Windows 7 Blue screen after logging in - may be related to AVG

[tatrman]

Hi,
I'm stuck with a problem with my windows 7 (x64 Home premium on i7-920)
While working with 3dsmax (rendering a picture) a message pop up saying system is unable to access (a rather strange filename I didn't have a chance to write down) few moments after that I got a message from AVG about some fake threats (for a second) and than I got blue screen saying windows shut down to prevent damage to your computer with some code which again I don't have a chance to write down because the blue screen flashes only for a second and than the computer start to boot again - if I choose boot normally I will get the same blue screen and immediate restart shortly after logging in.
I've tried to run system restore from safe mode (couple of times with different points)- it reports that it is unable to complete the system restore.
I've tried to get rid off AVG - though system restore didn't work I managed to run windows in normal mode but after a while I got the same.
I have a dual boot with ubuntu 10 - it runs however it experiences problems while booting as well - it freezes just before loading GRUB but after immediate reset it boots and works ok. I run some diagnostics from linux and everything seems to be all right. (linux is on second HDD)

Anyone with similar experience?

 

[Elmer]

Hi tatrman and welcome to the Forum.

To give yourself a fighting chance:
AVG is known to be a cause of BSOD's on some Win 7 systems. Suggest to you uninstall it. Download the correct Link Removed for your system.
If you have AVG ID protection installed, download the Link Removed as well (it wouldn't hurt to download and run it anyway). Download Link Removed due to 404 Error as its replacement. Re-boot to Safe Mode. In Safe Mode run the AVG Removal tools. Re-boot to normal mode and install MSE. Make sure your Windows firewall is enabled.

 

[Elmer]

To ensure minidumps are enabled:

Go to Start, in the Search Box type: sysdm.cpl, press Enter.
Under the Advanced tab, click on the Startup and Recovery Settings... button.
Ensure that Automatically restart is unchecked.
Under the Write Debugging Information header select Small memory dump (256 kB) in the drop-down box (the 256kb varies).
Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
OK your way out.
Reboot if changes have been made.

The .dmp files are located at C:\Windows\Minidump. Until a .dmp file is generated, the Minidump folder may not exist.

The next time you get a BSOD: Go to your C:\Windows\Minidump folder. Copy the .dmp files to a new folder on your desktop. Zip up that folder and attach to a post.

Link Removed

 

[tatrman]

Hi Elmer,

thanks for your help. I've tried to do it in the safe mode but after trying to run browser I got blue screen again. I've attached the minidump files.

****

AVG is completely removed using the suggested tools. But the problem remained.

 

[cybercore]

If it freezes before loading Grub - that's the problem. Could be something with the bootloader or hardware.

Link Removed

1. MEMORY tab
2. SPD tabs of E A C H slot - even if empty.

 

[cybercore]

Give me your CPU-Z data as in post above.



IRQL_NOT_LESS_OR_EQUAL (a)
0xA_ataport!IdeCompleteScsiIrp


1. Memtest86+ - Advanced Memory Diagnostic Tool
2. HDDScan

3. Should update:

Atheros Extensible Wireless LAN
athrx.sys Mon May 19 22:43:58 2008

Realtek PCI Lan
Rt64win7.sys Thu Feb 26 04:04:13 2009

Elaborate Bytes Virtual Clone
VClone.sys Sun Aug 09 17:25:45 2009




Crash Dumps:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\a\Minidump\D M P\DMP\012811-37112-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c53000 PsLoadedModuleList = 0xfffff800`02e90e50
Debug session time: Fri Jan 28 14:10:50.668 2011 (UTC - 5:00)
System Uptime: 0 days 0:00:44.917
Loading Kernel Symbols
..

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

.............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {8, 2, 0, fffff80002c9fd29}

Probably caused by : ataport.SYS ( ataport!IdeCompleteScsiIrp+62 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002c9fd29, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002efb0e0
 0000000000000008 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiInsertQueueApc+1e9
fffff800`02c9fd29 488b5108        mov     rdx,qword ptr [rcx+8]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff88002ffd650 -- (.trap 0xfffff88002ffd650)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa8007f8d2e8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c9fd29 rsp=fffff88002ffd7e0 rbp=fffff88002fd5180
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KiInsertQueueApc+0x1e9:
fffff800`02c9fd29 488b5108        mov     rdx,qword ptr [rcx+8] ds:c650:00000000`00000008=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002cc2ca9 to fffff80002cc3740

