BSOD and atapi.sys

[[email protected]]

Hi,

I am having repeated BSOD crashes, mostly of this sort:

Bug Check String  : UNEXPECTED_KERNEL_MODE_TRAP
Bug Check Code    : 0x1000007f
Parameter 1       : 0x00000008
Parameter 2       : 0x80042000
Parameter 3       : 0x00000000
Parameter 4       : 0x00000000
Caused By Driver  : atapi.sys
Caused By Address : atapi.sys+2e2b
File Description  : IDE/ATAPI Port Driver
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 5.1.2600.5512 (xpsp.080413-2108)
Processor         : 32-bit
Crash Address     : atapi.sys+2e2b
Stack Address 1   : atapi.sys+3c38
Stack Address 2   : atapi.sys+614b
Stack Address 3   : ntoskrnl.exe+6e561

I have attached a file with more information and different sorts of crashes.

I have run the Tweaking repair tool and I have recently done a repair install of XP SP3.

Help would be greatly appreciated.

Phil King

[Shane]

More info on that one
https://msdn.microsoft.com/en-us/library/windows/hardware/ff559244%28v=vs.85%29.aspx

Which can be caused by faulty memory, have you done a memory test yet?

Shane

[[email protected]]

Hi!

What did you change before concerning your hardware?

HDW

  I replaced an Asus DVD player and burner that would no longer burn DVDs with a new one of the same model, but the problem goes back to before that.

[[email protected]]

More info on that one
https://msdn.microsoft.com/en-us/library/windows/hardware/ff559244%28v=vs.85%29.aspx

Which can be caused by faulty memory, have you done a memory test yet?

Shane

Yes, I ran the latest version of memtest86, two passes no errors.

[Shane]

The UNEXPECTED_KERNEL_MODE_TRAP bug check has a value of 0x0000007F. This bug check indicates that the Intel CPU generated a trap and the kernel failed to catch this trap.

This trap could be a bound trap (a trap the kernel is not permitted to catch) or a double fault (a fault that occurred while processing an earlier fault, which always results in a system failure).

0x00000008, or Double Fault, indicates that an exception occurs during a call to the handler for a prior exception. Typically, the two exceptions are handled serially. However, there are several exceptions that cannot be handled serially, and in this situation the processor signals a double fault. There are two common causes of a double fault:

    A kernel stack overflow. This overflow occurs when a guard page is hit, and the kernel tries to push a trap frame. Because there is no stack left, a stack overflow results, causing the double fault. If you think this overview has occurred, use !thread to determine the stack limits, and then use kb (Display Stack Backtrace) with a large parameter (for example, kb 100) to display the full stack.
    A hardware problem.

So a hardware problem can cause it, but so can an infection or bad sectors on a hard drive and a system file is on a bad sector.

So now that we tested memory we can cross that off the list and keep going through a process of elimination

Now I noticed in the log that you posted that it wasnt always the atapy.sis but also a few other files with all the same error.

So a couple of questions

1. have you ran chkdsk c: /r on the system yet to check for bad sectors?
2. Have you ran combofix.exe and tdsskiller.exe yet?

Reason why I ask is on the xp machines I found a lot of infections and rootkits that infected the atapi.sys, and so it would cause a blue screen.

You said the problems where happening before you replaced the dvd drive, so we know that isnt the cause.

have you also made sure to get all the current updates for XP? There was a lot of updates after sp3 and a lot of bug fixes. Even though MS doesnt support XP the updates are still online to be donwloaded, they simply are not making any new updates.

Shane

[[email protected]]

Now I noticed in the log that you posted that it wasnt always the atapy.sis but also a few other files with all the same error.

So a couple of questions

1. have you ran chkdsk c: /r on the system yet to check for bad sectors?

Yes

2. Have you ran combofix.exe and tdsskiller.exe yet?

I just ran tdsskiller, and it did not indicate any problem. Perhaps I need to interpret something.

I did not succeed in running combofix. When it got to the scan portion, it froze the computer, including the clock, twice. I ran it in safe mode, and after 25 minutes, there were no results and no CPU activity and the computer appeared to be frozen except for the clock.

I did run GMER without finding any problem.

You said the problems where happening before you replaced the dvd drive, so we know that isnt the cause.

It has been happening occasionally for quite a while. Then I upgraded Macrium Reflect to v.6. I ran a backup successfully. I ran an incremental backup successfully, but the second incremental caused the BSOD.  It has done this every time that I have tried it. Macrium is not been able to figure out what is causing it. after I upgraded Macrium Reflect, the crashes started occurring more and more frequently.

have you also made sure to get all the current updates for XP?

 Yes.

Thank you.

Phil

[Shane]

File versions is always a good idea to make sure an old version didnt get put on.

it is always possible it is something in the registry as well. The problem with this kind of error is there are SO many different things that can cause it.

Shane