ntoskrnl.exe BSOD randomly

[x BlueRobot]

If it doesn't crash in Safe Mode, then it's usually just a driver issue, however, looking at the most recent bugcheck it seem that the working set free list is corrupt is most likely caused by hardware.

[COLOR=Red]BugCheck 1A[/COLOR], {[COLOR=Blue]5003[/COLOR], [COLOR=Orange]c0802000[/COLOR], 6c1, 6c3d80}

Probably caused by : [COLOR=Red]memory_corruption[/COLOR] ( nt!MiAllocateWsle+6f )

0: kd> [COLOR=SeaGreen]!wsle 2[/COLOR]

Working Set @ [COLOR=Orange]c0802000[/COLOR]
    FirstFree      6c1  FirstDynamic        6
    LastEntry      701  NextSlot            6  LastInitialized      8bd
    NonDirect      1f4  HashTable           0  HashTableSize          0

Reading the WSLE data .....Unable to get Wsle table block - address c0803108 - count 512 - page 0x100

With the second bit flag set with the extension, the free WSLEs shoud also be displayed, but since this data structure has become corrupt then this data may not be displayed.

0: kd> [COLOR=SeaGreen]dt nt!_MMWSLE c0802000[/COLOR]
   +0x000 u1               : <unnamed-tag>

0: kd> [COLOR=SeaGreen].trap a75d2d34[/COLOR]
ErrCode = [COLOR=Red]00000006[/COLOR]
eax=01470020 ebx=01470020 ecx=000037f1 edx=0000004c esi=76dbeef7 edi=014a1fa0
eip=76f19c9c esp=00f0f194 ebp=00f0f198 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
001b:76f19c9c ??              ???

Interestingly, the trap frame which was caused because of an invalid assembly instruction. The call stack doesn't reveal much, because the instruction was possibly made in User-Mode.

We could try running Driver Verifier again, but with the Special Pool option enabled too. Select Individual Settings, and enable all the options, apart from Low Resources Simulation.

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

 

[moieu]

Alright I ran driver verifier, found asacpi.sys was the cause, and looked up how to fix it. A fix was to rename it to asacpi.bak and it would make a new one on startup, and that helped, I ran the new asacpi.sys file and it was fine. But after about 2 hrs from that I got another blue screen but it didn't post a dump file. Also instead of the usual text at the bottom half where it says its posting a dump, I got about 7 or 8 weird characters that I had no clue what were for. Also all my other drivers are running fine. I ran driver verifier without problems.
EDIT: Ran driver verifier on ALL my drivers, hidclass.sys was giving a blue screen. Posting the dump file for you to look at.

 

[x BlueRobot]

Don't enable Driver Verifer for Windows drivers.

[COLOR="Red"]BugCheck C9[/COLOR], {[COLOR="Blue"]220[/COLOR], 985e2a8c, bc308ed8, 8d317e98}

*** WARNING: Unable to verify timestamp for LGVirHid.sys
*** ERROR: Module load completed but symbols could not be loaded for LGVirHid.sys
Probably caused by : HIDCLASS.SYS ( HIDCLASS!HidpMajorHandler+0 )

This bugcheck indicates that a driver has completed a IRP_MJ_SYSTEM_CONTROL request without the correct ProviderID.

2: kd> [COLOR="SeaGreen"]!irp bc308ed8[/COLOR]
Irp is active with 5 stacks 4 is current (= 0xbc308fb4)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  2 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 c00000bb
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [ 17,ff]   0  2 8e7b6bf8 00000000 00000000-00000000    
	      8e7b6bf8: Could not read device object or _DEVICE_OBJECT not found

			Args: 8d317e98 00000000 00000000 00000000
[COLOR="Red"]>[ 17,ff]   0 e0 8e7b6bf8 00000000 82d74d3a-bc308fd8 Success Error Cancel 
	      8e7b6bf8: Could not read device object or _DEVICE_OBJECT not found
	nt!IovpInternalCompletionTrap[/COLOR]
			Args: 8d317e98 00000000 00000000 00000000
 [ 17,ff]   0 e0 8e7b6aa8 00000000 82d73c25-8819d9c0 Success Error Cancel 
	      8e7b6aa8: Could not read device object or _DEVICE_OBJECT not found
	nt!ViIrpSynchronousCompletionRoutine
			Args: 8d317e98 00000000 00000000 00000000

2: kd> [COLOR="Blue"][COLOR="SeaGreen"]lmvm LGVirHid[/COLOR][/COLOR]
start    end        module name
b0c41000 b0c43000   LGVirHid T (no symbols)           
    Loaded symbol image file: LGVirHid.sys
    Image path: \SystemRoot\system32\drivers\LGVirHid.sys
    Image name: LGVirHid.sys
    Timestamp:        [COLOR="DarkRed"][COLOR="Red"]Tue Nov 24 01:36:26 2009[/COLOR][/COLOR] (4B0B389A)
    CheckSum:         00010C56
    ImageSize:        00002000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your Logitech Gamepanel Virtual HID Device Driver seems to be causing problems, please update the driver from here - Logitech Support - Downloads, Manuals, FAQs & More

Check the support pages for any Logitech equipment you have.

 

[moieu]

Alright well I wasn't getting blue screens, but windows was freezing again. This is what I got from Event Viewer. Also I tried to run startup repair and it said it was unable to repair the problem. I don't know how to get that dump file, if there is one anyways. Also my bad about the windows files, I clicked on select all drivers, because I thought it might be a problem with a windows driver. Also, I just reinstalled logitech gaming software for my mouse and headset, and right after that I got a computer freeze.

 

[x BlueRobot]

That error seems to be largely network based from what I've found on Technet and MSDN. Have you tried a different browser? It might also be related to Outlook if you have the Outlook client installed.

 

[moieu]

I don't know what I did but it's fixed I think. Haven't had any blue screens in 3 days.

 

[x BlueRobot]

Okay, that's great news, leave the thread open for a few more days and then mark it has solved if you feel your issue has been resolved

 

[moieu]

Just got another blue screen. I don't know if this helps, but it happened about 2 minutes after I plugged my phone into my usb charger connected to my pc. The charger is actually for my headset, and it has a split were you can plug another usb into. It's kinda confusing but think of it as this, it plus into my computer, then has another usb slot coming from it, then a charger for my headset, that also fits for my phone.

 

[ICIT2LOL]

Just got another blue screen. I don't know if this helps, but it happened about 2 minutes after I plugged my phone into my usb charger connected to my pc. The charger is actually for my headset, and it has a split were you can plug another usb into. It's kinda confusing but think of it as this, it plus into my computer, then has another usb slot coming from it, then a charger for my headset, that also fits for my phone.

Do you need to charge the phone via the charger mate most stuff will have a direct USB cable that will avoid using the charger.

The other point to me is that the machine doesn't like the phone or it's software.
Blue will be able to help you with the other stuff mate as I am pretty hopeless with that

 

[moieu]

Well I just split the two. My phone is now charging on a separate cable and my headset is using it's own too. And I haven't had any bsods.

 

[ICIT2LOL]

Well I just split the two. My phone is now charging on a separate cable and my headset is using it's own too. And I haven't had any bsods.

Good stuff if it stays that way then maybe it is that the machine doesn't like both through one USB port - who knows as long as it works thats the main thing.

 

[x BlueRobot]

Well I just split the two. My phone is now charging on a separate cable and my headset is using it's own too. And I haven't had any bsods.

That's good to know

 

[x BlueRobot]

Just for the sake of debugging, here's my analysis:

[COLOR="Red"]BugCheck 1000008E[/COLOR], {[COLOR="SeaGreen"]c0000005[/COLOR], 82a87189, a16d6ca4, 0}

Probably caused by : [COLOR="Red"]invalid_control_transfer[/COLOR]

a16d6ca4 -- ([COLOR="SeaGreen"].trap 0xffffffffa16d6ca4[/COLOR])
ErrCode = [COLOR="Red"]00000002[/COLOR]
eax=855b2400 ebx=97cf4a1c ecx=00000000 edx=00000000 esi=00000008 edi=00000028
eip=82a87189 esp=a16d6d18 ebp=a16d6d24 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
nt!ExReleaseResourceAndLeavePriorityRegion+0xc:
82a87189 888b0200008d    mov     byte ptr [ebx-72FFFFFEh],cl ds:0023:24cf4a1e=??

