BSOD usbser.sys

Hy everyone,

I have a little problem with my laptop running Labview2011. I get a BSOD randomly.

Code:

On Tue 26.11.2013 13:46:11 GMT your computer crashedcrash dump file: C:\Windows\Minidump\112613-28548-01.dmpThis was probably caused by the following module: usbser.sys (0xFFFFF880079A8161) Bugcheck code: 0xD1 (0xB8, 0x2, 0x0, 0xFFFFF880079A8161)Error: DRIVER_IRQL_NOT_LESS_OR_EQUALfile path: C:\Windows\system32\drivers\usbser.sysproduct: Microsoft® Windows® Operating Systemcompany: Microsoft Corporationdescription: USB Modem DriverBug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time. On Tue 26.11.2013 13:46:11 GMT your computer crashedcrash dump file: C:\Windows\memory.dmpThis was probably caused by the following module: usbser.sys (usbser+0x9161) Bugcheck code: 0xD1 (0xB8, 0x2, 0x0, 0xFFFFF880079A8161)Error: DRIVER_IRQL_NOT_LESS_OR_EQUALfile path: C:\Windows\system32\drivers\usbser.sysproduct: Microsoft® Windows® Operating Systemcompany: Microsoft Corporationdescription: USB Modem DriverBug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time. On Tue 26.11.2013 09:52:16 GMT your computer crashedcrash dump file: C:\Windows\Minidump\112613-30123-01.dmpThis was probably caused by the following module: usbser.sys (0xFFFFF88007D08161) Bugcheck code: 0xD1 (0xB8, 0x2, 0x0, 0xFFFFF88007D08161)Error: DRIVER_IRQL_NOT_LESS_OR_EQUALfile path: C:\Windows\system32\drivers\usbser.sysproduct: Microsoft® Windows® Operating Systemcompany: Microsoft Corporationdescription: USB Modem DriverBug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.

I made this error-file with the programm "whocrashed". I hope anybody has a idea. I allready updated all drivers. Thanks for your help.

P.S.: Please excuse my bad english

Please follow - Blue Screen of Death (BSOD) Posting Instructions

Code:

BugCheck D1, {b8, 2, 0, fffff880079a8161}

Probably caused by : usbser.sys ( usbser!UsbSerTryToCompleteCurrent+1d )

Code:

1: kd> r
Last set context:
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8005cb9a40
rdx=fffffa8005cb9c02 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880079a8161 rsp=fffff88002f1b940 rbp=0000000000000000
 r8=0000000000000000  r9=fffffa8005cb9c88 r10=fffff880009eab80
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=0000  es=0000  fs=0000  gs=0000             efl=00010282
usbser!UsbSerTryToCompleteCurrent+0x1d:
fffff880`079a8161 4c8b90b8000000  mov     r10,qword ptr [rax+0B8h] ds:00000000`000000b8=????????????????

The address referenced was a Data Segment register, which contained a NULL value. It's okay for the Data Segment to be loaded with a NULL pointer, however, any references afterwards will result in a General Protection Fault, and causes no memory reference to occur.

Code:

1: kd> r @ds
Last set context:
ds=0000

Code:

1: kd> !dpx
Start memory scan  : 0xfffff88002f1b668 ($csp)
End memory scan    : 0xfffff88002f1c000 (Stack Base)

