After installing update, system crashes

The DRIVER_IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x000000D1. This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

Code:

Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\041219-90531-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Mini Kernel Dump does not have process information

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*
Symbol search path is: SRV*
Executable search path is: 
Windows 10 Kernel Version 17763 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff802`5d4b5000 PsLoadedModuleList = 0xfffff802`5d8d0790
Debug session time: Fri Apr 12 16:52:46.762 2019 (UTC + 2:00)
System Uptime: 0 days 0:04:26.492
Loading Kernel Symbols
...............................................................
................................................................
................................................................
......
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffff80347fd3a9c, ff, 0, fffff80347fd3a9c}

*** WARNING: Unable to verify timestamp for sptd2.sys
*** ERROR: Module load completed but symbols could not be loaded for sptd2.sys
Probably caused by : sptd2.sys ( sptd2+3a9c )

Followup:     MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff80347fd3a9c, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80347fd3a9c, address which referenced memory

Debugging Details:
------------------


KEY_VALUES_STRING: 1


STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING:  10.0.17763.437 (WinBuild.160101.0800)

DUMP_FILE_ATTRIBUTES: 0x9
  Hiber Crash Dump
  Kernel Generated Triage Dump

DUMP_TYPE:  2

BUGCHECK_P1: fffff80347fd3a9c

BUGCHECK_P2: ff

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80347fd3a9c

READ_ADDRESS: fffff8025d9f7390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
 fffff80347fd3a9c 

CURRENT_IRQL:  f

FAULTING_IP: 
sptd2+3a9c
fffff803`47fd3a9c ??              ???

IP_IN_PAGED_CODE: 
sptd2+3a9c
fffff803`47fd3a9c ??              ???

CPU_COUNT: 4

CPU_MHZ: c15

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 2a

CPU_STEPPING: 7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  AV

ANALYSIS_SESSION_HOST:  MICHAL

ANALYSIS_SESSION_TIME:  04-16-2019 17:49:31.0774

ANALYSIS_VERSION: 10.0.17763.132 amd64fre

TRAP_FRAME:  ffffdc0326b95270 -- (.trap 0xffffdc0326b95270)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80347fd3a9c rbx=0000000000000000 rcx=ffff8a0278937940
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80347fd3a9c rsp=ffffdc0326b95408 rbp=ffffdc0326b954a0
 r8=000000000000005f  r9=ffffdc0326b954a0 r10=0000000000000100
r11=ffffdc0326b95580 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di ng nz na po cy
sptd2+0x3a9c:
fffff803`47fd3a9c ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8025d679e69 to fffff8025d668730

FAILED_INSTRUCTION_ADDRESS: 
sptd2+3a9c
fffff803`47fd3a9c ??              ???

STACK_TEXT:  
ffffdc03`26b95128 fffff802`5d679e69 : 00000000`0000000a fffff803`47fd3a9c 00000000`000000ff 00000000`00000000 : nt!KeBugCheckEx
ffffdc03`26b95130 fffff802`5d67628e : 00000000`00000000 00000000`5dfcf000 00000000`00000000 00000000`0000000a : nt!KiBugCheckDispatch+0x69
ffffdc03`26b95270 fffff803`47fd3a9c : fffff803`480350de ffffda17`880e14b0 00000000`00000020 fffff0fb`dd200038 : nt!KiPageFault+0x44e
ffffdc03`26b95408 fffff803`480350de : ffffda17`880e14b0 00000000`00000020 fffff0fb`dd200038 fffff0f8`7dee9000 : sptd2+0x3a9c
ffffdc03`26b95410 fffff803`48042e9f : ffff8a02`7a4511f0 00000000`00000003 ffff8a02`7897d1c0 fffff802`5d4e4de3 : pci!PciReadDeviceConfig+0x6e
ffffdc03`26b95480 fffff803`48042da3 : 00000000`00000100 ffffdc03`26b956d0 00000000`00000001 00000000`00037405 : pci!PciEarlyRestoreSkipAllowed+0x7f
ffffdc03`26b955e0 fffff803`48042d72 : 00000000`00000100 ffffdc03`26b956d0 00000000`00000001 00000000`00000001 : pci!PciEarlyRestoreResourcesInternal+0x23
ffffdc03`26b95620 fffff802`5d49e0e6 : 00000000`00000006 00000000`00000100 ffffdc03`26b956d0 fffff802`5d8f266c : pci!PciEarlyRestoreResources+0x22
ffffdc03`26b95650 fffff802`5d422e8b : 00000000`00000001 00000000`00000001 fffff802`5d8f266c 00000000`00000000 : hal!HalpAcpiPostSleep+0x3a2a
ffffdc03`26b95700 fffff802`5da1dfde : 00000000`00000000 fffff802`5d670220 ffff8a02`7a4ff4f0 ffffdd01`68020180 : hal!HaliAcpiSleep+0x2db
ffffdc03`26b957a0 fffff802`5da1dd3e : fffff802`5d8f2630 ffffdc03`26b95920 fffff802`5d8f2630 00000000`0000008e : nt!PopHandleNextState+0x1ee
ffffdc03`26b957f0 fffff802`5da1da34 : 00000000`00000100 fffff802`5d66f75f 00000404`ad9bbffe ffffdc03`26b95900 : nt!PopIssueNextState+0x1a
ffffdc03`26b95820 fffff802`5da202dc : 00000000`0000000c ffffdb00`000077c0 00000000`00000000 fffff802`5d5e72d4 : nt!PopInvokeSystemStateHandler+0x29c
ffffdc03`26b95a30 fffff802`5da20f62 : ffffffff`ffffffff ffffffff`ffffffff 00000000`00000011 00000000`00000000 : nt!PopEndMirroring+0x1cc
ffffdc03`26b95af0 fffff802`5da20c9f : 00000000`00000000 00000003`00000000 00000011`00000001 bc9a4c3a`00000001 : nt!MmDuplicateMemory+0x26e
ffffdc03`26b95b80 fffff802`5d4f2a45 : ffff8a02`81ce9000 ffff8a02`81ce9040 fffff802`5da20b70 bc963aea`bf42eae1 : nt!PopTransitionToSleep+0x12f
ffffdc03`26b95c10 fffff802`5d66fb8c : fffff802`5c582180 ffff8a02`81ce9040 fffff802`5d4f29f0 bc97d023`f956f9f3 : nt!PspSystemThreadStartup+0x55
ffffdc03`26b95c60 00000000`00000000 : ffffdc03`26b96000 ffffdc03`26b90000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x1c


