locked
Bluescreen X64_0x3B_ks!KspPinPropertyHandler+17a RRS feed

  • Question

  • I have a bluescreen.

    Please assist.

    : kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff88002da02c6, Address of the instruction which caused the bugcheck Arg3: fffff8800a67bf10, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ KEY_VALUES_STRING: 1 STACKHASH_ANALYSIS: 1 TIMELINE_ANALYSIS: 1 DUMP_CLASS: 1 DUMP_QUALIFIER: 401 BUILD_VERSION_STRING: 7601.24308.amd64fre.win7sp1_ldr.181111-0600 SYSTEM_MANUFACTURER: Hewlett-Packard SYSTEM_PRODUCT_NAME: HP ProBook 650 G1 SYSTEM_SKU: F1P85ET#ABH SYSTEM_VERSION: A3009DD10303 BIOS_VENDOR: Hewlett-Packard BIOS_VERSION: L77 Ver. 01.22 BIOS_DATE: 09/26/2014 BASEBOARD_MANUFACTURER: Hewlett-Packard BASEBOARD_PRODUCT: 1993 BASEBOARD_VERSION: KBC Version 16.39 DUMP_TYPE: 1 BUGCHECK_P1: c0000005 BUGCHECK_P2: fffff88002da02c6 BUGCHECK_P3: fffff8800a67bf10 BUGCHECK_P4: 0 EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%p verwijst naar geheugen op 0x%p. Het geheugen kan niet worden %s. FAULTING_IP: ks!KspPinPropertyHandler+17a fffff880`02da02c6 448b0a mov r9d,dword ptr [rdx] CONTEXT: fffff8800a67bf10 -- (.cxr 0xfffff8800a67bf10) rax=fffffa8006d7c248 rbx=0000000000000000 rcx=0000000000000000 rdx=00700052004b0064 rsi=fffffa8006d7c010 rdi=000000000f2a62b8 rip=fffff88002da02c6 rsp=fffff8800a67c8e0 rbp=0000000000000003 r8=0000000000000001 r9=000000000f2a62b8 r10=fffff8a00f1cac10 r11=00000000fffffff8 r12=0000000000000008 r13=fffff8a00f1cac00 r14=00000000ffffffff r15=0000000000000001 iopl=0 nv up ei pl nz ac pe cy cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010213 ks!KspPinPropertyHandler+0x17a: fffff880`02da02c6 448b0a mov r9d,dword ptr [rdx] ds:002b:00700052`004b0064=???????? Resetting default scope CPU_COUNT: 4 CPU_MHZ: a22 CPU_VENDOR: GenuineIntel CPU_FAMILY: 6 CPU_MODEL: 3c CPU_STEPPING: 3 CPU_MICROCODE: 6,3c,3,0 (F,M,S,R) SIG: 16'00000000 (cache) 16'00000000 (init) DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: svchost.exe CURRENT_IRQL: 0 ANALYSIS_SESSION_HOST: V2014-NB02 ANALYSIS_SESSION_TIME: 12-18-2018 10:09:13.0799 ANALYSIS_VERSION: 10.0.18272.1001 amd64fre LAST_CONTROL_TRANSFER: from fffff88002da7aff to fffff88002da02c6 STACK_TEXT: fffff880`0a67c8e0 fffff880`02da7aff : fffffa80`06d7c010 fffffa80`0a70dcf0 fffff8a0`027e28d0 fffffa80`06d7c010 : ks!KspPinPropertyHandler+0x17a fffff880`0a67c930 fffff880`06509ec0 : 00000000`00000000 00000000`00000001 00000000`00000000 fffff8a0`021b4590 : ks!KsPinPropertyHandler+0x1b fffff880`0a67c970 fffff880`02d9b585 : 00000000`00000000 fffffa80`07eabc40 00000000`00000000 fffffa80`06d7c010 : portcls!PcPinPropertyHandler+0x17c fffff880`0a67c9b0 fffff880`02da7a1f : fffffa80`06d7c010 fffff880`00000002 fffff880`0a67cac0 fffff8a0`027e2b00 : ks!KspPropertyHandler+0x715 fffff880`0a67ca10 fffff880`0650a964 : 00000000`00000000 fffff880`0a67cac0 fffffa80`00000001 fffff8a0`027e2b00 : ks!KsPropertyHandler+0x1b fffff880`0a67ca60 fffff880`0651e844 : fffffa80`07eabc40 fffffa80`06d7c010 fffffa80`07eabd90 fffff880`064ed0cb : portcls!PcHandlePropertyWithTable+0x64 fffff880`0a67ca90 fffff880`06509f9d : fffffa80`06d7c010 fffffa80`07eabc40 fffffa80`07eabd90 fffff880`0654bb10 : portcls!CPortFilterWaveRT::DeviceIoControl+0x144 fffff880`0a67caf0 fffff880`02d9b7ab : 00000000`c000000d fffffa80`06d7c248 fffffa80`07eabd90 fffff800`02d52e69 : portcls!DispatchDeviceIoControl+0x79 fffff880`0a67cb20 