Blue Screen of Death

[joe43wv]

I'm working on a PC and have run into a brick wall, BIG TIME. The system boots up and runs just fine, but when I go to shut it down I get the blue screen of death. It doesn't do it while the system is running, just when the system is shutting down. I tried messing with the hardware and found that when I unplug the DVD drives it will operate and shutdown just fine. I thought it might have been the DVD drives so I tried new ones and that didn't work, so I tried SATA DVD drives rather than IDE and still doesn't work. So I've narrowed it down to the DVD drives but don't know how to get it to work from here. Any thoughts?

[Tripredacus]

You need to post what appears on this bsod.

[joe43wv]

I'm at work right now, when I get home I'll look at it and post the BSOD. Thanks tripredacus.

[joe43wv]

Update: I hooked up the system and at shutdown here's what the BSOD says IRQL_NOT_LESS_OR_EQUAL. What's that mean, and how do I fix it?

[cluberti]

It means you had a driver access memory that required a paging operation at DPC dispatch level (IRQL 2) or higher, which is a no-no and causes a bugcheck. Unless you can look at the dump and see which driver is listed as the culprit, you'll need to post it here for us to help. Or, just remove and update all of the drivers in your box .

[joe43wv]

I'll look for the file this evening and post if needed. One question though, I've never searched for the file that contains the info. always before I'd run across the problem causing the BSOD and fix it without issue, so where is the file located and what is the file called?

[cluberti]

I'll look for the file this evening and post if needed. One question though, I've never searched for the file that contains the info. always before I'd run across the problem causing the BSOD and fix it without issue, so where is the file located and what is the file called?

It's usually a .dmp file in the \Windows directory.

[joe43wv]

Here's the dump files you requested. Hopefully this will tell us something.

dump_files.zip

[Mr Snrub]

Both dumps are STOP 0xA:

IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses.

First dump has no stack, so not much of use, however the debugger reports the exeception caused by a driver calling nt!IoDetachDevice.

Second dump is better:

TRAP_FRAME: f79ff9d8 -- (.trap 0xfffffffff79ff9d8)

ErrCode = 00000000

eax=00000000 ebx=00000000 ecx=80552582 edx=00000000 esi=8617c030 edi=8651bd08

eip=804ef320 esp=f79ffa4c ebp=f79ffa58 iopl=0 nv up ei pl zr na pe nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246

nt!IoDetachDevice+0x2a:

804ef320 8b80b0000000 mov eax,dword ptr [eax+0B0h] ds:0023:000000b0=????????

STACK_TEXT:

f79ff9d8 804ef320 badb0d00 00000000 f79ffa04 nt!_KiTrap0E+0x238

f79ffa58 f785623c 8617c030 f78552e4 86345020 nt!IoDetachDevice+0x2a

WARNING: Stack unwind information not available. Following frames may be wrong.

f79ffa8c f78552f5 8651bbe8 86345020 8651bca0 sonypvl3+0x223c

f79ffae8 804f185e 865668c0 00000000 86345000 sonypvl3+0x12f5

f79ffb00 f743060c 86345000 8052595a 86345020 nt!IoDeleteDevice+0x76

f79ffb14 f7430706 86345020 00000008 8617c030 fltMgr!FltpCleanupDeviceObject+0x76

f79ffb30 f7434df3 8617c030 80559e50 00fe000a fltMgr!FltpDetachFromFileSystemDevice+0x44

f79ffc58 f74351c8 8617c030 00000000 f79ffc84 fltMgr!FltpFsNotificationActual+0x4f

f79ffc68 80573d43 8617c030 00000000 8621cf4c fltMgr!FltpFsNotification+0x10

f79ffc84 f67f3c82 8617c030 f79ffcf0 804ef095 nt!IoUnregisterFileSystem+0x3f

f79ffc90 804ef095 8617c030 8621ce70 8651bd08 Cdfs+0x3c82

f79ffcf0 804ef095 8651bbe8 8621ce70 8621ce70 nt!IopfCallDriver+0x31

f79ffd00 f7428fbb 865668c0 862fc020 86373330 nt!IopfCallDriver+0x31

f79ffd28 804ef095 862fc020 8621ce70 86373330 fltMgr!FltpDispatch+0x6f

f79ffd38 80647130 80561f70 00000001 00000000 nt!IopfCallDriver+0x31

f79ffd64 8064eac8 00000000 80563720 865c3230 nt!IoShutdownSystem+0x62

f79ffd7c 805379bd 00000000 00000000 865c3230 nt!PopGracefulShutdown+0xbe

f79ffdac 805ce84c 00000000 00000000 00000000 nt!ExpWorkerThread+0xef

f79ffddc 8054532e 805378ce 00000000 00000000 nt!PspSystemThreadStartup+0x34

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

Crash occurred because EAX was 0, and the module sonpvl3.dll was the originator of the nt!IoDetachDevice call:

0: kd> lmvm sonypvl3

start end module name

f7854000 f7858680 sonypvl3 T (no symbols)

Loaded symbol image file: sonypvl3.sys

Image path: sonypvl3.sys

Image name: sonypvl3.sys

Timestamp: Wed Sep 22 04:55:37 2004 (4150E9A9)

CheckSum: 0000A238

ImageSize: 00004680

Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0

However, in this instance the debugger even manages to provide an OCA link for this issue:

http://oca.microsoft.com/resredir.aspx?sid=5404&State=1

[joe43wv]

Thanks Mr Snrub, I downloaded the patch and will install it this evening, I'll keep you all posted as to my results.

[joe43wv]

Update: Mr Snrub you hit the nail EXACTLY on the head. I installed that update yesterday evening and the BSOD went away. At first I thought it wasn't going to work, but sure enough it did. I'm gonna keep it over the weekend, run updates, double check a few things, etc. before returning it to the owner. Thanks again guys, and thanks Mr Snrub for the link to the patch download.

[Mr Snrub]

Great news

As a side note, this is a handy feature of Vista - Windows Error Reporting (WER) would have checked the OCA for you and presented you with the solution automatically, and it shows the value of the "report this problem to Microsoft anonymously" messages.