THREAD_SHA1_HASH_MOD_FUNC:  ddd1119b10370d4222139df8dd967d80e126a94c

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  a9a24880dc278dfdfa55b2feb62d2aa539e48ff5

THREAD_SHA1_HASH_MOD:  66b84fa04b1930d7a5082c955ed7ebd181482726

FOLLOWUP_IP: 
sptd2+3a9c
fffff803`47fd3a9c ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  sptd2+3a9c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: sptd2

IMAGE_NAME:  sptd2.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  54c52a71

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  3a9c

FAILURE_BUCKET_ID:  AV_CODE_AV_PAGED_IP_sptd2!unknown_function

BUCKET_ID:  AV_CODE_AV_PAGED_IP_sptd2!unknown_function

PRIMARY_PROBLEM_CLASS:  AV_CODE_AV_PAGED_IP_sptd2!unknown_function

TARGET_TIME:  2019-04-12T14:52:46.000Z

OSBUILD:  17763

OSSERVICEPACK:  437

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  2005-12-02 08:58:59

BUILDDATESTAMP_STR:  160101.0800

BUILDLAB_STR:  WinBuild

BUILDOSVER_STR:  10.0.17763.437

ANALYSIS_SESSION_ELAPSED_TIME:  a0a

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:av_code_av_paged_ip_sptd2!unknown_function

FAILURE_ID_HASH:  {dc797598-11b0-58c7-e17a-9742fc702ce6}

Followup:     MachineOwner
---------

Delete Daemon tools lite (or alcohol 120% it depends what you have)

Ok, I uninstalled Deamon tool lite. I still have the issue. Hope someone is able to go through the files and the dump i attached in previous post and provide a resolution. I am sure there would be other people like me having the same issue.

Please post up a new set of logs. We need to see if it is the same cause or a different one.

Attachment 231057

I have attached the latest files. Please do help me in providing a resolution. I would be grateful.

JasonMay said:

Attachment 231057

I have attached the latest files. Please do help me in providing a resolution. I would be grateful.

There was one more crash recorded on the 14th but the crash dumps for that have already been deleted by Windows so they were not in the logs and we can't view them.

Code:

Event[747]:
  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2019-04-14T12:53:35.487
  Event ID: 1001
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DESKTOP-LBURVDA
  Description: 
The computer has rebooted from a bugcheck.  The bugcheck was: 0xc000021a (0xffffe58298c5f190, 0xffffffffc0000006, 0xffffe58298c54ef0, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 58ea1973-7bc4-4d02-b2d1-b1b55e5ab86a.

What we can see is that it was a 0xC000021a. Here is the typical cause and remedy:

Cause
This error occurs when a user-mode subsystem, such as WinLogon or the Client Server Run-TimeSubsystem (CSRSS), has been fatally compromised and security can no longer be guaranteed. In response, the operating system switches to kernel mode. Microsoft Windows cannot run without WinLogon or CSRSS. Therefore, this is one of the few cases where the failure of a user-mode service can shut down the system.

Mismatched system files can also cause this error. This can occur if you have restored your harddisk from a backup. Some backup programs might skip restoring systemfiles that they determine are in use.

Resolving the Problem

Running the kernel debugger is not useful in this situation because the actual error occurred in a user-mode process.

Resolving an error in a user-mode device driver, system service, or third-party application:
Because bug check 0xC000021A occurs in a user-mode process, the most common culprits are third-party applications. If the error occurred after the installation of a new or updated device driver, system service, or third-party application, the new software should be removed or disabled. Contact the manufacturer of the software about a possible update.

