Link to home
Start Free TrialLog in
Avatar of Vodkasoda
VodkasodaFlag for Ireland

asked on

Vista - BSOD - Which Driver is the problem this time ?!?

I've upgraded my Desktop from XP to Vista after being happy with Vista Home Premium on my Laptop.

It was working OK at first, but after updating some drivers as advised by DriverAgent (which I have found to be extremely reliable in the past), I am getting the infamous BSOD at random, but annoyingly too frequent, intervals. Funnily enough, I don't believe it happened immediately, the PC seemed to run OK for a day or two before the first crash, but now it's laughing at me !!!

I have had similar problems enough times over the years to know that it is probably a single driver causing these problems, but I would have thought that after all this time Microsoft might have improved their error messaging system and debugging software enough so that the average poor bugger that gets hit with this crap might have a slight inkling as to which driver is the problem !!!

Below is some PC info & the latest dump info from WinDbg. If somebody could help thwn I will be eternally grateful !!!

Windows Version:  Windows Vista (6.0.6000) Home Premium
License Information:  Gary
Product ID:  xxxxxxxxxxxxxxxxxxxxxxx
Product Key:  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
System Name:  To Be Filled By O.E.M.
Processor Name:  AMD Athlon(tm) 64 Processor 3000+
Videocard Name:  ATI Radeon HD 2600 XT AGP
Installed Memory:  2,046.69 MB
Default Printer:  Canon Inkjet i865
Number of Installed Programs:  58 programs
Number of Running Processes:  82 processes
Internet Explorer Version:  7.0.6000.16609 (0)
DirectX Version:  4.09.00.0904
Office Version:  11.0.8173.0


Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini030908-05.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows Vista Kernel Version 6000 UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x81800000 PsLoadedModuleList = 0x81911e10
Debug session time: Sun Mar  9 21:17:00.294 2008 (GMT+0)
System Uptime: 0 days 0:23:22.158
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
.................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
Unable to load image \SystemRoot\system32\DRIVERS\USBPORT.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for USBPORT.SYS
*** ERROR: Module load completed but symbols could not be loaded for USBPORT.SYS
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck FE, {5, 8726d0e0, 10330035, 85c83d5c}

*** WARNING: Unable to verify timestamp for usbohci.sys
*** ERROR: Module load completed but symbols could not be loaded for usbohci.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Probably caused by : usbohci.sys ( usbohci+2742 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BUGCODE_USB_DRIVER (fe)
USB Driver bugcheck, first parameter is USB bugcheck code.
Arguments:
Arg1: 00000005, USBBUGCODE_INVALID_PHYSICAL_ADDRESS The host controller is
      using a physical memory address that was not allocated by
      the USBport driver.
Arg2: 8726d0e0, Device extension pointer of the host controller
Arg3: 10330035, PCI Vendor,Product id for the controller
Arg4: 85c83d5c, Pointer to Endpoint data structure

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************

MODULE_NAME: usbohci

FAULTING_MODULE: 81800000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  46d76cbf

CUSTOMER_CRASH_COUNT:  5

DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

BUGCHECK_STR:  0xFE

LAST_CONTROL_TRANSFER:  from 8ae2c52f to 818d8681

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
818f1b8c 8ae2c52f 000000fe 00000005 8726d0e0 nt+0xd8681
818f1bb0 8ae0f8d2 8726d028 00003000 87699000 USBPORT+0x2952f
818f1be4 8be6e742 fffffff0 5650706d 85c83d5c USBPORT+0xc8d2
818f1c10 8be6fc1e 8726e15c 85c83d5c 00000000 usbohci+0x2742
818f1c24 8ae0d8ca 8726e15c 85c83d5c 81891f34 usbohci+0x3c1e
818f1c40 8ae06f61 8726d0e0 85c83b02 81891f34 USBPORT+0xa8ca
818f1c68 8ae0d6d4 38496573 00000004 0000000e USBPORT+0x3f61
818f1c88 8ae05b82 8726d028 85c83ba8 0000000e USBPORT+0xa6d4
818f1cc0 8ae055b9 8726d028 8726d878 8726d002 USBPORT+0x2b82
818f1ce8 818a93ae 8726d884 34776478 00000000 USBPORT+0x25b9
818f1d50 818913ee 00000000 0000000e 00000000 nt+0xa93ae
818f8740 00000000 818f8748 818f8748 818f8750 nt+0x913ee


STACK_COMMAND:  kb

FOLLOWUP_IP:
usbohci+2742
8be6e742 ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  usbohci+2742

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  usbohci.sys

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

kd> lmvm usbohci
start    end        module name
8be6c000 8be76000   usbohci  T (no symbols)          
    Loaded symbol image file: usbohci.sys
    Image path: \SystemRoot\system32\DRIVERS\usbohci.sys
    Image name: usbohci.sys
    Timestamp:        Fri Aug 31 02:19:59 2007 (46D76CBF)
    CheckSum:         0000B683
    ImageSize:        0000A000
    Translations:     0000.04b0 0000.04e0 0409.04b0 0409.04e0
kd> lmvm nt
start    end        module name
81800000 81ba1000   nt       T (no symbols)          
    Loaded symbol image file: ntkrnlpa.exe
    Image path: \SystemRoot\system32\ntkrnlpa.exe
    Image name: ntkrnlpa.exe
    Timestamp:        Wed Oct 24 02:45:00 2007 (471EA39C)
    CheckSum:         00363BFB
    ImageSize:        003A1000
    Translations:     0000.04b0 0000.04e0 0409.04b0 0409.04e0



Avatar of nobus
nobus
Flag of Belgium image

did you set the proper symbol path ?
Once youve installed 6.7.5.1 (or later) of the debugging tools, run the Windbg application.  Go to FILE - SymbolSearchPath and key in:  (or copy)
SRV*c:\debug*http://msdl.microsoft.com/download/symbols
and then quit the application.  
When prompted to save, say yes, and click Dont Ask Again.  
Avatar of Vodkasoda

ASKER

nobus : No, I did nothing but install the Debug tool & open a crash dump. I didn't find anywhere on the net that told me to do more than that !!! Have done that now & rerun WinDbg on the same Crash Dump File.

It isn't full of error messages this time, thanks !!!

I clicked on the line that says "Use !analyze -v to get detailed debugging information." & within there I clicked on the "MODULE_NAME: usbohci" hyperlink within the area that was expanded. Below is the information I was given ... BTW, I can't see any personal information that I needed to blank out this time, please let me know ASAP if I've missed something !!!


Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini030908-05.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\debug*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x81800000 PsLoadedModuleList = 0x81911e10
Debug session time: Sun Mar  9 21:17:00.294 2008 (GMT+0)
System Uptime: 0 days 0:23:22.158
Loading Kernel Symbols
.................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck FE, {5, 8726d0e0, 10330035, 85c83d5c}



Probably caused by : usbohci.sys ( usbohci!OHCI_PollAsyncEndpoint+5e )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BUGCODE_USB_DRIVER (fe)
USB Driver bugcheck, first parameter is USB bugcheck code.
Arguments:
Arg1: 00000005, USBBUGCODE_INVALID_PHYSICAL_ADDRESS The host controller is
      using a physical memory address that was not allocated by
      the USBport driver.
Arg2: 8726d0e0, Device extension pointer of the host controller
Arg3: 10330035, PCI Vendor,Product id for the controller
Arg4: 85c83d5c, Pointer to Endpoint data structure

Debugging Details:
------------------




CUSTOMER_CRASH_COUNT:  5

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0xFE

PROCESS_NAME:  Idle

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 8ae2c52f to 818d8681

STACK_TEXT:  
818f1b8c 8ae2c52f 000000fe 00000005 8726d0e0 nt!KeBugCheckEx+0x1e
818f1bb0 8ae0f8d2 8726d028 00003000 87699000 USBPORT!USBPORT_BugCheck+0x3b
818f1be4 8be6e742 fffffff0 5650706d 85c83d5c USBPORT!USBPORTSVC_MapHwPhysicalToVirtual+0x169
818f1c10 8be6fc1e 8726e15c 85c83d5c 00000000 usbohci!OHCI_PollAsyncEndpoint+0x5e
818f1c24 8ae0d8ca 8726e15c 85c83d5c 81891f34 usbohci!OHCI_PollEndpoint+0x20
818f1c40 8ae06f61 8726d0e0 85c83b02 81891f34 USBPORT!MPf_PollEndpoint+0x89
818f1c68 8ae0d6d4 38496573 00000004 0000000e USBPORT!USBPORT_iSetGlobalEndpointStateTx+0x156
818f1c88 8ae05b82 8726d028 85c83ba8 0000000e USBPORT!USBPORT_iSetGlobalEndpointState+0x18
818f1cc0 8ae055b9 8726d028 8726d878 8726d002 USBPORT!USBPORT_Core_UsbHcIntDpc_Worker+0x285
818f1ce8 818a93ae 8726d884 34776478 00000000 USBPORT!USBPORT_Xdpc_Worker+0x273
818f1d50 818913ee 00000000 0000000e 00000000 nt!KiRetireDpcList+0x147
818f1d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x46


STACK_COMMAND:  kb

FOLLOWUP_IP:
usbohci!OHCI_PollAsyncEndpoint+5e
8be6e742 ff7038          push    dword ptr [eax+38h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  usbohci!OHCI_PollAsyncEndpoint+5e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: usbohci

IMAGE_NAME:  usbohci.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  46d76cbf

FAILURE_BUCKET_ID:  0xFE_usbohci!OHCI_PollAsyncEndpoint+5e

BUCKET_ID:  0xFE_usbohci!OHCI_PollAsyncEndpoint+5e

Followup: MachineOwner
---------

kd> lmvm usbohci
start    end        module name
8be6c000 8be76000   usbohci    (pdb symbols)          c:\debug\usbohci.pdb\60CDFFB049874E6DB23D37B426421B141\usbohci.pdb
    Loaded symbol image file: usbohci.sys
    Mapped memory image file: c:\debug\usbohci.sys\46D76CBFa000\usbohci.sys
    Image path: \SystemRoot\system32\DRIVERS\usbohci.sys
    Image name: usbohci.sys
    Timestamp:        Fri Aug 31 02:19:59 2007 (46D76CBF)
    CheckSum:         0000B683
    ImageSize:        0000A000
    File version:     6.0.6000.16553
    Product version:  6.0.6000.16553
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     USBOHCI.sys
    OriginalFilename: USBOHCI.sys
    ProductVersion:   6.0.6000.16553
    FileVersion:      6.0.6000.16553 (vista_gdr.070830-1500)
    FileDescription:  OHCI USB Miniport Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.


seems usb related :
MODULE_NAME: usbohci   IMAGE_NAME:  usbohci.sys
check if you find the usbohci.sys on another system, and copy it to the correct location
to find the location, do a search for it
Much as I appreciate your help & reply, nobus, I'd worked that much out for myself !!!

So is there nobody amongst all of you "Experts" that can look at a Vista dump and tell me what driver is crashing ? If, as looks likely, it is this module, USBOHCI.SYS, that is causing it, which occurrence of it might be causing it ? I did a search on the C: drive and found 5 System Files and 5 Setup Information files ... 1 of which appears to have a different date than the rest ...

I am loathe to just copy one of the newer ones over the older one as Vists works differently than previous OSs, apparently, but if somebody KNOWS (not guesses !) better ..... I've attached a screen print.  
USBOHCI-List.doc
More info ... I have found a patch that seems to update USBOHCI.SYS to version 16553, KB941600, which is the version that 4 of my 5 versions of that file seem to be. However, Vista will not let me install this patch, it says "The update does not apply to your system" ... according to other web sites I have googled, this is to do with having SP1 Beta applied to my OS.

I have also found another fix, KB941649 which addresses module NTKRNLPA (this appears in the dump) & appears to update it to version 16551 and/or 20670 (I don't understand this part of Vista at all, how can there be 2 different versions in the same update ?!?!?) ... If I search the C: drive for NTKRNLPA it finds 10 versions of it, versions 16386, 16514, 16551, 16575, 16584 x2, 20629, 20670, 20697 & 20707 ... all of them are in "kernel" directories, which look to have identical paths when I click on "Open File Location", the one that occurs twice also appears in "System 32 (C:\Windows)".

I have got to stop now as I am confusing myself !!!!!
More searching around on the internet has (I think) revealed to me that these extra versions of the driver files which exist in "xxxxx.kernel.xxxxx" folders are backups.

Which insinuates that the versions of the NTKRNLPA & USBOHCI files that I am using are the latest versions.

By going through my Device Driver table I can only see 2 USB devices that specify USBOHCI, my camera and my phone port ... I've uninstalled the camera and got a BSOD IRQ_NOT_EQUAL or something like that on reboot & I am now going to uninstall the phone port ... I'll see how it goes with those both disconnected from the system ...

Thanks for your help everybody, I assume you're all off getting thousands of points from people who are having trouble playing DVDs in CD players, or similarly simple !!!
My actions appear to have resolved the problem(s) ... touch wood.

Admin, could you please now close this question thread and allocate the 500 points to myself for apparently being the only Vista expert on the site ?!?!?!
you seem gladly to forget i pointed out how to use windbg...
ASKER CERTIFIED SOLUTION
Avatar of Computer101
Computer101
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial