BSOD Worker Thread Returned At Bad IRQL while using BitTorrent

x75 · 07 May 2013

Recently started receiving the BSOD while using BitTorrent. Usually doesn't occur until the after the torrent metadata is downloaded and checked and it starts actually downloading. Currently running McAfee and I understand this may be the problem, but I don't want to remove it until I'm sure. I've included what the SF Diagnostic Tool could manage to capture but it seems to be having trouble capturing a few things. Hope the information I've provided is enough. Please help this n00b.

x75 · 07 May 2013

Finally got it all I think...

koolkat77 · 08 May 2013

Yes it is McAfee that is creating the problem for you. Besides that you should not run two real time AV's together. They always create conflicts. You are better off with Security Essentials. Read - is it bad to run multiple antivirus programs? - AntiVirus, Firewall and Privacy Products and Protection Methods

Code:

fffff880`037b2000 fffff880`037fc000   mfeavfk01.sy

I might blog about this bug check and McAfee someday as I've come across more than 15 threads where McAfee was the cause of the BSOD and the bug check was Worker thread returned at bad irql E1. Typing the lm command is enough for me to know that McAfee is the cause.

Anyway, here is an output of one your dumps:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck E1, {fffff8000358ad50, 2, fffffa80067c3950, fffffa80067c3950}

Probably caused by : ntkrnlmp.exe ( nt!IopProcessWorkItem+0 )

