[SOLVED] BSOD 0x50 drivers windows 7

[Angelika]

How to check if all drivers are digitally signed or not? (for all devices).
Note that all drivers are already installed and I want to detect if they are not digitally signed.

[Boggin]

sigverif is what you are looking for - http://www.thewindowsclub.com/identify-unsigned-drivers-sigverif-windows

[Angelika]

C:\Users\Public\Documents\SIGVERIF.TXT(7): Wyniki skanowania:  Plików w sumie: 317, Podpisane: 314, Niepodpisane: 3, Nie skanowane: 0
C:\Users\Public\Documents\SIGVERIF.TXT(63): ampa.sys AOMEI                10-11-15       Brak                Niepodpisane        Brak               
C:\Users\Public\Documents\SIGVERIF.TXT(103): eugdidrv.sys EASEUS             11-07-16       Brak                Niepodpisane        Brak               
C:\Users\Public\Documents\SIGVERIF.TXT(233): iccwdt.sys Intel(R) Watchdog Timer Driver (Intel(R) WDT) BSOD 0x50               08-05-17       11.0.0.1013         Niepodpisane        Brak

I deleted these files manually, but SFC /SCANNOW restores them each time.
How do definitively delete these system files?               

Example: How to complete remove:
Intel(R) Watchdog Timer Driver (Intel(R) WDT) BLUE SCREEN ON DEATH BSOD 0x0000050

[Boggin]

For those three -

ampa.sys belongs to AoMei Partition Assistant

eugdidrv.sys belongs to EASUS Partition Manager

iccwdt is an Intel driver for the Intel Watchdog Timer and should be digitally signed by Intel.

You could find that one in Device Manager/View/Show hidden devices/Non-Plug and Play Drivers and right click on it and select Update Driver Software to see if there is one.

As for the other two, if you are no longer using those programs then uninstall them or check for updated versions and reinstall.

[Angelika]

WDT It is not digitally signed even by Intel and causes problems. How do remove it completely?


FAKE signed
---------------------------
Driver update warning
---------------------------
It is not recommended to install this device driver because Windows can not determine if it is compatible with your hardware. If the driver is not compatible, the hardware may not work properly and the computer may be unstable or stop working completely. Do you want to continue installing this driver?
---------------------------
Yes No
---------------------------
---------------------------

[Boggin]

You could right click on it in Device Manager and select Uninstall then click on Action/Scan for hardware changes or just reboot, where it should reinstall perhaps with an older driver, but create a restore point first.

I have it on this Win 7 laptop upgraded to Win 10 and the driver is dated 29/09/2015 with the version 11.0.0.1007 and I've never had any BSODs because of that or anything else.

I see you've edited your last post - what did you do to get that error message ?

[Angelika]

Windows 7 detects at the beginning of the installation as digitally signed.
This driver is digitally signed.
It's not true!
But when I try to install it, a pop-up window appears with this information.
I have tested all drivers, but I will force to unninstall this, each driver causes BSOD in random events.
There are no appropriate drivers on the internet, even on the manufacturer's website.
I want to Win7x64, not Win10x64.

Download Intel WDT Driver 11.0.0.1007 for Windows 10 64 bit

Not compatible with Windows 7!

https://www.catalog.update.microsoft.com/Search.aspx?q=watchdog

[Boggin]

The Win 10 upgrade must have updated mine and I've just checked and it's Digitally Signed.

You may have to contact either your computer vendor if OEM build or Intel for legacy drivers.

It may not be that driver that is causing the BSODs but something else - what are you doing when you get the BSODs ?

Download BlueScreenView to see what it gives for your Memory Dump files.

http://www.nirsoft.net/utils/blue_screen_view.html

I'd suggest going into Device Manager or your computer support site to see if there are any updates for the Intel Chipset drivers - these may also update the WDT.

[Angelika]

For example, BSOD occurs randomly when I try to uninstall or install any program. It does not matter what program (each)
Not always only sometimes.
Blue  Screen View is a shit tool. Nothing shows.
Windbg is a better debugging tool.

PAGE_FAULT_IN_NONPAGED_AREA bug check has a value of 0x00000050

Code: [Select]

ADDITIONAL_DEBUG_TEXT: 
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: fffff8000325f000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  59b946d1

WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
 ffffffffffffffd0

FAULTING_IP:
nt+625b1
fffff800`032c15b1 f048830301      lock add qword ptr [rbx],1

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000334c70e to fffff800032cfe00

STACK_TEXT: 
fffff880`037fc488 fffff800`0334c70e : 00000000`00000050 ffffffff`ffffffd0 00000000`00000001 fffff880`037fc5f0 : nt+0x70e00
fffff880`037fc490 00000000`00000050 : ffffffff`ffffffd0 00000000`00000001 fffff880`037fc5f0 00000000`00000000 : nt+0xed70e
fffff880`037fc498 ffffffff`ffffffd0 : 00000000`00000001 fffff880`037fc5f0 00000000`00000000 00000000`00000020 : 0x50
fffff880`037fc4a0 00000000`00000001 : fffff880`037fc5f0 00000000`00000000 00000000`00000020 fffff8a0`00001670 : 0xffffffff`ffffffd0
fffff880`037fc4a8 fffff880`037fc5f0 : 00000000`00000000 00000000`00000020 fffff8a0`00001670 00000000`000007ff : 0x1
fffff880`037fc4b0 00000000`00000000 : 00000000`00000020 fffff8a0`00001670 00000000`000007ff fffffa80`09d36000 : 0xfffff880`037fc5f0


STACK_COMMAND:  .bugcheck ; kb

FOLLOWUP_IP:
nt+625b1
fffff800`032c15b1 f048830301      lock add qword ptr [rbx],1

SYMBOL_NAME:  nt+625b1

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntoskrnl.exe

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

[Boggin]

And you can analyse that can you ?

Is your computer set to create memory dump files ?

What have you done about looking for updates for your Chipset drivers ?

[Angelika]

Drivers do not matter, because for so many months everything was OK, nothing to install and nothing. Now I do not have a BLUE screen, so I do not know what causes Blue Screen 3 times.
I checked the Memory, everything OK, I checked all the best ways and there are no signs of system errors. So I have no idea what it is.
I only know that I had a similar error when installing the latest driver. The latest drivers are not always the best, for example, they do not work with Windows 7, only with Windows 10. But maybe this is not a bug Driver, because the reason for this error 0x50 are many.
I deleted the DUMP file. If I resume BSOD again, I will try to analyze again.
https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/analyzing-a-user-mode-dump-file-with-windbg

[Boggin]

Try this MS Troubleshooter to see if it will fix uninstall/install of programs. - https://support.microsoft.com/en-gb/help/17588/fix-problems-that-block-programs-from-being-installed-or-removed

It may resolve your BSODs.

[Angelika]

I do not think I have a problem installing the software because it works and works, but the extreme rare cases are BSOD. It installs without any problem, so here the problem is not there.
It seems that there is a similar option in WR v4. Repair MSI


No errors detected.
http://aka.ms/Program_Install_and_Uninstall

[Boggin]

Run just that repair then.

[Angelika]

Still BSOD, I still do not know what causes BSOD at an unexpected moment when I'm working on a computer.
DUMP does not show any information what may cause this error.

Code: [Select]

On Thu 28-12-17 16:35:24 GMT your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\122817-11091-01.dmp
This was probably caused by the following module: nt_wrong_symbols.sys (nt_wrong_symbols)
Bugcheck code: 0x50 (0xFFFFFFFFFFFFFFD0, 0x1, 0xFFFFF800032B65B1, 0x0)
Error: PAGE_FAULT_IN_NONPAGED_AREA
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: nt_wrong_symbols.sys .
Google query: nt_wrong_symbols.sys PAGE_FAULT_IN_NONPAGED_AREA

[Boggin]

Does Event Viewer or Reliability history have any details ?

Have you checked to see if your machine is set to create dumps ?

[Angelika]

I checked the debugging tool.
I have analyzed the problem more closely and this is caused by:


Unable to load image pffilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for pffilter.sys
*** ERROR: Module load completed but symbols could not be loaded for pffilter.sys

Could not read faulting driver name
Probably caused by : pffilter.sys ( pffilter+32df )


Found Google:
Pffilter.sys file information
The process known as Protected Folder filter driver belongs to software Protected Folder by IObit Information Technology.


BSOD caused by: X64_0x50_pffilter+32df

EDIT:
I uninstalled this program.
Now I am looking for another alternative program to secure the Folder with a password?