BSOD from driver?

[tys]

Hi all,

Weird one... I had a couple of USB devices plugged in, with HDMI and power. I pulled them all out and received a BSOD... maybe a usb driver?

attached is the what it looks like in Blue Screen Viewer and the dmp files.

Any help would be appreciated.

regards,

 

[Arc]

Difficult to say, as you have supplied a single crash dump only (not any other necessary files) and that crash dump is kinda silent.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

If memtest86+ results no errors, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any. Post it following the Blue Screen of Death (BSOD) Posting Instructions.
________________________________________________________________________________________

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 1, fffff8000349a93c}

Probably caused by : win32k.sys ( win32k!CAutoMutex::CAutoMutex+26 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8000349a93c, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800036cb100
GetUlongFromAddress: unable to read from fffff800036cb1c0
 0000000000000000 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeWaitForSingleObject+13c
fffff800`0349a93c f00fba2e07      lock bts dword ptr [rsi],7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  csrss.exe

TRAP_FRAME:  fffff880033af710 -- (.trap 0xfffff880033af710)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000d39b90 rbx=0000000000000000 rcx=0000000000000002
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000349a93c rsp=fffff880033af8a0 rbp=0000000000000000
 r8=fffff78000000008  r9=0000000000000000 r10=0000000000000000
r11=fffff880009eb180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KeWaitForSingleObject+0x13c:
fffff800`0349a93c f00fba2e07      lock bts dword ptr [rsi],7 ds:00000000`00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003493129 to fffff80003493b80

STACK_TEXT:  
fffff880`033af5c8 fffff800`03493129 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`033af5d0 fffff800`03491da0 : 00000000`00000000 fffff800`03492e13 fffffa80`03fd5b50 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`033af710 fffff800`0349a93c : 00000000`00000000 00000000`00000001 fffff8a0`06bb6790 fffff800`036e93bd : nt!KiPageFault+0x260
fffff880`033af8a0 fffff960`001b0246 : 00000000`00000000 00000000`00000000 fffff8a0`06bb6700 fffff8a0`1837a900 : nt!KeWaitForSingleObject+0x13c
fffff880`033af940 fffff960`002fcf5e : 00000000`00000000 fffff8a0`06064b80 fffff880`033afa90 fffff800`03467600 : win32k!CAutoMutex::C[COLOR=Red]AutoMute[/COLOR]x+0x26
fffff880`033af980 fffff960`0036c21f : fffff8a0`07de2740 fffff8a0`06064b80 fffff800`03962700 00000000`00000000 : win32k!C[COLOR=Red]PhysicalMonitorHandle[/COLOR]::Destroy+0x22
fffff880`033af9b0 fffff800`03701850 : 00000000`00000000 fffff8a0`1837a9d0 fffffa80`0aec8b30 fffffa80`08478620 : win32k!CMonitorPDO::[COLOR=Red]MonitorInterfaceCallback[/COLOR]+0x8b
fffff880`033af9e0 fffff800`038d5838 : fffff8a0`1837a9d0 fffff880`033afa98 fffff8a0`072c3cc0 00000000`ffffffff : [COLOR=Red]nt!PnpNotifyDriverCallback[/COLOR]+0x130
fffff880`033afa70 fffff800`037faa04 : 00000000`00000000 fffffa80`0c11e090 fffff8a0`11584a60 00000000`00000000 : nt![COLOR=Red]PnpNotifyDeviceClassChange[/COLOR]+0x188
fffff880`033afb10 fffff800`0349d261 : fffff800`03700868 fffff8a0`072c3c50 fffff800`036392d8 fffffa80`03fd5b50 : nt! ?? ::NNGAKEGL::`string'+0x55191
fffff880`033afb70 fffff800`03731bae : 7cc8b7a4`c5953c44 fffffa80`03fd5b50 00000000`00000080 fffffa80`03f5a890 : nt!ExpWorkerThread+0x111
fffff880`033afc00 fffff800`034848c6 : fffff880`031d5180 fffffa80`03fd5b50 fffff880`031dffc0 9b80f924`58b40605 : nt!PspSystemThreadStartup+0x5a
fffff880`033afc40 00000000`00000000 : fffff880`033b0000 fffff880`033aa000 fffff880`033af7e0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!CAutoMutex::CAutoMutex+26
fffff960`001b0246 488bc3          mov     rax,rbx

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  win32k!CAutoMutex::CAutoMutex+26

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  52705fba

FAILURE_BUCKET_ID:  X64_0xA_win32k!CAutoMutex::CAutoMutex+26

BUCKET_ID:  X64_0xA_win32k!CAutoMutex::CAutoMutex+26

Followup: MachineOwner
---------