My BSOD methods - John Carrona, MVP (usasma)

usasma · Oct 19, 2012

How I do BSOD analysis
(from a series of posts here: https://www.sysnative.com/forums/showthread.php/3814-BSOD-on-friends-computer?p=27780#post27780)

Just FYI
- here's a link on how I did it back in 2010: http://www.carrona.org/dbgrpt.html
- here's a link on how I did it back in a couple of months ago: http://www.carrona.org/howidoit.html

First, I must say that the analysis all depends on what data/reports you collect.
Second, I must remind you that this is from an actual analysis - so some of the stuff is specific to that situation.

PERFMON /REPORT:

I like to start by looking at the Errors/Warnings/and Information section of the perfmon /report:
Disabled devices can still load drivers. Find out why they're disabled (looking for problems that caused the owner to disable them)
Then remove them if at all possible, if not then enable them, update the drivers - then disable if so desired

Missing events may be significant, but I generally don't pursue them unless there's evidence that they're needed

Dirty Flag is a huge clue! There's something wrong with the hard drive. It's most likely a file system problem, but can be a hardware issue.
Run chkdsk /r to attempt to fix - if it doesn't work, then a format of the hard drive is required to fix it.
Also, in case it's a problem with the hard drive - run diagnostics: http://www.carrona.org/hddiag.html

Why are the Realtek wired networking device and the Cisco VPN device disabled?
Please remove them from the system if possible. If not, please enable them, then update their drivers. Feel free to disable them again if so desired

Please run chkdsk /r /f from an elevated (Run as administrator) Command Prompt.
Recheck to see if the Dirty Bit is fixed (run another perfmon /report)
If not, start backing up your stuff as a format is the only other way to fix it.
While doing this, also perform a hard drive diagnostic in case the hard drive is starting to die: http://www.carrona.org/hddiag.html

Then I move on to the $systeminfo.txt report

$SYSTEMINFO.TXT REPORT:

I check for anything that might signal a pirated copy of Windows
I check for Service Pack level
Some people check the install date - I'm not that concerned about it
I check the amount of memory and the amount being used.
I check the number of hotfixes. Win7 SP1 has 130 to 140 hotfixes - if the system doesn't have that many, I suggest visiting Windows Update to get all available updates (some systems only have 100 or so - so this isn't a firm number).
I check networking devices - particularly looking for USB wireless devices as they have issues with Win7 systems

In this case there's nothing unusual - so I move on to MSINFO32 (in the next post)

MSINFO32.NFO REPORT:

I look for:
- Components...Network...Adapter - to see if there are any problems and to see if there are any wireless USB devices
- Components...Storage...Drives - to see if any of the drives have less than 15% free space (I don't calculate each one - I just estimate)
- Components...Storage...Disks - to see how many disks are present (I use it as an indicator to check the PSU size) and if any are SSD's (different instructions on how to update drivers)
- Components...Problem Devices - research and find out why. In this case it's repetition from the perfmon /report
- Software Environment...Windows Error Reporting - I check for BSOD info (looking for patterns) and other items that might stand out as unusual
- Software Environment...Startup Programs - look for any known problem startup items
- Software Environment...Program Groups - look for any known problem programs

On this system there's slightly more than 10% free space on the single hard drive. Id suggest freeing up 40 gB more in order to achieve optimum performance (but this will have to wait on the results of the Dirty Bit stuff discussed above).

Daemon Tools is a known cause of BSOD's on some Win7 systems. Please do the following:

Daemon Tools (and Alcohol % software) are known to cause BSOD's on some Win7 systems (mostly due to the sptd.sys driver, although I have seen dtsoftbus01.sys blamed on several occasions).
Please un-install the program, then use the following free tool to ensure that the troublesome sptd.sys driver is removed from your system (pick the 32 or 64 bit system depending on your system's configuration): ~~http://www.duplexsecure.com/faq#remove_32sptd~~ Link broken as of 21 Jul 2012
New link (15 Aug 2012): http://www.duplexsecure.com/downloads (pick the appropriate version for your system and select "Un-install" when you run it).
Alternate link: http://www.disc-tools.com/download/sptd
Manual procedure here: http://daemonpro-help.com/en/problems_and_solutions/registry_and_sptd_problems.html

Other analysts will use other reports - and I'll use other reports depending on what I see up to this point (and after looking at the memory dumps).

