Frequent system-crashes in Windows 8.1

Anonymous
2014-03-30T08:16:45+00:00

My Sony Vaio Tap 11 (model: SVT1121C5E) runs very unstable ever since I bought it about 3 months ago. Almost every day the system crashes, sometimes multiple times. Sometimes with prior bluescreen, Windows colleting data and then stopping at 100%.

Occasionally the device shuts down and automatically restarts.

Sometimes the screen becomes black and the device can be turned off only by holding the power-button for a few seconds.

I´m running Windows 8.1 and all the current device-drivers, bios-update and Windows-updates are installed. I would really need some help here.

The event-viewer has some "Event41, Kernel-Power" entries in the category "critical" such as following: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" /> <EventID>41</EventID> <Version>3</Version> <Level>1</Level> <Task>63</Task> <Opcode>0</Opcode> <Keywords>0x8000000000000002</Keywords> <TimeCreated SystemTime="2014-03-06T10:01:05.426979800Z" /> <EventRecordID>58462</EventRecordID> <Correlation /> <Execution ProcessID="4" ThreadID="8" /> <Channel>System</Channel> <Computer>Parinibbana</Computer> <Security UserID="S-1-5-18" /> </System> - <EventData> <Data Name="BugcheckCode">126</Data> <Data Name="BugcheckParameter1">0xffffffffc0000005</Data> <Data Name="BugcheckParameter2">0xfffff80077ebbb76</Data> <Data Name="BugcheckParameter3">0xffffd00026b5b638</Data> <Data Name="BugcheckParameter4">0xffffd00026b5ae40</Data> <Data Name="SleepInProgress">0</Data> <Data Name="PowerButtonTimestamp">0</Data> <Data Name="BootAppStatus">0</Data> </EventData> </Event>

Another frequently occurring error is "LoadPerf" with EventID: 3012 The general-tab says: "The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section."

In the details of the XML-view it says: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" /> <EventID>41</EventID> <Version>3</Version> <Level>1</Level> <Task>63</Task> <Opcode>0</Opcode> <Keywords>0x8000000000000002</Keywords> <TimeCreated SystemTime="2014-03-06T10:01:05.426979800Z" /> <EventRecordID>58462</EventRecordID> <Correlation /> <Execution ProcessID="4" ThreadID="8" /> <Channel>System</Channel> <Computer>Parinibbana</Computer> <Security UserID="S-1-5-18" /> </System> - <EventData> <Data Name="BugcheckCode">126</Data> <Data Name="BugcheckParameter1">0xffffffffc0000005</Data> <Data Name="BugcheckParameter2">0xfffff80077ebbb76</Data> <Data Name="BugcheckParameter3">0xffffd00026b5b638</Data> <Data Name="BugcheckParameter4">0xffffd00026b5ae40</Data> <Data Name="SleepInProgress">0</Data> <Data Name="PowerButtonTimestamp">0</Data> <Data Name="BootAppStatus">0</Data> </EventData> </Event>

In order to get a clearer picture of my system-crashes I downloaded a software called "WhoCrashed", clicked on "Analyse" and the following is the result of it´s log:

System Information (local) computer name: PARINIBBANA windows version: Windows 8 , 6.2, build: 9200 windows dir: C:\WINDOWS Hardware: SVT1121C5E, Sony Corporation, VAIO CPU: GenuineIntel Intel(R) Core(TM) i7-4610Y CPU @ 1.70GHz Intel586, level: 6 4 logical processors, active mask: 15 RAM: 4185702400 total VM: 2147352576, free: 1916170240 Crash Dump Analysis Crash dump directory: C:\WINDOWS\Minidump Crash dumps are enabled on your computer.

On Wed 19.03.2014 22:18:28 GMT your computer crashed crash dump file: C:\WINDOWS\memory.dmp This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0) Bugcheck code: 0x9F (0x3, 0xFFFFE00008DC4410, 0xFFFFF80289209840, 0xFFFFE0000172C010) Error: DRIVER_POWER_STATE_FAILURE Bug check description: This bug check indicates that the driver is in an inconsistent or invalid power state. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Wed 19.03.2014 08:12:08 GMT your computer crashed crash dump file: C:\WINDOWS\Minidump\031914-5859-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x150B36) Bugcheck code: 0x9F (0x4, 0x12C, 0xFFFFE00000F14880, 0xFFFFF800EDD7E860) Error: DRIVER_POWER_STATE_FAILURE file path: C:\WINDOWS\system32\ntoskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This bug check indicates that the driver is in an inconsistent or invalid power state. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Sun 16.03.2014 15:16:25 GMT your computer crashed crash dump file: C:\WINDOWS\Minidump\031614-7609-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x14DCA0) Bugcheck code: 0xA (0x0, 0x2, 0x0, 0xFFFFF802530BD533) Error: IRQL_NOT_LESS_OR_EQUAL file path: C:\WINDOWS\system32\ntoskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Sun 16.03.2014 15:16:25 GMT your computer crashed crash dump file: C:\WINDOWS\memory.dmp This was probably caused by the following module: nuserver64.sys (NUServer64+0x17C13) Bugcheck code: 0xA (0x0, 0x2, 0x0, 0xFFFFF802530BD533) Error: IRQL_NOT_LESS_OR_EQUAL file path: C:\WINDOWS\system32\drivers\nuserver64.sys product: Network USB Server company: Elite Silicon Technology Inc. description: Network USB Server 64bit Device Driver Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: nuserver64.sys (Network USB Server 64bit Device Driver, Elite Silicon Technology Inc.). Google query: Elite Silicon Technology Inc. IRQL_NOT_LESS_OR_EQUAL

On Thu 06.03.2014 10:00:19 GMT your computer crashed crash dump file: C:\WINDOWS\Minidump\030614-7234-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0xADB76) Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF80077EBBB76, 0xFFFFD00026B5B638, 0xFFFFD00026B5AE40) Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M file path: C:\WINDOWS\system32\ntoskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a system thread generated an exception which the error handler did not catch. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Thu 06.03.2014 04:55:47 GMT your computer crashed crash dump file: C:\WINDOWS\Minidump\030614-6921-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x14DCA0) Bugcheck code: 0xA (0x1, 0x2, 0x0, 0xFFFFF800060AE5D1) Error: IRQL_NOT_LESS_OR_EQUAL file path: C:\WINDOWS\system32\ntoskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Thu 06.03.2014 03:58:36 GMT your computer crashed crash dump file: C:\WINDOWS\Minidump\030614-6015-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x425637) Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF803D029D637, 0xFFFFD000237F57D8, 0xFFFFD000237F4FE0) Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M file path: C:\WINDOWS\system32\ntoskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a system thread generated an exception which the error handler did not catch. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Wed 26.02.2014 21:57:39 GMT your computer crashed crash dump file: C:\WINDOWS\Minidump\022714-5343-01.dmp This was probably caused by the following module: netwbw02.sys (0xFFFFF8000284FDFC) Bugcheck code: 0xD1 (0x40, 0x2, 0x0, 0xFFFFF8000284FDFC) Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL file path: C:\WINDOWS\system32\drivers\netwbw02.sys product: Intel® Wireless WiFi Link Adapter company: Intel Corporation description: Intel® Wireless WiFi Link Driver Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: netwbw02.sys (Intel® Wireless WiFi Link Driver, Intel Corporation). Google query: Intel Corporation DRIVER_IRQL_NOT_LESS_OR_EQUAL

On Tue 25.02.2014 08:27:36 GMT your computer crashed crash dump file: C:\WINDOWS\Minidump\022514-7359-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x425637) Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF8023C840637, 0xFFFFD000397EA7D8, 0xFFFFD000397E9FE0) Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M file path: C:\WINDOWS\system32\ntoskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a system thread generated an exception which the error handler did not catch. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Sun 26.01.2014 06:29:07 GMT your computer crashed crash dump file: C:\WINDOWS\Minidump\012614-6859-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x14DCA0) Bugcheck code: 0x4E (0x9A, 0x1553B7, 0x6, 0x2) Error: PFN_LIST_CORRUPT file path: C:\WINDOWS\system32\ntoskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that the page frame number (PFN) list is corrupted. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules. The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Tue 21.01.2014 12:42:17 GMT your computer crashed crash dump file: C:\WINDOWS\Minidump\012114-6000-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x425637) Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF80120A2E637, 0xFFFFD00026ECC7D8, 0xFFFFD00026ECBFE0) Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M file path: C:\WINDOWS\system32\ntoskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a system thread generated an exception which the error handler did not catch. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

Conclusion

32 crash dumps have been found and analyzed. Only 10 are included in this report. 2 third party drivers have been identified to be causing system crashes on your computer. It is strongly suggested that you check for updates for these drivers on their company websites. Click on the links below to search with Google for updates for these drivers: netwbw02.sys (Intel® Wireless WiFi Link Driver, Intel Corporation) nuserver64.sys (Network USB Server 64bit Device Driver, Elite Silicon Technology Inc.) If no updates for these drivers are available, try searching with Google on the names of these drivers in combination the errors that have been reported for these drivers and include the brand and model name of your computer as well in the query. This often yields interesting results from discussions from users who have been experiencing similar problems. End of WhoCrashed´s Analysis.

For more information I have put the Windows event-viewer

a) application events

b) system events

c) Windows Power Shell logs, 

as well as the dumpfile-list on my dropbox: https://www.dropbox.com/sh/l840x044kepyrna/aSIqO7PmqC 

Please feel free to have a look at them too.

For comments and suggestions I would be very grateful.

Thanks

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

54 answers

Sort by: Newest
  1. Anonymous
    2014-05-09T01:18:49+00:00

    Hello Patrick,

    Here is the latest news:

    As recommended I made a fresh install of Windows, and voila - an entire week without crash.

    After that week I started to install software. I started with the USB-Hub, which seemed most suspicious for my crashes. And guess what - after I installed the Sharkoon USB-LAN HUB software, the crashes came back.

    I think we found the culprit.

    After that I uninstalled the software and manually removed the remaining registry-entries that I could clearly identify as belonging to the software, hoping that in this way I could get rid of the crashes again. (all entries containing one of these terms: sharkoon; nuserver; usb server; usbserver; nus_bus)

    That, however, didn't work out so far.

    The question now is, where and why the software still causes crashes? How to find and identify the remaining traces of this product that causes the instability of my system.

    Is there a way to find out what exactly the setup-program does when installing the software? Which entries in the registry does it make etc.?

    Here is the link to the product: http://www.sharkoon.com/?q=en/content/usb-lanport-400-giga

    The 18 MB installation file that causes the problem is inside "LANPortXP_W8.1_13_1112_0057.zip".

    I would really like to solve this problem, rather than re-installing Windows afresh without the USB-LAN HUB. The reason is, that I had many complex software-settings done one my original system, to which I would like to revert (restoration by system-image), as soon as I have found out how to get rid of the system-crash issue.

    So to sum up: How can we identify the remaining traces of that Sharkoon-software in my system?

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2014-04-12T14:06:16+00:00

    Absolutely not, don't download that and/or any other .dll's, etc, from the internet.

    I unfortunately only have access to W7-based files, sorry. You could try a Refresh/Reset, but given you have corrupt files, it may prompt you to insert the install media to access said files, and since you do not have that, it won't work. It may be worth a try.

    You could contact the manufacturer and have them ship you an OS/recovery DVD.

    Regards,

    Patrick

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2014-04-12T13:44:31+00:00

    The filesize of the deviceregistration.dll on my system is 0 KB.

    That´s certainly not quite right.

    Since Windows8 was pre-installed on my system I haven't got a CD with the OS from which I could pull the file. It seems I have to rely on online-versions, but am not sure whether the sources are trustworthy or not.

    What do you think about: http://systemexplorer.net/file-database/file/deviceregistration-dll/21514147

    Or otherwise, do you have access to a Windows 8 (8.1) based machine from which you could provide me the file?

    Was this answer helpful?

    0 comments No comments
  4. Anonymous
    2014-04-12T13:09:14+00:00

    You can try manually replacing the file via the installation media - http://www.sevenforums.com/tutorials/42776-extract-files-windows-7-installation-dvd.html

    Note that this applies to W7, however, it should be similar to 8.

    Regards,

    Patrick

    Was this answer helpful?

    0 comments No comments
  5. Anonymous
    2014-04-12T12:53:24+00:00

    I just ran the "sfc /scannow" command which starts the Windows "System File Checker (SFC)".

    When the scan was finished I got the following report: 

    "Windows Resource Protection found corrupt files but was unable to fix some

    of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log." 

    Searching the logfile for the word "corrupt" I get the following entries:

    2014-04-12 18:43:40, Info                  CSI    00000163 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"??\C:\WINDOWS\System32"[l:44{22}]"deviceregistration.dll"; source file in store is also corrupted

    2014-04-12 19:18:11, Info                  CSI    00000b18 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"??\C:\WINDOWS\System32"[l:44{22}]"deviceregistration.dll"; source file in store is also corrupted

    014-04-12 19:41:13, Info                  CSI    00001381 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"??\C:\WINDOWS\System32"[l:44{22}]"deviceregistration.dll"; source file in store is also corrupted

    For the complete logfile, pls see "CBS.log" from my dropbox-link: https://www.dropbox.com/sh/l840x044kepyrna/aSIqO7PmqC

    So what is this deviceregistration.dll that gives this issue? Can it be replaced by another version?

    Was this answer helpful?

    0 comments No comments