Error: KMODE_EXCEPTION_NOT_HANDLED

starview · 13 Sep 2017

Hi, PC was working great and all of a sudden during the last 2 weeks gives me BSOD about 2 times a day.

It has happened in the middle of BF1, Battlefront, using Firefox or just checking my mail.

I'm sure it must be a driver conflict somewhere as there's been lots of updates, but don't know which one.

Thanks for your help

Spectrum · 13 Sep 2017

Hi starview,

From what I am seeing, something in your storage subsystem is causing the bugchecks (bluescreens).

From the mini crash dump generated on 9/9/17, we can see that the storport (storage port driver), is sending an IO Packet which ultimately leads to a FataException being raised, causing the bugcheck.

Code:

0xffffd300e727a658 : 0xfffff8024ce180b6 : nt!KiFatalExceptionHandler+0x22
0xffffd300e727a670 : 0xfffff8024cc93c95 : nt!PpmUpdatePerformanceFeedback+0x85
0xffffd300e727a688 : 0xfffff80f74b48512 : storport!RaidUnitClaimIrp+0x512
0xffffd300e727a698 : 0xfffff8024cd8fa3d : nt!RtlpExecuteHandlerForException+0xd
0xffffd300e727a6a0 : 0xfffff8024cfa7000 : "nt!BcpDisplayParameters <PERF> (nt+0x38a000)"
0xffffd300e727a6a8 : 0xfffff8024cc1d000 : "nt!TmInitSystemPhase2 <PERF> (nt+0x0)"
0xffffd300e727a6c0 : 0xffffd300e727a770 : 0xfffff8024cd8c60a : nt!KiIdleLoop+0x5a
0xffffd300e727a6c8 : 0xfffff8024cc48d94 : nt!RtlDispatchException+0x404
0xffffd300e727a6f8 : 0xfffff8024d4a92e1 : hal!HalBuildScatterGatherListV2+0x221
0xffffd300e727a718 : 0xfffff8024cc1d000 : "nt!TmInitSystemPhase2 <PERF> (nt+0x0)"
0xffffd300e727a770 : 0xfffff8024cd8c60a : nt!KiIdleLoop+0x5a
0xffffd300e727a778 : 0xfffff8024cc1d000 : "nt!TmInitSystemPhase2 <PERF> (nt+0x0)"
0xffffd300e727a780 : 0xfffff8024cfbbea4 : "nt!BcpDisplayParameters <PERF> (nt+0x39eea4)"
0xffffd300e727a7a0 : 0xfffff8024ce18094 : nt!KiFatalExceptionHandler
0xffffd300e727a7c8 : 0xfffff8024ccf1101 : nt!PoFxActivateComponent+0x11
0xffffd300e727a818 : 0xfffff80f74b5bd08 : storport!RaidCheckPerProcessorCompletions+0x68
0xffffd300e727a848 : 0xfffff80f74b4775a : storport!RaidStartIoPacket+0x45a
0xffffd300e727a8c8 : 0xfffff8024d4a8ef5 : hal!HalSendSoftwareInterrupt+0xa5
0xffffd300e727a938 : 0xfffff8024cc8aa45 : nt!KiDeferredReadyThread+0x2d5
0xffffd300e727a958 : 0xfffff8024cc8b44c : nt!KiChooseTargetProcessor+0x11c
0xffffd300e727a968 : 0xfffff8024cce4045 : nt!IoReuseIrp+0x115
0xffffd300e727aa88 : 0xfffff80f75944d7a : CLASSPNP!ServiceTransferRequest+0x29a
0xffffd300e727aad8 : 0xfffff8024d4a8ef5 : hal!HalSendSoftwareInterrupt+0xa5
0xffffd300e727ab48 : 0xfffff8024cc8aa45 : nt!KiDeferredReadyThread+0x2d5

From the mini crash dump generated on 8/29/2017:

Code:

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: ffffb687860bc990, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffffc0000185, error status (normally i/o status code)
Arg3: 0000000022a7c860, current process (virtual address for lock type 3, or PTE)
Arg4: ffff848080582c90, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

This bugcheck occurs when part of the kernel has been paged to your hard disk, and when the system tried to bring it back into your RAM it isn't able to.

The Error status, c0000185, translates to:

Code:

The I/O device reported an I/O error.

There are also a good number of event log entries that are indicating issues with your disk and/or storage controller. Below are some examples.

