BSOD STOP D1 - pci.sys

[wither 2]

Let's hope you can't reproduce the error.

 

[IHTurbo]

I have been testing since my last Post, but I have had to perform a Restart many times in the intervening time frame (not for this problem), which I have noticed in the past tends to "reset" the BSOD D1 situation, temporarily.

I was scared to incur Murphy's wrath before this, but I WAS hopeful that the issue had gone, although it went against all logic.

Unfortunately not, however, as I have just had my first BSOD D1 since reinstalling the newest Nvidia Drivers, whilst playing one of the legacy games.

Hence, I will now proceed with the following Win7 Updates:-
- April 2015 Servicing Stack Update for Win7
- KB3125574 - Win7 SP1 Rollup Update [SP2]

I DO know that one of the above Updates DOES modify the pci.sys file, so this may be a positive as far as fixing the problem goes.

After the above Updates are installed, if I still have the problem, my only recourse is to run the "MS ACT - Appln Compat Toolkit" & see what this finds.

More later.

 

[IHTurbo]

Last wednesday (10th), I attempted to install KB3020369, the Win7 April 2015 Servicing Stack Update, but received the error message of "The update is not applicable to your computer."
I then successfully managed to install KB3125574, the Win7 Convenience Rollup Update, sometimes referred to as SP2, although never by Microsoft.

I have been, and still am, testing to see if the BSOD error still exists.

KB3020369 was a prerequisite install for KB3125574, so I must have already had it installed.
Interestingly, KB3125574 included a list of files that were modified in the update and pci.sys was one of them, unfortunately, I already had a higher version that was listed in KB3125574.

My pci.sys version is:- 6.1.7601.24441, dated 19/Apr/19 @ 13:45:00.

The pci.sys version from KB3125574 is:- 6.1.7601.23403, Dated 25/Mar/16 @ 19:09

My version of the file is obviously much newer than this KB3125574 [SP2] version.

After my testing is finished, I have nothing else to try; I have exhausted all avenues as far as I am concerned.

The only desperation idea I have is to replace the newer pci.sys file with the older version from the KB3125574 [SP2] and see what happens.
But it is not usually a good idea, to go back to a MUCH older file version.


Any new comments or ideas would be most welcomed at this stage.
If anyone DOES have any ideas, I am all ears.

 

[wither 2]

If my calculations are correct, you've only gotten the D1 error one time in the last two weeks. At least you only mentioned it one time.

Why are you using the 2015 update package instead of Windows Update?

 

[IHTurbo]

I have received the D1 5 times in the last 2 weeks, on one occasion twice in one day.
I only mentioned the one that was relevant, showing that it still existed.
I didn't want to bore you with all the others!

As you can see from the list below (a list only, no actual Dumps), the last one prior to the start of Feb was on the 20th of Jan, which is nearly a 2 week gap.


I used the 2015 Update Pkg instead of Windows Update because it was the most recent Pkg I could find.
Since Win7 lost all Support, I used WSUS Offline Update by Torsten Wittrock, to download all Updates I was possibly missing.
I did this either just before, or just after Support was pulled.
I also used the same S/W to Update my Office 2010.
I have found it very useful.

Prior to the loss of Win7 Support, I used to have Windows Update set to "Chk for updates but let me choose whether to install them", as many friends who auto-downloaded them had many issues with individual & problematic Win Updates over the years.
I also have the Recommended Updates box ticked.

I kept Win Updates on for a while, but got sick of hiding & refusing all the "Windows Malicious Software Removal Tool" (WMSRT) pkgs, which I don't use & have only ever used once or twice.
Since the Support was lost, I have not received ONE Update.
My KIS, MBAM, etc has always been good enough, w/o the need for these pkgs.
So, I turned Win Updates off & only turned it back on every 6 months or so.
Since the end of Support, I have only ever been notified of WMSRT pkgs.

I have turned it back on for the moment, with the settings I mentioned above, but with no Support for Win7, I don't really expect to be notified that there will EVER be any Updates, except the aforementioned WMSRT pkgs.

RECENT DUMPS
---
DMP-20210120-Jan
---
DMP-20210203-feb-#1
DMP-20210203-feb-#2
DMP-20210205-feb
DMP-20210209-feb
DMP-20210213-feb
---

 

[IHTurbo]

FYI, I have just been notified by Win Update of KB4536952, a Jan 2020 Servicing Stack Update!
Win Update took its time, as it has been turned back on for over 30 mins & I performed an initial Update check before I turned it back on.
Timing is everything!

 

[IHTurbo]

I checked out Update KB4536952 (Jan 2020 Servicing Stack Update), which led me to a total of 4 Win7 Updates.

In addition to the above KB4536952, one of them was a much more recent Servicing Stack Update, dated Dec 2020.

This is:-
- KB4592510 - Win7 x64 Dec 2020 Servcg Stack Update.

There were 2 Prerequisite Updates for this Update, namely:-
1 - KB4474419 - SHA-2 Signing Support Security Update.
2 - KB4490628 - Win7 x64 Mar 2019 Servcg Stack Update.

Consequently, I attempted to install the above 2 KB Updates, only to receive a message stating they were both "ALREADY INSTALLED".

I then successfully installed:-
- KB4536952 - Win7 x64 Jan 2020 Servcg Stack Update.

After completion, I Restarted the PC.

After the Restart, I then successfully installed:-
- KB4592510 - Win7 x64 Dec 2020 Servcg Stack Update.

Again, after completion, I Restarted the PC.

I shall now see what happens over the next few days & I will also be watching Windows Update with interest.
The notification re: KB4536952 (Win7 x64 Jan 2020 Servcg Stack Update) was the first REAL notification I have seen in probably the last 12 months.
I don't really expect to see another non-WMSRT now, for at least 12 months, if ever.

I will get Testing and get back to you.

 

[IHTurbo]

Unfortunately, I have to announce that the BSOD D1 problem still exists.


I will now have to delve into the 2x BSOD E7 I received when I ran the Driver Verifier.
This would suggest that a Driver is the definitive offender and is either corrupted or screwed up in some way.
Obviously I suspect pci.sys, but as it is a System file, I have no idea at this stage as to how I can possibly replace it.
Obviously, it is an importatn Driver.
None of the Ein7 KB Updates I have done have updated the pci.sys driver & my version # is higher than in those KB Updates.


I will post initial info when I have studied the E7 data.


If anyone can help with the E7 Dumps, I will post them too, if requested.

 

[wither 2]

What is the E7?

 

[IHTurbo]

Apparently I made a slight error in my personal D1 Notes.
It would appear that the Driver Verifier did not die with an E7, but rather with an E6.
It would also appear that. for some unkown reason, I have not saved these particular Dumps.

Apparently, a BSOD E6 is "DRIVER_VERIFIER_DMA_VIOLATION"

Consequently, this means that I will have to run Driver Verifier again & record all the details of the BSODs that subsequently occur, as well as the Dumps.
As this previously crashed the PC every time, it may take a little while.


In the meantime, below is a table of the extracted more important data from all the D1 Dumps, obtained using the excellent Nirsoft BlueScreenView.
Items in braces ("{}") are extra & alternate values for the field.
Where there is a "{none} noted, it is probably due to the Dump not being a normal Dump, but being a Dump entitled "MEMORY.DMP".
ONLY these type of dumps have missing fields (I.E. "{none}").


DUMP TECH INFO
---
BUG CHECK STRING = DRIVER_IRQL_NOT_LESS_OR_EQUAL [ALWAYS]
---
BUG CHECK CODE = 0x000000d1 [ALWAYS]
---
PARM 1 = 00000000`00000064 [ALWAYS]
---
PARM 2 = 00000000`0000000b [ALWAYS]
---
PARM 3 = 00000000`00000001 [ALWAYS]
---
PARM 4 = fffff880`0100ce9b
{fffff880`015a5e9b}
{fffff880`00e76e9b}
{fffff880`01076e9b}
{fffff880`0101fe9b}
---
CAUSED BY DRIVER = pci.sys
{none}
---
CAUSED BY ADDRESS = pci.sys+ce9b
{none}
---
CRASH ADDR = ntoskrnl.exe+93ea0
{none}
{exe+93ca0}
{exe+93ba0}
{exe+939a0}
---

 

[wither 2]

Any progress on this?

 

[IHTurbo]

My Apologies for the long silence.
Life got busy and I have been having problems with Kaspersky auto-updating itself to the latest version (a la Microsoft's Win10 auto-update), destroying my system functionality.
I have to find a way to block this, but the last try did not work.
I will probably switch to BitDefender, when stable.
When a software company gets this arrogant, it is time to look elsewhere.
KIS has been good, but they keep removing useful functionality in new versions, and now this forced auto-update is a step too far.

I have run one Driver Verifier and to save time, I restricted it to run only on pci.sys.
As expected, it died with an E6. This sort of stopped me in my tracks.
The E6 Dump can be provided, if required.
I haven't yet quite figured out how to run Driver Verifier on ALL drivers EXCEPT pci.sys, to verify the other drivers, without having to individually tick all drivers.
To be honest, I sort of lost interest at this point, not knowing what to do next, and put it in the "Too hard" basket for the moment, hence the silence.

 

[wither 2]

The E6 dump file would be helpful.

 

[IHTurbo]

This is the BSOD E6 Driver Verifier Dump, dated 26/Feb/21.


It would be much appreciated if you can gather more info from it.

 

[wither 2]

The file associated with the problem is klkbdfit.sys. I hope you can translate it but this is the only thing I can find on it-

Web Translator

Note that it might take a minute for the translation to occur.

 

[IHTurbo]

Thanks Wither 2.

As an ex-Analyst/Programmer, I am guessing that this file "klkbdfit.sys" belongs to Kaspersky, the KL being for Kaspersky Labs & the kbd being for keyboard.
Kaspersky Internet Security (KIS) has an on-screen keyboard, for data input protection & I am guessing that this file is something to do with that, although how exactly, I do not know.

Unfortunately, I got warned of a Trojan by Malwarebytes at that URL.
I will look for more information elsewhere.

 

[IHTurbo]

An update.


Apparently, "KLKBDFLT" is a Kaspersky Labs Keyboard Device Filter Driver.
I am not really sure how that helps me though.
If it was ONLY needed for the Online Keyboard, I might be able to block it or something.
Maybe updating this file would help.
I will attempt to do that.

 

[wither 2]

Yeh, Malwarebytes gave me the same error about a trojan. Despite that, the website showed text
(maybe from Malwarebytes) that the site might not be secure and gave me the option to dismiss it.
When I did, everything was fine.

That site is pretty good at suggestions on how to fix the problem. Looks like you're on the right track.

 

[torchwood]

I've got KIS (free) on my W7, actually this comp which is my main.
I have NOT had a problem with it updating.

there is an option to turn the onscreen keyboard off.
Might just work


Roy

 

[wither 2]

Did it work?