digital Image etc when I first installed the printer so I had already uninstalled the offending program from the HP suite as I would never have used it.


----------



## Jonathan_King (May 30, 2010)

Nice post Reventon!

Norton should be removed completely. After you have uninstalled it, run this cleanup utility: ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_Removal_Tool.exe


----------



## MCROZ (Jan 1, 2003)

May I ask a REALLY dumb question now and expose my ignorance and nervousness when it comes to antivirus ?
What sequence should I adopt when uninstalling Norton and replacing with (presumably) MS Security essentials ?

What I am nervous about is uninstalling Norton and having no protection when I thn go on the web and download MS Security ......but is that the safe and suggested sequence...ie

1. Uninstall NIS
2. Go to web and download and run cleanup utility
3. Go to web and download and instal MS Security ?

Thanks and please forgive the ignorance in this case.

BTW I ran CHKDSK but the window closed and I didn't see any errors so I might assume it's OK ?? I'll run again just to be sure.

Appreciate all the help.

MC


----------



## Jonathan_King (May 30, 2010)

It really doesn't matter, the chances of you getting infected for that long is very small.

If you are concerned, do the following in order:

1. Download MSE, and save it to the desktop: http://www.microsoft.com/security_essentials

2. Download the Norton removal tool, and save it to the desktop: ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_Removal_Tool.exe

3. Uninstall Norton.

4. Run the Norton removal tool that you downloaded.

5. Install MSE, that you downloaded.


----------



## MCROZ (Jan 1, 2003)

Thank You Sir.:up:

Full CHKDSK just run with no errors so fingers crossed.
Will remove NIS later tonight - should I also remove Norton Utilities ? ......if so is there a better or equivalent "cleaner" (I used CCleaner successfully in the past for disk cleanups - staying away now from any registry cleans but uninstalled it when I installed Norton Utilities)
I also periodically run Spybot which so far hasn't given any trouble.

MC

EDIT - are you guys familiar with this ?

http://www.memtest.org/

was suggested elsewhere that it might be worth running (although confess I couldn't work out what to download and run ...so at the moment I haven't followed up on it).


----------



## reventon (Aug 2, 2010)

CCleaner is ok, just make sure it stays away from the registry.

Also, it deletes BSOD minidumps - so don't run it if you have got another BSOD and have not saved the Minidump elsewhere first.

Get rid of Norton Utilities too.

Yes, we are familiar with Memtest. However currently this issue appears to be software related rather than hardware related. If you are still getting BSODs after fixing all the software aspects we will look at running the memtest then.


----------



## MCROZ (Jan 1, 2003)

OK - I have uninstalled Norton Internet Security and installed MSE so let's see what happens.
I couldn't however successfuly run the Norton removal tool as it keeps telling me I still have Norton Utilities installed - which I don't ....I even reinstalled and then uninstalled NU just to be sure, but it still thinks I have it ?

Not sure if that will create any conflicts ?

A couple more BSODs today including one while I was actually uninstalling NIS and providing Symantec with "feedback" on web on why I was doing it !

Reliability monitor reported a new one .."presentation font cache exe stopped working" followed immediately by windows shutdown 3 times and DNS client stopped working ...all at about the same time I was trying to remove Norton .....

Any advice on how to run the Norton removal tool .. ?

I was also prompted to update the realtec driver again today (this time by Toshiba) which I have done.


----------



## MCROZ (Jan 1, 2003)

OK - another BSOD this time after Norton had been uninstalled (but see comment on inability to run the removal tool, above - maybe some part of Norton is still there ?). Reboot was followed by "internet explorer has stopped working" (posting this via firefox - I had in fact just opened fireox when latest BSOD occurred):down::down:

Although I can see 4 new mindump files from 4 and 5 August I cannot zip or upload them - system tells me I do not have "Read permission" although I had managed to upload older files onto the MS forum. Is it worth running the data collection and posting again (would anyone have time to analyse it ?)

Now this is really getting me frustrated.

At what point should I consider a complete reinstal of Windows and applications from recovery disks with restore of files from backup on external HDD (assuming the backed up files don't include whatever problems are causing the BSODs) ?

I guess I should, however, now backup again so that I don't ever restore with Norton ?


----------



## reventon (Aug 2, 2010)

Did you run the Removal Tool in Safe Mode?


----------



## MCROZ (Jan 1, 2003)

Nope - will try that later.

Bit concerned now that I seem to be locked out of the minidump files ?

Just for the hell of it I will run the data collection routines again later today when I have time - so at least I have them (although I will not post unless someone asks me).

I'm not too phased by the prospect of a complete clean instal from recovry DVD disks (although I'm not sure of the difference between the two Toshiba disks that I created when I first installed the machine and the "repair Disk Windows 7 64 bit" that I recently created from within the WIN 7 action center.

I don't have much critical file data stored on the hard drive - my only slight concern would be whether Live Mail would be retored to it's current state when restoring from the most recent windows backup file, with all contacts prserved, plus "filed" sent/received emails etc. 

Thanks again for sticking with me on this one.


----------



## Mauritz (Aug 5, 2010)

Hi,

Can you upload your dumps,
I can debug the dumps

By Mauritz


----------



## MCROZ (Jan 1, 2003)

Hi - new dumps if create them today using the data collection ("jcgriff"" routines) ? (see previous dumps earlier in the thread) ..yes can do ..but see latest concern that I seem to be locked out of the minidump files even though thay are all sitting in the windows minidump folder.

What does anyone think about this piece of latest advide from Toshiba forum ?

"If you have no restore point before 23 July, [ which I don't]I think you should reinstall Windows. Using factory settings everything should work properly and no errors should occur.

You can use the HDD recovery feature to reinstall Windows"

How to recover a Toshiba notebook with the HDD recovery procedure? 
http://forums.computers.toshiba-europe.com/forums/ann.jspa?annID=58


----------



## Jonathan_King (May 30, 2010)

Mauritz said:


> Hi,
> 
> Can you upload your dumps,
> I can debug the dumps
> ...


Hello Mauritz, that is what Reventon did, as part of his analysis.


----------



## MCROZ (Jan 1, 2003)

reventon said:


> Did you run the Removal Tool in Safe Mode?


I just tried it in safe mode but it insists I have Norton Utilities installed and therefore will not run ...I reinstaledl and uninstaledl NU again but that didn't work - uninstaller says it has removed it - there is absolutely no evidence of it on C Drive but the removal tool says it is still there.

Latest update on BSOD if anyone is still following ......I am now *very* suspicious of MS Windows Update itself...

System had been rock solid all day as far as I can see. Then - five minutes ago - I installed an "optional" update to MSE(which seemed a good idea at the time) - from the windows update site...AND - after installation (for some reason my update history has also entirely disappeared) my wireless connection immediately dropped and then ..BSOD................coincidence or ???

I have saved all the latest Minidumps on external HDD just in case ....but here are the most recent 4 dumps (if they are of any use ..I had to zip to upload the one immediately preceding these cannot be zipped as I seem to have no access to it ....)


----------



## Jonathan_King (May 30, 2010)

reventon said:


> ```
> [FONT=lucida console]
> [SIZE=2]igdkmd64.sys Fri Aug 28 03:07:00 2009 (4A96A114) - Intel Graphics
> Rt64win7.sys Sat May 23 02:52:30 2009 (4A16BC2E) - Realtek Networking[/SIZE]
> ...


Try that before doing a reinstall.

...Summary of the Dumps:

```
[font=lucida console]
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Thu Aug  5 13:22:29.133 2010 (UTC - 4:00)
System Uptime: 0 days 6:23:42.100
BugCheck 50, {fffffca014bed6fc, 0, fffff80002fae56d, 7}
Probably caused by : ntkrnlmp.exe ( nt!CmpKcbCacheLookup+1dd )
BUGCHECK_STR:  0x50
PROCESS_NAME:  msdt.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Wed Aug  4 19:18:39.545 2010 (UTC - 4:00)
System Uptime: 0 days 2:32:31.512
BugCheck 50, {fffffd00c299fdf0, 0, fffff80002da5f8c, 7}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+100 )
BUGCHECK_STR:  0x50
PROCESS_NAME:  csrss.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Wed Aug  4 16:17:11.492 2010 (UTC - 4:00)
System Uptime: 0 days 1:38:03.459
BugCheck A, {fffff700010833a0, 0, 0, fffff80002c95166}
Probably caused by : memory_corruption ( nt!MiUpdateWsle+186 )
BUGCHECK_STR:  0xA
PROCESS_NAME:  wscstub.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Wed Aug  4 14:38:11.112 2010 (UTC - 4:00)
System Uptime: 0 days 9:56:33.079
BugCheck 50, {fffffca012982622, 0, fffff88001342f74, 7}
Probably caused by : fileinfo.sys ( fileinfo!FIPfStringFind+48 )
BUGCHECK_STR:  0x50
PROCESS_NAME:  svchost.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
[/font]
```


----------



## MCROZ (Jan 1, 2003)

OK - using the intel driver update utility I get this :

Graphics Driver 
Product Detected Mobile Intel® 4 Series Express Chipset Family 
Current Driver Installed 8.15.0010.1883 
A customized computer manufacturer driver is installed on your computer. The Intel Driver Update Utility is not able to update the driver. Installing a generic Intel driver instead of the customized computer manufacturer driver may cause technical issues. Contact your computer manufacturer for the latest driver for your computer.

Audio Driver for Intel® Desktop Board
Product Detected 
Current Driver Installed 
This device is unknown or unsupported. Please contact the manufacturer for possible updates. More information>>

Wireless Networking
Product Detected 
Current Driver Installed 
This device is unknown or unsupported. Please contact the manufacturer for possible updates. More information>>

Wired Networking
Product Detected Intel® Desktop Board DG41BI: Realtek* RTL8103EL Ethernet 
Current Driver Installed 7.3.522.2009 
Newer Driver Available: 7.006.0820.2009 
File Size: 5.247 MB 
Download Time: Time @56Kbps:12.44min 
Driver Description & Driver Documentation 

I assumed I didn't need to do anything related to wired networking but I have installed it anyway and it defaulted into the "repair" option when installing so who knows.....maybe just maybe that was a problem...let's see !

For realtek - as they don't have a convenient "analyse and update" facility on their site confess I'm not sure which driver I have to check (although as I said in previous posts, I have been prompted recently - and in case of the TOSH site - after the crashes started) to instal an update for a realtek driver ...which I have done.

Is it simply the WIN 7 driver 6.1111 from this list ?
http://www.realtek.com/downloads/do...&Level=5&Conn=4&DownTypeID=3&GetDown=false#1I

As far as the HP printing issue goes - that is not a problem - I had previosuly (on first installation of the HP printer under both XP on previous system and subsequently WIN7 on this laptop) uninstalled the offending HP module - the issue with it is that it perpetually crashes IE8 but not WIndows (in my experience).

Starting up this morning generated new errors and initial failure of desktop to load - shut down and restart, however, restored to normal.

One observation about a complete reinstal - IF the BSOD problems are in fact related to some kind of "update" issues - I can see that reinstalling without Norton (if it was Norton updates that were the problem) will fix it..BUT - if there is ANY chance that it was an MS update ....then surely as soon as I reinstal (back to 2/2010 state as it came out of the box) - as soon as I run MS update - whic of course I must for security patches etc ...won't the offening update(s) - if that's what they were ..simply appear again ?

Just a thought !

MC


----------



## MCROZ (Jan 1, 2003)

reventon said:


> CCleaner is ok, just make sure it stays away from the registry.
> 
> Also, it deletes BSOD minidumps - so don't run it if you have got another BSOD and have not saved the Minidump elsewhere first.


reventon - I noticed it's possible to "uncheck" memory dump files from CCleaner before running it so I guess that would be a safe option (although I am saving dumps on external HDD as well).

After all the stuff that's been going on I would like to tun some knd of cleanup routines to get rid of crap if possible....and clearly now I am not running Norton Utilities. Is it possible that CCleaner might find whatever remnant of NU is lurking somewhere and preventing me running that Norton removal tool ?


----------



## MCROZ (Jan 1, 2003)

Seemed to get through a whole day yesterday with no BSOD.

MSE doesn't seem, however, to be error-free ..?

Today - shortly after startup - in reverse order but all within a space of 30 minutes (and I had to manually restart MSE) these app crashes occurred. I checked for solutions using action center but windows doesn't find any ......

Not overly impressed now with an AV program that does't give continuous protection...but hey - a day without BSOD is a day of sunshine maybe.

Description
Faulting Application Path:	C:\Windows\servicing\TrustedInstaller.exe

Problem signature
Problem Event Name:	APPCRASH
Application Name:	TrustedInstaller.exe
Application Version:	6.1.7600.16385
Application Timestamp:	4a5bc4b0
Fault Module Name:	cbscore.dll
Fault Module Version:	6.1.7600.16385
Fault Module Timestamp:	4a5bde8f
Exception Code:	c0000005
Exception Offset:	00000000000b6448
OS Version:	6.1.7600.2.0.0.768.3
Locale ID:	2057
Additional Information 1:	0109
Additional Information 2:	010989a79145f43c65272b022daca739
Additional Information 3:	6dfd
Additional Information 4:	6dfd7b0d4ed4c10835e12b4736739ad8

Extra information about the problem
Bucket ID:	13574918

Description
Faulting Application Path:	C:\Program Files\Microsoft Security Essentials\MsMpEng.exe

Problem signature
Problem Event Name:	APPCRASH
Application Name:	MsMpEng.exe
Application Version:	2.1.6805.0
Application Timestamp:	4bac57df
Fault Module Name:	StackHash_eaac
Fault Module Version:	0.0.0.0
Fault Module Timestamp:	00000000
Exception Code:	c0000005
Exception Offset:	00000000009502ef
OS Version:	6.1.7600.2.0.0.768.3
Locale ID:	2057
Additional Information 1:	eaac
Additional Information 2:	eaacf54ceba554240882b0bea1a21fdc
Additional Information 3:	6ff2
Additional Information 4:	6ff2d6e55af60eabcff91e9f4408b299

