Blue Screen of Death --Fix Needed--

[mpl34]

Lately my computer has been receiving the blue screen of death. It only seems to happen when my computer has been left idle for approx. 10min then the blue screen will pop up it will dump the memory and reset it self. It has been occurring for the past 2 weeks, I believe it has something to do with my 2.5" external harddrive. Every once and a while i'll be able to correctly eject the hard drive and the error will stop but usually after plugging in or ejecting the hard drive will cause the error to begin again.

I have no idea why this is happening and would love some help, I have provided some useful information below... cheers,


Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7600.2.0.0.256.1
Locale ID: 5129

Additional information about the problem:
BCCode: 1000008e
BCP1: C0000005
BCP2: 8B5D35EE
BCP3: 9FCFCB10
BCP4: 00000000
OS Version: 6_1_7600
Service Pack: 0_0
Product: 256_1

 

[zigzag3143]

Lately my computer has been receiving the blue screen of death. It only seems to happen when my computer has been left idle for approx. 10min then the blue screen will pop up it will dump the memory and reset it self. It has been occurring for the past 2 weeks, I believe it has something to do with my 2.5" external harddrive. Every once and a while i'll be able to correctly eject the hard drive and the error will stop but usually after plugging in or ejecting the hard drive will cause the error to begin again.

I have no idea why this is happening and would love some help, I have provided some useful information below... cheers,


Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7600.2.0.0.256.1
Locale ID: 5129

Additional information about the problem:
BCCode: 1000008e
BCP1: C0000005
BCP2: 8B5D35EE
BCP3: 9FCFCB10
BCP4: 00000000
OS Version: 6_1_7600
Service Pack: 0_0
Product: 256_1

We really need the actual DMP file.

If you wish to have others assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder. The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Start your own thread in the "Crashes and Debugging" section of the forum and attach the ZIP archive to your post using the "paperclip" (file attachments) button.
* Briefly describe the problem history and circumstances in the same post. Somebody will attend to your query as soon as possible.


edit: even without seeing the DMP the first parameter is a memory exception. I can tell you more after I see the DMP but test your memory

Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Boot from the CD, and leave it running for at least 5 or 6 passes.

 

[mpl34]

Sorry had difficulty attaching it the first time

 

[zigzag3143]

Sorry had difficulty attaching it the first time

This one was caused by your US4Visa.sys part of us4vista.sys Universal Shield. It is 14 months old and should be removed



Old drivers that need updating

rixdptsk.sys        0x9161e000    0x9166f000    0x00051000    0x455a6ed7    11/14/2006 21:35:19                        
rimsptsk.sys        0x90fc0000    0x90fd4000    0x00014000    0x455a8cb5    11/14/2006 23:42:45                        
rimmptsk.sys        0x90fb2000    0x90fc0000    0x0000e000    0x455accd7    11/15/2006 04:16:23                        
bcm4sbxp.sys        0x90f5c000    0x90f6d000    0x00011000    0x4562f047    11/21/2006 08:25:43                        
pcouffin.sys        0x91799000    0x917a4900    0x0000b900    0x457584b9    12/5/2006 10:39:53                        
stwrt.sys        0x9248e000    0x924e3000    0x00055000    0x46e95767    9/13/2007 11:29:43                        
SynTP.sys        0x91687000    0x916b4980    0x0002d980    0x472254e1    10/26/2007 16:58:09                        
VSTCNXT3.SYS        0x9293e000    0x929f3000    0x000b5000    0x48f68ad9    10/15/2008 20:29:13                        
VSTAZL3.SYS        0x9252b000    0x92568000    0x0003d000    0x48f68b0b    10/15/2008 20:30:03                        
VSTDPV3.SYS        0x9283c000    0x9293e000    0x00102000    0x48f68b84    10/15/2008 20:32:04                        
nvlddmkm.sys        0x9181e000    0x91f504c0    0x007324c0    0x4982c9f0    1/30/2009 05:35:44                        
bcmwl6.sys        0x90e3a000    0x90f52000    0x00118000    0x49cc24c8    3/26/2009 20:58:48                        
spldr.sys        0x8b5ea000    0x8b5f2000    0x00008000    0x4a084ebb    5/11/2009 12:13:47                        
spsys.sys        0x9f0d1000    0x9f13b000    0x0006a000    0x4a085436    5/11/2009 12:37:10                        
GEARAspiWDM.sys        0x916d1000    0x916d6280    0x00005280    0x4a1151b5    5/18/2009 08:16:53                        
amdxata.sys        0x8afc2000    0x8afcb000    0x00009000    0x4a12f30f    5/19/2009 13:57:35                        
[COLOR=Red][I][B]US4Vista.sys    US4Vista.sys+15ee    0x8b5d2000    0x8b5ea000    0x00018000    0x4a26569c    6/3/2009 06:55:24[/B][/I][/COLOR]

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\082610-26176-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols;*http://msdl.microsoft.com/download/symbols ;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82a52000 PsLoadedModuleList = 0x82b9a810
Debug session time: Wed Aug 25 21:36:02.525 2010 (GMT-4)
System Uptime: 0 days 0:01:12.507
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
.....
Unable to load image \SystemRoot\System32\Drivers\US4Vista.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for US4Vista.sys
*** ERROR: Module load completed but symbols could not be loaded for US4Vista.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 8b5d35ee, 9fcfcb10, 0}

Probably caused by : US4Vista.sys ( US4Vista+15ee )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8b5d35ee, The address that the exception occurred at
Arg3: 9fcfcb10, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
US4Vista+15ee
8b5d35ee 8b490c          mov     ecx,dword ptr [ecx+0Ch]

TRAP_FRAME:  9fcfcb10 -- (.trap 0xffffffff9fcfcb10)
ErrCode = 00000000
eax=86b04464 ebx=86b04388 ecx=00000010 edx=86b04388 esi=8748f7d8 edi=00000000
eip=8b5d35ee esp=9fcfcb84 ebp=9fcfcba8 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
US4Vista+0x15ee:
8b5d35ee 8b490c          mov     ecx,dword ptr [ecx+0Ch] ds:0023:0000001c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  PDEngine.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8b5d579a to 8b5d35ee

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
9fcfcba8 8b5d579a 8748f7d8 00000000 9fcfcbd0 US4Vista+0x15ee
9fcfcbb8 82a8e4bc 8748f720 86b04388 86b04388 US4Vista+0x379a
9fcfcbd0 8ae813e8 87473b38 00000000 86ba3b30 nt!IofCallDriver+0x63
9fcfcbfc 82a8e4bc 87473b38 86b04388 86b04388 fltmgr!FltpDispatch+0xe2
9fcfcc14 82c8ff2e 86ba3b30 86b04388 86b04464 nt!IofCallDriver+0x63
9fcfcc34 82cacd11 87473b38 86ba3b30 00000000 nt!IopSynchronousServiceTail+0x1f8
9fcfccd0 82caf4ec 87473b38 86b04388 00000000 nt!IopXxxControlFile+0x6aa
9fcfcd04 82a9544a 00000224 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
9fcfcd04 770b64f4 00000224 00000000 00000000 nt!KiFastCallEntry+0x12a
00cbeb00 00000000 00000000 00000000 00000000 0x770b64f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
US4Vista+15ee
8b5d35ee 8b490c          mov     ecx,dword ptr [ecx+0Ch]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  US4Vista+15ee

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: US4Vista

IMAGE_NAME:  US4Vista.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a26569c

FAILURE_BUCKET_ID:  0x8E_US4Vista+15ee

BUCKET_ID:  0x8E_US4Vista+15ee

Followup: MachineOwner
---------

 

[CarlTR6]

Error code 8E, KERNEL_MODE_EXCEPTION_NOT_HANDLED_M - usual causes are Insufficient disk space, Device driver, Video card, BIOS, Breakpoint in startup without having a debugger attached, Hardware incompatibility, Faulty system service, 3rd party remote control, Memory.