Code:

Event[19560]:
  Log Name: System
  Source: Disk
  Date: 2017-09-09T20:14:01.306
  Event ID: 153
  Task: N/A
  Level: Warning
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Dad-PC
  Description: 
The IO operation at logical block address 0xa0bf2ea for Disk 1 (PDO name: \Device\0000002d) was retried.

Code:

Event[19614]:
  Log Name: System
  Source: storahci
  Date: 2017-09-11T12:46:28.929
  Event ID: 129
  Task: N/A
  Level: Warning
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Dad-PC
  Description: 
Reset to device, \Device\RaidPort0, was issued.

Given the age of the device it wouldn't be surprising if your hard drive has started to fail, please make sure you have a backup of your important files.

I would suggest that you run an error scan on your C: drive with HDTune, post a screenshot of it after you are finished.

starview · 13 Sep 2017

Hi, I actually have a PNY SSD as well as a regualr HD. The original HDs are no longer in the system.

The PNY has the OS system and the HD has the storage and games
PNY 980 Gb capacity. Volume C and Partition D

The HD has volume I and J. Capacity is 1 TB

I am running HDtune and will post as soon as I get it. Results enclosed. Hopefully I did it correctly.

I did figure out how to update my system specs as part of my profile and have done so just now

Spectrum · 13 Sep 2017

You may want to use PNY's SSD Firmware Update Tool to ensure your SSD is on the latest revision of firmware.

starview · 13 Sep 2017

Spectrum said:

You may want to use PNY's SSD Firmware Update Tool to ensure your SSD is on the latest revision of firmware.

Just chatted with PNY, apparently there is no firmware update for my CS1311. I'm also disappointed that there is no specific utility that check everything for PNY, optimizes etc such as Crucial has.

Alsowondering if there are updated drivers for storage port controllers etc I should be getting ?

Spectrum · 13 Sep 2017

Let's check if the filesystem on the C: partition is healthy.

From an elevated cmd or powershell prompt please run:

Code:

chkdsk.exe /R /X C:

This will ask you to schedule a check on the next reboot, press "y" to confirm, and then reboot.

zbook · 13 Sep 2017

1) Uninstall Bitdefender:
Uninstall Bitdefender
2) Uninstall Malwarebytes
2) Turn on Windows defender
3) Open file explorer > this PC > local C: drive > in the right upper corner type or copy and paste: C:\Windows\MEMORY.DMP
4) Using one drive or drop box post a share link of the memory.dmp into the thread.

Code:

