bsod on starting utorrent

[titan77]

i get problem whenever i start utorrent.i remains fine for 5 to 10 minutes,then suddenly the blue screen of death arrives and i have to restart it. it happened again and again. Then i made a solution. I stopped my bitdefender firewall and started windows firewall instead. To my surprise it promptly cured the problem.

[GTHK]

Sooooooo... you're good? Or if you want confirmation of what caused the BSOD, zip one of your minidumps from C:\WINDOWS\Minidump and upload it to mediafire.

[titan77]

do i always need to stop bitdefender firewall? but it helps me in portscan block

[GTHK]

Could be BitDefender is screwed up, could be your networking drivers. Try updating BitDefender and your network card.

[ranito]

Same problem here. After updating to 1.8.3 (and then 1.8.4. and 2 beta), I am getting BSOD when download starts (should start). Machine specs:

Core Duo 1.5 Ghz, 2GB RAM, Vista SP1 32bit

I've already read similar posts, some related to the very same problem in Vista, some in Windows 7. I have the newest network card drivers available, firewall turned off, and I've come thru virus/malware scan. Don't tell me it's drivers, they worked with uTorrent just fine for more than one year... It started right after updating to newer version, can't be a coincidence Oh and moving back (well, re-installing with older client) doesn't help, so maybe the problem is in some new version of a .dll coming with uTorrent, which can't be overwritten by older version...

[DreadWingKnight]

so maybe the problem is in some new version of a .dll coming with uTorrent, which can't be overwritten by older version...

if uTorrent actually came with dlls, that would be a probable cause.

http://forum.utorrent.com/viewtopic.php?id=29748

[ranito]

Ok, here it goes - Scanned WITHOUT uTorrent running.

HIJACKTHIS LOG:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:52:51, on 22.8.2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18226)

Boot mode: Normal

Running processes:

D:\Windows\system32\taskeng.exe

D:\Windows\system32\Dwm.exe

D:\Windows\Explorer.EXE

D:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

D:\Windows\ehome\ehtray.exe

D:\Windows\ehome\ehmsas.exe

D:\Program Files\Windows Media Player\wmpnscfg.exe

D:\Windows\system32\wbem\unsecapp.exe

D:\Windows\system32\rdpclip.exe

E:\SkypePortable4\Phone\Skype.exe

D:\Program Files\Internet Explorer\iexplore.exe

F:\Program Files\Trend Micro\HijackThis\HijackThis.exe

D:\Windows\system32\conime.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O4 - HKLM\..\Run: [RtHDVCpl] D:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKCU\..\Run: [ehTray.exe] D:\Windows\ehome\ehTray.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O13 - Gopher Prefix:

O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab

O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - D:\Windows\SYSTEM32\crypserv.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - D:\Windows\system32\nvvsvc.exe

--

End of file - 2726 bytes

PROCESS EXPLORER LOG

Process PID CPU Description Company Name

System Idle Process 0 100.00

Interrupts n/a Hardware Interrupts

DPCs n/a Deferred Procedure Calls

System 4

smss.exe 564 Windows Session Manager Microsoft Corporation

csrss.exe 636 Client Server Runtime Process Microsoft Corporation

wininit.exe 688 Windows Start-Up Application Microsoft Corporation

services.exe 732 Services and Controller app Microsoft Corporation

svchost.exe 892 Host Process for Windows Services Microsoft Corporation

ehmsas.exe 2852 Media Center Media Status Aggregator Service Microsoft Corporation

unsecapp.exe 3368 Sink to receive asynchronous callbacks for WMI client application Microsoft Corporation

