This one has me stumped, and I am not getting much (any?) help at Online Armor Forums, as my firewall is the free version.

Since last August I have had six BSOD events, with the Minidumps pointing at Online Armor drivers.
This year at the rate of one a week.
All 4 recent BSOD's have been during boot,
with reboot taking place successfully, and without being asked if I wanted to boot to safe mode.

I have had no other BSOD Events.
All BSOD events are tabulated below per - Date: Error Code (param1, 2, 3, 4) - Driver Implicated
If desired, I can attach the dumps in a zip, or post the text generated by WinDbg.

(going by time stamps) There are no relevant Events listed in Event Viewer.
(Possibly/probably because the BSOD takes place early in the boot process?)

Per the suggestion of Catprincess at OA, I did upgrade to version 4, and still had a BSOD.
Then, per the suggestion of Catprincess, I went offline, uninstalled OA, and did a clean install of Version 4.
Since then I have had two more bsods.
I have already run Memtest, and it ran 11 full passes with no errors.

System: Gateway 4525GZ, with upgraded memory and drive.
Drive #1 - (internal 0 ide) WDC WD1600BEVE-00UYT0 (127 GB)
Drive #2 - (external USB-ide) Toshiba HDDR 160E01X
Memory: Total 2014 MB
(memory and hard-drive upgrades were last summer)

OS: XP Home SP3

Other security software currently installed: Avira, Spybot S&D, MBAM

Avira is fully up to date and scans are clean.

Related Thread at OA - /vbforum/showthread.php?t=11588

============
Tabulated BSOD Data... Date is MMDDYY
================================================== ====
Date: Error Code, {param 1, param 2, param 3, param 4} Driver Implicated
================================================== ====
080709: 1000000A, { 4, 2, 0, 804e39a7} OADriver.sys
092409: 1000008E, {c0000005, 8056987b, b1440a78, 0} OADriver.sys
010710: 1000008E, {c0000005, 80569a0b, b1554a78, 0} OADriver.sys
011310: 1000008E, {c0000005, 80569913, b15aaa74, 0} OADriver.sys
012010: 1000008E, {c0000005, 80569913, b1376a74, 0} OADriver.sys
020110: 1000008E, {c0000005, 80569913, b17f8a74, 0} OADriver.sys

Any help would be appreciated.
Thanks in advance.

First thing I would do - windows key and R - type verifier - hit enter

The Driver Status property page gives you an image of the current status of Driver Verifier. You can see what drivers the verifier detects. The status can be one of the following:

* Loaded: The driver is currently loaded and verified.
* Unloaded: The driver is not currently loaded but it was loaded at least once since you restarted the computer.
* Never Loaded: The driver was never loaded. This status can indicate that the driver's image file is corrupted or that you specified a driver name that is missing from the system.

More Options with verifier:
http://support.microsoft.com/kb/244617

========================================

Also attach the zipped dumps - I am curious to have a look through.

__________________
__________________
Check us out on Facebook!

Useful Guides: Networking 101 Security 101 Disable Real Time Monitoring Virus/Malware Preliminary Removal Instructions

Hello Blind Dragon.

Thank you very much for looking at this for me!

Driver Verifier Manager
-> Select a Task
-> -> Create Standard Settings
-> -> Next

-> Select what drivers to verify
-> -> Automatically select all drivers installed on this computer
-> -> Finish

-> Reboot

Performance has taken a real hit with the Verifier running, but no BSOD on reboot this time.
If history is any indication, it could take up to a couple of weeks for the next one to hit.
(#2@6 days, #3@7 days, #4@12 days, ... Next @ ? )

Drivers Status...
Never Loaded - None
Unloaded - Thirteen Drivers

I cannot determine a way to print / save a file of these drivers so that all may be investigated.
I have been working on that process with OTL, (it is taking some time to be thorough) but no badies found so far.

Do you think I should modify Verifier's settings to "stress test" the OA drivers?
(I ask, since those are indicated in the dumps)
If so, could you / would you please step me through it?
(I am not very familiar with this tool but I am "a quick study"... or so I thought until GeekU).

Minidump Zip attached. (In order to stay under the size limit, I included only the last four - {which are the most similar} - even to parameter 3.)

Again; Many Thanks!

Attached Files

B00kWyrm-minidump.zip (84.5 KB, 2 views)

1) What is the size of your pagefile?
By default, the virtual memory paging file that is created during installation is 1.5 times the physical RAM on your computer. Therefore, a computer that had 1GB of installed RAM will have 1.5GB of virtual memory.

You said that you increased the amount of RAM that your computer has. Did you also increase the size of your pagefile accordingly. ie. 2GB RAM = 3GB paging file.

To manually change the size of virtual memory, follow these steps:

1. Click Start, click Run, type sysdm.cpl in the Open box, and then press ENTER.
2. Click the Advanced tab, and then under Performance click Settings.
3. Click the Advanced tab, and then under Virtual memory click Change.
4. Under Drive [Volume Label], click the drive that contains the paging file that you want to change.
5. Under Paging file size for selected drive, click Custom size, type a new paging file size in megabytes (MB) in the Initial size (MB) and Maximum size (MB) box, and then click Set.
6. Click OK to close the dialog box and apply changes.

=======================================

Before we do that, check your pagefile as posted above.

Also was the Online Armor driver one of the Unloaded Drivers found with verifier?

__________________
__________________
Check us out on Facebook!

Useful Guides: Networking 101 Security 101 Disable Real Time Monitoring Virus/Malware Preliminary Removal Instructions

I had previously set my Pagefile to 2g min / 4g max.
Per your instructions, I have now set it as 3g min / 4g max.

OA was not in the Unloaded list...

Diver Verifier List (Partial)

All Unloaded List:

• aec.sys
• cdaudio.sys
• dmusic.sys
• drmkaud.sys - see below
• fdc.sys
• flpydisk.sys
• kmixer.sys
• parport.sys
• sfloppy.sys
• splittter.sys
• swmidi.sys
• vga.dll

Loaded include:

• OADriver.sys
• OAmon.sys
• OAnet.sys

Re: drmkaud.sys - The filename is difficult to read on this file, due to the font, but I am pretty sure I have it correct, as I also have this line in my OTL.

DRV - [2008/04/13 13:45:13 | 00,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\drmkaud.sys -- (drmkaud)

Thank You again!

Well everything is referencing the online armor drivers, my thinking with the pagefile is that it looks like it may have tried to pull resources that weren't there. When the BSOD happened were you doing anything else on the computer that could have been resource intensive?

Of course they should hopefully provide you with more details seeing that you submitted your dumps to them .

It makes it even harder that it doesn't happen on a regular basis.

__________________
__________________
Check us out on Facebook!

Useful Guides: Networking 101 Security 101 Disable Real Time Monitoring Virus/Malware Preliminary Removal Instructions

Re OA... That is what I was reading too.
Re doing anything else... No! Is booting "resource intensive"?
Every one happened during the boot process.
(Fairly early at that - I don't think I even got to the user logon screen)
So I would have doubted pagefile should have had anything to do with it.

They have received two now, but I am not holding my breath!
Catprincess replied quickly the first time,
but now it looks like I am being ignored.

Exactly!
When the next one happens, (not if! - call me a pessimist if you want), I am ready to change firewall again.
Either go back to Comodo, or perhaps try Kerio.

Firewalls can be a pain. One time I had Comodo which corrupted my windows repository - after rebuilding wmi it still didn't work. The problem was windows reported I had multiple firewalls installed - both being Comodo. Their support was not able to fix it either and I ended up having to do a repair install. Even with Comodo uninstalled - all the registry keys I could find manually deleted and the repository rebuilt I had this:



I also had problems with Online Armor at one time and had issues upon uninstalling it.

=============================

Anyways being that early in the boot process my next suspect would either be:
1) A BIOS setting (ie. Disable BIOS memory options such as caching or shadowing)
2) BIOS needing an update - check with Gateway

__________________
__________________
Check us out on Facebook!

Useful Guides: Networking 101 Security 101 Disable Real Time Monitoring Virus/Malware Preliminary Removal Instructions

Thanks Blind Dragon.
I appreciate your time and suggestions on this.

Re: BIOS Settings... none have been changed (at least since last summer, maybe ever)

Re: BIOS Update ... with this computer now being 5+ years old, I doubt Gateway has much support for it. (if any)

But, I will check both.
Thank you for the suggestions.
Again, I appreciate your time and value your input!

Hi Blind Dragon
As far as Gateway is concerned, my computer is an orphan... support on it has been sold to a third party.
I have not been able to find bios updates.

From a different angle, I have decided to uninstall Spybot / Teatimer for now, and see if that makes a difference.
Again... thanks for the attention and suggestions you gave to my question.