Solved lots of BSOD Errors, often ntoskrnl.exe+153fa0

Chrstn · Apr 1, 2015

Hey

the bsod happens usually when saving or closing a file in MS word.
Less bsod after installing Update KB2887595 on 24/03, but still too much :think:

Do you have any ideas for fixing the errors? Thanks a million..

The requested .zip: View attachment 59907

blueelvis · Apr 6, 2015

Hi Chrstn & Welcome to the forums ^_^,

I am extremely sorry for the delayed response

. I have been very busy with university and other analysts are busy as well with life. Do you still need help with this problem? If yes, kindly respond to this topic and I will be notified via email and I would reply within 48 hours.

-Pranav

Chrstn · Apr 8, 2015

Hi Pranav,

thanks for your response. unfortunately the problem isn't solved yet :-/
Your help would be great!

Christina

blueelvis · Apr 9, 2015

Hi Christina ^_^,

I have analysed your dump files and below has been provided an analysis of the same for informative purposes :-

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem.

Sadly, the exception record does not point to anything

. Below is the stack -

Code:

1: kd> kb
RetAddr           : Args to Child                                                           : Call Site
fffff801`7982511f : 00000000`0000001e ffffffff`c0000005 fffff801`79a4ce22 00000000`00000000 : nt!KeBugCheckEx
fffff801`797e95c2 :[COLOR=#FF0000][U][B] ffffe001`fc7ff080 [/B][/U][/COLOR]ffffd000`3fd717c0 00000000`00000000 fffff801`796f7897 : ntKiDispatchException!+0x3726f
fffff801`797e7d14 : 00000000`00000000 ffffffff`ffffffff 00000000`00000000 00000000`6f706d55 : nt!KiExceptionDispatch+0xc2
fffff801`79a4ce22 : 00000000`00000000 ffffd000`3fd71b90 fffff801`3b479820 ffffe001`f56c1440 : nt!KiPageFault+0x214
fffff801`79718736 : 00000000`00000000 00000000`00000000 00000000`00000001 ffffd000`38901d18 : nt!FsRtlAcquireFileForCcFlushEx+0x246
fffff801`796c559e : ffffd000`38901d00 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmFlushSection+0x17a
fffff801`7978d7b1 : ffffe001`f156a5b8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!CcFlushCachePriv+0x616
fffff801`3c17d7c2 : ffffe001`f5e68a01 ffffe001`00000007 ffffe001`f78e0d40 ffffe001`f576f800 : nt!CcFlushCache+0x11
fffff801`797e12f7 : ffffd000`3fd71fd0 ffffe001`fddf5a01 ffffe001`fc7ff080 ffffd000`3f58cba0 : rdbss!RxpFlushFcbInSystemCacheCallout+0x4a
fffff801`797e12bd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x27
00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue

The first argument (The value highlighted in RED) is a pointer to a data structure which contains pointers to an except statement. Let's dump the pointer value -

Code:

1: kd> dd [U][COLOR=#FF0000][B]ffffe001`fc7ff080[/B][/COLOR][/U] L2
[COLOR=#0000FF][B]ffffe001`fc7ff080 [/B][/COLOR] [B][COLOR=#008000]00000006`00000000
[/COLOR][/B]

The first value highlighted in BLUE contains the exception record whereas the second value in GREEN contains the address to the context record. Sadly, we need the value in GREEN but the minidump has not saved the information :'(
On taking a look at the stack, it seems that the process was dealing with private cache and flushing it. One thing which I found in the dump files that the process which was running while the crash occurred is the Mcafee Antivirus -

Code:

PROCESS_NAME:  mcshield.exe

Below, is a list of drivers present on your system -

Code:

**************************Wed Apr  1 18:04:53.404 2015 (UTC + 5:30)**************************
btath_lwflt.sys             Fri Nov  2 11:05:44 2012 (50935BB0)
btath_hcrp.sys              Tue Dec 18 15:24:54 2012 (50D03D6E)
btath_bus.sys               Mon Jan 21 14:48:42 2013 (50FD07F2)
ElbyCDIO.sys                Mon Mar  4 14:51:51 2013 (513467AF)
btath_rcp.sys               Fri Jun 21 14:41:54 2013 (51C418DA)
VClone.sys                  Wed Jul 24 20:32:55 2013 (51EFEC9F)
Rt630x64.sys                Thu Aug 15 11:53:59 2013 (520C73FF)
intelppm.sys                Thu Aug 22 14:16:35 2013 (5215CFEB)
btath_flt.sys               Fri Aug 23 09:16:29 2013 (5216DB15)
TeeDriverx64.sys            Thu Sep  5 23:32:18 2013 (5228C72A)
AcpiVpc.sys                 Wed Sep 25 07:59:03 2013 (52424A6F)
RtsPer.sys                  Fri Oct 18 11:39:07 2013 (5260D083)
athwbx.sys                  Wed Nov 13 13:35:17 2013 (528332BD)
mfehidk.sys                 Fri Nov 15 18:48:23 2013 (52861F1F)
mfewfpk.sys                 Fri Nov 15 18:48:38 2013 (52861F2E)
mfeapfk.sys                 Fri Nov 15 18:49:06 2013 (52861F4A)
mfeavfk.sys                 Fri Nov 15 18:49:27 2013 (52861F5F)
mfefirek.sys                Fri Nov 15 18:51:19 2013 (52861FCF)
btath_avdt.sys              Fri Nov 22 12:45:28 2013 (528F0490)
btath_a2dp.sys              Fri Nov 22 12:47:31 2013 (528F050B)
mfencbdc.sys                Wed Nov 27 11:34:06 2013 (52958B56)
SFWCallout.sys              Fri Nov 29 22:40:32 2013 (5298CA88)
btfilter.sys                Fri Dec 20 13:12:05 2013 (52B3F4CD)
nvvad64v.sys                Fri Dec 27 22:11:28 2013 (52BDADB8)
rtsuvc.sys                  Tue Jan 21 14:42:34 2014 (52DE3A02)
nvlddmkm.sys                Fri Jan 24 10:37:30 2014 (52E1F512)
savonaccess.sys             Tue Feb 18 21:32:49 2014 (53038429)
SynTP.sys                   Sat Mar  8 01:48:04 2014 (531A297C)
Smb_driver_Intel.sys        Sat Mar  8 01:52:54 2014 (531A2A9E)
RTKVHD64.sys                Tue Mar 11 18:26:41 2014 (531F0809)
iwdbus.sys                  Fri Mar 14 03:29:14 2014 (53222A32)
iaStorA.sys                 Fri Mar 14 05:22:06 2014 (532244A6)
igdkmd64.sys                Mon Mar 31 10:48:10 2014 (5338FA92)
swi_callout.sys             Mon Jan 19 19:06:53 2015 (54BD0875)

Chrstn · Apr 13, 2015

Hey Pranav,

Never thought this could be the problem. After removing mcaffe I had no further BSOD :party:

- knock on wood!
Thank you so much!

Best wishes
Christina

blueelvis · Apr 13, 2015

Hi Christina ^_^,

Glad to hear that your problem has been solved. If you face any further problems, please do not hesitate to post back ^_^

-Pranav

Solved lots of BSOD Errors, often ntoskrnl.exe+153fa0

Chrstn

New Member

My Computer

System One

blueelvis

OMG Debugger!

My Computer

System One

Chrstn

New Member

My Computer

System One

blueelvis

OMG Debugger!

My Computer

System One

Chrstn

New Member

My Computer

System One

blueelvis

OMG Debugger!

My Computer

System One