Windows 7 BSOD Win 7 64bit 3b and 1e

biggyk · Sep 27, 2010

OKay, I deleted usbfilter.sys from that path. What exactly are you asking me to uninstall? wmplayer? I use that alot.

EDIT:Well deleting that .sys file was a bad idea. Now I cant use my keyboard or mouse. I have to remote connect to get into it. I cannot get the mouse or keyboard to work at al. Im really screwed.Tried reinstalling he drivers and it wont work again. In device manager it all shows as uninstalled.

I did a system restore and it looks like my mouse and keyboard works again. Im going to reinstall the chipset drivers and usb3 driver.

TorrentG · Sep 27, 2010

In all fairness, and it actually makes the difference here, I said to delete it after uninstalling VM software(s).

This should fix it up:

Open the Windows registry, by clicking on Start > Run and typing regedit
Navigate to the following location HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}.
In the right hand panel, if the the UpperFilters entry exists, then delete it.
Go to the location HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\.
Delete the usbfilter string.
Delete this file: %system32%\drivers\usbfilter.sys.
Reboot your computer.

TorrentG · Sep 27, 2010

Cool. Just noticed your latest edit. Sounds good. Please post any new crash dumps if/as they happen and we'll take things from there.

Possibly, the USB 3.0 driver update may do wonders. We shall see.

biggyk · Sep 27, 2010

well i deleted those files, but havent restarted. Should I still go ahead or restore.

I went ahead and did a system restore again to undo any delete i did. Im resintalled the drivers and see how that goes. I will chime in again if I bluescreen down the road.

Just want to say thank you for all the time you have spent helping me out here, without you I would probably be screwed lol

TorrentG · Sep 27, 2010

Try a restart and be prepared to restore if necessary. If a restore is done, then install the AMD chipset and NEC 3.0 USB drivers.

Reboot after installing drivers.

If bsods happen, post them. And good luck.

biggyk · Oct 1, 2010

new bsod after a few days of none.

TorrentG · Oct 1, 2010

This is a rarer kind of crash. I'll simply post it so you can see it too. Because of the way it did crash, and the page file may be corrupt, most drivers can not even be seen.

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\Temp\Rar$DI00.506\100110-15319-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03006000 PsLoadedModuleList = 0xfffff800`03243e50
Debug session time: Fri Oct  1 02:49:05.170 2010 (UTC - 4:00)
System Uptime: 0 days 0:04:41.872
Loading Kernel Symbols
...................................................
Loading User Symbols
Loading unloaded module list
..Missing image name, possible paged-out or corrupt data.
....Missing image name, possible paged-out or corrupt data.
......Missing image name, possible paged-out or corrupt data.
.......Missing image name, possible paged-out or corrupt data.
...Missing image name, possible paged-out or corrupt data.
.Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.
.Missing image name, possible paged-out or corrupt data.
.
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!PoIdle+53a )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.

FAULTING_IP: 
+64ac2faf00b7de58
00000000`00000000 ??              ???

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

ERROR_CODE: (NTSTATUS) 0 - STATUS_WAIT_0

BUGCHECK_STR:  0x1E_0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000308424a to fffff880037cb7f2

STACK_TEXT:  
fffff800`04444c98 fffff800`0308424a : 00000000`002e7417 fffffa80`0542e598 fffff800`031fec40 00000000`00000001 : 0xfffff880`037cb7f2
fffff800`04444ca0 fffff800`0307eebc : fffff800`031f0e80 fffff800`00000000 00000000`00000000 fffff880`014fcc50 : nt!PoIdle+0x53a
fffff800`04444d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x2c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!PoIdle+53a
fffff800`0308424a 0fba25f61318000f bt      dword ptr [<Unloaded_Unknown_Module_00000000`00000043>+0x1813b3 (00000000`001813f6)],0Fh

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!PoIdle+53a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1E_0_nt!PoIdle+53a

BUCKET_ID:  X64_0x1E_0_nt!PoIdle+53a

Followup: MachineOwner
---------

0: kd> lmtn
start             end                 module name
00000000`31005800 00000000`80529b49   Unknown_Module_00000000_31005800 Unknown_Module_00000000`31005800 unavailable (00000000)
fffff800`00ba2000 fffff800`00bac000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff800`03006000 fffff800`035e2000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff800`035e2000 fffff800`0362b000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`00c00000 fffff880`00cc0000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`00cea000 fffff880`00cf7000   mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Mon Jul 13 21:29:09 2009 (4A5BDF65)
fffff880`00cf7000 fffff880`00d0b000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`00d0b000 fffff880`00d69000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00d69000 fffff880`00dc5000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`00dc5000 fffff880`00def000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`00e00000 fffff880`00e0b000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`00e23000 fffff880`00ec7000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00ec7000 fffff880`00ed6000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00ed6000 fffff880`00f2d000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`00f2d000 fffff880`00f36000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00f36000 fffff880`00f40000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`00f40000 fffff880`00f4d000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`00f4d000 fffff880`00f80000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00f80000 fffff880`00f95000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00f95000 fffff880`00f9e000   compbatt compbatt.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`00f9e000 fffff880`00faa000   BATTC    BATTC.SYS    Mon Jul 13 19:31:01 2009 (4A5BC3B5)
fffff880`00faa000 fffff880`00fbf000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00fbf000 fffff880`00fc6000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00fc6000 fffff880`00fd6000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`00fd6000 fffff880`00ff0000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00ff0000 fffff880`00ff9000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`01000000 fffff880`0104c000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`0104c000 fffff880`01069000   sbp2port sbp2port.sys Mon Jul 13 19:19:53 2009 (4A5BC119)
fffff880`01069000 fffff880`010a3000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`010bd000 fffff880`01109000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`01109000 fffff880`0111d000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`0111d000 fffff880`0117b000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`0117b000 fffff880`011ee000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`01200000 fffff880`0121a000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`0121a000 fffff880`0122b000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`0122b000 fffff880`01235000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`01246000 fffff880`013e9000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`01400000 fffff880`01460000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`01460000 fffff880`0148b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`0148b000 fffff880`014d5000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff880`014d5000 fffff880`014e5000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`014e5000 fffff880`014ed000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`014ed000 fffff880`014fa000   MDPMGRNT MDPMGRNT.SYS Wed Sep 23 15:23:04 2009 (4ABA7598)
fffff880`014fb000 fffff880`015ed000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`015ed000 fffff880`015ff000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`01603000 fffff880`01800000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`01886000 fffff880`018d9000   MDFSYSNT MDFSYSNT.sys Thu Feb 04 10:14:15 2010 (4B6AE447)
fffff880`018d9000 fffff880`018e2000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`018e2000 fffff880`0191c000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`0191c000 fffff880`01932000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`01932000 fffff880`01962000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`01962000 fffff880`0196a000   AtiPcie  AtiPcie.sys  Tue May 05 11:00:22 2009 (4A005486)

Unloaded modules:
33998f08`00000002 33998f08`5fffffff   Unknown_Module_33998f08`00000002
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  5FFFFFFD
00000000`00000043 00000001`0000001d   Unknown_Module_00000000`00000043
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FFFFFFDA
Missing image name, possible paged-out or corrupt data.
00000000`5fffffff 00000001`03c7a818   Unknown_Module_00000000`5fffffff
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  A3C7A819
00000000`03c7a7f4 00000001`00000009   Unknown_Module_00000000`03c7a7f4
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FC385815
00000000`00000001 00000001`00000000   Unknown_Module_00000000`00000001
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FFFFFFFF
28d58c9c`00000002 28d58c9c`5fffffff   Unknown_Module_28d58c9c`00000002
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  5FFFFFFD
Missing image name, possible paged-out or corrupt data.
00000000`5fffffff 00000001`03c7a7b6   Unknown_Module_00000000`5fffffff
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  A3C7A7B7
00000000`0000004e 00000001`00000002   Unknown_Module_00000000`0000004e
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FFFFFFB4
00000000`03c7a78a 00000001`0000000b   Unknown_Module_00000000`03c7a78a
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FC385881
00000000`00000002 00000000`00000039   Unknown_Module_00000000`00000002
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00000037
20c0fa08`00000002 20c0fa08`5fffffff   Unknown_Module_20c0fa08`00000002
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  5FFFFFFD
00000000`00000008 00000000`0000000e   Unknown_Module_00000000`00000008
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00000006
Missing image name, possible paged-out or corrupt data.
00000000`5fffffff 00000001`03c7a74a   Unknown_Module_00000000`5fffffff
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  A3C7A74B
00000000`03c7a724 00000001`00000007   Unknown_Module_00000000`03c7a724
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FC3858E3
00000000`00000003 00000000`00000038   Unknown_Module_00000000`00000003
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00000035
145ff744`00000002 145ff744`5fffffff   Unknown_Module_145ff744`00000002
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  5FFFFFFD
00000000`0000004b 00000001`00000011   Unknown_Module_00000000`0000004b
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FFFFFFC6
00000000`5fffffff 00000001`03c7a6e6   Unknown_Module_00000000`5fffffff
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  A3C7A6E7
00000000`0000001c 00000001`00000002   Unknown_Module_00000000`0000001c
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FFFFFFE6
Missing image name, possible paged-out or corrupt data.
00000000`03c7a6ba 00000001`00000008   Unknown_Module_00000000`03c7a6ba
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FC38594E
075cc809`00000002 075cc809`5fffffff   Unknown_Module_075cc809`00000002
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  5FFFFFFD
00000000`00000007 00000001`00000000   Unknown_Module_00000000`00000007
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FFFFFFF9
Missing image name, possible paged-out or corrupt data.
00000000`00000071 00000000`03c7a690   Unknown_Module_00000000`00000071
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  03C7A61F
Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.
00000000`040b7940 00000000`0445e760   Unknown_Module_00000000`040b7940
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  003A6E20
Missing image name, possible paged-out or corrupt data.
00000000`03c60017 00000001`022bc1f0   Unknown_Module_00000000`03c60017
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FE65C1D9

I would do the following...

Disable the page file completely. (Google if you don't know how.)

Reboot. Re-enable the page file. Reboot again.

Then run this command from an elevated command prompt, for the hdd partition you have the page file on. It will be on C: by default.

chkdsk /r

biggyk · Oct 1, 2010

okay il try it later on today. What exactly caused it?

Edit. On 5 of 5 in the disk check everything looking fine. When I was looking at the dump file it almost seems like it was my external that was the problem E: correct me if im wrong. When I restarted it says my external might be corrupt but I can still mount it and use it fine.

Its a mac format external btw. Have a macbook so its the easiest way to be able to use it on mac and pc. I plugged it into my mac, did a disk check and everything was fine. Plugged it back into my pc and no errors to show again.

biggyk · Oct 3, 2010

and yet another one, outta control

btw, how do I diable check disk everytime it boots?

TorrentG · Oct 4, 2010

This driver is the culprit now:

xusb21 xusb21.sys Fri Feb 16 21:43:15 2007

It's in C:\Windows\System32\drivers

Rename it to xusb21.BAK and reboot.

biggyk · Oct 4, 2010

okay il give it a shot. Btw when you told me to do the disk check in command prompt it now trying to check everything single time I boot up. Is there a way to disable that?

TorrentG · Oct 4, 2010

That means it's not completing well at all...which also means the hard drive is likely messed up.

You can try to boot to safe mode to run the command and let it do its thing to completion.

If the issue persists, the flag is not being reset from a successful run. In this case, recommend a new hard drive.

biggyk · Oct 4, 2010

well that sucks lol, this hard drive is brand new. and it seems to be working fine. If I run in safe mode will it make me restart?

what does changing that .sys file to BAK do?

TorrentG · Oct 4, 2010

Yep...see this from your crash dump before:

Code:

..Missing image name, possible paged-out or corrupt data. ....Missing image name, possible paged-out or corrupt data. ......Missing image name, possible paged-out or corrupt data. .......Missing image name, possible paged-out or corrupt data. ...Missing image name, possible paged-out or corrupt data. .Missing image name, possible paged-out or corrupt data. Missing image name, possible paged-out or corrupt data. .Missing image name, possible paged-out or corrupt data.

That's very rare to see anything like that...the hard drive with the page file was/is still messed up...especially if checkdisk is stuck in the loop like that.

Renaming the driver will disable it from loading with Windows, keep it from loading into memory, and disable it's ability to cause bsods.

Running the command from safe mode might help it complete well, but still unlikely if it has not done so before.

biggyk · Oct 4, 2010

seems to be having trouble boot into safe mode. It hangs loading the drivers when it gets atipcie.sys

TorrentG · Oct 4, 2010

Yeah, that's indicative of RAM or hdd issue.

biggyk · Oct 4, 2010

well i did run memtest a few days ago and seemed fine. Il try running the diskcheck one more, is there a way to stop it from checking when it boots if it dont work

TorrentG · Oct 4, 2010

In Regedit - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

For SFCScan, set it to 0. This will not fix the underlying problem at all though.

Or run this command:

CHKNTFS /x

biggyk · Oct 4, 2010

yes i know. Im going to run it one more time and see how that work. the computer is running fine atm. So I dont want format or buy a new drive if i able to do my thing in the meantime.

biggyk · Oct 4, 2010

well it did a 3 stages of dskcheck, completed, restarted and it didnt show up again while booting. So I am going to assume that its fine.

Windows 7 BSOD Win 7 64bit 3b and 1e

Well-Known Member

Banned

Banned

Well-Known Member

Banned

Well-Known Member

Attachments

Banned

Well-Known Member

Well-Known Member

Attachments

Banned

Well-Known Member

Banned

Well-Known Member

Banned

Well-Known Member

Banned

Well-Known Member

Banned

Well-Known Member

Well-Known Member

Similar threads