Sony Vaio BSOD Screens and query on checking external drives

belinda502 · 10 Feb 2013

I had posted this on another thread concerning a blue screen in a Sony Vaio but was advised to remove it and start a new thread which I’m doing here. I have a two year old Sony Vaio 64 bit with Windows 7 Home Premium, Service pack 1. I had no problem with it until I put on Norton 360 when blue screens started generating. I posted on here a week ago and uploaded a zip file and followed the advice given after analysis.
I got onto Norton Community as advised and uploaded the contents of the BSOD screen which only occurred when I started the computer. They gave me a link to a Microsoft Knowledge base article at http://support.microsoft.com/kb/979444 which in turn led me to the following hotfix :- http://hotfixv4.microsoft.com/Windows%207/WindowsServer%202008%20R2/sp1/Fix302249/7600/free/404162_intl_x64_zip.exe
I downloaded this Hotfix and got no BSOD for a week when I got another one. The contents of the BSOD screen I got after one week were as follows:-
A problem has been detected and windows has shut down to prevent damage to your computer.
APC_INDEX_MISMATCH

If problems continue disable or remove any newly installed hardwear or softwear. Disable BIOS memory options such as caching or shadowing. If you need to use safe mode to remove or disable components, restart your computer press F8 to select advanced start-up options and then select safe mode.
Technical Information
***STOP: 0 X 00000001 (C 0 X 000000007798172A, 0 X 0000000000000000, 0 X 00000000FFFF0000, 0 X FFFFF88003277B60)

Collecting data for crash dump…
Initializing disk for crash dump…
Beginning dump of physical memory
Dumping physical memory to disk: 100
Physical memory dump complete
Contact your system administrator or technical support group for further assistance.

After this happened I removed Norton finally using the Norton Remover tool and I installed Microsoft Security Essentials, did a virus check which was clear but when I shut down the computer I got another BSOD screen the contents of which were as follows:-
DRIVER_IRQL_NOT_LESS_OR_EQUAL
If problems continue disable or remove any newly installed hardwear or softwear. Disable BIOS memory options such as caching or shadowing. If you need to use safe mode to remove or disable components, restart your computer press F8 to select advanced start-up options and then select safe mode.
Technical Information:
xxxStop: 0x000000D1
COXFFFFF88006D0D205, OX000000000000000X2, 0X0000000000000008, 0XFFFFF88006DOD205
+++ArcSoftKSUFilter.sys-Address FFFFF88006D0D205 base at FFFFF88006DO6000, D atestamp 4a1a5673
+++ArcSoftKSUFilter.sys-Address FFFFF88006D0D205 base at FFFFF88006DO6000, D atestamp 4a1a5673
This BSOD kept hanging so I had to turn off the computer eventually without generating a dump file.
I then did a hard drive check on my ‘c’ drive which has no errors. I am trying to do one now on my external ‘e’ and ‘d’ drives but when I typed in “chkdsk e” into the command prompt, it said ‘Access Denied as you do not have sufficient privileges, you have to invoke this utility running in elevated mode’. Could someone please tell me how I get around this so that I can check these external drives? I’m not a computer expert and the computer was in a repair shop for 3 days and they could not fix it other than to tell me to remove Norton which hasn’t worked.
I should also mention that while I was downloading the file from Windows Seven Forums to upload a zip file for a bug check, I got another BSOD file which said:-
The IO Manager has detected a violation by a driver that is being verified.
Technical information
+++Stop: 0x000000C9
COX0000000000000224, 0XFFFFF880031E8710, 0XFFFFF9807A4BA9D0, 0XFFFFFFFFC00000BB)
+++HIDCLASS.SYS – Address FFFFF880031E8710 base at FFFFF880031E6000, datestamp 4ce7a665
From some of the BSOD screens I’ve been getting, I’m wondering if it could be a driver problem. I checked my device drivers on windows and they are updated automatically and are apparently in working order.

I was advised to a system repaid scan which I did and the contents are as follows:-
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>sfc /scannow
Beginning system scan. This process will take some time.
Beginning verification phase of system scan.
Verification 100% complete.

I have uploaded an updated dump file for analysis.

koolkat77 · 11 Feb 2013

Code:

VERIFIER_ENABLED_VISTA_MINIDUMP

You need to disable driver verifier as it may create false BSOD-s.

Please disable verifier according to its tutorial below and let us know if you are still getting BSOD-s.

Driver Verifier - Enable and Disable

belinda502 · 11 Feb 2013

Ok, I will try doing that. Can I ask why does the code for the bug check show VERIFIER_ENABLED_VISTA_MINIDUMP when I have Windows 7 installed not Vista?
Also I want to check my external drives 'e' and 'd' but when I tried this by typing 'chkdsk e' into the command prompt the message it sent back was 'Access denied as you do not have sufficient privileges. You have to invoke this utility running in elevated mode? Any idea how I would go about this?

koolkat77 · 11 Feb 2013

I'm not sure why it showed Vista instead of Win7 cause even I'm using the 7 version of the debugger tool.

It might be cause you're windows 7 installation may be corrupt but I'm calling for more help.

NoelDP · 12 Feb 2013

CHKDSK commands always require elevated privileges - because it effectively takes the disk out of use, and can break running programs.
run the command from an elevated command prompt -
To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.

belinda502 · 13 Feb 2013

Hi,
I followed your instructions to run the elevated command prompt but I still can't open the 'e' drive.
I have posted the result here. Does the drive need to be use in order to check it - should I attach a USB stick? :-

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>chkdsk e:
Cannot open volume for direct access.

NoelDP · 13 Feb 2013

Please open diskmgmt.msc
take a screenshot of it and post the shot.

belinda502 · 13 Feb 2013

I tried copying and pasting the screenshot of diskmgmt.msc here but it didn't seem to paste so I have attached it as a file. I think I have narrowed down the problem to an 'e' disk. I wanted to check the external drives before dis-enabling the driver verifier. I have a Sony mp3 player - I attached it and as soon as I disconnected it I got another BSOD that I have uploaded as a zipped file

NoelDP · 13 Feb 2013

There is no E: drive on the system.
Where are you finding this drive letter?
The only time you are likely to see such a letter (unless external drives are plugged in - which they weren't when you did the diskmgmt screenshot) is when in the Repair Environment - when it may be the main Windows partition.

If you only see this letter when external drives are plugged in, then please lug them back in and post a new diskmgmt screenshot.

koolkat77 · 13 Feb 2013

Why haven't you still disabled Driver Verifier?

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffff8800248c205, 2, 8, fffff8800248c205}

*** WARNING: Unable to verify timestamp for ArcSoftKsUFilter.sys
*** ERROR: Module load completed but symbols could not be loaded for ArcSoftKsUFilter.sys
Probably caused by : ArcSoftKsUFilter.sys ( ArcSoftKsUFilter+7205 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff8800248c205, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: fffff8800248c205, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ecb100
GetUlongFromAddress: unable to read from fffff80002ecb1c0
 fffff8800248c205 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
ArcSoftKsUFilter+7205
fffff880`0248c205 488b4f28        mov     rcx,qword ptr [rdi+28h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff880033bd4d0 -- (.trap 0xfffff880033bd4d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8008b12c01
rdx=fffffa80097d63e1 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800248c205 rsp=fffff880033bd660 rbp=fffff98024e8aaf0
 r8=fffffa80097d63e0  r9=0000000000000000 r10=fffff8000314c4c0
r11=fffffa8008b12c00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
ArcSoftKsUFilter+0x7205:
fffff880`0248c205 488b4f28        mov     rcx,qword ptr [rdi+28h] ds:00000000`00000028=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c9b569 to fffff80002c9bfc0

FAILED_INSTRUCTION_ADDRESS: 
ArcSoftKsUFilter+7205
fffff880`0248c205 488b4f28        mov     rcx,qword ptr [rdi+28h]

STACK_TEXT:  
fffff880`033bd388 fffff800`02c9b569 : 00000000`0000000a fffff880`0248c205 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff880`033bd390 fffff800`02c9a1e0 : fffffa80`03c746c0 fffffa80`0953d1d0 00000000`00000000 fffffa80`062d1d60 : nt!KiBugCheckDispatch+0x69
fffff880`033bd4d0 fffff880`0248c205 : 00000000`00000010 fffffa80`062d1d60 fffff980`24e8aaf0 00000000`00010206 : nt!KiPageFault+0x260
fffff880`033bd660 00000000`00000010 : fffffa80`062d1d60 fffff980`24e8aaf0 00000000`00010206 fffffa80`08bf7060 : ArcSoftKsUFilter+0x7205
fffff880`033bd668 fffffa80`062d1d60 : fffff980`24e8aaf0 00000000`00010206 fffffa80`08bf7060 00000000`00000000 : 0x10
fffff880`033bd670 fffff980`24e8aaf0 : 00000000`00010206 fffffa80`08bf7060 00000000`00000000 00000000`00000000 : 0xfffffa80`062d1d60
fffff880`033bd678 00000000`00010206 : fffffa80`08bf7060 00000000`00000000 00000000`00000000 fffff800`0313ec16 : 0xfffff980`24e8aaf0
fffff880`033bd680 fffffa80`08bf7060 : 00000000`00000000 00000000`00000000 fffff800`0313ec16 fffff980`24e8aaf0 : 0x10206
fffff880`033bd688 00000000`00000000 : 00000000`00000000 fffff800`0313ec16 fffff980`24e8aaf0 00000000`00000002 : 0xfffffa80`08bf7060


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ArcSoftKsUFilter+7205
fffff880`0248c205 488b4f28        mov     rcx,qword ptr [rdi+28h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  ArcSoftKsUFilter+7205

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ArcSoftKsUFilter

IMAGE_NAME:  ArcSoftKsUFilter.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a1a5673

FAILURE_BUCKET_ID:  X64_0xD1_VRF_CODE_AV_BAD_IP_ArcSoftKsUFilter+7205

BUCKET_ID:  X64_0xD1_VRF_CODE_AV_BAD_IP_ArcSoftKsUFilter+7205

Followup: MachineOwner
---------