Sign in to follow this  
balloonshark

Windows 8 64 bit BSOD that may be related to OAmon

Recommended Posts

I built this computer less that a month ago. I've been getting warnings in the event viewer daily with the occassional BSOD when I start Firefox after booting. In event viewer I get a warning, error and another warning. The first warning is at 12:22:08 with the error and 2nd warning at 12:22:10 AM.

 

1. Intel® I211 Gigabit Network Connection
 Network link is disconnected.

 

2. The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000050 (0xfffff8a0095f2000, 0x0000000000000000, 0xfffff801b8ed12a0, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081113-13187-01.

 

3. The description for Event ID 16001 from source AFD cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

\Device\Afd
\Driver\OAmon

_______________________________________________________________________________________________________

Please note that I get two warnings everytime I start the computer but I don't always get the BSOD. I get one warning for each of my ethernet connections. I'm only using 1217-V and even despite these warnings my connection has been working fine.

 

A week ago I unistalled OA, rebooted twice and then reinstalled in my admin account in an attempt to fix the issue. I'm assuming OA isn't causing the warnings but I need to know if the BSOD is related to OA. Hopefully attaching the memory dump worked. If not I need instructions.

 

 

 

 

 

 

 

 

Share this post


Link to post
Share on other sites

Did you zip the memory dump first Balloonshark and try to attach it by using the 'more reply options' button ?

Share this post


Link to post
Share on other sites

It goes through the motions of uploading and then nothing. The file size is 115MB which should be under your limit. I may need to try it without Sandboxie. I don't allow dllhost in Sandboxie and that could be the issue.

 

It also looks like I should configure a full dump for when it happens again.

 

 

Share this post


Link to post
Share on other sites

Don't know why it won't work. I'm currently non-sandboxed with firefox run as admin and both basic and advanced uploading doesn't work. I can see something uploading so I don't know what is going on. The advanced uploaded about 4MB and says "Upload Skipped (Error IO).

 

Edit: Tried zipping with 7zip and while the file is smaller it didn't help. Can I not upload because I'm new here? I used to do a little beta testing for tall emu with the same user name but for some reason my old password wouldn't work so I had to create this account.

Share this post


Link to post
Share on other sites

Just had a try uploading a zip file using basic uploader in Sandboxed Opera. No problem.

 

Try plan B :)

 

Have you tried disabling anything security related to eliminate different things? Run FF in FF safe mode?

Share this post


Link to post
Share on other sites

Thanks for the trying an upload Stapp :). I did try FF in safe mode outside the sandbox and it didn't work. I tried IE and it didn't work. I even tried PaleMoon. Perhaps it is a permission thing? As you can see I can upload a small text file.

 

What is a safe service that will allow me to upload a large file temporarily? I'm also leary about uploading a dump file to the cloud somewhere. Should I encrypt it with 7zip and PM someone the password?

 

I also have a 2nd dump but the non-zipped file was about the same size ~400MB. Does that sound right for a full dump? I have 8GB of memory with the same size page file.

Share this post


Link to post
Share on other sites

I'm fairly certain that 115MB is too large for the forums.

That being said, have you configured Windows for Full Memory Dumps on BSoD errors, or is it still configured for Kernel Memory Dumps?

Share this post


Link to post
Share on other sites

Where the Attach This File button is it says "You can upload up to 250MB of files (Max. single file size: 128MB)". Perhaps the forum is configured in another way.

 

Is this all I need for a full memory dump?

Complete_Dump.jpg

Also, if I have to upload somewhere else what is the safest procedure? At the time of the crash I was probably opening firefox as well as keepass. Not sure if I was typing my master password at the time of the crash. Probably not but I don't want to take any chances.

Share this post


Link to post
Share on other sites

Ok, I just got another BSOD and this one was a full dump. It was 7.93GB and I have a ultra compressed 7z file ready to send. Its file size is 370MB. I just need somewhere to upload the file.

 

What happened. I booted into windows and then got the bar across the screen telling me Windows had updates and I clicked cancel. I then went to my desktop and then double-clicked the palemoon icon (which if a forced sandbox program) and got the BSOD right after clicking the icon.

Share this post


Link to post
Share on other sites

Our developers let me know that the BSoD was caused by Sandboxie.

Thanks GT500. I'll pass the information on to Tzuk.

 

Was it by chance a conflict between OA and Sbie? I've seen plenty of conflicts between the two in the past but never a BSOD.

Share this post


Link to post
Share on other sites

This newest crash seems to point to oanet.sys according to the whocrashed log below. If you want the full dump file let me know. I'll keep it on my hdd for a little while longer.

 

I'm also not sure what triggered the crash. All I know is I started my computer, the screen was black and it was using the sdd before I got to my motherboard logo. I guess it was writing the dump file from the last session.

________________________________________________________________________________________________________________

 

 

Welcome to WhoCrashed (HOME EDITION) v 4.02


This program checks for drivers which have been crashing your computer. If your computer has displayed a blue screen of death, suddenly rebooted or shut down then this program will help you find the root cause and possibly a solution.

Whenever a computer suddenly reboots without displaying any notice or blue screen of death, the first thing that is often thought about is a hardware failure. In reality, on Windows most crashes are caused by malfunctioning device drivers and kernel modules. In case of a kernel error, many computers do not show a blue screen unless they are configured for this. Instead these systems suddenly reboot without any notice.

This program will analyze your crash dumps with the single click of a button. It will tell you what drivers are likely to be responsible for crashing your computer. It will report a conclusion which offers suggestions on how to proceed in any situation while the analysis report will display internet links which will help you further troubleshoot any detected problems.

To obtain technical support visit www.resplendence.com/support

Click here to check if you have the latest version or if an update is available.

Just click the Analyze button for a comprehensible report ...




Home Edition Notice


This version of WhoCrashed is free for use at home only. If you would like to use this software at work or in a commercial environment you should get the professional edition of WhoCrashed which also allows analysis of crashdumps on remote drives and computers on the network and offers a range of additional features.

Click here for more information on the professional edition.
Click here to buy the the professional edition of WhoCrashed.



System Information (local)


computer name: WOPRII
windows version: Windows 8 , 6.2, build: 9200
windows dir: C:\Windows
CPU: GenuineIntel Intel® Core i5-4670K CPU @ 3.40GHz Intel586, level: 6
4 logical processors, active mask: 15
RAM: 8516931584 total
VM: 2147352576, free: 1923772416





Crash Dump Analysis


Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.

On Mon 8/19/2013 4:17:22 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\081913-13078-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x5A440)
Bugcheck code: 0x139 (0x3, 0xFFFFF88003C061E0, 0xFFFFF88003C06138, 0x0)
Error: KERNEL_SECURITY_CHECK_FAILURE
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: The kernel has detected the corruption of a critical data structure.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Mon 8/19/2013 4:17:22 AM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: oanet.sys (oanet+0x2463)
Bugcheck code: 0x139 (0x3, 0xFFFFF88003C061E0, 0xFFFFF88003C06138, 0x0)
Error: KERNEL_SECURITY_CHECK_FAILURE
file path: C:\Windows\system32\drivers\oanet.sys
product: OA Helper Driver
company: Emsisoft
description: OA Helper Driver
Bug check description: The kernel has detected the corruption of a critical data structure.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: oanet.sys (OA Helper Driver, Emsisoft).
Google query: Emsisoft KERNEL_SECURITY_CHECK_FAILURE



