BSOD - Help!

[xMarkx]

Hi,

When I turned my PC on today, I received a Blue Screen Error.

It only lasted for a few seconds, so I wasn't able to see everything.

The computer rebooted and when I logged back in I got a message saying Windows rebooted from an error.

I'm no good at technical stuff like this but I do know it's a problem - happened 3 times in the past month!! I'm running Windows Vista Home Premium SP1.

Here is the info that Windows provided when it rebooted and from what I saw on the BSOD:

From what I saw: BAD_POOL_HEADER

Windows provided when it rebooted:


Problem Event Name: BlueScreen

Additional information about the problem:
BCCode: 19
BCP1: 00000021
BCP2: 87DB0000
BCP3: 00009B58
BCP4: 00000000

Just before I turned the computer off, it said that something about WinTask still running or something but it quickly disappeared so that's all I saw.

Would it be possible for someone to figure out what the cause of my BSOD is with the BCCODE and the BCP1-BCP4 above?

Thanks, let me know if you need more info.

[Osaban]

What is your security set-up? What is it that you have installed lately (in the past month), particularly HIPS are likely to create conflicts. You should also check what starts up automatically with Windows, you can check with AutoRuns from Sysinternals http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

[xMarkx]

-{ Quote: "What is your security set-up? What is it that you have installed lately (in the past month), particularly HIPS are likely to create conflicts. You should also check what starts up automatically with Windows, you can check with AutoRuns from Sysinternals http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx" }-
Hi,

I have installed nothing since the BSOD occured with the exception of Windows Updates.

I had McAfee from the day I bought my computer until today.

However, today (after the BSOD) I uninstalled McAfee and downloaded NOD32 Antivirus v3.

I don't know what HIPS are. I will check out the link you provided.

Thanks.
Regards,
Mark.

[Franklin]

Have a look around in the Event Viewer for any pointers to the prob.

[xMarkx]

-{ Quote: "Have a look around in the Event Viewer for any pointers to the prob." }-
Exactly what kind of things am I looking for, besides, of course, the bugcheck for the BSOD? The info for it was provided in my thread.

[Osaban]

-{ Quote: "Hi,

I have installed nothing since the BSOD occured with the exception of Windows Updates.

I had McAfee from the day I bought my computer until today.

However, today (after the BSOD) I uninstalled McAfee and downloaded NOD32 Antivirus v3.

" }-

Blue screens are usually caused by conflicts, but could also be spyware or adware. If you downloaded Nod32, I would imagine you have performed a full system scan. If I were you I would also download SuperAntispyware and Malwarebytes Anti-Malware http://www.malwarebytes.org/ http://www.superantispyware.com/ both programs are perhaps better than Nod32 at spotting spyware (they are both free).

-{ Quote: " Would it be possible for someone to figure out what the cause of my BSOD is with the BCCODE and the BCP1-BCP4 above?" }-

I personally have never read of anybody identifying errors by quoting their numbers. I could be wrong so hopefully somebody who is a real expert might help you. In the past when I brought my computer back to after service support, and ask them to interpret a blue screen, their answer would invariably be: Reinstall Windows.

[xMarkx]

-{ Quote: "Blue screens are usually caused by conflicts, but could also be spyware or adware. If you downloaded Nod32, I would imagine you have performed a full system scan. If I were you I would also download SuperAntispyware and Malwarebytes Anti-Malware http://www.malwarebytes.org/ http://www.superantispyware.com/ both programs are perhaps better than Nod32 at spotting spyware (they are both free).



I personally have never read of anybody identifying errors by quoting their numbers. I could be wrong so hopefully somebody who is a real expert might help you. In the past when I brought my computer back to after service support, and ask them to interpret a blue screen, their answer would invariably be: Reinstall Windows." }-
Hi,

Yes I performed 2 full system scans with NOD32. I also performed numerous full system scans with McAfee before I got rid of it for NOD32 a few days ago.

All scans were clean.

[Osaban]

Vista creates by default a restore point in 'System Restore' every time there is a download, particularly Windows Updates. You could try to restore your system before Windows' last update.

If I were you and nobody comes up with a solution, I would definitely reinstall Windows with its original CD. I would also buy an 'imaging program', back up my system regularly, and whenever a situation as the one you are experiencing occurs, restoring your system to an ideal configuration would take minutes (my system 50 GB+ takes 23 minutes).

It would save you a lot of time and anxiety in the long run.

[nick s]

Hi xMarkx,

Debugwiz is a convenient tool for analyzing BSODs. You can get it here with setup instructions > Dump Data collection tool and instructions (http://www.windowsbbs.com/general-discussions/33471-dump-data-collection-tool-instructions.html). Post the contents of c:\debuglog.txt. BSOD causes are often obvious. Keep in mind that debugwiz requires network access to MS symbol servers.

Nick

[GlobalForce]

If you're serious Mark, that's sound advice Nick offered. Most folks fail to go forward 'cause they needlessly sweat the symbols dwnld.

S

[xMarkx]

-{ Quote: "If you're serious Mark, that's sound advice Nick offered. Most folks fail to go forward 'cause they needlessly sweat the symbols dwnld.

S" }-
Hi,

Is it safe to download something from a website I don't know that is used to analyze my PC when it's not from Microsoft or an antivirus vendor?

[nick s]

-{ Quote: "Hi,

Is it safe to download something from a website I don't know that is used to analyze my PC when it's not from Microsoft or an antivirus vendor?" }-
Debugwiz is a reputable/safe app. It's merely a convenient UI for MS Debugging Tools for Windows.

Nick

[xMarkx]

-{ Quote: "Debugwiz is a reputable/safe app. It's merely a convenient UI for MS Debugging Tools for Windows.

Nick" }-
Hi,

Isn't there anyway I can tell what the cause of the BSOD is without having to download anything I'm still not 100% sure of? Since BSOD's are a common problem in Windows, shouldn't Microsoft provide an easy way to access the debug file to solve the problem?

Regards,
Mark

[nick s]

-{ Quote: "Isn't there anyway I can tell what the cause of the BSOD is without having to download anything I'm still not 100% sure of?" }-
Not without, at minimum, installing MS Debugging Tools for Windows on your system. You could, however, send your minidump(s) to someone else for analysis. I'll take a look at them. PM me if you're interested.

-{ Quote: "Since BSOD's are a common problem in Windows, shouldn't Microsoft provide an easy way to access the debug file to solve the problem?" }-
MS Debugging Tools for Windows + debugwiz is about as easy and safe as it gets.

Nick

[majoMo]

Similar tool is WhoCrashed (http://www.resplendence.com/whocrashed). Like DebugWiz it needs Windows Debugging Package installed (or install it for you; online required also).

[xMarkx]

-{ Quote: "Hi xMarkx,

Debugwiz is a convenient tool for analyzing BSODs. You can get it here with setup instructions > Dump Data collection tool and instructions (http://www.windowsbbs.com/general-discussions/33471-dump-data-collection-tool-instructions.html). Post the contents of c:\debuglog.txt. BSOD causes are often obvious. Keep in mind that debugwiz requires network access to MS symbol servers.

Nick" }-
Hi,

I'm okay with computers but not this kind of high tech technical stuff.

However, with a Dell Support agent, I was able to install WinDbg and analyze the debug files.

I have no idea how to read it, but the Dell Agent said the problem pointed to "npkcusb.sys" in the Blue Screens. After that, he disconnected the telephone chat and DellConnect chat...

I can still open the debug files but they look different than before because he copied and pasted a command into the box, but I don't know what he copied and pasted into it. But in any case I think he was right about the "npkcusb.sys" causing the issue because at the bottom of the long list of numbers and letters it says "Probably caused by : npkcusb.sys"

What should I do now?

Thanks for your advice!
Regards,
Mark.

Edit : This is what "file.com" had to say about npkcusb.sys

The process nProtect KeyCrypt Driver belongs to the software nProtect KeyCrypt Driver or Lineage II by INCA Internet Co., Ltd.

Description: npkcusb.sys is located in a subfolder of "C:\Program Files". The file size on Windows XP is 37009 bytes.
The driver can be started or stopped from Services in the Control Panel or by other programs. The program is not visible. There is no detailed description of this service. File npkcusb.sys is not a Windows core file. npkcusb.sys seems to be a compressed file. Therefore the technical security rating is 40% dangerous.

I have no idea what this means. I do know that a game I used to play called MapleStory uses Gameguard which includes the nProtect Keycrypt Driver. I tried adding this info into the actual thread but I couldn't find the 'edit' button for some reason, so I just included it in this post.

What should I do?

Thanks,

Mark.

[nick s]

-{ Quote: "Hi,

I'm okay with computers but not this kind of high tech technical stuff.

However, with a Dell Support agent, I was able to install WinDbg and analyze the debug files.

I have no idea how to read it, but the Dell Agent said the problem pointed to "npkcusb.sys" in the Blue Screens. After that, he disconnected the telephone chat and DellConnect chat...

I can still open the debug files but they look different than before because he copied and pasted a command into the box, but I don't know what he copied and pasted into it. But in any case I think he was right about the "npkcusb.sys" causing the issue because at the bottom of the long list of numbers and letters it says "Probably caused by : npkcusb.sys"

What should I do now?

Thanks for your advice!
Regards,
Mark.

Edit : This is what "file.com" had to say about npkcusb.sys

The process nProtect KeyCrypt Driver belongs to the software nProtect KeyCrypt Driver or Lineage II by INCA Internet Co., Ltd.

Description: npkcusb.sys is located in a subfolder of "C:\Program Files". The file size on Windows XP is 37009 bytes.
The driver can be started or stopped from Services in the Control Panel or by other programs. The program is not visible. There is no detailed description of this service. File npkcusb.sys is not a Windows core file. npkcusb.sys seems to be a compressed file. Therefore the technical security rating is 40% dangerous.

I have no idea what this means. I do know that a game I used to play called MapleStory uses Gameguard which includes the nProtect Keycrypt Driver. I tried adding this info into the actual thread but I couldn't find the 'edit' button for some reason, so I just included it in this post.

What should I do?

Thanks,

Mark." }-
If you're no longer using anything requiring GameGuard, you can merely disable the driver from loading. No driver loading = no driver-related BSOD. According to How to remove npkcusb error (http://www.file.net/process/npkcusb.sys.html), you can disable its service via Control Panel > Administrative Tools > Services. You could also use Sysinternals' AutoRuns (http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx). Untick the npkcusb.sys entry in the Drivers tab.

Nick

[xMarkx]

-{ Quote: "If you're no longer using anything requiring GameGuard, you can merely disable the driver from loading. No driver loading = no driver-related BSOD. According to How to remove npkcusb error (http://www.file.net/process/npkcusb.sys.html), you can disable its service via Control Panel > Administrative Tools > Services. You could also use Sysinternals' AutoRuns (http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx). Untick the npkcusb.sys entry in the Drivers tab.

Nick" }-
Hi,

Thanks for your quick reply! If I wanted to run the game requiring GameGuard, (I don't play it anymore, but sometimes I might go on it just to say hi to old friends, etc) but I have disabled the driver npkcusb.sys from loading, will it result in the game not loading correctly or loading at all and/or further problems?

Regards,

Mark.

[nick s]

-{ Quote: "Hi,

Thanks for your quick reply! If I wanted to run the game requiring GameGuard, (I don't play it anymore, but sometimes I might go on it just to say hi to old friends, etc) but I have disabled the driver npkcusb.sys from loading, will it result in the game not loading correctly or loading at all and/or further problems?

Regards,

Mark." }-It will probably break the game somehow. I would enable the driver when you need it (might require a reboot) and disable it when you're done.

Nick

[xMarkx]

-{ Quote: "It will probably break the game somehow. I would enable the driver when you need it (might require a reboot) and disable it when you're done.

Nick" }-
Hi,

If I set it to start 'manually' does that mean it will only start when I start the program and will be 'disabled' unless I start the program myself? Will the program start correctly? After I quit the program, will it disable itself or keep running? If it keeps running, would I disable it then? Or would it be best to just enable driver when using it and then disable it when done? Do you know of anyone else who has had a similar problem with this driver as well? (who might know a fix for it other than disableing it). I get the blue screen for it about once per month.

Regards,

Mark.

[nick s]

-{ Quote: "Hi,

If I set it to start 'manually' does that mean it will only start when I start the program and will be 'disabled' unless I start the program myself? Will the program start correctly? After I quit the program, will it disable itself or keep running? If it keeps running, would I disable it then? Or would it be best to just enable driver when using it and then disable it when done? Do you know of anyone else who has had a similar problem with this driver as well? (who might know a fix for it other than disableing it). I get the blue screen for it about once per month.

Regards,

Mark." }-Hi,

I went ahead and installed MapleStory to get an idea of what you're up against. As you probably already know, MapleStory + GameGuard have known compatibility issues with Vista. To get it running, I had to turn off UAC, turn off DEP completely (using "bcdedit.exe /set {current} nx AlwaysOff"), and set maplestory.exe to run in XP SP2 compatibility mode.

When MapleStory executes for the first time, GameGuard creates one automatic service, npkcmsvc - nProtect KeyCrypt Manager Service, and two autostarting boot drivers, npkcusb.sys and npkcrypt.sys.

The game will start and run normally if you set the npkcmsvc service to manual startup...

[nick s]

The game will also start and run normally if you untick npkcusb.sys and npkcrypt.sys using Autoruns. GameGuard, however, will reset the boot drivers to autostart every time you run MapleStory. You will need to use Autoruns to disable them when you're done playing and reboot...