New
#21
This time, BSOD may be caused by 'uxpatch.sys'. The report is attached.
This time, BSOD may be caused by 'uxpatch.sys'. The report is attached.
We'll disregard this one.
Leave driver verifier enabled for 24 hours and upload all the reports.
But keeping the driver verifier enabled, I can only login using the safemode.
I deseleted the 'uxpatch.sys', and select all the other non-microsoft drivers, I had successfully enter the windows once. Then, I put the PC to sleep, the BSOD came, but when I restart, I can no longer get into windows again, the system gave me another BSOD right after I login windows. The report is here!
All the recent BSOD-s with verifier were caused by Protectora.sys: Protectora.sys driver | What is Protectora.sys file?
Update or remove them completely if required.
Code:******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {fffff8000356447c, 2, 8, fffff8000356447c} *** WARNING: Unable to verify timestamp for ProtectorA.sys *** ERROR: Module load completed but symbols could not be loaded for ProtectorA.sys Probably caused by : ProtectorA.sys ( ProtectorA+31e2 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: fffff8000356447c, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000008, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff8000356447c, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034fc100 GetUlongFromAddress: unable to read from fffff800034fc1c0 fffff8000356447c Nonpaged pool CURRENT_IRQL: 2 FAULTING_IP: nt!RtlCompareUnicodeString+0 fffff800`0356447c 4883ec38 sub rsp,38h CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP BUGCHECK_STR: 0xA PROCESS_NAME: System TRAP_FRAME: fffff880035af560 -- (.trap 0xfffff880035af560) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffffa8007ffcbf0 rbx=0000000000000000 rcx=fffffa8007ffcc28 rdx=fffff880035af790 rsi=0000000000000000 rdi=0000000000000000 rip=fffff8000356447c rsp=fffff880035af6f8 rbp=0000000000000000 r8=fffffa800ca32201 r9=0000000000000150 r10=fffff80003440e80 r11=fffffa8006725040 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc nt!RtlCompareUnicodeString: fffff800`0356447c 4883ec38 sub rsp,38h Resetting default scope LAST_CONTROL_TRANSFER: from fffff800032c31e9 to fffff800032c3c40 FAILED_INSTRUCTION_ADDRESS: nt!RtlCompareUnicodeString+0 fffff800`0356447c 4883ec38 sub rsp,38h STACK_TEXT: fffff880`035af418 fffff800`032c31e9 : 00000000`0000000a fffff800`0356447c 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx fffff880`035af420 fffff800`032c1e60 : fffffa80`0c7b1110 00000000`00000008 fffffa80`0c7d0f20 fffffa80`0ca26d20 : nt!KiBugCheckDispatch+0x69 fffff880`035af560 fffff800`0356447c : fffff880`0a8bd1e2 00000000`00000000 fffff880`035af6c8 00000000`00000240 : nt!KiPageFault+0x260 fffff880`035af6f8 fffff880`0a8bd1e2 : 00000000`00000000 fffff880`035af6c8 00000000`00000240 00000000`00000000 : nt!RtlCompareUnicodeString fffff880`035af700 00000000`00000000 : fffff880`035af6c8 00000000`00000240 00000000`00000000 fffffa80`07ffcbf0 : ProtectorA+0x31e2 STACK_COMMAND: kb FOLLOWUP_IP: ProtectorA+31e2 fffff880`0a8bd1e2 ?? ??? SYMBOL_STACK_INDEX: 4 SYMBOL_NAME: ProtectorA+31e2 FOLLOWUP_NAME: MachineOwner MODULE_NAME: ProtectorA IMAGE_NAME: ProtectorA.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4cb80d7f FAILURE_BUCKET_ID: X64_0xA_VRF_CODE_AV_BAD_IP_ProtectorA+31e2 BUCKET_ID: X64_0xA_VRF_CODE_AV_BAD_IP_ProtectorA+31e2 Followup: MachineOwner --------- 0: kd> lmvm ProtectorA start end module name fffff880`0a8ba000 fffff880`0a8c3000 ProtectorA T (no symbols) Loaded symbol image file: ProtectorA.sys Image path: \??\C:\Windows\system32\drivers\ProtectorA.sys Image name: ProtectorA.sys Timestamp: Fri Oct 15 14:14:55 2010 (4CB80D7F) CheckSum: 0000D9E8 ImageSize: 00009000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Protectora.sys is the plug-in of a bank, I have uninstalled it. This time, I can do driver verifier and log in to Windows. But still, when I put the laptop to sleep, the BSOD came. Here is the report.
Crashing on UX patch.sys. Remove and see if that helps.
This tutorial USB Selective Suspend - Turn On or Off may help you:
To Disable Selective Suspend:
- open the control panel
- go to power options (you may have to set view to small icons)
- click change plan settings
- in the window that opens:
- click change plan settings
- click change advanced power settings, expand usb and ensure usb selective suspend is disabled.
The frequency of BSOD is reduced since I delete 'uxpatch.sys'. I need to observe several days and see whether this issue has been completely solved.