Solved ntoskrnl.exe 0x0000001E BSOD

[justinbronze]

Good, I will.

And maybe when this is solved we it will help anyone with this problem in the future.

 

[justinbronze]

Something weird just happened. I was playing MW3 and the game froze and the sound became the "da-da-da-da-da" that usually happens right before the blue screen pops up. So I waited, but the sound just kept going. So I hit control alt delete. Nothing happened. Then the sound stopped, game unfroze. It lagged a little bit for a minute or so, and then the windows task menu popped up. I closed it, kept on playing. Lag stopped. Everything's fine again.

So it seems that my computer tried to BSOD on me, but couldn't/didn't. Any thoughts

 

[writhziden]

Something weird just happened. I was playing MW3 and the game froze and the sound became the "da-da-da-da-da" that usually happens right before the blue screen pops up. So I waited, but the sound just kept going. So I hit control alt delete. Nothing happened. Then the sound stopped, game unfroze. It lagged a little bit for a minute or so, and then the windows task menu popped up. I closed it, kept on playing. Lag stopped. Everything's fine again.

So it seems that my computer tried to BSOD on me, but couldn't/didn't. Any thoughts

It may have been an application, service, or system error that halted the system until it could fix itself. If you continue to see behavior like that, open up Event Viewer and check for errors that reoccur around the time of the hiccup (Start Menu -> type "eventvwr" without quotes into the Search programs and files and hit enter -> Expand Custom Views -> Administrative Events). Search for the errors with Google and try to find a solution.

 

[justinbronze]

I did check event viewer afterwards, and all that showed up was a SideBySide error (Event id 72) that pertained to MSE. I don't know if this caused it, because it seems the same error happened two days ago with nothing like I experienced happening.

But what I did notice was that Event Viewer logged the problem at 3AM, when it occurred half past midnight. I find it odd that it would log the event at a time that had not yet happened.

 

[justinbronze]

Oh goodie, another BSOD.

Zip file attached.

 

[writhziden]

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\justinbronze\Windows_NT6_BSOD_jcgriff2\011512-50591-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c53000 PsLoadedModuleList = 0xfffff800`02e98670
Debug session time: Sun Jan 15 16:48:33.864 2012 (UTC - 7:00)
System Uptime: 0 days 5:41:10.409
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {9, 2, 1, fffff80002ceace8}

Unable to load image usbfilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for usbfilter.sys
*** ERROR: Module load completed but symbols could not be loaded for usbfilter.sys
Probably caused by : usbfilter.sys ( usbfilter+1bf5 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000009, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ceace8, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f02100
 0000000000000009 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IoAllocateMdl+118
fffff800`02ceace8 48894108        mov     qword ptr [rcx+8],rax

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff88002ffcf70 -- (.trap 0xfffff88002ffcf70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8006705010 rbx=0000000000000000 rcx=0000000000000001
rdx=fffffa8006705011 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ceace8 rsp=fffff88002ffd100 rbp=0000000000000008
 r8=fffffa8006705010  r9=0000000000000000 r10=fffffa8003ba5cf0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!IoAllocateMdl+0x118:
fffff800`02ceace8 48894108        mov     qword ptr [rcx+8],rax ds:ed30:00000000`00000009=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ccf1e9 to fffff80002ccfc40

STACK_TEXT:  
fffff880`02ffce28 fffff800`02ccf1e9 : 00000000`0000000a 00000000`00000009 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`02ffce30 fffff800`02ccde60 : 00000000`c00000bb 00000000`00000008 00000000`c00000bb 00000000`00000030 : nt!KiBugCheckDispatch+0x69
fffff880`02ffcf70 fffff800`02ceace8 : fffffa80`0615fb00 fffff880`0416e63c 00000000`000003ed fffff880`04150f5d : nt!KiPageFault+0x260
fffff880`02ffd100 fffff880`0416c252 : fffffa80`0623e1a0 00000000`c000000d fffffa80`05e70000 fffffa80`0615fb00 : nt!IoAllocateMdl+0x118
fffff880`02ffd150 fffff880`04174e74 : fffff980`0bdbed30 fffffa80`060d0009 fffff980`0bdbed30 fffffa80`0623e1a0 : USBPORT!USBPORT_ProcessURB+0x8de
fffff880`02ffd200 fffff880`0414eaf4 : 00000000`00000000 fffffa80`060d7050 fffffa80`06c87350 fffff980`0bdbed30 : USBPORT!USBPORT_PdoInternalDeviceControlIrp+0x138
fffff880`02ffd240 fffff800`03175c16 : fffff980`0bdbed30 00000000`00000002 fffffa80`060d7050 fffffa80`07152f40 : USBPORT!USBPORT_Dispatch+0x1dc
fffff880`02ffd280 fffff880`0489ebf5 : fffff980`0bdbed30 00000000`00000002 fffffa80`060d43b0 fffffa80`07152f40 : nt!IovCallDriver+0x566
fffff880`02ffd2e0 fffff980`0bdbed30 : 00000000`00000002 fffffa80`060d43b0 fffffa80`07152f40 fffffa80`060d4500 : usbfilter+0x1bf5
fffff880`02ffd2e8 00000000`00000002 : fffffa80`060d43b0 fffffa80`07152f40 fffffa80`060d4500 fffff800`02d8d600 : 0xfffff980`0bdbed30
fffff880`02ffd2f0 fffffa80`060d43b0 : fffffa80`07152f40 fffffa80`060d4500 fffff800`02d8d600 fffff980`0bdbef68 : 0x2
fffff880`02ffd2f8 fffffa80`07152f40 : fffffa80`060d4500 fffff800`02d8d600 fffff980`0bdbef68 fffffa80`060d4500 : 0xfffffa80`060d43b0
fffff880`02ffd300 fffffa80`060d4500 : fffff800`02d8d600 fffff980`0bdbef68 fffffa80`060d4500 00000000`00000000 : 0xfffffa80`07152f40
fffff880`02ffd308 fffff800`02d8d600 : fffff980`0bdbef68 fffffa80`060d4500 00000000`00000000 fffffa80`05e6e020 : 0xfffffa80`060d4500
fffff880`02ffd310 00000000`00000002 : fffffa80`060d43b0 00000001`06c9d2e0 fffff980`0bdbed30 fffff880`0489e4f5 : nt!PfTSectInfoDisableSchedule+0x70
fffff880`02ffd350 fffffa80`060d43b0 : 00000001`06c9d2e0 fffff980`0bdbed30 fffff880`0489e4f5 fffffa80`060d43b0 : 0x2
fffff880`02ffd358 00000001`06c9d2e0 : fffff980`0bdbed30 fffff880`0489e4f5 fffffa80`060d43b0 fffff980`0bdbed30 : 0xfffffa80`060d43b0
fffff880`02ffd360 fffff980`0bdbed30 : fffff880`0489e4f5 fffffa80`060d43b0 fffff980`0bdbed30 00000000`00000002 : 0x1`06c9d2e0
fffff880`02ffd368 fffff880`0489e4f5 : fffffa80`060d43b0 fffff980`0bdbed30 00000000`00000002 fffffa80`060d43b0 : 0xfffff980`0bdbed30
fffff880`02ffd370 fffffa80`060d43b0 : fffff980`0bdbed30 00000000`00000002 fffffa80`060d43b0 fffffa80`060d4500 : usbfilter+0x14f5
fffff880`02ffd378 fffff980`0bdbed30 : 00000000`00000002 fffffa80`060d43b0 fffffa80`060d4500 fffff980`0bdbef68 : 0xfffffa80`060d43b0
fffff880`02ffd380 00000000`00000002 : fffffa80`060d43b0 fffffa80`060d4500 fffff980`0bdbef68 fffff980`0bdbef68 : 0xfffff980`0bdbed30
fffff880`02ffd388 fffffa80`060d43b0 : fffffa80`060d4500 fffff980`0bdbef68 fffff980`0bdbef68 00000000`00000000 : 0x2
fffff880`02ffd390 fffffa80`060d4500 : fffff980`0bdbef68 fffff980`0bdbef68 00000000`00000000 fffffa80`060d43b0 : 0xfffffa80`060d43b0
fffff880`02ffd398 fffff980`0bdbef68 : fffff980`0bdbef68 00000000`00000000 fffffa80`060d43b0 fffff880`0489e800 : 0xfffffa80`060d4500
fffff880`02ffd3a0 fffff980`0bdbef68 : 00000000`00000000 fffffa80`060d43b0 fffff880`0489e800 fffffa02`00000000 : 0xfffff980`0bdbef68
fffff880`02ffd3a8 00000000`00000000 : fffffa80`060d43b0 fffff880`0489e800 fffffa02`00000000 fffff800`00000000 : 0xfffff980`0bdbef68


STACK_COMMAND:  kb

FOLLOWUP_IP: 
usbfilter+1bf5
fffff880`0489ebf5 ??              ???

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  usbfilter+1bf5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: usbfilter

IMAGE_NAME:  usbfilter.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d0899c9

FAILURE_BUCKET_ID:  X64_0xA_VRF_usbfilter+1bf5

BUCKET_ID:  X64_0xA_VRF_usbfilter+1bf5

Followup: MachineOwner
---------

Finally, something to go on. This was caused by a USB device. Follow the steps in http://www.sevenforums.com/tutorials/165554-usb-driver-general-fix-problems.html to determine which device (if any) or troubleshoot possible USB conflicts due to hidden/inactive devices.

 

[justinbronze]

Followed that whole tutorial thing. Faded things uninstalled, INFCACHE.1 deleted and recreated. Now we play the waiting game.

So does this mean that it cannot be a HDD or Memory problem?

 

[writhziden]

Followed that whole tutorial thing. Faded things uninstalled, INFCACHE.1 deleted and recreated. Now we play the waiting game.

So does this mean that it cannot be a HDD or Memory problem?

Does not appear to be, but your case is very strange, so I do not want to rule anything out completely. I have seen memory tests come back fine and the RAM still be bad, so I never really rule that out. Hard disks seem to check out, so I'm almost positive that is not the issue.

