Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have upgraded my PC and changed the motherboard, HDD, DVD, and the RAM (3 times) ... Now after installing the Windows 7 Ultimate, I get BSOD with different Errors each time ... Some times MEMORY_MANAGEMENT, other times BAD_SYSTEM_CONFIG_INFO I have analyzed the Dump file online at OSR Online and got this result:

Debugging Details:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

828888d0 8b448efc        mov     eax,dword ptr [esi+ecx*4-4]

EXCEPTION_RECORD:  89f1b54c -- (.exr 0xffffffff89f1b54c)
ExceptionAddress: 828888d0 (nt!memcpy+0x00000130)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000000
Attempt to read from address 00000000

CONTEXT:  89f1b130 -- (.cxr 0xffffffff89f1b130)
eax=00000004 ebx=aa47def8 ecx=00000001 edx=00000000 esi=00000000 edi=aa47def8
eip=828888d0 esp=89f1b614 ebp=89f1b61c iopl=0         nv up ei ng nz ac pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010297
828888d0 8b448efc        mov     eax,dword ptr [esi+ecx*4-4] ds:0023:00000000=????????
Resetting default scope




ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".



READ_ADDRESS: GetPointerFromAddress: unable to read from 829b2718
Unable to read MiSystemVaType memory at 82992160

9510e0bf ??              ???


LAST_CONTROL_TRANSFER:  from 828e3f97 to 828888d0

89f1b61c 828e3f97 aa47def8 00000000 00000004 nt!memcpy+0x130
89f1b63c 9510e0bf 89f1b670 856aac78 847ce000 nt!RtlCopyUnicodeString+0x32
WARNING: Stack unwind information not available. Following frames may be wrong.
89f1b680 9510e172 847ce000 856aac78 00000000 klmouflt+0x60bf
89f1b698 829ed728 856aac78 847ce000 c000035f klmouflt+0x6172
89f1b6c4 82a88a14 bd0d5952 89f1b7bc 89f1b840 nt!IopLoadDriver+0x7ed
89f1b784 82a88a14 00000018 00000000 89f1b7f8 nt!CmOpenKey+0x264
00000000 00000000 00000000 00000000 00000000 nt!CmOpenKey+0x264


SYMBOL_NAME:  klmouflt+60bf

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: klmouflt

IMAGE_NAME:  klmouflt.sys


STACK_COMMAND:  .cxr 0xffffffff89f1b130 ; kb

FAILURE_BUCKET_ID:  0x7E_klmouflt+60bf

BUCKET_ID:  0x7E_klmouflt+60bf

Followup: MachineOwner

I really need help. I have changed my RAM 3 times now and nothing happened. I`m starting to think that the motherboard is corrupted!!

Anyone got a clue why this is happening?

share|improve this question
+1 Didn't know about OSR online! :O – Tom Wijsman Jan 22 '11 at 1:08
Did you install all the drivers? Have you checked that any third-party software drivers are causing this? (eg. A bad behaving virus scanner could deny your memory from being read) – Tom Wijsman Jan 22 '11 at 1:10
I am sure that there is no problem with the software I installed, except the LAN, I have downloaded it and havent used the motherboard DVD as I dont have it now. When I bought it I had a problem with the RAM it was corrupted, and it has been replaced. The second one worked fine for a while and then started reading double capacity (a 2GB RAM was reading 4GB!), so it was replaced for the second time with a RAM of a different make, a samsung now. Is it possible that the motherboard is corrupted somehow? – sikas Jan 22 '11 at 1:21
PLUS, now I can`t access the Windows installed. I get BSOD before even the windows start! – sikas Jan 22 '11 at 1:22
Get rid of Kaspersky as soon as you possibly can. Then, if you have more than one RAM stick, remove all except one. Unplug your non-essential devices, including USB, DVD-ROM, modem, and NIC. Then see if Windows boots. Reconnect each of these devices one by one, with a reboot in between, and see what causes the failure. And yes, it is possible your motherboard is faulty. – user3463 Jan 22 '11 at 1:36

Given how much klmouflt.sys appears in your analysis, I would suspect it's Kaspersky, NOT a hardware issue. Drivers are more often the problem than hardware. I would suggest you look for an update to Kaspersky or uninstall it and see if the system becomes more stable.

share|improve this answer
I came here to say just this, your Kaspersky mouse filter is crashing your computer, uninstall Kaspersky, use the removal tool, and then reinstall. – OmnipotentEntity Jan 22 '11 at 8:00
Oh, I didn't see I could scroll down to go to the stack, well spotted. – Tom Wijsman Jan 22 '11 at 12:24

To add to Multiverse IT: your issue is a Kaspersky mouse filter driver, if you cannot boot your computer into Windows or Safe mode you will need to edit your registry. The best way to do this is through another computer. Remove your hard drive and attach it via USB enclosure to a different computer running Windows.

Open up regedit, highlight HKEY_LOCAL_MACHINE, and go to File -> Load Hive...

Find the registry file named SYSTEM on your computer's hard drive. It is normally located Windows\system32\config (on F: or wherever it got mounted.)

Next, type in the name you want to attach the hive as, I suggest RemoteOS-HKLM-System

Next, navigate to the following registry key: HKEY_LOCAL_MACHINE\RemoteOS-HKLM-System\Select and look for the value named Current

Make a note of this value (it is usually 1) and then go to HKEY_LOCAL_MACHINE\RemoteOS-HKLM-System\ControlSet00X where X is the value you just made a note of, HKEY_LOCAL_MACHINE\RemoteOS-HKLM-System\ControlSet00X\Control\Class\{4D36E96F-E325-11CE-BFC1-08002BE10318}

The last part of key name is a CLSID the part that's different from its surroundings is the end of the first 8 characters 6F, you'll know you're in the right place if the (Default) value is Mice and other pointing devices.

Next, check for values named UpperFilters and LowerFilters for klmouflt you should see it in the UpperFilter value along with mouclass. Delete klmouflt but leave mouclass.

Next, highlight the key HKEY_LOCAL_MACHINE\RemoteOS-HKLM-System and go to File -> Unload Hive.

Safely Eject your computer's hard drive from your friend's computer, reinstall the hard drive and then try to boot to Windows. You ought to be able to at this point.

Next, remove Kaspersky via the Windows Add/Remove Programs utility appwiz.cpl.

Next, remove Kaspersky using the Kaspersky Removal tool.

Finally, reinstall Kaspersky or another antivirus.

share|improve this answer

Are you able to run it in Safe Mode or apply a system restore? If you can, try the latter and see if you're able to boot up with out getting a BSOD.

share|improve this answer
nope, safe mode doesn`t start, and the system restore just crash! – sikas Jan 22 '11 at 10:38
up vote 0 down vote accepted

It was either a corrupted RAM or incompatible with the Motherboard. I bought another RAM, Kingston this time, and it worked well with me. Thanks all for the support.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .