Windows 7 Boot BSOD, Bccode: d1

Dundret · 23 Feb 2015

Hi, i've been having some issues sometimes getting startup bluescreens. I recently formated my PC and the problems didn't start occuring right away so i suspect some driver issue but i can't quite figure it out. DM log collector file is included.

The most recent one show these messages if it's any help:

Bccode: d1
bcp1: 000000000000001c
bcp2: 0000000000000002
bcp3: 0000000000000008
bcp4: 000000000000001c

Very thankful for help!! :)

Arc · 23 Feb 2015

Hi Dundret.

Update the network driver from Realtek .... you need to take the second one from the list, the Win7 and Server 2008 R2 Auto Installation Program (SID:1705495).

Let us know the situation after doing it. Another issue is there, which is not very explicit. So let us minimize one first and then we will pay attention to the remaining.
___________________________________________

Code:

BugCheck D1, {20, 2, 0, fffff88000f3b351}

Probably caused by : ACPI.sys ( ACPI!ACPIBuildCompleteMustSucceed+19 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000020, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88000f3b351, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c0100
GetUlongFromAddress: unable to read from fffff800032c01c0
 0000000000000020 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
ACPI!ACPIBuildCompleteMustSucceed+19
fffff880`00f3b351 8b4120          mov     eax,dword ptr [rcx+20h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

DPC_STACK_BASE:  FFFFF80000BA2FB0

TRAP_FRAME:  fffff80000ba2c30 -- (.trap 0xfffff80000ba2c30)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000014 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000f3b351 rsp=fffff80000ba2dc0 rbp=fffffa80085f72f0
 r8=0000000000000000  r9=fffffa80085f7380 r10=fffff80003012000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac pe cy
ACPI!ACPIBuildCompleteMustSucceed+0x19:
fffff880`00f3b351 8b4120          mov     eax,dword ptr [rcx+20h] ds:00000000`00000020=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003086469 to fffff80003086ec0

STACK_TEXT:  
fffff800`00ba2ae8 fffff800`03086469 : 00000000`0000000a 00000000`00000020 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00ba2af0 fffff800`030850e0 : fffff880`00f6bd00 fffff880`00f6cac8 fffffa80`08c0de78 fffffa80`085f7380 : nt!KiBugCheckDispatch+0x69
fffff800`00ba2c30 fffff880`00f3b351 : fffffa80`085f7380 fffff880`00f46304 fffff880`00f6d2f0 fffff880`00f3e1e9 : nt!KiPageFault+0x260
fffff800`00ba2dc0 fffff880`00f3e186 : fffffa80`085f7380 fffff880`00f3e0d0 00000000`00000000 fffffa80`085f7380 : ACPI!ACPIBuildCompleteMustSucceed+0x19
fffff800`00ba2e00 fffff880`00f3dac2 : fffffa80`085f7380 fffff880`00f6d2f0 fffff880`00f6d2f0 fffffa80`06c7b3f0 : ACPI!ACPIBuildProcessRunMethodPhaseRecurse+0xa2
fffff800`00ba2e70 fffff880`00f3b491 : fffff880`00f6d300 fffff880`00f6d340 fffff880`00f6d2d0 fffff880`00f6d2f0 : ACPI!ACPIBuildProcessGenericList+0x62
fffff800`00ba2eb0 fffff800`030927ac : fffff800`03203e80 00000000`00000000 fffff880`00f6d280 fffffa80`06c7a118 : ACPI!ACPIBuildDeviceDpc+0xdd
fffff800`00ba2f00 fffff800`03089925 : 00000000`00000000 fffffa80`06d06040 00000000`00000000 fffff880`00f3b3b4 : nt!KiRetireDpcList+0x1bc
fffff800`00ba2fb0 fffff800`0308973c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxRetireDpcList+0x5
fffff880`031c3790 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ACPI!ACPIBuildCompleteMustSucceed+19
fffff880`00f3b351 8b4120          mov     eax,dword ptr [rcx+20h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  ACPI!ACPIBuildCompleteMustSucceed+19

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ACPI

IMAGE_NAME:  ACPI.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79294

IMAGE_VERSION:  6.1.7601.17514

FAILURE_BUCKET_ID:  X64_0xD1_ACPI!ACPIBuildCompleteMustSucceed+19

BUCKET_ID:  X64_0xD1_ACPI!ACPIBuildCompleteMustSucceed+19

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xd1_acpi!acpibuildcompletemustsucceed+19

FAILURE_ID_HASH:  {4ed96d71-18ea-d0b9-b7e8-acbe3e64b679}

Followup: MachineOwner
---------

Code:

BugCheck D1, {1c, 2, 8, 1c}

*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
Probably caused by : Rt64win7.sys ( Rt64win7+70cd0 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 000000000000001c, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: 000000000000001c, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003308100
GetUlongFromAddress: unable to read from fffff800033081c0
 000000000000001c Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
+a669f1fdc535
00000000`0000001c ??              ???

PROCESS_NAME:  System

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

DPC_STACK_BASE:  FFFFF80000BA2FB0

TRAP_FRAME:  fffff80000b9c0b0 -- (.trap 0xfffff80000b9c0b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000001c rbx=0000000000000000 rcx=0000000000000047
rdx=0000000500000000 rsi=0000000000000000 rdi=0000000000000000
rip=000000000000001c rsp=fffff80000b9c248 rbp=fffffa80087bb258
 r8=0000000000000100  r9=0000000000000000 r10=fffffa8008afaf90
r11=00000007aa81bbc0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
00000000`0000001c ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030ce469 to fffff800030ceec0

FAILED_INSTRUCTION_ADDRESS: 
+a669f1fdc535
00000000`0000001c ??              ???

STACK_TEXT:  
fffff800`00b9bf68 fffff800`030ce469 : 00000000`0000000a 00000000`0000001c 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff800`00b9bf70 fffff800`030cd0e0 : fffff800`00b9c230 00000000`00000028 fffff880`0155c110 00000005`cde94d67 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c0b0 00000000`0000001c : fffff800`030212bd ffff000f`285e44c2 00000000`001f0000 00000000`00000001 : nt!KiPageFault+0x260
fffff800`00b9c248 fffff800`030212bd : ffff000f`285e44c2 00000000`001f0000 00000000`00000001 fffff800`03020a7b : 0x1c
fffff800`00b9c250 fffff800`03020a7b : 00000000`0000000a 00000000`00000000 fffffa80`087bb608 fffffa80`087bb648 : hal!HalpTscStallExecutionProcessor+0xb9
fffff800`00b9c2b0 fffff880`04542cd0 : fffffa80`087bb000 fffffa80`087bb258 00000000`00000000 fffff800`00b9c501 : hal!KeStallExecutionProcessor+0x183
fffff800`00b9c2e0 fffffa80`087bb000 : fffffa80`087bb258 00000000`00000000 fffff800`00b9c501 fffff800`00b9c501 : Rt64win7+0x70cd0
fffff800`00b9c2e8 fffffa80`087bb258 : 00000000`00000000 fffff800`00b9c501 fffff800`00b9c501 fffff880`044ecb56 : 0xfffffa80`087bb000
fffff800`00b9c2f0 00000000`00000000 : fffff800`00b9c501 fffff800`00b9c501 fffff880`044ecb56 fffffa80`087bb000 : 0xfffffa80`087bb258


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Rt64win7+70cd0
fffff880`04542cd0 ??              ???

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  Rt64win7+70cd0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Rt64win7

IMAGE_NAME:  Rt64win7.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4df1baab

FAILURE_BUCKET_ID:  X64_0xD1_CODE_AV_NULL_IP_Rt64win7+70cd0

BUCKET_ID:  X64_0xD1_CODE_AV_NULL_IP_Rt64win7+70cd0

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xd1_code_av_null_ip_rt64win7+70cd0

FAILURE_ID_HASH:  {b3e32c0a-ee18-ce1c-0559-15f694d30d82}

Followup: MachineOwner
---------

0: kd> lmvm Rt64win7
start             end                 module name
fffff880`044d2000 fffff880`04557000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: \SystemRoot\system32\DRIVERS\Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:        Fri Jun 10 12:03:15 2011 (4DF1BAAB)
    CheckSum:         0008B67F
    ImageSize:        00085000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Dundret · 23 Feb 2015

Thanks alot! I've installed the new driver. Will get back to you in a couple of days if any more errors emerge :)

Dundret · 22 Mar 2015

Hi again! Seems another problem has arisen :/ I just got another start up BSOD after being free for a few weeks.. Please help! Log collector file has been attached.

Thanks for any help!!

Arc · 24 Mar 2015

Ok, first you scan the system for possible virus infection with the following programs.

Let us know the results.

Dundret · 25 Mar 2015

Ok, i found no threats scanning with the TDSSKiller. Neither did booting with the Windows Defender Offline.

Arc · 26 Mar 2015

A relieving news.

Now enable Driver Verifier to monitor the drivers.

Driver Verifier - Enable and Disable

Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.