[poohfam]

Over the last few weeks I have started to get the Blue Screen of Death out of nowhere. I don't think I'm doing anything in particular when it happens, and each time I am getting a differnet message with it. From the ones I remember, I've seen the BAD_POOL_CALLER and the BAD_POOL_HEADER and just this morning I got the tcpip.sys error. I saw that you guys were able to help someone else with the tcpip.sys error by looking at a zipped file of all of the dumps. Could you please help me also? I have finals coming up in a few weeks and am concerned I might need to get a new computer, but I hope not! Thanks so much in advance.

Attached Files

•  Dumps Zips.zip   315.51KB   144 downloads

[Advertisements]

Welcome to GeekstoGo
Sorry you have had to wait for a reply
Both of those errors are usually caused by driver issues. However it may also be an actual memory (ram) issue.
Download this please
http://www.resplendence.com/whocrashed
Run the program
Click the analyse tab
scroll down as the message indicates
Copy and paste the results of the dump analysis into your reply.

Edited by Macboatmaster, 26 March 2011 - 06:52 PM.

[Macboatmaster]

Welcome to GeekstoGo
Sorry you have had to wait for a reply
Both of those errors are usually caused by driver issues. However it may also be an actual memory (ram) issue.
Download this please
http://www.resplendence.com/whocrashed
Run the program
Click the analyse tab
scroll down as the message indicates
Copy and paste the results of the dump analysis into your reply.

Edited by Macboatmaster, 26 March 2011 - 06:52 PM.

[typoprone]

Sorry for the hijack!

Edited by typoprone, 27 March 2011 - 06:36 PM.

[Macboatmaster]

typoprone
Welcome to Geeks.
Please DO start your own thread.
I will then respond.
It will if the original poster answers become totally confusing for all concerned as each post by me will have to be separately addressed.

Edited by Macboatmaster, 27 March 2011 - 05:12 PM.

[poohfam]

Hello Macboatmaster,

I'm very sorry I haven't responded sooner. I was away on business for the day yesterday. I've downloaded the program and the Crash Dump Analysis is provided below. Thank you so much again for all of your help.

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.


On Fri 3/25/2011 11:14:06 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\Mini032511-01.dmp
This was probably caused by the following module: tcpip.sys (tcpip+0x4E32A)
Bugcheck code: 0xBE (0xFFFFFFFF9621C264, 0xFFFFFFFF92876101, 0xFFFFFFFF8D25DAC8, 0xB)
Error: ATTEMPTED_WRITE_TO_READONLY_MEMORY
file path: C:\Windows\system32\drivers\tcpip.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: TCP/IP Driver
Bug check description: This is issued if a driver attempts to write to a read-only memory segment.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system which cannot be identified at this time.


On Fri 3/25/2011 11:14:06 AM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: tcpip.sys (tcpip+0x4E361)
Bugcheck code: 0xBE (0xFFFFFFFF9621C264, 0xFFFFFFFF92876101, 0xFFFFFFFF8D25DAC8, 0xB)
Error: ATTEMPTED_WRITE_TO_READONLY_MEMORY
file path: C:\Windows\system32\drivers\tcpip.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: TCP/IP Driver
Bug check description: This is issued if a driver attempts to write to a read-only memory segment.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system which cannot be identified at this time.


On Thu 3/24/2011 11:00:38 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\Mini032411-02.dmp
This was probably caused by the following module: tfsysmon.sys (TfSysMon+0x7B86)
Bugcheck code: 0x1000008E (0xFFFFFFFFC0000006, 0xFFFFFFFF82AB3071, 0xFFFFFFFFB35AAABC, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
file path: C:\Windows\system32\drivers\tfsysmon.sys
product: ThreatFire
company: PC Tools
description: ThreatFire System Monitor
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: tfsysmon.sys (ThreatFire System Monitor, PC Tools).
Google query: tfsysmon.sys PC Tools KERNEL_MODE_EXCEPTION_NOT_HANDLED_M




On Thu 3/24/2011 8:06:25 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\Mini032411-01.dmp
This was probably caused by the following module: aswsnx.sys (aswSnx+0x9DF0)
Bugcheck code: 0xC5 (0x4, 0x2, 0x1, 0xFFFFFFFF82B03010)
Error: DRIVER_CORRUPTED_EXPOOL
file path: C:\Windows\system32\drivers\aswsnx.sys
product: avast! Antivirus System
company: AVAST Software
description: avast! Virtualization Driver
Bug check description: This indicates that the system attempted to access invalid memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: aswsnx.sys (avast! Virtualization Driver, AVAST Software).
Google query: aswsnx.sys AVAST Software DRIVER_CORRUPTED_EXPOOL