The exception being introduced here is a NMI (or Non-Maskable Interrupt), and is a very high priority interrupt used for crashes.

The nt!ExReleaseResourceAndLeavePriorityRegion (undocumented) is used to release a executive resource, and leave a priority region. The priority region in this case, may have been a critical section.

1: kd> [COLOR="SeaGreen"]u win32k!NtUserCallOneParam+0x43[/COLOR]
[COLOR="Red"]win32k!NtUserCallOneParam[/COLOR]+0x43:
97cf4a5f e8a3ecfeff      [COLOR="Blue"]call [/COLOR]   win32k!UserSessionSwitchLeaveCrit (97ce3707) <-- Problem here
97cf4a64 8bc7            mov     eax,edi
97cf4a66 5f              pop     edi
97cf4a67 5e              pop     esi
97cf4a68 5d              pop     ebp
97cf4a69 c20800          ret     8
97cf4a6c 90              nop
97cf4a6d 90              nop

The problem happens when attempting to call a certain function, and this call fails.

 

[moieu]

Alright, still getting bsods... I've tried everything. Its still usbfilter.sys, I ran driver verifier to check. But even after updating it it's still the cause. I'm also not able to do anything past boot now cause it says winload.exe is missing or corrupt. It did this earlier and then after awhile went away. I need serious help because I'm going to get kicked out of my classes if I can't submit work... also, I was trying to fix it by myself and found a thread were a program had fixed the issue, it disabled the USB filter system file, but now my keyboard and mouse won't work at all.

 

[moieu]

Ok so I reset my computere to factory settings again. It's couldn't find another way to use my keyboard and mouse after boot, and I finally got the winload.exe error to go away. It just went away, after awhile. After resetting my computer I installed all the updates, and I didn't get a blue screen, but I got that thing where my computer tower stays on, but everything connected to it shuts off. My monitor went to standby mode. I guess that's kind of like a blue screen, although I got no dmp file for it. If I get any blue screens I will be posting the dmp files for them as they come.

 

[moieu]

Alright for some reason I can't edit my previous posts, but I had a bsod and there was no dump file, then I decided to use driver verifier to see which one it was, it was usbfilter.sys I'm attaching the two bsods I got from driver verifier in hopes that you have a fix. Keep in mind the last time I installed the amd update from my computer's website it didn't fix the usbfilter.sys bsods I was getting.

 

[x BlueRobot]

3: kd> [COLOR=Red][COLOR=SeaGreen]lmvm usbfilter[/COLOR][/COLOR]
start             end                 module name
fffff880`043c9000 fffff880`043d6000   usbfilter T (no symbols)           
    Loaded symbol image file: usbfilter.sys
    Image path: \SystemRoot\system32\DRIVERS\usbfilter.sys
    Image name: usbfilter.sys
    Timestamp:        [COLOR=Red]Tue Dec 22 08:26:22 2009[/COLOR] (4B3082AE)
    CheckSum:         0000DFD8
    ImageSize:        0000D000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Where did you update the driver last time? Try the AMD website, since this driver usually belongs to your chipset. Do you have a non-USB keyboard and mouse?

Support & Drivers

[COLOR=Red]BugCheck D5[/COLOR], {fffff98008d84df0, 0, fffff880043cd1aa, 0}

Could not read faulting driver name
Probably caused by : usbfilter.sys ( usbfilter+41aa )

The driver caused a invalid page fault, since the pool page was no longer allocated to the driver's own address space. It was freed.

 

[moieu]

I originally downloaded it from my computer's website. I have an Asus cm1630, and they had the driver there. But it didn't seem to fix the problem. I'll download it from this website and see if it does. I have no clue on which one to install from this website you linked me, I'm using a nvidia graphics card, so it doesn't tell me which amd one I have installed.

EDIT: Ran driver verifier with usbfilter.sys checked, no bsod on startup, but then after like 10 minutes I got one. But it didn't post a dmp file, so I don't have one to show for it. Will be posting them as they come though.

 

[moieu]

Just got a bsod, it said tcpip.sys, I looked it up but I don't understand what could've caused it. Could you look into it for me?
EDIT: Another two bsods since the last time I posted. Here they are.

 

[x BlueRobot]

Did you use the AMD automatic driver installation?