locked
Blue Screen error on Windows 7 RRS feed

  • Question

  • Hi 

    I recieved a Blue Screen error last week. I didnt install any new progs or S/ws. I did restore my Laptop (Dell XPS ) using a system restore. But still I received a BS yesterday. I have a dump generated in my system. Also below is the error recorded in the event logs. I suspect it has to do with McAfee. 

    Please investigate and help me with the necessary action. 

    Also do let me know if you want me to upload the dump using MS Skydrive.

    Log Name:      System
    Source:        Microsoft-Windows-WER-SystemErrorReporting
    Date:          12/9/2012 21:07:32
    Event ID:      1001
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      SUDHAN-PC
    Description:
    The computer has rebooted from a bugcheck.  The bugcheck was: 0x000000e1 (0xfffff80003582560, 0x0000000000000002, 0xfffffa8009bd3790, 0xfffffa8009bd3790). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 120912-20295-01.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
        <EventID Qualifiers="16384">1001</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2012-12-10T03:07:32.000000000Z" />
        <EventRecordID>38957</EventRecordID>
        <Correlation />
        <Execution ProcessID="0" ThreadID="0" />
        <Channel>System</Channel>
        <Computer>SUDHAN-PC</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="param1">0x000000e1 (0xfffff80003582560, 0x0000000000000002, 0xfffffa8009bd3790, 0xfffffa8009bd3790)</Data>
        <Data Name="param2">C:\Windows\MEMORY.DMP</Data>
        <Data Name="param3">120912-20295-01</Data>
      </EventData>
    </Event>

    Tuesday, December 11, 2012 1:47 AM

Answers

  • Hi,


    Here is the dump file:

    *******************************************************************************

    *                                                                             *

    *                        Bugcheck Analysis                                    *

    *                                                                             *

    *******************************************************************************

    WORKER_THREAD_RETURNED_AT_BAD_IRQL (e1)

    Arguments:

    Arg1: fffff80003582560, address of worker routine (do ln on this to find guilty driver)

    Arg2: 0000000000000002, IRQL returned at (should have been 0, but isn't).

    Arg3: fffffa8009bd3790, workitem parameter

    Arg4: fffffa8009bd3790, workitem address

    Debugging Details:

    ------------------

    TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2

    FAULTING_IP:

    nt!IopProcessWorkItem+0

    fffff800`03582560 fff3            push    rbx

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

    BUGCHECK_STR:  0xE1

    PROCESS_NAME:  System

    CURRENT_IRQL:  2

    LAST_CONTROL_TRANSFER:  from fffff8000330f4a8 to fffff8000328ffc0

    STACK_TEXT: 

    fffff880`03594b68 fffff800`0330f4a8 : 00000000`000000e1 fffff800`03582560 00000000`00000002 fffffa80`09bd3790 : nt!KeBugCheckEx

    fffff880`03594b70 fffff800`03526e5a : 00000000`00000000 fffffa80`06cdc040 00000000`00000080 fffffa80`06c63400 : nt! ?? ::FNODOBFM::`string'+0x58246

    fffff880`03594c00 fffff800`03280d26 : fffff880`03389180 fffffa80`06cdc040 fffff880`033940c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a

    fffff880`03594c40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

    STACK_COMMAND:  .bugcheck ; kb

    FOLLOWUP_IP:

    nt!IopProcessWorkItem+0

    fffff800`03582560 fff3            push    rbx

    SYMBOL_NAME:  nt!IopProcessWorkItem+0

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

    FAILURE_BUCKET_ID:  X64_0xE1_nt!IopProcessWorkItem+0

    BUCKET_ID:  X64_0xE1_nt!IopProcessWorkItem+0

    Followup: MachineOwner



    I suggest you refer this similar thread WORKER_THREAD_RETURNED_AT_BAD_IRQL (e1) .


    Hope this helps.


    Vincent Wang
    TechNet Community Support

    Monday, December 24, 2012 8:54 AM

All replies

  • Hi 

    Here is the skydrive link that contains the Minidump of my system's crash.

    Please investigate into this and let me know for any issues.

    https://skydrive.live.com/#cid=2E2CEF1CC2EA0C52&id=2E2CEF1CC2EA0C52%21106

    Tuesday, December 11, 2012 2:05 AM
  • The link is expired or not shared.  Try it again

    https://gtipjg.bay.livefilestore.com/y1p7P6gQ60Njlf0eOW_D1hH_tmMjQP2AjJgl72IoiP3_FJLR3Bzru6mF-7pLvTk5nxyOOSw5lCL-VtS_i-as-S0ZKa2S6I4Jcds/Expired%20link2.jpg?psid=1


    MS-MVP 2010, 2011, 2012 Team ZigZag

    Tuesday, December 11, 2012 3:08 AM
  • Hi,


    You can refer to the following link to share the file:


    Use SkyDrive to upload collected files and post screen shot/picture. (Updated: 1/16/2012)

    http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65/


    In addition, according the BSOD error message, you can refer to Bug Check 0xE1: WORKER_THREAD_RETURNED_AT_BAD_IRQL (Windows Debuggers).


    Hope this helps


    Vincent Wang
    TechNet Community Support

    Wednesday, December 12, 2012 1:49 AM
  • HI Vincent 

     Please refer the following link  https://skydrive.live.com/redir?resid=2E2CEF1CC2EA0C52!106&authkey=!AI9DLeX3M1hOoIw  for the mini dump. 

    Thursday, December 20, 2012 5:57 AM
  • Parameshi

    The link is still bad.


    MS-MVP 2010, 2011, 2012 Team ZigZag

    Thursday, December 20, 2012 7:50 AM
  • Hi,


    Here is the dump file:

    *******************************************************************************

    *                                                                             *

    *                        Bugcheck Analysis                                    *

    *                                                                             *

    *******************************************************************************

    WORKER_THREAD_RETURNED_AT_BAD_IRQL (e1)

    Arguments:

    Arg1: fffff80003582560, address of worker routine (do ln on this to find guilty driver)

    Arg2: 0000000000000002, IRQL returned at (should have been 0, but isn't).

    Arg3: fffffa8009bd3790, workitem parameter

    Arg4: fffffa8009bd3790, workitem address

    Debugging Details:

    ------------------

    TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2

    FAULTING_IP:

    nt!IopProcessWorkItem+0

    fffff800`03582560 fff3            push    rbx

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

    BUGCHECK_STR:  0xE1

    PROCESS_NAME:  System

    CURRENT_IRQL:  2

    LAST_CONTROL_TRANSFER:  from fffff8000330f4a8 to fffff8000328ffc0

    STACK_TEXT: 

    fffff880`03594b68 fffff800`0330f4a8 : 00000000`000000e1 fffff800`03582560 00000000`00000002 fffffa80`09bd3790 : nt!KeBugCheckEx

    fffff880`03594b70 fffff800`03526e5a : 00000000`00000000 fffffa80`06cdc040 00000000`00000080 fffffa80`06c63400 : nt! ?? ::FNODOBFM::`string'+0x58246

    fffff880`03594c00 fffff800`03280d26 : fffff880`03389180 fffffa80`06cdc040 fffff880`033940c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a

    fffff880`03594c40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

    STACK_COMMAND:  .bugcheck ; kb

    FOLLOWUP_IP:

    nt!IopProcessWorkItem+0

    fffff800`03582560 fff3            push    rbx

    SYMBOL_NAME:  nt!IopProcessWorkItem+0

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

    FAILURE_BUCKET_ID:  X64_0xE1_nt!IopProcessWorkItem+0

    BUCKET_ID:  X64_0xE1_nt!IopProcessWorkItem+0

    Followup: MachineOwner



    I suggest you refer this similar thread WORKER_THREAD_RETURNED_AT_BAD_IRQL (e1) .


    Hope this helps.


    Vincent Wang
    TechNet Community Support

    Monday, December 24, 2012 8:54 AM