Windows 7: BSOD randomly happening rar file attached

meanodeano · 26 Sep 2013

hi ev1, my computer has been crashing with BSOD at random times using various programs nothing specific, just its driving me crazy now any help would be appreciated ty

YoYo155 · 26 Sep 2013

Hello and welcome to SF :) .

A single dump isn't enough in most case and this one being one of them where a couple more could have
led to a more fruitful debugging.

Code:

WORKER_THREAD_RETURNED_AT_BAD_IRQL (e1)
Arguments:
Arg1: fffff80002f83ad0, address of worker routine
Arg2: 0000000000000002, IRQL returned at
Arg3: fffffa8006ef9820, workitem parameter
Arg4: fffffa8006ef9820, workitem address

The Interrupt Request Level (IRQL) was raised to 2 where it should have been 0 for that thread.

Code:

!irql
Debugger saved IRQL for processor 0x4 -- 2 (DISPATCH_LEVEL)

Code:

ln /D fffff80002f83ad0

(fffff800`02f83ad0)   nt!IopProcessWorkItem   |  (fffff800`02f83b18)   nt!NtWaitForMultipleObjects
Exact matches:
    nt!IopProcessWorkItem (<no parameter info>)

All we can see from this dump is that ntkrnlmp is waiting, but we can't see what.

This is usually due to a buggy driver, by listing the loaded modules we also get the unloaded ones,
by looking at those we can see that rapportiaso6 was loaded and unloaded multiple times.

Code:

Unloaded modules:
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07200000 fffff880`07271000   spsys.sys
fffff880`0556f000 fffff880`055a3000   rapportiaso6
fffff880`055a3000 fffff880`055d7000   rapportiaso6
fffff880`0556f000 fffff880`055a3000   rapportiaso6
fffff880`055a3000 fffff880`055d7000   rapportiaso6
fffff880`0556f000 fffff880`055a3000   rapportiaso6
fffff880`055a3000 fffff880`055d7000   rapportiaso6
fffff880`0556f000 fffff880`055a3000   rapportiaso6
fffff880`055a3000 fffff880`055d7000   rapportiaso6
fffff880`0556f000 fffff880`055a3000   rapportiaso6
fffff880`05c72000 fffff880`05c94000   NisDrvWFP.sy
fffff880`01c00000 fffff880`01c0e000   crashdmp.sys
fffff880`0444f000 fffff880`047f3000   dump_iaStor.
fffff880`04400000 fffff880`04413000   dump_dumpfve
fffff880`01600000 fffff880`01614000   VirtDiskBus6

Driver Reference Table - rapportiaso64.sys

The driver is part of Trusteer Ltd. Rapport Security software;

Code:

c:\program files (x86)\trusteer\rapport\

Using RevoUninstaller remove the software completely along with any remaining registry entries.
Install Microsoft Security Essentials as a reliable alternative.

Then run Full Scans of both Microsoft Security Essentials and Malwarebytes (which you already have installed). During the the troubleshooting process do not run CCleaner as it deletes dump files.

Post back with the results!

meanodeano · 27 Sep 2013

thanks for your help and time, i will uninstall rapport and get back to you regards dean

meanodeano · 27 Sep 2013

hi ive uninstalled rapport program, and run the 2 scans and nothing was found, is there anything i need to do now regards dean.

YoYo155 · 27 Sep 2013

Thanks for the feedback :) .
As of now not much just update if it bugchecks again and mark as solved after a week or so if it hasn't.

meanodeano · 29 Sep 2013

hi yo-yo and crew, just had another BSOD whilst running the windows experience index. as requested ive attached the rar file ty

meanodeano · 29 Sep 2013

ive had a quick look into this debugging stuff, and think it might be something to do with acpi.sys , but thats as far as i got its all quite confusing , but the tutorials are good on this site

YoYo155 · 29 Sep 2013

Hi thanks for the update :).
The dump is basically the same and Trusteer Ltd. Rapport Security software is still active
both in the PC (loaded modules / services..) and in the dump file.

Please remove it completely.

Then follow the detailed instructions below.

Quote: Originally Posted by Arc

Your crash dumps are not showing any finite probable cause.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

Quote: Originally Posted by Arc

First run it with all the existing/installed RAM modules. If it comes with no error, all is good.

But if it starts showing errors, Stop testing. Errors/red lines means one or more RAM is faulty. But the fault may occur due to a faulty DIMM slot, too, which is a motherboard component. Using memtest86+, you can discriminate between a faulty RAM and a faulty motherboard.

How? Say you have two RAM sticks and two DIMM slots. You obtained errors at the test with all RAM sticks installed. Now, remove all the sticks but one. Test it in all the available slots, one by one. Continue the same procedure for all the available sticks.
How to make the inference that is it a RAM issue or it is a motherboard issue? Suppose you have got the result like that:

test	Slot1	Slot2
RAM1	Error	Error
RAM2	Good	Good

It is a RAM, a bad RAM.

But if you have got a result like that:

test	Slot1	Slot2
RAM1	Error	Good
RAM2	Error	Good

It is a motherboard issue. The particular slot is bad.

If memtest comes free from errors, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

meanodeano · 29 Sep 2013

ok yoyo, ty will do that now, i did initially remove rapport , but then i thought i had to reinstall it from the hyperlink, but its all uninstalled now

YoYo155 · 29 Sep 2013

Thanks :) , keep us posted.