STACK_TEXT:  
fffff880`02ffd508 fffff800`02cc2ca9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`02ffd510 fffff800`02cc1920 : fffffa80`00000002 fffffa80`08501b60 fffffa80`083adb80 fffff880`010e5e92 : nt!KiBugCheckDispatch+0x69
fffff880`02ffd650 fffff800`02c9fd29 : fffffa80`083adc50 00000000`00000200 00000000`00000000 fffff800`02d770e4 : nt!KiPageFault+0x260
fffff880`02ffd7e0 fffff800`02ca2fec : fffffa80`08501b60 00000000`00000002 00000000`00000000 fffffa80`07f8d2e8 : nt!KiInsertQueueApc+0x1e9
fffff880`02ffd810 fffff800`02cc655b : 00000000`00000000 00000000`a000000c 00000000`00000000 00000000`00000000 : nt!KeInsertQueueApc+0x80
fffff880`02ffd870 fffff880`010e341a : 00000000`00000200 00000000`00000001 fffffa80`083407a0 00000000`00000000 : nt!IopfCompleteRequest+0xbdb
fffff880`02ffd950 fffff880`010e3242 : fffffa80`083407a0 fffff880`010e5b3b fffffa80`083adb80 fffffa80`060097d0 : ataport!IdeCompleteScsiIrp+0x62
fffff880`02ffd980 fffff880`010dde32 : 00000000`00000000 00000000`00000000 fffffa80`05fe7500 fffffa80`060097d0 : ataport!IdeCommonCrbCompletion+0x5a
fffff880`02ffd9b0 fffff880`010e67ed : fffffa80`05fe61a0 fffffa80`083407a0 00000000`00000000 fffffa80`083407a0 : ataport!IdeTranslateCompletedRequest+0x236
fffff880`02ffdae0 fffff880`010e60ec : fffffa80`05fe61a0 00000000`00000000 fffffa80`05fe61a0 00000000`00000000 : ataport!IdeProcessCompletedRequests+0x4d5
fffff880`02ffdc10 fffff800`02ccebfc : fffff880`02fd5180 00000000`071f315c fffffa80`05fe6050 fffffa80`05fe6118 : ataport!IdePortCompletionDpc+0x1a8
fffff880`02ffdcd0 fffff800`02ccbeea : fffff880`02fd5180 fffff880`02fe00c0 00000000`00000000 fffff880`010e5f44 : nt!KiRetireDpcList+0x1bc
fffff880`02ffdd80 00000000`00000000 : fffff880`02ffe000 fffff880`02ff8000 fffff880`02ffdd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ataport!IdeCompleteScsiIrp+62
fffff880`010e341a 8bc3            mov     eax,ebx

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  ataport!IdeCompleteScsiIrp+62

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ataport

IMAGE_NAME:  ataport.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc118

FAILURE_BUCKET_ID:  X64_0xA_ataport!IdeCompleteScsiIrp+62

BUCKET_ID:  X64_0xA_ataport!IdeCompleteScsiIrp+62

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\a\Minidump\D M P\DMP\012911-27034-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02007000 PsLoadedModuleList = 0xfffff800`02244e50
Debug session time: Sat Jan 29 11:13:29.018 2011 (UTC - 5:00)
System Uptime: 0 days 0:14:26.533
Loading Kernel Symbols
..

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

.............................................................
.......................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {8, 2, 0, fffff80002053d29}

Probably caused by : ataport.SYS ( ataport!IdeCompleteScsiIrp+62 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002053d29, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800022af0e0
 0000000000000008 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiInsertQueueApc+1e9
fffff800`02053d29 488b5108        mov     rdx,qword ptr [rcx+8]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  chrome.exe

TRAP_FRAME:  fffff88001efd880 -- (.trap 0xfffff88001efd880)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa8006289958 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002053d29 rsp=fffff88001efda10 rbp=fffff88001ece180
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KiInsertQueueApc+0x1e9:
fffff800`02053d29 488b5108        mov     rdx,qword ptr [rcx+8] ds:5650:00000000`00000008=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002076ca9 to fffff80002077740

