BSOD - Stop 0xC5

lielc · 28 Sep 2012

Hello,
My Toshiba laptop rebooted with no warning 4 times during the last week while I was watching streaming video. After I turned off the auto-reboot on system failure I've had 1 BSOD (while using chrome, iTunes and some other programs, nothing special really).

My specs:
Windows 7 Home Premium 64-bit
Processor: Intel(R) Core(TM) i3 CPU M 330 @ 2.13GHz , 3GB RAM

I have problems with my winzip but I already analysed the dump file with Windows Debugger, I really hope it will be enough for you:

Code:

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: fffffa800916f768, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff800033ac90d, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR:  0xC5_2

CURRENT_IRQL:  2

FAULTING_IP: 
nt!ExAllocatePoolWithTag+53d
fffff800`033ac90d 48895808        mov     qword ptr [rax+8],rbx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  uTorrent.exe

TRAP_FRAME:  fffff88006d08750 -- (.trap 0xfffff88006d08750)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800916f760 rbx=0000000000000000 rcx=fffffa8005859900
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800033ac90d rsp=fffff88006d088e0 rbp=fffff80003407880
 r8=0000000000000000  r9=fffff800034079d0 r10=fffff80003407888
r11=00000000000000ff r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!ExAllocatePoolWithTag+0x53d:
fffff800`033ac90d 48895808        mov     qword ptr [rax+8],rbx ds:fffffa80`0916f768=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032785a9 to fffff80003279040

STACK_TEXT:  
fffff880`06d08608 fffff800`032785a9 : 00000000`0000000a fffffa80`0916f768 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`06d08610 fffff800`03277220 : fffff880`00000000 fffff800`034079d0 fffff880`06d08780 fffff880`06d0877c : nt!KiBugCheckDispatch+0x69
fffff880`06d08750 fffff800`033ac90d : fffff880`06d08e00 fffffa80`02b51240 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
fffff880`06d088e0 fffff880`01951157 : fffff880`00000000 fffffa80`069c3fe0 fffff880`06d08ac8 fffff880`00000000 : nt!ExAllocatePoolWithTag+0x53d
fffff880`06d089d0 fffff880`01954887 : 00000000`00000003 fffff880`06d08a98 00000000`00000003 00000000`000007ff : NETIO!WfpPoolAllocNonPaged+0x17
fffff880`06d08a00 fffff880`019549a2 : 00000000`00000006 fffffa80`069c3fd0 00000000`00000000 00000000`00000000 : NETIO!ConvertValueToCondition+0x57
fffff880`06d08a30 fffff880`019544f5 : fffffa80`022c7b40 fffffa80`069c3f40 00000000`00000000 00000000`000000c0 : NETIO!ConvertTableToEnumTemplate+0x93
fffff880`06d08a90 fffff880`0195470d : 00000000`00000000 fffff880`06d08bfc fffff880`06d08ba0 fffff880`06d09040 : NETIO!ConstructNewCacheEntry+0x45
fffff880`06d08b10 fffff880`0194edae : 00000000`00000000 fffff880`06d09040 fffff880`06d08f40 00000000`00000000 : NETIO!ProcessCacheMiss+0x8d
fffff880`06d08b60 fffff880`02f0164b : fffff880`06d095c0 fffff880`06d08f28 fffff880`00000000 fffffa80`02b51240 : NETIO!KfdClassify+0xb31
fffff880`06d08ed0 fffff880`02e05d30 : 00000000`00000000 fffffa80`08a72ab0 fffffa80`02657a70 fffff880`00000000 : tcpip!WFPDatagramDataShimV4+0x49b
fffff880`06d09230 fffff880`02e39d49 : fffff880`06d094c8 fffffa80`02950856 fffffa80`05372c58 00000000`00000008 : tcpip! ?? ::FNODOBFM::`string'+0x2ac4f
fffff880`06d094a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!WfpProcessOutTransportStackIndication+0x329


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!WfpPoolAllocNonPaged+17
fffff880`01951157 488903          mov     qword ptr [rbx],rax

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  NETIO!WfpPoolAllocNonPaged+17

