Repeated BSOD error 0x0000001e, even after factory reset

sharona · 06 May 2013

First post, and I hope I'm doing everything correctly! You guys have come up a lot in my myriad Google searches and you are awesome. I am here because I'm kind of at the end of my rope. I've attached the required SF zipped folder, if you just want to skip to that. Otherwise, please enjoy this very detailed account of the troubles.

Specs: Dell Vostro 3550, running Win7, Professional, SP1, 64-bit

Main stop error is 0x0000001e. (I was getting 0x0000000A for a while, but that's stopped)

The issue is with a laptop belonging to a family friend. She uses it for work. A week ago, she asked me to look over it because of constant errors, which turned out to be blue screens. I did some system restores to earlier points, which seemed to help. After working fine for the rest of the day and the next, i sent it back. She called me to tell me it was messing up again. Blue screens were back.

I started working on it again Saturday. Here's a list of common suggestions I tried. Most multiple times. None seemed to help or even suggest what the exact problem might be (such as Driver Verifier):

Turned on driver verifier
Installed & Ran Microsoft Security Essentials (Note: She did not have a virus program already installed)
Ran tools chkdsk, Repair, and Memory Diagnostic Tool
Did Google searches with the help of Blue Screen View
Set computer back to Factory Image via Dell Backup & Recovery
Updated drivers AND BIOS via Dell's website

I know this particular error usually points to a driver issue, but I can't seem to pinpoint. I will say that I tried to update the ATI-related driver from Dell's website for this machine, but the BSOD interrupted it. I tried updating it in Safe Mode, but it won't run in Safe Mode. Also, the BSOD seems to coincide most following Windows Updates. Even after turning them off, though, there were still errors. Just much less of a pattern to them.

In sum, my eyes are really starting to cross from non-stop searching and trial and error. I'm so afraid that if I do I clean install of Windows 7 (was able to find a link, here I think, to legit .ISOs), the BSOD will just come back because later because of some issue related to Windows Update or hardware after all.

Thank you in advance! And I hope I did everything by the letter. Please let me know if you need more information. And apologies if that was just too much info!

Northernsoul55 · 07 May 2013

Hi,

From your crash logs:

Code:

 
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffffa80063ffbb0, 0, fffa8000}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4977d )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)

Faulting Driver: iaStor.sys
Refers to: Intel Storage drivers

https://downloadcenter.intel.com/Default.aspx

Driver: RtsUStor.sys
Refers to: Realtek USB Card Reader

http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=15&PFid=25&Level=4&Conn=3&DownTypeID=3&GetDown=false

You have MSE installed and Micro trend Client/Server Security Agent.

Please remove Micro trend Client/Server Security Agent:

http://esupport.trendmicro.com/solution/en-us/1057237.aspx

Please run the following tests and post back results:

SFC to check the integrity of all Windows 7 system files:

Click on Start > Type in search cmd
Right-click cmd after results are displayed and Run as Administrator
Type SFC /scannow at the prompt
(Note: There is a space between SFC and /scannow)

SFC Tutorial

Note

Select option two. If any problems are found, run the scan 3 times and immediately
reboot the computer after each scan.

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

https://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Tip

Run these tests overnight

Also run the Dell Diagnostic test:

http://www.dell.com/support/Diagnostics/us/en/19/

cheers

Dave

sharona · 08 May 2013

Hello, Dave! Thank you so much for your quick response! Here's a rundown of my outcomes:

Drivers:
I wasn't sure if the drivers' faulting meant I needed to update them to fix the issue. I went to the sites you did a great job of linking to. Haven't been able to update those drivers. When I finally got the INTEL driver check to work for me (it took me a few tries) none of the drivers it indicated related to IaStor.sys. I tried doing a search for just IaStor.sys, but I didn't know which package it listed to get. (I tried DLing one, thinking it would autoinstall, but it just gave me a bunch of files. And the Setup binary wouldn't work. And none of the files were IaStor.sys, just variants of that file name. /end ramble)

I had the same issue over at Realtek, which one to pick. I tried the reader program, again multiple times, but each time it told me no Realtek devices were found.

