Solved BSODs over the last couple of days

peaco19 · Mar 7, 2013

Over the last couple of days I've been having random BSOD after a few hours of use or so. I've been unable to find anything that causes it to occur, it appears to just happen randomly. Thanks for any help!

usasma · Mar 11, 2013

Sorry for the delay in responding. There just aren't that many people who do BSOD analysis, so at times we get a bit overwhelmed!

C: drive only has about 10% free space. Windows likes 15% free space in order to perform stuff "behind the scenes" without adversely affecting the system's performance. Please free up 15% on ALL hard drives.

These devices have problems:

VirtualBox Host-Only Ethernet Adapter ROOT\NET\0001 This device is disabled.
Not Available ACPI\QCI0701\2&DABA3FF&1 The drivers for this device are not installed.

I'm seeing lot's of issues on systems that have Virtual machine software. I would suggest removing the software in order to test. Either use the Hyper-V solution that comes with some versions of Win8, or leave the virtual software off of the system while testing. Feel free to reinstall it once the system has stabilized.

The ACPI\QCI0701\2&DABA3FF&1 is a part of this (this driver package must be installed):
PROVIDER_NAME="TOSHIBA"
DESCRIPTION="Generic IO & Memory Access"
WDM_INSTALL_DISK="QIOMem Disk"
SERVICE_DISPLAY_NAME="Generic IO & Memory Access"

DriverVer=06/02/2009,2,1,0,0
QIOMem.sys

It is a part of this program:
"Generic IO & Memory Access" from the "QIOMem Disk" Program and can be found in the Hardware Setup at Toshiba's Driver Downloads and described as being:

This tool lets you customize your hardware settings according to the way you work with your computer and the peripherals you use.

Also, your Leaf Network Adapter installs a lot of stuff that causes problems with other software (a search for "Leaf Network Adapter" will show a lot of problems. Please uninstall it to see if that's causing the problems (it's associated with the NetGear stuff that is installed on your system). Feel free to reinstall the latest, Win8 compatible version once the system has been stabilized.

One of the memory dumps blames the Leaf device, another blames Kaspersky. I suspect that the numerous firewall devices installed by the Netgear Leaf software are to blame for this (along with the fact that one of it's drivers dates from 2008: leafnets.sys Thu Apr 24 17:06:18 2008 (4810F64A) ). I suggest that you remove the Leaf software and see if that stops the BSOD's.

Please update these older drivers. Links are included to assist in looking up the source of the drivers. If unable to find an update, please remove (un-install) the program responsible for that driver. DO NOT manually delete/rename the driver as it may make the system unbootable! :

lmimirr.sys Tue Apr 10 18:32:45 2007 (461C108D)
RemotelyAnywhere Mirror Miniport Driver or LogMeIn Mirror Miniport Driver
http://www.carrona.org/drivers/driver.php?id=lmimirr.sys

TVALZ_O.SYS Thu Nov 8 22:08:41 2007 (4733CF39)
TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver
http://www.carrona.org/drivers/driver.php?id=TVALZ_O.SYS

RaInfo.sys Fri Jan 4 13:57:14 2008 (477E818A)
LogMeIn/RemotelyAnywhere Kernel Information Provider
http://www.carrona.org/drivers/driver.php?id=RaInfo.sys

LMIRfsDriver.sys Mon Jul 14 12:26:56 2008 (487B7E50)
RemotelyAnywhere Mirror Miniport Driver or LogMeIn Mirror Miniport Driver
http://www.carrona.org/drivers/driver.php?id=LMIRfsDriver.sys

HECIx64.sys Thu Sep 17 15:54:16 2009 (4AB293E8)
Intel Management Engine Interface
http://www.carrona.org/drivers/driver.php?id=HECIx64.sys

appliand.sys Fri May 20 06:20:42 2011 (4DD6407A)
Applian Network Service/Applian Technologies APPLIAND helper driver
http://www.carrona.org/drivers/driver.php?id=appliand.sys

Analysis:
The following is for informational purposes only.

Code:

[FONT=lucida console]**************************Thu Mar  7 20:36:58.985 2013 (UTC - 4:00)**************************
Loading Dump File [C:\Users\Owner\SysnativeBSODApps\030713-62796-01.dmp]
Windows 8 Kernel Version 9200 MP (2 procs) Free x64
Built by: [B]9200[/B].16496.amd64fre.win8_gdr.130108-1504
System Uptime:[B]0 days 2:46:14.696[/B]
*** WARNING: Unable to verify timestamp for fwleaf.sys
*** ERROR: Module load completed but symbols could not be loaded for fwleaf.sys
Probably caused by :[B]Pool_Corruption ( nt!ExFreePool+3ec )[/B]
BugCheck [B]19, {3, fffffa8008ac5010, 0, fffffa8008ac5010}[/B]
BugCheck Info: [URL="http://www.carrona.org/bsodindx.html#0x00000019"]BAD_POOL_HEADER (19)[/URL]
Arguments: 
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffffa8008ac5010, the pool entry being checked.
Arg3: 0000000000000000, the read back flink freelist value (should be the same as 2).
Arg4: fffffa8008ac5010, the read back blink freelist value (should be the same as 2).
BUGCHECK_STR:  0x19_3
PROCESS_NAME:  System
FAILURE_BUCKET_ID: [B]0x19_3_nt!ExFreePool[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Thu Mar  7 15:31:22.212 2013 (UTC - 4:00)**************************
Loading Dump File [C:\Users\Owner\SysnativeBSODApps\030713-23234-01.dmp]
Windows 8 Kernel Version 9200 MP (2 procs) Free x64
Built by: [B]9200[/B].16461.amd64fre.win8_gdr.121119-1606
System Uptime:[B]0 days 4:31:22.190[/B]
*** ERROR: Module load completed but symbols could not be loaded for ndiswan.sys
Probably caused by :[B]ntkrnlmp[/B]
BugCheck [B]9F, {3, fffffa8003b88060, fffff8021f653920, fffffa800a3c6af0}[/B]
BugCheck Info: [URL="http://www.carrona.org/bsodindx.html#0x0000009F"]DRIVER_POWER_STATE_FAILURE (9f)[/URL]
Arguments: 
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa8003b88060, Physical Device Object of the stack
Arg3: fffff8021f653920, nt!TRIAGE_9F_POWER on Win7, otherwise the Functional Device Object of the stack
Arg4: fffffa800a3c6af0, The blocked IRP
BUGCHECK_STR:  0x9F
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  System
FAILURE_BUCKET_ID: [B]0x9F_3_POWER_DOWN_IMAGE_ntkrnlmp[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Wed Mar  6 16:52:58.582 2013 (UTC - 4:00)**************************
Loading Dump File [C:\Users\Owner\SysnativeBSODApps\030613-54187-01.dmp]
Windows 8 Kernel Version 9200 MP (2 procs) Free x64
Built by: [B]9200[/B].16461.amd64fre.win8_gdr.121119-1606
System Uptime:[B]0 days 1:46:46.294[/B]
*** WARNING: Unable to verify timestamp for klim6.sys
*** ERROR: Module load completed but symbols could not be loaded for klim6.sys
Probably caused by :[B]klim6.sys ( klim6+28f4 )[/B]
BugCheck [B]FC, {fffffa8008667250, 80000001302009e3, fffff88019ec8970, 3}[/B]
BugCheck Info: [URL="http://www.carrona.org/bsodindx.html#0x000000FC"]ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)[/URL]
Arguments: 
Arg1: fffffa8008667250, Virtual address for the attempted execute.
Arg2: 80000001302009e3, PTE contents.
Arg3: fffff88019ec8970, (reserved)
Arg4: 0000000000000003, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  System
FAILURE_BUCKET_ID: [B]0xFC_klim6+28f4[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Wed Mar  6 15:04:49.882 2013 (UTC - 4:00)**************************
Loading Dump File [C:\Users\Owner\SysnativeBSODApps\030613-35781-01.dmp]
Windows 8 Kernel Version 9200 MP (2 procs) Free x64
Built by: [B]9200[/B].16461.amd64fre.win8_gdr.121119-1606
System Uptime:[B]0 days 0:41:00.596[/B]
*** WARNING: Unable to verify timestamp for fwleaf.sys
*** ERROR: Module load completed but symbols could not be loaded for fwleaf.sys
Probably caused by :[B]ntkrnlmp[/B]
BugCheck [B]9F, {3, fffffa8003b7d660, fffff800d2b9a920, fffffa800a3ace10}[/B]
BugCheck Info: [URL="http://www.carrona.org/bsodindx.html#0x0000009F"]DRIVER_POWER_STATE_FAILURE (9f)[/URL]
Arguments: 
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa8003b7d660, Physical Device Object of the stack
Arg3: fffff800d2b9a920, nt!TRIAGE_9F_POWER on Win7, otherwise the Functional Device Object of the stack
Arg4: fffffa800a3ace10, The blocked IRP
BUGCHECK_STR:  0x9F
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  System
FAILURE_BUCKET_ID: [B]0x9F_3_POWER_DOWN_IMAGE_ntkrnlmp[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/FONT]

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.

Code:

[FONT=lucida console]**************************Thu Mar  7 20:36:58.985 2013 (UTC - 4:00)**************************
[COLOR=RED][B]lmimirr.sys                 Tue Apr 10 18:32:45 2007 (461C108D)[/B][/COLOR]
[COLOR=RED][B]TVALZ_O.SYS                 Thu Nov  8 22:08:41 2007 (4733CF39)[/B][/COLOR]
[COLOR=RED][B]RaInfo.sys                  Fri Jan  4 13:57:14 2008 (477E818A)[/B][/COLOR]
[COLOR=RED][B]leafnets.sys                Thu Apr 24 17:06:18 2008 (4810F64A)[/B][/COLOR]
[COLOR=RED][B]LMIRfsDriver.sys            Mon Jul 14 12:26:56 2008 (487B7E50)[/B][/COLOR]
[COLOR=RED][B]HECIx64.sys                 Thu Sep 17 15:54:16 2009 (4AB293E8)[/B][/COLOR]
[COLOR=RED][B]appliand.sys                Fri May 20 06:20:42 2011 (4DD6407A)[/B][/COLOR]
truecrypt.sys               Tue Feb  7 04:09:36 2012 (4F30EA50)
GEARAspiWDM.sys             Thu May  3 15:56:17 2012 (4FA2E2E1)
L1C63x64.sys                Thu Jun 14 01:57:40 2012 (4FD97D54)
kl1.sys                     Tue Jun 19 09:27:15 2012 (4FE07E33)
rtwlane.sys                 Thu Jun 21 00:45:30 2012 (4FE2A6EA)
dump_storahci.sys           Wed Jul 25 22:30:35 2012 (5010ABCB)
klim6.sys                   Thu Aug  2 07:08:40 2012 (501A5FB8)
klflt.sys                   Fri Aug  3 12:09:20 2012 (501BF7B0)
NetgearUDSMBus.sys          Mon Aug 13 03:03:29 2012 (5028A6C1)
kneps.sys                   Mon Aug 13 08:45:42 2012 (5028F6F6)
klkbdflt.sys                Mon Sep  3 09:54:42 2012 (5044B6A2)
klmouflt.sys                Mon Sep  3 10:20:14 2012 (5044BC9E)
igdkmd64.sys                Fri Sep 14 19:09:01 2012 (5053B90D)
klif.sys                    Fri Nov  2 07:38:53 2012 (5093B0CD)
intelppm.sys                Mon Nov  5 22:55:02 2012 (50988A16)
fwleaf.sys                  Fri Nov 30 16:03:42 2012 (50B91F2E)
VBoxUSBMon.sys              Wed Dec 19 08:47:17 2012 (50D1C565)
VBoxDrv.sys                 Wed Dec 19 08:48:25 2012 (50D1C5A9)
klwfp.sys                   Thu Dec 20 06:50:29 2012 (50D2FB85)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Thu Mar  7 15:31:22.212 2013 (UTC - 4:00)**************************
NetgearUDSTcpBus.sys        Mon Aug 13 03:05:54 2012 (5028A752)
[/FONT]

peaco19 · Mar 11, 2013

Awesome, thanks for the assistance. I've done all suggestions, except for removing VirtualBox (I've currently got to have it for University), and thus far my issues seem to have been resolved.

Once again, thanks for your help.

Solved BSODs over the last couple of days

peaco19

New Member

My Computer

System One

usasma

Mr. Cranky Pants

My Computer

System One

peaco19

New Member

My Computer

System One