[Hadleigh101]

Hi, my sisters come to me to help me solve the issue of her computer not turning on an coming to the BSOD! After trying to find out what driver is causing the issue I am struggling majorly! Im assuming its something to do with the wireless card or something if its TCPIP.SYS related? Removed kaspersly because that seemed to be the first thing to stop working (I.e. corrupt databases on updates) Below I have attached all the times I have in the minidumps folder.

Could it possible be malware related?

Also on one of the manyt errors on the blue screen it said IRQL not less or equal, then another one about memory and many others...

Thanks
Hadleigh

Attached Files

•  dumps.zip   215.67KB   140 downloads

[Advertisements]

Are you sure Kaspersky is uninstalled completely? Several of the dumps, including the most recent, point to klif.sys which is a Kaspersky file.

On Tue 8/16/2011 11:37:16 PM your computer crashed
This was likely caused by the following module: ntkrnlpa.exe
Bugcheck code: 0x1000008E (0xC0000005, 0x82E58426, 0xAE743704, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
Dump file: C:\Windows\Minidump\081611-26457-01.dmp

On Tue 8/16/2011 11:35:24 PM your computer crashed
This was likely caused by the following module: ntkrnlpa.exe
Bugcheck code: 0xBE (0xC03FFEF0, 0x4DD72025, 0x97E7FB74, 0xB)
Error: ATTEMPTED_WRITE_TO_READONLY_MEMORY
Dump file: C:\Windows\Minidump\081611-26473-01.dmp

On Tue 8/16/2011 11:18:22 PM your computer crashed
This was likely caused by the following module: unknown_image
Bugcheck code: 0x1A (0x41284, 0x1002001, 0x0, 0xC0802000)
Error: MEMORY_MANAGEMENT
Dump file: C:\Windows\Minidump\081611-26488-01.dmp

On Wed 8/17/2011 8:22:26 PM your computer crashed
This was likely caused by the following module: unknown_image
Bugcheck code: 0x1A (0x41284, 0x6842001, 0x0, 0xC0802000)
Error: MEMORY_MANAGEMENT
Dump file: C:\Windows\Minidump\081711-18314-01.dmp

On Wed 8/17/2011 7:11:50 PM your computer crashed
This was likely caused by the following module: ntkrnlpa.exe
Bugcheck code: 0x1000008E (0xC0000005, 0x82E7CB7D, 0xA039392C, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
Dump file: C:\Windows\Minidump\081711-20404-01.dmp

On Wed 8/17/2011 6:51:40 PM your computer crashed
This was likely caused by the following module: ci.dll
Bugcheck code: 0x19 (0x3, 0x858FE740, 0x858FE740, 0x858FE741)
Error: BAD_POOL_HEADER
Dump file: C:\Windows\Minidump\081711-16894-01.dmp
file path: C:\Windows\system32\ci.dll
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Code Integrity Module
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.

On Tue 8/16/2011 12:25:18 AM your computer crashed
This was likely caused by the following module: klif.sys
Bugcheck code: 0x1000008E (0xC0000005, 0x82D757FF, 0x95DB7514, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
Dump file: C:\Windows\Minidump\081611-17596-01.dmp

On Tue 8/16/2011 12:23:18 AM your computer crashed
This was likely caused by the following module: klif.sys
Bugcheck code: 0x19 (0x3, 0x858FEE70, 0x858FEE70, 0x858FEE71)
Error: BAD_POOL_HEADER
Dump file: C:\Windows\Minidump\081611-20404-01.dmp

On Tue 8/16/2011 11:42:56 PM your computer crashed
This was likely caused by the following module: klif.sys
Bugcheck code: 0x1000008E (0xC0000005, 0x82D74985, 0xB42B8B88, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
Dump file: C:\Windows\Minidump\081611-30466-01.dmp

Try running the Removal tool for Kaspersky Lab products

Another is ci.dll which is a Vista module (Code Integrity). Open a Command prompt and run System File Checker by typing sfc /scannow and pressing Enter (space between sfc and /scannow).

