usbport.sys/usbehci.sys BSODs have skyrocketed in last few days

[Bilge]

Hey all, I've muddled through with usbport.sys BSODs once every 2-3 weeks since last August, but in the last few days they jumped to nearly 10 just today. I've monkeyed with peripheral configs, run "SFC /scannow" with no report integrity violations, run MS Fixit, completed a clean disk check process, and tried the clean startup process (results pending).

My hardware has been static for quite a while, so nothing has changed in that regard. Not sure exactly the best way to ensure I don't have corrupt or old drivers on the system, since I try to avoid loading bloat/spam/malware posted to some forums.

Definitely interested in what anyone can surmise to be the common thread, but my gut tells me it's driver-related.

Thanks,
Bilge

 

[Arc]

BugCheck D1, {ffffffff83c70a76, 2, 0, fffff880063b753b}

Probably caused by : USBPORT.SYS ( USBPORT!USBPORT_TxAcquireLock+13 )

Followup: MachineOwner
---------

BugCheck D1, {fffff8000497b7b0, 2, 0, fffff880061af090}

Probably caused by : usbehci.sys ( usbehci!EHCI_InterruptDpcEx+318 )

Followup: MachineOwner
---------

Upload the list of all the third party drivers Using NirSoft DriverView :

• Download and execute Driverview
• View > Hide Microsoft Drivers
• Edit > Select all
• File > Save Selected Items
• In the Save dialog, Set the path to desktop, Put "Driverview" in the name field, and save.
• Zip the .txt file and upload it.

We need to see this file in this case.

 

[Bilge]

Arc, much appreciated. Here you go.

I'm also running under the clean startup approach, which is currently only running three non-MS services (ActivIdentity, Carbonite, and Norton 360), with the rest disabled. Hard to tell if it's a fix, but it seems to have reduced the BSOD frequency a bit, so not sure if you those disabled non-MS services are evident in the Driverview output you need.

Bilge

 

[Arc]

These things may cause it.

Product Name : SCR3xx USB Smart Card Reader

• Modified Date : 6/5/2013 9:42:06 AM
• Created Date : 6/5/2013 9:42:06 AM

Product Name : GIGABYTE On/Off Charge

• Modified Date : 1/10/2011 5:16:08 PM
• Created Date : 8/20/2011 3:25:06 PM

Product Name : Citrix Receiver (Citrix USB Monitor Driver)

• Modified Date : 10/29/2014 5:26:46 PM
• Created Date : 10/29/2014 5:26:46 PM

To take precautions against it, the steps will be ....

• Citix: Search for possible updates. Search it in Downloads - Citrix
• GIGABYTE On/Off Charge: Uninstall all the Gigabyte software. They all are not only unnecessary but also evil.
• SCR3xx: Update it: Identive Customer Support Center

Let us know the results.

 

[Bilge]

Thanks, Arc. I went in and removed all the Gigabyte stuff, along with the Citrix receiver, which I don't really use anymore. I also verified that the SCR3xx driver I'm running is the latest. This did give me an excuse to purge my installed programs to trim some more fat, but I tend to keep a pretty lean set of programs.

Otherwise, I've turned back on a few of the services I disabled during the clean start process, and I'll see how this does for a few days. Not entirely sure when to claim victory.

V/r,
Bilge

 

[Arc]

Difficult to say. But if you say that it is a week passed within an issue, that is a positive indication. But BSODs are totally unpredictable. They can happen anytime.

 

[Bilge]

Arc, I was out of town for the weekend so the computer was off for a couple days, but I snagged two more BSODs since the last post. The smart card reader driver is supposedly up to date, but it wasn't plugged in at the time of the last BSOD, so unsure if it contributed.

Not sure if it's relevant, but when I return from a BSOD my Netgear WNDA3100v2 USB-adapter seems to always need to be unplugged and replugged before it can resume operation.

V/r,
Bilge

 

[Arc]

Now, this is a different bugcheck code.

BugCheck 1E, {0, 0, 0, 0}

[COLOR=Red]Probably caused by : USBPORT.SYS[/COLOR] ( USBPORT!MPf_Get32BitFrameNumber+89 )

Followup: MachineOwner
---------

So it is something to do with any USB device driver, again. A deeper search revealed it ....

fffff800`00b99228  fffff880`05441f1cUnable to load image \SystemRoot\system32\DRIVERS\bcmwlhigh664.sys, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for bcmwlhigh664.sys
*** ERROR: Module load completed but symbols could not be loaded for bcmwlhigh664.sys[/COLOR]
 bcmwlhigh664+0x1ff1c

It is the NETGEAR WNDA3100v2 N600 Wireless Dual Band USB Adapter. So apparently we are at the way. The driver is old. So it may not work properly.

    Image name: bcmwlhigh664.sys
[COLOR=Red]    Timestamp:        Tue Apr 19 12:43:08 2011 [/COLOR](4DAD3604)

Search for any possible update in NETGEAR Support | Downloads

BTW, there is another fold of the issue, too. Symantec Network Security Intermediate Filter Driver is also causing blockage to network which positively contributes to the BSOD.

fffff800`00b999c8  fffff880`04368a13Unable to load image \SystemRoot\system32\DRIVERS\SymIMv.sys, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for SymIMv.sys
*** ERROR: Module load completed but symbols could not be loaded for SymIMv.sys[/COLOR]
 SymIMv+0x2a13

Though it is discovered, let us first see what happens after the netgear driver update? If teh issue continues still after doing it, then we will concentrate on the Symantec thing. OK? So not suggesting the precautionary steps for it right now.

But if you want to rectify this too at the same go, let me know. I will suggest the precautionary steps for it too.

 

[Bilge]

Arc, just reinstalled the NETGEAR software/driver. Looks like the timestamp and driver version is the same as the one I'm running, but perhaps the initial install didn't quite take for some reason. I'll try to keep an eye on it and see if there's anything that happens in the next few days.

Thanks,
Bilge

 

[Arc]

Yes, observe the situation, inform us if needed.

 

[Bilge]

Arc, replaced my USB NETGEAR adapter with an internal PCI adapter, and have been minimizing the time when I've got my Smart Card reader plugged in ... and I still managed to get a recent BSOD claiming USBPORT.SYS as the culprit (the most recent dump file).

At this point, my only USB connections are a Dell RF keyboard receiver and 4-port USB hub with a MS Arc mouse adapter plugged into it ... unless some drivers are still running services despite the devices being disconnected.

Thanks,
Bilge

 

[Arc]

BugCheck D1, {fffffa8019c76109, 2, 1, fffff88005841803}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
[COLOR=Red]Probably caused by : memory_corruption[/COLOR]

Followup: memory_corruption
---------

It repoets memory corruption, so we need to check for it. It causes for not only a failing memory but also a misbehaving driver.

Test your RAM modules for possible errors.

How to Test and Diagnose RAM Issues with Memtest86+
​

Run memtest86+ for at least 8 consecutive passes.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

If it does not show any error, enable Driver Verifier to monitor the drivers.

Driver Verifier - Enable and Disable
​

Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[Bilge]

Arc, I ran the memTest for 10 passes with no errors, then ran the CCleaner pro cleanup/registry tweak, and finally finished up about 2 days worth of Driver Verifier with no BSODs.

Thanks,
Bilge

 

[Arc]

Well, apparently there is no more reasons for a stop 0xD1 left unchecked.

 

[Bilge]

It's been a while since I last posted, but I've still been experiencing a lot of BSODs, kicking out a usbport.sys or occasionally another code.

If DM Log Collector v1.2 no longer generates a final output file on the desktop (despite running flawlessly), is there another way to present the log collection for analysis?

Thanks!
Bilge

 

[Arc]

If DM Log Collector v1.2 no longer generates a final output file on the desktop (despite running flawlessly), is there another way to present the log collection for analysis?

Yes, there is. Try SF Diag tool.

 

[Bilge]

Arc, Norton keeps blasting the SF Tool off the hard drive. Would WinDbg or another program provide the same visibility?

Also, despite 1-5 BSODs a day, it looked like I only had one 820MB Memory.dmp and one Minidump from March. I went in yesterday and ensured Win7 was configured to generate minidumps, but it would seem that all of the recent BSODs weren't generating minidumps. Do they tend to produce one file per event?

 

[Bilge]

Sorry for the double-tap, but in the one minidump file I have, windbg highlights ntoskrnl.exe and usbport.sys as likely culprits (though I didn't have time to figure out how to properly load the symbols for windbg).

V/r,
Bilge

 

[Arc]

Arc, Norton keeps blasting the SF Tool off the hard drive.

Thats false.

 

[Bilge]

Arc, before I can get to the log collector it appears that the BSODs are no longer generating minidump files. Any tips for how to restore this? I've had it configured for minidumps under the Startup & Recovery menu, so I'm uncertain why they are no longer produced.

Bilge