BSOD - wdf01000.sys - PLEASE HELP!

zovoti · Jul 12, 2019

My computer doesn't shut down and barley turns back on!
When I hit shut down the shut down windows appears but freezes for a few seconds and then BSOD appears (Attached photo).

When BSOD appears, shutdown button doesn't work and I have to unplug the computer!
When I put back the plug, it takes about 20 clicks on the turn on button for the computer to respond!

PLEASE HELP!
Couldn't find an answer anywherer.

after computer comes on it reads:
"Windows has recovered from an unexoected shutdown".

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 1037

Additional information about the problem:
BCCode: d1
BCP1: 0000000000000003
BCP2: 0000000000000002
BCP3: 0000000000000000
BCP4: FFFFF88000EAC4A1
OS Version: 6_1_7601
Service Pack: 1_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\071219-29250-01.dmp
C:\Users\HomePc\AppData\Local\Temp\WER-1708366-0.sysdata.xml

Read our privacy statement online:
Windows 7 Privacy Statement

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

MrPepka · Jul 12, 2019

See:
Blue Screen of Death (BSOD) Posting Instructions

zovoti · Jul 14, 2019

Thank you for the clarification regarding the post process,
Here's the zip file acording to the instructions.

MrPepka · Jul 14, 2019

1. Run Driver Verifier Manager
2. Select "Create custom settings (for code developers)"
3. Select all standard settings and 2 additional settings ("Force pending I/O request" and "IRP Logging")
4. Select "Select driver names from a list"
5. Select all drivers except Microsoft drivers
6. Reboot computer

zovoti · Jul 17, 2019

Thank you - a new problem!

Thank you for the response.
I followed your instructions, for some reason it caused a new BSOD error.
Attached is a screen shot and again a new zip file with all the info as incstruced.
Also my computer became super slow since i ran Driver Verifier Manager... PLEASE HELP!!!

MrPepka · Jul 17, 2019

BSoD's causes the mafw.sys driver

Code:

Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\071019-77204-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*
Symbol search path is: SRV*
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.24441.amd64fre.win7sp1_ldr.190418-1735
Machine Name:
Kernel base = 0xfffff800`0340e000 PsLoadedModuleList = 0xfffff800`03647c90
Debug session time: Wed Jul 10 13:25:51.649 2019 (UTC + 2:00)
System Uptime: 0 days 0:53:55.414
Loading Kernel Symbols
...............................................................
................................................................
...............................................
Loading User Symbols
Loading unloaded module list
.......................
For analysis of this file, run !analyze -v
0: kd> !analyze
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {3, 2, 0, fffff88000e554a1}

*** WARNING: Unable to verify timestamp for mafw.sys
GetUlongPtrFromAddress: unable to read from fffff800036ab300
Probably caused by : mafw.sys ( mafw+d62e )

Followup:     MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000003, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88000e554a1, address which referenced memory

Debugging Details:
------------------


KEY_VALUES_STRING: 1


PROCESSES_ANALYSIS: 1

SERVICE_ANALYSIS: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING:  7601.24441.amd64fre.win7sp1_ldr.190418-1735

DUMP_TYPE:  2

BUGCHECK_P1: 3

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff88000e554a1

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036ab100
Unable to get MmSystemRangeStart
GetUlongPtrFromAddress: unable to read from fffff800036ab2f0
GetUlongPtrFromAddress: unable to read from fffff800036ab4a8
GetPointerFromAddress: unable to read from fffff800036ab0d8
 0000000000000003 

CURRENT_IRQL:  2

FAULTING_IP: 
Wdf01000!FxIrpQueue::InsertIrpInQueue+61
fffff880`00e554a1 4c3910          cmp     qword ptr [rax],r10

CPU_COUNT: 4

CPU_MHZ: cf0

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 5e

CPU_STEPPING: 3

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

ANALYSIS_SESSION_HOST:  MICHAL

ANALYSIS_SESSION_TIME:  07-17-2019 13:49:20.0925

ANALYSIS_VERSION: 10.0.18362.1 amd64fre

TRAP_FRAME:  fffff80000b9e500 -- (.trap 0xfffff80000b9e500)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000003 rbx=0000000000000000 rcx=fffffa80171530b8
rdx=fffffa8017153010 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000e554a1 rsp=fffff80000b9e698 rbp=fffff80000b9e770
 r8=fffffa800dc10868  r9=0000000000000000 r10=fffffa80115138f8
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
Wdf01000!FxIrpQueue::InsertIrpInQueue+0x61:
fffff880`00e554a1 4c3910          cmp     qword ptr [rax],r10 ds:00000000`00000003=????????????????
Resetting default scope

DPC_STACK_BASE:  FFFFF80000BA4FB0

STACK_OVERFLOW: Stack Limit: fffff80000b9efb0. Use (kF) and (!stackusage) to investigate stack usage.

LAST_CONTROL_TRANSFER:  from fffff800034afe69 to fffff800034a1aa0

STACK_TEXT:  
fffff800`00b9e3b8 fffff800`034afe69 : 00000000`0000000a 00000000`00000003 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9e3c0 fffff800`034adc88 : 00000000`00000000 00000000`00000003 fffffa80`0cbe1000 fffffa80`0dc10800 : nt!KiBugCheckDispatch+0x69
fffff800`00b9e500 fffff880`00e554a1 : fffff880`00e4e539 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KiPageFault+0x448
fffff800`00b9e698 fffff880`00e4e539 : 00000000`00000000 00000000`00000002 00000000`00000000 fffff800`035e768e : Wdf01000!FxIrpQueue::InsertIrpInQueue+0x61
fffff800`00b9e6a0 fffff880`00e89adc : fffffa80`11513850 fffff880`00e4ff62 00000000`00000000 00000000`00000000 : Wdf01000!FxRequest::InsertTailIrpQueue+0x85
fffff800`00b9e6e0 fffff880`00e4e0ef : fffffa80`11513850 fffff800`00b9e770 fffffa80`17153002 00000000`00000005 : Wdf01000!FxIoQueue::InsertNewRequestLocked+0x34
fffff800`00b9e730 fffff880`00e592fb : fffffa80`100cc5c0 fffffa80`0dc10802 fffffa80`0dc10800 fffffa80`0dc10800 : Wdf01000!FxIoQueue::DispatchEvents+0x55f
fffff800`00b9e7b0 fffff880`00e4f51a : fffffa80`100cc502 fffffa80`0dc10800 fffffa80`17153010 fffff800`00b9e890 : Wdf01000!FxIoQueue::QueueRequest+0x2ab
fffff800`00b9e820 fffff880`00e4b79a : fffffa80`0dc10800 fffffa80`17153010 fffffa80`0ce1e000 fffffa80`17153010 : Wdf01000!FxPkgIo::Dispatch+0x4da
fffff800`00b9e890 fffff880`00e4b866 : fffffa80`17153010 fffffa80`0ce1e000 fffffa80`10ba79d0 fffffa80`1033e2c0 : Wdf01000!FxDevice::Dispatch+0x19a
fffff800`00b9e8d0 fffff880`077bb62e : fffffa80`13316602 fffffa80`0ce1e000 fffffa80`133165a0 fffffa80`133166f0 : Wdf01000!FxDevice::DispatchWithLock+0xa6
fffff800`00b9e910 fffffa80`13316602 : fffffa80`0ce1e000 fffffa80`133165a0 fffffa80`133166f0 00000000`00000000 : mafw+0xd62e
fffff800`00b9e918 fffffa80`0ce1e000 : fffffa80`133165a0 fffffa80`133166f0 00000000`00000000 fffffa80`10476a40 : 0xfffffa80`13316602
fffff800`00b9e920 fffffa80`133165a0 : fffffa80`133166f0 00000000`00000000 fffffa80`10476a40 00000000`00000000 : 0xfffffa80`0ce1e000
fffff800`00b9e928 fffffa80`133166f0 : 00000000`00000000 fffffa80`10476a40 00000000`00000000 00000000`00000001 : 0xfffffa80`133165a0
fffff800`00b9e930 00000000`00000000 : fffffa80`10476a40 00000000`00000000 00000000`00000001 00000000`00000000 : 0xfffffa80`133166f0


THREAD_SHA1_HASH_MOD_FUNC:  1d53ccd977bf7691d5116f07cba17ed56a54e054

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  3d5251130f378689572f7eca8e776e158e6cced1

THREAD_SHA1_HASH_MOD:  5a24e45f89be3fa31d970f6de32dd403b512a109

FOLLOWUP_IP: 
mafw+d62e
fffff880`077bb62e ??              ???

SYMBOL_STACK_INDEX:  b

SYMBOL_NAME:  mafw+d62e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: mafw

IMAGE_NAME:  mafw.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a70bea2

STACK_COMMAND:  .thread ; .cxr ; kb

FAILURE_BUCKET_ID:  X64_0xD1_mafw+d62e

BUCKET_ID:  X64_0xD1_mafw+d62e

PRIMARY_PROBLEM_CLASS:  X64_0xD1_mafw+d62e

TARGET_TIME:  2019-07-10T11:25:51.000Z

OSBUILD:  7601

OSSERVICEPACK:  1000

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 7

OSEDITION:  Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  2019-04-19 04:08:54

BUILDDATESTAMP_STR:  190418-1735

BUILDLAB_STR:  win7sp1_ldr

BUILDOSVER_STR:  6.1.7601.24441.amd64fre.win7sp1_ldr.190418-1735

ANALYSIS_SESSION_ELAPSED_TIME:  84d

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xd1_mafw+d62e

FAILURE_ID_HASH:  {c2e9db89-aff9-c269-6d3f-9a02e8c761f0}

Followup:     MachineOwner
---------

0: kd> .load pde
=========================================================================================
 PDE v11.3 - Copyright 2017 Andrew Richards
=========================================================================================
0: kd> !dpx
Start memory scan  : 0xfffff80000b9e3b8 ($csp)
End memory scan    : 0xfffff80000b9f000 (Kernel Stack Base)

               rax : 0xfffff80000b9e4c0 : 0xfffffa800dc10800 :  dt Wdf01000!FxRequestFromLookaside
               rbx : 0xfffffa800dc10800 :  dt Wdf01000!FxRequestFromLookaside
               rsp : 0xfffff80000b9e3b8 : 0xfffff800034afe69 : nt!KiBugCheckDispatch+0x69
               rsi : 0xfffff80000b9e7c0 : 0xfffffa800dc10800 :  dt Wdf01000!FxRequestFromLookaside
0xfffff80000b9e3b8 : 0xfffff800034afe69 : nt!KiBugCheckDispatch+0x69
0xfffff80000b9e3e0 : 0xfffff88000e554a1 : Wdf01000!FxIrpQueue::InsertIrpInQueue+0x61
0xfffff80000b9e4c0 : 0xfffffa800dc10800 :  dt Wdf01000!FxRequestFromLookaside
0xfffff80000b9e4d0 : 0xfffff80000b9e7c0 : 0xfffffa800dc10800 :  dt Wdf01000!FxRequestFromLookaside
0xfffff80000b9e4f8 : 0xfffff800034adc88 : nt!KiPageFault+0x448
0xfffff80000b9e500 : 0x0000000000000000 :  Trap @ fffff80000b9e500
0xfffff80000b9e518 : 0xfffffa800dc10800 :  dt Wdf01000!FxRequestFromLookaside
Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
0xfffff80000b9e608 : 0xfffff8800558a5cc : ks!KspTransferKsIrp+0x54
0xfffff80000b9e628 : 0xfffff800035e846d : nt!ExFreePoolWithTag+0x22d
0xfffff80000b9e630 : 0xfffff800034a3c99 : nt!KiIsrLinkage+0x328
0xfffff80000b9e638 : 0xfffff800035f2180 : nt!KiInitialPCR+0x180
0xfffff80000b9e668 : 0xfffff88000e554a1 : Wdf01000!FxIrpQueue::InsertIrpInQueue+0x61
0xfffff80000b9e680 : 0xfffff80000b9e698 : 0xfffff88000e4e539 : Wdf01000!FxRequest::InsertTailIrpQueue+0x85
0xfffff80000b9e698 : 0xfffff88000e4e539 : Wdf01000!FxRequest::InsertTailIrpQueue+0x85
0xfffff80000b9e6b8 : 0xfffff800035e768e : nt!ExAllocatePoolWithTag+0xfe
0xfffff80000b9e6d8 : 0xfffff88000e89adc : Wdf01000!FxIoQueue::InsertNewRequestLocked+0x34
0xfffff80000b9e6e0 : 0xfffffa8011513850 :  dt Wdf01000!FxIoQueue
0xfffff80000b9e6e8 : 0xfffff88000e4ff62 : Wdf01000!FxIoQueue::CanThreadDispatchEventsLocked+0x8a
0xfffff80000b9e728 : 0xfffff88000e4e0ef : Wdf01000!FxIoQueue::DispatchEvents+0x55f
0xfffff80000b9e730 : 0xfffffa8011513850 :  dt Wdf01000!FxIoQueue
0xfffff80000b9e750 : 0xfffffa800dc10800 :  dt Wdf01000!FxRequestFromLookaside
0xfffff80000b9e758 : 0xfffff88000e558d3 : Wdf01000!FxRequest::FxRequest+0x33
0xfffff80000b9e790 : 0xfffffa8011513850 :  dt Wdf01000!FxIoQueue
0xfffff80000b9e7a8 : 0xfffff88000e592fb : Wdf01000!FxIoQueue::QueueRequest+0x2ab
0xfffff80000b9e7c0 : 0xfffffa800dc10800 :  dt Wdf01000!FxRequestFromLookaside
0xfffff80000b9e7c8 : 0xfffffa800dc10800 :  dt Wdf01000!FxRequestFromLookaside
0xfffff80000b9e7d8 : 0xfffff88000e4e539 : Wdf01000!FxRequest::InsertTailIrpQueue+0x85
0xfffff80000b9e808 : 0xfffffa800dc10800 :  dt Wdf01000!FxRequestFromLookaside
0xfffff80000b9e810 : 0xfffffa8011513850 :  dt Wdf01000!FxIoQueue
0xfffff80000b9e818 : 0xfffff88000e4f51a : Wdf01000!FxPkgIo::Dispatch+0x4da
0xfffff80000b9e828 : 0xfffffa800dc10800 :  dt Wdf01000!FxRequestFromLookaside
0xfffff80000b9e838 : 0xfffff80000b9e890 : 0xfffffa800dc10800 :  dt Wdf01000!FxRequestFromLookaside
0xfffff80000b9e858 : 0xfffff80003608888 : nt!NonPagedPoolDescriptor+0x8
0xfffff80000b9e888 : 0xfffff88000e4b79a : Wdf01000!FxDevice::Dispatch+0x19a
0xfffff80000b9e890 : 0xfffffa800dc10800 :  dt Wdf01000!FxRequestFromLookaside
0xfffff80000b9e8c8 : 0xfffff88000e4b866 : Wdf01000!FxDevice::DispatchWithLock+0xa6
*** WARNING: Unable to verify timestamp for mafw.sys
0xfffff80000b9ea08 : 0xfffff88000e4b866 : Wdf01000!FxDevice::DispatchWithLock+0xa6
0xfffff80000b9eab8 : 0xfffff8801081c23c : 1394ohci!IsochRx::WdfEvtNotificationDpc+0x2d8
0xfffff80000b9eb20 : 0xfffff8000361e7b8 : nt!ExWorkerQueue+0x18
0xfffff80000b9eb48 : 0xfffff88000eb579f : Wdf01000!FxDpc::FxDpcThunk+0xd7
0xfffff80000b9eb88 : 0xfffff80003457d2c : nt!KiRetireDpcList+0x1bc
0xfffff80000b9eb90 : 0xfffff800035f2180 : nt!KiInitialPCR+0x180
0xfffff80000b9ebd8 : 0xfffff800034a4495 : nt!SwapContext_PatchXRstor+0x98
0xfffff80000b9ebf8 : 0xfffff8000361e7b8 : nt!ExWorkerQueue+0x18
0xfffff80000b9ec20 : 0xfffff800036021c0 : nt!KiInitialThread
0xfffff80000b9ec30 : 0xfffff800035f2180 : nt!KiInitialPCR+0x180
0xfffff80000b9ec38 : 0xfffff800034a501a : nt!KiIdleLoop+0x5a
0xfffff80000b9ec40 : 0xfffff800035f2180 : nt!KiInitialPCR+0x180
0xfffff80000b9ec48 : 0xfffff800036021c0 : nt!KiInitialThread
0xfffff80000b9ec58 : 0xfffff88000eb56c8 : Wdf01000!FxDpc::FxDpcThunk

0: kd> !verifier

Verify Flags Level 0x00000000

  STANDARD FLAGS:
    [X] (0x00000000) Automatic Checks
    [ ] (0x00000001) Special pool
    [ ] (0x00000002) Force IRQL checking
    [ ] (0x00000008) Pool tracking
    [ ] (0x00000010) I/O verification
    [ ] (0x00000020) Deadlock detection
    [ ] (0x00000080) DMA checking
    [ ] (0x00000100) Security checks
    [ ] (0x00000800) Miscellaneous checks

  ADDITIONAL FLAGS:
    [ ] (0x00000004) Randomized low resources simulation
    [ ] (0x00000200) Force pending I/O requests
    [ ] (0x00000400) IRP logging

    [X] Indicates flag is enabled


Summary of All Verifier Statistics

  RaiseIrqls           0x0
  AcquireSpinLocks     0x0
  Synch Executions     0x0
  Trims                0x0

  Pool Allocations Attempted             0x0
  Pool Allocations Succeeded             0x0
  Pool Allocations Succeeded SpecialPool 0x0
  Pool Allocations With NO TAG           0x0
  Pool Allocations Failed                0x0

  Current paged pool allocations         0x0 for 00000000 bytes
  Peak paged pool allocations            0x0 for 00000000 bytes
  Current nonpaged pool allocations      0x0 for 00000000 bytes
  Peak nonpaged pool allocations         0x0 for 00000000 bytes

0: kd> lmvm nvlddmkm
Browse full module list
start             end                 module name
fffff880`186a8000 fffff880`19b8c000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Browse all global symbols  functions  data
    Timestamp:        Wed Jul  3 01:19:59 2019 (5D1C652F)
    CheckSum:         0148878C
    ImageSize:        014E4000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:
0: kd> lmvm mafw
Browse full module list
start             end                 module name
fffff880`077ae000 fffff880`077e9000   mafw     T (no symbols)           
    Loaded symbol image file: mafw.sys
    Image path: \SystemRoot\system32\DRIVERS\mafw.sys
    Image name: mafw.sys
    Browse all global symbols  functions  data
    Timestamp:        Wed Jul 29 14:26:58 2009 (4A70BEA2)
    CheckSum:         000390C0
    ImageSize:        0003B000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

Update:
M-Audio FireWire driver (M-Audio)

zovoti · Jul 19, 2019

no update for m-audio firewire

Hello again, thank you so much for your help!
Unfortunatelly, there is no updates available for the device M-audio firewire 410, I have the latest 5.10.0.5058 installed on my machine.

M-Audio

Any other ideas?

MrPepka · Jul 19, 2019

I looked for a moment and found such a fix:
Just in case anyone ever has the same problem, I appear to have fixed it by using the following method (found here: 404 Error Page...)

Click Start

Then click on Control Panel

Click on Device Manager

Note: If you don’t see Device Manager listed, click on View By: Category on the top right side of the
Control Panel Window.
Then Click on Large Icons
You should now have a list of items in the Control Panel and click on Device Manager.

Under the Device Manager, look down the list for IEEE 1394 Bus Host Controllers and Double Click on it.

It should display something like - 1394 OHCI Compliant Host Controller

Note: If it has the word (Legacy) behind it, you are already setup and you can just exit out.

Next, double click on the 1394 OHCI Compliant Host Controller

A window will popup saying 1394 OHCI Compliant Host Controller Properties

Click on the Driver Tab

Then look down in the widow and click on Update Driver

Then select - Browse my computer for driver software

Next select - Let me pick from a list of device drivers on my computer

It will bring up a list of drivers.

Click on 1394 OHCI Compliant Host Controller (Legacy)

NOTE: It is important that you select the one with (Legacy) after it, just like shown above.

Then click Next

Once it installs the 1394 OHCI Compliant Host Controller (Legacy),
it will say Windows has successfully updated your driver software.

Click on the Close button and exit out of all of the other windows.

Then Reboot your computer.
Source: Firewire 410, Win764bit, bluescreen on shutdown

zovoti · Jul 19, 2019

Thank you for that,
Did the repair and now I have the 1394 controller (Legacy),
but pc sound is gone and my M-AUDIO is on "other devices"...
Should I re-install the drivers? will it reverse the Legacy?

MrPepka · Jul 19, 2019

Reinstall M-Audio drivers

zovoti · Jul 24, 2019

yet another different BSOD

I have no idea what's going on!
I have a new (3rd) BSOD in a row!
Should I format my PC and that's it?

Attached is the new BSOD + pc report
Thank you again!!!

MrPepka · Jul 24, 2019

Update:
Intel USB 3.0 driver (check in Intel Driver & Support Assistant https://downloadmirror.intel.com/28425/a08/Intel-Driver-and-Support-Assistant-Installer.exe)

zovoti · Jul 26, 2019

OK. did everything! Worked for a while, no everytime I suspend my AVG antivirus, I get a new BSOD!
Can you please check the attached details about this please and tell me what's wrong and what I need to do with this?

Thank you so much for your support...

MrPepka · Jul 26, 2019

The DRIVER_VERIFIER_DETECTED_VIOLATION bug check has a value of 0x000000C4. This is the general bug check code for fatal errors found by Driver Verifier.
1st parameter = 0x62 - The driver is unloading without first freeing its pool allocations. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.

Code:

Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\072619-220928-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*
Symbol search path is: SRV*
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.24441.amd64fre.win7sp1_ldr.190418-1735
Machine Name:
Kernel base = 0xfffff800`0341d000 PsLoadedModuleList = 0xfffff800`03656c90
Debug session time: Fri Jul 26 13:36:49.645 2019 (UTC + 2:00)
System Uptime: 0 days 3:16:03.769
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
.............
For analysis of this file, run !analyze -v
3: kd> !analyze
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {62, fffffa8011bcebe8, fffffa8011bce8c0, e0}

*** WARNING: Unable to verify timestamp for avgStm.sys
GetUlongPtrFromAddress: unable to read from fffff800036ba300
Probably caused by : avgStm.sys

Followup:     MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000062, A driver has forgotten to free its pool allocations prior to unloading.
Arg2: fffffa8011bcebe8, name of the driver having the issue.
Arg3: fffffa8011bce8c0, verifier internal structure with driver information.
Arg4: 00000000000000e0, total # of (paged+nonpaged) allocations that weren't freed.
	Type !verifier 3 drivername.sys for info on the allocations
	that were leaked that caused the bugcheck.

Debugging Details:
------------------


KEY_VALUES_STRING: 1


PROCESSES_ANALYSIS: 1

SERVICE_ANALYSIS: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING:  7601.24441.amd64fre.win7sp1_ldr.190418-1735

DUMP_TYPE:  2

BUGCHECK_P1: 62

BUGCHECK_P2: fffffa8011bcebe8

BUGCHECK_P3: fffffa8011bce8c0

BUGCHECK_P4: e0

BUGCHECK_STR:  0xc4_62

IMAGE_NAME:  avgStm.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5d0b0634

MODULE_NAME: avgStm

FAULTING_MODULE: fffff8800913e000 avgStm

VERIFIER_DRIVER_ENTRY: dt nt!_MI_VERIFIER_DRIVER_ENTRY fffffa8011bce8c0
Symbol nt!_MI_VERIFIER_DRIVER_ENTRY not found.

CPU_COUNT: 4

CPU_MHZ: cf0

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 5e

CPU_STEPPING: 3

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  services.exe

CURRENT_IRQL:  2

ANALYSIS_SESSION_HOST:  MICHAL

ANALYSIS_SESSION_TIME:  07-26-2019 15:54:11.0267

ANALYSIS_VERSION: 10.0.18362.1 amd64fre

LAST_CONTROL_TRANSFER:  from fffff800039174fc to fffff800034b0aa0

STACK_TEXT:  
fffff880`17a33308 fffff800`039174fc : 00000000`000000c4 00000000`00000062 fffffa80`11bcebe8 fffffa80`11bce8c0 : nt!KeBugCheckEx
fffff880`17a33310 fffff800`0392668a : 00000000`00000001 00000000`00000000 fffff880`0913e000 00000000`00000001 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`17a33350 fffff800`0356cf40 : 00000000`00000000 00000000`00000000 fffff880`009aa180 00000000`00000000 : nt!VfPoolCheckForLeaks+0x4a
fffff880`17a33390 fffff800`0380a2de : fffffa80`11bceb30 00000000`00000000 00000000`00000000 00000000`00000018 : nt!VfTargetDriversRemove+0x160
fffff880`17a33430 fffff800`0382f54b : 00000000`00000000 00000000`000e0082 00000000`00000000 00000000`00000001 : nt!VfDriverUnloadImage+0x2e
fffff880`17a33460 fffff800`0382f9ed : 00000000`00000000 fffffa80`11bceb30 00000000`00000000 00000000`00010200 : nt!MiUnloadSystemImage+0x28b
fffff880`17a334d0 fffff800`039011e1 : 00000000`00000000 fffff880`17a337f0 fffffa80`0d823de0 00000000`00000018 : nt!MmUnloadSystemImage+0x4d
fffff880`17a33510 fffff800`0345c274 : 00000000`00000000 fffff880`17a337f0 fffffa80`0d823de0 fffffa80`11bce788 : nt!IopDeleteDriver+0x41
fffff880`17a33540 fffff800`0383b4ac : fffff880`17a337f0 00000000`00000000 00000000`c0000001 fffff880`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`17a335a0 fffff800`034bead3 : fffffa80`18d63b50 00000000`00000000 fffff800`036bda01 00000000`00000000 : nt!IopUnloadDriver+0x45c
fffff880`17a33770 fffff800`034b42b0 : fffff800`0383b1a5 00000000`027eeb00 00000000`00000001 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
fffff880`17a33908 fffff800`0383b1a5 : 00000000`027eeb00 00000000`00000001 00000000`00000000 00000000`00cada10 : nt!KiServiceLinkage
fffff880`17a33910 fffff800`034bead3 : fffffa80`18d63b50 fffff880`17a33b60 00000000`00000000 00000000`00000000 : nt!IopUnloadDriver+0x155
fffff880`17a33ae0 00000000`773bb0fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`027eead8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x773bb0fa


THREAD_SHA1_HASH_MOD_FUNC:  591646535b6c407bc45fa532f044222b581d75cc

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  ab4cd03d1732ae1098429d754ab04e1e5c6d7565

THREAD_SHA1_HASH_MOD:  7f608ac2fbce9034a3386b1d51652e4911d30234

FOLLOWUP_NAME:  MachineOwner

STACK_COMMAND:  .thread ; .cxr ; kb

FAILURE_BUCKET_ID:  X64_0xc4_62_VRF_LEAKED_POOL_IMAGE_avgStm.sys

BUCKET_ID:  X64_0xc4_62_VRF_LEAKED_POOL_IMAGE_avgStm.sys

PRIMARY_PROBLEM_CLASS:  X64_0xc4_62_VRF_LEAKED_POOL_IMAGE_avgStm.sys

TARGET_TIME:  2019-07-26T11:36:49.000Z

OSBUILD:  7601

OSSERVICEPACK:  1000

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 7

OSEDITION:  Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  2019-04-19 04:08:54

BUILDDATESTAMP_STR:  190418-1735

BUILDLAB_STR:  win7sp1_ldr

BUILDOSVER_STR:  6.1.7601.24441.amd64fre.win7sp1_ldr.190418-1735

ANALYSIS_SESSION_ELAPSED_TIME:  756

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xc4_62_vrf_leaked_pool_image_avgstm.sys

FAILURE_ID_HASH:  {c341edbd-a105-4ab9-c966-527e399cd25f}

Followup:     MachineOwner
---------

3: kd> .load pde
=========================================================================================
 PDE v11.3 - Copyright 2017 Andrew Richards
=========================================================================================
3: kd> !dpx
Start memory scan  : 0xfffff88017a33308 ($csp)
End memory scan    : 0xfffff88017a34000 (Kernel Stack Base)

               rsp : 0xfffff88017a33308 : 0xfffff800039174fc : nt!VerifierBugCheckIfAppropriate+0x3c
*** WARNING: Unable to verify timestamp for avgStm.sys
               rsi : 0xfffffa800e624050 : 0xfffff8800913e000 : avgStm
                r8 : 0xfffffa8011bcebe8 :  !du "avgStm.sys"
0xfffff88017a33308 : 0xfffff800039174fc : nt!VerifierBugCheckIfAppropriate+0x3c
0xfffff88017a33320 : 0xfffffa8011bcebe8 :  !du "avgStm.sys"
0xfffff88017a33338 : 0xfffff80003569e35 : nt!VfAvlLookupTreeNode+0xf5
0xfffff88017a33348 : 0xfffff8000392668a : nt!VfPoolCheckForLeaks+0x4a
0xfffff88017a33360 : 0xfffff8800913e000 : avgStm
0xfffff88017a33388 : 0xfffff8000356cf40 : nt!VfTargetDriversRemove+0x160
0xfffff88017a333d8 : 0xfffff800037f6c0e : nt!VfThunkCheckDriverUnloading+0x2e
0xfffff88017a33400 : 0xfffff8800913e000 : avgStm
0xfffff88017a33428 : 0xfffff8000380a2de : nt!VfDriverUnloadImage+0x2e
0xfffff88017a33458 : 0xfffff8000382f54b : nt!MiUnloadSystemImage+0x28b
0xfffff88017a334c8 : 0xfffff8000382f9ed : nt!MmUnloadSystemImage+0x4d
0xfffff88017a33508 : 0xfffff800039011e1 : nt!IopDeleteDriver+0x41
0xfffff88017a33538 : 0xfffff8000345c274 : nt!ObfDereferenceObject+0xd4
0xfffff88017a33598 : 0xfffff8000383b4ac : nt!IopUnloadDriver+0x45c
0xfffff88017a335e8 : 0xfffff8000372003a : nt!CmEnumerateValueKey+0x49a
0xfffff88017a335f0 : 0xfffff800036bd540 : nt!MmSystemPtesWs
0xfffff88017a33640 : 0xfffff88017a335e8 : 0xfffff8000372003a : nt!CmEnumerateValueKey+0x49a
0xfffff88017a336b8 : 0xfffff800034bcca5 : nt!KiPageFault+0x465
0xfffff88017a336c8 : 0xfffff80003722e94 : nt!PsReferenceImpersonationToken
0xfffff88017a33700 : 0xfffff8000385a200 : nt!IopLoadUnloadDriver
0xfffff88017a33768 : 0xfffff800034bead3 : nt!KiSystemServiceCopyEnd+0x13
0xfffff88017a33780 : 0xfffff800036bda01 : nt!MmFreePageListHead+0x1
0xfffff88017a33798 : 0xfffff800034a8f01 : nt!MiMakeTransitionPte+0x1d
0xfffff88017a337b0 : 0xfffff80003640880 : nt!MiSpecialPool
0xfffff88017a337c8 : 0xfffff8000359d426 : nt!MmAllocateSpecialPool+0x7b6
0xfffff88017a337f8 : 0xfffff80003729b8f : nt!SePrivilegedServiceAuditAlarm+0x47
0xfffff88017a33828 : 0xfffff80003640888 : nt!MiSpecialPool+0x8
0xfffff88017a338d8 : 0xfffff800034b42b0 : nt!KiServiceLinkage
0xfffff88017a338f0 : 0xfffff88017a33908 : 0xfffff8000383b1a5 : nt!IopUnloadDriver+0x155
0xfffff88017a33908 : 0xfffff8000383b1a5 : nt!IopUnloadDriver+0x155
0xfffff88017a33938 : 0xfffff800034bcca5 : nt!KiPageFault+0x465
0xfffff88017a33948 : 0xfffff8000383b610 : nt!NtUnloadDriver
0xfffff88017a33a10 : 0xfffff8000383b610 : nt!NtUnloadDriver
0xfffff88017a33a58 : 0xfffff80003719326 : nt!ExMapHandleToPointer+0x26
0xfffff88017a33a88 : 0xfffff800037164f4 : nt!ObpCloseHandle+0x94
0xfffff88017a33aa8 : 0xfffff8000383b610 : nt!NtUnloadDriver
0xfffff88017a33ad8 : 0xfffff800034bead3 : nt!KiSystemServiceCopyEnd+0x13
0xfffff88017a33ae0 : 0xfffffa8018d63b50 :  Trap @ fffff88017a33ae0

3: kd> lmvm avgStm
Browse full module list
start             end                 module name
fffff880`0913e000 fffff880`09175000   avgStm   T (no symbols)           
    Loaded symbol image file: avgStm.sys
    Image path: \SystemRoot\system32\drivers\avgStm.sys
    Image name: avgStm.sys
    Browse all global symbols  functions  data
    Timestamp:        Wed Jun 19 21:06:12 2019 (5D0B0634)
    CheckSum:         0003C441
    ImageSize:        00037000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

Disable Driver Verifier, and if blue screens continue, then uninstall and reinstall the AVG anti-virus

zovoti · Jul 28, 2019

Thank you so much!!! You are incredible!

zovoti · Oct 21, 2019

After several months of no problems what so ever due to your amazing help,
my computer decided to crash once again with a brand new BSOD... :-(

Can you help me once more please?
Thank you so much...

MrPepka · Oct 21, 2019

I don't see new crash dumps. Make sure that you don't have problems with your disk and logging crash dumps is enabled and correctly set.

BSOD - wdf01000.sys - PLEASE HELP!

New member

My Computer

Member

My Computer

New member

My Computer

Member

My Computer

New member

My Computer

Member

My Computer

New member

My Computer

Member

My Computer

New member

My Computer

Member

My Computer

New member

My Computer

Member

My Computer

New member

My Computer

Member

My Computer

New member

My Computer

New member

My Computer

Member

My Computer

Similar threads