none
BSOD Whenever transferring files over USB 3.0

    Question

  • Hi I keep getting a BSOD crash every time I try to copy large files through USB 3.0, either from an external to my HDD or the other way around. I keep getting a crash with the error DRIVER_IRQL_NOT_LESS_OR_EQUAL (Wdf01000.sys)

    Its a fairly new desktop, less than 6 months old. It has an AsRock 970 Extreme3 R2.0 motherboard

    Any help for what could be causing it?

    Thanks

    Friday, July 11, 2014 6:04 AM

Answers

  • Thanks very much!

    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

    This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

    A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high. This bug check is usually caused by drivers that have used improper addresses.

    2: kd> .bugcheck
    Bugcheck code 000000D1
    Arguments 00000000`000000b8 00000000`00000002 00000000`00000000 fffff800`816b770a
    

    Right away we can assume that due to the 1st argument being 00000000000000b8, this is a completely invalid address. We can confirm this just to be sure:

    2: kd> !pte 00000000000000b8
                                               VA 00000000000000b8
    PXE at FFFFF6FB7DBED000    PPE at FFFFF6FB7DA00000    PDE at FFFFF6FB40000000    PTE at FFFFF68000000000
    contains 098000012E970867  contains 76C000016D811867  contains 040000016DA32867  contains 0000000000000000
    GetUlongFromAddress: unable to read from fffff80024bcb104
    pfn 12e970    ---DA--UWEV  pfn 16d811    ---DA--UWEV  pfn 16da32    ---DA--UWEV  not valid
    

    2: kd> k
    Child-SP          RetAddr           Call Site
    ffffd001`3be48508 fffff800`249d6ae9 nt!KeBugCheckEx
    ffffd001`3be48510 fffff800`249d533a nt!KiBugCheckDispatch+0x69
    ffffd001`3be48650 fffff800`816b770a nt!KiPageFault+0x23a
    ffffd001`3be487e0 fffff800`816c4364 Wdf01000!FxRequest::CompleteInternal+0x4a
    ffffd001`3be488a0 fffff800`83b1ef16 Wdf01000!imp_WdfRequestComplete+0x8c
    ffffd001`3be48910 fffff800`83b1f684 USBXHCI!Bulk_Transfer_CompleteCancelable+0x15a
    ffffd001`3be48970 fffff800`83b1fd0d USBXHCI!Bulk_ProcessTransferEventWithHaltedCompletion+0x124
    ffffd001`3be489d0 fffff800`83b0d02b USBXHCI!Bulk_ProcessTransferEventWithED1+0x229
    ffffd001`3be48a80 fffff800`8174fc81 USBXHCI!Interrupter_WdfEvtInterruptDpc+0x427
    ffffd001`3be48b80 fffff800`248d11e0 Wdf01000!FxInterrupt::DpcHandler+0xc1
    ffffd001`3be48bb0 fffff800`248d03fb nt!KiExecuteAllDpcs+0x1b0
    ffffd001`3be48d00 fffff800`249ce0d5 nt!KiRetireDpcList+0xdb
    ffffd001`3be48fb0 fffff800`249cded9 nt!KxRetireDpcList+0x5
    ffffd001`4b31a7b0 00000000`00000000 nt!KiDispatchInterruptContinue
    

    The USBXHCI.sys driver, specifically USBXHCI!Bulk_Transfer_CompleteCancelable+0x15a is the driver that attempted to access completely invalid memory within kernel-mode, therefore the box bug checked. This is a Windows system driver, therefore something 3rd party is causing conflicts.

    1. Uninstall AOMEI Backupper ASAP, terrible drivers.

    2. Remove and replace Norton with Windows 8's built-in Windows Defender for temporary troubleshooting purposes as it's very likely causing USB conflicts:

    Norton removal - https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us;jsessionid=841A6D40BA6872C47697C6C6B19C8E11.4?entsrc=redirect_pubweb&pvid=f-home

    Windows Defender (how to turn on after removal) - http://www.eightforums.com/tutorials/21962-windows-defender-turn-off-windows-8-a.html

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    • Marked as answer by Timtam123 Sunday, July 13, 2014 2:45 AM
    Saturday, July 12, 2014 1:25 PM

All replies

  • Hi,

    In order to assist you, we will need the .DMP files to analyze what exactly occurred at the time of the crash, etc.

    If you don't know where .DMP files are located, here's how to get to them:

    1. Navigate to the %systemroot%\Minidump folder.

    2. Copy any and all DMP files in the Minidump folder to your Desktop and then zip up these files.

    3. Upload the zip containing the .DMP files to Onedrive or a hosting site of your choice and paste in your reply. Preferred sites: Onedrive, Mediafire, Dropbox, etc. Nothing with wait-timers, download managers, etc.

    4 (optional): The type of .DMP files located in the Minidump folder are known as Small Memory Dumps. In %systemroot% there will be what is known as a Kernel-Dump (if your system is set to generate). It is labeled MEMORY.DMP. The difference between Small Memory Dumps and Kernel-Dumps in the simplest definition is a Kernel-Dump contains much more information at the time of the crash, therefore allowing further debugging of your issue. If your upload speed permits it, and you aren't going against any strict bandwidth and/or usage caps, etc, the Kernel-Dump is the best choice. Do note that Kernel-Dumps are much larger in size due to containing much more info, which is why I mentioned upload speed, etc.

    If you are going to use Onedrive but don't know how to upload to it, please visit the following:

    Upload photos and files to Onedrive.

    After doing that, to learn how to share the link to the file if you are unaware, please visit the following link - Share files and folders and change permissions and view 'Get a link'.

    Please note that any "cleaner" programs such as TuneUpUtilities, CCleaner, etc, by default will delete .DMP files upon use. With this said, if you've run such software, you will need to allow the system to crash once again to generate a crash dump.

    If your computer is not generating .DMP files, please do the following:

    1. Start > type %systemroot% which should show the Windows folder, click on it. Once inside that folder, ensure there is a Minidump folder created. If not, CTRL-SHIFT-N to make a New Folder and name it Minidump.

    2. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Performance > Settings > Advanced > Ensure there's a check-mark for 'Automatically manage paging file size for all drives'.

    3. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Startup and Recovery > Settings > System Failure > ensure there is a check mark next to 'Write an event to the system log'.

    Ensure Small Memory Dump is selected and ensure the path is %systemroot%\Minidump.

    4. Double check that the WERS is ENABLED:

    Start > Search > type services.msc > Under the name tab, find Windows Error Reporting Service > If the status of the service is not Started then right click it and select Start. Also ensure that under Startup Type it is set to Automatic rather than Manual. You can do this by right clicking it, selecting properties, and under General selecting startup type to 'Automatic', and then click Apply.

    If you cannot get into normal mode to do any of this, please do this via Safe Mode.

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Friday, July 11, 2014 1:26 PM
  • Hi Patrick,

    Here is the link to the .DMP files as requested, thanks for helping

    https://onedrive.live.com/redir?resid=61A126FB578BD900!531&authkey=!ANod3bve6pI01cI&ithint=file%2c.zip

    Saturday, July 12, 2014 7:30 AM
  • Thanks very much!

    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

    This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

    A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high. This bug check is usually caused by drivers that have used improper addresses.

    2: kd> .bugcheck
    Bugcheck code 000000D1
    Arguments 00000000`000000b8 00000000`00000002 00000000`00000000 fffff800`816b770a
    

    Right away we can assume that due to the 1st argument being 00000000000000b8, this is a completely invalid address. We can confirm this just to be sure:

    2: kd> !pte 00000000000000b8
                                               VA 00000000000000b8
    PXE at FFFFF6FB7DBED000    PPE at FFFFF6FB7DA00000    PDE at FFFFF6FB40000000    PTE at FFFFF68000000000
    contains 098000012E970867  contains 76C000016D811867  contains 040000016DA32867  contains 0000000000000000
    GetUlongFromAddress: unable to read from fffff80024bcb104
    pfn 12e970    ---DA--UWEV  pfn 16d811    ---DA--UWEV  pfn 16da32    ---DA--UWEV  not valid
    

    2: kd> k
    Child-SP          RetAddr           Call Site
    ffffd001`3be48508 fffff800`249d6ae9 nt!KeBugCheckEx
    ffffd001`3be48510 fffff800`249d533a nt!KiBugCheckDispatch+0x69
    ffffd001`3be48650 fffff800`816b770a nt!KiPageFault+0x23a
    ffffd001`3be487e0 fffff800`816c4364 Wdf01000!FxRequest::CompleteInternal+0x4a
    ffffd001`3be488a0 fffff800`83b1ef16 Wdf01000!imp_WdfRequestComplete+0x8c
    ffffd001`3be48910 fffff800`83b1f684 USBXHCI!Bulk_Transfer_CompleteCancelable+0x15a
    ffffd001`3be48970 fffff800`83b1fd0d USBXHCI!Bulk_ProcessTransferEventWithHaltedCompletion+0x124
    ffffd001`3be489d0 fffff800`83b0d02b USBXHCI!Bulk_ProcessTransferEventWithED1+0x229
    ffffd001`3be48a80 fffff800`8174fc81 USBXHCI!Interrupter_WdfEvtInterruptDpc+0x427
    ffffd001`3be48b80 fffff800`248d11e0 Wdf01000!FxInterrupt::DpcHandler+0xc1
    ffffd001`3be48bb0 fffff800`248d03fb nt!KiExecuteAllDpcs+0x1b0
    ffffd001`3be48d00 fffff800`249ce0d5 nt!KiRetireDpcList+0xdb
    ffffd001`3be48fb0 fffff800`249cded9 nt!KxRetireDpcList+0x5
    ffffd001`4b31a7b0 00000000`00000000 nt!KiDispatchInterruptContinue
    

    The USBXHCI.sys driver, specifically USBXHCI!Bulk_Transfer_CompleteCancelable+0x15a is the driver that attempted to access completely invalid memory within kernel-mode, therefore the box bug checked. This is a Windows system driver, therefore something 3rd party is causing conflicts.

    1. Uninstall AOMEI Backupper ASAP, terrible drivers.

    2. Remove and replace Norton with Windows 8's built-in Windows Defender for temporary troubleshooting purposes as it's very likely causing USB conflicts:

    Norton removal - https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us;jsessionid=841A6D40BA6872C47697C6C6B19C8E11.4?entsrc=redirect_pubweb&pvid=f-home

    Windows Defender (how to turn on after removal) - http://www.eightforums.com/tutorials/21962-windows-defender-turn-off-windows-8-a.html

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    • Marked as answer by Timtam123 Sunday, July 13, 2014 2:45 AM
    Saturday, July 12, 2014 1:25 PM
  • Ok removed the things you recommended then transferred the large files back and forth that I previously had trouble with. No BSOD crashes at all I think that has resolved the issue, thanks again for your help!

    Regards,

    Tim

    Sunday, July 13, 2014 2:45 AM
  • My pleasure, very glad to hear!

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Sunday, July 13, 2014 2:56 AM