0

Hi normally i have more programming type of questions but today i have a good one and o'boy i am so lost. I am trying to tell only the important.

Lets explain the environment:

I am working in a big corp. and here all applications are distributed over network. I am in charge of the installation and distribtion of applications and Operating Systems(Windows 7 32x) which is of course done via an Server-Clientsystem and scripts. Everything is automative and can easily be deployed. In a new installation of an OS the driver are automatically installed.

Now the problem:

Since some weeks we have the problem on the clients that after a not definitive timespane or trigger a bluescreen appears when the client is booting itself. I am deploying Images on the clients which are the laptop models CF-53 and L420. I am creating the images in a VM upfront and install necessary software or windows updates on them. Through this i can be sure there is no malware on them. The Bluescreen tells the root of all anger: IRQL_NO_LESS_OR_EQUAL, some drivers coudn't be loaded. I tried to solve the problem with the windows build repairsystem which did help mir first handed but not everytime. through this is could get my hands on some logs.

My questions:

  • what should i do now?
  • can you lead me to other sites where i can find the help?

What have i done a.k.a investigation: I started my search by sorting out software problems. It would not be the first time some proprietary driver from siemens inflicts some bluescreen. I installed a fresh image on a Laptop model L420 and used a script which automatically logs into the client and reboots them. I let the script run again automatically after a period of time. The result were that applications are not the trigger. The bluescreen came again. After this i started lookin into the logs. The first log was the windows eventmanager which revealed a problem with the installed anti-virus software. Normally it is installed on the image for better protection. I created a new image without it and run the test again while reading other logs. The test failed and the anti-virus software was also not responsible. I read the windows minidump and NTBTlogs which stated that SynTP.sys and acpi.sys could be responsible. SynTP.sys is a driver from Touchpad UltraNav.

I downloaded the lastest version of the driver and improrted it in the serversystem. After another two test queues i could confirm that neither the driver nor an windows update are responsible for it. In the one test queue i installed the driver and updated the operation system till it told me it had no further updates for it. In the other test queue i also manuelly installed the latest driver for the touchpad but did not update windows. The results were the same(Bluescreen with the same Error)

to conclude: I did some research and got the following The Bluescreen happens neverless:

  • installed windows updates, full and none
  • installed latest driver from Touchpad UltraNav, installed and not installed
  • updated driver from windows, there was an update particular for this update
  • installed or not installed anti-virus software
  • Malware can also not be the problem because every image i used for the test were created only for this.

The Bluescreen

 Der NTBTLOG 1: ul.to/ehdsdl5a

 Der NTBTLOG 2: ul.to/dpv4j513

 Der MiniDump:  ul.to/x6dq16cv

UPDATE

I have two testclients right now. First is a Lenovo L420 which was installed via Windows-DVD. I installed the agent of the server system(baramundi) and so far no bluescreens. I want to test if the server system is responsible with for the bluescreens. So far no bluescreens

Second is a Panasonic CF-53 MK3 which was installed through the server system baramundi. The server system uses a cloned image from a vm for the client. I installed the latest driver from synapsis for win7 (thx to magicandre1981 for the link). I also installed the anti-virus client. I wanted to test if i can get a bluescreen on a cloned system with non-generic drivers and the antivirus. In other testruns this was enough to generate the bluescreen. So far no bluescreen.

  • have you tried to update the touchpad driver? – magicandre1981 Apr 4 '17 at 4:30
  • yes with the driver i got from lenovo but it generated a bluescreen. Now i have installed the driver from synapsis. So far so good. – AlaskaStack Apr 11 '17 at 11:39
  • OEMs often provide old drivers on their pages. watch this 2 more days and if everything works, accept my answer – magicandre1981 Apr 11 '17 at 14:10
  • does it work now? If yes, accept my answer to "close" the question. – magicandre1981 Apr 15 '17 at 6:29
  • Yes, i am sorry. It works till now. I am forcing all different models to install the newest synapsis driver i got from the synapsis homepage. – AlaskaStack Apr 24 '17 at 11:56
0

The dump shows that the SynTP.sys (Synaptics Touchpad Driver) as cause:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00001120, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 930e7cfe, address which referenced memory

Debugging Details:
------------------

Unable to load image \SystemRoot\system32\DRIVERS\SynTP.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SynTP.sys
*** ERROR: Module load completed but symbols could not be loaded for SynTP.sys

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING:  7601.23677.x86fre.win7sp1_ldr.170209-0600

SYSTEM_MANUFACTURER:  Panasonic Corporation

SYSTEM_PRODUCT_NAME:  CF-53SAWZ5MG

SYSTEM_SKU:  CF-53SAWZ5MG

SYSTEM_VERSION:  003

BIOS_VENDOR:  American Megatrends Inc.

BIOS_VERSION:  V3.00L11

BIOS_DATE:  07/03/2014

BASEBOARD_MANUFACTURER:  Panasonic Corporation

BASEBOARD_PRODUCT:  CF53-3

BASEBOARD_VERSION:  1

STACK_TEXT: 
00 nt!KiTrap0E
WARNING: Stack unwind information not available. Following frames may be wrong.
01 SynTP
02 SynTP
03 SynTP
04 nt!PopCallPowerSettingCallback
05 nt!PopDispatchPowerSettingCallbacks
06 nt!PopPolicyWorkerNotify
07 nt!PopPolicyWorkerThread
08 nt!ExpWorkerThread
09 nt!PspSystemThreadStartup
0a nt!KiThreadStartup

Image path: \SystemRoot\system32\DRIVERS\SynTP.sys
Image name: SynTP.sys
Browse all global symbols  functions  data
Timestamp:        Tue Nov 11 20:58:21 2014 

Because the driver is from 2014, try to install the latest version.

| improve this answer | |
  • on another test client i installed the latest version of the driver. i download it from lenovo and also installed the windows update for the driver. I got the bluescreen on this testclient. – AlaskaStack Apr 4 '17 at 14:58
  • also share the dumps of the other test clients – magicandre1981 Apr 4 '17 at 15:00
0

Indeed it seems most BSOD error are caused by corrupted system files you have mentioned especially acpi.sys and I have been a victim of such an attack.

Possible resolutions include:

  1. Checking the integrity of acpi.sys by looking at any file size changes (sometimes it appears as a 0 byte file when corrupted)

  2. Replacing acpi.sys in C:\Windows\System32\drivers with the one stored in C:\Windows\WinSxS\ file store for system files - (this is normally where correct system files are stored and sfc/scannow retrieves from this store in case of corruption)

  3. Restore image health online using the following commands:

    Dism /Online /Cleanup-Image /StartComponentCleanup Dism /Online /Cleanup-Image /RestoreHealth

Sometimes its better to cleanup the Windows Component Store altogether and retrieve new fresh files from Microsoft servers and in most cases reolves the problem.

Hope this helps

| improve this answer | |
  • Thanks for your suggestions. 1. I searched for the acpi.sys and found a healthy 268kb big on under ...\system32\drivers 2. I tried the scancommand and it could not find any problems. On both test clients. 3. i am on it. – AlaskaStack Mar 30 '17 at 13:12
  • 3. The terminal tells me that the command "/StartComponentCleanup" and "/RestoreHealth" is unkown in this context.Errorcode 87. I've tried to copy the command but it did not work. – AlaskaStack Mar 30 '17 at 13:25
  • Really? Please check again if you missed some spaces after 'dism" & "online" & "image") – xavier_fakerat Mar 30 '17 at 13:42
  • You should never download the file from a third-party. Any system file will be located within the image you have deployed. – Ramhound Mar 30 '17 at 16:53
  • @Ramhound yes I agree that's why I recommend using dism feature (it automatically downloads form Microsoft servers isn't it? ) The other part had mentioned to check the file from component store WinSxS folder no third-parties invloved here – xavier_fakerat Mar 30 '17 at 16:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.