BSOD when i plug my USB Drive

[civilisation88]

Hello everyone,

I'm in desperate need of someone helping me to find a solution cause i have found nothing at all to fix it.
The issue is that everytime i plug a USB Flash pen on any of my USB ports i get the BSOD screen with the error IRQL_LESS_OR_NOT EQUAL...

if anyone can share some info on it or maybe links to fix it i would really be great.

this is my PC specs:
Operating System: Windows 7 Ultimate 64-bit (6.1, Build 7600) (7600.win7_gdr.100618-1621)
Language: English (Regional Setting: English)
System Model: ASUS P5Q3 DELUXE @ Wi-Fi n
BIOS: BIOS Date: 05/26/09 21:34:55 Ver: 08.00.14
Processor: Intel(R) Core(TM)2 Quad CPU Q9550 @ 2.83GHz
Memory: 8192MB RAM
Available OS Memory: 8192MB RAM
VGA: NVIDIA GeForce 8400 GS
Sound Card: Creative SB X-Fi Fatality Pro






if anyone needs any additional information please let me know so that i can give them.



Thank you in advance for any help.

 

[lorddenis]

please folow this instructions:
http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

 

[CarlTR6]

I suspect a driver problem. . Follow what lorddenis suggested above, and we will help you.

 

[civilisation88]

I'm always getting this error while generating a perfmon report:
this is the error:

Error:


An error occured while attempting to generate the report.



The wait for the report generation tool to finish has timed out.

i only managed to upload the first part.

 

[CarlTR6]

That is OK; you got most of it. I will take a look and be back.

Error code A, IRQL_NOT_LESS_OR_EQUAL. Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

Kernel base = 0xfffff800`02c4d000 PsLoadedModuleList = 0xfffff800`02e8ae50
Debug session time: Fri Oct  1 15:07:07.103 2010 (GMT-4)
System Uptime: 0 days 8:07:29.945
Loading Kernel Symbols
...............................................................
................................................................
................................................................
........
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {138, 2, 0, fffff80002c66dec}

Unable to load image \SystemRoot\system32\DRIVERS\snapman.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for snapman.sys
*** ERROR: Module load completed but symbols could not be loaded for snapman.sys
Probably caused by : snapman.sys ( snapman+260fb )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000138, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002c66dec, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef50e0
 0000000000000138 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IoDetachDevice+2c
fffff800`02c66dec 488b9138010000  mov     rdx,qword ptr [rcx+138h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff88003dcb280 -- (.trap 0xfffff88003dcb280)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c66dec rsp=fffff88003dcb410 rbp=0000000000000000
 r8=fffff88003bd5890  r9=0000000000000000 r10=fffff88003bd5b80
r11=fffffa8006bc6f00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!IoDetachDevice+0x2c:
fffff800`02c66dec 488b9138010000  mov     rdx,qword ptr [rcx+138h] ds:00000000`00000138=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002cbcca9 to fffff80002cbd740

STACK_TEXT:  
fffff880`03dcb138 fffff800`02cbcca9 : 00000000`0000000a 00000000`00000138 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`03dcb140 fffff800`02cbb920 : 00000000`00000000 fffffa80`0ea22210 fffff880`03dcb390 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`03dcb280 fffff800`02c66dec : 00000000`00000000 fffffa80`0ea22210 00000000`00000000 00000000`00000001 : nt!KiPageFault+0x260
fffff880`03dcb410 fffff880`00e6a0fb : fffffa80`0eb84590 00000000`00000001 00000000`00000001 00000000`00000000 : nt!IoDetachDevice+0x2c
fffff880`03dcb440 fffffa80`0eb84590 : 00000000`00000001 00000000`00000001 00000000`00000000 00000000`00000001 : snapman+0x260fb
fffff880`03dcb448 00000000`00000001 : 00000000`00000001 00000000`00000000 00000000`00000001 fffff880`00e4d814 : 0xfffffa80`0eb84590
fffff880`03dcb450 00000000`00000001 : 00000000`00000000 00000000`00000001 fffff880`00e4d814 00000000`00000001 : 0x1
fffff880`03dcb458 00000000`00000000 : 00000000`00000001 fffff880`00e4d814 00000000`00000001 00000000`00000001 : 0x1


STACK_COMMAND:  kb

FOLLOWUP_IP: 
snapman+260fb
fffff880`00e6a0fb ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  snapman+260fb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: snapman

IMAGE_NAME:  snapman.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a88f974

FAILURE_BUCKET_ID:  X64_0xA_snapman+260fb

BUCKET_ID:  X64_0xA_snapman+260fb

Followup: MachineOwner
---------

The dump directly blames snapman.sys which is an Acronis driver. According to a BSOD thread I read this morning, Acronis is causing instability on some Win 7 systems. I suggest that you uninstall it using Revo (free) uninstaller, at least while you are troubleshooting. After you get your system running smoothly, you can try it again. This is the third BSOD in two days I have seen where Acronis was involved. I suggest you try Macrium Reflect (free or paid). I have not seen any problems with Macrium on Win 7. I use the free version.

I see another almost guaranteed BSOD cause on your system, Alcohol. It uses[FONT=&quot] uses a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Uninstall Alcohol. Use this SPTD uninstaller when you're done: [/FONT]DuplexSecure - Downloads. Select uninstall; do not select reinstall. You can try MagicDisk; it does not use the sptd driver.

You also have a large number of programs running at start up. For a smoother and quicker boot, you might want to trim that list and only load essential programs at startup. That is just the way I do things; it is not necessary for eliminating BSOD's.

I find one more almost guaranteed cause of crashes:

ASACPI.sys Sun Mar 27 22:30:36 2005

The 2005 version of this driver is a known BSOD cause.
Please visit this link: ASUSTeK Computer Inc.-Support- download_item_mkt

Scroll down to the Utilities category, then scroll down to the "ATK0110 driver for WindowsXP/Vista/Windows 7 32&64-bit " (it's about the 8th item down).
Download and install it.

Go to C:\Windows\System32\drivers to check and make sure that the ASACPI.sys file is date stamped from 2009 or 2010 (NOT 2005).

Next, please uninstall Kaspersky while you are troubleshooting. Kaspersky is know to cause crashes on some Win 7 systems. You can reinstall it when you get your system running smoothly; but I do not recommend doing so. Use this removal tool to uninstall Kaspersky: Info > Tool. Download and install Microsoft security Essentials while you are troubleshooting. Make sure Windows Firewall is turned on.

You have a number of Obsolete drivers on your system. Out of date drivers can and do cause memory corruption and BSOD's. Update these drivers; start with the ones in red font:

CT20XUT.SYS Wed Jun 03 14:01:05 2009 - Creative 20X Utility Effects Creative Worldwide Support

ctac32k.sys Wed Jul 02 04:38:22 2008 - Creative Audio Driver Creative Worldwide Support

ctaud2k.sys Wed Jun 03 13:59:45 2009 - Creative Audio Driver (WDM) Creative Worldwide Support

CTEXFIFX.SYS Wed Jun 03 14:01:00 2009 - Creative XFi Effects Creative Worldwide Support

CTHWIUT.SYS Wed Jun 03 14:01:09 2009 - Creative Utility Effects Creative Worldwide Support

ctoss2k.sys Wed Jun 03 13:57:43 2009 - Creative Utility Effects Creative Worldwide Support

ctprxy2k.sys Wed Jun 03 13:59:48 2009 - Creative Audio Driver (WDM) Creative Worldwide Support

ctsfm2k.sys Wed Jun 03 13:57:30 2009 - Creative SoundFont Management Device Driver Creative Worldwide Support

emupia2k.sys Wed Jun 03 13:57:22 2009 - Creative E-mu Plug-in Architecture Driver Creative Worldwide Support

ha20x2k.sys Wed Jun 03 13:59:09 2009 - Creative 20X HAL (WDM) Creative Worldwide Support

iaStorV.sys Wed Apr 08 12:57:17 2009 - Intel Storage drivers http://downloadcenter.intel.com/Default.aspx

ISODrv64.sys Fri Nov 02 23:21:18 2007 - ISO CD-ROM Device Driver - ISODrive Create a MultiBoot CD, an ISO image file or a virtual CD - download FREE evaluation copies of our software!

PxHlpa64.sys Tue Jun 23 19:16:35 2009 - Sonic CD/DVD driver (used by many different CD/DVD programs) pxHelp20.sys programs
Go to C:\Windows\System32\drivers and rename PxHlpa64.sys to PxHlpa64.BAK
This will break your CD/DVD program, but can easily be renamed after we've finished.

rminiv3.sys Fri Aug 17 16:53:11 2007 - Radmin Mirror Miniport Driver V3 is a driver file from Famatech International Corp. belonging to Radmin. This is obsolete software. Uninstall it.

Si3132r5.sys Fri Jun 01 13:08:28 2007 - Silicone Image storage drivers Silicon Image - Support. This software is obsolete.

SiRemFil.sys Wed Oct 18 18:20:39 2006 - Silicon Image driver Silicon Image - Support

SiWinAcc.sys Mon Nov 01 15:23:29 2004 - This in an XP driver. Silicon Image driver - comes with package for the SIxxxx drivers Silicon Image - Support

sptd.sys Sun Mar 22 08:35:35 2009 -You should have laready taken care of this on.

How to update drivers:

- I have listed links to most of the drivers in the code box below. Please use the links there to see what info I've found about those drivers.
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads
- - To remove any left over driver remnants, especially from graphics cards, use driver sweeper Guru3D - Driver Sweeper

I recommend that you uninstall the obsolete software and replace it with software certified to be compatible with Win 7. You can check compatibility at the link below.

Windows 7 Compatibility: Software Programs & Hardware Devices: Find Updates, Drivers, & Downloads

 

[civilisation88]

Dear CarlTR6

Thank you so much for helping me i have resolved my issue by following all the steps you told me about.
I'm sorry for not replying sooner i wasn't available at all and out of reach of my PC.

Although i have one question how do you do this (debug and find the issue with the report i have sent you) I'd really like to learn this to be able to do it myself when i have issue's with my PC at home and at work.

Anyhow thanks a lot for everything...

 

[CarlTR6]

Thank you for reporting back with the good news! I will ask the moderators to mark this one as solved.

To analyze the dumps, we use an MS program called Windows Debugger Version 6. Read this thread and follow the references for a really good discussion of Debugging:

BSOD Kernel Dump Analysis - Discussion - Tech Support Forum