BSOD ntoskrnl.exe associated

Capacity · 27 Nov 2012

I came across a BSOD randomly about a month ago and didn't think to much of it, i still was able to do everything that i did before after the initial BSOD. After a while however they became more and more frequent. I started trying to debug the problem, using verifier.exe, whocrashed and other program's to try and find a cause of the BSOD. After using this software I found some clue to what the problem might be. Here's the most recent Who Crashed report.

On Thu 11/22/2012 8:57:14 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\112212-19827-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x7EFC0)
Bugcheck code: 0xE1 (0xFFFFF80003975560, 0x2, 0xFFFFFA800B833110, 0xFFFFFA800B833110)
Error: WORKER_THREAD_RETURNED_AT_BAD_IRQL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a worker thread completed and returned with IRQL at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Thu 11/22/2012 8:57:14 PM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
Bugcheck code: 0xE1 (0xFFFFF80003975560, 0x2, 0xFFFFFA800B833110, 0xFFFFFA800B833110)
Error: WORKER_THREAD_RETURNED_AT_BAD_IRQL
Bug check description: This indicates that a worker thread completed and returned with IRQL at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

Im about out of idea's because the verifier.exe seems to be stopping the system from BSOD in the usual spot's like starting Diablo 3 and clicking on my Fantasy live cast for my ESPN fantasy football. If you guys could help that would be great :)!

Thanks,
CAP

Capacity · 27 Nov 2012

Sorry i didn't the tool finish so not all my information was in the file... Here is an updated zipped folder with another BSOD Dump file inside. Hope you can help

bagavan · 27 Nov 2012

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck E1, {fffff800039bc560, 2, fffff9805d4f8fc0, fffff9805d4f8fc0}

Probably caused by : ntkrnlmp.exe ( nt!IopProcessWorkItem+0 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

WORKER_THREAD_RETURNED_AT_BAD_IRQL (e1)
Arguments:
Arg1: fffff800039bc560, address of worker routine (do ln on this to find guilty driver)
Arg2: 0000000000000002, IRQL returned at (should have been 0, but isn't).
Arg3: fffff9805d4f8fc0, workitem parameter
Arg4: fffff9805d4f8fc0, workitem address

Debugging Details:
------------------


FAULTING_IP: 
nt!IopProcessWorkItem+0
fffff800`039bc560 fff3            push    rbx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xE1

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800037494a8 to fffff800036c9fc0

STACK_TEXT:  
fffff880`0357fb68 fffff800`037494a8 : 00000000`000000e1 fffff800`039bc560 00000000`00000002 fffff980`5d4f8fc0 : nt!KeBugCheckEx
fffff880`0357fb70 fffff800`03960e5a : 00000000`00000000 fffffa80`06d03040 00000000`00000080 fffffa80`06c86890 : nt! ?? ::FNODOBFM::`string'+0x58246
fffff880`0357fc00 fffff800`036bad26 : fffff880`03389180 fffffa80`06d03040 fffff880`033940c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0357fc40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  .bugcheck ; kb

FOLLOWUP_IP: 
nt!IopProcessWorkItem+0
fffff800`039bc560 fff3            push    rbx

SYMBOL_NAME:  nt!IopProcessWorkItem+0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

FAILURE_BUCKET_ID:  X64_0xE1_VRF_nt!IopProcessWorkItem+0

BUCKET_ID:  X64_0xE1_VRF_nt!IopProcessWorkItem+0

Followup: MachineOwner
---------

By the way have you updated all your device drivers

koolkat77 · 28 Nov 2012

Welcome

Familiar bugcheck 1E and when McAfee is present. McAfee is a frequent cause of BSOD crashes, consider uninstalling it with the McAfee Removal Tool and replace with Microsoft Security Essentials to test.

Note that you have Microsoft security essentials installed but keeping two antiviruses would create conflicts. is it bad to run multiple antivirus programs?

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

Click on the
Type CMD on Search
Left click and Run as Administrator
Type SFC /scannow

Full tutorial here:

SFC /SCANNOW Command - System File Checker

Run Disk Check on your hard disk for file system errors and bad sectors on it:

Disk Check

Reinstall the drivers for your graphics card:
Click on the Start

► Control Panel ► Programs ► Uninstall a program ► Uninstall everything related to; NVIDIA. Restart the system. Delete remnants of its drivers/older drivers using Driver Fusion/Sweeper
Download link for a stable version of drivers:

Download NVIDIA Forceware 306.23 WHQL Vista 64 - FileHippo.com

Go to this link:

Intel® Driver Update Utility

Run with Java and update all drivers that need to be updated.

Check for a BIOS update:

Code:

BIOS Version/Date	Dell Inc. A07, 10/20/2011

Free up the start-up, nothing except the antivirus is usually needed.

Let us know if that helps.

Code:

STOP 0x0000001E: KMODE_EXCEPTION_NOT_HANDLED 
Usual causes:  Device driver, hardware, System service, 
compatibility, Remote control programs, memory, BIOS
BugCheck E1, {fffff800039bc560, 2, fffff9805d4f8fc0, fffff9805d4f8fc0}
Probably caused by : ntkrnlmp.exe ( nt!IopProcessWorkItem+0 )
--------
Unloaded modules:
fffff880`215b5000 fffff880`215c1000   pcdsrvc_x64.
fffff880`215c1000 fffff880`215c3000   MSPQM.sys
fffff880`21544000 fffff880`215b5000   spsys.sys
fffff880`214ab000 fffff880`2151c000   spsys.sys
fffff880`0e849000 fffff880`0e891000   mfeavfk01.sy
fffff880`02e00000 fffff880`02e36000   WUDFRd.sys
fffff880`01bde000 fffff880`01bec000   crashdmp.sys
fffff880`03e83000 fffff880`03fd7000   dump_iaStor.
fffff880`03fd7000 fffff880`03fea000   dump_dumpfve

Capacity · 28 Nov 2012

Looks like it was McAfee and Microsoft Security Essentials Fighting. Thanks for all your help i will post on a new thread if i have anymore problems. :)

Thanks!!!

CAP

koolkat77 · 28 Nov 2012

You're welcome.
We'll be here if you need more help :)