Solved BSOD while Patching ArcheAge, caused by driver ntoskrl.exe

[Boozad]

I don't have time to post it up in full at the moment (I'm on my phone now) but I'm suspecting the CPU.

 

[essenbe]

OK, good suspect.

 

[Boozad]

I'll try to post up my reasoning when I get to work although I won't have the dumps to hand as I don't have administrative rights to install WinDBG there. Just leaving the house now.

 

[essenbe]

Sounds good. just whenever you have time. I'm not sure I have ever seen this before.

Use !analyze -v to get detailed debugging information.
BugCheck 101, {31, 0, fffff880009ec180, 1}
[COLOR=red]Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )[/COLOR]
Followup: MachineOwner

 

[Boozad]

I've seen that numerous times, not much help really is it?

If you look at the 0x1A and use !analyze -v then take a look at the Process ID listed in the readout. That process is the .NET Framework which notoriously uses one core, sometimes slowing peoples PCs right down during the update process. Given that the OP is running Windows Updates it doesn't sound like a false positive. Couple that up with the three 0x101 STOPs (Watchdog Timeouts) and the processor sounds very suspect. I could be wrong, it's just a hunch at the moment.

 

[essenbe]

here you go, Gav. I'm going to go to sleep.

 !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
CLOCK_WATCHDOG_TIMEOUT (101)
An expected clock interrupt was not received on a secondary processor in an
MP system within the allocated interval. This indicates that the specified
processor is hung and not processing interrupts.
Arguments:
Arg1: 0000000000000031, Clock interrupt time out interval in nominal clock ticks.
Arg2: 0000000000000000, 0.
Arg3: fffff880009ec180, The PRCB address of the hung processor.
Arg4: 0000000000000001, 0.
Debugging Details:
------------------
 
BUGCHECK_STR:  CLOCK_WATCHDOG_TIMEOUT_4_PROC
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME:  System
CURRENT_IRQL:  d
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
STACK_TEXT:  
fffff880`035850d8 fffff800`02d29d0a : 00000000`00000101 00000000`00000031 00000000`00000000 fffff880`009ec180 : nt!KeBugCheckEx
fffff880`035850e0 fffff800`02cdc647 : 00000000`00000000 fffff800`00000001 00000000`00002711 fffff800`02cbf873 : nt! ?? ::FNODOBFM::`string'+0x4e3e
fffff880`03585170 fffff800`02c1e895 : fffff800`02c44460 fffff880`03585320 fffff800`02c44460 00000000`00000000 : nt!KeUpdateSystemTime+0x377
fffff880`03585270 fffff800`02cce413 : 00000000`8e1c9adb fffff800`02e4ee80 00000000`001fa000 00000000`00000000 : hal!HalpHpetClockInterrupt+0x8d
fffff880`035852a0 fffff800`02cd7966 : fffff800`02e4ee80 00000000`00000001 00000000`00000000 fffff880`03585528 : nt!KiInterruptDispatchNoLock+0x163
fffff880`03585430 fffff800`02d168ac : fffff880`03585b01 fffffa80`0923c1c0 fffff980`0f9a4000 00000000`00000002 : nt!KeFlushMultipleRangeTb+0x266
fffff880`03585500 fffff880`0165d64d : fffffa80`0c7c0b50 00000000`871549ea fffff880`03585b01 fffffa80`0923c1c0 : nt!MmSetAddressRangeModified+0x2b0
fffff880`03585600 fffff880`01708bb5 : fffff8a0`0020d9f0 00000000`871549c2 00000000`00000000 fffffa80`0c7c0b00 : Ntfs!LfsFlushLfcb+0x5ad
fffff880`03585770 fffff880`0170adf1 : fffff880`03585b18 00000000`871549c2 fffff880`03585b18 fffff8a0`0020a590 : Ntfs!LfsFlushToLsnPriv+0x155
fffff880`03585800 fffff800`02d14c61 : fffff8a0`0020a590 00000000`871549c2 00000000`871549c2 fffffa80`0caf9af0 : Ntfs!LfsFlushToLsn+0xa1
fffff880`03585830 fffff800`02d13402 : fffffa80`0caf9af0 fffffa80`0caf9af0 00000000`00000000 fffff880`03585968 : nt!CcAcquireByteRangeForWrite+0x7e7
fffff880`03585910 fffff800`02d17066 : fffffa80`0caf9f68 fffffa80`00000001 fffff880`00000001 00000000`00157000 : nt!CcFlushCache+0x2c2
fffff880`03585a10 fffff800`02d17a28 : fffff880`00000000 fffff880`03585b18 fffffa80`1170e220 fffffa80`0caf9af0 : nt!CcWriteBehind+0x1c6
fffff880`03585ac0 fffff800`02cdba95 : fffffa80`0c76ca70 fffff800`02fcab01 fffff800`02edaae0 00000000`00000003 : nt!CcWorkerThread+0x1c8
fffff880`03585b70 fffff800`02f70b8a : 00000000`00000000 fffffa80`0c7c0b50 00000000`00000080 fffffa80`0c6e19e0 : nt!ExpWorkerThread+0x111
fffff880`03585c00 fffff800`02cc38e6 : fffff880`03365180 fffffa80`0c7c0b50 fffff880`0336ffc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03585c40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
 
STACK_COMMAND:  kb
SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME:  Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP:  0
IMAGE_VERSION:  
FAILURE_BUCKET_ID:  X64_CLOCK_WATCHDOG_TIMEOUT_4_PROC_ANALYSIS_INCONCLUSIVE
BUCKET_ID:  X64_CLOCK_WATCHDOG_TIMEOUT_4_PROC_ANALYSIS_INCONCLUSIVE
ANALYSIS_SOURCE:  KM
FAILURE_ID_HASH_STRING:  km:x64_clock_watchdog_timeout_4_proc_analysis_inconclusive
FAILURE_ID_HASH:  {d61e255a-5a6a-8ac9-10f0-973c0c42bda6}
Followup: MachineOwner

 

[Boozad]

OK, back from work, time to elaborate. There are three of these bugchecks in the log (0x101):

BUGCHECK_STR:  CLOCK_WATCHDOG_TIMEOUT_4_PROC

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  d

ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre

STACK_TEXT:  
fffff880`035850d8 fffff800`02d29d0a : 00000000`00000101 00000000`00000031 00000000`00000000 fffff880`009ec180 : nt!KeBugCheckEx
fffff880`035850e0 fffff800`02cdc647 : 00000000`00000000 fffff800`00000001 00000000`00002711 fffff800`02cbf873 : nt! ?? ::FNODOBFM::`string'+0x4e3e
fffff880`03585170 fffff800`02c1e895 : fffff800`02c44460 fffff880`03585320 fffff800`02c44460 00000000`00000000 : nt!KeUpdateSystemTime+0x377
fffff880`03585270 fffff800`02cce413 : 00000000`8e1c9adb fffff800`02e4ee80 00000000`001fa000 00000000`00000000 : hal!HalpHpetClockInterrupt+0x8d
fffff880`035852a0 fffff800`02cd7966 : fffff800`02e4ee80 00000000`00000001 00000000`00000000 fffff880`03585528 : nt!KiInterruptDispatchNoLock+0x163
fffff880`03585430 fffff800`02d168ac : fffff880`03585b01 fffffa80`0923c1c0 fffff980`0f9a4000 00000000`00000002 : nt!KeFlushMultipleRangeTb+0x266
fffff880`03585500 fffff880`0165d64d : fffffa80`0c7c0b50 00000000`871549ea fffff880`03585b01 fffffa80`0923c1c0 : nt!MmSetAddressRangeModified+0x2b0
fffff880`03585600 fffff880`01708bb5 : fffff8a0`0020d9f0 00000000`871549c2 00000000`00000000 fffffa80`0c7c0b00 : Ntfs!LfsFlushLfcb+0x5ad
fffff880`03585770 fffff880`0170adf1 : fffff880`03585b18 00000000`871549c2 fffff880`03585b18 fffff8a0`0020a590 : Ntfs!LfsFlushToLsnPriv+0x155
fffff880`03585800 fffff800`02d14c61 : fffff8a0`0020a590 00000000`871549c2 00000000`871549c2 fffffa80`0caf9af0 : Ntfs!LfsFlushToLsn+0xa1
fffff880`03585830 fffff800`02d13402 : fffffa80`0caf9af0 fffffa80`0caf9af0 00000000`00000000 fffff880`03585968 : nt!CcAcquireByteRangeForWrite+0x7e7
fffff880`03585910 fffff800`02d17066 : fffffa80`0caf9f68 fffffa80`00000001 fffff880`00000001 00000000`00157000 : nt!CcFlushCache+0x2c2
fffff880`03585a10 fffff800`02d17a28 : fffff880`00000000 fffff880`03585b18 fffffa80`1170e220 fffffa80`0caf9af0 : nt!CcWriteBehind+0x1c6
fffff880`03585ac0 fffff800`02cdba95 : fffffa80`0c76ca70 fffff800`02fcab01 fffff800`02edaae0 00000000`00000003 : nt!CcWorkerThread+0x1c8
fffff880`03585b70 fffff800`02f70b8a : 00000000`00000000 fffffa80`0c7c0b50 00000000`00000080 fffffa80`0c6e19e0 : nt!ExpWorkerThread+0x111
fffff880`03585c00 fffff800`02cc38e6 : fffff880`03365180 fffffa80`0c7c0b50 fffff880`0336ffc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03585c40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

