BSOD randomly happening rar file attached

Hello and welcome to SF :) .

A single dump isn't enough in most case and this one being one of them where a couple more could have
led to a more fruitful debugging.

Code:

WORKER_THREAD_RETURNED_AT_BAD_IRQL (e1)
Arguments:
Arg1: fffff80002f83ad0, address of worker routine
Arg2: 0000000000000002, IRQL returned at
Arg3: fffffa8006ef9820, workitem parameter
Arg4: fffffa8006ef9820, workitem address

The Interrupt Request Level (IRQL) was raised to 2 where it should have been 0 for that thread.

Code:

!irql
Debugger saved IRQL for processor 0x4 -- 2 (DISPATCH_LEVEL)

Code:

ln /D fffff80002f83ad0

(fffff800`02f83ad0)   nt!IopProcessWorkItem   |  (fffff800`02f83b18)   nt!NtWaitForMultipleObjects
Exact matches:
    nt!IopProcessWorkItem (<no parameter info>)

All we can see from this dump is that ntkrnlmp is waiting, but we can't see what.

This is usually due to a buggy driver, by listing the loaded modules we also get the unloaded ones,
by looking at those we can see that rapportiaso6 was loaded and unloaded multiple times.

Code:

Unloaded modules:
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07200000 fffff880`07271000   spsys.sys
fffff880`0556f000 fffff880`055a3000   rapportiaso6
fffff880`055a3000 fffff880`055d7000   rapportiaso6
fffff880`0556f000 fffff880`055a3000   rapportiaso6
fffff880`055a3000 fffff880`055d7000   rapportiaso6
fffff880`0556f000 fffff880`055a3000   rapportiaso6
fffff880`055a3000 fffff880`055d7000   rapportiaso6
fffff880`0556f000 fffff880`055a3000   rapportiaso6
fffff880`055a3000 fffff880`055d7000   rapportiaso6
fffff880`0556f000 fffff880`055a3000   rapportiaso6
fffff880`05c72000 fffff880`05c94000   NisDrvWFP.sy
fffff880`01c00000 fffff880`01c0e000   crashdmp.sys
fffff880`0444f000 fffff880`047f3000   dump_iaStor.
fffff880`04400000 fffff880`04413000   dump_dumpfve
fffff880`01600000 fffff880`01614000   VirtDiskBus6

• Driver Reference Table - rapportiaso64.sys

The driver is part of Trusteer Ltd. Rapport Security software;

Code:

c:\program files (x86)\trusteer\rapport\

Using RevoUninstaller remove the software completely along with any remaining registry entries.
Install Microsoft Security Essentials as a reliable alternative.


Then run Full Scans of both Microsoft Security Essentials and Malwarebytes (which you already have installed). During the the troubleshooting process do not run CCleaner as it deletes dump files.




Post back with the results!

Thanks for the feedback :) .
As of now not much just update if it bugchecks again and mark as solved after a week or so if it hasn't.

Hi thanks for the update :).
The dump is basically the same and Trusteer Ltd. Rapport Security software is still active
both in the PC (loaded modules / services..) and in the dump file.

Please remove it completely.

Then follow the detailed instructions below.

Arc said:

Your crash dumps are not showing any finite probable cause.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

Arc said:

First run it with all the existing/installed RAM modules. If it comes with no error, all is good.

But if it starts showing errors, Stop testing. Errors/red lines means one or more RAM is faulty. But the fault may occur due to a faulty DIMM slot, too, which is a motherboard component. Using memtest86+, you can discriminate between a faulty RAM and a faulty motherboard.

How? Say you have two RAM sticks and two DIMM slots. You obtained errors at the test with all RAM sticks installed. Now, remove all the sticks but one. Test it in all the available slots, one by one. Continue the same procedure for all the available sticks.
How to make the inference that is it a RAM issue or it is a motherboard issue? Suppose you have got the result like that:
No code has to be inserted here. It is a RAM, a bad RAM.

But if you have got a result like that:
No code has to be inserted here. It is a motherboard issue. The particular slot is bad.

If memtest comes free from errors, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

Thanks :) , keep us posted.