Event 41 Kernal Power

[jwise1981]

I have been looking at my aunts laptop for her which had been shutting down showing a critical error. I have ran SFC/scannow which stated it made some corrections and also ran check disk which came back with no problems but it is still doing the same thing. Included the DMP file. Any help would be great.. Thanks

 

[Arc]

Hello jwise1981.

You have supplied a very limited data. It may/might not give a total view of your issue. Still, from the data you supplied, it appears that the issue here is the Intel RST drivers.

fffff880`040bbde8  fffff880`01254256Unable to load image \SystemRoot\system32\DRIVERS\[URL="http://www.carrona.org/drivers/driver.php?id=iaStor.sys"]iaStor.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=iaStor.sys"]iaStor.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=iaStor.sys"]iaStor.sys[/URL]
 iaStor+0x50256

And the driver is very old.

fffff880`01204000 fffff880`0159e000   iaStor   T (no symbols)           
    Loaded symbol image file: iaStor.sys
    Image path: \SystemRoot\system32\DRIVERS\iaStor.sys
[COLOR=Red]    Image name: iaStor.sys
    Timestamp:        Tue Apr 26 23:36:18 2011[/COLOR] (4DB7099A)
    CheckSum:         0008D1A1
    ImageSize:        0039A000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

As the RST drivers are having stability issues lately, I am not suggestion you to update it. Better you uninstall it. Get rid of intel rapid storage. First uninstall Intel Rapid Storage from Control Panel > Programs and Features. Then Uninstall the driver from device manager.

1. Right click on "my computer" icon and click "manage" on the context menu.
2. It will open the "computer management" window.
3. Select "Device Manager" in the left pane, It will list all the existing devices up.
4. Expand "IDE ATA/ATAPI controllers" by clicking on the triangle in front of it.
5. Select one Intel device item under it, right click, uninstall.
6. Continue the process for all Intel items under "IDE ATA/ATAPI controllers"
7. Now restart the computer. At restart, windows will auto configure the appropriate native system driver.

Let us know the results. If it continue crashing, next time post it following the Blue Screen of Death (BSOD) Posting Instructions.
____________________________________________________________________
BSOD ANALYSIS:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffffa80078ac610, 0, 7fffffa8000}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+487ed )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffffa80078ac610, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 000007fffffa8000, Parameter 1 of the exception

Debugging Details:
------------------


OVERLAPPED_MODULE: Address regions for 'btwl2cap' and 'RtsPStor.sys' overlap

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f0f100
GetUlongFromAddress: unable to read from fffff80002f0f1c0
 0000000000000000 Nonpaged pool

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+0
fffffa80`078ac610 488b040a        mov     rax,qword ptr [rdx+rcx]

BUGCHECK_STR:  0x1E_c0000005_R

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  mscorsvw.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880040bc4c0 -- (.trap 0xfffff880040bc4c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=f6410675c7844415 rbx=0000000000000000 rcx=0000000000018c00
rdx=000007fffff8f400 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa80078ac610 rsp=fffff880040bc658 rbp=fffff80002e7d2d8
 r8=0000000000007e00  r9=0000000000000010 r10=40ed02400a7408c0
r11=0000000000011000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
fffffa80`078ac610 488b040a        mov     rax,qword ptr [rdx+rcx] ds:000007ff`fffa8000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002d22728 to fffff80002cd7c00

STACK_TEXT:  
fffff880`040bbc38 fffff800`02d22728 : 00000000`0000001e ffffffff`c0000005 fffffa80`078ac610 00000000`00000000 : nt!KeBugCheckEx
fffff880`040bbc40 fffff800`02cd7282 : fffff880`040bc418 000007ff`fffa00f0 fffff880`040bc4c0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x487ed
fffff880`040bc2e0 fffff800`02cd5dfa : 00000000`00000000 000007ff`fffa8000 00000000`00000000 000007ff`fffa00f0 : nt!KiExceptionDispatch+0xc2
fffff880`040bc4c0 fffffa80`078ac610 : fffffa80`078ab487 fffff800`02e7d2d8 fffff880`040bc6e0 fffffa80`078ad400 : nt!KiPageFault+0x23a
fffff880`040bc658 fffffa80`078ab487 : fffff800`02e7d2d8 fffff880`040bc6e0 fffffa80`078ad400 fffffa80`078ae3d0 : 0xfffffa80`078ac610
fffff880`040bc660 fffff800`02e7d2d8 : fffff880`040bc6e0 fffffa80`078ad400 fffffa80`078ae3d0 00000000`00003000 : 0xfffffa80`078ab487
fffff880`040bc668 fffff880`040bc6e0 : fffffa80`078ad400 fffffa80`078ae3d0 00000000`00003000 00000000`00000040 : nt!ExWorkerQueue+0x58
fffff880`040bc670 fffffa80`078ad400 : fffffa80`078ae3d0 00000000`00003000 00000000`00000040 fffff880`040bc740 : 0xfffff880`040bc6e0
fffff880`040bc678 fffffa80`078ae3d0 : 00000000`00003000 00000000`00000040 fffff880`040bc740 00000000`00000002 : 0xfffffa80`078ad400
fffff880`040bc680 00000000`00003000 : 00000000`00000040 fffff880`040bc740 00000000`00000002 00000000`00100000 : 0xfffffa80`078ae3d0
fffff880`040bc688 00000000`00000040 : fffff880`040bc740 00000000`00000002 00000000`00100000 00000000`00000002 : 0x3000
fffff880`040bc690 fffff880`040bc740 : 00000000`00000002 00000000`00100000 00000000`00000002 00000000`00000000 : 0x40
fffff880`040bc698 00000000`00000002 : 00000000`00100000 00000000`00000002 00000000`00000000 00000000`00000000 : 0xfffff880`040bc740
fffff880`040bc6a0 00000000`00100000 : 00000000`00000002 00000000`00000000 00000000`00000000 00000000`00000000 : 0x2
fffff880`040bc6a8 00000000`00000002 : 00000000`00000000 00000000`00000000 00000000`00000000 000007ff`fffa0000 : 0x100000
fffff880`040bc6b0 00000000`00000000 : 00000000`00000000 00000000`00000000 000007ff`fffa0000 00000000`00000000 : 0x2


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+487ed
fffff800`02d22728 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+487ed

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5147d9c6

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_R_nt!_??_::FNODOBFM::_string_+487ed

BUCKET_ID:  X64_0x1E_c0000005_R_nt!_??_::FNODOBFM::_string_+487ed

Followup: MachineOwner
---------