On Wed 8/14/2013 12:24:05 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\081413-13109-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x5A440)
Bugcheck code: 0x50 (0xFFFFF8A010DD4000, 0x0, 0xFFFFF8008A2D92A0, 0x0)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 8/14/2013 10:11:58 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\081413-13203-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x5A440)
Bugcheck code: 0x50 (0xFFFFF8A00845000C, 0x0, 0xFFFFF8014C2CC49A, 0x0)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 8/11/2013 8:40:15 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\081113-13328-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x5A440)
Bugcheck code: 0x50 (0xFFFFF8A009E4200C, 0x0, 0xFFFFF802804DA49A, 0x0)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 8/11/2013 4:21:36 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\081113-13187-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x5A440)
Bugcheck code: 0x50 (0xFFFFF8A0095F2000, 0x0, 0xFFFFF801B8ED12A0, 0x0)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Mon 8/5/2013 10:15:42 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080513-13234-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x5A440)
Bugcheck code: 0x139 (0x3, 0xFFFFF8800A1951E0, 0xFFFFF8800A195138, 0x0)
Error: KERNEL_SECURITY_CHECK_FAILURE
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: The kernel has detected the corruption of a critical data structure.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Mon 8/5/2013 4:10:57 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080513-14031-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x5A440)
Bugcheck code: 0x50 (0xFFFFF8A0089F4000, 0x0, 0xFFFFF8020FA562A0, 0x0)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 8/4/2013 2:23:30 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080413-14296-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x5A440)
Bugcheck code: 0x50 (0xFFFFF8A010260000, 0x0, 0xFFFFF802D5AC42A0, 0x0)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sat 8/3/2013 10:26:16 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080313-13234-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x5A440)
Bugcheck code: 0x50 (0xFFFFF8A009E58000, 0x0, 0xFFFFF8039026B2A0, 0x0)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 7/30/2013 3:08:30 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\072913-13390-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x5A440)
Bugcheck code: 0x139 (0x3, 0xFFFFF88003D6C1E0, 0xFFFFF88003D6C138, 0x0)
Error: KERNEL_SECURITY_CHECK_FAILURE
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: The kernel has detected the corruption of a critical data structure.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Mon 7/29/2013 1:21:36 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\072813-13406-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x5A440)
Bugcheck code: 0x50 (0xFFFFF8A008C45000, 0x0, 0xFFFFF800958692A0, 0x0)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sat 7/27/2013 9:46:49 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\072713-14203-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x5A440)
Bugcheck code: 0x50 (0xFFFFF8A008E6600C, 0x0, 0xFFFFF800948C149A, 0x0)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.





Conclusion

13 crash dumps have been found and analyzed. A third party driver has been identified to be causing system crashes on your computer. It is strongly suggested that you check for updates for these drivers on their company websites. Click on the links below to search with Google for updates for these drivers:

oanet.sys (OA Helper Driver, Emsisoft)

If no updates for these drivers are available, try searching with Google on the names of these drivers in combination the errors that have been reported for these drivers and include the brand and model name of your computer as well in the query. This often yields interesting results from discussions from users who have been experiencing similar problems.


Read the topic general suggestions for troubleshooting system crashes for more information.

Note that it's not always possible to state with certainty whether a reported driver is actually responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further.




 

Share this post


Link to post
Share on other sites

A minidump won't tell you what was responsible for the crash. Sometimes a kernel memory dump will contain the information, however you usually need to inspect a full memory dump in order to discover the cause.

As for the disk usage, the way Windows handles memory dumps on a BSoD is to write them to the pagefile (which is why the pagefile needs to be so large), and then on the next startup it copies the memory dump out of the pagefile and into the location specified in the settings. My understanding is that this happens fairly late in the startup process.

Share this post


Link to post
Share on other sites

Thanks GT500. I uninstalled OA last night, did two reboots and used the computer normally afterwards. Today I got another BSOD when starting my browser sandboxed like the majority of my BSODs. Unless there are bits of OA leftover after uninstalling I think I have eliminated OA as the cause.

Share this post


Link to post
Share on other sites

If you still have the full memory dump (C:\memory.dmp or whatever you had set it to) from the crash, then you may want to send it to Sandboxie's support so that their developers can take a look at it.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.