BSOD A device driver attempting to corrupt the system has been caught.

[prizna]

Hi,

While shutting down my computer I received this BSOD message "A device driver attempting to corrupt the system has been caught. The faulty driver currently on the kernel stack must be replaced"

I was in a hurry to shut my computer down so I clicked shutdown before closing my open programs (I wouldn't think this could cause any problems as it hasn't in the past, but you never know with these kind of things) hoping that someone could help shed a little light on what may have caused this BSOD.

I have attached the the .zip file.

thanks,

 

[Arc]

Yes, there is a rogue driver, apparently. It is behaving like driver verifier is on, but not properly.

Arg1: 0000000000000091, [COLOR=Red]A driver switched stacks using a method that is not supported by
    the operating system.[/COLOR] The only supported way to extend a kernel
    mode stack is by using KeExpandKernelStackAndCallout.

But the crash dump is not pointing to the driver, unfortunately, even in the deepest search.

EDIT: First, Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Then uninstall Daemon Tools. Then download SPTD standalone installer from Disk-Tools.com, and execute the downloaded file as guided below :

• Double click to open it.
• Click this button only:
• 
• If it is grayed out, as in the picture, there is no more SPTD in your system, and you just close the window.

Now run the computer normally. If teh issue persists .... then read the following:

Enable Driver Verifier to monitor the drivers, following the instructions below.Hopefully it will catch the driver.

Driver Verifier - Enable and Disable
​

Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[prizna]

Thanks for your reply, I will go ahead and make those changes and keep you updated on the issue, just to clarify by "rogue driver" do you mean a driver that is acting as something that it isn't, like a virus? Should I run a virus scan to see if I can pick up anything?

 

[Arc]

The driver is working as it should not, but not like a virus. See the code box in post #2 .... the red line in the box.

But, if you scan your entire computer for virus, it is always good, irrespective of situation.

 

[prizna]

Im guessing that line should read "The driver is working as it should not, but not like a virus." lol, just making sure

 

[Arc]

Well .... that was a typo ....

 

[prizna]

Thanks for the help, I will keep you posted on the situation.