Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

smb 1.XXX driver win 7 fails


  • Please log in to reply

#16
Paul432220

Paul432220

    Member

  • Topic Starter
  • Member
  • PipPip
  • 78 posts

Hi Phill,

 

Windows 7 is legitimate, it was bought with the PC.  "System" window in the Control panel clearly shows a "windows activated" status.

The fact that Malware still showed up is most probably due to the fact i ran Speccy right after removing Malware (but i did not reboot in  between, i agree i should have done that !)

 

I'm afraid i cannot avoid the dump after Speccy than as NAV is now the last and only AV on the system.

 

I believe that for some reason the PC got configured by accident to not receive any updates for a long time. However, after the updates i did 2 weeks ago and some i even did tonight, it now indicates me that

Windows is up to date and no further updates are available.

 

What do you advise me as the next action ? Do i need to try and recreate the isse and send you another dump ?

 

Best regards, Paul.


  • 0

Advertisements


#17
phillpower2

phillpower2

    Mechanised Mod

  • Global Moderator
  • 24,710 posts

Hello Paul,

 

Windows 7 is legitimate,

 

 

Acknowledged.

 

If Norton is the free version, I would have gotten rid of that, kept MBAM until the day before the trial ran out and downloaded/installed a good free AV such as Microsoft Security Essentials. 

 

What do you advise me as the next action ? Do i need to try and recreate the isse and send you another dump ?

 

 

This is about all that you can do for now, if the crash happens again, post an updated Speccy link and the latest crash dmp, download the trial version of MBAM again, uninstall Norton, restart and test.


  • 0

#18
Paul432220

Paul432220

    Member

  • Topic Starter
  • Member
  • PipPip
  • 78 posts

Hi Phill,

 

Norton is a paid version for which an annual subscription is running... does therefor make sense to keep this one.

 

I started Gmail and tried to attach a file, Windows crashed immediately. I'll attach the dump below.

 

The Speccy link = http://speccy.pirifo...NlFAouPAwfefX32

 

It remains funny that attaching a file to Gmail (or Thunderbird) makes Windows crash while manipulating files via Win Explorer does not do anything at all and works fine....

it's my impression that the way browsers link to files is what is broken here...

 

Best regards,

Paul

 

 

 

 

Attached Files


  • 0

#19
phillpower2

phillpower2

    Mechanised Mod

  • Global Moderator
  • 24,710 posts

Hello Paul,

 

it's my impression that the way browsers link to files is what is broken here...

 

 

100% possible but also just as possible is a security issue with Windows, even more so when it is the same driver that is crashing, see info below that I have highlighted in red + the link here which tells us what the driver is and how it is obtained/updated.

 

KMODE_EXCEPTION_NOT_HANDLED (1e)

This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 9f81af60, The address that the exception occurred at
Arg3: 00000000, Parameter 0 of the exception
Arg4: 00000000, Parameter 1 of the exception
 
Debugging Details:
------------------
 
TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2
 
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
 
FAULTING_IP: 
+0
9f81af60 84b4819f60b081  test    byte ptr [ecx+eax*4-7E4F9F61h],dh
 
EXCEPTION_PARAMETER1:  00000000
 
EXCEPTION_PARAMETER2:  00000000
 
READ_ADDRESS: GetPointerFromAddress: unable to read from 83591850
Unable to read MiSystemVaType memory at 83571080
 00000000 
 
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
 
BUGCHECK_STR:  0x1e_c0000005
 
CUSTOMER_CRASH_COUNT:  1
 
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
 
PROCESS_NAME:  System
 
CURRENT_IRQL:  0
 
LAST_CONTROL_TRANSFER:  from 8bd86e95 to 8bd8f271
 
CONTEXT:  9f81b060 -- (.cxr 0xffffffff9f81b060)
eax=00000000 ebx=00000000 ecx=9f81b55c edx=d8f1b698 esi=9f81b65c edi=9f81b638
eip=8bd8f271 esp=9f81b54c ebp=9f81b560 iopl=0         nv up ei ng nz ac po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010293
ksecdd!InitUserModeContext+0x35:
8bd8f271 ff5008          call    dword ptr [eax+8]    ds:0023:00000008=????????
Resetting default scope
 
STACK_TEXT:  
9f81b560 8bd86e95 9f81b65c 9f81b580 9f81b65c ksecdd!InitUserModeContext+0x35
9f81b5b8 8bd8ee09 00000000 9f81b65c 8bd8c3cc ksecdd!KsecProcessSecurityContext+0x133
9f81b5e8 8c06e997 9f81b664 9f81b65c 8bd8c3cc ksecdd!InitializeSecurityContextW+0x35
9f81b6a0 8c06eab2 0001bb1e 00000000 9f81b728 tcpip!WfpAlepCreateTokenFromLogonId+0x100
9f81b6e4 8c06e7e8 0001bb1e 00000000 9f81b728 tcpip!WfpAleCreateTokenFromLogonId+0x28
9f81b744 8c06b90f 865d3838 00000000 867f2c60 tcpip!WfpAlepSetSecurity+0x2e0
9f81b850 8c065d35 865d3838 980000c8 866aad88 tcpip!WfpAleProcessSecureSocketControl+0x20f
9f81b88c 8c0668ff 006aade8 8b98cc13 861fbee8 tcpip!TcpSetSockOptEndpoint+0x28e
9f81b8c0 834a1dc8 9f81b950 b32d6b3c 00000000 tcpip!TcpTlEndpointIoControlEndpointCalloutRoutine+0x51
9f81b928 8c0618de 8c0668ae 9f81b950 00000000 nt!KeExpandKernelStackAndCalloutEx+0x132
9f81b960 8b98d52e 866aad00 9f81b901 866aad88 tcpip!TcpTlEndpointIoControlEndpoint+0x67
9f81b9ac 8b98d2b1 86295358 00000003 980000c8 afd!WskProTLControlRequest+0xc4
9f81b9fc 8b98d464 86295358 00000058 861fbee8 afd!WskProControlSocketCore+0x3d7
9f81ba0c 8b98885a 9f81ba2c 83455f22 88cb68b0 afd!WskProIRPControlSocket+0x10
9f81ba14 83455f22 88cb68b0 861fbee8 00000000 afd!AfdWskDispatchInternalDeviceControl+0x21
9f81ba2c 8b98d433 00000002 980000c8 0000fffc nt!IofCallDriver+0x63
9f81ba54 9b6074dd 8629536c 00000002 980000c8 afd!WskProAPIControlSocket+0x8d
9f81bacc 9b607a64 867c05a0 897ba8b8 867f8a38 mrxsmb!SmbWskSetSocketOptions+0x1af
9f81bb9c 9b60692f 867f8a38 867f8a38 866cb970 mrxsmb!SmbWskInitiateAsynchronousConnect+0x193
9f81bbb4 9b606810 017f8a38 04e0e53e 89c9d9b0 mrxsmb!RxCeInitiateConnectRequest+0x44
9f81bcc4 9b6077e7 866cb970 9b6076c2 96b5be18 mrxsmb!RxCeBuildConnectionOverMultipleTransports+0x510
9f81bcd8 96b48143 866cb970 09340ef7 85ec7920 mrxsmb!RxCeInitiateConnection+0x125
9f81bd34 96b5ed74 96b5be18 96b5c118 9f81bd90 rdbss!RxpWorkerThreadDispatcher+0x13e
9f81bd44 83631b12 96b5be18 b32d6f84 00000000 rdbss!RxWorkerThreadDispatcher+0x1a
9f81bd90 834cf171 96b5ed5a 96b5be18 00000000 nt!PspSystemThreadStartup+0x159
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
 
 
FOLLOWUP_IP: 
ksecdd!InitUserModeContext+35
8bd8f271 ff5008          call    dword ptr [eax+8]
 
SYMBOL_STACK_INDEX:  0
 
SYMBOL_NAME:  ksecdd!InitUserModeContext+35
 
FOLLOWUP_NAME:  MachineOwner
 
MODULE_NAME: ksecdd
 
IMAGE_NAME:  ksecdd.sys
 
DEBUG_FLR_IMAGE_TIMESTAMP:  5b6daab9
 
STACK_COMMAND:  .cxr 0xffffffff9f81b060 ; kb
 
FAILURE_BUCKET_ID:  0x1e_c0000005_ksecdd!InitUserModeContext+35
 
BUCKET_ID:  0x1e_c0000005_ksecdd!InitUserModeContext+35
 
Followup: MachineOwner
---------
 
The following drivers also failed to load;
 
Unloaded modules:
a6594000 a659b000   cpuz143_x32.
8c200000 8c20d000   crashdmp.sys
91c23000 91dd6000   dump_iaStor.
91dd6000 91de7000   dump_dumpfve
9841e000 98efa000   igdkmd32.sys
98efa000 98fb2000   dxgkrnl.sys
973a7000 973b3000   discache.sys
8bf16000 8bf3c000   ksecpkg.sys
 
 
No mention of MBAM or Norton this time.
 
 
Run DriverMax to see if any driver updates are suggested for the chipset, network or storage devices

 

Please note that you are only allowed to download two drivers a day for free and be sure to uncheck the “install AVG toolbar” option box.

 

Remember to always create a new restore point before updating any drivers.


  • 0

#20
Paul432220

Paul432220

    Member

  • Topic Starter
  • Member
  • PipPip
  • 78 posts

Hi Phill, 

I have been running DriverMax for 3 days now, installing each day 2 drivers. What's left is related to audio, network and graphics, so i doubt this is relevant for the issue i have, but anyway, i'll update those tomorrow and the  day after in order to be completely uptodate.

Having seen in you comments that the last dump was related to ksecdd.sys, i went to look for it in the \windows\system32\drivers directory and i saw that it was dated of August 10th 2018,

which is very strange for a Win 7 version, also i did not do any updates around that date either. So i pulled this driver out of the initial CD that came with the PC, and installed it (keeping the old version though as you never know). But this did not result in any change as i'm still getting blue screens when attaching a file.

Since the message in the event log speaks about the SMB 1.XXX driver, i checked out the mrxsmb,mrxsmb10, mrxsmb20 drivers as well, all 3 also from August 10th 2018...

So i also reverted those back to the CD versions (dated of the year 2010 ! ) but this also did not solve the blue screen issue.

I attach a new dump that i just had after installing another 2 drivers and with the 4 mentioned drivers reverted back to the versions of the installation CD.

 

Best regards, Paul

 

Attached Files


  • 0

#21
Paul432220

Paul432220

    Member

  • Topic Starter
  • Member
  • PipPip
  • 78 posts

Hi Phill,

I can only download 10 drivers per month. What's left now is Audio or graphics, not sure this is relevant for the issue i have. Have you been able to look into the last dump i sent as i'm curious to see what's the root cause here...

thanks and regards, Paul


  • 0

#22
phillpower2

phillpower2

    Mechanised Mod

  • Global Moderator
  • 24,710 posts

Hello Paul,

 

I have been running DriverMax for 3 days now, installing each day 2 drivers. What's left is related to audio, network and graphics, so i doubt this is relevant for the issue i have,

 

 

Not the case I`m afraid, the following drivers are flagged up in your first crash dmp; 

 

tcpip = network drivers.

 

igdkmd32.sys = Intel graphics.

 
dxgkrnl.sys = Dirext X which is also related to the graphics.
 
Will look at the latest crash dmp and get back to you ( I will edit this reply if you have not already replied first).
 
Edit to add: Still the same problem drivers being flagged up but none in particular being named, all that is showing is PROCESS_NAME:  System which can be just about any driver.
 
We will have to wait and see if you get another crash after the latest updates were installed, if again nothing is named directly we will provide you with the steps that you need to run Driver Verifier.

  • 0

#23
Paul432220

Paul432220

    Member

  • Topic Starter
  • Member
  • PipPip
  • 78 posts

Hi Phill,

 

One driver remains to be updated, that will be for tomorrow. At least today, after the update, i still had a Win 7 crash and blue screen...i'll get back tomorrow with another update

Best regards, Paul


  • 0

#24
phillpower2

phillpower2

    Mechanised Mod

  • Global Moderator
  • 24,710 posts

:thumbsup:


  • 0

#25
phillpower2

phillpower2

    Mechanised Mod

  • Global Moderator
  • 24,710 posts

Not heard back from you Paul, do you still require assistance or is the issue now resolved, an update would be appreciated.


  • 0

Advertisements







Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP