Windows 7 BSOD ON Startup

[Joe S]

I turned my PC on and a BSOD went by to fast to read. It did startup repair. It's HP d5000t Windows 7 Ultimate 64 bit with SP1 8 Gig ram. It also happened a few weeks ago. I since reverted to pre SP1 image and installed SP1 again. I suspect VMware Workstation may be involved they are having issues with memory usage and I was using it just before shutdown. After first install of SP1 I updated NVIDIA driver and had problems with them so reverted to older image. The other BSOD was with SP1 installed
Joe

 

[cybercore]

The crash was caused by Avast Antivirus. Uninstall it and replace with Link Removed.

032611-14632-01.dmp
BugCheck E3, {fffff8800491d5d0, fffffa8008964b60, 0, 2}
RESOURCE_NOT_OWNED (e3)
A thread tried to release a resource it did not own.
Probably caused by : aswSP.SYS ( aswSP+11101 )

Update or uninstall:

Sonic CD/DVD driver (used by many different CD/DVD programs):
(If you don' know what it is, go to C:\Windows\System32\drivers and rename PxHelp20.sys to PXHelp20.BAK)
PxHlpa64.sys Wed Mar 12 21:58:17 2008


Easy Media Creator
RxFilter.sys Mon Aug 11 13:51:21 2008


Update Acronis
tdrpm258.sys Tue Oct 20 03:39:53 2009





CRASH DUMPS

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\032611-14632-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`03413000 PsLoadedModuleList = 0xfffff800`03658e90
Debug session time: Sat Mar 26 20:02:22.178 2011 (UTC - 4:00)
System Uptime: 0 days 0:00:06.973
Loading Kernel Symbols
...............................................................
...........................
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck E3, {fffff8800491d5d0, fffffa8008964b60, 0, 2}

Unable to load image \SystemRoot\System32\Drivers\aswSP.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSP.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswSP.SYS
Probably caused by : aswSP.SYS ( aswSP+11101 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

RESOURCE_NOT_OWNED (e3)
A thread tried to release a resource it did not own.
Arguments:
Arg1: fffff8800491d5d0, Address of resource
Arg2: fffffa8008964b60, Address of thread
Arg3: 0000000000000000, Address of owner table if there is one
Arg4: 0000000000000002

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xE3

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000341d47f to fffff80003493640

STACK_TEXT:  
fffff880`03244f08 fffff800`0341d47f : 00000000`000000e3 fffff880`0491d5d0 fffffa80`08964b60 00000000`00000000 : nt!KeBugCheckEx
fffff880`03244f10 fffff880`048ec101 : 00000000`00000000 00000000`0000001d fffff880`03245020 fffff800`0376831b : nt! ?? ::FNODOBFM::`string'+0x1ae23
fffff880`03244f70 00000000`00000000 : 00000000`0000001d fffff880`03245020 fffff800`0376831b 00000000`010000d4 : aswSP+0x11101


STACK_COMMAND:  kb

FOLLOWUP_IP: 
aswSP+11101
fffff880`048ec101 ??              ???