[Ztruker]

Are you sure Kaspersky is uninstalled completely? Several of the dumps, including the most recent, point to klif.sys which is a Kaspersky file.

On Tue 8/16/2011 11:37:16 PM your computer crashed
This was likely caused by the following module: ntkrnlpa.exe
Bugcheck code: 0x1000008E (0xC0000005, 0x82E58426, 0xAE743704, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
Dump file: C:\Windows\Minidump\081611-26457-01.dmp

On Tue 8/16/2011 11:35:24 PM your computer crashed
This was likely caused by the following module: ntkrnlpa.exe
Bugcheck code: 0xBE (0xC03FFEF0, 0x4DD72025, 0x97E7FB74, 0xB)
Error: ATTEMPTED_WRITE_TO_READONLY_MEMORY
Dump file: C:\Windows\Minidump\081611-26473-01.dmp

On Tue 8/16/2011 11:18:22 PM your computer crashed
This was likely caused by the following module: unknown_image
Bugcheck code: 0x1A (0x41284, 0x1002001, 0x0, 0xC0802000)
Error: MEMORY_MANAGEMENT
Dump file: C:\Windows\Minidump\081611-26488-01.dmp

On Wed 8/17/2011 8:22:26 PM your computer crashed
This was likely caused by the following module: unknown_image
Bugcheck code: 0x1A (0x41284, 0x6842001, 0x0, 0xC0802000)
Error: MEMORY_MANAGEMENT
Dump file: C:\Windows\Minidump\081711-18314-01.dmp

On Wed 8/17/2011 7:11:50 PM your computer crashed
This was likely caused by the following module: ntkrnlpa.exe
Bugcheck code: 0x1000008E (0xC0000005, 0x82E7CB7D, 0xA039392C, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
Dump file: C:\Windows\Minidump\081711-20404-01.dmp

On Wed 8/17/2011 6:51:40 PM your computer crashed
This was likely caused by the following module: ci.dll
Bugcheck code: 0x19 (0x3, 0x858FE740, 0x858FE740, 0x858FE741)
Error: BAD_POOL_HEADER
Dump file: C:\Windows\Minidump\081711-16894-01.dmp
file path: C:\Windows\system32\ci.dll
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Code Integrity Module
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.

On Tue 8/16/2011 12:25:18 AM your computer crashed
This was likely caused by the following module: klif.sys
Bugcheck code: 0x1000008E (0xC0000005, 0x82D757FF, 0x95DB7514, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
Dump file: C:\Windows\Minidump\081611-17596-01.dmp

On Tue 8/16/2011 12:23:18 AM your computer crashed
This was likely caused by the following module: klif.sys
Bugcheck code: 0x19 (0x3, 0x858FEE70, 0x858FEE70, 0x858FEE71)
Error: BAD_POOL_HEADER
Dump file: C:\Windows\Minidump\081611-20404-01.dmp

On Tue 8/16/2011 11:42:56 PM your computer crashed
This was likely caused by the following module: klif.sys
Bugcheck code: 0x1000008E (0xC0000005, 0x82D74985, 0xB42B8B88, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
Dump file: C:\Windows\Minidump\081611-30466-01.dmp

Try running the Removal tool for Kaspersky Lab products

Another is ci.dll which is a Vista module (Code Integrity). Open a Command prompt and run System File Checker by typing sfc /scannow and pressing Enter (space between sfc and /scannow).

[Hadleigh101]

I used the clean-up tool prior to posting on here but after the creation of them dumps so I will add one newer dump that come from a different BSOD please find attached below.




Just finished a sfc scan and it says :-


Verification 100% complete.

Windows Resource Protection did not find any integrity violations



I had the computer going for a few hours yesterday after rolling back the wireless driver, LAN driver and display driver - yet when windows update search for optional drivers 3 appeared and since installing one of them its started doing it again?

Thanks

Attached Files

•  081811-18252-01.zip   22.41KB   174 downloads

[Ztruker]

Roll it back again then refuse those 3 updates and check the box that says you don't want them offered again.

[Hadleigh101]

Theres no option to roll back anymore though?


Did any of them dmps show any other signs?

[Ztruker]

Uninstall the optional driver update. Does that help?

The dump you posted shows 0x000000c1 in win32k.sys. This is a windows file but it's still quite probable this is caused by a defective drive.

I think at this point it would be a good idea to rule out (or confirm) a malware problem. Go to the Virus, Spyware, Malware Removal forum, read the first post and follow instructions.

Come back here once you get a clean bill of health if you still have problems.

[Hadleigh101]

Scan has come back clean...

Infections found 0(0)
PUPs found 0
Files healed 0
Warnings reported 1
Errors reported 0


and the warning was :-
/mnt/sda2/Windows/System32/sdohlp.dll ; Object is white-listed (critical/system file that should not be removed)




Prior to running the scan I tired to get Windows to start in Safe Mode with netowrking and it now doesnt even load, and even just starting Windows normally (which used to work for a few minutes then BSOD) now doesnt load either - I get the error message..

Windows failed to start. A recent hardware or software change might be the cause. To fix the problem:
1. Insert your windows installation disc and restart your computer
2.Choose your language settings, and then click "Next."
3. Click "Repair your computer."

If you do not have this disc, contact your system administrator or computer manufacturer for assistant.

File: \windows\system32\ntkrnlpa.exe

Status: 0xc0000221

Info: Windows failed to load because the kernal is missing, or corrupt.




Then gives me the option to press Enter to go next or Esc to Cancel so I press Enter and gives me an option to loads my operating system "Windows 7" or tab down to do a Windows Memory Diagnostic (which I have done and still no joy)


Is there anyway I can remove any partitions I currently have and install a fresh copy of Windows 7 without needing Windows to boot? Or can this be repaired without needing a fresh copy of W7?



Thanks

Hadleigh

[Ztruker]

Do you have a Windows 7 installation DVD for this computer? If so, you can follow these instructions:

How to Do a Clean Installation with Windows 7

or this one:

How to Do a Clean Install with a Upgrade Windows 7 Version

I believe this would be the quickest way to resolve the issue, unless its caused by a hardware problem. Won't know that until you do the reinstall unfortunately.

[Hadleigh101]

I don't think you understand, now windows wont even boot into safe mode or wont even let me boot from disc (with disc number 1 in the priority of boot order) - just comes up with what I said before and that I should insert my Windows disc select language and press repair, although when I do this I get into a loop and restart (again with disc in with the computer booting from disc) and it says the same thing thats there maybe a hardwre or software error and that I need to insert Windows disc and around an around...........


Windows failed to start. A recent hardware or software change might be the cause. To fix the problem:
1. Insert your windows installation disc and restart your computer
2.Choose your language settings, and then click "Next."
3. Click "Repair your computer."

If you do not have this disc, contact your system administrator or computer manufacturer for assistant.

File: \windows\system32\ntkrnlpa.exe

Status: 0xc0000221







Can you give me instructions on how to load windows without having to boot into windows/or anything that is, i.e. pre load linux or install from a memory stick...?

I have a windows 7 X86 disc and the serial number for the laptop is underneath - although like I said windows wont even boot with the CD.

[Ztruker]

Looks like the easiest method is to use Universal USB Installer – Easy as 1 2 3.

Select Windows 7 from the drop down menu, all the way to the bottom after all the Linux choices, and your off.

You'll need your Win 7 DVD and a 4GB or larger flash drive.

[Hadleigh101]

I have a Windows7 disc but its one I have copied myself (Legit) - Was a OEM one from Toshiba that I made a copy on, there is no ISO file on there to use for USB Installer?

[Ztruker]

You can create an ISO file from the disc using ImgBurn.