Followup: MachineOwner
---------

0: kd> lm
start             end                 module name
fffff800`00bb2000 fffff800`00bbc000   kdcom      (deferred)             
fffff800`0321d000 fffff800`03803000   nt         (pdb symbols)          c:\symcache\ntkrnlmp.pdb\4406EA3F2CE044878BDFDEF95E07708E2\ntkrnlmp.pdb
fffff800`03803000 fffff800`0384c000   hal        (deferred)             
fffff880`00c00000 fffff880`00cc0000   CI         (deferred)             
fffff880`00cd5000 fffff880`00d24000   mcupdate_GenuineIntel   (deferred)             
fffff880`00d24000 fffff880`00d38000   PSHED      (deferred)             
fffff880`00d38000 fffff880`00d96000   CLFS       (deferred)             
fffff880`00d96000 fffff880`00df2000   volmgrx    (deferred)             
fffff880`00e00000 fffff880`00e1a000   mountmgr   (deferred)             
fffff880`00e1a000 fffff880`00e3e000   HDAudBus   (deferred)             
fffff880`00e51000 fffff880`00f13000   Wdf01000   (deferred)             
fffff880`00f13000 fffff880`00f23000   WDFLDR     (deferred)             
fffff880`00f23000 fffff880`00f7a000   ACPI       (deferred)             
fffff880`00f7a000 fffff880`00f83000   WMILIB     (deferred)             
fffff880`00f83000 fffff880`00f8d000   msisadrv   (deferred)             
fffff880`00f8d000 fffff880`00fc0000   pci        (deferred)             
fffff880`00fc0000 fffff880`00fcd000   vdrvroot   (deferred)             
fffff880`00fcd000 fffff880`00fe2000   partmgr    (deferred)             
fffff880`00fe2000 fffff880`00ff7000   volmgr     (deferred)             
fffff880`01019000 fffff880`01135000   iaStor     (deferred)             
fffff880`01135000 fffff880`0115f000   vsmraid    (deferred)             
fffff880`0115f000 fffff880`011c2000   storport   (deferred)             
fffff880`011c2000 fffff880`011cd000   amdxata    (deferred)             
fffff880`011cd000 fffff880`011fd000   CLASSPNP   (deferred)             
fffff880`01222000 fffff880`0126e000   fltmgr     (deferred)             
fffff880`0126e000 fffff880`01282000   fileinfo   (deferred)             
fffff880`01282000 fffff880`012ba000   MpFilter   (deferred)             
fffff880`012ba000 fffff880`01373700   mfehidk    (deferred)             
fffff880`01374000 fffff880`01380040   PxHlpa64   (deferred)             
fffff880`01381000 fffff880`013df000   msrpc      (deferred)             
fffff880`013df000 fffff880`013f5000   intelppm   (deferred)             
fffff880`01400000 fffff880`01426000   tunnel     (deferred)             
fffff880`0142e000 fffff880`015d0000   Ntfs       (deferred)             
fffff880`015d0000 fffff880`015eb000   ksecdd     (deferred)             
fffff880`01600000 fffff880`0163a000   rdyboost   (deferred)             
fffff880`0163a000 fffff880`01674000   fvevol     (deferred)             
fffff880`01674000 fffff880`0168a000   disk       (deferred)             
fffff880`0168a000 fffff880`016ac000   tdx        (deferred)             
fffff880`016b4000 fffff880`01726000   cng        (deferred)             
fffff880`01726000 fffff880`01737000   pcw        (deferred)             
fffff880`01737000 fffff880`01741000   Fs_Rec     (deferred)             
fffff880`01741000 fffff880`01791c00   mfewfpk    (deferred)             
fffff880`01792000 fffff880`017de000   volsnap    (deferred)             
fffff880`017de000 fffff880`017ef000   blbdrive   (deferred)             
fffff880`01800000 fffff880`01860000   NETIO      (deferred)             
fffff880`01860000 fffff880`0188b000   ksecpkg    (deferred)             
fffff880`0188b000 fffff880`018d4000   fwpkclnt   (deferred)             
fffff880`018d6000 fffff880`019c8000   ndis       (deferred)             
fffff880`019c8000 fffff880`019d0000   spldr      (deferred)             
fffff880`019d0000 fffff880`019e2000   mup        (deferred)             
fffff880`019e2000 fffff880`019eb000   hwpolicy   (deferred)             
fffff880`01a00000 fffff880`01c00000   tcpip      (deferred)             
fffff880`02a94000 fffff880`02b5d000   HTTP       (deferred)             
fffff880`02b5d000 fffff880`02b7e000   NisDrvWFP   (deferred)             
fffff880`02b7e000 fffff880`02be7000   srv2       (deferred)             
fffff880`02c00000 fffff880`02c36000   WUDFRd     (deferred)             
fffff880`02c36000 fffff880`02c5a000   mrxsmb20   (deferred)             
fffff880`02cbb000 fffff880`02d61000   peauth     (deferred)             
fffff880`02d61000 fffff880`02d6c000   secdrv     (deferred)             
fffff880`02d6c000 fffff880`02d99000   mrxsmb     (deferred)             
fffff880`02d99000 fffff880`02de7000   mrxsmb10   (deferred)             
fffff880`03600000 fffff880`0360b000   Sftredirlh   (deferred)             
fffff880`0360b000 fffff880`03634b00   mfeapfk    (deferred)             
fffff880`03635000 fffff880`03653000   bowser     (deferred)             
fffff880`03653000 fffff880`03664000   WinUsb     (deferred)             
fffff880`0366b000 fffff880`03684000   WudfPf     (deferred)             
fffff880`03692000 fffff880`03753000   Sftfslh    (deferred)             
fffff880`03753000 fffff880`037a0000   Sftplaylh   (deferred)             
fffff880`037a0000 fffff880`037b2000   tcpipreg   (deferred)             
fffff880`037b2000 fffff880`037e3000   srvnet     (deferred)             
fffff880`037e3000 fffff880`037f2300   cfwids     (deferred)             
fffff880`03c00000 fffff880`03c09000   RDPCDD     (deferred)             
fffff880`03c09000 fffff880`03c12000   rdpencdd   (deferred)             
fffff880`03c12000 fffff880`03c1b000   rdprefmp   (deferred)             
fffff880`03c1b000 fffff880`03c26000   Msfs       (deferred)             
fffff880`03c26000 fffff880`03c37000   Npfs       (deferred)             