STACK_TEXT:  
fffff880`01efd738 fffff800`02076ca9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`01efd740 fffff800`02075920 : fffffa80`00000002 fffffa80`061acb60 fffffa80`06284b80 fffff880`00db6e92 : nt!KiBugCheckDispatch+0x69
fffff880`01efd880 fffff800`02053d29 : fffffa80`06284c50 00000000`00000200 00000000`00000000 fffff800`0212b0e4 : nt!KiPageFault+0x260
fffff880`01efda10 fffff800`02056fec : fffffa80`061acb60 00000000`00000002 00000000`00000000 fffffa80`06289958 : nt!KiInsertQueueApc+0x1e9
fffff880`01efda40 fffff800`0207a55b : 00000000`00000000 00000000`a000000c 00000000`00000000 00000000`00000000 : nt!KeInsertQueueApc+0x80
fffff880`01efdaa0 fffff880`00db441a : 00000000`00000200 00000000`00000001 fffffa80`062a16c0 00000000`00000000 : nt!IopfCompleteRequest+0xbdb
fffff880`01efdb80 fffff880`00db4242 : fffffa80`062a16c0 fffff880`00db6b3b fffffa80`06284b80 fffffa80`05fcb7d0 : ataport!IdeCompleteScsiIrp+0x62
fffff880`01efdbb0 fffff880`00daee32 : 00000000`00000000 00000000`00000000 fffffa80`05fb3500 fffffa80`05fcb7d0 : ataport!IdeCommonCrbCompletion+0x5a
fffff880`01efdbe0 fffff880`00db77ed : fffffa80`05fb21a0 fffffa80`062a16c0 00000000`00000000 fffffa80`062a16c0 : ataport!IdeTranslateCompletedRequest+0x236
fffff880`01efdd10 fffff880`00db70ec : fffffa80`05fb21a0 00000000`00000000 fffffa80`05fb21a0 00000000`00000000 : ataport!IdeProcessCompletedRequests+0x4d5
fffff880`01efde40 fffff800`02082bfc : fffff880`01ece180 fffff880`0000a400 fffffa80`05fb2050 fffffa80`05fb2118 : ataport!IdePortCompletionDpc+0x1a8
fffff880`01efdf00 fffff800`0207d865 : 00000000`00000000 fffffa80`06cdbb60 00000000`00000000 fffff880`00db6f44 : nt!KiRetireDpcList+0x1bc
fffff880`01efdfb0 fffff800`0207d67c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxRetireDpcList+0x5
fffff880`04665be0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ataport!IdeCompleteScsiIrp+62
fffff880`00db441a 8bc3            mov     eax,ebx

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  ataport!IdeCompleteScsiIrp+62

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ataport

IMAGE_NAME:  ataport.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc118

FAILURE_BUCKET_ID:  X64_0xA_ataport!IdeCompleteScsiIrp+62

BUCKET_ID:  X64_0xA_ataport!IdeCompleteScsiIrp+62

Followup: MachineOwner
---------

Drivers:

start             end                 module name
fffff880`0332d000 fffff880`0336b000   1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30)
fffff880`00f2b000 fffff880`00f82000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`02cf9000 fffff880`02d83000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`033ca000 fffff880`033e0000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`00dd5000 fffff880`00de0000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`00cda000 fffff880`00ce3000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00dab000 fffff880`00dd5000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`03210000 fffff880`0332d000   athrx    athrx.sys    Mon May 19 22:43:58 2008 (48323AEE)
fffff960`00ae0000 fffff960`00b41000   ATMFD    ATMFD.DLL    Thu May 27 00:11:31 2010 (4BFDF0F3)
fffff880`01941000 fffff880`01948000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`0339e000 fffff880`033af000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`08dc2000 fffff880`08de0000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff880`0336b000 fffff880`03395000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00c00000 fffff880`00cc0000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`018d2000 fffff880`01902000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00d4d000 fffff880`00dab000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0116f000 fffff880`011e2000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`033af000 fffff880`033bf000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`08d42000 fffff880`08d50000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`02de0000 fffff880`02dfe000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`018bc000 fffff880`018d2000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`08d5c000 fffff880`08d65000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`08d50000 fffff880`08d5c000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`08d65000 fffff880`08d78000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`08d95000 fffff880`08da1000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff960`00450000 fffff960`0046e000   dxg      dxg.sys      Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`0306b000 fffff880`030a1000   fastfat  fastfat.SYS  Mon Jul 13 19:23:28 2009 (4A5BC1F0)
fffff880`010fd000 fffff880`01111000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`010b1000 fffff880`010fd000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff960`00870000 fffff960`00879000   framebuf framebuf.dll Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`01200000 fffff880`0120a000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`01882000 fffff880`018bc000   fvevol   fvevol.sys   Mon Jul 13 19:22:15 2009 (4A5BC1A7)
fffff880`015a5000 fffff880`015ef000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`025e3000 fffff800`0262c000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`01845000 fffff880`01869000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`04eea000 fffff880`04f03000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`04f03000 fffff880`04f0b080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`04edc000 fffff880`04eea000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`01412000 fffff880`0141b000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`03200000 fffff880`0320f000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`04f36000 fffff880`04f44000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`00bbd000 fffff800`00bc0000   kdcom    kdcom.dll    Fri Jan 21 08:17:13 2011 (4D398759)
fffff880`08c7e000 fffff880`08cc1000   ks       ks.sys       Mon Jul 13 20:00:31 2009 (4A5BCA9F)
fffff880`013cf000 fffff880`013e9000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`0157a000 fffff880`015a5000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`00cf5000 fffff880`00d39000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`031f0000 fffff880`031ff000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`04f29000 fffff880`04f36000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00cc0000 fffff880`00cda000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`08de0000 fffff880`08df8000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`01902000 fffff880`0192f000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`04e6b000 fffff880`04eb9000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`04eb9000 fffff880`04edc000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`01994000 fffff880`0199f000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00f8b000 fffff880`00f95000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`01111000 fffff880`0116f000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`033bf000 fffff880`033ca000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`01400000 fffff880`01412000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`01428000 fffff880`0151a000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`033e0000 fffff880`033ec000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`08c53000 fffff880`08c66000   ndisuio  ndisuio.sys  Mon Jul 13 20:09:25 2009 (4A5BCCB5)
fffff880`0316b000 fffff880`0319a000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`08d2d000 fffff880`08d42000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`02cc4000 fffff880`02cd3000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`01800000 fffff880`01845000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`0151a000 fffff880`0157a000   NETIO    NETIO.SYS    Thu Apr 08 22:43:59 2010 (4BBE946F)
fffff880`0199f000 fffff880`019b0000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02dd4000 fffff880`02de0000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02007000 fffff800`025e3000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`0122c000 fffff880`013cf000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`01938000 fffff880`01941000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`08c00000 fffff880`08c53000   nwifi    nwifi.sys    Mon Jul 13 20:07:23 2009 (4A5BCC3B)
fffff880`02c9e000 fffff880`02cc4000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00fd5000 fffff880`00fea000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00f95000 fffff880`00fc8000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00e5c000 fffff880`00e63000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00e63000 fffff880`00e73000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`013e9000 fffff880`013fa000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`00d39000 fffff880`00d4d000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`03147000 fffff880`0316b000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`0319a000 fffff880`031b5000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`031b5000 fffff880`031d6000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`031d6000 fffff880`031f0000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`02d83000 fffff880`02dd4000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`0198b000 fffff880`01994000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`0104c000 fffff880`01086000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`03115000 fffff880`03147000   Rt64win7 Rt64win7.sys Thu Feb 26 04:04:13 2009 (49A65B0D)
fffff880`0300f000 fffff880`0303e000   SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
fffff880`0303e000 fffff880`0303f480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01603000 fffff880`01800000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`019ce000 fffff880`019db000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`019b0000 fffff880`019ce000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`033ec000 fffff880`03400000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`00720000 fffff960`0072a000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`02cd3000 fffff880`02cf9000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`08cc1000 fffff880`08cd3000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`04f0c000 fffff880`04f29000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`08d93000 fffff880`08d94f00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`03104000 fffff880`03115000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`08cd3000 fffff880`08d2d000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`030ae000 fffff880`03104000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`08d78000 fffff880`08d93000   USBSTOR  USBSTOR.SYS  Mon Jul 13 20:06:34 2009 (4A5BCC0A)
fffff880`030a1000 fffff880`030ae000   usbuhci  usbuhci.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`03000000 fffff880`0300f000   VClone   VClone.sys   Sun Aug 09 17:25:45 2009 (4A7F3ED9)
fffff880`00fc8000 fffff880`00fd5000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`01948000 fffff880`01956000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`01956000 fffff880`0197b000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`00fea000 fffff880`00fff000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00e00000 fffff880`00e5c000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01000000 fffff880`0104c000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`02c00000 fffff880`02c95000   vsdatant vsdatant.sys Sun May 09 12:28:58 2010 (4BE6E2CA)
fffff880`0197b000 fffff880`0198b000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00e78000 fffff880`00f1c000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f1c000 fffff880`00f2b000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`02c95000 fffff880`02c9e000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00090000 fffff960`0039f000   win32k   win32k.sys   Sat Jun 19 00:31:59 2010 (4C1C483F)
fffff880`03395000 fffff880`0339e000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`00f82000 fffff880`00f8b000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`08da1000 fffff880`08dc2000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)