Do have one question. I note that you have Microsoft Security Essentials. Has there ever been another antivirus system installed, such as when you first bought the computer? I note it is custom built, but I also note you said the OS came pre-installed. How exactly was this computer put together and the software originally installed?

If you could answer both of my above questions, I would appreciate it. Best wishes that the USB troubleshooting provides more stability.

 

[zigzag3143]

Just a drive by thought.

You have been at this for more than 2 weeks and more than 60 posts.

You might want to start thinking about a clean install if at all possible.

My $0.02

 

[JMH]

Over 2 weeks & many posts later...your choices seem limited ATM.

It is a salient reminder re the importance of backing up your computer & all of your work frequently so that in situations such as this you can restore your system to a good working state.

http://www.sevenforums.com/tutorials/663-backup-complete-computer-create-image-backup.html

http://www.sevenforums.com/tutorials/700-system-restore.html

>>>Is it time for a clean install now?

http://www.sevenforums.com/tutorials/1649-clean-install-windows-7-a.html

 

[justinbronze]

Does not appear to be, but your case is very strange, so I do not want to rule anything out completely. I have seen memory tests come back fine and the RAM still be bad, so I never really rule that out. Hard disks seem to check out, so I'm almost positive that is not the issue.

Do have one question. I note that you have Microsoft Security Essentials. Has there ever been another antivirus system installed, such as when you first bought the computer? I note it is custom built, but I also note you said the OS came pre-installed. How exactly was this computer put together and the software originally installed?

If you could answer both of my above questions, I would appreciate it. Best wishes that the USB troubleshooting provides more stability.

There only other security system type thing that has ever been on it is Malwarebytes (the purchased version). Other than that, there has been no other security system ever on.

After the computer was built, Windows 7 was bought and installed on the computer. So maybe poor choice of words on my part. But Windows 7 is the only OS on the system, and it was installed shortly after the computer was put together.

My very last resort would be a clean install, and I'm not ready to scuttle the ship just yet.

 

[writhziden]

Does not appear to be, but your case is very strange, so I do not want to rule anything out completely. I have seen memory tests come back fine and the RAM still be bad, so I never really rule that out. Hard disks seem to check out, so I'm almost positive that is not the issue.

Do have one question. I note that you have Microsoft Security Essentials. Has there ever been another antivirus system installed, such as when you first bought the computer? I note it is custom built, but I also note you said the OS came pre-installed. How exactly was this computer put together and the software originally installed?

If you could answer both of my above questions, I would appreciate it. Best wishes that the USB troubleshooting provides more stability.

There only other security system type thing that has ever been on it is Malwarebytes (the purchased version). Other than that, there has been no other security system ever on.

After the computer was built, Windows 7 was bought and installed on the computer. So maybe poor choice of words on my part. But Windows 7 is the only OS on the system, and it was installed shortly after the computer was put together.

My very last resort would be a clean install, and I'm not ready to scuttle the ship just yet.

If you are not comfortable doing a clean install, you may consider a http://www.sevenforums.com/tutorials/3413-repair-install.html to leave all programs and user files in place. Backup any important files first in case anything goes wrong.

You can let it run now that you have applied the USB troubleshooting and see if it resolves the problem. You should run with both Verifier enabled and disabled to test system stability. If you continue to have instability, consider the repair install first (after backing up important files).

 

[justinbronze]

Okay. Just had another one of those weird "almost BSOD" things while played MW3, except no lag afterward. Froze, sound went to the "da-da-da" then it unfroze and it was as if nothing happened.. Event Viewer logged a VSS error.

"Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {20ba945b-b38a-4502-8c8d-a9ccc234bbac}"

 

[writhziden]

Okay. Just had another one of those weird "almost BSOD" things while played MW3, except no lag afterward. Froze, sound went to the "da-da-da" then it unfroze and it was as if nothing happened.. Event Viewer logged a VSS error.

"Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {20ba945b-b38a-4502-8c8d-a9ccc234bbac}"

VSS is part of backup software. It is the shadow copy service. Do you have backups enabled? Is the drive connected for the backup? Those errors often occur when the drive is not connected and you get an error through Action center telling you your backup was not successful.

 

[justinbronze]

Drives connected, backup's enabled. Don't know why I'd get that error.

 

[writhziden]

Drives connected, backup's enabled. Don't know why I'd get that error.

Could be third party software. If you are concerned about it, you can try to http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html and see if you can narrow down the application. Do you have any third party backup tools? Any other security tools than MSE?

 

[justinbronze]

No other backup software besides what Windows comes installed with. Also no security tools besides Malwarebytes and MSE

 

[writhziden]

No other backup software besides what Windows comes installed with. Also no security tools besides Malwarebytes and MSE

Do you have malwarebytes installed and constantly running, or just the standalone version that scans?

 

[justinbronze]

Its the bought version that runs constantly.

 

[writhziden]

Its the bought version that runs constantly.

Having Malwarebytes and MSE running at the same time may cause conflicts. We recommend one or the other. Both are accepted programs on these forums. If you paid for Malwarebytes, you can uninstall MSE.