14/06/2017 2:54 PM	Application Error	Faulting application name: vsserv.exe, version: 21.0.25.92, time stamp: 0x5926cd41
Faulting module name: ntdll.dll, version: 10.0.15063.0, time stamp: 0xb79b6ddb
Exception code: 0xc000000d
Fault offset: 0x0000000000105a50
Faulting process id: 0x63c
Faulting application start time: 0x01d2e50561c53da0
Faulting application path: C:\Program Files\Bitdefender\Bitdefender 2017\vsserv.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: 72467152-73d4-46cd-b2a6-433ee61f4548
Faulting package full name: 
Faulting package-relative application ID:05/07/2017 2:09 PM	Application Error	Faulting application name: vsserv.exe, version: 21.0.25.92, time stamp: 0x5926cd41
Faulting module name: ntdll.dll, version: 10.0.15063.0, time stamp: 0xb79b6ddb
Exception code: 0xc000000d
Fault offset: 0x0000000000105a50
Faulting process id: 0x63c
Faulting application start time: 0x01d2f5439c084a1a
Faulting application path: C:\Program Files\Bitdefender\Bitdefender 2017\vsserv.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: 2e413445-30d4-4103-b9ef-07f16465deaf
Faulting package full name: 
Faulting package-relative application ID:15/07/2017 8:48 PM	Application Error	Faulting application name: vsserv.exe, version: 21.0.25.92, time stamp: 0x5926cd41
Faulting module name: ntdll.dll, version: 10.0.15063.447, time stamp: 0xa329d3a8
Exception code: 0xc000000d
Fault offset: 0x0000000000105a50
Faulting process id: 0x624
Faulting application start time: 0x01d2fd7e0d90eba1
Faulting application path: C:\Program Files\Bitdefender\Bitdefender 2017\vsserv.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: b6596cbb-3817-4dca-b7a0-330dd10e4d87
Faulting package full name: 
Faulting package-relative application ID:15/07/2017 3:21 PM	Application Error	Faulting application name: vsserv.exe, version: 21.0.25.92, time stamp: 0x5926cd41
Faulting module name: ntdll.dll, version: 10.0.15063.447, time stamp: 0xa329d3a8
Exception code: 0xc000000d
Fault offset: 0x0000000000105a50
Faulting process id: 0x638
Faulting application start time: 0x01d2fcd2cbefe75a
Faulting application path: C:\Program Files\Bitdefender\Bitdefender 2017\vsserv.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: 1ffd1cba-4908-4b1d-bf29-fd0be1834724
Faulting package full name: 
Faulting package-relative application ID:08/08/2017 8:25 PM	Application Error	Faulting application name: vsserv.exe, version: 21.2.25.30, time stamp: 0x596dc30d
Faulting module name: ntdll.dll, version: 10.0.15063.447, time stamp: 0xa329d3a8
Exception code: 0xc000000d
Fault offset: 0x0000000000105a50
Faulting process id: 0x544
Faulting application start time: 0x01d30eae4a68d1e2
Faulting application path: C:\Program Files\Bitdefender\Bitdefender 2017\vsserv.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: a7085f43-91dd-474f-bb45-b2304410df15
Faulting package full name: 
Faulting package-relative application ID:11/08/2017 1:01 AM	Application Error	Faulting application name: vsserv.exe, version: 21.2.25.30, time stamp: 0x596dc30d
Faulting module name: ntdll.dll, version: 10.0.15063.447, time stamp: 0xa329d3a8
Exception code: 0xc000000d
Fault offset: 0x0000000000105a50
Faulting process id: 0x55c
Faulting application start time: 0x01d3109ade60f05b
Faulting application path: C:\Program Files\Bitdefender\Bitdefender 2017\vsserv.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: fc6a228f-e93b-4ab0-aeef-8514de8cf98e
Faulting package full name: 
Faulting package-relative application ID:12/08/2017 6:45 PM	Application Error	Faulting application name: vsserv.exe, version: 21.2.25.30, time stamp: 0x596dc30d
Faulting module name: ntdll.dll, version: 10.0.15063.447, time stamp: 0xa329d3a8
Exception code: 0xc000000d
Fault offset: 0x0000000000105a50
Faulting process id: 0x614
Faulting application start time: 0x01d3123d7b3e0de7
Faulting application path: C:\Program Files\Bitdefender\Bitdefender 2017\vsserv.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: c8e1dcea-addb-4e8b-bc9c-4ee832cbcb6a
Faulting package full name: 
Faulting package-relative application ID:29/08/2017 7:14 PM	Application Error	Faulting application name: vsserv.exe, version: 21.2.25.30, time stamp: 0x596dc30d
Faulting module name: ntdll.dll, version: 10.0.15063.447, time stamp: 0xa329d3a8
Exception code: 0xc000000d
Fault offset: 0x0000000000105a50
Faulting process id: 0x61c
Faulting application start time: 0x01d320f71aaf7660
Faulting application path: C:\Program Files\Bitdefender\Bitdefender 2017\vsserv.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: e589307d-810d-497f-9549-a0570245748c
Faulting package full name: 
Faulting package-relative application ID:

Code:

10/09/2017 7:49 AM	Windows Error Reporting	Fault bucket 129395419092, type 5
Event Name: RADAR_PRE_LEAK_64
Response: Not available
Cab Id: 0

Problem signature:
P1: MBAMService.exe
P2: 3.1.0.415
P3: 10.0.15063.2.0.0
P4: 
P5: 
P6: 
P7: 
P8: 
P9: 
P10: 

Attached files:
\\?\C:\Users\Dad\AppData\Local\Temp\RDR7D4F.tmp\empty.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D5F.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DDB.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E1B.tmp.txt

These files may be available here:


Analysis symbol: 
Rechecking for solution: 0
Report Id: 06ed2853-6c5c-43e3-b7e2-65ae1e3ba20d
Report Status: 268435456
Hashed bucket: 86e3cdb695e68bbb41db8abf6e1c311129/06/2017 11:59 AM	Windows Error Reporting	Fault bucket 129395419092, type 5
Event Name: RADAR_PRE_LEAK_64
Response: Not available
Cab Id: 0

Problem signature:
P1: MBAMService.exe
P2: 3.1.0.415
P3: 10.0.15063.2.0.0
P4: 
P5: 
P6: 
P7: 
P8: 
P9: 
P10: 

Attached files:
\\?\C:\Users\Dad\AppData\Local\Temp\RDR8E62.tmp\empty.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8E73.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8EFE.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F3E.tmp.txt