MEMORY DUMPS:

What we look for in the memory dumps is 3 things:
- evidence that a certain driver is causing a problem.
- the presence of known problem drivers
- outdated drivers

In short, there's 3 things that can cause BSOD's (and I look for them in this order):
- 3rd party drivers (non-Windows)
- hardware problems
- Windows problems
FYI - there's other things (like compatibility issues and malware) that can appear to cross the border between the different things. So it's never a 100% solution.

There's a program by writhziden that allows us to highlight the problem drivers - but currently that's an individual project (so not all known problem drivers may get highlighted). And "known problem drivers" is a vague term - usually obtained by consensus between BSOD analysts

PM either writhziden or jcgriff2 for access to the forum with the program. It's an amazing tool that let's us run several dumps at one time - and allows customization of the output to make it easier for us to review the data output.

Outdated drivers are those that are older than the latest service pack for that OS
BUT, antivirus and video drivers should be the most current available from the chipset manufacturer (NOT the PC Manufacturer)

Finally, I post the summary text - so that others can review the data and draw their own conclusions.
I try to also state (somewhere) in the post as to what I suspect is the primary cause - but that's not always easy.
I also try to post the follow-up steps - so that the OP knows what the next steps are if this doesn't fix the problem.

In this one, I look at the memory dump codes (part of writhziden's program) and find that there were 6 memory dumps, with 4 different BSOD error codes - and 5 different causes.

Here's my canned speech about that:

This is most likely a hardware problem. They (hardware problems) are usually caused by one of these things:
- borked (broken) hardware (several different procedures used to isolate the problem device)
- overclocking - You'll know if you're overclocking or not. If uncertain we can suggest things to check.
- compatibility issues (3rd party hardware/drivers)
- low-level driver problems
- or even malware (scanned for when we ask for hardware diagnostics from http://www.carrona.org/initdiag.html or http://www.carrona.org/hwdiag.html ).

But, we've seen hard drive issues (the Dirty Bit thing) - and there is one memory dump that refers to the file system (NTFS) on the hard drive.
So I'd focus on that for starters (using the steps that I suggested back in the beginning for the Dirty Bit. Also, the hard drive diagnostic is essential to save the poster's time (if the hard drive is dying, then they're wasting their time with all the fixes that I suggest - as they be reinstalling Windows when they put in a new hard drive).

Then I review the BSOD summaries - and reread the entire BSOD text if needed (didn't note anything in particular here)
Then I review the 3rd party driver list for known problems (I found Daemon Tools stuff here - so refer back to the Daemon Tools instructions - FWIW, this is the second most likely cause of the problems (after the hard drive issues).
Then I review the dates of the 3rd party drivers (Win7 SP1 came out in mid-2009, but I entered it into the progam so that it's automatically highlighted for me.

Please update these older drivers. Links are included to assist in looking up the source of the drivers. If unable to find an update, please remove (un-install) the program responsible for that driver. DO NOT manually delete/rename the driver as it may make the system unbootable! :

wacommousefilter.sys Fri Feb 16 13:12:17 2007 (45D5F401)
Wacom(tablet) Mouse Filter
http://www.carrona.org/drivers/driver.php?id=wacommousefilter.sys

dne64x.sys Mon Nov 10 20:01:24 2008 (4918D964)
Citrix Deterministic Network Enhancer Miniport or Cisco Systems VPN Client
http://www.carrona.org/drivers/driver.php?id=dne64x.sys

OA008Ufd.sys Fri Mar 6 02:33:57 2009 (49B0D1E5)
Video Class Upper Filter Driver
http://www.carrona.org/drivers/driver.php?id=OA008Ufd.sys

CtClsFlt.sys Mon Jun 15 01:06:41 2009 (4A35D6E1)
Creative Camera Class Upper Filter Driver
http://www.carrona.org/drivers/driver.php?id=CtClsFlt.sys
Probably the biggest PITA I've had with a camera. I have some special files for this at work if we need to get into this in detail.

