BSOD ntoskrnl

ruchijain · 10 Aug 2010

Hi Team ,

Please help me , please please please .. I am frequently getting BSOD and craches. I am generally good at debugging problems related to my system, but I am weighed down and at my wits end.

Performed the following steps.
1. Did a full system recovery .
2. did a full HD test .
3. did a full memory test .

DRIVER_IRQL_NOT_LESS_OR_EQUAL 0x000000d1 ffffea80`04e11120 Wdf01000.sys+4ab77
DRIVER_IRQL_NOT_LESS_OR_EQUAL 0x000000d1 ffffe880`00fb1f30 ATSwpWDF.sys+2ddaa
IRQL_NOT_LESS_OR_EQUAL 0x0000000a 00000000`00000028 ntoskrnl.exe+71f00
MEMORY_MANAGEMENT 0x0000001a 00000000`00005003 ntoskrnl.exe+71f00

C:\Users\Administrator>sfc /scannow
Beginning system scan. This process will take some time.
Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection did not find any integrity violations.

I have attached the minidump files.

CarlTR6 · 10 Aug 2010

I will take a look and be right back.

ruchijain · 10 Aug 2010

I just updated the windows update and now I am not able to restart the system . everytime I login in It crashes.

Thanks a lot Carl .

CarlTR6 · 10 Aug 2010

The error codes point to hardware or hard ware related problems.

BugCheck D1 - BSOD Index

BugCheck A - BSOD Index

BugCheck 1A - BSOD Index

BugCheck 1E - BSOD Index

BugCheck 7F -BSOD Index

BugCheck 19 - BSOD Index

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp3_dump.zip\080610-11980-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`01e5a000 PsLoadedModuleList = 0xfffff800`02097e50
Debug session time: Fri Aug  6 06:03:03.512 2010 (GMT-4)
System Uptime: 0 days 0:02:00.012
Loading Kernel Symbols
...............................................................
..............................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {ffffea8004e11120, 2, 0, fffff88000d8eb77}

Probably caused by : cdrom.sys ( cdrom!RequestDispatchSpecialIoctls+23f )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffffea8004e11120, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88000d8eb77, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800021020e0
 ffffea8004e11120 

CURRENT_IRQL:  2

FAULTING_IP: 
Wdf01000!FxIoQueue::ProcessCancelledRequests+57
fffff880`00d8eb77 488b4208        mov     rax,qword ptr [rdx+8]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b99e20 -- (.trap 0xfffff80000b99e20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffffa8004e11020
rdx=ffffea8004e11118 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000d8eb77 rsp=fffff80000b99fb0 rbp=fffffa8004e11020
 r8=0000000000000000  r9=0000000000000000 r10=fffffa8004fab760
r11=fffffa8004e110c8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
Wdf01000!FxIoQueue::ProcessCancelledRequests+0x57:
fffff880`00d8eb77 488b4208        mov     rax,qword ptr [rdx+8] ds:1b08:ffffea80`04e11120=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80001ecb469 to fffff80001ecbf00