fffff880`03c37000 fffff880`03c44000   TDI        (deferred)             
fffff880`03c44000 fffff880`03d60000   dump_iaStor   (deferred)             
fffff880`03d7b000 fffff880`03da5000   cdrom      (deferred)             
fffff880`03da5000 fffff880`03dae000   Null       (deferred)             
fffff880`03dae000 fffff880`03db5000   Beep       (deferred)             
fffff880`03db5000 fffff880`03dc3000   vga        (deferred)             
fffff880`03dc3000 fffff880`03de8000   VIDEOPRT   (deferred)             
fffff880`03de8000 fffff880`03df8000   watchdog   (deferred)             
fffff880`04000000 fffff880`04016000   vwififlt   (deferred)             
fffff880`04016000 fffff880`04025000   netbios    (deferred)             
fffff880`04025000 fffff880`04040000   wanarp     (deferred)             
fffff880`04040000 fffff880`04054000   termdd     (deferred)             
fffff880`04054000 fffff880`040a5000   rdbss      (deferred)             
fffff880`040a5000 fffff880`040b1000   nsiproxy   (deferred)             
fffff880`040b1000 fffff880`040bc000   mssmbios   (deferred)             
fffff880`040bc000 fffff880`040cb000   discache   (deferred)             
fffff880`040cb000 fffff880`040e9000   dfsc       (deferred)             
fffff880`040f3000 fffff880`04138000   netbt      (deferred)             
fffff880`04138000 fffff880`041c1000   afd        (deferred)             
fffff880`041c1000 fffff880`041ca000   wfplwf     (deferred)             
fffff880`041ca000 fffff880`041f0000   pacer      (deferred)             
fffff880`04a00000 fffff880`04a46000   dxgmms1    (deferred)             
fffff880`04a46000 fffff880`04a53000   usbuhci    (deferred)             
fffff880`04a53000 fffff880`04aa9000   USBPORT    (deferred)             
fffff880`04aa9000 fffff880`04aba000   usbehci    (deferred)             
fffff880`04acf000 fffff880`054f2120   igdkmd64   (deferred)             
fffff880`054f3000 fffff880`055e7000   dxgkrnl    (deferred)             
fffff880`05a00000 fffff880`05a1b000   USBSTOR    (deferred)             
fffff880`05a1b000 fffff880`05a29000   kbdhid     (deferred)             
fffff880`05a29000 fffff880`05a4c000   luafv      (deferred)             
fffff880`05a4c000 fffff880`05a57000   Sftvollh   (deferred)             
fffff880`05a57000 fffff880`05a6f000   mpsdrv     (deferred)             
fffff880`05a9e000 fffff880`05ab3000   lltdio     (deferred)             
fffff880`05ab3000 fffff880`05ac6000   ndisuio    (deferred)             
fffff880`05ace000 fffff880`05b49680   mfefirek   (deferred)             
fffff880`05b4a000 fffff880`05b58000   crashdmp   (deferred)             
fffff880`05b58000 fffff880`05b6b000   dump_dumpfve   (deferred)             
fffff880`05b6b000 fffff880`05b77000   Dxapi      (deferred)             
fffff880`05b77000 fffff880`05b85000   monitor    (deferred)             
fffff880`05b85000 fffff880`05b97000   usbaapl64   (deferred)             
fffff880`05b97000 fffff880`05b98f00   USBD       (deferred)             
fffff880`05b99000 fffff880`05ba7000   hidusb     (deferred)             
fffff880`05ba7000 fffff880`05bc0000   HIDCLASS   (deferred)             
fffff880`05bc0000 fffff880`05bc8080   HIDPARSE   (deferred)             
fffff880`05bc9000 fffff880`05bd6000   mouhid     (deferred)             
fffff880`05bd6000 fffff880`05be7000   point64    (deferred)             
fffff880`05be7000 fffff880`05bff000   rspndr     (deferred)             
fffff880`05c0e000 fffff880`05df7c80   RTKVHD64   (deferred)             
fffff880`05df8000 fffff880`05dfd200   ksthunk    (deferred)             
fffff880`06867000 fffff880`068ff000   srv        (deferred)             
fffff880`068ff000 fffff880`06935000   fastfat    (deferred)             
fffff880`0a61c000 fffff880`0a6a1000   Rt64win7   (deferred)             
fffff880`0a6a1000 fffff880`0a6a7c00   GEARAspiWDM   (deferred)             
fffff880`0a6a8000 fffff880`0a6b8000   CompositeBus   (deferred)             
fffff880`0a6b8000 fffff880`0a6c0000   RootMdm    (deferred)             
fffff880`0a6c0000 fffff880`0a6cf000   modem      (deferred)             
fffff880`0a6cf000 fffff880`0a6e5000   AgileVpn   (deferred)             
fffff880`0a6e5000 fffff880`0a709000   rasl2tp    (deferred)             
fffff880`0a709000 fffff880`0a715000   ndistapi   (deferred)             
fffff880`0a715000 fffff880`0a744000   ndiswan    (deferred)             
fffff880`0a744000 fffff880`0a75f000   raspppoe   (deferred)             
fffff880`0a75f000 fffff880`0a780000   raspptp    (deferred)             
fffff880`0a780000 fffff880`0a79a000   rassstp    (deferred)             
fffff880`0a79a000 fffff880`0a7ac000   RimSerial_AMD64   (deferred)             
fffff880`0a7ac000 fffff880`0a7bb000   kbdclass   (deferred)             
fffff880`0a7bb000 fffff880`0a7ca000   mouclass   (deferred)             
fffff880`0a7ca000 fffff880`0a7cb480   swenum     (deferred)             
fffff880`0a800000 fffff880`0a849600   mfeavfk    (deferred)             
fffff880`0a84a000 fffff880`0a89d000   nwifi      (deferred)             
fffff880`0a8ac000 fffff880`0a8ef000   ks         (deferred)             
fffff880`0a8ef000 fffff880`0a901000   umbus      (deferred)             
fffff880`0a901000 fffff880`0a95b000   usbhub     (deferred)             
fffff880`0a95b000 fffff880`0a970000   NDProxy    (deferred)             
fffff880`0a970000 fffff880`0a9ad000   portcls    (deferred)             
fffff880`0a9ad000 fffff880`0a9cf000   drmk       (deferred)             
fffff880`0a9cf000 fffff880`0a9f7000   IntcHdmi   (deferred)             
fffff960`00080000 fffff960`00396000   win32k     (deferred)             
fffff960`005d0000 fffff960`005da000   TSDDD      (deferred)             
fffff960`00700000 fffff960`00727000   cdd        (deferred)             

Unloaded modules:
fffff880`06935000 fffff880`069a6000   spsys.sys
fffff880`03635000 fffff880`0366b000   WUDFRd.sys
fffff880`037b2000 fffff880`037fc000   mfeavfk01.sy
fffff880`05a57000 fffff880`05a68000   WinUsb.sys
fffff880`05a68000 fffff880`05a9e000   WUDFRd.sys
fffff880`019eb000 fffff880`019f9000   crashdmp.sys
fffff880`03c4c000 fffff880`03d68000   dump_iaStor.
fffff880`03d68000 fffff880`03d7b000   dump_dumpfve

Security App

Crashes indicate McAfee being a possible cause. Remove McAfee and replace with Microsoft Security Essentials to see if it provides more stability. Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase

Microsoft Security Essentials and Malwarebytes, both recommended from a strict BSOD perspective.

Microsoft Security Essentials, Free antivirus for windows

Malwarebytes Anti-Malware Free

Information

DO NOT start the free trial of MalwareBytes. Deselect the option when prompted.

Please run these tests and report back the results

1. SFC /scannow to check windows for corruption - SFC /SCANNOW Command - System File Checker
2. Disk check for errors on the hard drive - Disk Check
3. Troubleshoot applications by a clean boot - Troubleshoot Application Conflicts by Performing a Clean Startup
4. Memtest86+ paying close attention to part 3 - RAM - Test with Memtest86+
5. Hard drive test from HDD mfg website - Hard Drive Diagnostic Procedure
Hope this helps. Good luck :)

koolkat77 · 01 Jun 2013

So were your BSOD issues resolved? :)