BSOD 0x00000044 random

[rs2000]

The system had some malware which has been cleaned using MalwareBytes full scan.

The BSOD do not appear to relate to any particular activity; the system is used at the reception desk of a dentist.

Thanks
Bob

 

[rs2000]

SF Diagnostic Upload

SF Diagnostic Upload attached

Bob

 

[Arc]

Hi rs2000.

Your crash dumps are not showing any finite probable cause. In such a situation, it is better to enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.
__________________________________________________________________________________________

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 44, {fffffa8001ff95d0, 1d7b, 0, 0}

Probably caused by : srv2.sys ( srv2!Smb2FreeResponseBufferForAsyncCall+1c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MULTIPLE_IRP_COMPLETE_REQUESTS (44)
A driver has requested that an IRP be completed (IoCompleteRequest()), but
the packet has already been completed.  This is a tough bug to find because
the easiest case, a driver actually attempted to complete its own packet
twice, is generally not what happened.  Rather, two separate drivers each
believe that they own the packet, and each attempts to complete it.  The
first actually works, and the second fails.  Tracking down which drivers
in the system actually did this is difficult, generally because the trails
of the first driver have been covered by the second.  However, the driver
stack for the current request can be found by examining the DeviceObject
fields in each of the stack locations.
Arguments:
Arg1: fffffa8001ff95d0, Address of the IRP
Arg2: 0000000000001d7b
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


IRP_ADDRESS: fffffa8001ff95d0

FOLLOWUP_IP: 
srv2!Smb2FreeResponseBufferForAsyncCall+1c
fffff880`0551b0ec 488bcb          mov     rcx,rbx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x44

PROCESS_NAME:  System

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

LAST_CONTROL_TRANSFER:  from fffff80002c277fc to fffff80002c7bbc0

STACK_TEXT:  
fffff880`033569c8 fffff800`02c277fc : 00000000`00000044 fffffa80`01ff95d0 00000000`00001d7b 00000000`00000000 : nt!KeBugCheckEx
fffff880`033569d0 fffff880`0551b0ec : fffff880`0552bd00 00000000`00000246 fffff880`6c32534c 00000000`000003db : nt! ?? ::FNODOBFM::`string'+0x31cdc
fffff880`03356a10 fffff880`0551e8fc : 00000000`00000000 fffff880`03356b10 fffffa80`0199db80 fffff880`0551f016 : srv2!Smb2FreeResponseBufferForAsyncCall+0x1c
fffff880`03356a40 fffff880`0551ec47 : 00000000`00000000 fffffa80`0199db80 fffffa80`0199db80 fffff880`05522961 : srv2!Smb2LeaseFree+0x9c
fffff880`03356a70 fffff880`055175f4 : 01cf20bf`11461deb 01cf20bf`11461deb fffff800`02e21200 fffffa80`0199db80 : srv2!Smb2DereferenceLease+0xa7
fffff880`03356af0 fffff800`02c85261 : fffff880`05510000 fffff800`02e21280 fffffa80`01802040 00000000`00000000 : srv2! ?? ::FNODOBFM::`string'+0x4192
fffff880`03356b70 fffff800`02f182ea : 74a45fc0`54bdca5e fffffa80`01802040 00000000`00000080 fffffa80`017a0ae0 : nt!ExpWorkerThread+0x111
fffff880`03356c00 fffff800`02c6c8e6 : fffff880`031d5180 fffffa80`01802040 fffff880`031dffc0 999d63ac`0547e61d : nt!PspSystemThreadStartup+0x5a
fffff880`03356c40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  srv2!Smb2FreeResponseBufferForAsyncCall+1c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: srv2

IMAGE_NAME:  srv2.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4dba2b0a

IMAGE_VERSION:  6.1.7601.17608

FAILURE_BUCKET_ID:  X64_0x44_srv2!Smb2FreeResponseBufferForAsyncCall+1c

BUCKET_ID:  X64_0x44_srv2!Smb2FreeResponseBufferForAsyncCall+1c

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x44_srv2!smb2freeresponsebufferforasynccall+1c

FAILURE_ID_HASH:  {bef626ed-25f0-968b-1a6a-50bdcc65c184}

Followup: MachineOwner
---------

0: kd> !irp fffffa8001ff95d0 1
Irp is active with 15 stacks 16 is current (= 0xfffffa8001ff9ad8)
 No Mdl: No System Buffer: Thread 00000000:  Irp is completed.  Pending has been returned
Flags = 00000000
ThreadListEntry.Flink = fffffa8001ff95f0
ThreadListEntry.Blink = fffffa8001ff95f0
IoStatus.Status = 00000000
IoStatus.Information = 0000006c
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = 00000000
UserEvent = 00000000
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000   
UserBuffer = 00000000
&Tail.Overlay.DeviceQueueEntry = fffffa8001ff9648
Tail.Overlay.Thread = 00000000
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = 00000000
Tail.Overlay.ListEntry.Blink = 00000000
Tail.Overlay.CurrentStackLocation = fffffa8001ff9ad8
Tail.Overlay.OriginalFileObject = 00000000
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  f, 0]   0  0 fffffa8004fa71f0 00000000 fffff880054c07a0-fffffa800660bbc0    
          fffffa8004fa71f0: Could not read device object or _DEVICE_OBJECT not found
    srvnet!SrvNetWskSendDataCallback
            Args: 00000000 00000000 00000000 00000000

 

[rs2000]

System has been stable for two days

The system has been stable for two days.

This may have been due to the application of this hotfix which I thought was unlikely to resolve the problem -
KB Article Number(s): 2552033
"0x00000044" Stop error on a computer that is running Windows 7 or Windows Server 2008 R2

Thanks for your help.

Bob

 

[Arc]

Good news.

Let us know for any further issue.