So, I wasn't able to update or change those drivers that way. How would I find out which downloads I need, and is that something I need to worry about? I ask only about that because it was the first things I tried to take care.

TrendMicro
Uninstalled this successfully. Again, thanks for the link to the uninstaller! I couldn't uninstall in Control Panel in Safe Mode, but could use the program!

SFC:
Ran. No errors. (I had run this a few times before, but forgot to mention it. Sorry about that.)

Memtest
Ran memtest per the tutorial. I actually started running it early in the evening and went to bed. So, at the end of it, it had done 13 passes. No errors found at all. I opened up the access panel to check the sticks, per the instructions, but saw only one. Do I still need to run a stick-specific test if there's only one?

Dell Diagnostics:
I was able to load Windows in full mode long enough to run this, as it wasn't work at Safe Mode with Networking after several attempts. (I did, however, have to restart one time because I got a blue screen, this time with the error ending in A, like I mentioned used to happen.) Ran the full test, everything passed. Also ran the symptom test for Windows Error. Again, everything passed.

What should I do next?

And thank you so very much in advance!

Northernsoul55 · 09 May 2013

Hi,

Thanks for the feedback :)
Sorry, my fault, the iastor drivers are a pain at the moment,
I would suggest this method:

Uninstall Intel Rapid Storage in Control Panel>Programs and Features.
Then, uninstall it in Device Manager.

1. Click Start and type in search box> manage
2. Click Computer management
3. Select Device Manager in the left pane, It will list all the existing devices.
4. Expand>IDE ATA/ATAPI controllers by clicking on the triangle in front of it.
5. Select one intel device under it, right click> uninstall.
Continue the process for all intel items under IDE ATA/ATAPI controllers
Restart the computer. At restart, windows will auto configure the appropriate system driver.

Yes having looked again, there is no Realtek Program on your system at present,
these must be leftover drivers from a previous install.

Driver: RtsUStor.sys
Refers to: Realtek USB Card Reader

How to clean left over drivers

Sometimes drivers remain even after a program has uninstalled.
Please refer to this tutorial for removal of drivers of the particular program:
How to Clean Left Over Driver Files with Driver Sweeper

Click on the Start button
► Control Panel
► Programs
► Uninstall a program
► Uninstall everything related to the software. (if it is present)

In order to delete remnants of its drivers/older drivers use:
Driver Fusion/Sweeper

Please can you post up your latest crash dump file and i will take a look.

Thanks

Dave

sharona · 09 May 2013

Dave,

I've followed the steps, still getting blue screens. So, I went ahead and did a full SF run and zipped the results to this post. Hopefully that helps, or at least shows if I messed something up.

Thanks again,
Sharona

Northernsoul55 · 09 May 2013

Hi,

Looks like when driver sweeper ran it deleted the problem driver but also a needed one!
Driver: Realtek PCIe GBE Family Controller Driver

Goto the download page

Realtek driver download

Download and install the driver marked in red.

The logs again show iastor.sys as a culprit and is still present on your computer.
Try uninstall again.

Also please navigate to Device Manager:

Start>Computer>system properties
Click Device Manager in the left pane
Check and expand all to see if any show a Yellow triangle?

If so, right click> Update driver software.

Also this device has issues, again look in device manager and see if you can update.

Code:

 
Security Processor Loader Driver ROOT\LEGACY_SPLDR\0000 
This device is not present, is not working properly, or does not have 
all its drivers installed.

Please download Malwarebytes:

Download

Note

Do not start the free trial of Malware Bytes, deselect that option when prompted.

Run a full scan once downloaded, installed and updated.

Ensure you have all the latest windows updates installed?

cheers

Dave

sharona · 09 May 2013

So, I checked Device Manager, and the only one with the yellow triangle was that same Realtek driver you told me I need to fix. So, I took care of that, and then all drivers were fine.

I couldn't pinpoint how else to get iastor.sys off. I ended up moving it so I didn't fully delete it. I'm linking to a screencap of my Device Manager under the list I had earlier removed drivers from to fix the IaStor issue to show which drivers were installed instead: Image - TinyPic - Free Image Hosting, Photo Sharing & Video Hosting

Ran MalwareBytes, nothing found.

Went in to Windows regular mode. A few rounds of installing updates went fine. But, at one point I started getting constant errors again. I checked Device Manager, there was a device not working related to tunnel.sys, a network adapter. I uninstalled it so Windows could find the appropriate driver.

I wasn't able to figure out that error you included, and what it links to. I did a quick google search or two and kept coming up with things related to a Kapersky issue? Not sure if that's correct. Some results were from years ago.

I'm attaching another full scan with the current dump files.

I really do appreciate your taking the time to do this.

Northernsoul55 · 10 May 2013

Hi,

Your latest crash dump shows:

Code:

 
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {0, 2, 0, fffff80002edc525}
Probably caused by : ntkrnlmp.exe ( nt!KeSetEvent+1e3 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)

STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL
Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

These isses will need addressing:

Code:

 
Security Processor Loader Driver ROOT\LEGACY_SPLDR\0000 
This device is not present, is not working properly, or does not have 
all its drivers installed.

Code:

 
Microsoft ISATAP Adapter #9  ROOT\*ISATAP\0006 This device is not 
working properly as windows cannot load the drivers

The Microsoft ISATAP adapter driver = tunnel.sys, the same driver listed under
"Teredo Tunneling Pseudo-Interface". It's related to iPv6.
That is the one you uninstalled relating to tunnel.sys and it will need its driver reinstalled. :)
You should see it in Device Manager:

1. Click Start and type in search box> manage
2. Click Computer management
3. Select Device Manager in the left pane, It will list all the existing devices.
4. Click the "View" tab and then "Show hidden devices" and Expand "Networking"
Right click and update the driver software
(you may be able to see the Security Processor Loader Driver now under hidden devices?)

Are you able to install the drivers for these two devices now?

For windows updating issues, lets try resetting Windows updates, choose option 3.

Windows Update Reset

Also please follow these instructions to upload your cbs.logs:

Open the Start Menu>Type in search cmd
Right click cmd at top and Run as Administrator.
In the elevated command prompt, copy and paste the command below, and press Enter.
(this will create a log on your desktop)

Code:

 
copy %windir%\logs\cbs\cbs.log %userprofile%\Desktop\cbs.txt

Close the command prompt and upload the cbs.log file from your desktop

Cheers
Dave

sharona · 10 May 2013

Dave,

I've uploaded the CBS file per your instruction.

I was having issues getting the drivers to reinstall. After a few Google searches, I saw that some had fixed the tunnel.sys with Microsoft's Fix It program. I used this. While it seemed like it wasn't able to reinstall the adapter driver at the time nor fix the issue with Security Process Loader(indeed visible in hidden devices, thank you for that!), it did indicate that driver downloads from Windows Update had been turned off. I turned it back on. After that, I restarted windows normally. Those problem drivers no longer had yellow triangles. One driver did, but it was a graphics driver. I was able to rollback the driver, update it, then restart it without errors.

Also, before finishing up with that, I ran the Windows Update Reset program.

No latest errors for me to upload dmp files for. I'll be doing my usual wait and see with letting Windows sit idly, doing a few processes, and restarting a few times to see if errors show up.

Thanks again for taking a look! Will let you know if I get any new BSODs!

Northernsoul55 · 11 May 2013

Thanks for the feedback.

Good work on updating the drivers. :)
If you do experience another crash please post up the new dump files.

I will ask another member to look at the cbs logs in the meantime.

Cheers

Dave