               rsp : 0xfffff88002f1b668 : 0xfffff800030d0169 : nt!KiBugCheckDispatch+0x69
0xfffff88002f1b668 : 0xfffff800030d0169 : nt!KiBugCheckDispatch+0x69
0xfffff88002f1b690 : 0xfffff880079a8161 : usbser!UsbSerTryToCompleteCurrent+0x1d
0xfffff88002f1b698 : 0xfffff880040069c0 : vwififlt!FilterReceiveNetBufferLists+0x158
0xfffff88002f1b7a8 : 0xfffff800030cede0 : nt!KiPageFault+0x260
0xfffff88002f1b7b0 : 0xfffff880009ea180 :  Trap @ fffff88002f1b7b0
0xfffff88002f1b7b8 : 0xfffff800030dc1b8 : nt!KeUpdateRunTime+0xb8
0xfffff88002f1b8e8 : 0xfffff880079a1913 : usbser!RestartRead+0x7b
0xfffff88002f1b918 : 0xfffff880079a8161 : usbser!UsbSerTryToCompleteCurrent+0x1d
0xfffff88002f1b978 : 0xfffff880079a1ff6 : usbser!CheckForQueuedReads+0x106
0xfffff88002f1b9b8 : 0xfffff880079a88bc : usbser!UsbSerStartRead
0xfffff88002f1b9c0 : 0xfffff880079a8244 : usbser!UsbSerGetNextIrp
0xfffff88002f1b9e8 : 0xfffff880079a1caf : usbser!ReadCompletion+0x153
0xfffff88002f1ba28 : 0xfffff800030d45d1 : nt!IopfCompleteRequest+0x341
0xfffff88002f1bab8 : 0xfffff88003e906fe : USBPORT!USBPORT_DereferenceDeviceHandle+0x14e
0xfffff88002f1bb18 : 0xfffff88003e7b631 : USBPORT!USBPORT_Core_iCompleteDoneTransfer+0xa15
0xfffff88002f1bb68 : 0xfffff88003e77b28 : USBPORT!USBPORT_TxCsqFindIrp+0x1c
0xfffff88002f1bbf8 : 0xfffff88003e7bb0f : USBPORT!USBPORT_Core_iIrpCsqCompleteDoneTransfer+0x3a7
0xfffff88002f1bc28 : 0xfffff88003e6ab20 : USBPORT!USBPORT_Xdpc_iBegin+0x110
0xfffff88002f1bc58 : 0xfffff88003e7966f : USBPORT!USBPORT_Core_UsbIocDpc_Worker+0xf3
0xfffff88002f1bc98 : 0xfffff88003e6af89 : USBPORT!USBPORT_Xdpc_Worker+0x1d9
0xfffff88002f1bcc8 : 0xfffff800030db30c : nt!KiRetireDpcList+0x1bc
0xfffff88002f1bd78 : 0xfffff800030c88ca : nt!KiIdleLoop+0x5a
0xfffff88002f1bd98 : 0xfffff88003e6adb0 : USBPORT!USBPORT_Xdpc_Worker

I've had to make some assumptions since I couldn't use the !irpfind extension or anything else which would have been useful, since we are dealing with a Minidump.

Do you have any Kernel Memory Dumps to use? They should be located in this folder:

Code:

C:\Windows\MEMORY.DMP

The raw stack begins with some DPC interrupts being sent, these I assume seem to be used for the first I/O completions.

After the first read request is completed, I presume using the IRP_MJ_READ, and goes to check the next IRP within the queue. The IRP then reads data from the device object associated with the driver, and then checks the queue again. After checking the queue, the Read request seems to fail for some reason and the attempt to complete the request is resent.

Code:

1: kd> lmvm NETw5s64

start             end                 module name
fffff880`05630000 fffff880`05d8f000   NETw5s64 T (no symbols)           
    Loaded symbol image file: NETw5s64.sys
    Image path: \SystemRoot\system32\DRIVERS\NETw5s64.sys
    Image name: NETw5s64.sys
    Browse all global symbols  functions  data
    Timestamp:        Wed Jan 13 16:37:13 2010 (4B4DF6B9)
    CheckSum:         0075EBFF
    ImageSize:        0075F000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your Intel 5100 wifi driver seems to be causing problems, please check for any updates from here - https://downloadcenter.intel.com/Default.aspx

Thanks very much for your help. I will check the WIFI driver. I found only a MEMORY.crashdumpfile but it has a size of 141MB in ZIP?! Thanks for your help.

Best Regards

Yes, that should be a Kernel Memory dump, please upload to Skydrive. I've got instructions on how to do so on my blog here - BSODTutorials: How to Upload Kernel Memory Dumps to Skydrive

hi bluerobot, here is the url to the Memory-File:

https://skydrive.live.com/redir?resi...nt=file%2c.zip

thanks very much

Can't find much more information, any other crashes?

No I cant find any other crashes. Do you know some way to update the usbser.sys or any other idea?
Best regards
eyk

usbser.sys isn't the problem, it was your Intel Wi-Fi driver, which has now been updated. Please leave this thread open for a few more days, and if no more crashes, then you may mark the thread as solved.