?
Solved

A driver causes BSODs, but which one?

Posted on 2009-02-10
12
Medium Priority
?
1,301 Views
Last Modified: 2012-06-21
I have a machine that has had lots of BSODs. At least 9 since November 08.

Windows Error Reporting says a device driver is to blame.

I've run verifier.exe successfully on only the non-MS provided drivers.

However each time , when I select ALL drivers, including MS provided drivers, and run verifier, I get a  BSOD with an error code where the first three parameters are the same  STOP 0x000000C4 (0x00000086, 0xBA4EBCBC, 0X00000004, [some variable hex number]).

So which driver is causing the problem?

Attached are all the mini-dumps I have.
DMPfiles2.zip
0
Comment
Question by:BriGuy2020
  • 4
  • 3
  • 3
  • +2
12 Comments
 
LVL 6

Expert Comment

by:ACollyer
ID: 23607507
I've attached the debug analysis for the most recent minidump (Mini011309-01). These lines in particular may be of interest:


SYMBOL_NAME:  usbhub!USBH_HubCancelIdleIrp+2d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: usbhub

IMAGE_NAME:  usbhub.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  453ca422

FAILURE_BUCKET_ID:  0x44_usbhub!USBH_HubCancelIdleIrp+2d

BUCKET_ID:  0x44_usbhub!USBH_HubCancelIdleIrp+2d



This suggests that you might have a dodgy USB device connected, or at least there is a problem surrounding USB. As the BSODs don't happen all the time, it might be difficult to track down exactly what could be causing the problem. Do you have a USB broadband modem connected, perhaps?

Maybe you could try updating your chipset drivers (from the list of loaded modules, I see your mainboard has an Intel northbridge and southbridge of some variety.) What is your computer or motherboard make/model?
BriGuy2020-debuglog.txt
0
 
LVL 2

Expert Comment

by:Crifford
ID: 23608321
Are you using norton antivirus?
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 23609215
Did you update SP2 to SP3 at about that time?

If so, you could try rolling back to XP SP2 because SP3 can affect or change usbport.sys.  This could conceivably be the problem concerning USB.

There is a patch provided by the motherboard manufacturer to resolve the usb problem, apparantly caused by SP3.    Microsoft KB817900 USB patch is found under Utilities, and not under USB drivers as expected.

USB port may stop working after you remove or insert a USB device:
http://support.microsoft.com/kb/817900
0
Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
LVL 6

Expert Comment

by:ACollyer
ID: 23609488
Now you mention SP3, Jonvee, there was an issue with certain HP machines that were shipped with SP2. When you upgrade to SP3, it screws the USB because the workstations affected use AMD CPUs, but the workstation image was created on a machine with an Intel CPU (sounds a bit weird, but it's a widely known issue.)

If (and only if!) your machine is an AMD-based HP, have a go at downloading the fix from HP:
http://h10025.www1.hp.com/ewfrf/wc/genericSoftwareDownloadIndex?cc=us&dlc=en&lc=en&softwareitem=pv-60484-2&jumpid=reg_R1002_USEN

More info here:
http://www.eweek.com/c/a/Desktops-and-Notebooks/HP-Fixing-XP-SP3-Problems/


Of course, if you have manually reinstalled the machine from scratch since you got it, just ignore this post as obviously you won't be using a dodgy workstation image :)
0
 
LVL 93

Expert Comment

by:nobus
ID: 23609502
you can try deleting all the usb entries from device manager, reboot and test
this may help too :
Delete the "UpperFilters" and "LowerFilters" registry values from:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}

you can also reset the usb :
rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\WINDOWS\inf\usbstor.inf
rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\WINDOWS\inf\usb.inf
rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\WINDOWS\inf\usbport.inf
rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\WINDOWS\inf\usbprint.inf
0
 

Author Comment

by:BriGuy2020
ID: 23615136
I'm going to go point by point in roughly chronological order:
A) I don't use Norton antivirus, or a broadband modem.
B) A certain USB flash memory drive may be flakey. I've seem other things in the event log about it.
C) The flakey USB memory drive doesn't explain why driver verifier (DV) consistently makes a BSOD, because I had the user's drive disconnected when running DV... Unless it was connected in the back, but I don't think it was.
D)Dell's diagnostics come back clean.
E) I may try updating the chipset driver. But what I'm really planning on doing is building another computer from an identical machine (I get them in batches for ghosting and deploying), installing all the drivers on that machine, and running driver verifier (DV) to see if DV makes any BSODs appear. By using DV, I can get a BSOD, if any, right away, instead of waiting for one.
E) I might have the user stop using that particular flash drive. That doesn't explain the DV BSODs, but it might stop other BSOds during regular use :-)
0
 

Author Comment

by:BriGuy2020
ID: 23724124
What seems to be the cause in the latest minidumps?
Minidump2.zip
0
 
LVL 93

Expert Comment

by:nobus
ID: 23724232
0901 - DEFAULT_BUCKET_ID:  DRIVER_FAULT    PROCESS_NAME:  OUTLOOK.EXE    IMAGE_NAME:  ntkrpamp.exe
02 - DEFAULT_BUCKET_ID:  DRIVER_FAULT    PROCESS_NAME:  csrss.exe    IMAGE_NAME:  hardware
03   DEFAULT_BUCKET_ID:  DRIVER_FAULT    PROCESS_NAME:  csrss.exe    IMAGE_NAME:  hardware


0
 
LVL 6

Accepted Solution

by:
ACollyer earned 1000 total points
ID: 23724274
I've attached analysis files for each of the minidumps....

DEFAULT_BUCKET_ID:  DRIVER_FAULT
PROCESS_NAME:  OUTLOOK.EXE

DEFAULT_BUCKET_ID:  DRIVER_FAULT
PROCESS_NAME:  csrss.exe



Not sure about outlook.exe to be honest, but:
"The Microsoft Client Server Runtime Server subsystem utilizes the process csrss.exe for managing the majority of the graphical instruction sets under the Microsoft Windows operating system. As such Csrss.exe provides the critical functions of the operating system, and its termination can result in the Blue Screen of Death being displayed."


I don't think any malware/spyware is killing csrss.exe, but maybe have a look at your graphics drivers as a first course of action?
0
 
LVL 6

Expert Comment

by:ACollyer
ID: 23724284
Sorry- forgot the files:
debug1.txt
debug2.txt
debug3.txt
0
 
LVL 93

Expert Comment

by:nobus
ID: 23731056
what motherboard and cards are on this system ?
0
 

Author Closing Comment

by:BriGuy2020
ID: 31545381
Thanks for your help. I used another image and another machine for this user, so I don't know if it was the graphics driver.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If your system is showing symptoms of browser hijacks or 'google search redirects' check out my other article (http://rdsrc.us/u3GP7A) first and run the tool TDSSKiller (http://rdsrc.us/GDBBs4) to get rid of the infection. Once done, and if the …
Sometimes people don't understand why download speed shows differently for Windows than Linux.Specially, this article covers and shows the solution for throughput difference for Windows than a Linux machine. For this, I arranged a test scenario.I…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
How can you see what you are working on when you want to see it while you to save a copy? Add a "Save As" icon to the Quick Access Toolbar, or QAT. That way, when you save a copy of a query, form, report, or other object you are modifying, you…
Suggested Courses

601 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question