Solved New Guy here with BSOD ;)

A Guy · Apr 27, 2013

Hello, I'm new here, and have a BSOD issue. I hear you are good at this stuff

Let me say this is random, and not urgent, so no hurry. I can actually live with it for now, but they are becoming more frequent.

About a month ago is when I got my first BSOD. On startup, it got past the POST screen, and started on welcome to windows, then as the desktop started loading, it BSOD'd. On restart I chose start normally, and on I went. This has mostly been the pattern when it has happened since. On cold boot, and often different causes. I had 2 yesterday in a row, and the attached will have those.

Just before posting this I had one while replying to a PM, 1st time I have had one while already in windows. It stuck on the blue screen, and never restarted, so I grabbed a picture. I had to press the power button to shut down, so I'm assuming that dump wasn't collected.

Let me know if you want me to set my system for full dump. I'll post more dumps if necessary, whatever you tell me. Looking forward to your expertise, thanks in advance. A Guy

View attachment 265813

DocBrown · Apr 27, 2013

Hello A Guy,

Sorry to hear about this, but since you say it is not urgent, one of our BSOD team members will get Back to you in the Future.

carwiz · Apr 27, 2013

tdrpm258.sys - Try & Decide Volume Filter Driver from Acronis

This driver is causing tcpip.sys to time out.

You might check to see if Acronis has an update. I never did care for their VM implementation.

A Guy · Apr 27, 2013

I am using TI2010, and it doesn't include updates. I don't use the try and decide feature, I just make imagaes every weekend. Not sure if I can disable the try and decide, or delete that .sys? Is that showing as the cause of the BSOD, or just something that's happening you are noticing? thanks Ken

A Guy

Edit: Try and decide is already turned off.

carwiz · Apr 27, 2013

I was using it on my XP machine a couple of years ago. It sort of worked ok but took too long to run the keep changes. From what I recall, you had to turn it on and off then make a choice to keep or flush the software you were testing. It wasn't meant to run all the time. I'm not sure why it caught tcpip with it's pants down except on the return, the address was corrupt.

It was definitely running: tdrpm258.sys Tue Oct 20 02:39:53 2009

Perhaps it was trying to phone home.

Added:
I'm not familiar with Avast but does it monitor outbound comm. Tcpip tried to release a locked hash.
Here's the stack trace.

Code:

STACK_TEXT:  
fffff800`04e0c358 fffff800`030c61a9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`04e0c360 fffff800`030c4e20 : fffff880`06fda9e0 fffff800`030a7490 00000000`00000000 fffffa80`060e7f80 : nt!KiBugCheckDispatch+0x69
fffff800`04e0c4a0 fffff800`030d235c : fffff880`01f6dd40 fffffa80`060d3840 fffff880`62615448 00000000`0000ffff : nt!KiPageFault+0x260
fffff800`04e0c630 fffff880`01e87869 : fffffa80`060e7f80 fffffa80`060e7b58 fffff880`01f6dd40 00000000`00000000 : nt!RtlContractHashTable+0x10c
fffff800`04e0c660 fffff880`01e876ac : fffffa80`06fbd900 fffffa80`060e7b58 fffff800`04e0c800 fffffa80`060e6fc0 : tcpip!IppRestructureHashTableUnderLock+0x39
fffff800`04e0c690 fffff880`01e87ce3 : fffffa80`060e7b58 fffff800`04e0c800 00000000`0000ffff fffff880`01e87483 : tcpip!IppPathSetTimeout+0x7d
fffff800`04e0c700 fffff880`01e884b9 : fffff800`04e0c800 fffff800`04e0c848 00000000`0000ffff fffffa80`075b0b50 : tcpip!IppCompartmentSetTimeout+0x63
fffff800`04e0c770 fffff800`030d184c : 00000000`0000ffff 00000000`00000000 00000000`00000003 fffff800`04e0c800 : tcpip!IppTimeout+0x89
fffff800`04e0c7a0 fffff800`030d16e6 : fffffa80`06329ba0 00000000`00000240 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
fffff800`04e0c810 fffff800`030d15ce : 00000000`055b570d fffff800`04e0ce88 00000000`00000240 fffff800`03244a88 : nt!KiProcessExpiredTimerList+0xc6
fffff800`04e0ce60 fffff800`030d13b7 : fffffa80`06cb92c3 fffffa80`00000240 00000000`00000000 00000000`00000040 : nt!KiTimerExpiration+0x1be
fffff800`04e0cf00 fffff800`030c9d05 : 00000000`00000000 fffffa80`075b0b50 00000000`00000000 fffff880`01c1e800 : nt!KiRetireDpcList+0x277
fffff800`04e0cfb0 fffff800`030c9b1c : fffffa80`06186c90 fffff800`03012895 fffff800`03038460 fffff880`03283720 : nt!KxRetireDpcList+0x5
fffff880`03283660 fffff800`03111b53 : fffff800`030c3180 fffff800`030c31ec fffff880`032836a0 fffff880`032836a0 : nt!KiDispatchInterruptContinue
fffff880`03283690 fffff800`030c31ec : fffff880`032836a0 fffff880`032836a0 00000000`00000000 00000000`00000000 : nt!KiDpcInterruptBypass+0x13
fffff880`032836a0 fffff880`0229da19 : fffff880`02296c73 fffffa80`074e8010 fffffa80`0633c010 fffffa80`074e3010 : nt!KiInterruptDispatchNoLock+0x1fc
fffff880`03283838 fffff880`02296c73 : fffffa80`074e8010 fffffa80`0633c010 fffffa80`074e3010 fffffa80`076a4cb0 : tdrpm258+0x53a19
fffff880`03283840 fffffa80`074e8010 : fffffa80`0633c010 fffffa80`074e3010 fffffa80`076a4cb0 00000000`00000000 : tdrpm258+0x4cc73
fffff880`03283848 fffffa80`0633c010 : fffffa80`074e3010 fffffa80`076a4cb0 00000000`00000000 00000000`00000008 : 0xfffffa80`074e8010
fffff880`03283850 fffffa80`074e3010 : fffffa80`076a4cb0 00000000`00000000 00000000`00000008 fffffa80`076ae860 : 0xfffffa80`0633c010
fffff880`03283858 fffffa80`076a4cb0 : 00000000`00000000 00000000`00000008 fffffa80`076ae860 fffff880`02294792 : 0xfffffa80`074e3010
fffff880`03283860 00000000`00000000 : 00000000`00000008 fffffa80`076ae860 fffff880`02294792 fffffa80`076b1010 : 0xfffffa80`076a4cb0

carwiz · Apr 27, 2013

I forgot to add that if you're not familiar with stacking, the most recent event is on top. So you read the sequences from bottom to top. You can see TDRPM258 making a Deferred Procedure Call (DPC) then timing out.

A Guy · Apr 27, 2013

Ken, that's all great, but what does it mean to me

Is that driver, and the timing out, a cause of my BSOD?

A Guy

carwiz · Apr 27, 2013

Yes. If no update, remove Try & Decide. It's pretty old anyway.

A Guy · Apr 27, 2013

Try and Decide is a part of TI, not separate, and it's off. I should be able to set tdrpm258.sys not to start in the registry. I'll make a test image, then set it to not start, and make another and see if it breaks TI. Thanks.

A Guy

Arc · Apr 28, 2013

Bill, my friend, its bad to see you having BSODs.

The picture you uploaded reveals a stop 0x101, clock watchdog timeout. But it is not contained in the uploaded zip .... both the crash dumps of the uploaded zips are Stop 0XA, IRQL_NOT_LESS_OR_EQUAL.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {8, 2, 1, fffff800030d235c}

*** WARNING: Unable to verify timestamp for tdrpm258.sys
*** ERROR: Module load completed but symbols could not be loaded for tdrpm258.sys
[COLOR=Red]Probably caused by : tcpip.sys[/COLOR] ( tcpip!IppRestructureHashTableUnderLock+39 )

Followup: MachineOwner
==================================================================
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {8, 2, 1, fffff8000309335c}

[COLOR=Red]Probably caused by : tcpip.sys[/COLOR] ( tcpip!IppRestructureHashTableUnderLock+39 )

Followup: MachineOwner
---------

You can see that both are showing that it is tcpip.sys, Microsoft TCP/IP Driver, related with networking. So it is something there that is blocking networking.

A network blockage is usually caused by either a failing network adapter driver, or by a third party firewall, or by a third party antivirus (specially if network and storage both the functions fail simultaneously) or in some cases it is a broken adapter physically. So let us check the dumps in depth now.

The Realtek PCIe GBE Family Controller Driver is failing there.

Code:

fffff800`00b9c8d8  fffff880`056e8cd8Unable to load image [URL="http://www.carrona.org/drivers/driver.php?id=Rt64win7.sys"]Rt64win7.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=Rt64win7.sys"]Rt64win7.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=Rt64win7.sys"]Rt64win7.sys[/URL]
 Rt64win7+0x6cd8

Here's is the timestrap of the driver ..... it is not up to date.

Code:

fffff880`056e2000 fffff880`05789000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: Rt64win7.sys
 [COLOR=Red]   Image name: Rt64win7.sys
    Timestamp:        Thu Feb 16 11:09:50 2012[/COLOR] (4F3C96A6)
    CheckSum:         000AE838
    ImageSize:        000A7000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it from Realtek

At the same time, we are seeing that COMODO Firewall Pro Firewall Driver is also failing.

Code:

fffff800`00b9c858  fffff880`021ebe96Unable to load image [URL="http://www.carrona.org/drivers/driver.php?id=inspect.sys"]inspect.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=inspect.sys"]inspect.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=inspect.sys"]inspect.sys[/URL]
 inspect+0x10e96

And COMODO Firewall Pro Sandbox Driver .....

Code:

fffff880`03282a38  fffff880`04e0d401Unable to load image [URL="http://www.carrona.org/drivers/driver.php?id=cmdguard.sys"]cmdguard.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=cmdguard.sys"]cmdguard.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=cmdguard.sys"]cmdguard.sys[/URL]
 cmdguard+0xd401

And avast! File System Minifilter Driver

Code:

fffff880`032829c8  fffff880`07fceda7Unable to load image [URL="http://www.carrona.org/drivers/driver.php?id=aswMonFlt.sys"]aswMonFlt.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=aswMonFlt.sys"]aswMonFlt.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=aswMonFlt.sys"]aswMonFlt.sys[/URL]
 aswMonFlt+0x21da7

And avast! Virtualization Driver

Code:

fffff880`032825f8  fffff880`04f05f02Unable to load image [URL="http://www.carrona.org/drivers/driver.php?id=aswSnx.SYS"]aswSnx.SYS[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=aswSnx.SYS"]aswSnx.SYS[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=aswSnx.SYS"]aswSnx.SYS[/URL]
 aswSnx+0x6f02

In such a situation, it is better to uninstall Comodo and Avast (comodo firewall pro is not only a firewall but it gives a real time protection too, a conflict between Avast, Avira and Comodo is most possible). Better you use MSE with Windows firewall. Using it myself, it's all good I can say with certainty

Finally, a little error is there which should not be overlooked.

Code:

fffff800`00b9cd98  fffff880`0103d4c0 [COLOR=Red]SCSIPORT[/COLOR]!ScsiPortCompletionDpc

I am seeing that your JMicron JMB36X Controller is outdated.

Code:

fffff880`00e56000 fffff880`00e77000   jraid      (deferred)             
    Image path: jraid.sys
[COLOR=Red]    Image name: jraid.sys
    Timestamp:        Thu May 19 13:25:18 2011[/COLOR] (4DD4CCE6)
    CheckSum:         00029667
    ImageSize:        00021000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it from ftp://driver.jmicron.com.tw/SATA_Controller/Windows/

And, make it sure that the Intel X25-M 80 GB SSD is running with the updated firmware. Frankly speaking, I dont know how to check it from the dump data

Wish you all the best, my/our friend.

koolkat77 · Apr 28, 2013

Hey Bill, I've gone through your dumps and would note the analysis exactly posted by Arc.
Let us know if your system is stable after making those changes!

Best of Luck!

A Guy · Apr 28, 2013

Thanks you two

Don't be offended if I am a bad patient and only try part of what you suggest

I am not wont to remove Comodo or Avast. I'd rather keep them and have an occasional problem. If the problem gets to be regular, I'd consider it. I'll look into the rest, thanks for the thorough analysis, I'll keep you updated. A Guy

P.S. Arc, the picture was of the BSOD that stuck and wouldn't reboot, as I mentioned. Had to power down with the power button, and I assume no dump was created because of it.

Arc · Apr 28, 2013

A Guy said:
Thanks you two Don't be offended if I am a bad patient and only try part of what you suggest I am not wont to remove Comodo or Avast. I'd rather keep them and have an occasional problem. If the problem gets to be regular, I'd consider it. I'll look into the rest, thanks for the thorough analysis, I'll keep you updated. A Guy

P.S. Arc, the picture was of the BSOD that stuck and wouldn't reboot, as I mentioned. Had to power down with the power button, and I assume no dump was created because of it.

Dont worry, Bill

We already know that you will not uninstall Comodo and Avast

But time will come

A Guy · Apr 28, 2013

Well, that was fun (not your fault). Realtek driver caused no internet. Several different BSOD after while trying to do system restore. Restored an Acronis image I made earlier today. So back where I started again. Realized chkdsk was trying to run as I tried to get into safe mode. Booted into windows, let chkdsk run. Reinstalled latest version of Acronis 2010, renamed the tdrpm258.sys Ken mentioned. Will attempt the drivers again. BTW, yes my SSD has latest firmware. A Guy

Arc · Apr 28, 2013

A Guy said:
Well, that was fun (not your fault). Realtek driver caused no internet. Several different BSOD after while trying to do system restore. Restored an Acronis image I made earlier today. So back where I started again. Realized chkdsk was trying to run as I tried to get into safe mode. Booted into windows, let chkdsk run. Reinstalled latest version of Acronis 2010, renamed the tdrpm258.sys Ken mentioned. Will attempt the drivers again. BTW, yes my SSD has latest firmware. A Guy

OMG :shock:
Which one you took? This one I guess?
Win7 and WinServer 2008 R2 Auto Installation Program (SID:1568649) : 2013/3/26

A Guy · Apr 28, 2013

Arc said:
A Guy said:

Well, that was fun (not your fault). Realtek driver caused no internet. Several different BSOD after while trying to do system restore. Restored an Acronis image I made earlier today. So back where I started again. Realized chkdsk was trying to run as I tried to get into safe mode. Booted into windows, let chkdsk run. Reinstalled latest version of Acronis 2010, renamed the tdrpm258.sys Ken mentioned. Will attempt the drivers again. BTW, yes my SSD has latest firmware. A Guy

Click to expand...

OMG :shock:
Which one you took? This one I guess?
Win7 and WinServer 2008 R2 Auto Installation Program (SID:1568649) : 2013/3/26

Yeah, tried that one again, used the silent installer.bat. Can you confirm it updated it?

View attachment 265841

Thanks

A Guy

Britton30 · Apr 28, 2013

Bill are you running Avast with Commodo A/V?

Arc · Apr 28, 2013

Yes, Bill. The driver is up to date now

Code:

RTL8167      Realtek 8167 NT Driver Kernel        [B]3/3/2013[/B] 11:25:55 PM

The date difference between the release date and timestrap is totally normal.

Is it connected to network rightly now?

For any further issue, all your friends are here.

A Guy · Apr 28, 2013

Britton30 said:
Bill are you running Avast with Commodo A/V?

No, Comodo Firewall

Arc said:
Yes, Bill. The driver is up to date now

Code:

RTL8167 Realtek 8167 NT Driver Kernel [B]3/3/2013[/B] 11:25:55 PM

The date difference between the release date and timestrap is totally normal.

Is it connected to network rightly now?

For any further issue, all your friends are here.

Yes, connected no problem. Thanks, updated both drivers, and finally updated to the latest Comodo firewall. Get 340/340 on firewall leak test now. Stealth at Shields Up. With these changes, we'll see how it goes. Appreciate your time and expertise

A Guy

Arc · Apr 28, 2013

Ok Bill

Let us know the updated situation when you like

Solved New Guy here with BSOD ;)

Righteous Dude

My Computer My Computer

At a glance

Crazy Scientific Senior

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Righteous Dude

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Righteous Dude

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Righteous Dude

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Righteous Dude

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Righteous Dude

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Righteous Dude

My Computer My Computer

At a glance

R.I.P. 7/09/2014

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Righteous Dude

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer