BSOD Back; random - Possible External HD?

mdenner · 04 Mar 2012

I thought I was all good with no BSOD but I got 2 recently (1 bout 2 min ago) and I did notice that before I got them my external HD kicks up and makes that whiring sound it is connected via firewire so im not sure if thats the issue I just noticed it both times it happened.

Also upon bootup after a BSOD I get the "Initializing and Establishing link" then no media found. I have to hit the power put and then turn it on. I never get this when I shut down, restart, or press the reset swithc it is only after the BSOD. not sure if it sees the external HD first and doesnt go to the SSD. Everything is good in BIOS (boot disk, external devices, HD, network)

Thanks guys and hope someone can help the BSOD are irritating

Vir Gnarus · 05 Mar 2012

Hello,

In both cases, it looked like your NEC USB controller driver isn't playing by the rules with Windows. While it's dated Oct 2011, you'll want to make sure that the drivers are up to date. I believe this is an internal USB controller hub that's built onto the motherboard, so you may wanna update all the drivers pertaining to your motherboard (especially those related to chipset and USB), as well as updating your BIOS. Understand that any overclocking can also cause these issues, and in addition motherboard malfunctioning can do the same (though the consistency I'm seeing here between the two crashdumps leads me to believe this isn't hardware-related).

Code:

crash 1:

CONTEXT:  fffff8800cef3ee0 -- (.cxr 0xfffff8800cef3ee0)
rax=0000000000000000 rbx=0000000000000038 rcx=0000000000000001
rdx=0000000000000000 rsi=fffffa8013aaa1b0 rdi=0000000000000000
rip=fffff800030e4bb6 rsp=fffff8800cef48c0 rbp=fffffa800d3aaa00
 r8=0000000000000000  r9=fffffa800d3aaa00 r10=0000000000000078
r11=0000000000000000 r12=fffffa800d52e101 r13=ffffffffc000000d
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!KeSetEvent+0x16:
fffff800`030e4bb6 f6037f          test    byte ptr [rbx],7Fh ds:002b:00000000`00000038=??
Resetting default scope

crash 2:

CONTEXT:  fffff88011a0cee0 -- (.cxr 0xfffff88011a0cee0)
rax=0000000000000000 rbx=0000000000000038 rcx=0000000000000001
rdx=0000000000000000 rsi=fffffa8013ad81b0 rdi=0000000000000000
rip=fffff800030d9bb6 rsp=fffff88011a0d8c0 rbp=fffffa8013e54ce0
 r8=0000000000000000  r9=fffffa8013e54ce0 r10=0000000000000078
r11=0000000000000000 r12=fffffa800d267101 r13=ffffffffc000000d
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!KeSetEvent+0x16:
fffff800`030d9bb6 f6037f          test    byte ptr [rbx],7Fh ds:002b:00000000`00000038=??
Resetting default scope

8: kd> !error c000000d
Error code: (NTSTATUS) 0xc000000d (3221225485) - An invalid parameter was passed to a service or function.

writhziden · 05 Mar 2012

Antivirus Software:

Code:

smc.exe	c:\program files (x86)\symantec\symantec endpoint protection\12.1.671.4971.105\bin64\smc.exe	2648	8	1024	8192	3/4/2012 7:15 PM	12.1.671.4971	2.47 MB (2,591,232 bytes)	6/17/2011 8:10 PM
ccsvchst.exe	c:\program files (x86)\symantec\symantec endpoint protection\12.1.671.4971.105\bin\ccsvchst.exe	1940	8	1024	16384	3/4/2012 7:15 PM	10.1.2.14	134.01 KB (137,224 bytes)	6/14/2011 7:31 PM
ccsvchst.exe	c:\program files (x86)\symantec\symantec endpoint protection\12.1.671.4971.105\bin\ccsvchst.exe	3240	8	1024	3072	3/4/2012 7:15 PM	10.1.2.14	134.01 KB (137,224 bytes)	6/14/2011 7:31 PM

Possible out of date drivers:

Code:

LHidFilt	fffff880`09112000	fffff880`09125000	Wed Jun 17 10:49:39 2009 (4a391ea3)	00014ede		LHidFilt.Sys
LMouFilt	fffff880`09132000	fffff880`09146000	Wed Jun 17 10:49:43 2009 (4a391ea7)	0001d7ff		LMouFilt.Sys

LHidFilt.Sys
LMouFilt.Sys

Code:


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\mdenner\Windows_NT6_BSOD_jcgriff2\030112-29140-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03064000 PsLoadedModuleList = 0xfffff800`032a9670
Debug session time: Wed Feb 29 19:01:40.738 2012 (UTC - 7:00)
System Uptime: 0 days 0:08:24.985
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
.......
Unable to load image \SystemRoot\system32\DRIVERS\nusb3xhc.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nusb3xhc.sys
*** ERROR: Module load completed but symbols could not be loaded for nusb3xhc.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff800030e4bb6, fffff8800cef4688, fffff8800cef3ee0}

Probably caused by : nusb3xhc.sys ( nusb3xhc+1abaf )

Followup: MachineOwner
---------

8: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800030e4bb6, The address that the exception occurred at
Arg3: fffff8800cef4688, Exception Record Address
Arg4: fffff8800cef3ee0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KeSetEvent+16
fffff800`030e4bb6 f6037f          test    byte ptr [rbx],7Fh

EXCEPTION_RECORD:  fffff8800cef4688 -- (.exr 0xfffff8800cef4688)
ExceptionAddress: fffff800030e4bb6 (nt!KeSetEvent+0x0000000000000016)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000038
Attempt to read from address 0000000000000038

CONTEXT:  fffff8800cef3ee0 -- (.cxr 0xfffff8800cef3ee0)
rax=0000000000000000 rbx=0000000000000038 rcx=0000000000000001
rdx=0000000000000000 rsi=fffffa8013aaa1b0 rdi=0000000000000000
rip=fffff800030e4bb6 rsp=fffff8800cef48c0 rbp=fffffa800d3aaa00
 r8=0000000000000000  r9=fffffa800d3aaa00 r10=0000000000000078
r11=0000000000000000 r12=fffffa800d52e101 r13=ffffffffc000000d
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!KeSetEvent+0x16:
fffff800`030e4bb6 f6037f          test    byte ptr [rbx],7Fh ds:002b:00000000`00000038=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000038

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003313100
 0000000000000038 

FOLLOWUP_IP: 
nusb3xhc+1abaf
fffff880`07e56baf ??              ???

BUGCHECK_STR:  0x7E

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from fffff88007e56baf to fffff800030e4bb6

STACK_TEXT:  
fffff880`0cef48c0 fffff880`07e56baf : fffffa80`0d3aaa00 fffffa80`00000000 04a404e4`04e40500 fffff880`0cef49b0 : nt!KeSetEvent+0x16
fffff880`0cef4930 fffffa80`0d3aaa00 : fffffa80`00000000 04a404e4`04e40500 fffff880`0cef49b0 fffffa80`0d3aaa00 : nusb3xhc+0x1abaf
fffff880`0cef4938 fffffa80`00000000 : 04a404e4`04e40500 fffff880`0cef49b0 fffffa80`0d3aaa00 fffff800`030e4021 : 0xfffffa80`0d3aaa00
fffff880`0cef4940 04a404e4`04e40500 : fffff880`0cef49b0 fffffa80`0d3aaa00 fffff800`030e4021 fffffa80`0d3aaad3 : 0xfffffa80`00000000
fffff880`0cef4948 fffff880`0cef49b0 : fffffa80`0d3aaa00 fffff800`030e4021 fffffa80`0d3aaad3 00000000`00000002 : 0x4a404e4`04e40500
fffff880`0cef4950 fffffa80`0d3aaa00 : fffff800`030e4021 fffffa80`0d3aaad3 00000000`00000002 fffffa80`13aaa060 : 0xfffff880`0cef49b0
fffff880`0cef4958 fffff800`030e4021 : fffffa80`0d3aaad3 00000000`00000002 fffffa80`13aaa060 fffffa80`0d3aaa00 : 0xfffffa80`0d3aaa00
fffff880`0cef4960 fffff880`00d67a4e : fffffa80`0d3aaa00 fffffa80`0d3aaa00 fffffa80`0d3aaa00 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff880`0cef4a50 fffff800`031deaa2 : fffffa80`0d3aaa00 00000000`00000000 fffffa80`0d3aaa00 fffffa80`13aaa1b0 : pci!PciDispatchPnpPower+0x146
fffff880`0cef4a90 fffff880`07e6e46e : 00000000`00000012 00000000`00000000 fffff880`000000f3 fffff880`090e4965 : nt!IopPoHandleIrp+0x32
fffff880`0cef4ac0 00000000`00000012 : 00000000`00000000 fffff880`000000f3 fffff880`090e4965 fffffa80`0d3aab18 : nusb3xhc+0x3246e
fffff880`0cef4ac8 00000000`00000000 : fffff880`000000f3 fffff880`090e4965 fffffa80`0d3aab18 00000000`00000000 : 0x12


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nusb3xhc+1abaf

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nusb3xhc

IMAGE_NAME:  nusb3xhc.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ea60982

STACK_COMMAND:  .cxr 0xfffff8800cef3ee0 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_nusb3xhc+1abaf

BUCKET_ID:  X64_0x7E_nusb3xhc+1abaf

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\mdenner\Windows_NT6_BSOD_jcgriff2\022912-11356-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03059000 PsLoadedModuleList = 0xfffff800`0329e670
Debug session time: Wed Feb 29 09:20:27.314 2012 (UTC - 7:00)
System Uptime: 0 days 0:06:44.514
Loading Kernel Symbols
...............................................................
................................................................
.................................................
Loading User Symbols
Loading unloaded module list
.........
Unable to load image \SystemRoot\system32\DRIVERS\nusb3xhc.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nusb3xhc.sys
*** ERROR: Module load completed but symbols could not be loaded for nusb3xhc.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff800030d9bb6, fffff88011a0d688, fffff88011a0cee0}

Probably caused by : nusb3xhc.sys ( nusb3xhc+1abaf )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800030d9bb6, The address that the exception occurred at
Arg3: fffff88011a0d688, Exception Record Address
Arg4: fffff88011a0cee0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KeSetEvent+16
fffff800`030d9bb6 f6037f          test    byte ptr [rbx],7Fh

EXCEPTION_RECORD:  fffff88011a0d688 -- (.exr 0xfffff88011a0d688)
ExceptionAddress: fffff800030d9bb6 (nt!KeSetEvent+0x0000000000000016)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000038
Attempt to read from address 0000000000000038

CONTEXT:  fffff88011a0cee0 -- (.cxr 0xfffff88011a0cee0)
rax=0000000000000000 rbx=0000000000000038 rcx=0000000000000001
rdx=0000000000000000 rsi=fffffa8013ad81b0 rdi=0000000000000000
rip=fffff800030d9bb6 rsp=fffff88011a0d8c0 rbp=fffffa8013e54ce0
 r8=0000000000000000  r9=fffffa8013e54ce0 r10=0000000000000078
r11=0000000000000000 r12=fffffa800d267101 r13=ffffffffc000000d
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!KeSetEvent+0x16:
fffff800`030d9bb6 f6037f          test    byte ptr [rbx],7Fh ds:002b:00000000`00000038=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000038

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003308100
 0000000000000038 

FOLLOWUP_IP: 
nusb3xhc+1abaf
fffff880`07c1abaf ??              ???

BUGCHECK_STR:  0x7E

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from fffff88007c1abaf to fffff800030d9bb6

STACK_TEXT:  
fffff880`11a0d8c0 fffff880`07c1abaf : fffffa80`13e54ce0 fffffa80`00000000 fffffa80`0d67b400 fffff800`03280b00 : nt!KeSetEvent+0x16
fffff880`11a0d930 fffffa80`13e54ce0 : fffffa80`00000000 fffffa80`0d67b400 fffff800`03280b00 fffffa80`13e54ce0 : nusb3xhc+0x1abaf
fffff880`11a0d938 fffffa80`00000000 : fffffa80`0d67b400 fffff800`03280b00 fffffa80`13e54ce0 fffff800`030d9021 : 0xfffffa80`13e54ce0
fffff880`11a0d940 fffffa80`0d67b400 : fffff800`03280b00 fffffa80`13e54ce0 fffff800`030d9021 fffffa80`13e54db3 : 0xfffffa80`00000000
fffff880`11a0d948 fffff800`03280b00 : fffffa80`13e54ce0 fffff800`030d9021 fffffa80`13e54db3 00000000`00000002 : 0xfffffa80`0d67b400
fffff880`11a0d950 fffffa80`13e54ce0 : fffff800`030d9021 fffffa80`13e54db3 00000000`00000002 fffffa80`13ad8060 : nt!PopIrpLock
fffff880`11a0d958 fffff800`030d9021 : fffffa80`13e54db3 00000000`00000002 fffffa80`13ad8060 fffffa80`13e54ce0 : 0xfffffa80`13e54ce0
fffff880`11a0d960 fffff880`00fbaa4e : fffffa80`13e54ce0 fffffa80`13e54d00 fffffa80`13e54ce0 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff880`11a0da50 fffff800`031d3aa2 : fffffa80`13e54ce0 00000000`00000000 fffffa80`13e54ce0 fffffa80`13ad81b0 : pci!PciDispatchPnpPower+0x146
fffff880`11a0da90 fffff880`07c3246e : fffff880`00f7dd10 fffff880`00f57bb7 fffffa80`000000cb fffffa80`0d67d7a0 : nt!IopPoHandleIrp+0x32
fffff880`11a0dac0 fffff880`00f7dd10 : fffff880`00f57bb7 fffffa80`000000cb fffffa80`0d67d7a0 fffffa80`13e54df8 : nusb3xhc+0x3246e
fffff880`11a0dac8 fffff880`00f57bb7 : fffffa80`000000cb fffffa80`0d67d7a0 fffffa80`13e54df8 00000000`00000000 : ACPI!AcpiRawDeviceIrpDispatch
fffff880`11a0dad0 fffff800`031ebf65 : 00000000`00000001 fffffa80`13ad8060 00000000`00000001 fffffa80`13e54d88 : ACPI!ACPIDispatchIrp+0x2a3
fffff880`11a0db50 fffff800`03370fee : ffffffff`fa0a1f00 fffffa80`0d51ab60 00000000`00000080 fffff800`030cd757 : nt!PopIrpWorker+0x3c5
fffff880`11a0dc00 fffff800`030c75e6 : fffff880`062fb180 fffffa80`0d51ab60 fffff880`063061c0 fffff880`0442d384 : nt!PspSystemThreadStartup+0x5a
fffff880`11a0dc40 00000000`00000000 : fffff880`11a0e000 fffff880`11a08000 fffff880`11a0d1a0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nusb3xhc+1abaf

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nusb3xhc

IMAGE_NAME:  nusb3xhc.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ea60982

STACK_COMMAND:  .cxr 0xfffff88011a0cee0 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_nusb3xhc+1abaf

BUCKET_ID:  X64_0x7E_nusb3xhc+1abaf

Followup: MachineOwner
---------

Pointing to your USB 3 drivers. This usually means a USB device plugged into the ports is causing a problem. It could very well be due to the out of date drivers above.
Basically the same as 1.

Update the Logitech drivers above. If that does not provide more stability, proceed with the steps Vir Gnarus outlined.

Also look at USB Driver - General Fix for Problems for resolving general USB problems.

Proceed to use hard reset to resolve hardware and software issues (which works for all computers, not just HP Pavilions) in case your USB devices have entered a power state to protect the system from power surges. The hard reset described in that link will reset the USB devices to their normal power state.