Massive amounts of BSODs on boot, multiple errors; BE, 18, 7E, 0A

Alphasoldier · Feb 23, 2012

Hello Windows 7 Forum,

I work at the IT department of a school where we have around 600 PC's that need to be maintained. Most things break by the kids and most is fixed my replacing, or simply imaging said computers again.
However, after having switched over from Windows XP to Windows 7 we've been having masses of BSODs when loading Windows. Not just the normal PC's, not just linked to one type (although pretty much everything is from HP). But it keeps happening.

The most common errors that we've been able to discover are:
0x00000018, 0x0000000A, 0x0000007E, 0x000000BE
After having researched these things, they all turned out to have something to do with drivers, not only that, but when trying to boot into safe mode the PC's would all freeze at "classpnp.sys" and sometimes reboot shortly after.

Our current solution is simply putting a new Windows 7 image over the computer and it'll work another day or two. It's great that it works again then, but we spend too much time on it.

As thus I come here, I want to avoid this problem. It can't possibly be the hardware, there are too many different kinds of computers for it to be that. I'm quite sure the problem is somewhere originating from the drivers we install, but then he question comes as to what ruins the drivers? Not to mention that there are also different drivers for the different kinds of PC's.

If I'm lacking any information please tell me. Thank you for your time.

ePeen · Feb 23, 2012

Hello Alpha, welcome to SevenForums!

This is going to be relatively tricky for us to help you with since it's on such a massive scale of computers. Is there any possible way you can grab a few dump files from any computer? Regardless, would it be possible for you to get one of the school PCs to boot into safe mode? If you can, see if it stops at CLASSPNP.SYS when it's loading all of the drivers.

Since you've mentioned ever since your school moved over to Windows 7, the issues started happening, I doubt it's a massive hardware related issue, but probably a bad image that you guys are using to install. Have you guys tried a BRAND new image / disc to see if its the current that is at fault?

Alphasoldier · Feb 23, 2012

It indeed locks up on classpnp.sys when booting in safe mode, I should have been more specific, my bad.

Otherwise, I'm not entirely sure how to make/get a minidump or do anything that's described in the instructions topic seeing I don't get into windows at all. I suppose I could get the HDD of the BSODing computer, I shall do that now.

As further information, I've also had a few computers, 4 so far, where the date reset to 2099. This is an issue that has come over the last week while this issue has been going for at least 3 months now. I'm not sure if this is related, but I figure any additional information is helpful.

I'll post again once I retrieved the dump file.

ePeen · Feb 23, 2012

Sounds great

The date issue you mentioned, does the time switch as well? Those can just be a dying CMOS battery, simple and cheap fix.

Alphasoldier · Feb 23, 2012

Great, the forum just ate the reply I put in Quick reply, let's do this again, but shorter.

I was able to connect the HDD to my computer and had to turn it online, after that I was able to locate the MEMORY.DMP file, but it's a whopping 150mb. I'm quite sure that I shouldn't upload that much. I saw that I could adjust the memory dump file size to 256kb, but alas, I can't boot into windows to change this. Is there some configuration I could edit for it to change to that?

As for the date thing, the time was indeed off on 3 out of 4, I'm guessing the 4th got lucky with being turned back on at the right time or something. Either way, if it's indeed just the CMOS battery the solution would be nice. The sudden 4 in one week is what concerned me though. I thought it might have been related.

Anyway, my working day has come to an end, I'll return tomorrow, with hopefully a smaller memory dump, or a way to get the small out of the bigger dump.

ePeen · Feb 23, 2012

The reasoning for it being that large is it is likely a full memory dump rather than a small, it contains much more information, thus the increase in size.

Sounds good man, keep us updated with any further information

Alphasoldier · Feb 24, 2012

Well, after a lot of hassle I found out that windows automatically saves minidumps as well. Yay for not readings things properly. After that I tried finding a program that would let me read the thing, but it redirected me to some windows thing that wouldn't let me download anything and I needed to get some subscription.
Then I also figured that I wouldn't know what to do with said decoded minidump file anyway, seeing I already know which codes it got.

So either way, uploaded it to dropbox, and here it is, please tell me you can figure out more than me.

http://dl.dropbox.com/u/5181268/021612-75671-01.dmp

EDIT: Well I finally got something through google, here's the debug report thing.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 00000000, Object type of the object whose reference count is being lowered
Arg2: 85c81a88, Object whose reference count is being lowered
Arg3: 00000002, Reserved
Arg4: 89a6df88, Reserved
    The reference count of an object is illegal for the current state of the object.
    Each time a driver uses a pointer to an object the driver calls a kernel routine
    to increment the reference count of the object. When the driver is done with the
    pointer the driver calls another kernel routine to decrement the reference count.
    Drivers must match calls to the increment and decrement routines. This bugcheck
    can occur because an object's reference count goes to zero while there are still
    open handles to the object, in which case the fourth parameter indicates the number
    of opened handles. It may also occur when the object’s reference count drops below zero
    whether or not there are open handles to the object, and in that case the fourth parameter
    contains the actual value of the pointer references count.

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x18

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8327fd22 to 832e5f2c

STACK_TEXT:  
8ac53cc8 8327fd22 00000018 00000000 85c81a88 nt!KeBugCheckEx+0x1e
8ac53cec 8327fcd0 85c81a88 8341b477 84fd3a70 nt!ObfDereferenceObjectWithTag+0x4b
8ac53cf4 8341b477 84fd3a70 8ac53d50 83284aab nt!ObfDereferenceObject+0xd
8ac53d00 83284aab 85fd70b0 00000000 84fd3a70 nt!IopProcessWorkItem+0x34
8ac53d50 8340ff64 00000001 94fb1975 00000000 nt!ExpWorkerThread+0x10d
8ac53d90 832b8219 8328499e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ObfDereferenceObjectWithTag+4b
8327fd22 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ObfDereferenceObjectWithTag+4b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4d9fd753

FAILURE_BUCKET_ID:  0x18_CORRUPT_REF_COUNT_nt!ObfDereferenceObjectWithTag+4b

BUCKET_ID:  0x18_CORRUPT_REF_COUNT_nt!ObfDereferenceObjectWithTag+4b

Followup: MachineOwner
---------

Alphasoldier · Mar 7, 2012

More than a week has passed, has anyone gotten the chance to look at this?
The problem still occurs on many computers.

writhziden · Mar 7, 2012

Sorry your thread was lost in the mix...

Please follow the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html to give us the best information possible so we can give specific troubleshooting steps.

Thank you.

Alphasoldier · Mar 7, 2012

I'm not quite sure how to follow a guide that tell me to do things on the computer when I can't even boot the computer into windows, which is the whole problem here.
And I'm quite sure that doing all those steps on a functioning PC is not going to help.

I already uploaded the minidump file and the added information. Is there anything else I can obtain?

Everything is being run on a Windows 7 Enterprise x86, there's several different machines. Ones that were designed for windows 7 and others that aren't supported by HP itself anymore seeing they were made for XP, we did however at least put in the minimum required hardware in the older machines.

writhziden · Mar 7, 2012

What drivers/software are common for all systems? Can you provide a list?

Are you having problems with the systems designed for Windows 7, as well?

Alphasoldier · Mar 8, 2012

Alright, the software list of all programs that aren't -not- used.

Adobe Acrobat
Adobe Air
Adobe Master Collection CS5 (All installed)
Adobe Shockwave
Coach 6
Java
LanSchool
Microsoft Office (All installed)
Microsoft Silverlight
Quicktime
Symantec
TestCenter
VLC media player
Windows Live Essentials (All installed)

I'm not sure where to get a driver list, most (if not all) drivers are automatically downloaded from Windows.com. Otherwise they're from HP themselves.

And yes the bluescreens also happen on the machines -designed- for windows 7.

writhziden · Mar 8, 2012

Any chance you could follow the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html on a set of the machines and provide us with the reports? I realize this is difficult when managing machines that are often in use, but it would give us driver information to look at. Can any of the malfunctioning systems boot into Windows 7 safe mode?

