BSOD error for file Wdf01000.sys

dancrow · 03 May 2015

From time to time I have this blue screen error (see file attached)
Any suggestions?
Thank you!

Arc · 04 May 2015

Uninstall any Ulead product that you have installed, probably Ulead burning helper.

Report us for any further BSOD.
_________________________________

Code:

BugCheck 1000008E, {c0000046, 836c8e0f, baea74d0, 0}

*** WARNING: Unable to verify timestamp for ULCDRHlp.sys
*** ERROR: Module load completed but symbols could not be loaded for ULCDRHlp.sys
Probably caused by : ULCDRHlp.sys ( ULCDRHlp+30e4 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000046, The exception code that was not handled
Arg2: 836c8e0f, The address that the exception occurred at
Arg3: baea74d0, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000046 - An attempt to release a mutant object was made by a thread that was not the owner of the mutant object.

FAULTING_IP: 
nt!KeReleaseMutant+215
836c8e0f cc              int     3

TRAP_FRAME:  baea74d0 -- (.trap 0xffffffffbaea74d0)
ESP EDITED! New esp=baea7880
ErrCode = 00000000
eax=c0000046 ebx=866bbd48 ecx=87804200 edx=00000000 esi=878042ec edi=00000000
eip=836c8e0f esp=baea7544 ebp=baea78b8 iopl=0         nv up ei ng nz na po nc
cs=0000  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000282
nt!KeReleaseMutant+0x215:
836c8e0f cc              int     3
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  wmpnscfg.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

LAST_CONTROL_TRANSFER:  from 836c8bf1 to 836c8e0f

STACK_TEXT:  
baea78b8 836c8bf1 878042ec 00000001 00000000 nt!KeReleaseMutant+0x215
baea78d0 949400e4 878042ec 00000000 87805428 nt!KeReleaseMutex+0x14
WARNING: Stack unwind information not available. Following frames may be wrong.
baea78f0 9493da7f 0066f200 8367ec1e 878041e8 ULCDRHlp+0x30e4
baea7910 8cc41606 87805428 87357008 00000000 ULCDRHlp+0xa7f
baea7934 8cc417eb 8666f200 878055ac 8666f200 Wdf01000!FxPkgGeneral::OnClose+0x120
baea7954 8cc3e52e 8666f200 87806e08 8666f200 Wdf01000!FxPkgGeneral::Dispatch+0xc0
baea797c 8cc3e39f 00806e08 8666f200 8666f200 Wdf01000!FxDevice::Dispatch+0x155
baea7998 8367ec1e 87806e08 8666f200 00000800 Wdf01000!FxDevice::DispatchWithLock+0x77
baea79b0 83879be6 861275d0 889feeb0 00000000 nt!IofCallDriver+0x63
baea79f4 8386a7c9 889feec8 889feec8 889feeb0 nt!IopDeleteFile+0x10c
baea7a0c 836c0200 00000000 00000000 836c0163 nt!ObpRemoveObjectRoutine+0x59
baea7a20 836c0170 889feec8 8cdde7ac 00000000 nt!ObfDereferenceObjectWithTag+0x88
baea7a28 8cdde7ac 00000000 86ab40e8 86ab40e8 nt!ObfDereferenceObject+0xd
baea7a4c 8cddeb51 86ab40e8 00000000 baea7a80 mountmgr!QueryDeviceInformation+0x3fa
baea7a8c 8cde4be7 86ab40e8 baea7ab8 00000000 mountmgr!FindDeviceInfo+0x3f
baea7ae0 8cde65df 86ab40e8 867334e8 866dc508 mountmgr!MountMgrQueryDosVolumePaths+0x10d
baea7afc 8367ec1e 86ab4104 006d0034 867334e8 mountmgr!MountMgrDeviceControl+0xd3
baea7b14 83872bf9 866dc508 867334e8 86733558 nt!IofCallDriver+0x63
baea7b34 83875de2 86ab4030 866dc508 00000000 nt!IopSynchronousServiceTail+0x1f8
baea7bd0 838bc779 86ab4030 867334e8 00000000 nt!IopXxxControlFile+0x6aa
baea7c04 836858c6 000000f8 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
baea7c04 775270f4 000000f8 00000000 00000000 nt!KiSystemServicePostCall
01abf7d4 00000000 00000000 00000000 00000000 0x775270f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ULCDRHlp+30e4
949400e4 ??              ???

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  ULCDRHlp+30e4

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ULCDRHlp

IMAGE_NAME:  ULCDRHlp.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  41c9dd4d

FAILURE_BUCKET_ID:  0x8E_ULCDRHlp+30e4

BUCKET_ID:  0x8E_ULCDRHlp+30e4

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x8e_ulcdrhlp+30e4

FAILURE_ID_HASH:  {1e6a9ca6-67d5-9eff-5509-79f3b7d32db0}

Followup: MachineOwner
---------

0: kd> lmvm ULCDRHlp
start    end        module name
9493d000 94943b00   ULCDRHlp T (no symbols)           
    Loaded symbol image file: ULCDRHlp.sys
    Image path: \SystemRoot\System32\Drivers\ULCDRHlp.sys
    Image name: ULCDRHlp.sys
    Timestamp:        Thu Dec 23 02:17:09 2004 (41C9DD4D)
    CheckSum:         000081C3
    ImageSize:        00006B00
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
BugCheck 1000008E, {c0000046, 836c8e0f, baea74d0, 0}

*** WARNING: Unable to verify timestamp for ULCDRHlp.sys
*** ERROR: Module load completed but symbols could not be loaded for ULCDRHlp.sys
Probably caused by : ULCDRHlp.sys ( ULCDRHlp+30e4 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000046, The exception code that was not handled
Arg2: 836c8e0f, The address that the exception occurred at
Arg3: baea74d0, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000046 - An attempt to release a mutant object was made by a thread that was not the owner of the mutant object.

FAULTING_IP: 
nt!KeReleaseMutant+215
836c8e0f cc              int     3

TRAP_FRAME:  baea74d0 -- (.trap 0xffffffffbaea74d0)
ESP EDITED! New esp=baea7880
ErrCode = 00000000
eax=c0000046 ebx=866bbd48 ecx=87804200 edx=00000000 esi=878042ec edi=00000000
eip=836c8e0f esp=baea7544 ebp=baea78b8 iopl=0         nv up ei ng nz na po nc
cs=0000  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000282
nt!KeReleaseMutant+0x215:
836c8e0f cc              int     3
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  wmpnscfg.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

LAST_CONTROL_TRANSFER:  from 836c8bf1 to 836c8e0f

STACK_TEXT:  
baea78b8 836c8bf1 878042ec 00000001 00000000 nt!KeReleaseMutant+0x215
baea78d0 949400e4 878042ec 00000000 87805428 nt!KeReleaseMutex+0x14
WARNING: Stack unwind information not available. Following frames may be wrong.
baea78f0 9493da7f 0066f200 8367ec1e 878041e8 ULCDRHlp+0x30e4
baea7910 8cc41606 87805428 87357008 00000000 ULCDRHlp+0xa7f
baea7934 8cc417eb 8666f200 878055ac 8666f200 Wdf01000!FxPkgGeneral::OnClose+0x120
baea7954 8cc3e52e 8666f200 87806e08 8666f200 Wdf01000!FxPkgGeneral::Dispatch+0xc0
baea797c 8cc3e39f 00806e08 8666f200 8666f200 Wdf01000!FxDevice::Dispatch+0x155
baea7998 8367ec1e 87806e08 8666f200 00000800 Wdf01000!FxDevice::DispatchWithLock+0x77
baea79b0 83879be6 861275d0 889feeb0 00000000 nt!IofCallDriver+0x63
baea79f4 8386a7c9 889feec8 889feec8 889feeb0 nt!IopDeleteFile+0x10c
baea7a0c 836c0200 00000000 00000000 836c0163 nt!ObpRemoveObjectRoutine+0x59
baea7a20 836c0170 889feec8 8cdde7ac 00000000 nt!ObfDereferenceObjectWithTag+0x88
baea7a28 8cdde7ac 00000000 86ab40e8 86ab40e8 nt!ObfDereferenceObject+0xd
baea7a4c 8cddeb51 86ab40e8 00000000 baea7a80 mountmgr!QueryDeviceInformation+0x3fa
baea7a8c 8cde4be7 86ab40e8 baea7ab8 00000000 mountmgr!FindDeviceInfo+0x3f
baea7ae0 8cde65df 86ab40e8 867334e8 866dc508 mountmgr!MountMgrQueryDosVolumePaths+0x10d
baea7afc 8367ec1e 86ab4104 006d0034 867334e8 mountmgr!MountMgrDeviceControl+0xd3
baea7b14 83872bf9 866dc508 867334e8 86733558 nt!IofCallDriver+0x63
baea7b34 83875de2 86ab4030 866dc508 00000000 nt!IopSynchronousServiceTail+0x1f8
baea7bd0 838bc779 86ab4030 867334e8 00000000 nt!IopXxxControlFile+0x6aa
baea7c04 836858c6 000000f8 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
baea7c04 775270f4 000000f8 00000000 00000000 nt!KiSystemServicePostCall
01abf7d4 00000000 00000000 00000000 00000000 0x775270f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ULCDRHlp+30e4
949400e4 ??              ???

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  ULCDRHlp+30e4

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ULCDRHlp

IMAGE_NAME:  ULCDRHlp.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  41c9dd4d

FAILURE_BUCKET_ID:  0x8E_ULCDRHlp+30e4

BUCKET_ID:  0x8E_ULCDRHlp+30e4

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x8e_ulcdrhlp+30e4

FAILURE_ID_HASH:  {1e6a9ca6-67d5-9eff-5509-79f3b7d32db0}

Followup: MachineOwner
---------

0: kd> lmvm ULCDRHlp
start    end        module name
9493d000 94943b00   ULCDRHlp T (no symbols)           
    Loaded symbol image file: ULCDRHlp.sys
    Image path: \SystemRoot\System32\Drivers\ULCDRHlp.sys
    Image name: ULCDRHlp.sys
    Timestamp:        Thu Dec 23 02:17:09 2004 (41C9DD4D)
    CheckSum:         000081C3
    ImageSize:        00006B00
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

dancrow · 04 May 2015

Thank you very much for your answer.
Have no idea from where this "Ulead burning helper" Service comes from. I don't have any Ulead product on my computer.
Anyway, I disabled Ulead burning helper service. Will see what is happening.
Have a great day!