IMAGE_VERSION:  

FAILURE_BUCKET_ID:  X64_CLOCK_WATCHDOG_TIMEOUT_4_PROC_ANALYSIS_INCONCLUSIVE

BUCKET_ID:  X64_CLOCK_WATCHDOG_TIMEOUT_4_PROC_ANALYSIS_INCONCLUSIVE

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_clock_watchdog_timeout_4_proc_analysis_inconclusive

FAILURE_ID_HASH:  {d61e255a-5a6a-8ac9-10f0-973c0c42bda6}

Then we have this 0x1A. As it's a 0x1A_41287 the only way to get any more info out of it would be to obtain a Kernel dump, but the process name stood out:

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, An illegal page fault occurred while holding working set synchronization.
    Parameter 2 contains the referenced virtual address.
Arg2: 00000000022b1000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41287

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  [COLOR=Red][B]mscorsvw.exe[/B][/COLOR]

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre

There is some pertinent info on mscorsvw.exe here and with that info it may point to why the CPU hung in the next three BSODs.
This may be a stretch and I could be completely wrong, with 0x101s it's obviously best to try and find a software fault causing the hang which is why I was glad you found the iaStor.sys Steve, I completely missed that (it was 4:30am, that's my excuse). Maybe that will sort the issue as it's notorious for causing BSODs, we'll see. Hopefully that was the problem.

 

[HikariChino]

I can't upload the folder, it keeps giving me a 500 internal server error. Should i use a file hosting service instead?

 

[essenbe]

Yes. use one of those. We have a size limit, I guess that is your problem is the size. Make sure you are uploading a zip file.

 

[HikariChino]

filehosting.org | Download | CBS.zip

Here's the link. I'm about to start Memtest, unless you need me for something.

 

[essenbe]

Could you use a different file hosting site? Maybe One Drive or something? I don't want to give them my email address. Hope you understand

 

[NoelDP]

Sorry - but any fileshare that attempts to force me to install a bogus ActiveX (among other things) is not going to get anywhere near me.

Please upload your files to either OneDrive or DropBox - then I'll take a look.

 

[Layback Bear]

Sorry - but any fileshare that attempts to force me to install a bogus ActiveX (among other things) is not going to get anywhere near me.

Please upload your files to either OneDrive or DropBox - then I'll take a look.

Same here. No way would I go to a site like that and don't recommend anybody reading these post go their either.

 

[essenbe]

Sorry Noel. That's why I had already asked for another upload site.

 

[NoelDP]

Not your fault, Steve - but it may give a heavy clue to the source of the OP's problems!

 

[Layback Bear]

Okay Steve; this time it's not your fault. Now about all the other times;well.

 

[essenbe]

Jack, that's what you get for 'hanging out with me'. It's kind of like, I think it was Harry Truman said. If you can't take the heat, stay out of the kitchen. :roflmao:

Noel, you could be right. This is on a clean install, while installing updates. BSODs and you can't pass sfc. makes me think of a few things.

 

[HikariChino]

Tell me if this works. Microsoft services

 

[essenbe]

Thank you, I'm sure that will work great. When Noel comes on he will take a look at it. He's the expert.

 

[NoelDP]

Here's the summary from the CheckSUR log.

Seconds executed: 219
 Found 217 errors
 Fixed 198 errors
  CSI Manifest Missing Total count: 20
  Fixed: CSI Manifest Missing.  Total count: 20
  CSI Manifest All Zeros Total count: 21
  Fixed: CSI Manifest All Zeros.  Total count: 20
  CSI Catalog Missing Total count: 3
  Fixed: CSI Catalog Missing.  Total count: 3
  CSI Catalog Corrupt Total count: 2
  Fixed: CSI Catalog Corrupt.  Total count: 2
  CSI Payload File Missing Total count: 123
  Fixed: CSI Payload File Missing.  Total count: 105
  CSI F Mark Missing Total count: 12
  Fixed: CSI F Mark Missing.  Total count: 12
  CBS MUM Missing Total count: 7
  Fixed: CBS MUM Missing.  Total count: 7
  CBS MUM Corrupt Total count: 4
  Fixed: CBS MUM Corrupt.  Total count: 4
  Fixed: CBS Paired File.  Total count: 11
  CSI Store Directory Missing Total count: 12
  Fixed: CSI Store Directory Missing.  Total count: 12
  CSI Catalog Thumbprint Invalid Total count: 13
  Fixed: CSI Catalog Thumbprint Invalid.  Total count: 13
Unavailable repair files:
 winsxs\manifests\amd64_microsoft-windows-crypt32-dll_31bf3856ad364e35_6.1.7601.22948_none_ba02e4640da5bb2a.manifest

Ill post a patch (first of a few, I suspect!) later.