Alphasoldier · Mar 8, 2012

I've had a -few- cases where I could use the option of 'Using last correct settings' when pressing F8, where they then would boot to windows, I suppose I could try doing the posting instructions on one of those machines.

Safe boot however makes it hang after classpnp.sys, which, after having tried this on a 'healthy' computer is right when windows is about to start.

Seeing I'm not at work right now I'll try to posts my results tomorrow.

writhziden · Mar 8, 2012

That's fine, we'll look them over after you post them.

Alphasoldier · Mar 9, 2012

I believe this is what you're after.
Mind you, the whole thing about the smartcard is nonsense, seeing we disconnect all of those. It's definitely not the causing thing, already tested it with and without it.

I hope you'll be able to understand all this, because I sure didn't.

writhziden · Mar 9, 2012

Problem Devices:

Code:

Smartcard SCFILTER \ CID_56346376 \ & 0 & 7 & 134B9E97 EUTRON_CRYPTOIDENTITY_CCID_0_SCFILTER_CID_56346376 The drivers for this device are not installed.

Code:

Loading Dump File [D:\Kingston\BSODDmpFiles\Alphasoldier\Windows_NT6_BSOD_jcgriff2\Windows_NT6_BSOD_jcgriff2\012712-80562-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17592.x86fre.win7sp1_gdr.110408-1631
Machine Name:
Kernel base = 0x82e38000 PsLoadedModuleList = 0x82f814d0
Debug session time: Fri Jan 27 03:55:11.906 2012 (UTC - 7:00)
System Uptime: 0 days 0:00:28.062
Loading Kernel Symbols
...............................................................
.......................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {12, 2, 0, 82e5a9ce}

*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
Probably caused by : cng.sys ( cng!CcnCancelSubscriptionProcess+28 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000012, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82e5a9ce, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82fa1848
Unable to read MiSystemVaType memory at 82f80e20
 00000012 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IoBoostThreadIoPriority+c1
82e5a9ce 8a4812          mov     cl,byte ptr [eax+12h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  autochk.exe

TRAP_FRAME:  8c6819a4 -- (.trap 0xffffffff8c6819a4)
ErrCode = 00000000
eax=00000000 ebx=888031a8 ecx=8c681a68 edx=82f9f0fc esi=00000018 edi=00000020
eip=82e5a9ce esp=8c681a18 ebp=8c681ac8 iopl=0         nv up ei pl nz ac pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010217
nt!IoBoostThreadIoPriority+0xc1:
82e5a9ce 8a4812          mov     cl,byte ptr [eax+12h]      ds:0023:00000012=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82e5a9ce to 82e795cb

STACK_TEXT:  
8c6819a4 82e5a9ce badb0d00 82f9f0fc 000000b0 nt!KiTrap0E+0x2cf
8c681ac8 82efcc33 00000000 00000002 00000000 nt!IoBoostThreadIoPriority+0xc1
8c681afc 82e6d9ff 00000002 82f62d20 85884298 nt!ExpCheckForIoPriorityBoost+0x8e
8c681b44 82eb96b6 88805736 85884298 85ee7d48 nt!ExpWaitForResource+0x7b
8c681b94 889ae633 85884298 00000001 85ee7d48 nt!ExAcquireResourceExclusiveLite+0x1cf
8c681bb0 889a3690 85884298 85ee5d40 8c681bd0 cng!CcnCancelSubscriptionProcess+0x28
8c681bc0 8899ddbf 85ee5d40 85ee5d40 8c681bfc cng!ConfigProcessTerminationHandler+0x13
8c681bd0 830937f8 00000110 0000011c 00000000 cng!CngCreateProcessNotifyRoutine+0x29
8c681bfc 830a162d 00000001 01ee5d40 925e3f43 nt!PspExitProcess+0xa3
8c681c78 83093bbd 00000000 c0000001 942ec9f8 nt!PspExitThread+0x59a
8c681ca0 8dbb06d9 ffffffff 00000000 85df8268 nt!NtTerminateProcess+0x1fa
WARNING: Stack unwind information not available. Following frames may be wrong.
8c681d24 82e761ea ffffffff 00000000 0015fc80 SYMEVENT+0x146d9
8c681d24 00000000 ffffffff 00000000 0015fc80 nt!KiFastCallEntry+0x12a
8c681d94 00000000 770d70b4 0000001b 00000206 0x0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
cng!CcnCancelSubscriptionProcess+28
889ae633 83c738          add     edi,38h