fffff880`0650906c : 0000c101`f8948a87 00000001`00000003 00000000`00000000 fffffa80`06d7c290 : ks!KsDispatchIrp+0xdb fffff880`0a67cb50 fffff880`064c7a68 : 00000000`00000003 fffffa80`06d7c2d8 00000000`00000000 fffffa80`06d7c290 : portcls!PcDispatchIrp+0x5c fffff880`0a67cb80 fffff880`0654b825 : 00000000`00000000 fffffa80`06d7c290 fffffa80`06d7c248 fffffa80`06d7c010 : HdAudio!IoCtlHandler+0x47c fffff880`0a67cbe0 fffff800`02d45a2a : 00000000`00000002 00000000`00000001 fffffa80`00000000 fffffa80`0a2f1070 : ksthunk!CKernelFilterDevice::DispatchIrp+0x11d fffff880`0a67cc40 fffff800`02f112f1 : fffffa80`0a2f1070 fffffa80`0a2f1070 fffffa80`0a2f1070 fffff880`009ec180 : nt!IopSynchronousServiceTail+0xfa fffff880`0a67ccb0 fffff800`02da2e26 : fffffa80`06dbcf70 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0xc51 fffff880`0a67cdf0 fffff880`02cb73f8 : 00000000`00000002 00000000`00000318 00000000`00000088 00000000`82ac8004 : nt!NtDeviceIoControlFile+0x56 fffff880`0a67ce60 fffff880`02d6b262 : 00000000`00000000 00000000`00000000 fffff880`0a67d0c0 00000000`82ac8004 : aswSnx+0x2e3f8 fffff880`0a67cef0 fffff880`02c8ca20 : 00000000`00000004 20206f49`00000001 00000000`00000000 00000000`00000000 : aswSnx+0xe2262 fffff880`0a67d7d0 fffff880`02c8c96e : fffffa80`080ef770 fffffa80`00000000 00000000`00000001 fffffa80`07649e30 : aswSnx+0x3a20 fffff880`0a67d820 fffff800`02d45a2a : 00000000`00000002 00000000`00000000 fffffa80`090a6f20 fffffa80`080ef770 : aswSnx+0x396e fffff880`0a67d850 fffff800`02f112f1 : fffffa80`090a6f20 00000000`00000088 fffffa80`090a6f20 fffff880`009ec180 : nt!IopSynchronousServiceTail+0xfa fffff880`0a67d8c0 fffff800`02da1cda : 000007fe`fb352101 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0xc51 fffff880`0a67da00 fffff800`02af99d3 : 00000000`00000000 00000000`0260e000 00000000`746c6644 fffff880`0a67daf8 : nt!NtFsControlFile+0x56 fffff880`0a67da70 00000000`76d59c1a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0260e408 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d59c1a THREAD_SHA1_HASH_MOD_FUNC: 7e2c767d24ae4e17d300636574cb7cce75e97e6b THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 4f855d55828b5de189a215bdf475a67516c268a8 THREAD_SHA1_HASH_MOD: cfbb562e3bd54e45928774d2e27dd9c5bcdf3ffd FOLLOWUP_IP: ks!KspPinPropertyHandler+17a fffff880`02da02c6 448b0a mov r9d,dword ptr [rdx] FAULT_INSTR_CODE: 440a8b44 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: ks!KspPinPropertyHandler+17a FOLLOWUP_NAME: MachineOwner MODULE_NAME: ks IMAGE_NAME: ks.sys DEBUG_FLR_IMAGE_TIMESTAMP: 5b84e29b IMAGE_VERSION: 6.1.7601.24240 STACK_COMMAND: .cxr 0xfffff8800a67bf10 ; kb FAILURE_BUCKET_ID: X64_0x3B_ks!KspPinPropertyHandler+17a BUCKET_ID: X64_0x3B_ks!KspPinPropertyHandler+17a PRIMARY_PROBLEM_CLASS: X64_0x3B_ks!KspPinPropertyHandler+17a TARGET_TIME: 2018-12-18T08:50:33.000Z OSBUILD: 7601 OSSERVICEPACK: 1000 SERVICEPACK_NUMBER: 0 OS_REVISION: 0 SUITE_MASK: 272 PRODUCT_TYPE: 1 OSPLATFORM_TYPE: x64 OSNAME: Windows 7 OSEDITION: Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS OS_LOCALE: USER_LCID: 0 OSBUILD_TIMESTAMP: 2018-11-11 17:16:57 BUILDDATESTAMP_STR: 181111-0600 BUILDLAB_STR: win7sp1_ldr BUILDOSVER_STR: 6.1.7601.24308.amd64fre.win7sp1_ldr.181111-0600 ANALYSIS_SESSION_ELAPSED_TIME: 2903 ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:x64_0x3b_ks!ksppinpropertyhandler+17a FAILURE_ID_HASH: {3ce8d699-4e4d-9b63-8955-fa4e74139d53}

