Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows 10 Laptop randomly crashes - nt_wrong_symbols.sys


  • Please log in to reply
19 replies to this topic

#1 Mubin Ali

Mubin Ali

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:11 PM

Posted 02 January 2018 - 03:52 AM

Hello,

 

I have HP windows 10- laptop and it has been crashing for the past few days or probably since last 2 weeks. The laptop was shipped with Windows 7 by HP but last year as there was Free upgrade from Win 7 to Win 10, I upgraded it. The laptop was bought some where around 2012 or 2013.

 

I have used WhoCrashed software to analyse the crash dumps and below is the output:

 

Crash dumps are enabled on your computer.

Crash dump directories:
C:\WINDOWS
C:\WINDOWS\Minidump

On Tue 02-Jan-18 1:29:57 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\010218-33078-01.dmp
This was probably caused by the following module: nt_wrong_symbols.sys (nt_wrong_symbols)
Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF8024AD3E844, 0xFFFFA580381B6C78, 0xFFFFA580381B64B0)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
Bug check description: This indicates that a system thread generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: nt_wrong_symbols.sys .
Google query: nt_wrong_symbols.sys SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M

 

System Information:

OS Name    Microsoft Windows 10 Home
Version    10.0.14393 Build 14393
Other OS Description     Not Available
OS Manufacturer    Microsoft Corporation
System Name    ALI
System Manufacturer    Hewlett-Packard
System Model    HP Pavilion g6 Notebook PC
System Type    x64-based PC
System SKU    B3J80PA#ACJ
Processor    AMD A8-4500M APU with Radeon™ HD Graphics, 1900 Mhz, 4 Core(s), 4 Logical Processor(s)
BIOS Version/Date    Insyde F.03, 16-Apr-12
SMBIOS Version    2.7
Embedded Controller Version    57.21
BIOS Mode    Legacy
BaseBoard Manufacturer    Hewlett-Packard
BaseBoard Model    Not Available
BaseBoard Name    Base Board
Platform Role    Mobile
Secure Boot State    Unsupported
PCR7 Configuration    Binding Not Possible
Windows Directory    C:\WINDOWS
System Directory    C:\WINDOWS\system32
Boot Device    \Device\HarddiskVolume1
Locale    United States
Hardware Abstraction Layer    Version = "10.0.14393.1378"
User Name    ALI\Mubin Ali
Time Zone    India Standard Time
Installed Physical Memory (RAM)    4.00 GB
Total Physical Memory    3.48 GB
Available Physical Memory    983 MB
Total Virtual Memory    6.73 GB
Available Virtual Memory    4.16 GB
Page File Space    3.25 GB
Page File    C:\pagefile.sys
Hyper-V - VM Monitor Mode Extensions    Yes
Hyper-V - Second Level Address Translation Extensions    Yes
Hyper-V - Virtualization Enabled in Firmware    No
Hyper-V - Data Execution Protection    Yes
 

Things that I have done so far:

1- Checked HP site and there is no new drivers available for the model of laptop with Windows 10, same for BIOS

2- I downloaded IO Bit Driver Booster and upgraded what ever drivers I could find.

 

Also, I am not sure if this issue is related to the Crashing but I have noticed that when I installed ZOne Alarm Free Firewall or use any Torrent App like Vuze, there is some distortion in the audio while playing Youtube or VLC. I uninstalled Zone alarm and shut down Vuze and the distortion stopped. Not sure if both the crashing and audio distortion are some how related or not.

 

I do not have the resources to backup data and re-install the OS.

 

Any help would be really appreciated.


Edited by Mubin Ali, 02 January 2018 - 04:39 AM.


BC AdBot (Login to Remove)

 


#2 bwv848

bwv848

    Bleepin' Owl


  • BSOD Kernel Dump Expert
  • 3,028 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:92.96 million miles away from the sun
  • Local time:03:41 AM

Posted 02 January 2018 - 10:39 AM

We need more information about your system than what you've provided. Hence, please follow these BSOD posting instructions and attach the requested files by replying to this topic. You may skip the part of step three where it instructs you to create a new topic, since you already have a topic here. There's no need to create another topic. :wink:

Thank you.

