BSOD randomly happening rar file attached

[meanodeano]

hi ev1, my computer has been crashing with BSOD at random times using various programs nothing specific, just its driving me crazy now any help would be appreciated ty

 

[YoYo155]

Hello and welcome to SF .

A single dump isn't enough in most case and this one being one of them where a couple more could have
led to a more fruitful debugging.

[B]WORKER_THREAD_RETURNED_AT_BAD_IRQL (e1)[/B]
Arguments:
Arg1: [COLOR=Blue][B]fffff80002f83ad0[/B][/COLOR], address of worker routine
Arg2: [COLOR=Red][B]0000000000000002[/B][/COLOR], IRQL returned at
Arg3: fffffa8006ef9820, workitem parameter
Arg4: fffffa8006ef9820, workitem address

The Interrupt Request Level (IRQL) was raised to 2 where it should have been 0 for that thread.

!irql
Debugger saved IRQL for processor 0x4 -- 2 (DISPATCH_LEVEL)

[COLOR=SeaGreen][B]ln /D[/B][/COLOR] [COLOR=Blue][B]fffff80002f83ad0[/B][/COLOR]

(fffff800`02f83ad0)   nt!IopProcessWorkItem   |  (fffff800`02f83b18)   [COLOR=Red][U][B]nt!NtWaitForMultipleObjects[/B][/U][/COLOR]
Exact matches:
    nt!IopProcessWorkItem (<no parameter info>)

All we can see from this dump is that ntkrnlmp is waiting, but we can't see what.

This is usually due to a buggy driver, by listing the loaded modules we also get the unloaded ones,
by looking at those we can see that rapportiaso6 was loaded and unloaded multiple times.

Unloaded modules:[B]
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6
fffff880`07234000 fffff880`07268000   rapportiaso6
fffff880`07200000 fffff880`07234000   rapportiaso6[/B]
fffff880`07200000 fffff880`07271000   spsys.sys[B]
fffff880`0556f000 fffff880`055a3000   rapportiaso6
fffff880`055a3000 fffff880`055d7000   rapportiaso6
fffff880`0556f000 fffff880`055a3000   rapportiaso6
fffff880`055a3000 fffff880`055d7000   rapportiaso6
fffff880`0556f000 fffff880`055a3000   rapportiaso6
fffff880`055a3000 fffff880`055d7000   rapportiaso6
fffff880`0556f000 fffff880`055a3000   rapportiaso6
fffff880`055a3000 fffff880`055d7000   rapportiaso6
fffff880`0556f000 fffff880`055a3000   rapportiaso6[/B]
fffff880`05c72000 fffff880`05c94000   NisDrvWFP.sy
fffff880`01c00000 fffff880`01c0e000   crashdmp.sys
fffff880`0444f000 fffff880`047f3000   dump_iaStor.
fffff880`04400000 fffff880`04413000   dump_dumpfve
fffff880`01600000 fffff880`01614000   VirtDiskBus6

• Driver Reference Table - rapportiaso64.sys

The driver is part of Trusteer Ltd. Rapport Security software;

c:\program files (x86)\trusteer\rapport\

Using RevoUninstaller remove the software completely along with any remaining registry entries.
Install Microsoft Security Essentials as a reliable alternative.


Then run Full Scans of both Microsoft Security Essentials and Malwarebytes (which you already have installed). During the the troubleshooting process do not run CCleaner as it deletes dump files.




Post back with the results!

 

[meanodeano]

thanks for your help and time, i will uninstall rapport and get back to you regards dean

 

[meanodeano]

ive uninstalled rapport

hi ive uninstalled rapport program, and run the 2 scans and nothing was found, is there anything i need to do now regards dean.

 

[YoYo155]

Thanks for the feedback .
As of now not much just update if it bugchecks again and mark as solved after a week or so if it hasn't.

 

[meanodeano]

hi yo-yo and crew, just had another BSOD whilst running the windows experience index. as requested ive attached the rar file ty

 

[meanodeano]

ive had a quick look into this debugging stuff, and think it might be something to do with acpi.sys , but thats as far as i got its all quite confusing , but the tutorials are good on this site

 

[YoYo155]

Hi thanks for the update .
The dump is basically the same and Trusteer Ltd. Rapport Security software is still active
both in the PC (loaded modules / services..) and in the dump file.

Please remove it completely.

Then follow the detailed instructions below.

Your crash dumps are not showing any finite probable cause.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

First run it with all the existing/installed RAM modules. If it comes with no error, all is good.

But if it starts showing errors, Stop testing. Errors/red lines means one or more RAM is faulty. But the fault may occur due to a faulty DIMM slot, too, which is a motherboard component. Using memtest86+, you can discriminate between a faulty RAM and a faulty motherboard.

How? Say you have two RAM sticks and two DIMM slots. You obtained errors at the test with all RAM sticks installed. Now, remove all the sticks but one. Test it in all the available slots, one by one. Continue the same procedure for all the available sticks.
How to make the inference that is it a RAM issue or it is a motherboard issue? Suppose you have got the result like that:

test|Slot1|Slot2
RAM1| Error | Error
RAM2|Good|Good

It is a RAM, a bad RAM.

But if you have got a result like that:

test|Slot1|Slot2
RAM1| Error |Good
RAM2| Error |Good

It is a motherboard issue. The particular slot is bad.

If memtest comes free from errors, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[meanodeano]

ok yoyo, ty will do that now, i did initially remove rapport , but then i thought i had to reinstall it from the hyperlink, but its all uninstalled now

 

[YoYo155]

Thanks , keep us posted.

 

[meanodeano]

hi yoyo, i ran the memtest86 last night for 9 passes and no errors so seems fine there, this morning i have just enabled the verifier, and BSOD as soon as my desktop appears, and this happens every time it restarts. so heres another rar file. thanks so much for your help

 

[YoYo155]

Hello thanks for the update.

The bugchecks are much clearer now thanks to driver verifier !

BugCheck D1, {fffff880065834b5, 2, 8, fffff880065834b5}

*** WARNING: Unable to verify timestamp for sbw.sys
*** ERROR: Module load completed but symbols could not be loaded for sbw.sys
Probably caused by : [COLOR=Red][U][B]sbw.sys[/B][/U][/COLOR] ( sbw+84b5 )

• Driver Reference Table - sbw.sys

Follow this tutorial on how to disable Driver Verifier;

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

Uninstall Speedbit Download Accelerator using RevoUninstaller ,remove all remaining files and registry keys using the advanced option.

Once you have successfully removed Speedbit, follow the instruction on how enable Driver Verifier
the same way you have the first time, post #8.

Keep us posted.

 

[meanodeano]

hi yoyo soz but i had to reinstall, my pc but i am still getting BSOD, i was just watching live tv with windows media center

 

[YoYo155]

Attach the new dumps then .

 

[meanodeano]

ok just uploaded it lol

 

[YoYo155]

Thanks for the feedback .
As you said it crashed while watching TV;

BugCheck 1000007E, {ffffffffc0000005, fffff8000f261407, fffff88003754538, fffff88003753d90}

*** WARNING: Unable to verify timestamp for cpsbda.sys
[COLOR=Red][U][B]*** ERROR: Module load completed but symbols could not be loaded for cpsbda.sys[/B][/U][/COLOR]
Probably caused by : ks.sys ( ks!CKsPin::TransferKsIrp+f5 )

lmvm [COLOR=Blue][U][B]cpsbda[/B][/U][/COLOR]
start             end                 module name
fffff880`06042000 fffff880`06068000   cpsbda   T (no symbols)           
    Loaded symbol image file: cpsbda.sys
    Image path: \SystemRoot\System32\Drivers\cpsbda.sys
    Image name: cpsbda.sys
    Timestamp:        [COLOR=Red][U][B]Tue Jan 18 07:39:58 2011[/B][/U][/COLOR]

cpsbda    [COLOR=Blue][U][B]Compro DVB Receiver[/B][/U][/COLOR]    c:\windows\system32\drivers\cpsbda.sys

I wasn't able to pinpoint the exact matching driver, but please update the appropriate one.
If you're having trouble finding an update post more information about the product and I will help .

Now I see you have enabled driver verifier again but the dump above wasn't induced by it
as the other two were. Those point to core Windows component ntkrnlmp.exe which is usually
pointing to hardware issue but judging the stack I don't believe that to be the case this time.
The fault seems to be of a couple of driver verifier settings and other
didn't have much in terms of a stack to look at.

!verifier

Verify Level fbb ... enabled options are:
    Special pool
    Special irql
    All pool allocations checked on unload
    [COLOR=Black]Io subsystem checking enabled[/COLOR]
    Deadlock detection enabled
    DMA checking enabled
    Security checks enabled
    [COLOR=Blue][U][B]Force pending I/O requests[/B][/U][/COLOR]
    [COLOR=Blue][U][B]IRP Logging[/B][/U][/COLOR]
    Miscellaneous checks enabled

Please disable driver verifier restart the PC and enable driver verifier
following this TUTORIAL | But using these settings:

1. Go to Start and type in "verifier" (without the quotes) and press Enter
2. Select "Create custom settings (for code developers)" and click "Next"
3. Select "Select individual settings from a full list" and click "Next"
4. Select everything EXCEPT FOR "Low Resource Simulation", "Force Pending I/O Requests", "IRP Logging" and click "Next"
5. Select "Select driver names from a list" and click "Next"
6. Then select all drivers NOT provided by Microsoft, Unknown, or Macrovision and click "Next"
7. Select "Finish" on the next page.

Keep us posted .

 

[meanodeano]

hi yoyo, i did everything you asked me to do, tv again just switching the channel over, and bsod again.

 

[YoYo155]

Hi
It's the same bugcheck as before, in this case Verifier is no help unfortunately.

BugCheck E1, {fffff8000f5bfad0, 2, fffff9800b4e4fc0, fffff9800b4e4fc0}

Probably caused by : ntkrnlmp.exe ( nt!IopProcessWorkItem+0 )

Please disable driver verifier | http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html


Please follow:

• If you have an SSD, make sure the following are up to date:
  • SSD firmware
  • BIOS Version
  • Chipset Drivers
  • Hard disk controller drivers/SATA drivers
  • If you have a Marvell IDE ATA/ATAPI device, make sure the drivers are up to date from the Intel site or Marvell site and not from your motherboard/vendor support site.
• Check Windows for corruption. Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations. Use OPTION THREE of http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html to provide us with the sfcdetails.txt file if errors occur.

• Download SSD Toolkit (version 1.0.0.1) (19MB)

   Warning

Flashing the BIOS is a risky procedure. If you are uncomfortable
performing it yourself, have a technician perform it on your behalf.
Regardless, flashing is at your own risk.

Update the BIOS: F9 3.68 MB 2012/09/27 Asia | China | America | Europe : FTP / Http

• Update the intel drivers using this online utility :: Intel® Driver Update Utility ::
• SATA AHCI :: Asia China America Europe: FTP / Http

Please post back with the results.