Various BSoD's on Custom Built Computer

[aommaster]

Hello,

A small bit of history first:
The computer in question is a custom build that I had been using for around 5 years with no problems at all. I then gave it to my sister after a complete format, and she has started to experience many BSoD's with it. Please note that only the internal hardware is the same, she may be using external hardware (USB devices) that are different to what I was using, which I believe may be the problem here.

I did try running Driver Verifier, and the computer would not boot up. It would BSoD into an IRQL_NOT_LESS_OR_EQUAL.

Sometimes, I noticed the computer would not even get past POST. It would finish all the memory tests, then just restart.

I have attached the entire folder of the SF Diagnostic Tool. If anyone could help shed some light on why I am receiving these BSoD's and how to fix it, I would really appreciate it.

 

[Arc]

Hi aommaster.

Apparently the BSODs are seeming to be some sort of driver fault, but the failing driver/s are not showing up in the crash dumps.

[COLOR=Red]INVALID_KERNEL_HANDLE (93)[/COLOR]
This message occurs if kernel code attempts to close or reference a handle
that is not a valid handle.  Only invalid or protected handles passed to NtClose
will cause this bugcheck, unless bad handle detection is enabled.

[COLOR=Red]IRQL_NOT_LESS_OR_EQUAL (a)[/COLOR]
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.

Enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[aommaster]

Hi Arc!

Thank you very much for helping me out.

I wasn't able to create a restore point, because every time I attempted to do so, I got a BSoD. I have attached the three generated crash dumps for you. They all appear identical.

When I previously attempted to use Driver Verifier (without creating the restore point), I was not able to get past the POST without an IRQL_NOT_LESS_OR_EQUAL BSoD. The dump for that can be found in my initial post, and is dated 4th of March.

What would you like me to do next?

Thanks again for all the help!

Edit: Also, I would like to add that the BSoD's mostly occur within 5 minutes of start-up. They are very frequent.

 

[Arc]

Hi aommaster, those crash dumps are not seeming to be Driver Verifier enabled.

1: kd> !verifier
fffff80003649b20: Unable to get verifier list.

So, nothing new can be obtained from those, unfortunately.

BTW, I know that it might not make you happy, but, can you disable FCB Fan Alert form startup, at least as a test?

I have no proof to say anything against it. But the startup programs may cause these type of BSODs.

 

[aommaster]

Hi Arc!

That's not a problem at all. Anything I can do to help you find out what is causing the issue is fine. Once I disable the program, should I try to create a restore point and then run Drive Verifier?

 

[Britton30]

I will assume the PC was moved to a new location. Check all of the power cable connections by removing them and hooking them back up to insure they are all fully connected.
Also remove and reinstall all the memory sticks and any PCIe card and confirm they are all fully seated.

Yes do the restore point and enable Driver Verifier for Arc.

 

[aommaster]

Hi Britton30

Thanks for taking a stab for me! I opened up the PC, checked all the connections (SATA, power cables, PCIExpress, etc.) and all are fine.

I decided to take a bit of a risk and run Driver Verifier as I noticed there was a previous restore point set to yesterday's Windows Update. When restarted, the computer reaches the "Windows is Starting" point, and then hits a BSoD with IRQL_NOT_LESS_OR_EQUAL. After the dump, the computer restarts and the process continues.

I'm not too worried, because I can still access safe mode to disable the verifier if need be. I have attached the dump for you. Is there anything you would like me to do now that I have this loop? Does this provide you with any information as to what's causing the problem?

Thanks again!

 

[Arc]

Now situation compels me to contradict my first post in this thread.

[COLOR=Red]BugCheck A[/COLOR], {0, 2, 0, fffff800034eba55}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

It is a verifier enabled crash dump, and not catching any driver at all. So, thje driver issue is not standing anymore there.

According to Carrona.org: STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL
Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

Late us pay attention to the highlighted points at first.

Uninstall Avira. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Try to update the BIOS to version F9 (not the latest one, U1D) from GIGABYTE - Motherboard - Socket 1155 - GA-P67A-UD3-B3 (rev. 1.x)
The BIOS here applied is F2.

Let us know the results.

 

[aommaster]

Thanks for the help Arc!

I uninstalled Avira as you recommended. I ran a scan using MSE, nothing found. Ran another scam using MBAM, found around 20 items, but just a browser extension. I deleted it anyway, though.

I also flashed the BIOS. I couldn't actually flash the BIOS through Windows using the tool provided, though. I kept receiving BSoD's, which are timed at 4:03 and 4:10 in the BSoD dumps attached. I finally flashed it through a flash drive (I had problems with this step, but realized I wasn't using the right file system. Once I changed it, it flashed fine).

When trying to boot up Windows, I am still receiving BSoD's after all the steps you suggested. Those are the ones timed at 4:19 and later.

Any ideas what could be causing it?

 

[Arc]

If DV is enabled, it continues with stop 0xA. So a deeper check was needed, and it revealed:

LOCK_ADDRESS:  fffff80003693be0 -- (!locks fffff80003693be0)

Resource @ nt!PiEngineLock (0xfffff80003693be0)    Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE: 
    Lock address  : 0xfffff80003693be0
    Thread Count  : 0
    Thread address: 0x0000000000000000
    Thread wait   : 0x0

LAST_CONTROL_TRANSFER:  from fffff8000348f169 to fffff8000348fbc0

And from your files, it is obtained:

DEVICE | PNP DEVICE ID | ERROR CODE
Security Processor Loader Driver | ROOT\LEGACY_SPLDR\0000 | This device is not present, is not working properly, or does not have all its drivers installed.

Plus, if DV is disabled, it continues to cause stop 0x93.

INVALID_KERNEL_HANDLE (93)
This message occurs if kernel code attempts to close or reference a handle
that is not a valid handle.  [COLOR=Red][U]Only invalid or protected handles passed to NtClose
will cause this bugcheck[/U], unless bad handle detection is enabled.[/COLOR]
Arguments:
Arg1: 0000000000000bd0, The handle that NtClose was called with
Arg2: 0000000000000000, A protected handle was closed.
Arg3: 0000000000000000
Arg4: 0000000000000000, The error occurred closing an invalid kernel handle.

Run SFC /SCANNOW Command - System File Checker

After doing this, upload your MSINFO32.nfo file again.

1. Click on the start button
2. Type "msinfo32" (without quotes) in the search bar of the start menu, click the resulting link. It will open the System Information window.
3. File>Save. In the "File Name" filed, put "MSINFO32" (without Quote), give the save location to desktop, and click the "save" button.
4. Give the time for processing, it will save a .nfo file on your desktop.
5. Zip it, and upload it following the instruction.

Plus, I think that Britton30 also has some ideas about this issue, which will definitely enlighten us. I have seen him earlier working with spldr successfully.

Edit: Upload the list of all the third party drivers Using NirSoft DriverView :

• Download and execute Driverview
• View > Hide Microsoft Drivers
• Edit > Select all
• File > Save Selected Items
• In the Save dialog, Set the path to desktop, Put "Driverview" in the name field, and save.
• Zip the .txt file and upload it.

 

[Britton30]

Please follow Arc's steps, if SFC finds corruptions it can't fix, more than 2 tries are useless.
Give these tests a run too.

Pick one for your HDD brand or use Seatools.

7 Free Hard Drive Testing Software Tools​

RAM (memory) test:

This will require memtest on a bootable CD or USB stick.
RAM - Test with Memtest86+​

 

[aommaster]

@Arc: I ran an SFC /Scannow check, all files were found okay. I've also uploaded the msinfo file you requested, and the DriverView logs you wanted to look at. In addition, I also attached two BSoD dump files for you, but I don't believe anything will be unexpected from those.

@Britton30: I ran scans using MemTest and Hitachi's drive fitness test. Both came clean.

Thanks for all the help!

 

[Arc]

The crash dumps are as usual. Noting is helpful there.

The spldr error is recovered.

Can you tell me what is this?

==================================================
Driver Name       : wStLibG64.sys
Address           : 00000000`00C2F000
End Address       : 00000000`00C40000
Size              : 0x00011000
Load Count        : 1
Index             : 61
File Type         : Network Driver
Description       : StdLib
Version           : 1.4.3.1
Company           : StdLib
Product Name      : StdLib
Modified Date     : 20-Feb-14 7:53:12 PM
Created Date      : 20-Feb-14 7:53:12 PM
Filename          : C:\Windows\system32\drivers\wStLibG64.sys
File Attributes   : A
Service Name      : wStLibG64
Service Display Name: wStLibG64
Digital Signature : 
==================================================

I have no prior experience about it. It claims to be a network driver, but it is not.

As I have no earlier experience about it, I searched over google, and found it: Malware scan of wstlibg64.sys (StdLib) e440f0f64fb1579c22e5878039e191a8bc10a7e2 - herdProtect

Scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

If still the BSODs continue to occur, IMHO it will be the best to go for a clean install.

 

[aommaster]

Hi Arc

I ran TDSSKiller, and nothing was found. As for that driver, I'm not particularly sure what it is. I ran it through Jotti (great site, if you haven't heard of it, by the way!) and all scanners came clean on it.

 

[Arc]

If you have nothing installed during February in this line, then it is some unwanted thing, which should not be there.

Moreover, it says itself to be a network driver, where it is not, at all.

Overall, it is not anything good and anything wanted.

Not being a security expert, I cannot say the last word in this line. But, if the BSODs continue to occur, your best deal will be to perform a clean install only; because it is the best way to remove a malware, provided TDSSKiller scan found nothing.

 

[aommaster]

Not a problem, I'll do a full re-format and re-install windows.

Thank you, both, Arc and Britton30 very much for your time!

 

[Britton30]

You're welcome and good luck, let us know of anything else you need.