Windows Vista Vista X64 SP1 random BSOD - minidumps available

Hi all!

For about 3 days I have some strange BSOD problem when running Vista X64 SP1 (XP SP3 is perfectly stable on the same machine) - I keep getting the STOP error 0xD1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL) in almost all cases, always referring to wdf01000.sys - always the same BCP2 - 4 (see further down). I have tried a lot to troubleshoot this - without success. Here's further information:

- system: Asus M70Sa, Vista X64 Ultimate (SP1), 2x2GB RAM (dual channel mode), ATI Mobility Radeon HD3650
- never had a BSOD since installation (middle of January) and never changed a driver or similar since installation
- first BSOD while watching some Simpsons episode (DivX) on Feb. 28th
- BSOD can't have been caused by Windows Updates, because no Windows Updates have been installed since middle of January
- installing latest Windows Updates after first BSOD didn't help (BSOD still occurred randomly after Vista had started - most of the time within the first minutes, but sometimes after more than an hour)
- neither AntiVir nor Spybot S&D found any virus or malware
- removed 2GB RAM so that the system was running with 2GB RAM in single channel mode -> didn't help
- removed the remaining 2GB and put the other 2GB module into the other slot -> didn't help
- deleted pagefile.sys and hiberfil.sys so that they had to be created from scratch by Vista on reboot -> didn't help
- unplugged all devices except USB mouse, disabled touchpad and WLAN in BIOS -> didn't help
- tried sfc /scannow at command prompt to check for corrupted system files -> no corrupted files reported
- in safe mode I saw no BSOD (but haven't run it for more than 2 minutes or so), after reboot in normal mode -> still BSODs
- read that on some Vista X64 systems, BSODs can appear randomly after Update 932596, so I tried to install the hotfix from KB950772, but the installer said the hotfix doesn't apply to my system
- once Vista didn't give me a BSOD within minutes after start, I started OCCD to heavily stress CPU, RAM and GPU for about 30 minuted, no BSOD
- multiboot system (Vista and XP SP3) - XP perfectly stable => BSOD in Vista software related?
- almost all the time the same BSOD (0xD1) referring to wdf01000.sys with the same BCP2 - BCP4 (see further down)
- changed the setting so that Vista wouldn't use a page file anymore, rebooted, changed the setting again so that Vista would handle the page file size on its own. When I tried to shut down, I got a different BSOD (STOP: 0x0000001E (0xFFFFFFFFC0000005,0xFFFFFA60034018C7,0x0000000000000001,0x0000003300000078
CmBatt.sys - Address FFFFFA60034018C7 base at FFFFFA6003400000, DateStamp 47919282) - I can see that the first argument includes "C0000005" and I could read on http://msdn.microsoft.com/en-us/library/ms793648.aspx that this exception code means "STATUS_ACCESS_VIOLATION - A memory access violation occurred. (Parameter 4 of the bug check is the address that the driver attempted to access.) "
- Event Viewer only lists the BSOD events themselves, can't see other suspicious events

I checked 3 of the last 4 0xD1 BSODs I was getting, here's the information I got after reboot (link to minidump zip with the corresponding file names further down); please note that BCP2 - 4 are always identical, and the 0xD1 BSODs always refer to wdf01000.sys:

event: BlueScreen
OS version: 6.0.6001.2.1.0.256.1

Crash 1
=======

BCCode: d1
BCP1: FFFFFFCD00000068
BCP2: 0000000000000002
BCP3: 0000000000000000
BCP4: FFFFFA600085CB97
OS Version: 6_0_6001
Service Pack: 1_0
Product: 256_1

Crash 2
=======

BCCode: d1
BCP1: 00000095FFFFFFD0
BCP2: 0000000000000002
BCP3: 0000000000000000
BCP4: FFFFFA6000859B97
OS Version: 6_0_6001
Service Pack: 1_0
Product: 256_1

Crash 3
=======

BCCode: d1
BCP1: 00000095FFFFFFA0
BCP2: 0000000000000002
BCP3: 0000000000000000
BCP4: FFFFFA6000856B97
OS Version: 6_0_6001
Service Pack: 1_0
Product: 256_1

The corresponding minidump files can be found within this zip archive:


I also included two more dump files in the zip - but for them I don't have the information I just quoted for Crash 1 - 3.

I am more or less out of ideas. I guess a hardware cause is unlikely because XP is perfectly stable on the same machine - the only difference is that XP has been installed to another hard disk (the M70Sa got two internal hard disks 500GB each). It looks like the BSOD changes if the page files change due to changed settings. I don't know if this is normal or not: The page files (pagefile.sys and hiberfil.sys) differed in size - one of them has the size
of my physical memory, the other one is a few 100 MB larger (don't remember which one and can't look it up right now, sorry).

Anyone's help is appreciated a lot - thanks in advance!

Stefan

 

Hi!

First of all - thanks for the really quick reply!

I read the note about Windows' execute cycles which are different from the cycles e.g. Memtest86 uses - that's why I didn't try Memtest, because it wouldn't detect execute cycle related errors. Instead, I tried to rule out memory issues by trying both 2GB modules separately in different slots - BSODs still occurring. So unless both modules are damaged (which I'd find very unlikely, because BSODs started 3 days ago, at almost every run of Vista, and never before, so this would need both modules gone bad on the same day and no effect at all when running XP?), I doubt it's related to the memory modules.

Any other ideas?

 

Well, I don't consider them "all over the place" - because before I changed the page file settings, I got the BSOD *always* (maybe except in 1 - 2 cases) related to wdf01000.sys with the same STOP code (0xD1) and the same BCP2 - 4. I thought it might have been a corrupted wdf01000.sys, but sfc /scannow didn't report any corruption. I only got the 0x1E STOP code and CmBatt.sys reference after I changed the page file settings this morning. Maybe it's a hard disk issue? I haven't heard strange noise from the drive though (on the other hand, it's a very quiet model anyway). Plus I'd not expect the same BCP2 - 4 on each BSOD in that case. I find an underpowered PSU unlikely aswell, because no BSODs on XP, and I got no BSODs when I managed to run OCCD for 30 minutes (which burdened the PSU a lot more than when I got BSODs at idle times).

So what can I do if we consider it a software BSOD (because it's always referring to wdf01000.sys, same BCP2 - 4)? wdf01000.sys seems to be okay (except if sfc /scannow has compared it against some copy on the hard disk which might have the same corruption). Maybe anybody can analyse the minidumps and find the cause or some hint?

 

I have only run in safe mode one time for about 2 minutes or so since the BSOD problem started (just to see if running in safe mode and in normal mode afterwards maybe already fixes the problem). I got no BSOD at that time. I could try tonight to run in safe mode for an hour or two - just a shame that the BSOD is not easy to reproduce (often I get the BSOD within a few minutes after starting in normal mode, at other times I get it no earlier than after two hours). Let's say it will run without BSOD in safe mode - what would your conclusion be and what would you suggest for further troubleshooting?

Thanks again!

 

Okay thanks a lot - I will try that tonight. But my gutt feeling tells me this won't be my last post. ;-( Because without having changed any driver, the BSOD problem appeared from one day to the other and hasn't gone since...

Anyway, I will check hard disk and run Memtest86, if both memory and hard disk are okay, I will try safe mode and troubleshooting drivers. If all that doesn't help, I'll make another post. Thanks so far!

 

Hi again!

I finally solved the BSOD problem - it was driver-related. I think this is what happened: When I installed the infrared device (ITECIR ITE8708) driver in the middle of January, the setup files accidently installed the x86 version instead of the x64 version. As everything looked fine in the device manager, I never knew about the wrong driver. But when I checked last night if BSODs occur in safe mode, too, I could see an exclamation mark in the device manager at some system device called "user infrared device" or similar (don't know the English term because it's the German version of Vista). So I deactivated this device and restarted Vista in normal mode. No BSOD anymore! I deinstalled the deactivated device and searched for new hardware (to hopefully reinstall the driver correctly). No new hardware was found! So I thought: "Okay, maybe the infrared driver is already installed at another position in the device manager" - and I found it to be in the input devices section. I then chose to update the driver and selected the x64 driver inf file manually - the new driver got installed, the device name had slightly changed, two more related entries were created in the input devices section, and that was it.

It's just weird that it took the BSODs 1 1/2 months to appear even though the driver had been bad from the very beginning (and not shown up that way in the device manager since then). I'm not sure why the BSODs never pointed me to the infrared driver file but always to wdf01000.sys - maybe this was because the "user infrared device" (which the device manager reported to be bad) was listed as a system device. Maybe this lowers the chance that the BSOD refers to the driver file that *really* causes the problem. In other words: If not a bad system device driver had caused the BSODs but a bad e.g. input device driver, the BSOD might have referred directly to the driver which was bad.

Anyway, it's solved now (I hope) and maybe this helps others who got the same or a similar problem.

Thanks again for helping me!

 

Yep - thanks again!

I also noticed that my first attempt to analyze the minidump files was not quite correct. When I tried it another way, it actually pointed me to the faulty driver (itecir.sys).