Computer hangs. Not Responding.

[Vaporhead]

My pops is having some problems with his machine. I did manage to get the dump files via the logmein program I installed years ago. Is there a way anyone can tell what is causing his machine to hang and not respond?

Mark

 

[marsmimar]

According to the dump file, there appears to be some issues with Bugcheck A, ntkrnlmp.exe / ntoskrnl.exe (an unspecified problem with NT Kernel & System - Different versions/date stamps according to OS and system specifications), rcx,qword ptr (possibly related to Ready Boost driver), csrss.exe (a necessary system process but could also be malware), EraserUtilRebootDrv.sys (a Symantec/Norton driver), and SYMEVENT64x86.SYS (another Norton Internet Security driver).

The following links provide more info about these issues and update info where available. In the interest of full disclosure I edited the dump file and reduced it to a more manageable size

Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL (Windows Debuggers)

Driver Reference Table - ntkrnlmp.exe

Driver Reference Table - ntoskrnl.exe

Driver Reference Table - rdyboost.sys and Blue Screen: Stop 0x1E and stop 0xD1 - Microsoft Community

csrss.exe - What is csrss.exe?

Driver Reference Table - EraserUtilRebootDrv.sys

Driver Reference Table - SYMEVENT64x86.SYS

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

[COLOR="red"]BugCheck A[/COLOR], {0, 2, 0, fffff80002cb1f74}

[COLOR="Red"]Probably caused by : ntkrnlmp.exe[/COLOR] ( nt!KiPageFault+260 )

Followup: MachineOwner
---------
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cb1f74, address which referenced memory

Debugging Details:
------------------
FAULTING_IP: 
nt!IopCompleteRequest+c64
fffff800`02cb1f74 488b09          mov     [COLOR="Red"]rcx,qword ptr[/COLOR] [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

[COLOR="Red"]PROCESS_NAME:  csrss.exe[/COLOR]

IRP_ADDRESS:  ffffffffffffff88

TRAP_FRAME:  fffff880030706e0 -- (.trap 0xfffff880030706e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800306f958 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cb1f74 rsp=fffff88003070870 rbp=0000000000000000
 r8=0000000000004740  r9=0000000000000080 r10=0000000000000002
r11=00000000000001c8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac pe cy
nt!IopCompleteRequest+0xc64:
fffff800`02cb1f74 488b09          mov     rcx,qword ptr [rcx] ds:1395:00000000`00000000=????????????????
Resetting default scope
------------------
fffff880`03070758  fffff880`04317ab8Unable to load image EraserUtilRebootDrv.sys, Win32 error 0n2
[COLOR="red"]*** WARNING: Unable to verify timestamp for EraserUtilRebootDrv.sys[/COLOR]
*** ERROR: Module load completed but symbols could not be loaded for EraserUtilRebootDrv.sys
 EraserUtilRebootDrv+0x2ab8

fffff880`030707b8  fffff880`040dcfd8Unable to load image SYMEVENT64x86.SYS, Win32 error 0n2
[COLOR="red"]*** WARNING: Unable to verify timestamp for SYMEVENT64x86.SYS[/COLOR]
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT64x86.SYS
 SYMEVENT64x86+0x21fd8

Starting with the basics, let's try to rule out any malware related problems that might have slipped by Norton. Uninstall any Norton products following the official Norton uninstall instructions.

https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us

I'd suggest running full scans using the free Malwarebytes and Windows Defender Offline. (No anti-malware product is 100% effective 100% of the time. If there was such a thing we'd all be using it. So running these on-demand scanners is a good thing.)

Malwarebytes

Windows Defender Offline

There may bo other damaged or corrupt system files that are preventing drivers from updating. You could try running a system file checker scan from an elevated command prompt (option two.) If problems are found, run the scan 3 times and immediately reboot the computer after each scan.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

You could also try to "stress test" your drivers by enabling Driver Verifier.

http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

One of the Forum experts prepared this troubleshooting guide that also includes links to various hardware tests.

http://www.sevenforums.com/tutorials/220165-troubleshooting-steps-windows-7-a.html

And in addition to the dump files, it would be helpful if you'd posted this information in a completely unedited form. Sometimes false activation issues can cause problems.

http://www.sevenforums.com/windows-...ne-activation-issue-posting-instructions.html

 

[Vaporhead]

Thanks for the response and I will check out those links and report back.