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_082610-26176-01.zip\082610-26176-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*[URL="http://msdl.microsoft.com/download/symbols"]Symbol information[/URL]
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82a52000 PsLoadedModuleList = 0x82b9a810
Debug session time: Wed Aug 25 21:36:02.525 2010 (GMT-4)
System Uptime: 0 days 0:01:12.507
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
.....
Unable to load image \SystemRoot\System32\Drivers\US4Vista.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for US4Vista.sys
*** ERROR: Module load completed but symbols could not be loaded for US4Vista.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 8b5d35ee, 9fcfcb10, 0}

Probably caused by : US4Vista.sys ( US4Vista+15ee )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8b5d35ee, The address that the exception occurred at
Arg3: 9fcfcb10, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
US4Vista+15ee
8b5d35ee 8b490c          mov     ecx,dword ptr [ecx+0Ch]

TRAP_FRAME:  9fcfcb10 -- (.trap 0xffffffff9fcfcb10)
ErrCode = 00000000
eax=86b04464 ebx=86b04388 ecx=00000010 edx=86b04388 esi=8748f7d8 edi=00000000
eip=8b5d35ee esp=9fcfcb84 ebp=9fcfcba8 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
US4Vista+0x15ee:
8b5d35ee 8b490c          mov     ecx,dword ptr [ecx+0Ch] ds:0023:0000001c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  PDEngine.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8b5d579a to 8b5d35ee

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
9fcfcba8 8b5d579a 8748f7d8 00000000 9fcfcbd0 US4Vista+0x15ee
9fcfcbb8 82a8e4bc 8748f720 86b04388 86b04388 US4Vista+0x379a
9fcfcbd0 8ae813e8 87473b38 00000000 86ba3b30 nt!IofCallDriver+0x63
9fcfcbfc 82a8e4bc 87473b38 86b04388 86b04388 fltmgr!FltpDispatch+0xe2
9fcfcc14 82c8ff2e 86ba3b30 86b04388 86b04464 nt!IofCallDriver+0x63
9fcfcc34 82cacd11 87473b38 86ba3b30 00000000 nt!IopSynchronousServiceTail+0x1f8
9fcfccd0 82caf4ec 87473b38 86b04388 00000000 nt!IopXxxControlFile+0x6aa
9fcfcd04 82a9544a 00000224 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
9fcfcd04 770b64f4 00000224 00000000 00000000 nt!KiFastCallEntry+0x12a
00cbeb00 00000000 00000000 00000000 00000000 0x770b64f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
US4Vista+15ee
8b5d35ee 8b490c          mov     ecx,dword ptr [ecx+0Ch]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  US4Vista+15ee

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: US4Vista

IMAGE_NAME:  US4Vista.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a26569c

FAILURE_BUCKET_ID:  0x8E_US4Vista+15ee

BUCKET_ID:  0x8E_US4Vista+15ee

Followup: MachineOwner
---------

This is a hardware or hardware related error. The dump showed c0000005 which indicates memory corruption. You have some obsolete drivers on your system which can cause memory corruption. The dump specifiaclly pointed to this driver, US4Vista.sys. Update these drivers.

bcm4sbxp.sys Tue Nov 21 07:25:43 2006
bcmwl6.sys Thu Mar 26 20:58:48 2009
nvlddmkm.sys Fri Jan 30 04:35:44 2009
pcouffin.sys Tue Dec 05 09:39:53 2006
rimmptsk.sys Wed Nov 15 03:16:23 2006
rimsptsk.sys Tue Nov 14 22:42:45 2006
rixdptsk.sys Tue Nov 14 20:35:19 2006
stwrt.sys Thu Sep 13 11:29:43 2007
US4Vista.sys Wed Jun 03 06:55:24 2009
VSTAZL3.SYS Wed Oct 15 20:30:03 2008
VSTCNXT3.SYS Wed Oct 15 20:29:13 2008
VSTDPV3.SYS Wed Oct 15 20:32:04 2008

How To Find Drivers:
- I have listed links to most of the drivers in the code box below. Please use the links there to see what info I've found about those drivers.
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

If you need help, please post back. Once you have updated these drivers, reboot, run your system and update us on how you are doing. If you get another BSOD. please up load it and we will go from there.

Ken types faster than I . We both agree as to the analysis.

