Blue Screen of Death --Fix Needed--

Error code 8E, KERNEL_MODE_EXCEPTION_NOT_HANDLED_M - usual causes are Insufficient disk space, Device driver, Video card, BIOS, Breakpoint in startup without having a debugger attached, Hardware incompatibility, Faulty system service, 3rd party remote control, Memory.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_082610-26176-01.zip\082610-26176-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82a52000 PsLoadedModuleList = 0x82b9a810
Debug session time: Wed Aug 25 21:36:02.525 2010 (GMT-4)
System Uptime: 0 days 0:01:12.507
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
.....
Unable to load image \SystemRoot\System32\Drivers\US4Vista.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for US4Vista.sys
*** ERROR: Module load completed but symbols could not be loaded for US4Vista.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 8b5d35ee, 9fcfcb10, 0}

Probably caused by : US4Vista.sys ( US4Vista+15ee )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8b5d35ee, The address that the exception occurred at
Arg3: 9fcfcb10, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
US4Vista+15ee
8b5d35ee 8b490c          mov     ecx,dword ptr [ecx+0Ch]

TRAP_FRAME:  9fcfcb10 -- (.trap 0xffffffff9fcfcb10)
ErrCode = 00000000
eax=86b04464 ebx=86b04388 ecx=00000010 edx=86b04388 esi=8748f7d8 edi=00000000
eip=8b5d35ee esp=9fcfcb84 ebp=9fcfcba8 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
US4Vista+0x15ee:
8b5d35ee 8b490c          mov     ecx,dword ptr [ecx+0Ch] ds:0023:0000001c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  PDEngine.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8b5d579a to 8b5d35ee

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
9fcfcba8 8b5d579a 8748f7d8 00000000 9fcfcbd0 US4Vista+0x15ee
9fcfcbb8 82a8e4bc 8748f720 86b04388 86b04388 US4Vista+0x379a
9fcfcbd0 8ae813e8 87473b38 00000000 86ba3b30 nt!IofCallDriver+0x63
9fcfcbfc 82a8e4bc 87473b38 86b04388 86b04388 fltmgr!FltpDispatch+0xe2
9fcfcc14 82c8ff2e 86ba3b30 86b04388 86b04464 nt!IofCallDriver+0x63
9fcfcc34 82cacd11 87473b38 86ba3b30 00000000 nt!IopSynchronousServiceTail+0x1f8
9fcfccd0 82caf4ec 87473b38 86b04388 00000000 nt!IopXxxControlFile+0x6aa
9fcfcd04 82a9544a 00000224 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
9fcfcd04 770b64f4 00000224 00000000 00000000 nt!KiFastCallEntry+0x12a
00cbeb00 00000000 00000000 00000000 00000000 0x770b64f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
US4Vista+15ee
8b5d35ee 8b490c          mov     ecx,dword ptr [ecx+0Ch]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  US4Vista+15ee

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: US4Vista

IMAGE_NAME:  US4Vista.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a26569c

FAILURE_BUCKET_ID:  0x8E_US4Vista+15ee

BUCKET_ID:  0x8E_US4Vista+15ee

Followup: MachineOwner
---------

This is a hardware or hardware related error. The dump showed c0000005 which indicates memory corruption. You have some obsolete drivers on your system which can cause memory corruption. The dump specifiaclly pointed to this driver, US4Vista.sys. Update these drivers.

bcm4sbxp.sys Tue Nov 21 07:25:43 2006
bcmwl6.sys Thu Mar 26 20:58:48 2009
nvlddmkm.sys Fri Jan 30 04:35:44 2009
pcouffin.sys Tue Dec 05 09:39:53 2006
rimmptsk.sys Wed Nov 15 03:16:23 2006
rimsptsk.sys Tue Nov 14 22:42:45 2006
rixdptsk.sys Tue Nov 14 20:35:19 2006
stwrt.sys Thu Sep 13 11:29:43 2007
US4Vista.sys Wed Jun 03 06:55:24 2009
VSTAZL3.SYS Wed Oct 15 20:30:03 2008
VSTCNXT3.SYS Wed Oct 15 20:29:13 2008
VSTDPV3.SYS Wed Oct 15 20:32:04 2008

How To Find Drivers:
- I have listed links to most of the drivers in the code box below. Please use the links there to see what info I've found about those drivers.
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

If you need help, please post back. Once you have updated these drivers, reboot, run your system and update us on how you are doing. If you get another BSOD. please up load it and we will go from there.

Ken types faster than I . We both agree as to the analysis.

These two are right - this driver was called based on the nt!WmipRegLookaside list function that preceded it:

Code:

// Registers at the time of the dump:
1: kd> r
eax=86b04464 ebx=86b04388 ecx=00000010 edx=86b04388 esi=8748f7d8 edi=00000000
eip=8b5d35ee esp=9fcfcb84 ebp=9fcfcba8 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
US4Vista+0x15ee:
8b5d35ee 8b490c          mov     ecx,dword ptr [ecx+0Ch] ds:0023:0000001c=????????

// Raw stack, stack pointer to base:
1: kd> dds 9fcfcb84 9fcfcba8 
9fcfcb84  87473b38
9fcfcb88  8748f720
9fcfcb8c  00000000
9fcfcb90  00000224
9fcfcb94  9fcfcbd8
9fcfcb98  86ba3b18
9fcfcb9c  000001ff
9fcfcba0  86ba3a78
9fcfcba4  82b87800 nt!WmipRegLookaside+0x40
9fcfcba8  9fcfcbb8

// Driver predates Win7's RTM of July 22, 2009, so this is probably a Vista driver given the date and name:
1: kd> lmvim US4Vista
start    end        module name
8b5d2000 8b5ea000   US4Vista T (no symbols)           
    Symbol file: US4Vista.sys
    Image path: \SystemRoot\System32\Drivers\US4Vista.sys
    Image name: US4Vista.sys
    Timestamp:        Wed Jun 03 06:55:24 2009 (4A26569C)
    CheckSum:         000150C9
    ImageSize:        00018000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

// Code executing in US4Vista at the time of the crash:
1: kd> u eip
US4Vista+0x15ee:
8b5d35ee 8b490c          mov     ecx,dword ptr [ecx+0Ch]
8b5d35f1 894d0c          mov     dword ptr [ebp+0Ch],ecx
8b5d35f4 80380d          cmp     byte ptr [eax],0Dh
8b5d35f7 0f855b010000    jne     US4Vista+0x1758 (8b5d3758)
8b5d35fd 80780101        cmp     byte ptr [eax+1],1
8b5d3601 0f8551010000    jne     US4Vista+0x1758 (8b5d3758)
8b5d3607 682e035e8b      push    offset US4Vista+0xe32e (8b5e032e)
8b5d360c e81bc70000      call    US4Vista+0xdd2c (8b5dfd2c)

That Wmip function appears to be required for new device notifications in WMI, so this is probably doing the registry work to handle that. I'm making an educated guess that the driver is walking an array (mov ecx,dword ptr [ecx+0Ch]), storing the new "this" pointer (ASM looks generated from C or C++ code, probably C++) off to an offset location from the ebp register (mov dword ptr [ebp+0Ch],ecx), and then checking the results to verify the array walk to the next member was successful (cmp byte ptr [eax],0Dh). However, the array pointer itself is corrupt, meaning something probably blew up when the driver loaded itself.

As previous posters have stated, this thing needs to be updated to something that's Win7 compatible, or it needs to be removed. In looking at the Universal Shield website, they do have a release of the product from March 31st of this year that is Win7 compatible (supposedly).

Cool - if this is indeed fixed, please mark the thread as resolved so others can find it!

Yeah, that's a 116 bugcheck. Get the latest nvidia driver set installed, as yours is old by nvidia standards:

Code:

0: kd> lmvm nvlddmkm
start    end        module name
91615000 91d474c0   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        Fri Jan 30 04:35:44 2009 (4982C9F0)
    CheckSum:         007354C0
    ImageSize:        007324C0
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

If the problem continues after the latest driver is installed, follow the troubleshooting steps here for such a bugcheck. Also, please open a new thread for further analysis to keep these separate if this does continue. Thanks!