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4bbe946f

FAILURE_BUCKET_ID:  X64_0xC5_2_NETIO!WfpPoolAllocNonPaged+17

BUCKET_ID:  X64_0xC5_2_NETIO!WfpPoolAllocNonPaged+17

Followup: MachineOwner
---------

I removed uTorrent from Startup once I've seen this analysis (feels too easy for a solution, and I've used this program in years and never had a problem with it before..) but I don't really know what everything else means.. I'd appreciate your help. Thanks! :)

koolkat77 · 28 Sep 2012

Welcome

Please upload your msinfo32.nfo file. To get this:

Click on the Start
Type msinfo32 into the Search programs and files box
When it opens, go to File, Save
Save as msinfo32.nfo and save in a place you will remember
Let it finish the process of gathering and saving the system info
Right click the .nfo file, click send to compressed (zipped) folder
Upload the .zip file here.

lielc · 29 Sep 2012

Hey,

I uploaded the SF Diagnostic Tool results from today. Last night I hibernated the laptop and this morning it acted as if there was a BSOD last night (even though I saw it hibernate), and created a new dump file:

Attachment 234241

Code:

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time (usually 10 minutes).
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa80031b1060, Physical Device Object of the stack
Arg3: fffff80000b9c518, nt!TRIAGE_9F_POWER on Win7, otherwise the Functional Device Object of the stack
Arg4: fffffa8008e3c460, The blocked IRP

Debugging Details:
------------------


DRVPOWERSTATE_SUBCODE:  3

IMAGE_NAME:  pci.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc117

MODULE_NAME: pci

FAULTING_MODULE: fffff88000f82000 pci

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x9F

PROCESS_NAME:  System

CURRENT_IRQL:  2

TAG_NOT_DEFINED_c000000f:  FFFFF80000BA2FB0

STACK_TEXT:  
fffff800`00b9c4c8 fffff800`03332e53 : 00000000`0000009f 00000000`00000003 fffffa80`031b1060 fffff800`00b9c518 : nt!KeBugCheckEx
fffff800`00b9c4d0 fffff800`032d10e6 : fffff800`00b9c600 fffff800`00b9c600 00000000`00000002 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x28e30
fffff800`00b9c570 fffff800`032d0396 : fffffa80`024ca568 fffffa80`024ca568 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x66
fffff800`00b9c5e0 fffff800`032d100e : 0000010e`8e044a6a fffff800`00b9cc58 00000000`0071a8f6 fffff800`03443148 : nt!KiProcessExpiredTimerList+0xc6
fffff800`00b9cc30 fffff800`032d0707 : 00000038`399a74c3 00000038`0071a8f6 00000038`399a74c7 00000000`000000f6 : nt!KiTimerExpiration+0x1be
fffff800`00b9ccd0 fffff800`032cd77a : fffff800`0343ee80 fffff800`0344cc40 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0x9F_3_rtl8192se_IMAGE_pci.sys

BUCKET_ID:  X64_0x9F_3_rtl8192se_IMAGE_pci.sys

Followup: MachineOwner
---------

Thanks!

Arc · 29 Sep 2012

OK, you have something to do here.

► First of all, install Service Pack 1

Code:

OS Name    Microsoft Windows 7 Home Premium
Version    6.1.7600 Build 7600

► Uninstall the following programs

Combined Community Codec Pack, replace by Shark007's FREE Codec solutions - Windows 7 codecs
DAEMON Tools Lite
Free Registry Cleaner

► There are lots of Toshiba Junks. You need to clean them all up.

Clean Up Factory Bloatware

► Free up the startup.

Click on the Start button
Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
Select the “Startup” tab.
Deselect all items other than the antivirus.
Apply > OK
Accept the restart.

► Update the following drivers:

Intel Graphics driver; from Download Center.
Intel Audio Driver;
Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC; from Realtek

► The latest crash is caused by Realtek Wireless LAN 802.11n PCI-E NIC NT Driver (that you posted and pasted here, showing the probable cause as pci.sys)

Code:

>[ 16, 2]   0  0 fffffa80058d1050 00000000 00000000-00000000    
          Unable to load image \SystemRoot\system32\DRIVERS\rtl8192se.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for rtl8192se.sys
*** ERROR: Module load completed but symbols could not be loaded for rtl8192se.sys
 \Driver\rtl8192se
            Args: 00015500 00000000 00000005 00000003

It is already advised to update the driver.

