locked
BSOD and computer cannot shut down but restarts with error and WDF01000 file seems to be the issue. RRS feed

  • Question

  • Hello guys,

    Im sure this isnt new but every case is usually different with the BSOD error with the WDF01000 file error.

    I recently ran WinDbg  on the latest minidump file and shows this:


    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\minidump\060613-9765-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
    Machine Name:
    Kernel base = 0xfffff800`03401000 PsLoadedModuleList = 0xfffff800`03644670
    Debug session time: Thu Jun  6 18:44:17.353 2013 (UTC - 10:00)
    System Uptime: 0 days 0:10:27.431
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................
    Loading User Symbols
    Loading unloaded module list

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 10D, {5, 0, 1401, fffffa801d1a6610}

    Probably caused by : Wdf01000.sys ( Wdf01000!imp_WdfDmaTransactionGetCurrentDmaTransferLength+47 )

    Followup: MachineOwner
    ---------

    5: kd>  !analyze -v to get detailed information
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    WDF_VIOLATION (10d)
    The Kernel-Mode Driver Framework was notified that Windows detected an error
    in a framework-based driver. In general, the dump file will yield additional
    information about the driver that caused this bug check.
    Arguments:
    Arg1: 0000000000000005, A framework object handle of the incorrect type was passed to
    a framework object method.
    Arg2: 0000000000000000, The handle value passed in.
    Arg3: 0000000000001401, Reserved.
    Arg4: fffffa801d1a6610, Reserved.

    Debugging Details:
    ------------------


    BUGCHECK_STR:  0x10D_5

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    PROCESS_NAME:  System

    CURRENT_IRQL:  2

    LAST_CONTROL_TRANSFER:  from fffff8800108d073 to fffff80003476c00

    STACK_TEXT:  
    fffff880`030cd838 fffff880`0108d073 : 00000000`0000010d 00000000`00000005 00000000`00000000 00000000`00001401 : nt!KeBugCheckEx
    fffff880`030cd840 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Wdf01000!imp_WdfDmaTransactionGetCurrentDmaTransferLength+0x47


    STACK_COMMAND:  kb

    FOLLOWUP_IP: 
    Wdf01000!imp_WdfDmaTransactionGetCurrentDmaTransferLength+47
    fffff880`0108d073 cc              int     3

    SYMBOL_STACK_INDEX:  1

    SYMBOL_NAME:  Wdf01000!imp_WdfDmaTransactionGetCurrentDmaTransferLength+47

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: Wdf01000

    IMAGE_NAME:  Wdf01000.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  5010aa89

    FAILURE_BUCKET_ID:  X64_0x10D_5_Wdf01000!imp_WdfDmaTransactionGetCurrentDmaTransferLength+47

    BUCKET_ID:  X64_0x10D_5_Wdf01000!imp_WdfDmaTransactionGetCurrentDmaTransferLength+47

    Followup: MachineOwner
    ---------

    5: kd> lmvm Wdf01000
    start             end                 module name
    fffff880`01047000 fffff880`01109000   Wdf01000   (pdb symbols)          c:\symbols\Wdf01000.pdb\FABEC58794454D0D9B539B58E2D0A0922\Wdf01000.pdb
        Loaded symbol image file: Wdf01000.sys
        Mapped memory image file: c:\symbols\Wdf01000.sys\5010AA89c2000\Wdf01000.sys
        Image path: \SystemRoot\system32\drivers\Wdf01000.sys
        Image name: Wdf01000.sys
        Timestamp:        Wed Jul 25 16:25:13 2012 (5010AA89)
        CheckSum:         000CDBF1
        ImageSize:        000C2000
        File version:     1.11.9200.16384
        Product version:  1.11.9200.16384
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        3.7 Driver
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     wdf01000.sys
        OriginalFilename: wdf01000.sys
        ProductVersion:   1.11.9200.16384
        FileVersion:      1.11.9200.16384 (win8_rtm.120725-1247)
        FileDescription:  Kernel Mode Driver Framework Runtime
        LegalCopyright:   © Microsoft Corporation. All rights reserved.

    The computer did go through alot of windows updates and i have a feeling the updates got messed up somewhere. Please help me, and thank you in advance.

    Heres the minidump zip of the crashfiles I have :

    https://skydrive.live.com/redir?resid=C329062B4BECD0AD!105&authkey=!AKh7M4ROrKQ0QeU

    Friday, June 7, 2013 6:55 AM

Answers

  • XDG

    You can remove Applecharger from the system as mobile devices can be charged directly from USB.  No software necessary.

    We need the newest DMPS to tell you more.

    *** WARNING: Unable to verify timestamp for AppleCharger.sys
    *** ERROR: Module load completed but symbols could not be loaded for AppleCharger.sys

    Could not read faulting driver name
    Probably caused by : AppleCharger.sys


    Wanikiya & Dyami--Team Zigzag


    • Marked as answer by XDG DESIGN Friday, June 7, 2013 8:46 AM
    • Edited by ZigZag3143x Friday, June 7, 2013 5:23 PM
    Friday, June 7, 2013 8:29 AM
  • XDG

    You need to remove Applecharger not just disable it.  BSOD'S are always a combination of things and in your combination Applecharger doesnt seem to play nice with others.

    Your iPhone should be able to charge natively using USB if the charger is USB.

    *** WARNING: Unable to verify timestamp for AppleCharger.sys
    *** ERROR: Module load completed but symbols could not be loaded for AppleCharger.sys
    Probably caused by : AppleCharger.sys


    Wanikiya & Dyami--Team Zigzag

    • Marked as answer by XDG DESIGN Saturday, June 8, 2013 9:29 AM
    Friday, June 7, 2013 5:23 PM

All replies

  • XDGD

    These were Related to FLxHCIc.sys xHCI Bus Driver from Fresco Logic.  Yours is 2+ years old.  I would re-install the newest driver available.

    STACK_TEXT:  
    fffff880`030cd838 fffff880`00f40073 : 00000000`0000010d 00000000`00000005 00000000`00000000 00000000`00001401 : nt!KeBugCheckEx
    fffff880`030cd840 fffff880`07204b9a : 00000000`00000000 fffffa80`1d2ef2b0 00000000`00000000 00000000`00000040 : Wdf01000!imp_WdfDmaTransactionGetCurrentDmaTransferLength+0x47
    fffff880`030cd890 00000000`00000000 : fffffa80`1d2ef2b0 00000000`00000000 00000000`00000040 00000000`00000000 : FLxHCIc+0x4b9a

    FOLLOWUP_IP:
    FLxHCIc+4b9a
    fffff880`07204b9a ??              ???
    SYMBOL_STACK_INDEX:  2

    SYMBOL_NAME:  FLxHCIc+4b9a
    MODULE_NAME: FLxHCIc
    IMAGE_NAME:  FLxHCIc.sys
    DEBUG_FLR_IMAGE_TIMESTAMP:  4e897ceb
    FAILURE_BUCKET_ID:  X64_0x10D_5_FLxHCIc+4b9a
    BUCKET_ID:  X64_0x10D_5_FLxHCIc+4b9a


    Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\Users\Ken\Desktop\New folder\060613-10203-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    WARNING: Whitespace at end of path element
    Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
    Machine Name:
    Kernel base = 0xfffff800`0340e000 PsLoadedModuleList = 0xfffff800`03651670
    Debug session time: Thu Jun  6 23:45:23.298 2013 (UTC - 4:00)
    System Uptime: 0 days 14:29:35.501
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................
    BugCheck 10D, {5, 0, 1401, fffffa8018b3de40}

    *** WARNING: Unable to verify timestamp for FLxHCIc.sys
    *** ERROR: Module load completed but symbols could not be loaded for FLxHCIc.sys
    Probably caused by : FLxHCIc.sys ( FLxHCIc+4b9a )

    Followup: MachineOwner
    ---------
    WDF_VIOLATION (10d)
    The Kernel-Mode Driver Framework was notified that Windows detected an error
    in a framework-based driver. In general, the dump file will yield additional
    information about the driver that caused this bug check.
    Arguments:
    Arg1: 0000000000000005, A framework object handle of the incorrect type was passed to
        a framework object method.
    Arg2: 0000000000000000, The handle value passed in.
    Arg3: 0000000000001401, Reserved.
    Arg4: fffffa8018b3de40, Reserved.

    BUGCHECK_STR:  0x10D_5
    CUSTOMER_CRASH_COUNT:  1
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    PROCESS_NAME:  System
    CURRENT_IRQL:  2

    TAG_NOT_DEFINED_c000000f:  FFFFF880030D4FB0
    LAST_CONTROL_TRANSFER:  from fffff88000e46073 to fffff80003483c00

    STACK_TEXT:  
    fffff880`030cd838 fffff880`00e46073 : 00000000`0000010d 00000000`00000005 00000000`00000000 00000000`00001401 : nt!KeBugCheckEx
    fffff880`030cd840 fffff880`0f085b9a : 00000000`00000000 fffffa80`1d3e62b0 00000000`00000000 00000000`00000040 : Wdf01000!imp_WdfDmaTransactionGetCurrentDmaTransferLength+0x47
    fffff880`030cd890 00000000`00000000 : fffffa80`1d3e62b0 00000000`00000000 00000000`00000040 00000000`00000000 : FLxHCIc+0x4b9a


    STACK_COMMAND:  kb
    FOLLOWUP_IP:
    FLxHCIc+4b9a
    fffff880`0f085b9a ??              ???
    SYMBOL_STACK_INDEX:  2
    SYMBOL_NAME:  FLxHCIc+4b9a
    FOLLOWUP_NAME:  MachineOwner
    MODULE_NAME: FLxHCIc
    IMAGE_NAME:  FLxHCIc.sys
    DEBUG_FLR_IMAGE_TIMESTAMP:  4e897ceb
    FAILURE_BUCKET_ID:  X64_0x10D_5_FLxHCIc+4b9a
    BUCKET_ID:  X64_0x10D_5_FLxHCIc+4b9a
    Followup: MachineOwner
    ---------

    Wanikiya & Dyami--Team Zigzag



    Friday, June 7, 2013 7:51 AM
  • Thank you very much for your reply. 

    I have done the above mentioned driver update and install but now when i restart my computer i see blue screen again and  the very first item listed at top says Applecharger.sys .

    Friday, June 7, 2013 8:26 AM
  • XDG

    You can remove Applecharger from the system as mobile devices can be charged directly from USB.  No software necessary.

    We need the newest DMPS to tell you more.

    *** WARNING: Unable to verify timestamp for AppleCharger.sys
    *** ERROR: Module load completed but symbols could not be loaded for AppleCharger.sys

    Could not read faulting driver name
    Probably caused by : AppleCharger.sys


    Wanikiya & Dyami--Team Zigzag


    • Marked as answer by XDG DESIGN Friday, June 7, 2013 8:46 AM
    • Edited by ZigZag3143x Friday, June 7, 2013 5:23 PM
    Friday, June 7, 2013 8:29 AM
  • Thank you very much for your reply again ZigZag,

    I have done the exact same thing mentioned on a different forum which was to disable the Applecharger from the drivers with Autorun software.

    Heres the latest crashdump before I disabled the driver :

    https://skydrive.live.com/redir?resid=C329062B4BECD0AD!114&authkey=!AHm0mRXNRoBpbnU

    Now the only question I have is I am still able to charge an iphone with this computer now? I wonder why apple's software screwed my computer

    What im guessing is it has to do with the GIGABYTE motherboard ON/OFF charger

    • Edited by XDG DESIGN Friday, June 7, 2013 8:40 AM new info
    Friday, June 7, 2013 8:38 AM
  • XDG

    You need to remove Applecharger not just disable it.  BSOD'S are always a combination of things and in your combination Applecharger doesnt seem to play nice with others.

    Your iPhone should be able to charge natively using USB if the charger is USB.

    *** WARNING: Unable to verify timestamp for AppleCharger.sys
    *** ERROR: Module load completed but symbols could not be loaded for AppleCharger.sys
    Probably caused by : AppleCharger.sys


    Wanikiya & Dyami--Team Zigzag

    • Marked as answer by XDG DESIGN Saturday, June 8, 2013 9:29 AM
    Friday, June 7, 2013 5:23 PM
  • Zigzag, 

    Thank you very much for your assistance. I was able to narrow down the root cause. So after several windows update the motherboard driver was incompatible with the system. It turns out that the Gigabyte made motherboards has an optional iphone charger driver that lets you charge phones directly from the motherboard for faster charges. This is the Motherboard's On/Off Applecharger.sys culprit. 

    So i had updated the motherboard first, then downloaded their program to remove the ON/OFF charger driver. Iphone now charges at the normal rate and the computer now properly shuts down and there is no BSOD error.

    Thank you very much for your help again ZigZag!

    Saturday, June 8, 2013 9:29 AM
  • Glad you are working let us know if you need help

    ZZ


    Wanikiya & Dyami--Team Zigzag

    Saturday, June 8, 2013 6:31 PM