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  cng!CcnCancelSubscriptionProcess+28

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: cng

IMAGE_NAME:  cng.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc427

FAILURE_BUCKET_ID:  0xA_cng!CcnCancelSubscriptionProcess+28

BUCKET_ID:  0xA_cng!CcnCancelSubscriptionProcess+28

Followup: MachineOwner
---------

The fact that one of these crashes points toward Symantec (Norton) leads me to believe the problem lies in the antivirus software installed on the machines. Norton is known to cause crashes on some systems.

Is it feasible to use a different antivirus? If so, I would recommend removing Norton off all machines using the Norton removal tool and replace it with Microsoft Security Essentials - Free Antivirus for Windows to run with Windows firewall.

Alphasoldier · Mar 9, 2012

It is not really all that feasible seeing I'm quite sure we have a running license on their product, me as an intern is not going to change that without concrete evidence.

How sure can one be on it being the antivirus?
And can it somehow be found out by all this data on how the blue screens could be triggered again, on purpose, so that I can show my employer this is the actual cause?

writhziden · Mar 9, 2012

Unfortunately, it is very difficult for us to help debugging in cases regarding multiple machines in which hardware testing is difficult to accomplish.

I cannot be sure it is the antivirus software, but that is one of the few items that seems to be the same across all systems based on your descriptions. The other crash files were fairly inconclusive and pointed to Windows system files; when the crashes do this, it typically means either a hardware problem or corrupted Windows files. The only conclusive crash indicated Norton, and Norton has been known to cause crashes that seem to be inconclusive, so it is possible Norton is also causing the other crashes that point to hardware or Windows file corruption. Unfortunately, without removing Norton to test, it is difficult to determine if it is definitely the cause of the other crashes.

Is there any hardware that is the same across all systems? RAM, a PCI card, etc.?

Alphasoldier · Mar 10, 2012

Well, all of the older systems gotten the same RAM upgrade, it has been suggested before that we match all the ram that are in all the machines. This however does not apply on the newer machines who also crash, who only have 1 stick of 2gb.
Then there's the smartcard reader, which if I recall correctly is almost in -every- machine. At least all the ones that crashed, but half of the time they're not connected, including on the crashing systems.

There -is- one case, of a laptop that first kept crashing on the image we used, over and over. Then we manually installed it and it didn't crash anymore. I'll ask that person if he also installed the AV or if he installed Security Essentials.

When looking back at how random all the crashes are, it does seem most likely that Norton's the cause. The other thing we thought about is students plugging in several different USB sticks. Which drivers always need to be properly installed, or so windows always tells me when I plug in my USB stick. And that it creates a fault in the drivers which are loaded up next time. Is this a possible cause, or should I let that rest?

Now for another question... would it help if I'd get reports off multiple machines? This might take some time, but if it'll help finding the cause I'm more than willing to do this.

Oh and my employer created another image in the hope that this would stop the crashing, we'll have to wait and see if this works.

Massive amounts of BSODs on boot, multiple errors; BE, 18, 7E, 0A

New member

My Computer My Computer

Banned

My Computer My Computer

New member

My Computer My Computer

Banned

My Computer My Computer

New member

My Computer My Computer

Banned

My Computer My Computer

New member

My Computer My Computer

New member

My Computer My Computer

Closed by request.

My Computer My Computer

New member

My Computer My Computer

Closed by request.

My Computer My Computer

New member

My Computer My Computer

Closed by request.

My Computer My Computer

New member

My Computer My Computer

Closed by request.

My Computer My Computer

New member

My Computer My Computer

Closed by request.

My Computer My Computer

New member

My Computer My Computer

Closed by request.

My Computer My Computer

New member

My Computer My Computer

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer