Windows 8 and 8.1 Forums


Multiple BSOD since receiving new computer - KMODE & IRQL

  1. #81


    Posts : 2,480
    Windows 10 Pro x64


    It's asking to login...

      My System SpecsSystem Spec

  2. #82


    Memphis
    Posts : 61
    Windows 8.1 x64


    Hmmm. I logged out and then click the link I posted and it's view only. That's not what it gives you?

    **I see what you're saying now. When you click on it, you have to log in. I had to have an account to upload the file so I guess you need an account to view it? Mysers asked me to use OneDrive... Did the mini dump have anything in it?

    Try this link... https://onedrive.live.com/redir?resi...int=file%2czip
      My System SpecsSystem Spec

  3. #83


    Posts : 2,480
    Windows 10 Pro x64


    Yes, but I have downloaded form there a million times before and never had a problem with downloading without logging in.
    Wait and see if Mysers will be able to download the dump to analyze it because I don't have access to the file at the moment sincr it's asking me to log in.
      My System SpecsSystem Spec

  4. #84


    Memphis
    Posts : 61
    Windows 8.1 x64


    Actually, try this link. It's a public file now. Maybe that it what the problem was...

    https://onedrive.live.com/redir?resi...634C038D%21106
      My System SpecsSystem Spec

  5. #85


    Posts : 2,480
    Windows 10 Pro x64


    Nope...
      My System SpecsSystem Spec

  6. #86


    Code:
    7: kd> .bugcheck
    Bugcheck code 000000C4
    Arguments 00000000`00000062 ffffe001`d93ca378 ffffe001`d93aa420 00000000`0000000a
    
    //A driver didn't free the allocations before unloading, creating a memory leak
    
    7: kd> dc ffffe001d93ca378
    ffffe001`d93ca378  0077006d 00630061 0073002e 00730079  m.w.a.c...s.y.s.
    ffffe001`d93ca388  00000000 00000000 0205000e 53646156  ............VadS
    ffffe001`d93ca398  00000000 00000000 00000000 00000000  ................
    ffffe001`d93ca3a8  00000000 00000000 d3949190 ffffe001  ................
    ffffe001`d93ca3b8  080f9830 080f98af 00000000 00000000  0...............
    ffffe001`d93ca3c8  00000000 00000000 00008020 0000000b  ........ .......
    ffffe001`d93ca3d8  00000000 00000000 02220005 63536343  ..........".CcSc
    ffffe001`d93ca3e8  00000300 00000000 020802ff 00000001  ................
    
    7: kd> kn
     # Child-SP          RetAddr           Call Site
    00 ffffd000`21a302c8 fffff802`24d0b6b0 nt!KeBugCheckEx //Bugcheck
    01 ffffd000`21a302d0 fffff802`24d0fc52 nt!VerifierBugCheckIfAppropriate+0x3c //If so, bugcheck
    02 ffffd000`21a30310 fffff802`2483e5f4 nt!VfPoolCheckForLeaks+0x4a //Check for any allocations remaining from deleted drivers
    03 ffffd000`21a30350 fffff802`24cfd064 nt!VfTargetDriversRemove+0x57644 //Remove driver(s)
    04 ffffd000`21a303e0 fffff802`24b66db2 nt!VfDriverUnloadImage+0x34 //Unload driver
    05 ffffd000`21a30410 fffff802`24b66d1c nt!MiUnloadSystemImage+0x7e //Memory internal unload function
    06 ffffd000`21a30490 fffff802`24b66c64 nt!MmUnloadSystemImage+0x20 //Unload the system image for driver
    07 ffffd000`21a304c0 fffff802`24a453b0 nt!IopDeleteDriver+0x40 //Delete driver
    08 ffffd000`21a30500 fffff802`246ddcbf nt!ObpRemoveObjectRoutine+0x64 //Remove object
    09 ffffd000`21a30560 fffff802`24b6d2f6 nt!ObfDereferenceObject+0x8f //Acquire information from object
    0a ffffd000`21a305a0 fffff802`247e22b3 nt!IopUnloadDriver+0x262 //Unload driver
    0b ffffd000`21a30780 fffff802`247da700 nt!KiSystemServiceCopyEnd+0x13 //Switch to Kernel mode
    0c ffffd000`21a30918 fffff802`24c2ebd1 nt!KiServiceLinkage //Switch to User mode
    0d ffffd000`21a30920 fffff802`247e22b3 nt!IopUnloadDriver+0x7a991 //Unload driver
    0e ffffd000`21a30b00 00007ffa`3a4e266a nt!KiSystemServiceCopyEnd+0x13 //Context switch to Kernel mode 
    0f 0000009f`8fdeea98 00007ff6`770a3954 ntdll!NtUnloadDriver+0xa //ntdll starting Kernel drivers
    10 0000009f`8fdeeaa0 00007ff6`770a382c services!ScUnloadDriver+0xb4
    11 0000009f`8fdeeae0 00007ff6`7708d50a services!ScControlDriver+0x11c
    12 0000009f`8fdeeb10 00007ff6`7706c1a0 services!ScControlService+0x2111a
    13 0000009f`8fdeebd0 00007ffa`3a102053 services!RControlService+0x50 //smss routines
    14 0000009f`8fdeec50 00007ffa`3a10c70d RPCRT4!Invoke+0x73
    15 0000009f`8fdeecb0 00007ffa`3a10d81a RPCRT4!NdrStubCall2+0x35e
    16 0000009f`8fdef320 00007ffa`3a1023c7 RPCRT4!NdrServerCall2+0x1a
    17 0000009f`8fdef350 00007ffa`3a102220 RPCRT4!DispatchToStubInCNoAvrf+0x33
    18 0000009f`8fdef3a0 00007ffa`3a102f9f RPCRT4!RPC_INTERFACE::DispatchToStubWorker+0x190 //Sending request to worker threads
    19 0000009f`8fdef4a0 00007ffa`3a102c86 RPCRT4!LRPC_SCALL::DispatchRequest+0x1fc
    1a 0000009f`8fdef5b0 00007ffa`3a102ad8 RPCRT4!LRPC_SCALL::HandleRequest+0x291
    1b 0000009f`8fdef660 00007ffa`3a1018bd RPCRT4!LRPC_SASSOCIATION::HandleRequest+0x238
    1c 0000009f`8fdef6f0 00007ffa`3a1016be RPCRT4!LRPC_ADDRESS::ProcessIO+0x444
    1d 0000009f`8fdef830 00007ffa`3a4858f0 RPCRT4!LrpcIoComplete+0x144 //Local Remote Procedure calls
    1e 0000009f`8fdef8d0 00007ffa`3a483c28 ntdll!TppAlpcpExecuteCallback+0x210 //ALPC functions, undocumented
    1f 0000009f`8fdef940 00007ffa`37e113d2 ntdll!TppWorkerThread+0x888 //Start worker threads
    20 0000009f`8fdefd20 00007ffa`3a4c03c4 KERNEL32!BaseThreadInitThunk+0x22 //Initiate Kernel thunk routine
    21 0000009f`8fdefd50 00000000`00000000 ntdll!RtlUserThreadStart+0x34 //Start user threads
    
    7: kd> !verifier 3 mwac.sys
    
    Verify Flags Level 0x0002892b
    
      STANDARD FLAGS:
        [X] (0x00000000) Automatic Checks
        [X] (0x00000001) Special pool
        [X] (0x00000002) Force IRQL checking
        [X] (0x00000008) Pool tracking
        [ ] (0x00000010) I/O verification
        [X] (0x00000020) Deadlock detection
        [ ] (0x00000080) DMA checking
        [X] (0x00000100) Security checks
        [X] (0x00000800) Miscellaneous checks
        [X] (0x00020000) DDI compliance checking
    
      ADDITIONAL FLAGS:
        [ ] (0x00000004) Randomized low resources simulation
        [ ] (0x00000200) Force pending I/O requests
        [ ] (0x00000400) IRP logging
        [ ] (0x00002000) Invariant MDL checking for stack
        [ ] (0x00004000) Invariant MDL checking for driver
        [X] (0x00008000) Power framework delay fuzzing
        [ ] (0x00040000) Systematic low resources simulation
        [ ] (0x00080000) DDI compliance checking (additional)
        [ ] (0x00200000) NDIS/WIFI verification
        [ ] (0x00800000) Kernel synchronization delay fuzzing
        [ ] (0x01000000) VM switch verification
    
        [X] Indicates flag is enabled
    
    
    Summary of All Verifier Statistics
    
      RaiseIrqls           0x347bed6
      AcquireSpinLocks     0x44e236e
      Synch Executions     0x1603f0e
      Trims                0x1f4e083
    
      Pool Allocations Attempted             0x312eb46
      Pool Allocations Succeeded             0x312eb46
      Pool Allocations Succeeded SpecialPool 0x312eb46
      Pool Allocations With NO TAG           0x24
      Pool Allocations Failed                0x0
    
      Current paged pool allocations         0x155b for 0013E838 bytes
      Peak paged pool allocations            0x1576 for 0023B044 bytes
      Current nonpaged pool allocations      0xe6d1 for 01557DA6 bytes
      Peak nonpaged pool allocations         0x1cb8d for 01F218B0 bytes
    
    Driver Verification List
    ------------------------
    
      MODULE: 0xffffe001d17f76f0 mwac.sys (Loaded)
    
        Pool Allocation Statistics: ( NonPagedPool / PagedPool )
    
          Current Pool Allocations: ( 0x0000000a / 0x00000000 )
          Current Pool Bytes:       ( 0x00000a00 / 0x00000000 )
          Peak Pool Allocations:    ( 0x000018dd / 0x00000000 )
          Peak Pool Bytes:          ( 0x00058a9c / 0x00000000 )
          Contiguous Memory Bytes:       0x00000000
          Peak Contiguous Memory Bytes:  0x00000000
    
        Pool Allocations:
    
          Address             Length      Tag   Caller Address    
          ------------------  ----------  ----  ------------------
          0xffffcf815bdd0f00  0x00000100  pppt  0xfffff800ae2b5b92  mwac
          0xffffcf815b49cf00  0x00000100  pppt  0xfffff800ae2b5b92  mwac
          0xffffcf8159438f00  0x00000100  pppt  0xfffff800ae2b5b92  mwac
          0xffffcf81581bef00  0x00000100  pppt  0xfffff800ae2b5b92  mwac
          0xffffcf81627c8f00  0x00000100  pppt  0xfffff800ae2b5b92  mwac
          0xffffcf8139902f00  0x00000100  pppt  0xfffff800ae2b5b92  mwac
          0xffffcf815f624f00  0x00000100  pppt  0xfffff800ae2b5b92  mwac
          0xffffcf813d1caf00  0x00000100  pppt  0xfffff800ae2b5b92  mwac
          0xffffcf815a940f00  0x00000100  pppt  0xfffff800ae2b5b92  mwac
          0xffffcf8138f96f00  0x00000100  pppt  0xfffff800ae2b5b92  mwac
    
        Contiguous allocations are not displayed with public symbols.
    
    //10 Malwarebytes leaked memory allocations
    
    7: kd> dt nt!_VF_SUSPECT_DRIVER_ENTRY ffffe001d17f76f0
       +0x000 Links            : _LIST_ENTRY [ 0xffffe001`d17f7690 - 0xffffe001`d17f7740 ]
       +0x010 Loads            : 1
       +0x014 Unloads          : 0
       +0x018 BaseName         : _UNICODE_STRING "mwac.sys"
    
    //Most likely the cause of the linked list corruption, caused by memory leaks
    
    7: kd> lmDvm mwac
    Browse full module list
    start             end                 module name
    fffff800`ae2ad000 fffff800`ae2c0000   mwac       (no symbols)           
        Loaded symbol image file: mwac.sys
        Image path: \??\C:\Windows\system32\drivers\mwac.sys
        Image name: mwac.sys
        Browse all global symbols  functions  data
        Timestamp:        Wed Jun 18 03:07:00 2014 (53A0F444)
        CheckSum:         00017634
        ImageSize:        00013000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    You could try updating Malwarebytes, the actual program is quite outdated.
    Nevertheless, it's clear malwarebytes is creating memory leaks.
    If the problems still persist after updating Malwarebytes, remove the program.
      My System SpecsSystem Spec

  7. #87


    Memphis
    Posts : 61
    Windows 8.1 x64


    Are you kidding me?? Malwarebytes is causing the issue? I'll just uninstall it. I had it installed before the reset, too. Very interesting... UGH!

    Thank you so very much, Mysers!
      My System SpecsSystem Spec

  8. #88


    Memphis
    Posts : 61
    Windows 8.1 x64


    Here's a new minidump file from 1/20. Any drivers look bad?
      My System SpecsSystem Spec

  9. #89


    Code:
    0: kd> .bugcheck
    Bugcheck code 0000000A
    Arguments 00000000`00005098 00000000`00000002 00000000`00000000 fffff801`3884ae98
    
    //Invalid memory was trying to be read
    
    0: kd> kn
     # Child-SP          RetAddr           Call Site
    00 ffffd001`f6ee26c8 fffff801`389735e9 nt!KeBugCheckEx //BSOD
    01 ffffd001`f6ee26d0 fffff801`38971e3a nt!KiBugCheckDispatch+0x69 //IRQL is 2, illegal operation, bugcheck
    02 ffffd001`f6ee2810 fffff801`3884ae98 nt!KiPageFault+0x23a //Not in memory, generate page fault
    03 ffffd001`f6ee29a0 fffff801`3884a712 nt!KiSearchForNewThread+0x258 //Find the new thread
    04 ffffd001`f6ee2a30 fffff801`3884a209 nt!KiSwapThread+0xd2 //Change thread 
    05 ffffd001`f6ee2ad0 fffff801`38894a4d nt!KiCommitThreadWait+0x129 //Place thread into wait state
    06 ffffd001`f6ee2b50 fffff801`38918440 nt!ExpWorkerThread+0x20d //Start worker thread
    07 ffffd001`f6ee2c00 fffff801`3896e0c6 nt!PspSystemThreadStartup+0x58 
    08 ffffd001`f6ee2c60 00000000`00000000 nt!KiStartSystemThread+0x16 //Initiate system thread
    
      STANDARD FLAGS:
        [X] (0x00000000) Automatic Checks
        [X] (0x00000001) Special pool
        [X] (0x00000002) Force IRQL checking
        [X] (0x00000008) Pool tracking
        [ ] (0x00000010) I/O verification
        [X] (0x00000020) Deadlock detection
        [ ] (0x00000080) DMA checking
        [X] (0x00000100) Security checks
        [X] (0x00000800) Miscellaneous checks
        [X] (0x00020000) DDI compliance checking
    
      ADDITIONAL FLAGS:
        [ ] (0x00000004) Randomized low resources simulation
        [ ] (0x00000200) Force pending I/O requests
        [ ] (0x00000400) IRP logging
        [ ] (0x00002000) Invariant MDL checking for stack
        [ ] (0x00004000) Invariant MDL checking for driver
        [X] (0x00008000) Power framework delay fuzzing
        [ ] (0x00040000) Systematic low resources simulation
        [ ] (0x00080000) DDI compliance checking (additional)
        [ ] (0x00200000) NDIS/WIFI verification
        [ ] (0x00800000) Kernel synchronization delay fuzzing
        [ ] (0x01000000) VM switch verification
    
        [X] Indicates flag is enabled
    
    //We already have the correct DV settings enabled to find such bugs, thus making it difficult to catch
    A minidump is very difficult to debug as it only contains limited information, specifically at the time of the crash. As a result we cannot see what the thread was and which process it belonged to.
    A full memory dump would be more beneficial, we should be able to trace back far enough to identify the culprit.
      My System SpecsSystem Spec

  10. #90


    Memphis
    Posts : 61
    Windows 8.1 x64


    Ok. I deactivated Driver Verifier last night, but I'll reactivate it again. I already have the settings updated to create a full crash dump file; however, I have to get a BSOD for that to happen. Lately, the PC isn't giving a BSOD (that I can tell), but is freezing or just restarting without error... Very strange.
      My System SpecsSystem Spec

Page 9 of 11 FirstFirst ... 7891011 LastLast
Multiple BSOD since receiving new computer - KMODE & IRQL
Related Threads
Excuse me for the bad thread title, I really couldn't figure out how to describe my problem since i've been getting BSOD's for the past week at least 7-8 times a day at an hour or two hour long intervals. They can occur at all times, sometimes right after booting up, sometimes while playing a...
Hey everyone, I am new to this forum, so please excuse me any layman propensities I might exhibit here. So, I am lucky (at least that was my initial thought) owner of a brand new Asus Zenbook UX32LA, 256 SSD GB, 8GB Ram netbook with win8/64bit OS. After cofiguring the computer I ve been...
Kmode bsod in BSOD Crashes and Debugging
hello , nothing much to explain because i dont rly know what can cause it . :confused:
Hello, i built my computer, and since i got several differents bsod. Never the same -KMODE EXCEPT -IRQL NOT LESS OR EQUAL -NTFS FILE SYSTEM and some other ...
BSOD and kmode exception not handled in BSOD Crashes and Debugging
I keep getting blue screen and this error "kmode exception not handled" at random times.Dont know what to do. Help
Kmode and driver irql help needed. in BSOD Crashes and Debugging
I have received these two BSOD'S. So far over the space of a day. I have memtest86 my ram, 12 passes no errors. Checked C: for errors. None found. SFC /SCANNOW has been completed with no problems Hard drive is bran spanking new as are most of my components except PSU which is a good...
Eight Forums Android App Eight Forums IOS App Follow us on Facebook