Cant fix a BSOD

[ehupp01]

I am getting a BSOD consistently and I cant solve it.

0x000000c2 (0x00000007, 0x00000cd4, 0x02360005, 0x881c1138)

Here is a copy of my minidump.
http://files.huppnet.org/Mini072708-01.dmp

 

[kimsland]

Inside the 1 Minidump: (that should have been attached here!!)

BugCheck C2, {7, cd4, 2360005, 881c1138}
Probably caused by : KMW_SYS.sys

KMW_SYS.sys - Kensington Mouse Works driver

I'd say un-install it (the mouse software)

Edit:
Also do not post all over the forum (just because you need help)
This post was reported, due to it's non supportive nothingness!
https://www.techspot.com/vb/post644659-3.html
Posting like this can get you banned.

 

[ehupp01]

WOW!! Thank you so much.

 

[kimsland]

That's ok Eric

I've also gone through the site http://files.huppnet.org/ fully
Nothing of interest in the files folders
And member bank of 7 is not over the top either

Sorry I have a very inquisitive mind, and must know everything I can about someone (or a minority group) at TechSpot, when things seem strange

 

[ehupp01]

It isn't the mouse driver anyway. It has to do something with KMW_KBD.sys. When I uninstall the mouseworks driver it uninstalls this as well and I lose my keyboard. I cant install a usb keyboard or a ps2 keyboard they just wont work in the OS. Digging in the registry if I add back to all the ControlSets:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\KMW_KBD]
"Type"=dword:00000001
"Start"=dword:00000003
"ErrorControl"=dword:00000000
"ImagePath"=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\
52,00,49,00,56,00,45,00,52,00,53,00,5c,00,4b,00,4d,00,57,00,5f,00,4b,00,42,\
00,44,00,2e,00,73,00,79,00,73,00,00,00
"DisplayName"="Kensington Input Devices Class filter driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\KMW_KBD\Enum]
"0"="HID\\Vid_06a3&Pid_8000&MI_00\\7&12479a9e&1&0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

My keyboard comes back. I am thinking my Hive is messed up. And by the way dont be so testy. Its all good.

 

[kimsland]

Looks to be part of:

Start-->Run-->Services.msc

to me

 

[ehupp01]

I have noticed my "server" service is completely gone? Could this be the cause? I had a root kit awhile back and manually removed it. It has been smooth sailing until SP3.

 

[kimsland]

Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Mine is disabled anyway (but it does show at least)

In your registry is it there? (and hidden?)

 

[ehupp01]

I don't see it at all in the registry. I stepped back to the oldest version of MW and the BSOD has not occurred again. However I had to once again manually add the reg entries for KMW_KBD.SYS. I know this file has the ability to log keys so I wonder if something "ie a kit" is using it?

 

[kimsland]

It's this one: lanmanserver

Here's my exported reg of it:

Oh ! it's too big to paste!
I'll attach it (Xp Pro SP3 by the way)

 

[ehupp01]

This is what I have.

 

[kimsland]

Ok text format then

Just save it to server.reg (actually just rename it to that (you have a backup now anyway!)

Import to registry

Then check srvices.msc again (without restart)

Restart to make sure all works still though

 

[ehupp01]

Now I see it but it wont start.

The Server service terminated with the following error:
The system cannot find the file specified.

 

[kimsland]

I had to read the txt again (the reg file rather)
There's no mention of any file to run, actually services don't use files, other than all the main ones "rundll and all the rest"

Just google that will you? ( "The system cannot find the file specified" server service xp )

So will I

 

[kimsland]

Oh first hit !

Insert the Windows XP disk into the CD drive.
Click Start, click Run, type cmd in the Open box, and then click OK
At the command prompt, type the following command, and then press ENTER.
expand CD drive:\i386\srvsvc.dl_ %systemroot%\system32\srvsvc.dll

Similarly, expand srv.sys file to the drivers folder. Use the following command:
expand CD drive:\i386\srv.sy_ %systemroot%\system32\drivers\srv.sys


From Here

 

[kimsland]

I found them in here too: C:\WINDOWS\ServicePackFiles\i386
Same size

 

[ehupp01]

Ok you are on to something here. srv.sys is immediately deleted after the expand or copy. srvsvc.dll will not allow itself to be overwritten either way. Could this be WFP working or something else?

This is what I have running.

 

[kimsland]

Server is Disabled (anyway mine is)

I wrote all about optimized services, somewhere in these threads (probably search will find it)

The deleting part cannot happen, from CD boot up (as outlined in that page)

 

[ehupp01]

I had it disabled in that screen shot. srv.sys is delete instantly.:dead: I give up!! I wont do a reinstall till I get a Bloomfield Nehalem main-board!!!! Maybe mid next year. For now I have good backups and working disk images. Thanks for your help, you have skills. Did you get my note from BestTechie?

GOT IT!! I enabled the firwall service and added file and print sharing service to the network. It did not delete the file and server is up and running. Now I am going to try and stop those two and see if it still works. Yipppeeee!! It does thanks again for walking me through that. I was about to pull my hair out. We will see if its a little more stable now.

 

[kimsland]

Did you get my note

Oh that was you!

You know I better check that,(haven't yet) got caught up here !!

 

[kimsland]

lol

just like me !

ok we're even !

And I replied!