These files may be available here:


Analysis symbol: 
Rechecking for solution: 0
Report Id: 87fc2ebc-0d11-4858-9408-65b04f3c743e
Report Status: 268435456
Hashed bucket: 86e3cdb695e68bbb41db8abf6e1c311106/08/2017 11:48 AM	Windows Error Reporting	Fault bucket 129395419092, type 5
Event Name: RADAR_PRE_LEAK_64
Response: Not available
Cab Id: 0

Problem signature:
P1: MBAMService.exe
P2: 3.1.0.415
P3: 10.0.15063.2.0.0
P4: 
P5: 
P6: 
P7: 
P8: 
P9: 
P10: 

Attached files:
\\?\C:\Users\Dad\AppData\Local\Temp\RDRF1C8.tmp\empty.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF1D8.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF1F7.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF246.tmp.txt

These files may be available here:


Analysis symbol: 
Rechecking for solution: 0
Report Id: e4a1aec5-ef95-43ba-98ef-62535d4cd064
Report Status: 268435456
Hashed bucket: 86e3cdb695e68bbb41db8abf6e1c311127/05/2017 1:17 PM	Windows Error Reporting	Fault bucket 129395419092, type 5
Event Name: RADAR_PRE_LEAK_64
Response: Not available
Cab Id: 0

Problem signature:
P1: MBAMService.exe
P2: 3.1.0.415
P3: 10.0.15063.2.0.0
P4: 
P5: 
P6: 
P7: 
P8: 
P9: 
P10: 

Attached files:
\\?\C:\Users\Dad\AppData\Local\Temp\RDRFC7C.tmp\empty.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC7D.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD57.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD97.tmp.txt

These files may be available here:


Analysis symbol: 
Rechecking for solution: 0
Report Id: 808b3a2e-7daa-4c1c-84b2-04a293123be5
Report Status: 268435456
Hashed bucket: 86e3cdb695e68bbb41db8abf6e1c3111

starview · 13 Sep 2017

Are you thinking of a conflict between MalwareBytes and Bitdefender ? I've heard of that in the past .... happened to me a while ago

starview · 13 Sep 2017

Result of chkdsk as per Spectrum's request :

Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.

A disk check has been scheduled.
Windows will now check the disk.

Stage 1: Examining basic file system structure ...
Cleaning up instance tags for file 0x877b.
690176 file records processed. File verification completed.
19340 large file records processed. 0 bad file records processed.
Stage 2: Examining file name linkage ...
870658 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered to lost and found.
Stage 3: Examining security descriptors ...
Cleaning up 2036 unused index entries from index $SII of file 0x9.
Cleaning up 2036 unused index entries from index $SDH of file 0x9.
Cleaning up 2036 unused security descriptors.
CHKDSK is compacting the security descriptor stream
Security descriptor verification completed.
90242 data files processed. CHKDSK is verifying Usn Journal...
Usn Journal verification completed.

Stage 4: Looking for bad clusters in user file data ...
690160 files processed. File data verification completed.

Stage 5: Looking for bad, free clusters ...
31039788 free clusters processed. Free space verification is complete.
Correcting errors in the Volume Bitmap.

Windows has made corrections to the file system.
No further action is required.

464045556 KB total disk space.
338861440 KB in 418320 files.
246476 KB in 90245 indexes.
0 KB in bad sectors.
778488 KB in use by the system.
65536 KB occupied by the log file.
124159152 KB available on disk.

4096 bytes in each allocation unit.
116011389 total allocation units on disk.
31039788 allocation units available on disk.

Internal Info:
00 88 0a 00 b6 c1 07 00 29 e4 0d 00 00 00 00 00 ........).......
3d 20 00 00 3f 63 00 00 00 00 00 00 00 00 00 00 = ..?c..........

Windows has finished checking your disk.
Please wait while your computer restarts.

zbook · 13 Sep 2017

The chkdsk report displayed:
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

So as Spectrum typed in post #2 a drive SMART test is useful to see the status of the drive.

The error/surface scan may take several hours and you can run it overnight.

When there are bsod they can be caused by hardware or software drivers or hardware.
Sometimes the AV drivers are the cause of bsod and other times they are just faulting applications.
During the troubleshooting process Windows defender can be used and the AV can often be reinstalled at a later time.

When the HD error scan (not quick scan but full scan) has completed please post an image into the thread:
https://www.tenforums.com/tutorials/6102-take-screenshot-windows-10-a.html