[MagicAndre1981]

Sorry I don't know if ZA uses the Kaspersky engine.

[jclarkw]

MagicAndre1981, on 02 December 2011 - 07:11 PM, said:

ok, also remove / update Kaspersky:
...
Your version is very old:
Image name: klif.sys
Timestamp: Tue Sep 22 12:32:04 2009

Dear MagicAndre1981 -- Thanks. You were dead right about klif.sys -- only your second try (details below just in case anyone else is intersted)!

Question: How can I figure this out for myself next time I'm hit with the BSOD (pretty rare in XP SP3)? I'm not an IT -- these modern systems are way over my head -- but I do have a lot of experience with Window plus considerably direct programming in Forth, C, Basic, Fortran, etc. Is there a tool that I can safely use to solve these problems for myself? (I was trying to get "Dumpchk.exe" from Debugging Tools in Windows SDK for x86, but it seems not to be there and anyhow is apparently not much good. Somebody else suggested http://www.nirsoft.n...creen_view.html, but ZoneAlarm Extreme Security advises me that the site is "known to distribute spyware." )

Details: After uninstalling ShadowProtect 3.5 (GREAT software, but I need to update it anyhow) to get rid of stcvsm.sys (without solving the problem), I also clean-uninstalled Zone Alarm Extreme Security 9.3.037 to get rid of klif.sys. Then I uninstalled and re-installed WAIK, just in case that installation had been interrered with by ZAES. On re-installing WAIK, I found that the WinPE 2.0 build went smoothly -- no BSOD. To confirm I re-installed ZAES 9.3.037 (bringing back the old version of klif.sys, and another WinPE build immediately brought on the same BSOD. (I didn't try the newest version of ZAES, which I am told has a new version of the Kaspersky AV engine, but that's another story and is OK because I now have the PE boot CD that I wanted and no longer need WAIK.) Thanks again! -- jclarkw

[MagicAndre1981]

ok, enjoy your WinPE now and remember this for the feature if you need to build a new Image with the WAIK

[jclarkw]

I found two ways to do myself at least part of what you did for me. Perhaps they will help some other readers:

BlueScreenView works like a champ and has the added benefit of no "install." It found both of my suspect drivers right away (after the fact, or course, since you had already pointed them out). Next time I think I can do it on my own with this tiny tool.

Next I tried the free-for-home-use version of WhoCrashed from Resplendence (referenced in one of the BlueScreenView reviews that I read), which requires the Windows Debugging Tools ("http://msdl.microsoft.com/download/symbols/debuggers/dbg_x86_6.11.1.404.msi" for my version of Windows), but which gives even more specific results. Having also installed those tools, I now see Dumpchk.exe in the Debugging Tools root directory. Dumpchk output even shows up now in BlueScreenView.

I even figured out how to incorporate Win XP SP3 symbols, although not those for the 3rd-party drivers, into the Debugging Tools (and into Dumpchk) by downloading them from "http://msdl.microsoft.com/download/symbols/packages/windowsxp/WindowsXP-KB936929-SP3-x86-symbols-full-ENU.exe." (WhoCrashed won't incorporate symbol stores unless you pay for the "Professional" version.)

Both free progarms seem to be winners, although WhoCrashed takes a lot more overhead.

Best Regards. - jclarkw

This post has been edited by jclarkw: 06 December 2011 - 09:20 PM

[MagicAndre1981]

I use WinDbg from the Windows Debugging Tools to get the cause.

[jclarkw]

MagicAndre1981, on 06 December 2011 - 06:00 AM, said:

I use WinDbg from the Windows Debugging Tools to get the cause.

Thanks again, MagicAndre1981. I'd like to give you credit for solving my problem, but I don't immediately see how... -- jclarkw

[MagicAndre1981]

I'm happy that you fixed the issue this is enough. Enjoy using the WAIK and discuss with other users here on msfn maybe you can help others