WmiPrvSE.exe 3460 WMI Provider Host Microsoft Corporation

nvvsvc.exe 936 NVIDIA Driver Helper Service, Version 179.67 NVIDIA Corporation

rundll32.exe 1836 Windows host process (Rundll32) Microsoft Corporation

rundll32.exe 2972 Windows host process (Rundll32) Microsoft Corporation

svchost.exe 964 Host Process for Windows Services Microsoft Corporation

svchost.exe 1004 Host Process for Windows Services Microsoft Corporation

svchost.exe 1052 Host Process for Windows Services Microsoft Corporation

audiodg.exe 1176 Windows Audio Device Graph Isolation Microsoft Corporation

svchost.exe 1084 Host Process for Windows Services Microsoft Corporation

dwm.exe 2256 Desktop Window Manager Microsoft Corporation

svchost.exe 1104 Host Process for Windows Services Microsoft Corporation

taskeng.exe 2220 Task Scheduler Engine Microsoft Corporation

taskeng.exe 2572 Task Scheduler Engine Microsoft Corporation

svchost.exe 1200 Host Process for Windows Services Microsoft Corporation

SLsvc.exe 1240 Microsoft Software Licensing Service Microsoft Corporation

svchost.exe 1296 Host Process for Windows Services Microsoft Corporation

svchost.exe 1472 Host Process for Windows Services Microsoft Corporation

rdpclip.exe 2144 RDP Clip Monitor Microsoft Corporation

svchost.exe 1652 Host Process for Windows Services Microsoft Corporation

svchost.exe 276 Host Process for Windows Services Microsoft Corporation

Crypserv.exe 332 CrypKey NT Service CrypKey (Canada) Ltd.

svchost.exe 556 Host Process for Windows Services Microsoft Corporation

svchost.exe 1164 Host Process for Windows Services Microsoft Corporation

svchost.exe 1852 Host Process for Windows Services Microsoft Corporation

SearchIndexer.exe 2092 Microsoft Windows Search Indexer Microsoft Corporation

wmpnetwk.exe 3232 Windows Media Player Network Sharing Service Microsoft Corporation

lsass.exe 744 Local Security Authority Process Microsoft Corporation

lsm.exe 756 Local Session Manager Service Microsoft Corporation

csrss.exe 700 Client Server Runtime Process Microsoft Corporation

winlogon.exe 1412 Windows Logon Application Microsoft Corporation

explorer.exe 2380 Windows Explorer Microsoft Corporation

RtHDVCpl.exe 2728 HD Audio Control Panel Realtek Semiconductor

ehtray.exe 2756 Media Center Tray Applet Microsoft Corporation

wmpnscfg.exe 3172 Windows Media Player Network Sharing Service Configuration Application Microsoft Corporation

procexp.exe 3144 Sysinternals Process Explorer Sysinternals - www.sysinternals.com

zwangi.exe 3348

csrss.exe 3160 Client Server Runtime Process Microsoft Corporation

winlogon.exe 3328 Windows Logon Application Microsoft Corporation

LogonUI.exe 2132 Windows Logon User Interface Host Microsoft Corporation

Skype.exe 4020 Skype Skype Technologies S.A.

iexplore.exe 5936 Internet Explorer Microsoft Corporation

HijackThis.exe 4392 HijackThis Trend Micro Inc.

notepad.exe 5708 Notepad Microsoft Corporation

conime.exe 5264 Console IME Microsoft Corporation

I don't have crashdump, maybe it doesn't have enough time when it crashes right to BSOD...

The malware check I ran didn't find anything, but I don't like the "zwangi.exe" much. I am not sure if it crashes uTorrent, though, the crashes really started right after updating to 1.8.3. I will try to remove the suspicious file and report back.

[DreadWingKnight]

http://www.prevx.com/filenames/2346422944934837948-X1/ZWANGI.EXE.html

[ranito]

System cleaned, didn't help. I thought I have most recent drivers since there were no newer ones on NIC's manufacturer's website, but then I found newer ones on my laptop's manufacturer's site. It works fine now. I am just wondering how can newer version of uTorrent make drivers so outdated that it crashes, it worked fine before

[ssh]

The problem could be with BitDefender Firewall ( unless you're using BitDefender 2010, which my source, the link below, says has fixed. I haven't checked out 2010 as yet, so can't comment )

http://forum.bitdefender.com/index.php?showtopic=15359

As discussed in the above link, the problem is caused by bdfndisf.sys

How did I find that out? Simple tool named BlueScreenView

http://www.nirsoft.net/utils/blue_screen_view.html

So,

Temporary Solution - Disable BitDefender Firewall and use Windows Firewall

Permanent Solution (maybe) to use BitDefender 2010

Hope that works friends