Regards,
bwv848

P.S. Even if your computer isn't blue screening, please still do the above.


If I do not reply in three days, please message me.
 
BC BSOD Posting Instructions | Carrona BSOD Index | Driver Reference Table (DRT)


#3 Mubin Ali

Mubin Ali
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:11 PM

Posted 02 January 2018 - 11:38 AM

Hello,

 

Thanks a lot for your response.

 

PFA is the SysnativeFileCollectionApp.zip file as instructed. The following is the Speccy URL http://speccy.piriform.com/results/Y6DdnFHITbsDP7lw8CvpSlt

 

Please let me know if any other steps needs to be done or if I am missing anything, will do them asap.

 

Regards.

Attached Files



#4 bwv848

bwv848

    Bleepin' Owl


  • BSOD Kernel Dump Expert
  • 3,028 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:92.96 million miles away from the sun
  • Local time:03:41 AM

Posted 02 January 2018 - 01:45 PM

Thank you.

I will be providing my analysis of the latest dump file from the crash that occured today. Note that there are several other dump files in the uploaded SFCA output. The ones from December 6 to December 15 are STOP 0x9Fs, the one that occured on December 22 was a STOP 0x124, and the ones that have been occuring since December 24 are STOP 0x1000007Es. In summary, I will disregard the other BSODs for now. :)

2: kd> !analyze -show 1000007e ffffffffc0000005 fffff8024ad3e844 ffffa580381b6c78 ffffa580381b64b0
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8024ad3e844, The address that the exception occurred at
Arg3: ffffa580381b6c78, Exception Record Address
Arg4: ffffa580381b64b0, Context Record Address
2: kd> !error ffffffffc0000005
Error code: (NTSTATUS) 0xc0000005 (3221225477) - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
2: kd> .exr ffffa580381b6c78
ExceptionAddress: fffff8024ad3e844 (NETIO!StreamInvokeCalloutAndNormalizeAction+0x0000000000000060)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000008
Attempt to read from address 0000000000000008
2: kd> knL
 # Child-SP          RetAddr           Call Site
00 ffffa580`381b6eb0 fffff802`4ad3e1a0 NETIO!StreamInvokeCalloutAndNormalizeAction+0x60
01 ffffa580`381b6f90 fffff802`4ad3d8b7 NETIO!StreamProcessCallout+0x434
02 ffffa580`381b70d0 fffff802`4ad3d02e NETIO!ProcessCallout+0x6b7
03 ffffa580`381b7250 fffff802`4ad3b1c3 NETIO!ArbitrateAndEnforce+0x4ee
04 ffffa580`381b7390 fffff802`4ad7bc85 NETIO!KfdClassify+0x303
05 ffffa580`381b7740 fffff802`4ad7b728 NETIO!StreamInternalClassify+0x109
06 ffffa580`381b7860 fffff802`4ad78e45 NETIO!StreamInject+0x214
07 ffffa580`381b7930 fffff802`4b07683d NETIO!FwppStreamInject+0x135
08 ffffa580`381b79c0 fffff802`4b74c9cf fwpkclnt!FwpsStreamInjectAsync0+0xfd
09 ffffa580`381b7a20 ffffb785`39201a90 vsdatant+0xc9cf
0a ffffa580`381b7a28 00000000`000005a0 0xffffb785`39201a90
0b ffffa580`381b7a30 ffffb785`393d99a0 0x5a0
0c ffffa580`381b7a38 00000000`00000000 0xffffb785`393d99a0
2: kd> !dpx ffffa580381b2000 ffffa580381b8000
Start memory scan  : 0xffffa580381b2000
End memory scan    : 0xffffa580381b8000

...
Unable to load image \??\C:\Program Files\Panda Security URL Filtering\panda_url_filteringd.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for panda_url_filteringd.sys
*** ERROR: Module load completed but symbols could not be loaded for panda_url_filteringd.sys
0xffffa580381b65a8 : 0xfffff8024ad3e844 : NETIO!StreamInvokeCalloutAndNormalizeAction+0x60
0xffffa580381b65b8 : 0xfffff8024ae09f90 : tcpip!TcpTcbSendDatagramsComplete
0xffffa580381b65d8 : 0xfffff8024ad3f8f4 : NETIO!NetioDereferenceNetBufferListChain+0xf4
0xffffa580381b6618 : 0xfffff8023649f83a : nt!KiRequestSoftwareInterrupt+0x2a
0xffffa580381b6648 : 0xfffff8024b0610e1 : fwpkclnt!FwppNetBufferListEventNotify+0xe1
0xffffa580381b6798 : 0xfffff8023640d277 : hal!HalRequestSoftwareInterrupt+0xd7
Unable to load image \SystemRoot\system32\DRIVERS\NNSNAHSL.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NNSNAHSL.sys
*** ERROR: Module load completed but symbols could not be loaded for NNSNAHSL.sys
Unable to load image \SystemRoot\system32\DRIVERS\NNSPRV.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NNSPRV.sys
*** ERROR: Module load completed but symbols could not be loaded for NNSPRV.sys
...
2: kd> lm k vm vsdatant; lm k vm panda_url_filteringd; lm k vm NNSNAHSL; lm k vm NNSPRV
Browse full module list
start             end                 module name
fffff802`4b740000 fffff802`4b7d6000   vsdatant T (no symbols)           
    Loaded symbol image file: vsdatant.sys
    Image path: \SystemRoot\System32\drivers\vsdatant.sys
    Image name: vsdatant.sys
    Browse all global symbols  functions  data
    Timestamp:        Sat Mar 11 21:49:14 2017 (58C4B72A)
    CheckSum:         0007D15F
    ImageSize:        00096000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
Browse full module list
start             end                 module name
fffff802`4f8c0000 fffff802`4f8cf000   panda_url_filteringd T (no symbols)           
    Loaded symbol image file: panda_url_filteringd.sys
    Image path: \??\C:\Program Files\Panda Security URL Filtering\panda_url_filteringd.sys
    Image name: panda_url_filteringd.sys
    Browse all global symbols  functions  data
    Timestamp:        Wed Mar 19 16:23:04 2014 (5329FCA8)
    CheckSum:         00014E61
    ImageSize:        0000F000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
Browse full module list
start             end                 module name
fffff802`4b8d0000 fffff802`4b8e4000   NNSNAHSL T (no symbols)           
    Loaded symbol image file: NNSNAHSL.sys
    Image path: \SystemRoot\system32\DRIVERS\NNSNAHSL.sys
    Image name: NNSNAHSL.sys
    Browse all global symbols  functions  data
    Timestamp:        Wed Jun 08 12:49:22 2016 (57584C92)
    CheckSum:         0001D8C3
    ImageSize:        00014000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
Browse full module list
start             end                 module name
fffff802`4bd60000 fffff802`4bdad000   NNSPRV   T (no symbols)           
    Loaded symbol image file: NNSPRV.sys
    Image path: \SystemRoot\system32\DRIVERS\NNSPRV.sys
    Image name: NNSPRV.sys
    Browse all global symbols  functions  data
    Timestamp:        Wed Feb 08 06:05:08 2017 (589AFB64)
    CheckSum:         000359FB
    ImageSize:        0004D000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
So you can see the 0x1000007E bugcheck. The first parameter shows an access violation occured, and the third parameter shows the exception record address. Looks like the violation happened in the NETIO!StreamInvokeCalloutAndNormalizeAction networking routine. Dumping the call stack we quickly see a ZoneAlarm driver, a potential culprit. However, dumping the raw stack we see lots of interesting things... a McAfee driver and a Panda Security driver. Which begs the question — why on earth are you running so many security programs at once?

In summary, I would suggest you remove all Panda Security, McAfee, and ZoneAlarm programs at once from the Control Panel — you may leave Malwarebytes installed for now. This should stop the BSODs.

If I do not reply in three days, please message me.
 
BC BSOD Posting Instructions | Carrona BSOD Index | Driver Reference Table (DRT)


#5 Mubin Ali

Mubin Ali
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:11 PM

Posted 02 January 2018 - 02:55 PM

Hello,

 

Thanks for the in-depth analysis and explanation. I only had Panda Anti-virus on my system+Malwarebytes+windows Firewall. I thought there would be no harm in dumping Windows Firewall and installing the free Zone Alarm Firewall. Hence I installed the Zone ALarm Free FW. I did not install their Anti-virus as I already had Panda on my system. Then as and when issues started to crop up, I uninstalled Zone Alarm FW few days ago and it is no longer showing in Control Panel > Uninstall Programs. If there are any left overs, then please advise best possible to get rid off them.

 

I honestly do not recall having McAfee on my system. Its possible that I had the 1 year free subscription when I bought the laptop which was back 2012 or 2013. Currently there is no McAfee showing in Control panel > Uninstall so again if left overs, please guide and then I would remove it.

 

As per your instruction, I have removed Panda and have switched on Windows Defender for now.



#6 bwv848

bwv848

    Bleepin' Owl


  • BSOD Kernel Dump Expert
  • 3,028 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:92.96 million miles away from the sun
  • Local time:03:41 AM

Posted 02 January 2018 - 03:03 PM

Can you run MiniToolBox? I would like to see your installed programs better...

 

:step1: MiniToolBox by Farbar

  • Download and save MiniToolBox from here.
  • Navigate to the directory in which you saved the file.
  • Right-click on MiniToolBox.exe, select Run as administrator, and accept any User Account Control Prompts.
  • Hit Select All and click Go. (You may uncheck Reset IE Proxy/FF Proxy Settings if you have intentionally setup a proxy server.)
  • Once MiniToolBox is complete, it will open a text file called MTB.txt, which is stored in the same directory you ran MiniToolBox from.
  • Please copy and paste the contents of MTB.txt in your next reply.


If I do not reply in three days, please message me.
 
BC BSOD Posting Instructions | Carrona BSOD Index | Driver Reference Table (DRT)


#7 Mubin Ali

Mubin Ali
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:11 PM

Posted 03 January 2018 - 12:50 AM

Hello

 

PFA MTB file as per your instructions.

 

Regards,

Attached Files

  • Attached File  MTB.txt   40.02KB   2 downloads


#8 NICK ADSL UK

NICK ADSL UK

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:08:41 AM

Posted 03 January 2018 - 05:55 AM

This fault has been noted by Microsoft and the team are looking into it. my conclusion is that it is caused by the Microsoft video card driver that is needed to run windows10 on those who upgraded from vista and windows 7 operating system's as AMD for example did not upgrade the older card drivers to be able to be compliant with windows 10 


Edited by NICK ADSL UK, 03 January 2018 - 05:56 AM.


Wilders Security Forum Admin
Microsoft MVP - Consumer Security


#9 bwv848

bwv848

    Bleepin' Owl


  • BSOD Kernel Dump Expert
  • 3,028 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:92.96 million miles away from the sun
  • Local time:03:41 AM

Posted 03 January 2018 - 10:31 AM

Thank you. ZoneAlarm is still present on the system.

ZoneAlarm Firewall (HKLM-x32\...\{21270F0B-5EF4-4AA9-A441-8DCB49607818}) (Version: 15.1.509.17508 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Security (HKLM-x32\...\{C34458C8-D14B-499B-ACD6-D3C40E98CF78}) (Version: 15.1.509.17508 - Check Point Software Technologies Ltd.) Hidden

Since you removed it via the Control Panel already, we need to run their uninstall tool - https://www.bleepingcomputer.com/download/zonealarm-uninstall-tool/
 
We also need to completely uninstall Panda Antivirus, please run their uninstall tool too - https://www.pandasecurity.com/usa/support/card?id=82011
 
You are right that McAfee is not on your system. The problem is that I saw MCShield on your computer and concluded from Google that it was from McAfee. That's wrong because MCShield is a USB antimalware program, while mcshield.exe is a McAfee related process (which kept turning up all over Google). Sorry about that.


If I do not reply in three days, please message me.
 
BC BSOD Posting Instructions | Carrona BSOD Index | Driver Reference Table (DRT)


#10 bwv848

bwv848

    Bleepin' Owl


  • BSOD Kernel Dump Expert
  • 3,028 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:92.96 million miles away from the sun
  • Local time:03:41 AM

Posted 03 January 2018 - 10:33 AM

I forgot to add that there was no McAfee driver in the raw stack either, I think. Don't know why I had said that. Sorry.


If I do not reply in three days, please message me.
 
BC BSOD Posting Instructions | Carrona BSOD Index | Driver Reference Table (DRT)


#11 Mubin Ali

Mubin Ali
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:11 PM

Posted 03 January 2018 - 12:40 PM

Hello,

 

Thanks for your response and its absolutely fine about the McAfee bit. :thumbup2:

 

As per your instructions I ran the Panda removal tool and rebooted the laptop. However, I could not do the same for ZoneAlarm FW. I got the attached error message/notification while running it. There was no other error message etc apart from this.

 

Is there any other way to remove ZoneAlarm FW ? and once this issue is sorted, which AV should I go for ?

 

Regards,

Attached Files



#12 Mubin Ali

Mubin Ali
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:11 PM

Posted 03 January 2018 - 02:18 PM

Hello,

 

Don't mean to spam the post but I got the Zone Alarm FW removed finally. I googled on how to remove it and stumbled on this link:https://www.zonealarm.com/forums/showthread.php/82080-Problem-with-resetting-uninstalling-Free-Antivirus-Firewall

 

It instructed to download the removal tool again so just out of curiosity I downloaded and alas the Removal tool worked much to my surprise. I ran the MiniToolbox and could not find ZoneAlarm entry in the notepad.

 

Hopefully this should solve the crashing. Please do advise which AV I should use. Should I go for Panda free AV as it used work fine? I just had some apprehensions that may be it is not doing the job properly so I thought of trying out Bit Defender Free AV. Please share your thoughts.

 

Thanks again for all your help and guidance.



#13 SteveBH

SteveBH

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:02:41 AM

Posted 03 January 2018 - 03:00 PM

Hello.   I wanted to add to this topic because I have the exact same problem, and Whocrashed is telling me the exact same message   My situation is different however - - -  I have a fairly new HP laptop (~3 months old) that came preinstalled with Window 10 64 bit, and I'm running  Norton security, with no other security apps on board.   So - if MS is really looking into this issue, it's seems it may not be ( or may not ONLY be) a Windows 7 to 10 upgrade issue or outdated driver error, unless my version of w10 came with pre-outdated drives. 

 

Note this only started happening to me after the Firefox upgrade to Firefox Quantum, which happened 3-4 weeks ago.  I'm now at version 57.0.3     Note also this random restart problem only happens when I'm in Firefox, but then again I'm in Firefox 90% of the time anyway, so perhaps it's just the odds.

 

Thanks.

 



#14 bwv848

bwv848

    Bleepin' Owl


  • BSOD Kernel Dump Expert
  • 3,028 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:92.96 million miles away from the sun
  • Local time:03:41 AM

Posted 03 January 2018 - 04:08 PM

Hello,

 

Don't mean to spam the post but I got the Zone Alarm FW removed finally. I googled on how to remove it and stumbled on this link:https://www.zonealarm.com/forums/showthread.php/82080-Problem-with-resetting-uninstalling-Free-Antivirus-Firewall

 

It instructed to download the removal tool again so just out of curiosity I downloaded and alas the Removal tool worked much to my surprise. I ran the MiniToolbox and could not find ZoneAlarm entry in the notepad.

 

Hopefully this should solve the crashing. Please do advise which AV I should use. Should I go for Panda free AV as it used work fine? I just had some apprehensions that may be it is not doing the job properly so I thought of trying out Bit Defender Free AV. Please share your thoughts.

 

Thanks again for all your help and guidance.

That's great. I would suggest you use Windows Defender for a few days, staying clear of all third-party antiviruses for now. Our objective is to see whether if the system has truly stabilized and returned back to normal.


If I do not reply in three days, please message me.
 
BC BSOD Posting Instructions | Carrona BSOD Index | Driver Reference Table (DRT)


#15 Mubin Ali

Mubin Ali
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:11 PM

Posted 04 January 2018 - 02:37 AM

Hello,

 

Sure thing. I will keep a tab of this and will report if the crash happens again. Thanks for your help.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users