Different BSOD behaviour on two systems

[Snugglebugs]

I have read the BSOD threads to see if there are any references to this particular problem. Especially
BSOD Analysis - Getting Started
As I couldn't spot any, I post this quick(ish) question to see if anyone can point me to a thread that covers it.

I have an Acer desktop that originally had XP Pro 32 bit. I wanted to try Win 7 before the XP EOL date, but I didn't like the dualboot method that MS provided some years ago. To get round that, I added a hard drive and loaded that with Win 7 Pro 32 bit. The XP was left untouched as it worked fine. That was about 6 years ago.

I carried on using XP but gradually transferred programmes and functions to the Win 7 HD. I kept the XP up to date, but by 2014 I only ever booted into the XP HD to use programmes that were not suitable for Win 7.
(Both the HDs were of course available to either OS to recover/copy any files I did not have on the OS in action at the time.)

Three months ago the XP OS was getting very dodgy and so I decided to upgrade it to Win 10 as a tryout, but leaving the Win 7 OS untouched on its dedicated HD. The compatibility check I ran showed severe limitations with the Acer, so in the end I upgraded the OS from XP to Win 7 Pro to give me a backup to be useful if the working Win 7 HD/OS ever gave me any trouble. (In the meantime I bought a refurbished 64 bit Lenovo desktop with a clean Win 10 Home license and installed that. It is that PC that I am using to send this question.)

Now the question!
The new Win 7 installation on what was the XP HD completed successfully and after LOTS of updates, booted correctly. But after a few days I got a BSOD on the original Win 7 HD when booting into that! Then it failed to boot at all. I tried a few minor things, including using the install DVD to Repair Startup.
It now will boot into Safe Mode with Networking. Trying any other boot option immediately gets BSOD - no Win 7 OS in any form.

Why? And what should I do to investigate?

I had a look at various threads/tutorials but couldn't find a basic step by step guide.

NOTE - the BSOD message about hardware or drivers cannot(?) refer to hardware as the whole PC is physically the same when booting from either HD. I do NOT plugin or switch on any hardware specifically for the HD I boot from.

 

[Paul Black]

Hi Snugglebugs,

BSOD - Posting Instructions => BSOD - Posting Instructions.

 

[axe0]

What is the error code you see on the screen?

 

[Snugglebugs]

If I can't avoid it happening again (!) I will try to take a photo before I restart.

 

[Snugglebugs]

Hi Snugglebugs,

BSOD - Posting Instructions => BSOD - Posting Instructions.

Thanks. But I wonder if there is any guide to how to investigate possible problems before making the file. Especially as I can't get the file if I can't boot the PC

 

[Snugglebugs]

I booted the Acer problem OS normally and after some seconds of the Win logo showing, the system crashed.
The error code on the screen was
STOP: 0X000000C9 (0X00000224, 0X94379DCE, 0X8C5C4E70, 0X00000005)

I then restarted the same OS in Safe mode with networking and when the system settled I ran the DM log collection exe which worked without any problems and collected the information to that desktop.

With a bit of maneuvering I have now transferred the information requested to this Lenovo PC so I can attach the zip file.

Now I hope that this wonderful forum can interpret the results for me

Thanks in advance!

Tony

 

[axe0]

I noticed driver easy is installed, this kind of programs are programs you do not need.
Most, if not all, of the drivers you need you can get from your pc vendor or Windows Update.

If you installed any drivers with this program, use a system restore point or system backup. If neither are available and you don't want to go for a clean install,
- if you don't know what drivers were installed, check if these programs have logs of driver installations, if requested I can spit the logs for you to find out
- if you do know, go into device manager and revert the drivers.


I also noticed in your eventlog a lot of issues related to your hard drive, although these events are from a few months back, have you dealt with this? If not, just let me know and we'll have a look at the drives together.


Could you upload the kernel dump from C:\Windows\MEMORY.dmp to onedrive, google drive, dropbox or a similar service and post a share link in your next reply. Just for some investigation purposes, I noticed something I haven't seen before with the 0x9C and the minidumps do not have enough information to have a look at it.

 

[Snugglebugs]

I noticed driver easy is installed, this kind of programs are programs you do not need.
Most, if not all, of the drivers you need you can get from your pc vendor or Windows Update.

If you installed any drivers with this program, use a system restore point or system backup. If neither are available and you don't want to go for a clean install,
- if you don't know what drivers were installed, check if these programs have logs of driver installations, if requested I can spit the logs for you to find out
- if you do know, go into device manager and revert the drivers.


I also noticed in your eventlog a lot of issues related to your hard drive, although these events are from a few months back, have you dealt with this? If not, just let me know and we'll have a look at the drives together.


Could you upload the kernel dump from C:\Windows\MEMORY.dmp to onedrive, google drive, dropbox or a similar service and post a share link in your next reply. Just for some investigation purposes, I noticed something I haven't seen before with the 0x9C and the minidumps do not have enough information to have a look at it.

Thanks - I do know some of the answers and write these below.

Driver Easy - DAMN - I got a trial of that from another website, and then realised it was a con. I thought I had got rid of it. I will see what is left and try and dump it. Not easy(?) as I have to use Safe Mode.

And no, I didn't install anything from it unless it tried to slip anything past me at the time.

The drive problem from a few months back may be from an installation of AOMEI Backupper on our networked computers. The installation may have been faulty as every time an automatic backup took place on one of them the information sent to the external hard drive via NAS caused a crash IF the NAS host PC was active on another programme at the sscheduled time. I reinstalled and shifted the drive plus NAS configuration to my Lenovo (Win 10) and haven't had any trouble since. But maybe the Win 7 drive still has rubbish on it? What do you think I should check? I have the Seagate check tools and can run those easily. What should I look for?

Kernel dump - I will find that and see if I can upload the file to Dropbox. I might not have time today.

 

[Snugglebugs]

axe0
I can't find the file you request. I have searched the Windows folder, and done a general search on the drive. Nowhere can I find MEMORY.dmp and the only *.dmp files found in the drive search are for the 6 files you already have in my zip file. Where else should I look and for what name?

I have checked the hard drive using SeaTools generic test and the WDC Lifeguard test. Both give the drive a PASS. I will carry out an extended test, but so far nothing has shown up as a problem. (That test passed OK)
What makes you think there is a problem?

Yes, the Driver Easy installation is still there when I inspect the programme files list, from outside the OS. I will get rid of it when I again try using Safe Mode.

 

[Paul Black]

Hi Snugglebugs,

Yes, the Driver Easy installation is still there when I inspect the programme files list, from outside the OS. I will get rid of it when I again try using Safe Mode.

Download and run Revo Uninstaller [FREE] from here => Revo Uninstaller. When you run scan for leftover items make sure that you use the Advanced Scan option, then tick everything and delete it.

I hope this helps!

 

[axe0]

If you cannot find it in C:\Windows, you won't find it anywhere else, that's the only location the file is saved by default.

I just realized I made a typo in my previous post, mentioning the 0x9C crash (unknown hardware problem) whereas the crashes are actually 0xC9 (verifier violation). I found it strange to see verifier calls in the stack of a 0x9C which is why I requested a kernel dump, however a kernel dump is still requested because the minidump barely gives insight in what happened.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 00000224, An IRP dispatch handler has returned a status that is inconsistent with the
	IRP's IoStatus.Status field.
Arg2: 94379dce, The address in the driver's code where the error was detected.
Arg3: 8c5c4e70, IRP address.
Arg4: [COLOR="red"]00000005[/COLOR], Expected status code.

Debugging Details:
------------------

*** ERROR: Module load completed but symbols could not be loaded for NTIDrvr.sys

2: kd> !error 00000005
Error code: (Win32) 0x5 (5) - Access is denied.

What happened according to this description: the CD-ROM filter driver was trying to communicate with another driver or with Windows. I don't know what it expected to happen (lack of data), but it got the message that it didn't have the right permission. Due to the age of this driver, there are various reasons why this caused a BSOD, the one I suspect the most is improperly handling this.

The mentioned driver, NTIDrvr.sys, is a CD-ROM filter driver, check your vendor for driver updates as it is very outdated.

2: kd> lmvm NTIDrvr
Browse full module list
start    end        module name
94379000 9437a800   NTIDrvr    (no symbols)           
    Loaded symbol image file: NTIDrvr.sys
    Image path: NTIDrvr.sys
    Image name: NTIDrvr.sys
    Browse all global symbols  functions  data
    Timestamp:        [COLOR="Red"]Tue Dec 21 21:33:14 2004[/COLOR] (41C8888A)
    CheckSum:         00007B71
    ImageSize:        00001800
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[Snugglebugs]

OK axe0

I will check the DVD driver and report back. I did have to replace the drive itself a couple of years ago.
(I will also check the good OS HD - maybe one has an update and not the other!)

I have looked up info on memory.dmp and how it is configured through System. I will report what I find.

Tony

 

[Snugglebugs]

I checked the CDDVD driver in both OS; for the working Win 7 OS on one HD in my Acer it shows three driver files and that is shown as working correctly. The files are cdrom.sys, ntidrvr.sys and ubhelper.sys

On the other Win7 OS on the second HD (the one that had BSOD unless I started in Safe Mode), there are four driver files - the extra is called afc.sys. The general tab shows that the driver is unsigned, although in DM it is listed as Microsoft. See the various screenshots attached.
I uninstalled that driver and when I restarted the OS booted without any problems!

So that solved the BSOD. Congratulations so far.
BUT, (isn't there often a but!), now the Device Manager shows that the driver is not working. The Details tab shows only the three files that are listed on the first HD (the no problem one) have the same names.
I now have the second OS that boots normally, but lists the same physical CDDVD drive as not working!

I remember that when I bought the CDDVDW unit it installed without any problem. I don't have an install CD in my collection, so it must have got the driver automatically when I first switched it on. Today I have been searching for a driver download and after trying many websites I had to stop as although they all listed the unit as shown in BIOS and my Device Manager, they either wanted me to install their spyware and/or give my credit card details even though they claimed the software was free!

Do you know of any reputable driver libraries that genuinely provide a safe download, even if it costs me?

Tony

 

[axe0]

AFAIK Windows should provide you with the right drivers.
Have you checked Windows Update?

 

[Snugglebugs]

Is there a Windows Update library that can be checked? I didn't know that MS has the facility for a user to get driver updates directly from them.

Tony

 

[axe0]

Quite often Windows Update automatically installs necessary drivers, but that may change depending on your Windows Update settings. Regardless of the settings, usually running Windows Update is enough to get any driver necessary.

Also, there's another setting that controls driver updates in Windows Update.
In Control Panel, go to System, click on System protection or Advanced system settings and go to Hardware tab. Finally click Device Installation Settings to view the settings.