Random BSOD on every 2nd/3rd boot - possibly Truecrypt?

allend66 · Jun 9, 2014

Hi all,

I get a random BSOD when I boot my HP Pavilion 15-e073sa notebook.

It's only on boot up, and only every 2 or 3 boots it gives me a REFERENCE_BY_POINTER and reboots, usually with no problem.

Any help would be appreciated, thanks!

usasma · Jun 11, 2014

Only 11 Windows Updates installed. Most systems have 60 or more. Please visit Windows Update and get ALL available updates (it may take several trips to get them all).

This device has problems in Device Manager:

Not Available ACPI\ASD0001\2&DABA3FF&2 The drivers for this device are not installed.

This is most likely an AMD Adaptive S4 driver (part of the graphics driver package for your system) Use the HP Support Assistant software to download/install the appropriate graphics drivers for your system.

I'd start by suspecting the Comodo firewall. Although there's no direct evidence implicating the firewall, it's similar to several prolbems that I seem to remember. So, the test would be to uninstall the Comodo firewall and enable the Windows firewall to see if the BSOD's stop. If not, then feel free to reinstall it AFTER the system has been stabilized.

Please uninstall TrueCrypt. Recently they posted that their product isn't secure: TrueCrypt

Please uninstall the Cyberlink software as it's drivers date from 2011.

If this doesn't stop the BSOD's, then run these free diagnostics (start with the hard drive and memory tests): Hardware Diagnostics

Analysis:
The following is for informational purposes only.

Code:

[font=lucida console]**************************Mon Jun  9 06:04:01.240 2014 (UTC - 4:00)**************************
Loading Dump File [C:\Users\John\SysnativeBSODApps\060914-28140-01.dmp]
Windows 8 Kernel Version 9600 MP (4 procs) Free x64
Built by: [B]9600[/B].17085.amd64fre.winblue_gdr.140330-1035
System Uptime:[B]12 days 16:15:29.266[/B]
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
Probably caused by :[B]ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+273aa )[/B]
BugCheck [B]18, {0, ffffe00108793300, 6, ffffffffffffffff}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x00000018]REFERENCE_BY_POINTER (18)[/url]
Arguments: 
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: ffffe00108793300, Object whose reference count is being lowered
Arg3: 0000000000000006, Reserved
Arg4: ffffffffffffffff, Reserved
    The reference count of an object is illegal for the current state of the object.
    Each time a driver uses a pointer to an object the driver calls a kernel routine
    to increment the reference count of the object. When the driver is done with the
    pointer the driver calls another kernel routine to decrement the reference count.
    Drivers must match calls to the increment and decrement routines. This bugcheck
    can occur because an object's reference count goes to zero while there are still
    open handles to the object, in which case the fourth parameter indicates the number
    of opened handles. It may also occur when the object?s reference count drops below zero
    whether or not there are open handles to the object, and in that case the fourth parameter
    contains the actual value of the pointer references count.
BUGCHECK_STR:  0x18
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  wmpnetwk.exe
FAILURE_BUCKET_ID: [B]0x18_nt!_??_::FNODOBFM::_string_[/B]
  BIOS Version                  F.31
  BIOS Release Date             12/04/2013
  Manufacturer                  Hewlett-Packard
  Product Name                  HP Pavilion 15 Notebook PC
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Tue May 27 08:17:59.110 2014 (UTC - 4:00)**************************
Loading Dump File [C:\Users\John\SysnativeBSODApps\052714-42281-01.dmp]
Windows 8 Kernel Version 9600 MP (4 procs) Free x64
Built by: [B]9600[/B].17085.amd64fre.winblue_gdr.140330-1035
System Uptime:[B]12 days 12:23:04.459[/B]
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
Probably caused by :[B]ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+273aa )[/B]
BugCheck [B]18, {0, ffffe0012d18a080, 6, ffffffffffffffff}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x00000018]REFERENCE_BY_POINTER (18)[/url]
Arguments: 
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: ffffe0012d18a080, Object whose reference count is being lowered
Arg3: 0000000000000006, Reserved
Arg4: ffffffffffffffff, Reserved
    The reference count of an object is illegal for the current state of the object.
    Each time a driver uses a pointer to an object the driver calls a kernel routine
    to increment the reference count of the object. When the driver is done with the
    pointer the driver calls another kernel routine to decrement the reference count.
    Drivers must match calls to the increment and decrement routines. This bugcheck
    can occur because an object's reference count goes to zero while there are still
    open handles to the object, in which case the fourth parameter indicates the number
    of opened handles. It may also occur when the object?s reference count drops below zero
    whether or not there are open handles to the object, and in that case the fourth parameter
    contains the actual value of the pointer references count.
BUGCHECK_STR:  0x18
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  wmpnetwk.exe
FAILURE_BUCKET_ID: [B]0x18_nt!_??_::FNODOBFM::_string_[/B]
  BIOS Version                  F.31
  BIOS Release Date             12/04/2013
  Manufacturer                  Hewlett-Packard
  Product Name                  HP Pavilion 15 Notebook PC
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/font]

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.

Code:

[font=lucida console]**************************Mon Jun  9 06:04:01.240 2014 (UTC - 4:00)**************************
[COLOR=RED][B]truecrypt.sys                Sun Sep  5 10:23:16 2010 (4C83A7D4)[/B][/COLOR]
[COLOR=RED][B]CLVirtualDrive.sys           Mon Dec 26 08:26:47 2011 (4EF87617)[/B][/COLOR]
usbfilter.sys                Tue Aug 28 21:27:12 2012 (503D6FF0)
WirelessButtonDriver64.sys   Wed Aug 29 23:11:29 2012 (503ED9E1)
uimx64.sys                   Thu Nov 22 07:07:52 2012 (50AE1598)
UimFIO.SYS                   Thu Nov 22 07:07:54 2012 (50AE159A)
Uim_IMx64.sys                Thu Nov 22 07:07:58 2012 (50AE159E)
uim_vimx64.sys               Thu Nov 22 07:08:04 2012 (50AE15A4)
SynTP.sys                    Tue Feb  5 22:26:11 2013 (5111CD53)
AtihdW86.sys                 Thu Feb 14 17:11:12 2013 (511D6100)
Accelerometer.sys            Tue Feb 26 15:08:10 2013 (512D162A)
hpdskflt.sys                 Tue Feb 26 15:08:12 2013 (512D162C)
RTKVHD64.sys                 Thu Mar  7 05:31:01 2013 (51386C65)
easytthr.sys                 Mon Mar 11 10:50:55 2013 (513DEF4F)
RtsP2Stor.sys                Thu Jul  4 22:59:40 2013 (51D6369C)
amdxata.sys                  Mon Jul  8 18:45:00 2013 (51DB40EC)
amdsata.sys                  Mon Jul  8 18:54:38 2013 (51DB432E)
Rt630x64.sys                 Thu Aug 15 02:23:59 2013 (520C73FF)
VBoxNetFlt.sys               Fri Sep  6 08:25:36 2013 (5229C9C0)
VBoxUSBMon.sys               Fri Sep  6 08:25:36 2013 (5229C9C0)
VBoxNetAdp.sys               Fri Sep  6 08:25:36 2013 (5229C9C0)
VBoxDrv.sys                  Fri Sep  6 08:26:49 2013 (5229CA09)
atikmpag.sys                 Fri Dec  6 15:21:45 2013 (52A231D9)
atikmdag.sys                 Fri Dec  6 16:19:43 2013 (52A23F6F)
ssudbus.sys                  Thu Jan  2 04:51:22 2014 (52C5369A)
ssudmdm.sys                  Thu Jan  2 04:51:26 2014 (52C5369E)
rtwlane.sys                  Thu Jan  9 21:50:07 2014 (52CF5FDF)
cmdhlp.sys                   Wed Apr 16 16:31:47 2014 (534EE8B3)
inspect.sys                  Wed Apr 16 16:31:47 2014 (534EE8B3)
cmderd.sys                   Wed Apr 16 16:31:57 2014 (534EE8BD)
cmdguard.sys                 Wed Apr 16 16:32:12 2014 (534EE8CC)
[/font]

allend66 · Jun 25, 2014

Thank you usasma!

I'll go through your list of recommendations.
However, I don't know why you think I only have 11 win updates - I am fastidious with keeping everything up to date.
View attachment 45727
I have 95 Windows updates, 41 Office updates, 1 Silverlight, and 2 C++ giving 139 updates in total.

Thank you for your advice. Maybe I will start with Truecrypt before Comodo, but either way I'll be testing my system for a while.
I'll report back in the near future.
Thanks again and have a good day
D

usasma · Jun 25, 2014

I looked at the systeminformation.txt report that you uploaded.
The actual number isn't important. What is important is that you have checked and are sure that you have ALL updates (which you obviously have done).

Don't forget to update the video drivers to fix that problem device in Device Manager!

Good luck!

Random BSOD on every 2nd/3rd boot - possibly Truecrypt?

allend66

New Member

usasma

Mr. Cranky Pants

allend66

New Member

usasma

Mr. Cranky Pants

Similar threads