Massive amounts of BSODs on boot, multiple errors; BE, 18, 7E, 0A

What drivers/software are common for all systems? Can you provide a list?

Are you having problems with the systems designed for Windows 7, as well?

Any chance you could follow the https://www.sevenforums.com/crashes-d...tructions.html on a set of the machines and provide us with the reports? I realize this is difficult when managing machines that are often in use, but it would give us driver information to look at. Can any of the malfunctioning systems boot into Windows 7 safe mode?

I've had a -few- cases where I could use the option of 'Using last correct settings' when pressing F8, where they then would boot to windows, I suppose I could try doing the posting instructions on one of those machines.

Safe boot however makes it hang after classpnp.sys, which, after having tried this on a 'healthy' computer is right when windows is about to start.

Seeing I'm not at work right now I'll try to posts my results tomorrow.

That's fine, we'll look them over after you post them. :)

I believe this is what you're after.
Mind you, the whole thing about the smartcard is nonsense, seeing we disconnect all of those. It's definitely not the causing thing, already tested it with and without it.

I hope you'll be able to understand all this, because I sure didn't.

Problem Devices:

Code:

Smartcard SCFILTER \ CID_56346376 \ & 0 & 7 & 134B9E97 EUTRON_CRYPTOIDENTITY_CCID_0_SCFILTER_CID_56346376 The drivers for this device are not installed.

Code:

Loading Dump File [D:\Kingston\BSODDmpFiles\Alphasoldier\Windows_NT6_BSOD_jcgriff2\Windows_NT6_BSOD_jcgriff2\012712-80562-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17592.x86fre.win7sp1_gdr.110408-1631
Machine Name:
Kernel base = 0x82e38000 PsLoadedModuleList = 0x82f814d0
Debug session time: Fri Jan 27 03:55:11.906 2012 (UTC - 7:00)
System Uptime: 0 days 0:00:28.062
Loading Kernel Symbols
...............................................................
.......................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {12, 2, 0, 82e5a9ce}

*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
Probably caused by : cng.sys ( cng!CcnCancelSubscriptionProcess+28 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000012, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82e5a9ce, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82fa1848
Unable to read MiSystemVaType memory at 82f80e20
 00000012 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IoBoostThreadIoPriority+c1
82e5a9ce 8a4812          mov     cl,byte ptr [eax+12h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  autochk.exe

TRAP_FRAME:  8c6819a4 -- (.trap 0xffffffff8c6819a4)
ErrCode = 00000000
eax=00000000 ebx=888031a8 ecx=8c681a68 edx=82f9f0fc esi=00000018 edi=00000020
eip=82e5a9ce esp=8c681a18 ebp=8c681ac8 iopl=0         nv up ei pl nz ac pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010217
nt!IoBoostThreadIoPriority+0xc1:
82e5a9ce 8a4812          mov     cl,byte ptr [eax+12h]      ds:0023:00000012=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82e5a9ce to 82e795cb

STACK_TEXT:  
8c6819a4 82e5a9ce badb0d00 82f9f0fc 000000b0 nt!KiTrap0E+0x2cf
8c681ac8 82efcc33 00000000 00000002 00000000 nt!IoBoostThreadIoPriority+0xc1
8c681afc 82e6d9ff 00000002 82f62d20 85884298 nt!ExpCheckForIoPriorityBoost+0x8e
8c681b44 82eb96b6 88805736 85884298 85ee7d48 nt!ExpWaitForResource+0x7b
8c681b94 889ae633 85884298 00000001 85ee7d48 nt!ExAcquireResourceExclusiveLite+0x1cf
8c681bb0 889a3690 85884298 85ee5d40 8c681bd0 cng!CcnCancelSubscriptionProcess+0x28
8c681bc0 8899ddbf 85ee5d40 85ee5d40 8c681bfc cng!ConfigProcessTerminationHandler+0x13
8c681bd0 830937f8 00000110 0000011c 00000000 cng!CngCreateProcessNotifyRoutine+0x29
8c681bfc 830a162d 00000001 01ee5d40 925e3f43 nt!PspExitProcess+0xa3
8c681c78 83093bbd 00000000 c0000001 942ec9f8 nt!PspExitThread+0x59a
8c681ca0 8dbb06d9 ffffffff 00000000 85df8268 nt!NtTerminateProcess+0x1fa
WARNING: Stack unwind information not available. Following frames may be wrong.
8c681d24 82e761ea ffffffff 00000000 0015fc80 SYMEVENT+0x146d9
8c681d24 00000000 ffffffff 00000000 0015fc80 nt!KiFastCallEntry+0x12a
8c681d94 00000000 770d70b4 0000001b 00000206 0x0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
cng!CcnCancelSubscriptionProcess+28
889ae633 83c738          add     edi,38h

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  cng!CcnCancelSubscriptionProcess+28

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: cng

IMAGE_NAME:  cng.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc427

FAILURE_BUCKET_ID:  0xA_cng!CcnCancelSubscriptionProcess+28

BUCKET_ID:  0xA_cng!CcnCancelSubscriptionProcess+28

Followup: MachineOwner
---------

The fact that one of these crashes points toward Symantec (Norton) leads me to believe the problem lies in the antivirus software installed on the machines. Norton is known to cause crashes on some systems.

Is it feasible to use a different antivirus? If so, I would recommend removing Norton off all machines using the Norton removal tool and replace it with Microsoft Security Essentials - Free Antivirus for Windows to run with Windows firewall.

It is not really all that feasible seeing I'm quite sure we have a running license on their product, me as an intern is not going to change that without concrete evidence.

How sure can one be on it being the antivirus?
And can it somehow be found out by all this data on how the blue screens could be triggered again, on purpose, so that I can show my employer this is the actual cause?

Unfortunately, it is very difficult for us to help debugging in cases regarding multiple machines in which hardware testing is difficult to accomplish.

I cannot be sure it is the antivirus software, but that is one of the few items that seems to be the same across all systems based on your descriptions. The other crash files were fairly inconclusive and pointed to Windows system files; when the crashes do this, it typically means either a hardware problem or corrupted Windows files. The only conclusive crash indicated Norton, and Norton has been known to cause crashes that seem to be inconclusive, so it is possible Norton is also causing the other crashes that point to hardware or Windows file corruption. Unfortunately, without removing Norton to test, it is difficult to determine if it is definitely the cause of the other crashes.

Is there any hardware that is the same across all systems? RAM, a PCI card, etc.?

Well, all of the older systems gotten the same RAM upgrade, it has been suggested before that we match all the ram that are in all the machines. This however does not apply on the newer machines who also crash, who only have 1 stick of 2gb.
Then there's the smartcard reader, which if I recall correctly is almost in -every- machine. At least all the ones that crashed, but half of the time they're not connected, including on the crashing systems.

There -is- one case, of a laptop that first kept crashing on the image we used, over and over. Then we manually installed it and it didn't crash anymore. I'll ask that person if he also installed the AV or if he installed Security Essentials.

When looking back at how random all the crashes are, it does seem most likely that Norton's the cause. The other thing we thought about is students plugging in several different USB sticks. Which drivers always need to be properly installed, or so windows always tells me when I plug in my USB stick. And that it creates a fault in the drivers which are loaded up next time. Is this a possible cause, or should I let that rest?

Now for another question... would it help if I'd get reports off multiple machines? This might take some time, but if it'll help finding the cause I'm more than willing to do this.

Oh and my employer created another image in the hope that this would stop the crashing, we'll have to wait and see if this works.