If the error occurs during system startup, restart your computer, and press F8 at the character-based menu that displays the operating system choices. At the resulting Windows Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time. If this does not resolve the error, try manually removing the offending software. You might be able to use Safe Mode to rename or delete the faulty software. If the faulty software is used as part of the system startup process in Safe Mode, you need to start the computer using the Recovery Console in order to access the file. If a newly installed piece if hardware is suspected, remove it to see if this resolves the issue.

Hi Zbook,

Apologies for the late reply as there was lot of things which I had to do as per your mail and it took some time . Thanks a lot for your patience and your valuable time in helping me.

The result of the voidtools can be downloaded from google drive link at:
https://drive.google.com/file/d/1r7_V_EHCRdmrfehEMpiOTsPgEut0JJcT/view?usp=sharing

Command Prompt command run details below

Microsoft Windows [Version 10.0.17763.437]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\Windows\system32>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.17763.1

Image Version: 10.0.17763.437

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

C:\Windows\system32>chkdsk /scan
The type of the file system is NTFS.

Stage 1: Examining basic file system structure ...
172288 file records processed.
File verification completed.
6383 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
5522 reparse records processed.
248212 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.
5522 reparse records processed.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
37963 data files processed.
CHKDSK is verifying Usn Journal...
36052880 USN bytes processed.
Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

103877894 KB total disk space.
35159376 KB in 126988 files.
91044 KB in 37964 indexes.
0 KB in bad sectors.
280330 KB in use by the system.
65536 KB occupied by the log file.
68347144 KB available on disk.

4096 bytes in each allocation unit.
25969473 total allocation units on disk.
17086786 allocation units available on disk.

C:\Windows\system32>wmic recoveros set autoreboot = false
Updating property(s) of '\\DESKTOP-LBURVDA\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition2"'
Property(s) update successful.

C:\Windows\system32>

Device manager screenshots below
I have highlighted in red square the problem areas

Attachment 231969


Driver Booster uninstalled
I have installed the latest driver for Intel management engine and Intel network adapter
I have attached the result of the Intel Driver Assistant software

Attachment 231970

Power plan changed from balanced to high performance

HD Tune results below

Attachment 231971Attachment 231972

I have read the link on windows driver verifier.Please do let me know what to do next to fix this issue.
Thanks a lot again.

1) Run the BETA log collector > post a new zip into the thread

2) For all drives re-run the HD Tune full error scan > post images of the results into the thread

3) For any drive that was unable to display a HD Tune result > run Download Macrorit Disk Scanner Portable 4.3.0 > post an image of the results into the thread

4) For ST2000 run:
a) HD Sentinel (free or trial version)
Overview, temperature, and SMART results
Hard Disk Sentinel - HDD health and temperature monitoring
b) Sea Tools for Windows
SMART and long generic test results
https://www.seagate.com/support/down...ls-win-master/

5) Uninstall Kaspersky AV using the applicable uninstall tool:
Macrium Software | Your Image is Everything

6) Make sure Windows defender is on

7) Uninstall and reinstall the problematic Intel drivers:
Updating a driver. - Microsoft Community

How to easily find drivers for Unknown Devices in Windows | PCWorld
https://www.howtogeek.com/193798/how...evice-manager/

5) After completing the above steps:

6)Make a backup image using Macrium:
Macrium Software | Your Image is Everything
Save the backup image to another disk drive (not another partition on the same drive) or to the cloud.

7) Make a new restore point:
Create System Restore Point in Windows 10 | Tutorials

8)Turn on Windows driver verifier with the settings in this link:
Enable and Disable Driver Verifier in Windows 10 | Tutorials

9) For any BSOD:
a) post a new BETA log collector zip
b) post a memory dump zip share link if the file sizee is < 1.5 GB (C:\windows\memory.dmp)

Hi Zbook,

Thanks a lot for the detailed steps. I have completed all the steps except the last step and I had a doubt in that. I am currently running the verifier tool. As per online instructions, after configuring the verifier tool, I need to restart the computer and then the testing would start. In my case, as informed earlier, when I restart, the network adapter works fine and so if the verifier runs , would I still pick issues as there would be no issues in device manager at that time? Currently after configuring the tool, I have shutdown and started so that the network adapter issue would still be there, but now , will the verifier be running or will it work only after a restart?
If so, as I can't keep the PC running for more than say 8 hours, do I have to configure each time and restart and continue the process until a BSOD?

When windows driver verifier is started it often produces an immediate BSOD.
For optimal testing the tool is run for 48 continuous hours to rule out misbehaving drivers.
After each BSOD the tool needs to be turned off.
The misbehaving driver is then uninstalled.
The tool is then restarted to find the next misbehaving driver.
Alternatively, a driver can be replaced before restarting the tool.

All non-Microsoft drivers should be tested.

If there are no performance/boot problems the number of simultaneous customized tests can be increased to 19 as in this link: https://answers.microsoft.com/en-us/...3-c48669e4c983
(increase by 4 - 5 / hour)

Each time the tool is restarted the settings need to be customized.