Let us know the results.

lielc · 29 Sep 2012

Hey ARC,
First of all - thank you!
Maybe I should have said this before, but in the last few days I've been preparing for formatting my drivers with the Product Recovery CD - haven't formatted since I got this laptop in 2009 and it's really full of garbage... Today I finally got the CD from my old apartment. Should I format and then follow your instructions? Anything else I should do after formatting?

Liel

Arc · 29 Sep 2012

In that case, do it.
Clean Reinstall - Factory OEM Windows 7

lielc · 03 Oct 2012

Hey,
I ended up formatting and reinstalling windows with the Toshiba Product Recovery CD, just because I never did a clean reinstall and installation of drivers myself and I was kinda scared to mess it up.. I wanted to do the Clean Up Factory Bloatware but didn't have the chance yet - after the reinstalling I had three crashes: first a reboot without any warning, before I shut the laptop's auto reboot on system failure, so I didn't see a BSOD and there was no dump file.
Then I turned off the laptop's auto reboot on system failure. A few hours later my laptap did a reboot with no BSOD and no dump file also, for some reason.. Third one was today, I had a BSOD with bug check 0x8E, here are the files:

Attachment 234875

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 82cb083e, The address that the exception occurred at
Arg3: aee7fa98, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MiGetNextNode+b
82cb083e 394804          cmp     dword ptr [eax+4],ecx

TRAP_FRAME:  aee7fa98 -- (.trap 0xffffffffaee7fa98)
ErrCode = 00000000
eax=09d33940 ebx=86058260 ecx=86058260 edx=88fe6f82 esi=86184030 edi=c58e2d4c
eip=82cb083e esp=aee7fb0c ebp=aee7fb44 iopl=0         ov up ei ng nz na po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010a83
nt!MiGetNextNode+0xb:
82cb083e 394804          cmp     dword ptr [eax+4],ecx ds:0023:09d33944=????????
Resetting default scope

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 82cc601c to 82cefe9c

STACK_TEXT:  
aee7f604 82cc601c 0000008e c0000005 82cb083e nt!KeBugCheckEx+0x1e
aee7fa28 82c4fe66 aee7fa44 00000000 aee7fa98 nt!KiDispatchException+0x1ac
aee7fa90 82c4fe1a aee7fb44 82cb083e badb0d00 nt!CommonDispatchException+0x4a
aee7faa4 82d318c0 00000000 863605c8 86184030 nt!KiExceptionExit+0x192
aee7fb44 82e7d019 c58e2cc0 863604c8 86184030 nt!ExAllocatePoolWithTag+0x8b5
aee7fc14 82e6c996 00000302 863604c8 86184238 nt!EtwTraceProcess+0x82
aee7fc38 82e7a84c 00000001 863604c8 8eb5dac6 nt!PspExitProcess+0x37
aee7fcb4 82e8e2a1 00000000 863df238 00000001 nt!PspExitThread+0x59a
aee7fccc 82cc2850 863df238 aee7fcf8 aee7fd04 nt!PsExitSpecialApc+0x22
aee7fd1c 82c4f334 00000001 00000000 aee7fd34 nt!KiDeliverApc+0x28b
aee7fd1c 77aa7094 00000001 00000000 aee7fd34 nt!KiServiceExit+0x64
WARNING: Frame IP not in any known module. Following frames may be wrong.
001cfe0c 00000000 00000000 00000000 00000000 0x77aa7094


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiGetNextNode+b
82cb083e 394804          cmp     dword ptr [eax+4],ecx

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MiGetNextNode+b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4f766ae5

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x8E_nt!MiGetNextNode+b

BUCKET_ID:  0x8E_nt!MiGetNextNode+b

Followup: MachineOwner
---------

Please help...

Arc · 03 Oct 2012

lielc, we need to go through the dump, but the zip you uploaded does not contain any

Upload it again? We are search in depth than that you did, if any probable cause is found.

lielc · 03 Oct 2012

Oh you're right, I didn't notice. Weird thing is my memory.dmp file is 317 mb! zip file is 95 mb... I can't upload it here :/

lielc · 03 Oct 2012

ok, here it is: Your Big File
(it works)