Solved ntoskrnl.exe 0x0000001E BSOD

[justinbronze]

Going on to the last seven. Hope it works.

 

[writhziden]

Going on to the last seven. Hope it works.

Keep going through the steps. If it does not crash, we will have to disable Verifier and see how it runs normally. Post any blue screen crashes you get. Best wishes that you do not get any with Verifier or in normal mode.

 

[AllOnTheBus]

Just to throw a spanner in the works folks!

In no way is this going to help the BSOD issue and for that I apologise,
however in reference to Bit Locker being installed, I think it may be
a wording issue that gets people a little confused here.

I would put it this way: Bit locker is a feature which is built into WIndows 7 versions (may even include Home versions but not 100% sure on that) and is enabled (as some other features are) dependant upon which product key is entered upon installation.
Only Ultimate and Enterprise versions come with bit locker pre-activated.
Windows 7 Proffesional can be upgraded to enable bit locker also which would take effect after the
Ultimate key has been purchased and installed.

As for the BSOD - I'll be leaving that one to the professionals for now.

 

[writhziden]

Just to throw a spanner in the works folks!

In no way is this going to help the BSOD issue and for that I apologise,
however in reference to Bit Locker being installed, I think it may be
a wording issue that gets people a little confused here.

I would put it this way: Bit locker is a feature which is built into WIndows 7 versions (may even include Home versions but not 100% sure on that) and is enabled (as some other features are) dependant upon which product key is entered upon installation.
Only Ultimate and Enterprise versions come with bit locker pre-activated.
Windows 7 Proffesional can be upgraded to enable bit locker also which would take effect after the
Ultimate key has been purchased and installed.

As for the BSOD - I'll be leaving that one to the professionals for now.

I spoke with zigzag3143 regarding this issue. There are two methods to disable bitlocker on the lower level systems. If Verifier does not find any issues, and justinbronze continues to have bitlocker based blue screen errors, we can go through the steps to disable bitlocker on the system and see if it fixes the crashes.

 

[AllOnTheBus]

Sounds like it's worth a shot to me

 

[justinbronze]

Just a few more hours until I can safely say no problems.

 

[justinbronze]

Verifier has caused no blue screens nor caused any problems with any drivers. Didn't even get any problems. No lag. No nothing.

Next step?

 

[writhziden]

Do your normal routine with Verifier disabled and see if the blue screens come back. If they do, let us know and we can look into disabling bitlocker. As I do not know what effect disabling it will have, I do not want to go through the steps if it is unnecessary.

 

[zigzag3143]

Verifier has caused no blue screens nor caused any problems with any drivers. Didn't even get any problems. No lag. No nothing.

Next step?

Can you check to make sure verifier is running by typing verifier /query. Tell us what drivers are being "verified"

Thanks

 

[justinbronze]

Verifier has caused no blue screens nor caused any problems with any drivers. Didn't even get any problems. No lag. No nothing.

Next step?

Can you check to make sure verifier is running by typing verifier /query. Tell us what drivers are being "verified"

Thanks

I've already finished running it, and have stopped running it. However, I did check twice out of the three times I ran it that it was working.

I only had 20 non-microsoft drivers and as per Writhziden's insructions, only ran a third of them at a time (So 6 drivers, then 7, then 7 again).

The non-microsoft drivers I ran were:

aoddriver2.sys
dump_amd_sata.sys
dump_diskdump.sys
dump_dumpfve.sys
amd_sata.sys
amd_xata.sys
amdiox64.sys
amdxata.sys
atihdw76.sys
usbfilter.sys
atipcie64.sys
atikmdag.sys
atikmpag.sys
athrx.sys
gearaspiwdm.sys
hamchi.sys
secdrv.sys
mbam.sys
rt64win7.sys
viahduaa.sys

 

[zigzag3143]

Great. If that batch doesnt find it we can run the others.

 

[justinbronze]

BSOD again. Same KMODE EXCEPTON NOT HANDLED. Had some differences though, so not EXACTLY the same.

Everything you need in the ZIP file, again.

 

[writhziden]

Alright, run driver verifier with all non-Microsoft drivers checked instead of breaking it up into three sets.

Additionally, run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Start Memtest86+ an hour before you go to bed so you can check it for a little while, then let it run overnight.

In case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. Start it an hour before you go to bed, and then let it run overnight. Same process as Memtest86+, basically.

 

[justinbronze]

I haven't run Verifier or Memtest yet. (Actually, I just started Verifier after this recent BSOD.)
So now I'm getting a IRQL_NOT_LESS_OR_EQUAL BSOD. Still, it's caused by ntoskrnl.sys. Which means, I have another zip file for everyone. Yay.

Note: This was not caused by Verifier as I had not started it yet. It's running now, and I'll keep you all posted.

 

[writhziden]

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\justinbronze\Phoenix BSOD 3\Windows_NT6_BSOD_jcgriff2\010512-39499-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c49000 PsLoadedModuleList = 0xfffff800`02e8e670
Debug session time: Thu Jan  5 05:15:21.086 2012 (UTC - 7:00)
System Uptime: 0 days 9:48:03.241
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {9, 2, 1, fffff80002ce0ce8}

Probably caused by : NETIO.SYS ( NETIO!NetioAllocateAndReferenceCloneNetBufferList+32 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000009, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ce0ce8, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef8100
 0000000000000009 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IoAllocateMdl+118
fffff800`02ce0ce8 48894108        mov     qword ptr [rcx+8],rax

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  Dropbox.exe

TRAP_FRAME:  fffff8800738e320 -- (.trap 0xfffff8800738e320)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8005d514d0 rbx=0000000000000000 rcx=0000000000000001
rdx=fffffa8005d514d1 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ce0ce8 rsp=fffff8800738e4b0 rbp=0000000000000008
 r8=fffffa8005d514d0  r9=0000000000000000 r10=fffffa8003bb8cf0
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!IoAllocateMdl+0x118:
fffff800`02ce0ce8 48894108        mov     qword ptr [rcx+8],rax ds:e848:00000000`00000009=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002cc51e9 to fffff80002cc5c40

STACK_TEXT:  
fffff880`0738e1d8 fffff800`02cc51e9 : 00000000`0000000a 00000000`00000009 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0738e1e0 fffff800`02cc3e60 : 00000000`00000000 fffff880`0738e481 fffff880`0738e360 00000000`00000030 : nt!KiBugCheckDispatch+0x69
fffff880`0738e320 fffff800`02ce0ce8 : fffff880`0738e808 fffff880`016d2897 fffffa80`03cd7650 fffff880`07380002 : nt!KiPageFault+0x260
fffff880`0738e4b0 fffff880`0144362c : 00000000`00000000 fffffa80`05bf3b20 fffffa80`03dc4d00 fffffa80`06d906a0 : nt!IoAllocateMdl+0x118
fffff880`0738e500 fffff880`01535b22 : fffffa80`05bf39f0 fffff880`017cf9a0 00000000`43bcf0bb 00000000`00000014 : ndis!NdisAllocateCloneNetBufferList+0x21c
fffff880`0738e610 fffff880`016926f3 : fffff880`0738e668 00000000`00000014 fffff880`017cf9a0 fffffa80`06d90570 : NETIO!NetioAllocateAndReferenceCloneNetBufferList+0x32
fffff880`0738e640 fffff880`01693944 : 00000000`00000000 fffffa80`06d90570 fffff880`017cf9a0 fffff880`016a6fbf : tcpip!IppCreateClonePacket+0x23
fffff880`0738e670 fffff880`01693acb : fffffa80`04ced670 fffffa80`06d906a0 fffffa80`04ced601 fffffa80`06d90570 : tcpip!IppCreateStrongClonePacket+0x54
fffff880`0738e6b0 fffff880`016b17a5 : fffffa80`03f1b101 fffffa80`03f1b160 fffff880`017cf9a0 fffffa80`03dc4c00 : tcpip!IppCreateLoopbackSplitList+0xab
fffff880`0738e710 fffff880`016b3895 : 00000000`00000000 00000000`00000009 fffff880`0738e848 00000000`00000000 : tcpip!IppDispatchSendPacketHelper+0x3e5
fffff880`0738e7d0 fffff880`016b1fd3 : 00000000`00000011 00000000`00000000 fffffa80`00000014 11397c15`00000000 : tcpip!IppPacketizeDatagrams+0x2d5
fffff880`0738e8f0 fffff880`016b543e : fffffa80`03f1b160 fffff880`0152ff04 fffff880`017cf9a0 fffffa80`03cd7650 : tcpip!IppSendDatagramsCommon+0x753
fffff880`0738ebc0 fffff880`01692ee8 : fffffa80`03cd7650 fffffa80`06d90570 fffffa80`06d90570 fffffa80`03f1b160 : tcpip!IpNlpSendDatagrams+0x3e
fffff880`0738ec00 fffff880`0169313b : fffffa80`06e9a280 fffff880`017910b0 fffff880`0738f540 00000000`00000000 : tcpip!UdpSendMessagesOnPathCreation+0x688
fffff880`0738ef80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!UdpSendMessages+0x1db


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!NetioAllocateAndReferenceCloneNetBufferList+32
fffff880`01535b22 488bd8          mov     rbx,rax

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  NETIO!NetioAllocateAndReferenceCloneNetBufferList+32

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79381

FAILURE_BUCKET_ID:  X64_0xA_NETIO!NetioAllocateAndReferenceCloneNetBufferList+32

BUCKET_ID:  X64_0xA_NETIO!NetioAllocateAndReferenceCloneNetBufferList+32

Followup: MachineOwner
---------

Probably caused by : NETIO.SYS
PROCESS_NAME: Dropbox.exe

NETIO.SYS is usually blamed when the problem is caused by your network driver. In your case, it may also have been blamed due to Dropbox. Try uninstalling Dropbox and see if the problem persists. If you have files in Dropbox that you need, move them to an external drive for the duration of testing.

 

[justinbronze]

Dropbox uninstalled. Let's see how thing's work out.

I'm also going to update my network adapter drivers and stuff.

Stupid question: I don't need the adapters if my connection is wired, but still connected to a router, right?

 

[writhziden]

Dropbox uninstalled. Let's see how thing's work out.

I'm also going to update my network adapter drivers and stuff.

Stupid question: I don't need the adapters if my connection is wired, but still connected to a router, right?

You don't need your wireless if you are connected via Ethernet, no.

 

[justinbronze]

Uninstalled the Atheros.

 

[justinbronze]

Another blue screen. I can imagine that this one was caused by verifier.

NTFS_FILE_SYSTEM

Caused by:
ntfs.sys
ntoskrnl.sys

Appropriate zip file attached.

 

[justinbronze]

Help?