My pops is having some problems with his machine. I did manage to get the dump files via the logmein program I installed years ago. Is there a way anyone can tell what is causing his machine to hang and not respond?
Mark
According to the dump file, there appears to be some issues with Bugcheck A, ntkrnlmp.exe / ntoskrnl.exe (an unspecified problem with NT Kernel & System - Different versions/date stamps according to OS and system specifications), rcx,qword ptr (possibly related to Ready Boost driver), csrss.exe (a necessary system process but could also be malware), EraserUtilRebootDrv.sys (a Symantec/Norton driver), and SYMEVENT64x86.SYS (another Norton Internet Security driver).
The following links provide more info about these issues and update info where available. In the interest of full disclosure I edited the dump file and reduced it to a more manageable size
Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL (Windows Debuggers)
Driver Reference Table - ntkrnlmp.exe
Driver Reference Table - ntoskrnl.exe
Driver Reference Table - rdyboost.sys and Blue Screen: Stop 0x1E and stop 0xD1 - Microsoft Community
csrss.exe - What is csrss.exe?
Driver Reference Table - EraserUtilRebootDrv.sys
Driver Reference Table - SYMEVENT64x86.SYS
Starting with the basics, let's try to rule out any malware related problems that might have slipped by Norton. Uninstall any Norton products following the official Norton uninstall instructions.Code:******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {0, 2, 0, fffff80002cb1f74} Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 ) Followup: MachineOwner --------- IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 0000000000000000, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff80002cb1f74, address which referenced memory Debugging Details: ------------------ FAULTING_IP: nt!IopCompleteRequest+c64 fffff800`02cb1f74 488b09 mov rcx,qword ptr [rcx] CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xA PROCESS_NAME: csrss.exe IRP_ADDRESS: ffffffffffffff88 TRAP_FRAME: fffff880030706e0 -- (.trap 0xfffff880030706e0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffff8800306f958 rbx=0000000000000000 rcx=0000000000000000 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80002cb1f74 rsp=fffff88003070870 rbp=0000000000000000 r8=0000000000004740 r9=0000000000000080 r10=0000000000000002 r11=00000000000001c8 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz ac pe cy nt!IopCompleteRequest+0xc64: fffff800`02cb1f74 488b09 mov rcx,qword ptr [rcx] ds:1395:00000000`00000000=???????????????? Resetting default scope ------------------ fffff880`03070758 fffff880`04317ab8Unable to load image EraserUtilRebootDrv.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for EraserUtilRebootDrv.sys *** ERROR: Module load completed but symbols could not be loaded for EraserUtilRebootDrv.sys EraserUtilRebootDrv+0x2ab8 fffff880`030707b8 fffff880`040dcfd8Unable to load image SYMEVENT64x86.SYS, Win32 error 0n2 *** WARNING: Unable to verify timestamp for SYMEVENT64x86.SYS *** ERROR: Module load completed but symbols could not be loaded for SYMEVENT64x86.SYS SYMEVENT64x86+0x21fd8
https://support.norton.com/sp/en/us/...rProfile_en_us
I'd suggest running full scans using the free Malwarebytes and Windows Defender Offline. (No anti-malware product is 100% effective 100% of the time. If there was such a thing we'd all be using it. So running these on-demand scanners is a good thing.)
Malwarebytes
Windows Defender Offline
There may bo other damaged or corrupt system files that are preventing drivers from updating. You could try running a system file checker scan from an elevated command prompt (option two.) If problems are found, run the scan 3 times and immediately reboot the computer after each scan.
SFC /SCANNOW Command - System File Checker
You could also try to "stress test" your drivers by enabling Driver Verifier.
Driver Verifier - Enable and Disable
One of the Forum experts prepared this troubleshooting guide that also includes links to various hardware tests.
Troubleshooting Steps for Windows 7
And in addition to the dump files, it would be helpful if you'd posted this information in a completely unedited form. Sometimes false activation issues can cause problems.
Windows Genuine and Activation Issue Posting Instructions
Thanks for the response and I will check out those links and report back.
Quote