new ThinkPad - repeated bsod - ntoskernel.exe is likely culprit

[brandnewblue]

Good morning,

I have a brand new ThinkPad T420, w/ Intel Core i5 @ 2.6GHz and 2.59GHZ. I'm running Windows 7 Professional, 64bit. Also, my entire hard drive is encrypted with PGP Desktop Encryption.

Basically, on Tuesday our IT guy set up the computer for my use, and I started using this computer yesterday [brand new], and have been getting BSOD roughly every hour or so. I downloaded the BlueScreenView.exe program, and it looks like the ntoskrnl.exe is probably the culprit. I'm not very tech-savvy though, so I don't really know what that means. I ran a Windows Update, as there were three updates, and I've gotten two BSOD since the update.

There aren't any activities in particular that seem to trigger the BSOD.

Since the computer is so new, I'm thinking it might just be a hardware issue, but I'd appreciate some help in trying to find a fix before I resort to returning it to the manufacturer.

I've attached the output from the jcgriff program. I've been running the perfmon for ~30 minutes without it telling me a report is ready, but if it ever finished I will post that as well. If you need any more specs, or need me to run any more reports/analysis, let me know. Thanks for your help, I really appreciate it.

-Chris

 

[yowanvista]

Sadly PGPwded.sys which belongs to your Encryption Software is the cause, this software should either be updated or removed


shockprf.sys is associated with a Lenovo utility for hard drives (part of the IBM Thinkpad Active Protection System).

Please uninstall this utility to see if that solves the BSOD's.
If it does, please download a newer version. Update other Lenovo Utilities

Apsx64.sys    Apsx64.sys+1070    fffff880`01b9a000    fffff880`01bc0000    0x00026000    0x4d91ad4c    29/03/2011 13:58:36

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MULTIPLE_IRP_COMPLETE_REQUESTS (44)
A driver has requested that an IRP be completed (IoCompleteRequest()), but
the packet has already been completed.  This is a tough bug to find because
the easiest case, a driver actually attempted to complete its own packet
twice, is generally not what happened.  Rather, two separate drivers each
believe that they own the packet, and each attempts to complete it.  The
first actually works, and the second fails.  Tracking down which drivers
in the system actually did this is difficult, generally because the trails
of the first driver have been covered by the second.  However, the driver
stack for the current request can be found by examining the DeviceObject
fields in each of the stack locations.
Arguments:
Arg1: fffffa8008544cf0, Address of the IRP
Arg2: 0000000000000eae
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


IRP_ADDRESS:  fffffa8008544cf0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x44

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002ec65e0 to fffff80002edcc40

STACK_TEXT:  
fffff880`039f8a98 fffff800`02ec65e0 : 00000000`00000044 fffffa80`08544cf0 00000000`00000eae 00000000`00000000 : nt!KeBugCheckEx
fffff880`039f8aa0 fffff880`0119290e : fffffa80`039f4790 00000000`00000080 fffffa80`04718ae0 fffffa80`04718ad8 : nt! ?? ::FNODOBFM::`string'+0x42392
fffff880`039f8b90 fffffa80`039f4790 : 00000000`00000080 fffffa80`04718ae0 fffffa80`04718ad8 fffffa80`03cd1010 : PGPwded+0x990e
fffff880`039f8b98 00000000`00000080 : fffffa80`04718ae0 fffffa80`04718ad8 fffffa80`03cd1010 fffff880`01193c1d : 0xfffffa80`039f4790
fffff880`039f8ba0 fffffa80`04718ae0 : fffffa80`04718ad8 fffffa80`03cd1010 fffff880`01193c1d fffffa80`03cd1010 : 0x80
fffff880`039f8ba8 fffffa80`04718ad8 : fffffa80`03cd1010 fffff880`01193c1d fffffa80`03cd1010 00000000`00000080 : 0xfffffa80`04718ae0
fffff880`039f8bb0 fffffa80`03cd1010 : fffff880`01193c1d fffffa80`03cd1010 00000000`00000080 fffffa80`03c8d800 : 0xfffffa80`04718ad8
fffff880`039f8bb8 fffff880`01193c1d : fffffa80`03cd1010 00000000`00000080 fffffa80`03c8d800 fffffa80`04723000 : 0xfffffa80`03cd1010
fffff880`039f8bc0 fffffa80`03cd1010 : 00000000`00000080 fffffa80`03c8d800 fffffa80`04723000 00000000`01c535c0 : PGPwded+0xac1d
fffff880`039f8bc8 00000000`00000080 : fffffa80`03c8d800 fffffa80`04723000 00000000`01c535c0 00000000`00000000 : 0xfffffa80`03cd1010
fffff880`039f8bd0 fffffa80`03c8d800 : fffffa80`04723000 00000000`01c535c0 00000000`00000000 00000000`00000001 : 0x80
fffff880`039f8bd8 fffffa80`04723000 : 00000000`01c535c0 00000000`00000000 00000000`00000001 fffff800`03177fee : 0xfffffa80`03c8d800
fffff880`039f8be0 00000000`01c535c0 : 00000000`00000000 00000000`00000001 fffff800`03177fee fffffa80`0471cb60 : 0xfffffa80`04723000
fffff880`039f8be8 00000000`00000000 : 00000000`00000001 fffff800`03177fee fffffa80`0471cb60 00000000`00000080 : 0x1c535c0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
PGPwded+990e
fffff880`0119290e ??              ???

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  PGPwded+990e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: PGPwded

IMAGE_NAME:  PGPwded.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4dfba1a6

FAILURE_BUCKET_ID:  X64_0x44_PGPwded+990e

BUCKET_ID:  X64_0x44_PGPwded+990e

Followup: MachineOwner
---------

 

[brandnewblue]

You are the man, thank you so much for your help. I've uninstalled the Lenovo Thinkpad Active Protection System, and my IT guy is looking into the PGP drivers.

Thanks again, I really appreciate it.

 

[jeffpowers]

hi brandnewblue

am facing the same issue. Kindly advice steps (need to remove just active protection or PGP drivers as well) how it was finally resolved please