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  aswSP+11101

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: aswSP

IMAGE_NAME:  aswSP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4d65203e

FAILURE_BUCKET_ID:  X64_0xE3_aswSP+11101

BUCKET_ID:  X64_0xE3_aswSP+11101

Followup: MachineOwner
---------

DRIVERS

start             end                 module name
fffff880`00ed1000 fffff880`00f28000   ACPI     ACPI.sys     Sat Nov 20 04:19:16 2010 (4CE79294)
fffff880`04400000 fffff880`04489000   afd      afd.sys      Sat Nov 20 04:23:27 2010 (4CE7938F)
fffff880`011b8000 fffff880`011c3000   amdxata  amdxata.sys  Fri Mar 19 12:18:18 2010 (4BA3A3CA)
fffff880`04489000 fffff880`04493000   aswRdr   aswRdr.SYS   Wed Feb 23 09:55:11 2011 (4D651FCF)
fffff880`0302a000 fffff880`030aa000   aswSnx   aswSnx.SYS   Wed Feb 23 09:56:59 2011 (4D65203B)
fffff880`048db000 fffff880`04926000   aswSP    aswSP.SYS    Wed Feb 23 09:57:02 2011 (4D65203E)
fffff880`045d6000 fffff880`045e6000   aswTdi   aswTdi.SYS   Wed Feb 23 09:55:51 2011 (4D651FF7)
fffff880`0451a000 fffff880`04521000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`048ca000 fffff880`048db000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`03000000 fffff880`0302a000   cdrom    cdrom.sys    Sat Nov 20 04:19:20 2010 (4CE79298)
fffff880`00d36000 fffff880`00df6000   CI       CI.dll       Sat Nov 20 08:12:36 2010 (4CE7C944)
fffff880`0101a000 fffff880`0104a000   CLASSPNP CLASSPNP.SYS Sat Nov 20 04:19:23 2010 (4CE7929B)
fffff880`00cd8000 fffff880`00d36000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`044cf000 fffff880`04511000   cmdguard cmdguard.sys Wed Jan 05 12:10:43 2011 (4D24A613)
fffff880`045ca000 fffff880`045d6000   cmdhlp   cmdhlp.sys   Wed Jan 05 12:09:59 2011 (4D24A5E7)
fffff880`0125e000 fffff880`012d0000   cng      cng.sys      Sat Nov 20 05:08:45 2010 (4CE79E2D)
fffff880`01be2000 fffff880`01bf0000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`04829000 fffff880`048ac000   csc      csc.sys      Sat Nov 20 04:27:12 2010 (4CE79470)
fffff880`048ac000 fffff880`048ca000   dfsc     dfsc.sys     Sat Nov 20 04:26:31 2010 (4CE79447)
fffff880`043b3000 fffff880`043c2000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01bcc000 fffff880`01be2000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`031e7000 fffff880`031fa000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`030c9000 fffff880`031e7000   dump_iaStorV dump_iaStorV.sys Thu Jun 10 20:46:19 2010 (4C11875B)
fffff880`013ab000 fffff880`013bf000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`0135f000 fffff880`013ab000   fltmgr   fltmgr.sys   Sat Nov 20 04:19:24 2010 (4CE7929C)
fffff880`0142c000 fffff880`01436000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`017b5000 fffff880`017ef000   fvevol   fvevol.sys   Sat Nov 20 04:24:06 2010 (4CE793B6)
fffff880`01a1f000 fffff880`01a69000   fwpkclnt fwpkclnt.sys Sat Nov 20 04:21:37 2010 (4CE79321)
fffff800`039fd000 fffff800`03a46000   hal      hal.dll      Sat Nov 20 08:00:25 2010 (4CE7C669)
fffff880`01bc0000 fffff880`01bcc000   hotcore3 hotcore3.sys Wed Jun 23 18:54:01 2010 (4C229089)
fffff880`01c7e000 fffff880`01c87000   hwpolicy hwpolicy.sys Sat Nov 20 04:18:54 2010 (4CE7927E)
fffff880`0109a000 fffff880`011b8000   iaStorV  iaStorV.sys  Thu Jun 10 20:46:19 2010 (4C11875B)
fffff880`042f5000 fffff880`0430d000   inspect  inspect.sys  Wed Jan 05 12:09:49 2011 (4D24A5DD)
fffff800`00bbd000 fffff800`00bc7000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`01400000 fffff880`0141b000   ksecdd   ksecdd.sys   Sat Nov 20 04:21:15 2010 (4CE7930B)
fffff880`0178a000 fffff880`017b5000   ksecpkg  ksecpkg.sys  Sat Nov 20 05:10:34 2010 (4CE79E9A)
fffff880`00c75000 fffff880`00cc4000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Sat Nov 20 08:03:51 2010 (4CE7C737)
fffff880`00fa5000 fffff880`00fbf000   mountmgr mountmgr.sys Sat Nov 20 04:19:21 2010 (4CE79299)
fffff880`0457f000 fffff880`0458a000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00f31000 fffff880`00f3b000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`01200000 fffff880`0125e000   msrpc    msrpc.sys    Sat Nov 20 04:21:56 2010 (4CE79334)
fffff880`043a8000 fffff880`043b3000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`01bae000 fffff880`01bc0000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`01637000 fffff880`0172a000   ndis     ndis.sys     Sat Nov 20 04:23:30 2010 (4CE79392)
fffff880`0430d000 fffff880`0431c000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`04276000 fffff880`042bb000   netbt    netbt.sys    Sat Nov 20 04:23:18 2010 (4CE79386)
fffff880`0172a000 fffff880`0178a000   NETIO    NETIO.SYS    Sat Nov 20 04:23:13 2010 (4CE79381)