Extra information about the problem
Bucket ID:	18347293

Description
Faulting Application Path:	C:\Windows\servicing\TrustedInstaller.exe

Problem signature
Problem Event Name:	APPCRASH
Application Name:	TrustedInstaller.exe
Application Version:	6.1.7600.16385
Application Timestamp:	4a5bc4b0
Fault Module Name:	cbscore.dll
Fault Module Version:	6.1.7600.16385
Fault Module Timestamp:	4a5bde8f
Exception Code:	c0000005
Exception Offset:	00000000000b6448
OS Version:	6.1.7600.2.0.0.768.3
Locale ID:	2057
Additional Information 1:	0109
Additional Information 2:	010989a79145f43c65272b022daca739
Additional Information 3:	6dfd
Additional Information 4:	6dfd7b0d4ed4c10835e12b4736739ad8

Extra information about the problem
Bucket ID:	13574918

Faulting Application Path:	C:\Windows\System32\svchost.exe

Problem signature
Problem Event Name:	APPCRASH
Application Name:	svchost.exe_Dnscache
Application Version:	6.1.7600.16385
Application Timestamp:	4a5bc3c1
Fault Module Name:	ntdll.dll
Fault Module Version:	6.1.7600.16559
Fault Module Timestamp:	4ba9b802
Exception Code:	c0000005
Exception Offset:	0000000000052b8d
OS Version:	6.1.7600.2.0.0.768.3
Locale ID:	2057
Additional Information 1:	1472
Additional Information 2:	1472e87357d2e196c06518cd3121c368
Additional Information 3:	4b05
Additional Information 4:	4b05292f0460758bf470767a3d94076d

Extra information about the problem
Bucket ID:	18195516

Faulting Application Path:	C:\Program Files\Microsoft Security Essentials\MsMpEng.exe

Problem signature
Problem Event Name:	APPCRASH
Application Name:	MsMpEng.exe
Application Version:	2.1.6805.0
Application Timestamp:	4bac57df
Fault Module Name:	mpengine.dll
Fault Module Version:	1.1.6004.0
Fault Module Timestamp:	4c355474
Exception Code:	c0000005
Exception Offset:	0000000000348625
OS Version:	6.1.7600.2.0.0.768.3
Locale ID:	2057
Additional Information 1:	858d
Additional Information 2:	858d730b22aa9732164880c26bdec1b9
Additional Information 3:	afc4
Additional Information 4:	afc47370e6955b9199d0a4206f2af94f

Extra information about the problem
Bucket ID:	19174376


----------



## reventon (Aug 2, 2010)

You had exactly the same kinds of errors with Norton, and I have a feeling if you install *any *AV you will get the same result.

What we are seeing here is symptomatic of a deeper fault. That re-install is looking good right about now.

If you do decide to go down that path then make sure you take things slowly, ie; don't install anything after you re-install and let all the Windows Updates roll in so you can be sure they are not the problem here.

Apart from that, have you run a memtest yet?



> *Memtest - Instructions:*
> 
> Download the ISO (or the .exe for USB drives) from here http://www.memtest.org/#downiso
> 
> ...


----------



## MCROZ (Jan 1, 2003)

OK - I have created an ISO disk for memtest and will try that when I get some time. Not completely sure, however, what you mean by "one stick of RAM in place at a time".

Just for interest this the config of my laptopp as acquired from the Toshiba Board - so I have 4096GB RAM (manufacturer spec - no memory upgrades applied since it came out of the box) ...I wasn't aware that was in "sticks" ? Incidentally I am sure it isn't showing all of the Windows updates which I have religiously applied since the laptop was new in Febraury this year.

I guess when you say "don't install anything after you re-install and let all the Windows Updates roll in so you can be sure they are not the problem here" you mean instal windows first - get all the updates and then install (restore) both the manufacturer pre-installed applications and any applications (eg iTunes) that I subsequently added ? On that basis would you recommend a reinstal from on-board HDD (as suggested on a Toshiba forum) or from the laptop recovery disks ? (apologies for asking more questions......). At what point do I then "restore" from the windows action center created backup file which is of course on external HDD

Although I have been through complete reinstals on previous older XP crashed boxes I have never before tried to do a reinstal and then a restore from a "proper" windows backup file or files.

Thanks again for the valuable advice.


