BSOD: IRQL_GT_ZERO_AT_SYSTEM_SERVICE (0x4A)

Lebon14 · 28 Jul 2013

Hey guys.
So, starting last night, I started to get some BSODs with this error:
IRQL_GT_ZERO_AT_SYSTEM_SERVICE

The first of the two BSOD didn't dump correctly because the dumping was set on a drive that didn't exist. I fixed that. The second one around, I was able to retrieve the minidump.

I did a bit by myself. Using BlueScreenView, I saw those two problematic files:
cdrom.sys
ntoskrnl.exe

So, first things first, I did a SFC /scannow which returned no errors
After, I did a chkdsk c: /f and this is the log as shown in the event viewer:

Code:

Une vérification de disque a été planifiée.
Windows va maintenant vérifier le disque.                

CHKDSK est en train de vérifier les fichiers (étape 1 sur 3)...
Nettoyage en cours des balises d’instance pour le fichier 0x23216.
Nettoyage en cours des balises d’instance pour le fichier 0x32fae.
  253184 enregistrements de fichier traités.                              La vérification des fichiers est terminée.
  629 enregistrements de grand fichier traités.                          0 enregistrements de fichier incorrect traités.                      0 enregistrements EA traités.                                        82 enregistrements d’analyse traités.                               CHKDSK est en train de vérifier les index (étape 2 sur 3)...
  327930 entrées d’index traitées.                                         La vérification des index est terminée.
  0 fichiers non indexés analysés.                                      0 fichiers non indéxés récupérés.                                       CHKDSK est en train de vérifier les descripteurs de sécurité (étape 3 sur 3)
  253184 SD/SID de fichiers traités.                                         Nettoyage en cours de 958 entrées d’index inutilisées à partir de l’index $SII
du fichier 0x9.
Nettoyage en cours de 958 entrées d’index inutilisées à partir de l’index $SDH
du fichier 0x9.
Nettoyage en cours de 958 descripteurs de sécurité non utilisés.
CHKDSK compacte le flux de descripteur de sécurité
  37374 fichiers de données traités.                                     CHKDSK vérifie le journal USN...
  35881696 octets USN traités.                                                Vérification du journal USN terminée.
CHKDSK a découvert de l’espace libre marqué alloué dans la
bitmap de la table de fichiers maîtres (MFT).
Correction des erreurs dans le carte du volume.
Windows a effectué des corrections sur le système de fichiers.

  87915519 Ko d’espace disque au total.
  63149764 Ko dans 195734 fichiers.
    111540 Ko dans 37377 index.
         0 Ko dans des secteurs défectueux.
    358191 Ko utilisés par le système.
     65536 Ko occupés par le fichier journal.
  24296024 Ko disponibles sur le disque.

      4096 octets dans chaque unité d’allocation.
  21978879 unités d’allocation au total sur le disque.
   6074006 unités d’allocation disponibles sur le disque.

Informations internes :
00 dd 03 00 9c 8e 03 00 e0 77 06 00 00 00 00 00  .........w......
6e 0c 00 00 52 00 00 00 00 00 00 00 00 00 00 00  n...R...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Windows a terminé la vérification de votre disque.
Veuillez patienter pendant le redémarrage de votre ordinateur.

So, yeah, I've attached everything below using the SF Analyzing tool.

It seems to be random. If I have another BSOD of the same, I'll be sure to post the minidump. Also, my PC has been trouble free for over a year.

So, hum, help?

Arc · 28 Jul 2013

Hello Lebon14.

The BSOD is caused by bdfwfpf.sys (c:\program files\common files\bitdefender\bitdefender firewall\bdfwfpf.sys)

Code:

fffff880`09aff978  fffff880`00dd6a9aUnable to load image bdfwfpf.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for bdfwfpf.sys
*** ERROR: Module load completed but symbols could not be loaded for bdfwfpf.sys
 bdfwfpf+0xca9a

Description here: Driver Reference Table - bdfwfpf.sys

I would suggest you to uninstall BitDefender using Uninstall Bitdefender , following the method described in Support
Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

Click on the Start button
Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
Select the “Startup” tab.
Deselect all items other than the antivirus.
Apply > OK
Accept then restart.

Then, Let us know how it is running. It appears that there might be some display related issue, but the main issue is to be removed at first.
______________________________________________________________________
BSOD ANALYSIS:

Code:

..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4A, {775e138a, 2, 0, fffff88009affca0}

Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_GT_ZERO_AT_SYSTEM_SERVICE (4a)
Returning to usermode from a system call at an IRQL > PASSIVE_LEVEL.
Arguments:
Arg1: 00000000775e138a, Address of system function (system call routine)
Arg2: 0000000000000002, Current IRQL
Arg3: 0000000000000000, 0
Arg4: fffff88009affca0, 0

Debugging Details:
------------------


PROCESS_NAME:  vsserv.exe

BUGCHECK_STR:  RAISED_IRQL_FAULT

FAULTING_IP: 
+0
00000000`775e138a c3              ret

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002e931a9 to fffff80002e93c00

STACK_TEXT:  
fffff880`09affa68 fffff800`02e931a9 : 00000000`0000004a 00000000`775e138a 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`09affa70 fffff800`02e930e0 : 00000000`00000844 fffff880`09affca0 00000000`00000000 fffff800`0317ef33 : nt!KiBugCheckDispatch+0x69
fffff880`09affbb0 00000000`775e138a : 000007fe`fd756cf6 00000000`00000000 00000000`1f0183c8 00000000`2a574950 : nt!KiSystemServiceExit+0x245
00000000`1fd3fcc8 000007fe`fd756cf6 : 00000000`00000000 00000000`1f0183c8 00000000`2a574950 000007fe`fd7310dc : 0x775e138a
00000000`1fd3fcd0 00000000`00000000 : 00000000`1f0183c8 00000000`2a574950 000007fe`fd7310dc 00000000`1bfef0a0 : 0x000007fe`fd756cf6


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiSystemServiceExit+245
fffff800`02e930e0 4883ec50        sub     rsp,50h

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiSystemServiceExit+245

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5147d9c6

FAILURE_BUCKET_ID:  X64_RAISED_IRQL_FAULT_vsserv.exe_nt!KiSystemServiceExit+245

BUCKET_ID:  X64_RAISED_IRQL_FAULT_vsserv.exe_nt!KiSystemServiceExit+245

Followup: MachineOwner
---------

Lebon14 · 28 Jul 2013

Bitdefender, eh. That was my first thought when I searched about the BSOD except that the faulty file was "vsserve.exe" and not "bdfwfpf.sys".

I'm going to forward this to the bitdefender forums to try to find a solution. I don't want to waste the subscription. Funny thing is that I've been running the AV with no problems for two months. If I am not able to figure out the problem with the bitdefender team, I'll gladly give the Bitdefender the boot and hopefully, someday when I'll be able to pay, go back to NOD32.

I'll give you further news on that. And thanks for the analysis, that'll be helpful.

Lebon14 · 29 Jul 2013

UPDATE
I didn't receive another BSOD yet.
I scanned my PC with MBAM, only a prtially downloaded PUP (name.exe.part) was detected.
BitDefender forums didn't give a single f* about my BSOD problem.

If this BSOD comes back one more time, I'll give BitDefender the boot.

P.S This is my 1337 post! YAY!