fffff880`0458a000 fffff880`0459b000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`0439c000 fffff880`043a8000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`03413000 fffff800`039fd000   nt       ntkrnlmp.exe Sat Nov 20 04:30:02 2010 (4CE7951A)
fffff880`0144d000 fffff880`015f0000   Ntfs     Ntfs.sys     Sat Nov 20 04:20:57 2010 (4CE792F9)
fffff880`04511000 fffff880`0451a000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`00fbf000 fffff880`00fe7000   nvraid   nvraid.sys   Fri Mar 19 16:59:20 2010 (4BA3E5A8)
fffff880`011c3000 fffff880`011ee000   nvstor   nvstor.sys   Fri Mar 19 16:45:11 2010 (4BA3E257)
fffff880`042cf000 fffff880`042f5000   pacer    pacer.sys    Sat Nov 20 05:52:18 2010 (4CE7A862)
fffff880`00f7b000 fffff880`00f90000   partmgr  partmgr.sys  Sat Nov 20 04:20:00 2010 (4CE792C0)
fffff880`00f3b000 fffff880`00f6e000   pci      pci.sys      Sat Nov 20 04:19:11 2010 (4CE7928F)
fffff880`0141b000 fffff880`0142c000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`00cc4000 fffff880`00cd8000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`013bf000 fffff880`013cad00   PxHlpa64 PxHlpa64.sys Wed Mar 12 21:58:17 2008 (47D88A39)
fffff880`0434b000 fffff880`0439c000   rdbss    rdbss.sys    Sat Nov 20 04:27:51 2010 (4CE79497)
fffff880`04564000 fffff880`0456d000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`0456d000 fffff880`04576000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`04576000 fffff880`0457f000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01c44000 fffff880`01c7e000   rdyboost rdyboost.sys Sat Nov 20 04:43:10 2010 (4CE7982E)
fffff880`030aa000 fffff880`030be000   RxFilter RxFilter.sys Mon Aug 11 13:51:21 2008 (48A07C19)
fffff880`01c00000 fffff880`01c44000   snapman  snapman.sys  Mon Feb 08 07:40:38 2010 (4B700646)
fffff880`01df4000 fffff880`01dfc000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`012fc000 fffff880`0135f000   storport storport.sys Sat Nov 20 05:35:02 2010 (4CE7A456)
fffff880`0181b000 fffff880`01a1f000   tcpip    tcpip.sys    Sat Nov 20 04:25:52 2010 (4CE79420)
fffff880`045bd000 fffff880`045ca000   TDI      TDI.SYS      Sat Nov 20 04:22:06 2010 (4CE7933E)
fffff880`01c88000 fffff880`01df4000   tdrpm258 tdrpm258.sys Tue Oct 20 03:39:53 2009 (4ADD6949)
fffff880`0459b000 fffff880`045bd000   tdx      tdx.sys      Sat Nov 20 04:21:54 2010 (4CE79332)
fffff880`04337000 fffff880`0434b000   termdd   termdd.sys   Sat Nov 20 06:03:40 2010 (4CE7AB0C)
fffff880`01a69000 fffff880`01b52000   timntr   timntr.sys   Tue Sep 29 09:36:57 2009 (4AC20D79)
fffff880`00f6e000 fffff880`00f7b000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`04521000 fffff880`0452f000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`0452f000 fffff880`04554000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`0104a000 fffff880`01086000   vmbus    vmbus.sys    Sat Nov 20 04:57:29 2010 (4CE79B89)
fffff880`01b52000 fffff880`01b62000   vmstorfl vmstorfl.sys Sat Nov 20 04:57:30 2010 (4CE79B8A)
fffff880`00f90000 fffff880`00fa5000   volmgr   volmgr.sys   Sat Nov 20 04:19:28 2010 (4CE792A0)
fffff880`00c00000 fffff880`00c5c000   volmgrx  volmgrx.sys  Sat Nov 20 04:20:43 2010 (4CE792EB)
fffff880`01b62000 fffff880`01bae000   volsnap  volsnap.sys  Sat Nov 20 04:20:08 2010 (4CE792C8)
fffff880`0431c000 fffff880`04337000   wanarp   wanarp.sys   Sat Nov 20 05:52:36 2010 (4CE7A874)
fffff880`04554000 fffff880`04564000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00e1e000 fffff880`00ec2000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00ec2000 fffff880`00ed1000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`042c6000 fffff880`042cf000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`01086000 fffff880`0109a000   winhv    winhv.sys    Sat Nov 20 04:20:02 2010 (4CE792C2)
fffff880`00f28000 fffff880`00f31000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`042bb000 fffff880`042c6000   ws2ifsl  ws2ifsl.sys  Mon Jul 13 20:10:33 2009 (4A5BCCF9)

 

[Joe S]

Thanks I found an update for the Acronis but not for the RxFilter.sys it's Roxio legacy product. I can't find PxHelp20.sys but PxHelpa64.sys is there. On the Avast is it possible that there was a conflict between the host and VM? The VM is a clone of the desktop and I was turning Avast on and off in VM The awSP.sys is the self protection mode and is one of the things in VM that i was turning on and off. I wondered if that caused some conflict. I've ran it 3 or 4 times since with no problem. The other time it happened I was in Avast on the VM too. If I have more problems I'll know what it is.
Joe

 

[cybercore]

I don't see any involvement of VM in your crashes.

Avast is well known for causing blue screens (as in your case).

The Roxio legacy product is outdated and not for Windows 7. If you get another blue screen, uninstall Roxio.
RxFilter.sys Mon Aug 11 13:51:21 2008