 

[cluberti]

These two are right - this driver was called based on the nt!WmipRegLookaside list function that preceded it:

// Registers at the time of the dump:
1: kd> r
eax=86b04464 ebx=86b04388 ecx=00000010 edx=86b04388 esi=8748f7d8 edi=00000000
eip=8b5d35ee esp=9fcfcb84 ebp=9fcfcba8 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
US4Vista+0x15ee:
8b5d35ee 8b490c          mov     ecx,dword ptr [ecx+0Ch] ds:0023:0000001c=????????

// Raw stack, stack pointer to base:
1: kd> dds 9fcfcb84 9fcfcba8 
9fcfcb84  87473b38
9fcfcb88  8748f720
9fcfcb8c  00000000
9fcfcb90  00000224
9fcfcb94  9fcfcbd8
9fcfcb98  86ba3b18
9fcfcb9c  000001ff
9fcfcba0  86ba3a78
9fcfcba4  82b87800 nt!WmipRegLookaside+0x40
9fcfcba8  9fcfcbb8

// Driver predates Win7's RTM of July 22, 2009, so this is probably a Vista driver given the date and name:
1: kd> lmvim US4Vista
start    end        module name
8b5d2000 8b5ea000   US4Vista T (no symbols)           
    Symbol file: US4Vista.sys
    Image path: \SystemRoot\System32\Drivers\US4Vista.sys
    Image name: US4Vista.sys
    Timestamp:        Wed Jun 03 06:55:24 2009 (4A26569C)
    CheckSum:         000150C9
    ImageSize:        00018000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

// Code executing in US4Vista at the time of the crash:
1: kd> u eip
US4Vista+0x15ee:
8b5d35ee 8b490c          mov     ecx,dword ptr [ecx+0Ch]
8b5d35f1 894d0c          mov     dword ptr [ebp+0Ch],ecx
8b5d35f4 80380d          cmp     byte ptr [eax],0Dh
8b5d35f7 0f855b010000    jne     US4Vista+0x1758 (8b5d3758)
8b5d35fd 80780101        cmp     byte ptr [eax+1],1
8b5d3601 0f8551010000    jne     US4Vista+0x1758 (8b5d3758)
8b5d3607 682e035e8b      push    offset US4Vista+0xe32e (8b5e032e)
8b5d360c e81bc70000      call    US4Vista+0xdd2c (8b5dfd2c)

That Wmip function appears to be required for new device notifications in WMI, so this is probably doing the registry work to handle that. I'm making an educated guess that the driver is walking an array (mov ecx,dword ptr [ecx+0Ch]), storing the new "this" pointer (ASM looks generated from C or C++ code, probably C++) off to an offset location from the ebp register (mov dword ptr [ebp+0Ch],ecx), and then checking the results to verify the array walk to the next member was successful (cmp byte ptr [eax],0Dh). However, the array pointer itself is corrupt, meaning something probably blew up when the driver loaded itself.

As previous posters have stated, this thing needs to be updated to something that's Win7 compatible, or it needs to be removed. In looking at the Universal Shield website, they do have a release of the product from March 31st of this year that is Win7 compatible (supposedly).

 

[mpl34]

Cheers, for the help, I simply deleted the driver and no crash since (i would have expected at least 3 in the time the computer has been running)

If the problem does persist i'll give an update.

Thanks for the help

 

[cluberti]

Cool - if this is indeed fixed, please mark the thread as resolved so others can find it!

 

[mpl34]

ok another problem, same deal another bsod, but i believe this is unrelated, happened whilst i was playing a game battle realms

 

[cluberti]

Yeah, that's a 116 bugcheck. Get the latest nvidia driver set installed, as yours is old by nvidia standards:

0: kd> lmvm nvlddmkm
start    end        module name
91615000 91d474c0   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        Fri Jan 30 04:35:44 2009 (4982C9F0)
    CheckSum:         007354C0
    ImageSize:        007324C0
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

If the problem continues after the latest driver is installed, follow the troubleshooting steps here for such a bugcheck. Also, please open a new thread for further analysis to keep these separate if this does continue. Thanks!