STACK_TEXT:  
fffff800`00b99cd8 fffff800`01ecb469 : 00000000`0000000a ffffea80`04e11120 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b99ce0 fffff800`01eca0e0 : fffffa80`03d1a148 fffffa80`04e11020 00000000`00000000 fffff800`01ed39ba : nt!KiBugCheckDispatch+0x69
fffff800`00b99e20 fffff880`00d8eb77 : fffffa80`04f9e4f0 0000057f`fb1eefd8 fffffa80`04e0b970 00000000`00000000 : nt!KiPageFault+0x260
fffff800`00b99fb0 fffff880`00d8c5ec : fffffa80`04e11020 00000000`00000001 fffff880`00dc83e0 fffff880`00d777e2 : Wdf01000!FxIoQueue::ProcessCancelledRequests+0x57
fffff800`00b9a030 fffff880`00d8c1ab : fffffa80`04e11020 00000000`00000002 00000000`00000000 00000000`00000000 : Wdf01000!FxIoQueue::DispatchEvents+0x12c
fffff800`00b9a0a0 fffff880`00d91986 : fffffa80`04f9e402 fffffa80`04f9e4f0 0000057f`fb1f2fd8 00000000`74617453 : Wdf01000!FxIoQueue::QueueRequestFromForward+0x1f7
fffff800`00b9a100 fffff880`00d6de3e : fffffa80`04e0b970 fffffa80`04e0d020 fffffa80`04e0d390 0000057f`fb061b08 : Wdf01000!FxPkgIo::EnqueueRequest+0x346
fffff800`00b9a180 fffff880`010a6873 : fffffa80`04e0d020 fffffa80`04f9e4f0 fffffa80`04e0d390 fffff800`00b9a330 : Wdf01000!imp_WdfDeviceEnqueueRequest+0x162
fffff800`00b9a1e0 fffff880`010a4d31 : 0000057f`fb1f2fd8 0000057f`fb061b08 fffff800`00b9a300 fffffa80`04e0d390 : cdrom!RequestDispatchSpecialIoctls+0x23f
fffff800`00b9a270 fffff880`00d92cd2 : 0000057f`fb061b08 fffffa80`04e11020 fffffa80`00000000 00000000`00000000 : cdrom!DeviceEvtIoInCallerContext+0x24d
fffff800`00b9a3e0 fffff880`00d91490 : fffffa80`04fab8c0 fffffa80`04f9e4f0 fffffa80`04fab760 fffffa80`04e0c5a0 : Wdf01000!FxPkgIo::DispathToInCallerContextCallback+0xf6
fffff800`00b9a410 fffff880`00d7b245 : fffffa80`04f9e4f0 0000057f`fb057158 fffffa80`04fa8f98 fffffa80`04fa8fb8 : Wdf01000!FxPkgIo::Dispatch+0x2b4
fffff800`00b9a490 fffff880`010aecde : fffffa80`04fa8ea0 fffff880`01e594b9 00000000`00000000 020fffff`80000000 : Wdf01000!FxDevice::Dispatch+0xa9
fffff800`00b9a4c0 fffff880`00d84f19 : 00000000`00000000 ff2932c2`0fffff88 cf080fff`ff804e80 00000000`00000020 : cdrom!DeviceMainTimerTickHandler+0xba
fffff800`00b9a500 fffff880`00d84f50 : fffff800`02044e80 fffff800`00b9a630 00000000`00000003 fffff800`02052c40 : Wdf01000!FxTimer::TimerHandler+0xb5
fffff800`00b9a540 fffff800`01ed7fa6 : 00000000`00000002 fffff800`00b9a618 00000000`00000000 00000000`00000000 : Wdf01000!FxTimer::_FxTimerDpcThunk+0x18
fffff800`00b9a570 fffff800`01ed7326 : fffffa80`03d73c68 fffffa80`03d73c68 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x66
fffff800`00b9a5e0 fffff800`01ed7e7e : 00000000`47888164 fffff800`00b9ac58 00000000`00001e0d fffff800`02047428 : nt!KiProcessExpiredTimerList+0xc6
fffff800`00b9ac30 fffff800`01ed7697 : fffffa80`03cea0ca 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiTimerExpiration+0x1be
fffff800`00b9acd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiRetireDpcList+0x277


STACK_COMMAND:  kb

FOLLOWUP_IP: 
cdrom!RequestDispatchSpecialIoctls+23f
fffff880`010a6873 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  cdrom!RequestDispatchSpecialIoctls+23f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: cdrom

IMAGE_NAME:  cdrom.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc11a

FAILURE_BUCKET_ID:  X64_0xD1_cdrom!RequestDispatchSpecialIoctls+23f

BUCKET_ID:  X64_0xD1_cdrom!RequestDispatchSpecialIoctls+23f

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp3_dump.zip\081010-21028-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c04000 PsLoadedModuleList = 0xfffff800`02e41e50
Debug session time: Tue Aug 10 18:36:26.175 2010 (GMT-4)
System Uptime: 0 days 0:05:45.343
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80050033, 6f8, fffff80002c7c18e}

Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050033
Arg3: 00000000000006f8
Arg4: fffff80002c7c18e

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  lsass.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002c75469 to fffff80002c75f00

STACK_TEXT:  
fffff880`009eec68 fffff800`02c75469 : 00000000`0000007f 00000000`00000008 00000000`80050033 00000000`000006f8 : nt!KeBugCheckEx
fffff880`009eec70 fffff800`02c73932 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`009eedb0 fffff800`02c7c18e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
ffffe880`009c17d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SwapContext_PatchXSave+0x8b


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiDoubleFaultAbort+b2
fffff800`02c73932 90              nop

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiDoubleFaultAbort+b2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2

BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp3_dump.zip\081010-21044-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c1e000 PsLoadedModuleList = 0xfffff800`02e5be50
Debug session time: Tue Aug 10 18:40:18.730 2010 (GMT-4)
System Uptime: 0 days 0:02:44.898
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffff80002e1dad0, fffff80002e1dad0, ffffe80002e1dad0}

Probably caused by : Pool_Corruption ( nt!ExFreePool+536 )

Followup: Pool_corruption
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffff80002e1dad0, the pool entry being checked.
Arg3: fffff80002e1dad0, the read back flink freelist value (should be the same as 2).
Arg4: ffffe80002e1dad0, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------


BUGCHECK_STR:  0x19_3

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  WSCStub.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002dc1d6f to fffff80002c8ff00

STACK_TEXT:  
fffff880`0a5ac7b8 fffff800`02dc1d6f : 00000000`00000019 00000000`00000003 fffff800`02e1dad0 fffff800`02e1dad0 : nt!KeBugCheckEx
fffff880`0a5ac7c0 fffff800`02fab4c9 : 00000000`00000000 00000000`00000000 fffffa80`03ee7278 fffff880`00000000 : nt!ExFreePool+0x536
fffff880`0a5ac8b0 fffff800`02fa7322 : fffffa80`06c7ac90 fffffa80`03ee7060 fffff880`0a5acb50 fffff880`0a5acb48 : nt!MiMapViewOfImageSection+0x199
fffff880`0a5ac9f0 fffff800`02fa6ebf : fffffa80`00000004 fffffa80`03ee7060 fffff880`0a5acb50 00000000`00000021 : nt!MiMapViewOfSection+0x372
fffff880`0a5acae0 fffff800`02c8f153 : 00000000`00000120 fffffa80`03eee060 00000000`0008e208 00000000`00000001 : nt!NtMapViewOfSection+0x2be
fffff880`0a5acbb0 00000000`7730013a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0008e1e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7730013a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExFreePool+536
fffff800`02dc1d6f cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExFreePool+536

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  X64_0x19_3_nt!ExFreePool+536

BUCKET_ID:  X64_0x19_3_nt!ExFreePool+536

Followup: Pool_corruption
---------

Notice what are the common factors in the usual causes for each error code. We will start the troubleshooting by enabling Driver Verifier.

Driver Verifier - Enable and Disable

Let Driver Verifier run and use your computer as normal. Upload any new dump files.

You have many out of date drivers on your system. Win 7 does not like older drivers. They can and do cause crashes. Did you do a clean install of Win 7 or did you do an upgrade install? At any rate these drivers are going to have to be update or the software/hardware they are associated with uninstalled.

Also, are you running a RAID array? I found obsolete RAID drivers.

Code:

adfs.SYS     Thu Jun 26 16:52:37 2008
adp94xx.sys  Fri Dec 05 18:54:42 2008
adpahci.sys  Tue May 01 13:30:09 2007
adpu320.sys  Tue Feb 27 19:04:15 2007
arc.sys      Thu May 24 17:27:55 2007
arcsas.sys   Wed Jan 14 14:27:37 2009
atikmdag.sys Thu Jul 02 13:45:07 2009
AtiPcie.sys  Tue May 05 11:00:22 2009
ATSwpWDF.sys Wed May 13 16:48:02 2009
btwaudio.sys Wed Jul 01 09:54:56 2009
btwavdt.sys  Thu Jun 25 01:50:13 2009
btwl2cap.sys Fri Apr 03 20:28:45 2009
btwrchid.sys Thu Jun 25 01:51:37 2009
elxstor.sys  Tue Feb 03 17:52:11 2009
enecir.sys   Wed May 20 02:08:57 2009
ENG64.SYS    Thu Feb 12 18:41:48 2009
EX64.SYS     Thu Feb 12 18:43:23 2009
HpqKbFiltr.sys Wed Apr 29 09:48:30 2009
HpSAMD.sys   Mon May 18 19:43:49 2009
iaStorV.sys  Wed Apr 08 12:57:17 2009
lsi_fc.sys   Tue Dec 09 17:46:09 2008
lsi_sas.sys  Mon May 18 20:20:23 2009
lsi_sas.sys  Mon May 18 20:20:23 2009
lsi_sas2.sys Mon May 18 20:31:48 2009
lsi_scsi.sys Thu Apr 16 18:13:50 2009
mcdbus.sys   Tue Feb 24 05:34:07 2009
megasas.sys  Mon May 18 21:09:46 2009
MegaSR.sys   Mon May 18 21:25:54 2009
nfrd960.sys  Tue Jun 06 17:11:48 2006
nvraid.sys   Wed May 20 02:39:40 2009
nvstor.sys   Wed May 20 02:45:37 2009
ql2300.sys   Thu Jan 22 18:05:06 2009
ql40xx.sys   Mon May 18 21:18:11 2009
Rt64win7.sys Fri May 22 10:52:30 2009
SiSRaid2.sys Wed Sep 24 14:28:20 2008
sisraid4.sys Wed Oct 01 17:56:04 2008
smserial.sys Tue May 05 08:20:31 2009
SRTSP64.SYS  Mon Jun 22 22:45:21 2009
SRTSPX64.SYS Mon Jun 22 22:47:54 2009
stexstor.sys Tue Feb 17 18:03:36 2009
usbfilter.sys Mon Mar 09 07:49:01 2009
vsmraid.sys  Fri Jan 30 20:18:57 2009

I just saw your latest post. Can you boot in the safe mode? If you can, try a system restore. A restore point should have been created prior to installing the updates.

ruchijain · 10 Aug 2010

Hi carl thanks .. I am working on it right away.

Jonathan_King · 10 Aug 2010

Remove Norton 2009 with this tool: ftp://ftp.symantec.com/public/englis...moval_Tool.exe

Replace it with MSE: http://www.microsoft.com/security_essentials

Update these old drivers:

Code:

iaStorV.sys  Wed Apr 08 12:57:17 2009 - Intel storage driver
nfrd960.sys  Tue Jun 06 17:11:48 2006 - IMB RAID controller?
nvraid.sys   Wed May 20 02:39:40 2009 - nVidia RAID drivers

ruchijain · 10 Aug 2010

Hi Carl,

I just enabled the driver verifier and after the restart I got an driver_verification_IO_manager violation and it was under RTSTOR64.sys

Hi Jonathan,
Thanks for jumping in and looking into the dumps. I am in the process of updating the above.

CarlTR6 · 10 Aug 2010

Thanks, Jonathan. He has a ton of obsolete drivers. I just edited my post above with the list.

I think your RAID drivers are causing some of your problem. I saw evidence of this in one of the dumps.

ruchijain · 10 Aug 2010

Hi Carl ,

How do I remove it . I dont know if i am using RAID or not . How do I update that ? Is there a way I can do that.

Thanks,
Ruchi

ruchijain · 10 Aug 2010

I removed Norton 2009 but every time I am restarting the system I get an error DRIVER_VERIFIER_IOMANAGER_VIOLATION
RTSTOR64.SYS

thanks, for your help team .. u guys are really very very helpful