On Tue 3/22/2011 2:16:13 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\Mini032211-01.dmp
This was probably caused by the following module: aswtdi.sys (aswTdi+0x40EB)
Bugcheck code: 0x1000008E (0xFFFFFFFFC0000005, 0xFFFFFFFF9002752F, 0xFFFFFFFF8BD61774, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
file path: C:\Windows\system32\drivers\aswtdi.sys
product: avast! Antivirus System
company: AVAST Software
description: avast! TDI Filter Driver
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: aswtdi.sys (avast! TDI Filter Driver, AVAST Software).
Google query: aswtdi.sys AVAST Software KERNEL_MODE_EXCEPTION_NOT_HANDLED_M




On Tue 3/22/2011 3:58:11 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\Mini032111-01.dmp
This was probably caused by the following module: tfsysmon.sys (TfSysMon+0x7B86)
Bugcheck code: 0x1000008E (0xFFFFFFFFC0000005, 0xFFFFFFFF82AC2F9C, 0xFFFFFFFFB70A5AC0, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
file path: C:\Windows\system32\drivers\tfsysmon.sys
product: ThreatFire
company: PC Tools
description: ThreatFire System Monitor
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: tfsysmon.sys (ThreatFire System Monitor, PC Tools).
Google query: tfsysmon.sys PC Tools KERNEL_MODE_EXCEPTION_NOT_HANDLED_M




On Fri 3/18/2011 8:42:26 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\Mini031811-02.dmp
This was probably caused by the following module: ntkrnlpa.exe (nt+0xCDB3F)
Bugcheck code: 0x19 (0x22, 0x10000000, 0x0, 0x0)
Error: BAD_POOL_HEADER
file path: C:\Windows\system32\ntkrnlpa.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a pool header is corrupt.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.


On Fri 3/18/2011 2:24:37 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\Mini031811-01.dmp
This was probably caused by the following module: ntkrnlpa.exe (nt+0xCDB3F)
Bugcheck code: 0xC2 (0xD, 0xFFFFFFFFAF71EC98, 0xFFFFFFFFEE657645, 0xFFFFFFFFAF71ECB8)
Error: BAD_POOL_CALLER
file path: C:\Windows\system32\ntkrnlpa.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the current thread is making a bad pool request.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.


On Thu 3/17/2011 6:03:23 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\Mini031711-01.dmp
This was probably caused by the following module: afd.sys (afd+0x24F6)
Bugcheck code: 0xD1 (0xFFFFFFFF9961E708, 0x2, 0x0, 0xFFFFFFFF90C1B4F6)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\drivers\afd.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Ancillary Function Driver for WinSock
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system which cannot be identified at this time.


On Tue 3/15/2011 8:44:54 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\Mini031511-01.dmp
This was probably caused by the following module: tffsmon.sys (TfFsMon+0x33D4)
Bugcheck code: 0x1000008E (0xFFFFFFFFC0000005, 0xFFFFFFFF834233D4, 0xFFFFFFFFAC7A0B34, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
file path: C:\Windows\system32\drivers\tffsmon.sys
product: ThreatFire
company: PC Tools
description: ThreatFire Filesystem Monitor
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: tffsmon.sys (ThreatFire Filesystem Monitor, PC Tools).
Google query: tffsmon.sys PC Tools KERNEL_MODE_EXCEPTION_NOT_HANDLED_M




On Mon 3/14/2011 12:30:51 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\Mini031311-02.dmp
This was probably caused by the following module: aswsnx.sys (aswSnx+0x1291C)
Bugcheck code: 0x1000008E (0xFFFFFFFFC0000005, 0xFFFFFFFF82AFBA9B, 0xFFFFFFFFAB5496E8, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
file path: C:\Windows\system32\drivers\aswsnx.sys
product: avast! Antivirus System
company: AVAST Software
description: avast! Virtualization Driver
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: aswsnx.sys (avast! Virtualization Driver, AVAST Software).
Google query: aswsnx.sys AVAST Software KERNEL_MODE_EXCEPTION_NOT_HANDLED_M




On Sat 3/12/2011 5:34:59 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\Mini031311-01.dmp
This was probably caused by the following module: ntkrnlpa.exe (nt+0xB213D)
Bugcheck code: 0x21 (0x0, 0x1, 0x10000000, 0xD1E6C28)
Error: QUOTA_UNDERFLOW
file path: C:\Windows\system32\ntkrnlpa.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that quota charges have been mishandled by returning more quota to a particular block than was previously charged.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.


On Fri 3/11/2011 8:10:54 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\Mini031111-01.dmp
This was probably caused by the following module: fltmgr.sys (fltmgr+0x2AB8)
Bugcheck code: 0xC2 (0x7, 0x110B, 0x0, 0xFFFFFFFF99C9F930)
Error: BAD_POOL_CALLER
file path: C:\Windows\system32\drivers\fltmgr.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Microsoft Filesystem Filter Manager
Bug check description: This indicates that the current thread is making a bad pool request.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system which cannot be identified at this time.


On Tue 3/8/2011 7:01:09 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\Mini030811-01.dmp
This was probably caused by the following module: ntfs.sys (Ntfs+0x19FFF)
Bugcheck code: 0x24 (0x1904AA, 0xFFFFFFFF8B94FB90, 0xFFFFFFFF8B94F88C, 0xFFFFFFFF8AE96198)
Error: NTFS_FILE_SYSTEM
file path: C:\Windows\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates a problem occurred in the NTFS file system.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system which cannot be identified at this time.


On Sun 3/6/2011 2:44:37 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\Mini030611-01.dmp
This was probably caused by the following module: ntfs.sys (Ntfs+0x8F574)
Bugcheck code: 0xA (0x42005C, 0x2, 0x1, 0xFFFFFFFF82ABD6A4)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system which cannot be identified at this time.



--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

15 crash dumps have been found and analyzed. 6 third party drivers have been identified to be causing system crashes on your computer. It is strongly suggested that you check for updates for these drivers on their company websites. Click on the links below to search with Google for updates for these drivers:

aswsnx.sys (avast! Virtualization Driver, AVAST Software)

tffsmon.sys (ThreatFire Filesystem Monitor, PC Tools)

tfsysmon.sys (ThreatFire System Monitor, PC Tools)

aswtdi.sys (avast! TDI Filter Driver, AVAST Software)

If no updates for these drivers are available, try searching with Google on the names of these drivers in combination the errors that have been reported for these drivers and include the brand and model name of your computer as well in the query. This often yields interesting results from discussions from users who have been experiencing similar problems.

[Macboatmaster]

How long please have you had AVAST AND threatfire installed. Is it the free AVAST and have you the trial of threat fire or purchased it pls.

[poohfam]

They've both been installed together since December 19, 2010. They are both the free version. I can't tell when I installed Avast version 6.0.1000, but from a little research it looks like the release date was around Feb. 26th of this year. I may have installed that version around the date my problems started. Could Avast be the problem? Are Threatfire and Avast meant to run at the same time? I have been running them at the same time since I installed them, but perhaps Threatfire cannot run with the Avast version 6.0.1000? I used to have AVG Free but have liked Avast much better. Perhaps I should just remove Threatfire? Or just prevent it from running all the time?

Thank you again.

[Macboatmaster]

Avast! update clashes with ThreatFire
Avast! has reported that in Avast! version 5.1.889, which has been available since mid-January, the Behaviour Shield module is now partially enabled – this module was previously disabled. If another behaviour recognition system is already active on the same computer, this may cause programs to crash or refuse to start. On the Avast forum, users have reported problems particularly with Avast! and ThreatFire on 64-bit Windows 7 systems.

To solve the problem, Avast! has recommended uninstalling the additional behaviour recognition software (ThreatFire) or removing Avast's Behaviour Shield module by performing a custom installation.





I appreciate you are on Vista 32 bit and not windows7 64 bit but the same principle applies.

I have just the other night worked on another thread with threatfire and another anti-virus installed with problems.
I know threatfire says it will RUN with other protection programs, as it works on a different principle.
My advise is to unistall it.
CHECK FIRST what you are uninstalling with it - in the history file.

BEFORE you do that may I stress that I can offer no advice on Malware matters. Only certified advisors in the Mlaware forum are allowed to advise on those issues.

[Macboatmaster]

Further to the above, threatfire suggests on their site that the yellow is without threatfire and the green with. ie: over 200% greater portection with threatfire over Kaspersky and Trend Micro on their own. I am NOT in a position to contradict this - if it is true - AN AMAZING PRODUCT. I would still uninstall it.
30%

[Macboatmaster]

Further to the above posts I have now found this.
It provides a further option if you are desirous of it in the future - feeling that threatfire offers something you need.

Protections by ThreatFire and Avast
PC Tools ThreatFire monitors the computer for signs of suspicious behavior and potential attacks. It's known as a behavioral-based protection anti-malware program that should run along with antivirus software. Some antivirus programs don't include behavioral-based detection or protection which means threatfire complements the protection offered by antivirus software.

The Avast antivirus program was recently updated by adding a Behavior Shield. It's the same protection that ThreatFire is already providing. Avast and ThreatFire problems started when its end-users reported applications such as Firefox Add or Remove Programs, System Restore, and Thunderbird had stopped working or were not responding.The problem started to occur after installing the new build of Avast 5.


How to Fix Avast and ThreatFire Problem
Most security software vendors and security experts recommend not using security software that provides the same functionality. This recommendation is correct and should be followed. It can prevent system instability and application crashes. It will also prevent interference in removing malware and scanning the computer.

If you are using the new version 5.1.889 or a higher version of Avast and also using Threatfire you will need to adjust the settings or remove one of these programs to fix the Avast and ThreatFire problems. Below are some methods you can use to fix problems caused by the recent update in Avast software.


Method 1: Remove ThreatFire Program
Since Avast antivirus added Behavioral Shield, it is best to remove ThreatFire that also provides the same protection. Removing ThreatFire is easily done by using the Add/Remove programs utility in Windows.

After removing the ThreatFire software, your computer will be protected against potential attacks or malware with the same behavior that is known to the Avast detection signature.


Method 2: Removing Behavior Shield by Avast
If you prefer to keep using ThreatFire protection against zero-day malware attacks, you can remove the Behavior Shield in Avast software:

• Open the Add or Remove Programs utility in the Windows' Control Panel.
• Select Avast program in the list of installed programs.
• Click Change or Change/Uninstall button.
• Avast Setup will be displayed. Select Change and click Next
• Select the box before Behavior Shield to change the mark from "green check" to "red x" or "red cross."
• Restart the computer for changes in Avast to take effect.

You can now continue using Avast antivirus and ThreatFire by removing the Behavior Shield component of Avast.


Method 3: Add ThreatFire in Trusted Processes Using Avast
Another method to use to fix Avast and ThreatFire problems is to configure Avast Behavior Shield by trusting ThreatFire processes and drivers. Use this method if you really want to keep both programs and you are not worried about any interference when both programs have found malicious activity in Windows.

To add ThreatFire processes and drivers in Avast follow the steps below:

• Open the Avast antivirus program. Click Real-Time Shields at the left pane and select Behavior Shield.
• Click Expert Settings button to display the Behavior Shield Settings window.
• Click Trusted Processes and click the browse button.
• Browse the folder of ThreatFire (C:\Program Files\ThreatFire). Select TFService.exe and click Open.
• Click the Add button in the Trusted Processes window of Avast.
• Repeat the same steps by adding TFGui.exe, TFHS.exe, TFNotice.exe, TFRC.exe, TFTray.exe, TFUD.exe, TFUN.exe, TFVS.exe and TFWSC.exe.
• Browse for C:\Windows\System32\drivers folder to add ThreatFire drivers as Trusted Processes by Avast.
• Locate TfSysMon.sys, TfNetMon.sys, and TfFsMon.sys in C:\Windows\System32\drivers and add them to be trusted by Avast Behavior Shield, as well.
• Click OK and close the Avast user interface. Avast should now stop monitoring the processes and tasks by ThreatFire. Also, it should stop other applications from responding.

Final Words
You can use Avast and ThreatFire provided that you use either method two or three above. The vendors should be able to release an update to fix incompatibility issues on their product with other software but if you choose one of fix methods, you won't have to wait for such a fix.

Screenshots courtesy of Avast Version 5.0 - http://www.avast.com

Edited by Macboatmaster, 27 March 2011 - 07:03 PM.

[poohfam]

Thank you! Thank you! Thank you! I think this has answered my question. I've decided to try Method 3 from your last post. Other than the Blue Screens, I have been very happy with the way that both programs have protected my system and I would prefer not to remove Threatfire if I don't have to. I've added all of the .exe's that the post suggested to the Avast Trusted Process List, so we'll see where that goes. If the computer continues to crash of course I will remove Threatfire, but in the meantime I am hoping that taking these steps will fix the problem and will remove any need to uninstall either of the programs. Thank you again for all of your help. The services and advice you and your collegues provide is invaluable.

Thank you again.

[Macboatmaster]

Thank you for the appreciation, it makes the job worthwhile.

However before you leave, as per my signature notes

Please follow your thread to a conclusion. Just because we may have been successful in solving your posted problem, does not mean that there was NOT further work to be done

Please go device manager and check for any warnings on any drivers. AFTER the Threatfire exercise and a reboot.

[poohfam]

I'm sorry, but how do I check for warnings on drivers in the Device Manager? Thank you again for your help.

[rshaffer61]

Please Go to

1: STARTand the click on RUN
2: Type in devmgmt.msc
3: Click Enter


To do a screenshot please have click on your Print Screen on your keyboard. It is normally the key above your number pad between the F12 key and the Scroll Lock key
Now go to Start and then to All Programs
Scroll to Accessories and then click on Paint
In the Empty White Area click and hold the CTRL key and then click the V
Go to the File option at the top and click on Save as
Save as file type JPEG and save it to your Desktop


Attach it to your next reply

[poohfam]

I've attached the screenshot of my device manager. Thank you again.

Attached Thumbnails

•