Solved BSOD stop 0x0000001e

[avi312]

Got 2 BSOD today with one being stop 0x0000001e and the other IRQL LESS OR EQUAL... not sure why all gpu and cpu ocs are off and are on default and my system is less than a year old with all good quality parts.
Thanks

 

[Thedoctor44]

Looking at your dump files I see numerous errors, however there is a particular function that has caught my eye.

BugCheck 1000007E, {[COLOR="red"]ffffffffc0000005[/COLOR], fffff80003506622, fffff880033e06d8, fffff880033dff30}

Probably caused by : ntkrnlmp.exe ( [COLOR="Blue"]nt!KxWaitForLockOwnerShip+12[/COLOR] )

This function, because it's undocumented there isn't too much about it.
I will take an educated guess and say it looks like a thread is trying to take ownership of a mutex object but is having to wait for some reason.

We can see an access violation which means the CPU has tried to access memory that is simply not available, whether it's due to a null pointer or the address trying to access has already been freed.

4: kd> [COLOR="green"]ln fffff80003506622[/COLOR]
(fffff800`03506610)   nt!KxWaitForLockOwnerShip+0x12   |  (fffff800`03506660)   nt!KxWaitForLockChainValid

There's the access violation that occurred at nt!KxWaitForLockOwnerShip

4: kd> [COLOR="Green"]u nt!KxWaitForLockOwnerShip+12[/COLOR]
nt!KxWaitForLockOwnerShip+0x12:
[COLOR="red"]fffff800`03506622[/COLOR] 48890a          [COLOR="Blue"]mov[/COLOR]     qword ptr [[COLOR="Red"]rdx[/COLOR]],rcx
fffff800`03506625 33db            xor     ebx,ebx
fffff800`03506627 660f1f0400      nop     word ptr [rax+rax]
fffff800`0350662c ffc3            inc     ebx
fffff800`0350662e 851d946d2000    test    dword ptr [nt!HvlLongSpinCountMask (fffff800`0370d3c8)],ebx
fffff800`03506634 0f847fb3faff    je      nt! ?? ::FNODOBFM::`string'+0x5da0 (fffff800`034b19b9)
fffff800`0350663a f390            [COLOR="Green"]pause[/COLOR]
fffff800`0350663c 488b4f08        mov     rcx,qword ptr [rdi+8]

We can see the pause function, probably waiting to acquire the mutex object.

Unable to load image \SystemRoot\system32\DRIVERS\atikmdag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
 [COLOR="red"]atikmdag+0x7dfb1[/COLOR]

Looking at the raw stack I can see that your display driver is causing issues.

7: kd> [COLOR="Green"]lmvm atikmdag[/COLOR]
start             end                 module name
fffff880`1102d000 fffff880`11fd6000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        [COLOR="Red"]Fri May 23 02:46:07 2014[/COLOR] (537EA85F)
    CheckSum:         00F417E6
    ImageSize:        00FA9000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

You are at the latest version, try rolling back to an earlier version.

I find these instructions useful.

How-To Install AMD Catalyst? Drivers For A Windows® Based System

Looking at your unloaded modules I see this.

Unloaded modules:
fffff880`081e9000 fffff880`081fa000   WinUsb.sys
fffff880`081e9000 fffff880`081fa000   WinUsb.sys
fffff880`081e9000 fffff880`081fa000   WinUsb.sys
fffff880`081e9000 fffff880`081fa000   WinUsb.sys
fffff880`081e9000 fffff880`081fa000   WinUsb.sys
fffff880`081e9000 fffff880`081fa000   WinUsb.sys
fffff880`081e9000 fffff880`081fa000   WinUsb.sys
fffff880`081e9000 fffff880`081fa000   WinUsb.sys
fffff880`081e9000 fffff880`081fa000   WinUsb.sys
fffff880`081e9000 fffff880`081fa000   WinUsb.sys
fffff880`081e9000 fffff880`081fa000   WinUsb.sys
fffff880`081f2000 fffff880`081fe000   ggsemc.sys
fffff880`081e9000 fffff880`081f2000   ggflt.sys
fffff880`081f2000 fffff880`081fe000   ggsemc.sys
fffff880`081e9000 fffff880`081f2000   ggflt.sys
fffff880`081f2000 fffff880`081fe000   ggsemc.sys
fffff880`081e9000 fffff880`081f2000   ggflt.sys
fffff880`081f2000 fffff880`081fe000   ggsemc.sys
fffff880`081e9000 fffff880`081f2000   ggflt.sys
fffff880`081f2000 fffff880`081fe000   ggsemc.sys
fffff880`081e9000 fffff880`081f2000   ggflt.sys
fffff880`081f2000 fffff880`081fe000   ggsemc.sys
fffff880`081e9000 fffff880`081f2000   ggflt.sys
fffff880`07376000 fffff880`073e7000   spsys.sys
fffff880`08000000 fffff880`08036000   WUDFRd.sys
fffff880`015d7000 fffff880`015e5000   crashdmp.sys
fffff880`015e5000 fffff880`015ef000   dump_storpor
fffff880`0121b000 fffff880`01233000   dump_amd_sat
fffff880`01000000 fffff880`01013000   dump_dumpfve
fffff880`05612000 fffff880`0561c000   amdkmafd.sys
fffff880`01475000 fffff880`0147f000   amdkmafd.sys
fffff880`04416000 fffff880`04420000   ndisrd.sys
fffff880`01013000 fffff880`0103d000   cdrom.sys

A lot of USB modules unloading...

Doing a bit of research I have found that the driver has these properties.

Company:
Sony Ericsson Mobile Communications
Description:
SEMC USB Flash Driver Filter

I recommend you remove this driver and the device associated with it.

Post back the results.

 

[avi312]

Just got some new blue screen, ive tried looking for sony flash driver but I cant seem to find it in deivce manager and ive even downloaded driver sweeper but still cant find it, i used the program to flash/root my phone but i dont really need it anymore... Ive just had 4 more blue screen since posting this when playing bf4- thanks for your quick reply

 

[Thedoctor44]

Avast is causing issues.
I suggest you remove it using the Avast removal tool.

Unable to load image \SystemRoot\system32\drivers\aswSP.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSP.sys
*** ERROR: Module load completed but symbols could not be loaded for aswSP.sys
 [COLOR="Red"]aswSP+0x1df95[/COLOR]

Replace it with MSE and Malwarebytes.

   Tip

Make sure you don't enable the free trial of malwarebytes pro

 

[avi312]

Thanks so much for your help after a day i havent had a single bsod, after listening to your advice

 

[Thedoctor44]

That's good news

Any more issues let me know.

 

[avi312]

just had some more bsods today lol, any help is appreciated

edit: im not sure it could be origin downloading but im not sure, just had 2 more bsod since this post

 

[Thedoctor44]

Here's my analysis.

BugCheck 1000007E, {[COLOR="Red"]ffffffffc0000005[/COLOR], [COLOR="Green"]fffff800034f4622[/COLOR], [COLOR="Blue"]fffff880033e06d8[/COLOR], fffff880033dff30}

Probably caused by : ntkrnlmp.exe ( [COLOR="Red"]nt!KxWaitForLockOwnerShip+12[/COLOR] )

An access violation has occurred which indicates the CPU tried to access memory which it couldn't address.
The 2nd parameter is the address at which the exception occurred at.
The 3rd parameter contains the exception record address.

EXCEPTION_RECORD:  [COLOR="Blue"]fffff880033e06d8[/COLOR] -- (.exr 0xfffff880033e06d8)
ExceptionAddress: fffff800034f4622 (nt!KxWaitForLockOwnerShip+0x0000000000000012)
   ExceptionCode: [COLOR="Red"]c0000005[/COLOR] (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address [COLOR="red"]ffffffffffffffff[/COLOR]

The exception occurred because the CPU attempted to read from this address which is clearly invalid.
I believe the KxWaitForLockOwnerShip function is waiting for a locked process to be unlocked so that it can be accessed but I'm not completely sure on that.