Acceler.sys Fri Jun 26 16:56:34 2009 (4A453602)
Accelerometer - in this case Dell, however the same driver could be used by other manufacturers
http://www.carrona.org/drivers/driver.php?id=Acceler.sys

risdpe64.sys Wed Jul 1 05:31:57 2009 (4A4B2D0D)
Ricoh PCIe Memory Stick Host Controller
http://www.carrona.org/drivers/driver.php?id=risdpe64.sys

OA008Vid.sys Mon Jul 13 01:48:21 2009 (4A5ACAA5)
Video Capture Device Driver
http://www.carrona.org/drivers/driver.php?id=OA008Vid.sys

stdflt.sys Thu Jul 16 11:36:50 2009 (4A5F4912)
Dell OEM Accelerometer driver
http://www.carrona.org/drivers/driver.php?id=stdflt.sys

SynTP.sys Mon Aug 24 13:37:05 2009 (4A92CFC1)
Synaptic Touch Pad Driver
http://www.carrona.org/drivers/driver.php?id=SynTP.sys

HECIx64.sys Thu Sep 17 15:54:16 2009 (4AB293E8)
Intel Management Engine Interface
http://www.carrona.org/drivers/driver.php?id=HECIx64.sys

wacomvhid.sys Mon Sep 21 19:29:14 2009 (4AB80C4A)
Wacom Virtual HID Device Driver
http://www.carrona.org/drivers/driver.php?id=wacomvhid.sys

sptd.sys Sun Oct 11 16:55:14 2009 (4AD24632)
SCSI Pass Through Direct Host - Daemon Tools (known issues with Win7)
http://www.carrona.org/drivers/driver.php?id=sptd.sys
This is the cause of the Daemon Tools issue - follow the instructions above.

PxHlpa64.sys Tue Oct 20 14:08:42 2009 (4ADDFCAA)
Sonic CD/DVD driver (used by many different CD/DVD programs)
http://www.carrona.org/drivers/driver.php?id=PxHlpa64.sys
Don't stress over this one - it's rarely at fault and it's a pain to locate and remove

In short, I think that the hard drive is the largest issue here - with Daemon Tools coming in in second place. The outdated drivers are an unknown - but with so many being older your time would be well spent by updating/removing them.

If all of this doesn't fix things, then we'll move on to hardware diagnostics ( http://www.carrona.org/hwdiag.html)

And this is the summary of what the application generated:
You'll notice some drivers in it (the 8 character filenames that start with "a" (lower case) and end in ".SYS" (upper case)) that aren't listed above.
These are dynamically generated driver names from Daemon Tools and they change each time the program is launched. There's no need to pay attention to them - but I wanted to leave them in so that you could see them.

Analysis:
The following is for information purposes only.

Code:

[font=lucida console]**************************Sun Sep 23 14:07:32.038 2012 (UTC - 4:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\092312-22651-01.dmp]
Windows 7 Kernel Version [B]7601 [/B](Service Pack 1) MP (4 procs) Free x64
Built by: [B]7601[/B].17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime:[B]0 days 3:02:17.552[/B]
BugCheck Code: [B]BugCheck 3B, {c0000005, fffff88004393983, fffff88009f6f540, 0}[/B]
Probably caused by :[B]dxgmms1.sys ( dxgmms1+1983 )[/B]
BugCheck Info: [B]SYSTEM_SERVICE_EXCEPTION (3b)[/B]
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x3B
PROCESS_NAME: [B]Gw2.exe[/B]
FAILURE_BUCKET_ID: [B]X64_0x3B_dxgmms1+1983[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Sep 23 10:57:59.554 2012 (UTC - 4:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\092312-20264-01.dmp]
Windows 7 Kernel Version [B]7601 [/B](Service Pack 1) MP (4 procs) Free x64
Built by: [B]7601[/B].17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime:[B]0 days 0:46:23.694[/B]
BugCheck Code: [B]BugCheck 4E, {99, 3b60e, 2, 3b608}[/B]
Probably caused by :[B]memory_corruption ( nt!MiBadShareCount+4c )[/B]
BugCheck Info: [B]PFN_LIST_CORRUPT (4e)[/B]
BUGCHECK_STR:  0x4E_99
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME: [B]explorer.exe[/B]
FAILURE_BUCKET_ID: [B]X64_0x4E_99_nt!MiBadShareCount+4c[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Sep 23 01:28:47.930 2012 (UTC - 4:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\092312-24273-01.dmp]
Windows 7 Kernel Version [B]7601 [/B](Service Pack 1) MP (4 procs) Free x64
Built by: [B]7601[/B].17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime:[B]0 days 0:14:08.054[/B]
BugCheck Code: [B]BugCheck 24, {1904fb, fffff8800a9e7bc8, fffff8800a9e7420, fffff880014b1527}[/B]
Probably caused by :[B]Ntfs.sys ( Ntfs!NtfsFindPrefixHashEntry+1fe )[/B]
BugCheck Info: [B]NTFS_FILE_SYSTEM (24)[/B]
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME: [B]svchost.exe[/B]
BUGCHECK_STR:  0x24
FAILURE_BUCKET_ID: [B]X64_0x24_Ntfs!NtfsFindPrefixHashEntry+1fe[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Sep 23 01:13:47.627 2012 (UTC - 4:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\092312-23805-01.dmp]
Windows 7 Kernel Version [B]7601 [/B](Service Pack 1) MP (4 procs) Free x64
Built by: [B]7601[/B].17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime:[B]0 days 3:31:13.001[/B]
BugCheck Code: [B]BugCheck 50, {fffffb2ec01c5b5b, 0, fffff80003075e85, 7}[/B]
Probably caused by :[B]memory_corruption ( nt!MiAgeWorkingSet+52b )[/B]
BugCheck Info: [B]PAGE_FAULT_IN_NONPAGED_AREA (50)[/B]
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME: [B]WLIDSVCM.EXE[/B]
FAILURE_BUCKET_ID: [B]X64_0x50_nt!MiAgeWorkingSet+52b[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sat Sep 22 21:41:15.055 2012 (UTC - 4:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\092212-54990-01.dmp]
Windows 7 Kernel Version [B]7601 [/B](Service Pack 1) MP (4 procs) Free x64
Built by: [B]7601[/B].17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime:[B]5 days 2:07:58.569[/B]
BugCheck Code: [B]BugCheck 4E, {99, 1c557b, 2, 1be1ba}[/B]
Probably caused by :[B]memory_corruption ( nt!MiBadShareCount+4c )[/B]
BugCheck Info: [B]PFN_LIST_CORRUPT (4e)[/B]
BUGCHECK_STR:  0x4E_99
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME: [B]Gw2.exe[/B]
FAILURE_BUCKET_ID: [B]X64_0x4E_99_nt!MiBadShareCount+4c[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Mon Sep 17 19:32:13.366 2012 (UTC - 4:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\091712-26098-01.dmp]
Windows 7 Kernel Version [B]7601 [/B](Service Pack 1) MP (4 procs) Free x64
Built by: [B]7601[/B].17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime:[B]1 days 10:46:25.228[/B]
BugCheck Code: [B]BugCheck 50, {7fefce12fcc, 8, 7fefce12fcc, 8}[/B]
Probably caused by :[B]ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+45ea5 )[/B]
BugCheck Info: [B]PAGE_FAULT_IN_NONPAGED_AREA (50)[/B]
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME: [B]svchost.exe[/B]
FAILURE_BUCKET_ID: [B]X64_0x50_BAD_IP_nt!_??_::FNODOBFM::_string_+45ea5[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/font]

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.

Code:

[font=lucida console]**************************Sun Sep 23 14:07:32.038 2012 (UTC - 4:00)**************************
[COLOR=RED][B]wacommousefilter.sys        Fri Feb 16 13:12:17 2007 (45D5F401)[/B][/COLOR]
[COLOR=RED][B]dne64x.sys                  Mon Nov 10 20:01:24 2008 (4918D964)[/B][/COLOR]
[COLOR=RED][B]OA008Ufd.sys                Fri Mar  6 02:33:57 2009 (49B0D1E5)[/B][/COLOR]
GEARAspiWDM.sys             Mon May 18 08:17:04 2009 (4A1151C0)
[COLOR=RED][B]CtClsFlt.sys                Mon Jun 15 01:06:41 2009 (4A35D6E1)[/B][/COLOR]
[COLOR=RED][B]Acceler.sys                 Fri Jun 26 16:56:34 2009 (4A453602)[/B][/COLOR]
[COLOR=RED][B]risdpe64.sys                Wed Jul  1 05:31:57 2009 (4A4B2D0D)[/B][/COLOR]
[COLOR=RED][B]OA008Vid.sys                Mon Jul 13 01:48:21 2009 (4A5ACAA5)[/B][/COLOR]
intelppm.sys                Mon Jul 13 19:19:25 2009 (4A5BC0FD)
[COLOR=RED][B]ause0drf.SYS                Tue Jul 14 17:12:55 2009 (4A5CF4D7)[/B][/COLOR]
[COLOR=RED][B]stdflt.sys                  Thu Jul 16 11:36:50 2009 (4A5F4912)[/B][/COLOR]
SynTP.sys                   Mon Aug 24 13:37:05 2009 (4A92CFC1)
HECIx64.sys                 Thu Sep 17 15:54:16 2009 (4AB293E8)
wacomvhid.sys               Mon Sep 21 19:29:14 2009 (4AB80C4A)
[COLOR=RED][B]sptd.sys                    Sun Oct 11 16:55:14 2009 (4AD24632)[/B][/COLOR]
PxHlpa64.sys                Tue Oct 20 14:08:42 2009 (4ADDFCAA)
Impcd.sys                   Fri Feb 26 18:32:11 2010 (4B8859FB)
amdxata.sys                 Fri Mar 19 12:18:18 2010 (4BA3A3CA)
rimspe64.sys                Thu Oct  7 22:41:46 2010 (4CAE84EA)
rixdpe64.sys                Sun Oct 10 00:56:36 2010 (4CB14784)
IntcDAud.sys                Tue Aug 23 09:12:57 2011 (4E53A759)
Sftvollh.sys                Fri Sep 30 12:42:46 2011 (4E85F186)
Sftplaylh.sys               Fri Sep 30 12:43:05 2011 (4E85F199)
Sftfslh.sys                 Fri Sep 30 12:43:06 2011 (4E85F19A)
Sftredirlh.sys              Fri Sep 30 12:43:14 2011 (4E85F1A2)
AMPPAL.sys                  Wed Oct 19 17:19:07 2011 (4E9F3ECB)
NETwNs64.sys                Mon Oct 31 18:57:43 2011 (4EAF27E7)
igdkmd64.sys                Tue Jan 10 17:28:09 2012 (4F0CBB79)
MpFilter.sys                Fri Mar  9 06:05:26 2012 (4F59E3F6)
mbam.sys                    Tue Mar 20 12:04:48 2012 (4F68AAA0)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Sep 23 10:57:59.554 2012 (UTC - 4:00)**************************
[COLOR=RED][B]ak03wh0c.SYS                Tue Jul 14 17:12:55 2009 (4A5CF4D7)[/B][/COLOR]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Sep 23 01:28:47.930 2012 (UTC - 4:00)**************************
[COLOR=RED][B]agyo5yv0.SYS                Tue Jul 14 17:12:55 2009 (4A5CF4D7)[/B][/COLOR]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Sep 23 01:13:47.627 2012 (UTC - 4:00)**************************
[COLOR=RED][B]aybz7bdp.SYS                Tue Jul 14 17:12:55 2009 (4A5CF4D7)[/B][/COLOR]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sat Sep 22 21:41:15.055 2012 (UTC - 4:00)**************************
[COLOR=RED][B]ado71mue.SYS                Tue Jul 14 17:12:55 2009 (4A5CF4D7)[/B][/COLOR]
pcdsrvc_x64.pkms            Mon May  9 20:20:44 2011 (4DC884DC)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Mon Sep 17 19:32:13.366 2012 (UTC - 4:00)**************************
[COLOR=RED][B]a9xjtzag.SYS                Tue Jul 14 17:12:55 2009 (4A5CF4D7)[/B][/COLOR]
[/font]

Capt.Jack Sparrow · Nov 6, 2012

Excellent Method .. I mostly do the same method though not extensively as you do on my first attempt. If the OP still have the issue after my initial analysis, then I may dig little deeper.

Thanks for sharing!

My BSOD methods - John Carrona, MVP (usasma)

usasma

Retired Admin

Capt.Jack Sparrow

BSOD Kernel Dump Expert