    Tuesday, December 18, 2018 9:41 AM

All replies

  • Hi Jeffrey.

    The 0x0000003B (SYSTEM_SERVICE_EXCEPTION) bug check indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code; the "00000000c0000005" value of the first parameter indicates that a memory access violation occurred, probably due to a service running within a svchost.exe instance (the ks.sys module is the Windows Kernel CSA Library file).
    Upload the .DMP file to your OneDrive, make it publicly available and post the URL here, so we can analyze it and try to suggest you a solution.

    Bye.


    Luigi Bruno
    MCP, MOS, MTA, MCTS, MCSA, MCSE

    Tuesday, December 18, 2018 9:50 AM
  • I have added the link of the dump file.

    memory.dmp

    Tuesday, December 18, 2018 10:39 AM
  • I have added the link of the dump file.

    memory.dmp

    The download stopped several times: could you please share it on your OneDrive?

    Bye.


    Luigi Bruno
    MCP, MOS, MTA, MCTS, MCSA, MCSE

    Tuesday, December 18, 2018 12:02 PM
  • Again a new link.

    https://vergezogt-my.sharepoint.com/personal/kris_vergezogt_nl/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkris_vergezogt_nl%2FDocuments%2FVergezogt%2FShared%2FMEMORY%2EDMP&parent=%2Fpersonal%2Fkris_vergezogt_nl%2FDocuments%2FVergezogt%2FShared&slrid=a738ad9e-307d-0000-43d6-461003e9b1e8

    The links is prompting me for credentials: I presume it points to a OneDrive within Office 365 or a private SharePoint MySite I do not have access to.
    Could you upload it to your OneDrive?

    Bye.


    Luigi Bruno
    MCP, MOS, MTA, MCTS, MCSA, MCSE

    Wednesday, December 19, 2018 10:05 AM
  • Thursday, December 20, 2018 2:19 PM
  • When posting into the thread please use one of these share links:

    one drive

    drop box

    google drive

    .

    .

    To evaluate the BSOD please post logs for troubleshooting.

    Using administrative command prompt copy and paste this whole command.

    Make sure the default language is English so that the logs can be scanned and read.

    https://www.tenforums.com/tutorials/3813-language-add-remove-change-windows-10-a.html

    The command will automatically collect the computer files and place them on the desktop.

    Then use 7zip to organize the files and one drive, drop box, or google drive to place share links into the thread for troubleshooting.

    https://support.office.com/en-us/article/Share-OneDrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    This command will automatically collect these files:  msinfo32, mini dumps, drivers, hosts, install, uninstall, services, startup, event viewer files, etc.

    Open administrative command prompt and copy and paste the whole command:

    copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

    There are two files for you to find manually:

    a) C:\Windows\MEMORY.DMP

    Use file explorer > this PC > local C: drive > right upper corner search enter the above to find results.

    b) dxdiag:  

    In the left lower corner search type:  dxdiag > When the DirectX Diagnostic Tool opens click on the next page button so that each tab is opened > click on save all information > save to desktop > post one drive or drop box share link into the thread
    .
    .
    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.
    .
    .
    .
    .
    .


    Thursday, December 20, 2018 3:44 PM
  • https://we.tl/t-sj2prsOW1T

    There are several occurrences of drivers related to Avast Antivirus software, as well as some related to the Intel Graphics Kernel Mode driver.
    First of all try disabling Avast: since the problem occurred within one instance of the Windows Service Host process, it could have been caused by one of those Avast modules running as services.

    Bye.


    Luigi Bruno
    MCP, MOS, MTA, MCTS, MCSA, MCSE

    Thursday, December 20, 2018 3:58 PM