Windows 7 SYSTEM_SERVICE_EXCEPTION caused by ntoskrnl.exe - System is boot looping

[Oneill5491]

[SOLVED!] SYSTEM_SERVICE_EXCEPTION caused by ntoskrnl.exe - System is boot looping

Hey BSOD wizards,

I have a Windows Home Server 2011 system that just recently started BSOD boot looping as a result of something relating to the kernel (ntoskrnl.exe) which sucks because I know that kernel BSODs are pretty generic.

I know that this isn't a Windows 7 machine, but I'm pretty sure we can treat it all the same since the engine/kernel is the same.

I have made no changes to the system's hardware or drivers. The only thing I recently reconfigured is the native server backup function built into the WHS 2011 software which involved formatting a dedicated backup drive in the system and rerunning the backup. It ran successfully, however, which makes me wonder how it could be a possible culprit.

After reaching the login prompt, the system BSODs and reboots about 90 seconds later regardless of whether I login or have it idle on the login prompt. I am, however, able to boot into Safe Mode or Safe Mode with Networking without having it crash. I have already ran chkdsk (which found nothing) and I also ran an SFC scan which did find some corrupted files but it did not remedy my problem.

I'm pretty certain this is a software issue since it's replicatable with consistency.

Attached are most of the requested goods for analysis. Look forward to everyone's input.

Thanks in advance.

 

[usasma]

If you can boot into Safe Mode, but not normal mode - then this is most likely a 3rd party driver issue.

Only 995 mB of free RAM - I'd suggest that you increase your RAM or decrease the number of programs that are running.

I have no idea about the update status of Server systems. Please ensure that you visit Windows Update and get ALL available updates.

There are issues with these 2 devices:

Security Processor Loader Driver ROOT\LEGACY_SPLDR\0000 This device is not present, is not working properly, or does not have all its drivers installed.
TOSHIBA DVD-ROM SD-R5112 ATA Device IDE\CDROMTOSHIBA_DVD-ROM_SD-R5112________________1033____\6&98865CC&0&0.0.0 This device is disabled.

Is the DVD drive deliberately disabled? If so, why?
As for the Security Processor Loader Driver - we frequently see this in relation to the damage caused by a malware program. Please run several of these free scans to ensure that your system is clean: Link Removed
If still infected, please seek assistance from a malware removal expert.

Interestingly, there's a lot of mention of the PDFsFilter.sys driver in the raw stack text.
This most likely belongs to Raxco Software's PerfectDisk OptiWrite Filter Driver.
While this is not necessarily the problem, it's worthwhile removing it to see if it is. Please un-install it and test for further BSOD's

Please update these older drivers. Links are included to assist in looking up the source of the drivers. If unable to find an update, please remove (un-install) the program responsible for that driver. DO NOT manually delete/rename the driver as it may make the system unbootable! :

osaio.sys Wed Feb 14 04:20:09 2007 (45D2D449)
OSA I/O Port Driver from Avocent/OSA Technologies (likely a component of an Intel desktop utility)
Link Removed

HECIx64.sys Fri May 11 22:00:20 2007 (46451FB4)
Intel Management Engine Interface
Link Removed

e1e6032e.sys Tue Mar 24 14:17:23 2009 (49C923B3)
Intel 82562V-2 10/100 Network Connection Ethernet driver
Link Removed

If all of this doesn't stop the BSOD's, please run Driver Verifier according to these instructions (if able to get into Normal mode): Link Removed


If unable to get into Normal mode, then we'll have to try the disabling stuff at startup to find out what's causing the BSOD's. Similar to doing a Clean Boot - but doing it in steps to see what's causing the problem.



Analysis:
The following is for informational purposes only.

[FONT=lucida console]**************************Mon Feb  4 00:42:40.125 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\Owner\SysnativeBSODApps\020313-55953-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Built by: [B]7601[/B].17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime:[B]0 days 0:02:24.890[/B]
Probably caused by :[B]ntkrnlmp.exe ( nt!RtlEnumerateGenericTableWithoutSplayingAvl+7 )[/B]
BugCheck [B]3B, {c0000005, fffff80001ea8867, fffff8800799fd30, 0}[/B]
BugCheck Info: [B]Link Removed[/B]
Arguments: 
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80001ea8867, Address of the instruction which caused the bugcheck
Arg3: fffff8800799fd30, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
BUGCHECK_STR:  0x3B
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT_SERVER
PROCESS_NAME:  PDEngine.exe
FAILURE_BUCKET_ID: [B]X64_0x3B_nt!RtlEnumerateGenericTableWithoutSplayingAvl+7[/B]
CPUID:        "Intel(R) Pentium(R) Dual  CPU  E2180  @ 2.00GHz"
MaxSpeed:     2000
CurrentSpeed: [B]2000[/B]
  BIOS Version                  DPP3510J.86A.0572.2009.0715.2346
  BIOS Release Date             07/15/2009
  Manufacturer                                                  
  Product Name                                                  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Mon Feb  4 00:15:19.718 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\Owner\SysnativeBSODApps\020313-53468-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Built by: [B]7601[/B].17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime:[B]0 days 0:02:35.500[/B]
Probably caused by :[B]ntkrnlmp.exe ( nt!RtlEnumerateGenericTableWithoutSplayingAvl+7 )[/B]
BugCheck [B]3B, {c0000005, fffff80001e6a867, fffff88008296d30, 0}[/B]
BugCheck Info: [B]Link Removed[/B]
Arguments: 
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80001e6a867, Address of the instruction which caused the bugcheck
Arg3: fffff88008296d30, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
BUGCHECK_STR:  0x3B
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT_SERVER
PROCESS_NAME:  PDEngine.exe
FAILURE_BUCKET_ID: [B]X64_0x3B_nt!RtlEnumerateGenericTableWithoutSplayingAvl+7[/B]
CPUID:        "Intel(R) Pentium(R) Dual  CPU  E2180  @ 2.00GHz"
MaxSpeed:     2000
CurrentSpeed: [B]2000[/B]
  BIOS Version                  DPP3510J.86A.0572.2009.0715.2346
  BIOS Release Date             07/15/2009
  Manufacturer                                                  
  Product Name                                                  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Feb  3 23:52:14.796 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\Owner\SysnativeBSODApps\020313-54015-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Built by: [B]7601[/B].17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime:[B]0 days 0:02:45.578[/B]
Probably caused by :[B]ntkrnlmp.exe ( nt!RtlEnumerateGenericTableWithoutSplayingAvl+7 )[/B]
BugCheck [B]3B, {c0000005, fffff800018a7867, fffff880083f2d30, 0}[/B]
BugCheck Info: [B]Link Removed[/B]
Arguments: 
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800018a7867, Address of the instruction which caused the bugcheck
Arg3: fffff880083f2d30, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
BUGCHECK_STR:  0x3B
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT_SERVER
PROCESS_NAME:  PDEngine.exe
FAILURE_BUCKET_ID: [B]X64_0x3B_nt!RtlEnumerateGenericTableWithoutSplayingAvl+7[/B]
CPUID:        "Intel(R) Pentium(R) Dual  CPU  E2180  @ 2.00GHz"
MaxSpeed:     2000
CurrentSpeed: [B]2000[/B]
  BIOS Version                  DPP3510J.86A.0572.2009.0715.2346
  BIOS Release Date             07/15/2009
  Manufacturer                                                  
  Product Name                                                  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Feb  3 23:38:18.078 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\Owner\SysnativeBSODApps\020313-48953-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Built by: [B]7601[/B].17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime:[B]0 days 0:02:36.859[/B]
Probably caused by :[B]ntkrnlmp.exe ( nt!RtlEnumerateGenericTableWithoutSplayingAvl+7 )[/B]
BugCheck [B]3B, {c0000005, fffff800018a7867, fffff880076f2d30, 0}[/B]
BugCheck Info: [B]Link Removed[/B]
Arguments: 
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800018a7867, Address of the instruction which caused the bugcheck
Arg3: fffff880076f2d30, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
BUGCHECK_STR:  0x3B
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT_SERVER
PROCESS_NAME:  PDEngine.exe
FAILURE_BUCKET_ID: [B]X64_0x3B_nt!RtlEnumerateGenericTableWithoutSplayingAvl+7[/B]
CPUID:        "Intel(R) Pentium(R) Dual  CPU  E2180  @ 2.00GHz"
MaxSpeed:     2000
CurrentSpeed: [B]2000[/B]
  BIOS Version                  DPP3510J.86A.0572.2009.0715.2346
  BIOS Release Date             07/15/2009
  Manufacturer                                                  
  Product Name                                                  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Feb  3 23:30:35.046 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\Owner\SysnativeBSODApps\020313-64031-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Built by: [B]7601[/B].17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime:[B]0 days 0:02:11.828[/B]
Probably caused by :[B]ntkrnlmp.exe ( nt!RtlEnumerateGenericTableWithoutSplayingAvl+7 )[/B]
BugCheck [B]3B, {c0000005, fffff80001858867, fffff88007bccd30, 0}[/B]
BugCheck Info: [B]Link Removed[/B]
Arguments: 
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80001858867, Address of the instruction which caused the bugcheck
Arg3: fffff88007bccd30, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
BUGCHECK_STR:  0x3B
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT_SERVER
PROCESS_NAME:  PDEngine.exe
FAILURE_BUCKET_ID: [B]X64_0x3B_nt!RtlEnumerateGenericTableWithoutSplayingAvl+7[/B]
CPUID:        "Intel(R) Pentium(R) Dual  CPU  E2180  @ 2.00GHz"
MaxSpeed:     2000
CurrentSpeed: [B]2000[/B]
  BIOS Version                  DPP3510J.86A.0572.2009.0715.2346
  BIOS Release Date             07/15/2009
  Manufacturer                                                  
  Product Name                                                  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Feb  3 23:15:24.000 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\Owner\SysnativeBSODApps\020313-49875-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Built by: [B]7601[/B].17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime:[B]0 days 0:02:09.781[/B]
Probably caused by :[B]ntkrnlmp.exe ( nt!RtlEnumerateGenericTableWithoutSplayingAvl+7 )[/B]
BugCheck [B]3B, {c0000005, fffff80001862867, fffff8800777bd30, 0}[/B]
BugCheck Info: [B]Link Removed[/B]
Arguments: 
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80001862867, Address of the instruction which caused the bugcheck
Arg3: fffff8800777bd30, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
BUGCHECK_STR:  0x3B
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT_SERVER
PROCESS_NAME:  PDEngine.exe
FAILURE_BUCKET_ID: [B]X64_0x3B_nt!RtlEnumerateGenericTableWithoutSplayingAvl+7[/B]
CPUID:        "Intel(R) Pentium(R) Dual  CPU  E2180  @ 2.00GHz"
MaxSpeed:     2000
CurrentSpeed: [B]2000[/B]
  BIOS Version                  DPP3510J.86A.0572.2009.0715.2346
  BIOS Release Date             07/15/2009
  Manufacturer                                                  
  Product Name                                                  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/FONT]

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.

[FONT=lucida console]**************************Mon Feb  4 00:42:40.125 2013 (UTC - 5:00)**************************
[B]osaio.sys                   Wed Feb 14 04:20:09 2007 (45D2D449)[/B]
[B]HECIx64.sys                 Fri May 11 22:00:20 2007 (46451FB4)[/B]
[B]e1e6032e.sys                Tue Mar 24 14:17:23 2009 (49C923B3)[/B]
intelppm.sys                Mon Jul 13 19:19:25 2009 (4A5BC0FD)
atikmdag.sys                Thu Feb 11 00:47:46 2010 (4B739A02)
amdxata.sys                 Fri Mar 19 12:18:18 2010 (4BA3A3CA)
iaStorV.sys                 Thu Jun 10 20:46:19 2010 (4C11875B)
rr62x.sys                   Mon Jun 14 20:46:51 2010 (4C16CD7B)
NuidFltr.sys                Fri Apr  8 18:58:16 2011 (4D9F9308)
DefragFS.SYS                Thu Aug  4 12:35:45 2011 (4E3ACA61)
PDFsFilter.sys              Wed Sep  7 14:47:52 2011 (4E67BC58)
[/FONT]

Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
rr62x.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
Link Removed
Link Removed
Link Removed

 

[Oneill5491]

Hey John,

You're a life saver man! You just saved many hours of work of having to overhaul my system! (I'm sure you get that a lot =)

You really piqued my attention when you mentioned the Raxco Perfect Disk services since the last modification I performed on the server was disk related. I disabled the PDAgent.exe service from starting up and voila! No more BSODs!

Thank you, thank you, thank you! You're a valuable asset to the Windows community!

Best regards,
-Oneill5491

 

[usasma]

I'm glad that you fixed it. Thanks for letting us know!