Unloaded modules:
fffff880`01902000 fffff880`01910000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff880`01910000 fffff880`0191c000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff880`0191c000 fffff880`01925000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00009000
fffff880`01925000 fffff880`01938000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00013000
fffff880`015ef000 fffff880`015f7000   spldr.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00008000

 

[tatrman]

thanks, I would post cpu-z but - an error occurs during initialization (of cpu-z) and memory and spd are blank.
It accually gives me blue screen even in safe mode if I try to run browser.

 

[cybercore]

It accually gives me blue screen even in safe mode if I try to run browser.

Blame your RAM.

 

[tatrman]

Blame your RAM.

Could you be more specific?

update:

In safe mode I got blue screen when trying to run chromium (IE works)
Than I tried to disable Zone Alarm, but after that I got blue screen even when logging into safe mode so I ended up with safe mode without networking which works. (so far)
If RAM is faulty how came that Ubuntu is running fine and reports no faults?

the first blue screen gave a code 0x0000003B
after disabling zone alarm it was 0x0000001E and 0x0000000A

 

[cybercore]

Could you be more specific?

If it crashes in safe mode then it's caused by hardware, by RAM in 90% of the cases.
Can you clean boot with essential services only and take the CPU-Z screenshots?

 

[tatrman]

If it crashes in safe mode then it's caused by hardware, by RAM in 90% of the cases.
Can you clean boot with essential services only and take the CPU-Z screenshots?

I've attached the txt file from cpu-z.
after disabling zone alarm It froze completely when loading desktop, but after restart I was actually able to perform the system restore. Now it works in safe mode with networking. So is time to try it in normal mode.

update:

wow,, It works in normal mode ... hope it stays there.

 

[cybercore]

The txt does not contain your memory settings, I need them for analysis.

 

[tatrman]

Unfortunately I'm unable to get them. In safe mode CPU-Z gives me only what I've already attached. but meantime it had further development:

I successfully got rid of AVG and I disabled zone alarm > that allowed me to do system restore . than I run avg uninstaller again just to be sure that system restore didn't put anything back. At this stage the computer was running ok and I thought it was all over. I've installed Microsoft security essentials and tried couple of things - computer was running - though strange thing happened - chromium was dead it opened a blank window. I had to use IE to get MSE - and than I put computer asleep. > when I got back and waked it up blue screen again. with code 0x000000D1 (previously it was 0x0000003B than 1E)
At this stage when restarted It didn't give me safe mode option menu but some repair menu. I went through repair - it tried to do system restore again, then restarted > it went straight to normal mode and crushed even before login page. safe mode crash the same way before login page - no blue screen, nothing.
At this stage I'm seriously frustrated.
I had to use ubuntu (from my second HDD) for my work and struggle with gimp, though, ubuntu works like a charm, there was waiting a big chunk of update for me - even GRUB update, I run linux memory test, No faults reported. I've tried couple apps, 3D games - no signs of faulty memory in ubuntu - Now I'm actually prepared for win7 reinstall - not something I'm keen to do, but it seems like the only choise left. (besides RAM, but I don't have any spare sticks to replace it and try)

 

[cybercore]

safe mode crash the same way before login page - no blue screen, nothing.

The system is either completely broken or something's wrong with your RAM. If you can't uninstall ZoneAlarm in safe mode and system repair doesn't work either, then load the setup defaults in the bios and reinstall the OS. But the reinstall won't help at all if the hardware is faulty.

Run memtest 10 passes overnight. Memtest86+ - Advanced Memory Diagnostic Tool.
If your RAM sticks are not the same brand identical - this may be the problem.