Jump to content

Windows XP USB question


aahmad

Recommended Posts

Hey all,

Just thought I would bring this post back to life as my problems have persisted since last year. One of my users has had 14 blue screens since the start of the year. Here is a minidump analysis of the past 3 using WhoCrashed:

Analysis

--------------------------------------------------------------------------------

Crash dump directory: C:\WINDOWS\Minidump

Crash dumps are enabled on your computer.

On Thu 6/11/2009 6:29:52 PM your computer crashed

This was likely caused by the following module: usbport.sys

Bugcheck code: 0x1000000A (0xFFFFFFE0, 0x2, 0x1, 0x80514565)

Error: Unknown

file path: C:\WINDOWS\system32\drivers\usbport.sys

product: Microsoft® Windows® Operating System

company: Microsoft Corporation

description: USB 1.1 & 2.0 Port Driver

The crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified.

On Thu 6/11/2009 6:29:52 PM your computer crashed

This was likely caused by the following module: usbport.sys

Bugcheck code: 0x44 (0x85C11E00, 0xD63, 0x0, 0x0)

Error: MULTIPLE_IRP_COMPLETE_REQUESTS

file path: C:\WINDOWS\system32\drivers\usbport.sys

product: Microsoft® Windows® Operating System

company: Microsoft Corporation

description: USB 1.1 & 2.0 Port Driver

The crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified.

On Thu 6/11/2009 6:29:52 PM your computer crashed

This was likely caused by the following module: usbport.sys

Bugcheck code: 0x1000000A (0xFFFFFFE0, 0x2, 0x1, 0x80514565)

Error: Unknown

file path: C:\WINDOWS\system32\drivers\usbport.sys

product: Microsoft® Windows® Operating System

company: Microsoft Corporation

description: USB 1.1 & 2.0 Port Driver

The crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified.

One thing is that the flash drive is considered as a generic volume in Windows XP if that means anything. The idea of using the safely remove hardware option is not well embraced. I just do not know why this issue occurs when unplugging a usb flash drive(Olympus DS-4000) randomly and getting blue screens. Also this happens on both laptops and desktops.

Thanks all for the help, I need a miracle.

Link to comment
Share on other sites


902973 You occasionally receive a "STOP 0x000000D1" error message when you start or shut down a Windows XP-based computer or a Windows Server 2003-based computer

http://support.microsoft.com/default.aspx?...kb;EN-US;902973

...

This is indeed a bug in the XP usbport.sys driver, but it's not fixed. You can avoid this by disabling the ability for XP to put any devices on the USB bus to sleep in the device manager under USB controllers, under each USB hub, properties, power management - uncheck "allow the computer to turn off this device to save power".

Unfortunately, at this point XP is in extended support, so getting a fix for XP is impossible unless you've got a premier support agreement, have an extended support and extended hotfix support agreement for XP, and are willing to file and wait to see if they're even going to consider fixing it.

Can you reproduce this on the same hardware with something newer, like Vista or Win7 (as a test)?

Link to comment
Share on other sites

  • 7 months later...

Ok, I believe I have found two resolutions. One is to turn Windows Data Execution Prevention off, the other is to scrap the Olympus and use a Philips handheld both seem to have resolved my blue screen issues. Given the Philips is quite expensive, my question is what are the negative effects if any to turning Windows DEP off? Or to avoid turning DEP completly off is there a way to determine how to turn DEP off for a particular driver or service?

Edited by aahmad
Link to comment
Share on other sites

You can't disable DEP for drivers, but you can for .EXEs if your system is set to opt-in. Disabling DEP means the system is no longer checking for executable code coming from pages not marked PAGE_EXECUTE, meaning buffer overruns and other types of pointer/load attacks are much easier to exploit (similar to the vulnerabilities patched by Microsoft in the MS10-002 patch, for a recent example). If disabling DEP fixes a driver, you have likely no recourse but to disable DEP or use a different device driver that isn't poorly written.

Link to comment
Share on other sites

You can't disable DEP for drivers, but you can for .EXEs if your system is set to opt-in. Disabling DEP means the system is no longer checking for executable code coming from pages not marked PAGE_EXECUTE, meaning buffer overruns and other types of pointer/load attacks are much easier to exploit (similar to the vulnerabilities patched by Microsoft in the MS10-002 patch, for a recent example). If disabling DEP fixes a driver, you have likely no recourse but to disable DEP or use a different device driver that isn't poorly written.

Thank you as always!

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...