[PC Information]
Model Name Satellite L500
Part Number PSLS0E-07501DEN

OS Version Microsoft Windows 7 Home Premium 6.1.7600
BIOS Version V2.10 
CPU Pentium(R) Dual-Core CPU T4400 @ 2.20GHz 
Physical Memory 4096MB RAM
Hard Disk Capacity 319,652,093,952 [Byte] 297.699 [GB] 
Hard Disk Free Space Capacity 261,193,232,384 [Byte] 243.255 [GB] 
Video Mobile Intel(R) 4 Series Express Chipset Family version=8.15.10.1883
Screen Resolution 1366 x 768 Pixels 
Color Quality True Color (32 Bit) 
Sound Realtek High Definition Audio version=6.0.1.5904
Intel(R) High Definition Audio HDMI version=6.10.1.2077 
Network Realtek PCIe FE Family Controller version=7.6.820.2009 MAC Address=70:5A:B6:70:BD:32
Realtek RTL8191SE Wireless LAN 802.11n PCI-E NIC version=2015.1.427.2010 MAC Address=00:26:B6:B6:54:37
Modem None
Internet Explorer 8.0.7600.16385
IDE Device TOSHIBA MK3263GSXN
TSSTcorp CDDVDW TS-L633C FW version=TF02

[QFE Information]
Windows Update "KB971033"
Windows Security Update "KB2032276"
Windows Security Update "KB2286198"
Windows Update "KB958488"
Windows Security Update "KB971468"
Windows Security Update "KB972270"
Windows Update "KB974332"
Windows Update "KB974431"
Windows Security Update "KB974571"
Windows Hotfix "KB975467"
Windows Update "KB975496"
Windows Security Update "KB975560"
Windows Update "KB976002"
Windows Update "KB976098"
Windows Update "KB976264"
Windows Update "KB976662"
Windows Update "KB977074"
Windows Update "KB977863"
Windows Update "KB978207"
Windows Security Update "KB978251"
Windows Security Update "KB978262"


----------



## MCROZ (Jan 1, 2003)

2 days BSOD free but here we go again (also noticed the IE8 is occasionally crashing).

Source
Windows

Summary
Shut down unexpectedly

Date
‎08/‎08/‎2010 11:22

Status
Report sent

Problem signature
Problem Event Name:	BlueScreen
OS Version:	6.1.7600.2.0.0.768.3
Locale ID:	2057

Extra information about the problem
BCCode:	a
BCP1:	FFFFF6FC00826578
BCP2:	0000000000000002
BCP3:	0000000000000000
BCP4:	FFFFF80002CAA58E
OS Version:	6_1_7600
Service Pack:	0_0
Product:	768_1
Bucket ID:	X64_0xA_nt!MiResolveMappedFileFault+8e
Server information:	8b40be4f-a4c2-4584-8635-578bbf6f7fb0

Latest dumps


----------



## MCROZ (Jan 1, 2003)

Another piece of (possibly useless) information.
Windows Update is not working ...

Code C8000CFA "Windows Update encountered an unknown error".

Although viewing installed upates via control panel lists 100 in total the "review update history" link from the Update page tells me "you have not tried to instal any pdates" - which is clearly not true.

Coming to the conclusion I will shortly need to a perform a complete reinstal and restore but am also considering getting local hands on expert help with that ...in case I do damage.

Thanks to any and all who are still following this thread and offering advice - it is appreciated.

I can live with periodic BSODs as long as the system successfully reboots but clearly something is fundamentally wrong with the software (haven't yet run the memtest .....I don't want to take any unncessary risks that the laptop fails entirely in the next 2-3 weeks as we have an important family wedding coming up and I don't want to risk being without email and web access !!!)

MC


----------



## reventon (Aug 2, 2010)

MCROZ said:


> Another piece of (possibly useless) information.
> Windows Update is not working ...
> 
> Code C8000CFA "Windows Update encountered an unknown error".
> ...


Hi,

Sorry I have not replied sooner - I had a busy week.

Yes, there are so many errors here that I think it would be wise to go for a re-install.

Run the memtest sometime. It should not damage your laptop at all (as it runs outside the Windows environment).

Regards,
Reventon


----------



## MCROZ (Jan 1, 2003)

No aplogies necessary reventon - I appreciate the interest others take in our problems.

Fixed the windows update issue by installing an MS fix from MS knowledge base (seems was a known problem) but one BSOD a day seems to have reappeared.

Have today also emailed Toshiba and pointed them to this thread and a smaller separate Toshiba forum thread - inviting them to comment on reliability (I attached the reliability report) and warranty implications .....although we all think this is a software problem. 

Have backed up again today although that was not without problems - backup failing twice before it was successful.

We'll see how we get on. 

MC


----------



## littlephoenix (Nov 18, 2008)

i thought BSOD is and has been history, specially with iwndows 7 in the picture,,,,


----------



## Jonathan_King (May 30, 2010)

littlephoenix said:


> i thought BSOD is and has been history, specially with iwndows 7 in the picture,,,,


Nope, as long as there is hardware that fails, and software not rigorously tested and certified by Microsoft (like Apple does), there will be BSODs.


----------



## ripulsachdeva (Jun 20, 2010)

Hi,i hope ur issue has been resolvd Mcroz..i strtd dis post in july,nw its august,whn i postd it da isue got resolvd on its own whn i did a clean instaltn of windws 7,nw ystrday wat hapnd,my cmputr was running n i ws watchng a muvie,i swtchd on my air cnditioner,the moment i swtchd it on my ups blinked,i mean the power supply was interuptd,so as a result my pc got restartd..nd frm that time,that is widin last one day i hv seen the bsod atlst 15times widin 5hours of my pc running...i hv agn done a clean instalatn of windws 7 ultimate bt the blue screen stil cums up quite often...and also i hv turnd on my a.c many times while my pc stil running bt no power loss hs been noticed widin last one day,nw since my pc got restartd whn i turned on my a.c yestrdy do u thnk the problem is the ups,nd i accurately remember that i m facing dis bsod mess aftr i got the ups to prevent damage to my pc,my cmputr used to work fine before i had a ups,i usd direct line fr eletricity wid no ups..


----------



## ripulsachdeva (Jun 20, 2010)

Also a bsod showed up when i was installing windows 7 last nyt . . . i mean it came up in da middle of instalation


----------



## reventon (Aug 2, 2010)

ripulsachdeva said:


> Hi,i hope ur issue has been resolvd Mcroz..i strtd dis post in july,nw its august,whn i postd it da isue got resolvd on its own whn i did a clean instaltn of windws 7,nw ystrday wat hapnd,my cmputr was running n i ws watchng a muvie,i swtchd on my air cnditioner,the moment i swtchd it on my ups blinked,i mean the power supply was interuptd,so as a result my pc got restartd..nd frm that time,that is widin last one day i hv seen the bsod atlst 15times widin 5hours of my pc running...i hv agn done a clean instalatn of windws 7 ultimate bt the blue screen stil cums up quite often...and also i hv turnd on my a.c many times while my pc stil running bt no power loss hs been noticed widin last one day,nw since my pc got restartd whn i turned on my a.c yestrdy do u thnk the problem is the ups,nd i accurately remember that i m facing dis bsod mess aftr i got the ups to prevent damage to my pc,my cmputr used to work fine before i had a ups,i usd direct line fr eletricity wid no ups..


We are willing to help you aswell, however I can't understand most of what you say to be honest.

Also, we do need the info, please follow these instructions: http://www.jcgriff2.com/BSODpostinstructions.html


----------



## MCROZ (Jan 1, 2003)

Just a short update

I mentioned in a previous post _"Have today also emailed Toshiba and pointed them to this thread and a smaller separate Toshiba forum thread - inviting them to comment on reliability (I attached the reliability report) and warranty implications .....although we all think this is a software problem". _

To their credit they did read the forum posts and replied today as follows (the net is - a recover / reinstal seems to be everyone's recommendation - although as they mention "memory" I agree I should run the memtest routine just to be sure).

Thank you for your email.

From reading all your forum posts you appear to have run all the obvious tests to rule out hardware problems on your notebook.

This sort of memory dump messages come up when Windows is having trouble retrieving stored data. This data can be stored either in physical or virtual memory. Physical memory being the RAM inside your notebook. Virtual memory usually being an area set aside on the Hard Drive.

You appear to have run tests on both of these finding no fault, so we suspect the fault lies within the stability of your current Windows installation.

We extensively test the software build on all our notebooks for reliability and stability, before releasing them to the public. But we have no control over what happens to then after that point. This is why software is specifically excluded from our warranties.

It does not appear that you have at any point recovered the notebook to the original factory state. Despite on the Toshiba forum it was the first thing that was suggested to you.

We would recommend you carry out a full product recovery using either the inbuilt Hard Drive partition or the Recovery DVDs you mention you have created. Both these will recover the operating system and all the factory installed software back to the state where we have tested works correctly on your system. 

I managed 2 days without BSOD - but not without various application crashes. I am also currently unable to instal 3 "important" windows 7 security updates (several others did in fact instal yesterday, and today I noticed some kind of driver update had occurred).

I have, however had 2 BSODs in rapid succession today.

I am now committed to a full recover/reinstal to the "out of the box" state in February - and as mentioned before I think I will take a very safe (I hope) option and get a local expert to give me hands-on assitance with it. Slightly woryying to see (if I understand the text speak correctly ?) from other posts that even a complete reinstal isn't guaranteed to fix BSOD occurrence (fortunately here in UK I don't have air conditioning ni my house - nor do I have a UPS).

*Many thanks *to Jonathan King and reventon who took a serious interest in this problem and gave me valuable advice. Your time and expertise are very much appreciated.

MC


----------



## jiml8 (Jul 3, 2005)

Having read through this entire thread, I think you should reinstall.

But before you do that, you should very carefully go through your hardware; you COULD have either bad memory or a failing hard drive.

What I saw as I read through this thread was evidence of a badly corrupted system, and I think you still have a corrupted registry which is causing you your current problems, hence the need for a reinstall.

The question is: "why was the system so badly corrupted?" It certainly could be a problem caused by Norton (I join the chorus of "avoid Norton", by the way) combined with a lack of file system maintenance on your part. File systems DO get corrupted for a large number of reasons and, particularly on a laptop, you need to run chkdsk at periodic intervals to catch and correct corruption before it spreads, and it WILL spread.

File systems also get corrupted by bad RAM, by a failing hard drive, or sometimes due to a malfunctioning component (hard disk controller) that is running too hot. So, you should start by making sure the fan in your laptop is running correctly, and that there is no dust blocking the passages through the machine. Beyond that, you should generally ensure the machine is not getting too hot. How you do this is probably vendor specific, and I don't have a Toshiba so I don't have any specific recommendations.

You then should run memtest to make sure there are no memory issues. Then you should run chkdsk \r to do a surface scan of the drive looking for any bad blocks.

After doing those things, then reinstall. And remember that you can cause hard drive errors by bumping or moving the laptop while the HD is running. Be very careful about that.


----------



## MCROZ (Jan 1, 2003)

OK - latest news - posting this from a netbook as I am currently running memtest (as suggested in a previous post) on the problem laptop.

I'm not a memtest expert (never used it before) but it seems I have a hardware memory problem. right now it seems to have run 3 passes of 8 or 9 tests and if I interpret the red half of the screen correctly has already found more than 300,000 errors.

If this is the case then I will be talking again to Toshiba about a warranty repair/replacement.

Appreciate your advice on file system maintenance etc ...but - this machine is 7 months old. I use it basically for email, web and photos. I had regularly run disk cleanup and Norton Utilities (yes OK OK I know....) cleanup routines. It's a laptop but it does not get moved around - at all - it is static on the desk at all times.

CHKDSK ran "automatically" yesterday after a windows update - with no errors (a previous chkdsk about a week or nmore ago did find and fix errors as noted in a previous post. The full and detailed chkdsk suggested by either Jonathan King or reventon also threw up no errors.

Quite how I am supposed to check the fan or overheating is beyond me .... as I said - the machine sits on a desk with in my view perfectly normal and adequate airflow all around it - it's a home computer installed in a regular home environment.

Memtest seems to be taking about an hour for each pass - so it will be some time before I get what assume will be a final result - I hope that will stay on the screen long enough for me to record it in some way (presumably pen and paper ...if there is any way to record it so I can provide it to Toshiba and avoid any debate about hw warranty replace/repair that would be very useful ...but as the machine is running outside windows I wonder how that would be possible) ?

All advice gratefully received as usual.

MC


----------



## Jonathan_King (May 30, 2010)

Try testing your sticks individually to see if you can identify the bad one. It may also be a bad motherboard slot.

Good idea talking with Toshiba, that is probably the best option at this point.


----------



## MCROZ (Jan 1, 2003)

"Try testing your sticks individually to see if you can identify the bad one. It may also be a bad motherboard slot"

Sorry - don't know how to do that - I booted from the ISO CD and it went straight into testing ...and that was 3 hours ago ...!!.

By the way - under the "err. bits" column I am getting a consistent number of 400 but against multiple "failing addresses".

Problem is I don't know how to interpret the data - but as half the screen is coloured red I assume that means "problem"..


----------



## reventon (Aug 2, 2010)

MCROZ said:


> I hope that will stay on the screen long enough for me to record it in some way (presumably pen and paper ...if there is any way to record it so I can provide it to Toshiba and avoid any debate about hw warranty replace/repair that would be very useful ...but as the machine is running outside windows I wonder how that would be possible) ?
> 
> All advice gratefully received as usual.
> 
> MC


Take a photo of it with your camera.

At least now you know the true problem.


----------



## jiml8 (Jul 3, 2005)

> Appreciate your advice on file system maintenance etc ...but - this machine is 7 months old. I use it basically for email, web and photos. I had regularly run disk cleanup and Norton Utilities (yes OK OK I know....) cleanup routines. It's a laptop but it does not get moved around - at all - it is static on the desk at all times.


Regardless. File systems DO get corrupted, and laptops are particularly susceptible. Running chkdsk periodically is a very good idea anyway.

As for checking the fan: Does the fan run? Does it exhaust hot air when it runs? Are the air intakes for the laptop clear? Not dirty? Not obstructed? You probably have a temperature monitoring utility. What does it say the temperature is?

Memtest failures are definitely pointing you in a direction. But, it is very possible that removing/replacing the memory board will cause the problem to go away. There are a lot of connectors on that board, and if even one connection is not right, you'll get errors. Laptops all have positive retention of the memory cards, but again...laptops lead a hard life. It could be as simple as removing the cover over the memory, removing and replacing the boards. You should try that.

Beyond that, then most probably you do have a warranty issue with Toshiba.


----------



## MCROZ (Jan 1, 2003)

reventon said "Take a photo of it with your camera".
Great Minds think alike reventon - that's exactly what I did !

I just stopped the memtest (2AM UK time ..I am spending too much time on this..) after 7 passes and 9 hours ! I thought it would stop at 7 but it started on the eighth and I am running out of steam.

The "headline" seems to be ...

Cached  Rsvd Mem Mem Map Cache ECC Test Pass Errors

3933M 236K e820 On Off Std 7 1118720

I guess that means a memory problem.

Other details

Intel Core 2 2195Mhz
L1 Cache 32K 30912 MB/s
L2 Cache 1024K 14345 MB/s
L3 Cache None

Memory 3933M 3135 MB/s
Chipset Intel PM/GM45/47 FSB : 199Mhz - ype DDRII
Settings RAM 399Mhz (DDR 798) / CAS : 6-6-6-15 / Dual Channel
To answer Jiml8's questions :

Does the fan run? YES
Does it exhaust hot air when it runs? YES
Are the air intakes for the laptop clear? YES Not dirty? NO
Not obstructed? NO 
You probably have a temperature monitoring utility. NO IDEA What does it say the temperature is?
NO IDEA

So the suggestion is maybe now to simply open the case and remove/re-seat the memory ????

Laptops have a hard life ? Sure - but mine never has - it only ever left the top of this desk once since it was placed there when it was new - and it went as far as my downstairs living room. That's not likely, surely, to dislodge anything (I was VERY careful moving it - I have lived with laptops a long time and carried my office machine - when I had one - to and from the office in a rucksack and in the boot of my car for many years without any problem ...that was an IBM Thinkpad ...later a Lenovo Thinkpad ) ?

As this machine is still under manufacturer warranty (and I in fact have a two year parts and labour warranty from the retailer) I think my preference is now to send Toshiba the memtest details (including a picture) - particularly as they have themselves suggested a memory problem may be the cause of the crashes - and invite them to replace the memory under warranty.

They can then restore/reinstal windows and applications to the original state (I guess I still have to suffer 100+ MS updates when I get it back ...unless they are kind to me....) - and then hopefully (if the WIN7 backup has been working properly each time I have run it - I can restore all my files and folders - my only real concern is whether all my LiveMail email contacts and history will have been backed up and will restore easily.


----------



## MCROZ (Jan 1, 2003)

Toshiba agree it is a hardware RAM problem and will fix it under warranty. I sent them a picture of the memtest result.

They responded to my lastest email in a matter of a few hours so no complaints about that.

To quote their reply :

"From the picture that you have supplied it does indeed seem to be a RAM memory module to be at fault . In regards to the re-installation of the operating system after the repair, you will be required to run a recovery from the Recovery Media you created from the machine ...... The notebook will be installed with an operating system when it is returned to you but this will only be to check that the notebook is working correctly under testing utilities. This operating system will only be a test version".

I can only hope that the WIN7 backup has been working properly - I see a file called (username)-TOSH on my external drive ...
16.1 GB, 291 files, 22 folders with a date created 20 February 2010 - which obviously isn't the date I last backed up ..it is in fact the first time I ran the backup utility..but I'm assuming each successful backup simply overwrites the last and doesn't change the created date ?

As Toshiba have a carry-in warranty service I will make sure I check all recover/reinstal/restore details with them when I get it fixed.

Thanks again to all who took the time to offer advice on this one. What looked like a software problem seems to have been a hardware failure .....naively I imagined memory was unlikely to simply fail in normal use environment but we learn something every day.


----------



## reventon (Aug 2, 2010)

Ok - good luck with the repair/re-install.

Personally I would manually back up your most important files (by simply using Windows to copy them to an external drive - this way you know that the files can be read).


----------



## ripulsachdeva (Jun 20, 2010)

BSOD resolved....i just selected the option "reload the default settings" in the BIOS and its one week since i have seen a BSOD....u try the same MCROZ....may be it helps


----------