4: kd> [COLOR="Green"]u fffff800034f4622[/COLOR]
nt!KxWaitForLockOwnerShip+0x12:
fffff800`034f4622 48890a          [COLOR="Red"]mov[/COLOR]     qword ptr [[COLOR="red"]rdx[/COLOR]],rcx <-- a move instruction from the RCX register to the RDX register has been initiated
fffff800`034f4625 33db            xor     ebx,ebx
fffff800`034f4627 660f1f0400      nop     word ptr [rax+rax]
fffff800`034f462c ffc3            inc     ebx
fffff800`034f462e 851d946d2000    test    dword ptr [nt!HvlLongSpinCountMask (fffff800`036fb3c8)],ebx
fffff800`034f4634 0f847fb3faff    je      nt! ?? ::FNODOBFM::`string'+0x5da0 (fffff800`0349f9b9)
fffff800`034f463a f390            pause
fffff800`034f463c 488b4f08        mov     rcx,qword ptr [rdi+8]

With that said lets take a look at the registers

4: kd> [COLOR="Green"]r[/COLOR]
rax=0000000000000000 rbx=fffff8000367afe0 rcx=fffff880033e09c0
rdx=[COLOR="Red"]2020000000000000[/COLOR] rsi=fffff880009b3180 rdi=fffff880033e09c0
rip=fffff800034f4622 rsp=fffff880033e0910 rbp=00000000425be7d8
 r8=fffff880033e09c0  r9=0000000000000001 r10=0000000000000002
r11=fffffa800c2b0d18 r12=00000000425be7d8 r13=0000058000000000
r14=0000000000000001 r15=2aaaaaaaaaaaaaab
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!KxWaitForLockOwnerShip+0x12:
fffff800`034f4622 48890a          mov     qword ptr [rdx],rcx ds:002b:20200000`00000000=????????????????

The RDX register is invalid...

The Callstack doesn't reveal too much.

Lets dump the raw stack and see if we can find anything.

Avast is causing issues, with that said you appear to have bitdefender installed so they can conflict with each other.
Try removing Avast and see if that fixes the issue, if not remove Bitdefender and replace it with Microsoft Security Essentials.

Unable to load image \SystemRoot\system32\drivers\aswMonFlt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswMonFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for aswMonFlt.sys
 [COLOR="Red"]aswMonFlt+0x1cac6[/COLOR]

Bitdefender Wallet	"c:\program files\bitdefender\bitdefender\pwdmanui.exe" --hidden --nowizard	NT AUTHORITY\SYSTEM	HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It's probably conflicting with Bitdefender.
Make sure you completely remove Avast, try using the removal tool.

www.avast.com/en-gb/uninstall-utility

 

[avi312]

im blue screening in safe mode im trying to remove avast in safe mode but i keep soing before i get to start the removal mtool

 

[Thedoctor44]

Upload the dump files.

It shouldn't BSOD in safe mode form just AVs.

 

[avi312]

ok ive managed to uninstall avast antivirus and installed Microsoft security essentials

 

[Thedoctor44]

Have you removed bitdefender as well?
You shouldn't have more than 1 Anti Virus at the same time.

Why have you uploaded more files?
If it hasn't crashed after removing Avast then the files are deemed invalid.

 

[avi312]

no ive only had one more bsod after uninstalling avast but its definitely not as frequent, i thought you said to upload the dump files but nvm... The thing is with bitdefender is that that file is just a trace of it because it has been already uninstalled so what should i do?

 

[Thedoctor44]

Try using Revo Uninstaller, use the advanced option to remove the registry entries.

Yes upload any new dump files, but only after changes have been made.

 

[avi312]

ok sorry, here are my 2 dump files from completely uninstalling avast
Thanks for all your help so far btw

 

[avi312]

wait theyre the wrong ones^^
these are right ones sorry about that lol

 

[Thedoctor44]

BugCheck [COLOR="Red"]3D[/COLOR], {fffff8800a67da90, 0, 0, fffff880045995d4}

I'm going to struggle with this bugcheck, 0x3Ds are interrupt exception not handled bugchecks that are pretty much undocumented as they are very rare, I've had a few in the past, I never found the exact solution given that the parameters don't give any description as to what they mean.

Looks like your display driver is causing issues.

The most up to date versions seem quite unstable.

7: kd> [COLOR="Green"]lmvm atikmdag[/COLOR]
start             end                 module name
fffff880`11051000 fffff880`11ffa000   atikmdag   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        [COLOR="Red"]Fri May 23 02:46:07 2014[/COLOR] (537EA85F)
    CheckSum:         00F417E6
    ImageSize:        00FA9000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

I would roll back to a version in late 2013.

I'm still seeing remnants of Avast...

aswHwid  [COLOR="Red"]aswHwid.sys[/COLOR]  Tue Apr 08 16:43:26 2014

I suggest using Revo Uninstaller to see if that finds anything, if so then use the Advanced options so it removes all registry entries.