0x000000c4 error

Hi Gerry

I have the latest version of avast home.

At the moment the problem only seems to happen when the drivers are being
verified. I have already rolled back to the last good configuration but the
only critical update I can think of is the program update for ad-ware. I
have not recently had to update any drivers since there are no recent updates
available.

According to sigverif the following drivers are not signed:

[c:\windows\system32\drivers]
tifsfilt.sys 18/04/2008 3.3.0.444 Not Signed
N/A
timntr.sys 18/04/2008 3.3.0.444 Not Signed
N/A
[c:\windows\system32\spool\drivers\w32x86\2]
plotter.dll 06/05/1997 0.2.0.0 Not Signed
N/A
plotui.dll 06/05/1997 0.2.0.0 Not Signed
N/A
[c:\windows\system32\spool\drivers\w32x86\3]
mxdwdrv.dll 22/03/2007 0.3.6000.0 Not Signed
N/A
mxdwdui.dll 22/03/2007 0.3.6000.16438 Not Signed
N/A
mxdwdui.gpd 31/08/2006 None Not Signed
N/A
mxdwdui.ini 21/04/2006 None Not Signed
N/A
unires.dll 22/03/2007 0.3.6000.16438 Not Signed
N/A

I am trying to isolate the suspect driver but cannot single one out with the
current information available to me. there is nothing showing in the event
log.

"Gerry" wrote:

> Lee
>
> What version of Avast?
>
> Have you a Sysyem Restore point from before the problem started? You
> will need to turn of Avast to use System Restore.
>
> Background information on Stop Error message
> http://msdn2.microsoft.com/en-us/library/ms793589.aspx
>
> 0x0000000A: IRQL_NOT_LESS_OR_EQUAL
> Typically due to a bad driver, or faulty or incompatible hardware or
> software. Use the General Troubleshooting of STOP Messages checklist
> above. Technically, this error condition means that a kernel-mode
> process or driver tried to access a memory location to which it did not
> have permission, or at a kernel Interrupt ReQuest Level (IRQL) that was
> too high. (A kernel-mode process can access only other processes that
> have an IRQL lower than, or equal to, its own.)
> Source: http://aumha.org/a/stop.htm
>
> Try Start, Run, type "sigverif.exe" without quotes and hit OK. What
> drivers are listed as unsigned? Disregard those which are not checked.
>
> --
>
>
>
> Hope this helps.
>
> Gerry
> ~~~~
> FCA
> Stourport, England
> Enquire, plan and execute
> ~~~~~~~~~~~~~~~~~~~
>
> LeeG wrote:
> > Thanks for your replies.
> >
> > I have Avast Home edition - fully updated. Spybot - fully updated.
> > Ad-ware - fully updated (although last update did not go quite to
> > plan (program update) but seemed okay after a retry.
> >
> > "Gerry" wrote:
> >
> >> Lee
> >>
> >> What are your anti-virus and anti-spyware arrangements?
> >>
> >>
> >> --
> >>
> >>
> >>
> >> Hope this helps.
> >>
> >> Gerry
> >> ~~~~
> >> FCA
> >> Stourport, England
> >> Enquire, plan and execute
> >> ~~~~~~~~~~~~~~~~~~~
> >>
> >> LeeG wrote:
> >>> the exact stop message is
> >>> '0x000000c4,0x0000003c,0x00000000,0x00000000' with text saying a
> >>> device driver was not working right or text to that effect (I can't
> >>> remember exactly). It seemed to be linked with running the driver
> >>> verifier which I was running after getting a 0xc2 (bad pool caller)
> >>> stop code. I managed to recover using the last known good
> >>> configuration so I therefore don't know exactly how far back the
> >>> computer has gone. I could try to run the verifier again but don't
> >>> want to run the risk of ending up with an un-recoverable system
> >>> unless it is un-avoidable.
> >>>
> >>> The BSD occured after the splash screen just as the desktop is
> >>> loading. I have tried researching the 0x3c parameter but cannot
> >>> find any reference for this code in connection with the 0xc4
> >>> parameter.
> >>>
> >>> the tmcomm error is a code 24 and when I try to start it I get 'the
> >>> system could not find the file specified.' It does not state which
> >>> file. Can I just delete this entry and if so what is the safest way
> >>> to do this.
> >>>
> >>> "Gerry" wrote:
> >>>
> >>>> Lee
> >>>>
> >>>> It would help to see the complete Stop Error Report.
> >>>>
> >>>> Disable automatic restart on system failure. This should help by
> >>>> allowing time to write down the STOP code properly. Right click on
> >>>> the My Computer icon on the Desktop and select Properties,
> >>>> Advanced, Start-Up and Recovery, System Failure and uncheck box
> >>>> before Automatically Restart.
> >>>>
> >>>> Do not re-enable automatic restart on system failure. Check for
> >>>> variants of the Stop Error message.
> >>>>
> >>>> Does the error occur doring or after the boot process? Does the
> >>>> error occur in safe mode?
> >>>>
> >>>> "I also have the yellow triangle against tmcomm which is stopped
> >>>> but if I try to start it I am told a file does not exist." What is
> >>>> the file named?
> >>>>
> >>>>
> >>>> --
> >>>>
> >>>>
> >>>>
> >>>> Hope this helps.
> >>>>
> >>>> Gerry
> >>>> ~~~~
> >>>> FCA
> >>>> Stourport, England
> >>>> Enquire, plan and execute
> >>>> ~~~~~~~~~~~~~~~~~~~
> >>>>
> >>>>
> >>>> LeeG wrote:
> >>>>> I have already verified that my computer is 'clean' and I have
> >>>>> also cleared all the caches for ie etc. I think that the windows
> >>>>> verifier is one of the causes of this problem. Concerning the
> >>>>> link you provided for windows verifier I don't have any Norton,
> >>>>> (and never will have,) software. I have a device driver that is
> >>>>> possibly corrupted (or on the edge of failing) but it is not
> >>>>> showing via device manager. I want to find out which device
> >>>>> driver this is but I don't know where to look besides device
> >>>>> manager. Is there another utility, maybe a benchmark tool, that
> >>>>> I can use which will test my device drivers other than the
> >>>>> verifier that windows provides?. The tmcomm link refers to
> >>>>> another av that I have never installed but it was an option to
> >>>>> install on the install disc I got with talktalk broadband.
> >>>>>
> >>>>> "nass" wrote:
> >>>>>
> >>>>>>
> >>>>>>
> >>>>>> "LeeG" wrote:
> >>>>>>
> >>>>>>> This morning I started getting the dreaded BSD with the error
> >>>>>>> code as above. I have successfully recovered the computer but
> >>>>>>> cannot track down the initial cause of the problem. The latest
> >>>>>>> memory dump file is dated 20/09 so therefore I can not tell
> >>>>>>> which driver is at fault. The event log service also does not
> >>>>>>> seem to contain the information concerning the possible event
> >>>>>>> that might have led to this BSD. I have a leaning towards the
> >>>>>>> latest upgrade to Ad-ware but can not confirm this. I also
> >>>>>>> have the yellow triangle against tmcomm which is stopped but if
> >>>>>>> I try to start it I am told a file does not exist. All other
> >>>>>>> devices and drivers appear to be okay. I have tried the driver
> >>>>>>> verifier manager which I think added to this problem.
> >>>>>>>
> >>>>>>> I am at a loss as to the next step in identifying to problem
> >>>>>>> driver. Any help is much appreciated.
> >>>>>>
> >>>>>>
> >>>>>> [Vulnerability Confirmation] TmComm Local Privilege Escalation
> >>>>>> Vulnerability
> >>>>>> http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1034432
> >>>>>>
> >>>>>> Fatal System Error: 0x000000C4 If Deadlock Detection in Driver
> >>>>>> Verifier Is http://support.microsoft.com/kb/325672
> >>>>>>
> >>>>>> You can use this driver verifier command:
> >>>>>> verifier.exe click [OK]
> >>>>>> First try to eliminate hardware, by going to Device manager and
> >>>>>> check by expanding the Plus [+] to see all devices listed, if
> >>>>>> there is a malfunctioning device or conflicting device it will
> >>>>>> show in Device manager. How to perform a clean boot in Windows XP
> >>>>>> http://support.microsoft.com/?id=310353
> >>>>>> A description of the Safe Mode Boot options in Windows XP
> >>>>>> http://support.microsoft.com/kb/315222/en-us
> >>>>>>
> >>>>>> Try to use the Verifier.exe command to see which Drivers not
> >>>>>> Verified on your system:
> >>>>>> How to Use Driver Verifier to Troubleshoot Windows Drivers
> >>>>>> http://support.microsoft.com/kb/244617/en-us
> >>>>>>
> >>>>>> Go through these cleaning steps:
> >>>>>>
> >>>>>> 1... First, try to clean up your caches, Internet files and
> >>>>>> delete cookies by doing this:
> >>>>>> Click Start >> Control Panel >> Double click Network and Internet
> >>>>>> Connections >> Double click Internet Options.
> >>>>>> On the IE properties windows you will see these Tabs:
> >>>>>> General | Security | Privacy | Content | Connections | Programs |
> >>>>>> Advanced
> >>>>>> Under General Tab clear your History, Internet Files and Cookies.
> >>>>>> Then click on Advanced tab and scroll down to under the Browsing
> >>>>>> Option: [&] Browsing
> >>>>>> [ ] Enable Third-Party browser extensions (Req Rest) uncheck
> >>>>>> this box. Then click on Programs Tab and click Manage Add-Ons and
> >>>>>> Disable all non Verified Add-Ons (You should Renable them later
> >>>>>> one-by-one and see the culprit and update it or remove it.
> >>>>>> How to manage Add-Ons:
> >>>>>> http://support.microsoft.com/kb/883256
> >>>>>> Scan for malware from here:
> >>>>>> SuperAntispyware - Free
> >>>>>> http://www.superantispyware.com/superantispywarefreevspro.html
> >>>>>> http://www.malwarebytes.org/rr-update/rr-free-setup.exe
> >>>>>> http://onecare.live.com/site/en-gb/default.htm?s_cid=sah
> >>>>>>
> >>>>>> Run a scan from here on-line:
> >>>>>> http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
> >>>>>> http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
> >>>>>> Download Avast Cleaner (offline scanner) from here:
> >>>>>> http://www.avast.com/eng/avast-virus-cleaner.html
> >>>>>>
> >>>>>> Run disk clean up on your Drive.
> >>>>>> You can download this tool o run clean up:
> >>>>>> http://www.ccleaner.com/download/builds/downloading-slim
> >>>>>>
> >>>>>> Run this command:
> >>>>>> sfc /scannow
> >>>>>>
> >>>>>>
> >>>>>> HTH,
> >>>>>> nass
> >>>>>> -------
> >>>>>> http://www.nasstec.co.uk
>
>
>

"LeeG" wrote:

> Hi Gerry
>
> I have the latest version of avast home.
>
> At the moment the problem only seems to happen when the drivers are being
> verified. I have already rolled back to the last good configuration but the
> only critical update I can think of is the program update for ad-ware. I
> have not recently had to update any drivers since there are no recent updates
> available.

Lee
Is this Windows Vista we are troubleshooting by any chance?
Did you have the latest drivers for the printer, latest updates for
Microsoft XPS Document Writer, Pen/Raster Plotter Driver User Interface
and what version of Acronis you have installed?

The list below tell what they are:
[c:\windows\system32\drivers]
tifsfilt.sys 18/04/2008 3.3.0.444 Not Signed
TrueImage File System Filter or Acronis True Image File System Filter


N/A
timntr.sys 18/04/2008 3.3.0.444 Not Signed
TrueImage Backup Archive Explorer

N/A
[c:\windows\system32\spool\drivers\w32x86\2]
plotter.dll 06/05/1997 0.2.0.0 Not Signed

Windows NT Raster/Pen Plotter Driver


N/A
plotui.dll 06/05/1997 0.2.0.0 Not Signed
Pen/Raster Plotter Driver User Interface

N/A
[c:\windows\system32\spool\drivers\w32x86\3]
mxdwdrv.dll 22/03/2007 0.3.6000.0 Not Signed
belonging to Microsoft® Windows® Operating System from Microsoft Corporation
Microsoft XPS Document Writer

N/A
mxdwdui.dll 22/03/2007 0.3.6000.16438 Not Signed
Microsoft XPS Document Writer

N/A
mxdwdui.gpd 31/08/2006 None Not Signed
A cumulative update for the XML Paper Specification (XPS) in Windows Vista
is available
http://support.microsoft.com/kb/942979

N/A
mxdwdui.ini 21/04/2006 None Not Signed
N/A
unires.dll 22/03/2007 0.3.6000.16438 Not Signed

is a Unidrv Printer Driver Resource DLL

HTH,
nass
---
http://www.nasstec.co.uk