BSOD Windows 10 RESOURCE_NOT_OWNED (e3) - possibly CrashPlan

I have been having an intermitant BSOD while running Windows 8.

I'm using WinDbg(x64)

WHEA_UNCORRECTABLE_ERROR (124) comes up often

It looked like CrashPlan from the PROCESS_NAME.

I run crashplan on all my machines, and it isn't something I can turn off and not back up.

I've tried various fixes with doing scans of the hard drives (which I have 4 in this machine).

I upgraded to Windows 10, ensured all updates were complete and it crashed again.

The error is new: RESOURCE_NOT_OWNED (e3)

But the service still shows CrashPlan.

I'm going to turn off the CP Service for a week and see if it stops, but even if it does, I need to find a better solution than to not backup my machine.  No other machine (I have it on 6 other systems) have any issues with CP.

Below is the full dump.

If anyone can read this and see if there is something more than just a bug in the CP software, and suggest something, I would be grateful!

Thank you!

Rich


Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [M:\MEMORY.DMP]
Kernel Bitmap Dump File: Only kernel address space is available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 8 Kernel Version 10586 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 10586.17.amd64fre.th2_release.151121-2308
Machine Name:
Kernel base = 0xfffff803`43211000 PsLoadedModuleList = 0xfffff803`434efc70
Debug session time: Sun Jan  3 10:38:15.858 2016 (UTC - 5:00)
System Uptime: 0 days 8:32:33.509
Loading Kernel Symbols
...............................................................
................................................................
.......................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`00354018).  Type ".hh dbgerr001" for details
Loading unloaded module list
.........................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck E3, {ffffe00018f74410, ffffe0001fa47080, ffffe000221633a0, 3}

*** ERROR: Module load completed but symbols could not be loaded for avgmfx64.sys
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+1857b )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

RESOURCE_NOT_OWNED (e3)
A thread tried to release a resource it did not own.
Arguments:
Arg1: ffffe00018f74410, Address of resource
Arg2: ffffe0001fa47080, Address of thread
Arg3: ffffe000221633a0, Address of owner table if there is one
Arg4: 0000000000000003

Debugging Details:
------------------

Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  0xE3

PROCESS_NAME:  CrashPlanServi

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

LAST_CONTROL_TRANSFER:  from fffff8034337a67b to fffff80343353760

STACK_TEXT:  
ffffd001`a0dddba8 fffff803`4337a67b : 00000000`000000e3 ffffe000`18f74410 ffffe000`1fa47080 ffffe000`221633a0 : nt!KeBugCheckEx
ffffd001`a0dddbb0 fffff800`db00d80e : ffffe000`1f5aa368 ffffe000`1f5aa2f8 ffffe000`16e49102 fffff800`db0cdfcc : nt! ?? ::FNODOBFM::`string'+0x1857b
ffffd001`a0dddc80 fffff800`db00d334 : ffffe000`1f5aa200 ffffd001`00000001 ffffe000`1f5aa278 ffffd001`a2f5a430 : NTFS!NtfsCleanupIrpContext+0x38e
ffffd001`a0dddce0 fffff800`db0c9c55 : ffffe000`1fa47080 ffffe000`18421ca0 00000000`00000001 00000000`00000000 : NTFS!NtfsExtendedCompleteRequestInternal+0x104
ffffd001`a0dddd20 fffff800`db0c5efd : ffffe000`1f5aa278 ffffe000`17f53630 ffffd001`a2f5a430 ffffe000`1f5aa27c : NTFS!NtfsCommonCreate+0x2fb5
ffffd001`a0dddf50 fffff803`43356327 : ffffd001`a2f5a3c0 ffffe000`18796080 ffffe000`18796080 ffffd001`a0762b30 : NTFS!NtfsCommonCreateCallout+0x1d
ffffd001`a0dddf80 fffff803`433562ed : 00000000`00006000 00000000`00000012 ffffd001`a0dde000 fffff803`43286ea1 : nt!KxSwitchKernelStackCallout+0x27
ffffd001`a2f5a200 fffff803`43286ea1 : 00000000`00000006 00000000`00006000 00000000`00000009 ffffe000`1fa47080 : nt!KiSwitchKernelStackContinue
ffffd001`a2f5a220 fffff803`43286c16 : 00000000`00000009 00000000`00006000 ffffd001`a2f5a770 ffffd001`a2f5a2a0 : nt!KiExpandKernelStackAndCalloutOnStackSegment+0x131
ffffd001`a2f5a2a0 fffff803`43286adf : 00000000`00000000 ffffd001`a2f5a3c0 00000000`00000001 ffffe000`17f53630 : nt!KiExpandKernelStackAndCalloutSwitchStack+0xa6
ffffd001`a2f5a300 fffff800`db0ca949 : 00000000`00000000 00000000`00000000 ffffe000`1f5aa278 ffffe000`17f53630 : nt!KeExpandKernelStackAndCalloutInternal+0x2f
ffffd001`a2f5a350 fffff800`d9c67895 : ffffe000`16e49030 ffffe000`17f53630 ffffd001`a2f5a600 ffffe000`17f53630 : NTFS!NtfsFsdCreate+0x1d9
ffffd001`a2f5a570 fffff800`d9c962d7 : ffffe000`18e55920 00000000`000007ff ffffe000`18e55901 00000000`00000801 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x1a5
ffffd001`a2f5a600 fffff803`43605328 : 00000000`00000001 00000000`00000006 00000000`00000060 ffffe000`24809e48 : FLTMGR!FltpCreate+0x347
ffffd001`a2f5a6b0 fffff803`435fbc96 : ffffc001`f4028d88 ffffc001`f4028d88 ffffd001`a2f5a980 ffffe000`18e15c50 : nt!IopParseDevice+0x7c8
ffffd001`a2f5a880 fffff803`435fa69c : ffffe000`180dcb00 ffffd001`a2f5aa90 ffffd001`00000240 ffffe000`16f5ddc0 : nt!ObpLookupObjectName+0x776
ffffd001`a2f5aa20 fffff803`436238c8 : 00000000`00000001 ffffe000`24dac620 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByNameEx+0x1ec
ffffd001`a2f5ab40 fffff803`43622e58 : ffffe000`1d187510 00000000`00000008 ffffd001`a2f5ad58 ffffd001`a2f5ad88 : nt!IopCreateFile+0x3d8
ffffd001`a2f5abf0 fffff800`d9c94932 : ffffe000`1d187480 ffffe000`1d187510 00000000`00000000 ffffc002`0fdd6998 : nt!IoCreateFileEx+0x120
ffffd001`a2f5ac80 fffff800`d9c98466 : ffffd001`a2f5c001 ffffd001`a2f50016 ffffe000`00000000 ffffe000`24809e48 : FLTMGR!FltpExpandFilePathWorker+0x2a2
ffffd001`a2f5adf0 fffff800`d9c97a40 : ffffe000`1d187401 ffffe000`1d187480 00000000`00000000 fffff803`432690bc : FLTMGR!FltpExpandFilePath+0x1a
ffffd001`a2f5ae40 fffff800`d9c97922 : ffffe000`1d187480 ffffd001`a2f56000 00000000`00000000 00000000`c00000bb : FLTMGR!FltpGetNormalizedFileNameWorker+0xb4
ffffd001`a2f5ae80 fffff800`d9c96eb0 : ffffe000`1fa47080 ffffd001`a2f5afd9 ffffe000`2333c580 fffff800`d9c93f71 : FLTMGR!FltpGetNormalizedFileName+0x1a
ffffd001`a2f5aed0 fffff800`d9c6ae87 : c00000bb`a2f5b100 ffffe000`1d187480 ffffe000`2333c580 ffffe000`1c629e50 : FLTMGR!FltpCreateFileNameInformation+0x340
ffffd001`a2f5af20 fffff800`d9c69457 : ffffe000`1c6297e0 ffffe000`1d187480 fffff800`d9c84060 00000000`c00000bb : FLTMGR!HandleStreamListNotSupported+0x113
ffffd001`a2f5af60 fffff800`d9c64a70 : 00000000`c0000034 00000000`00000000 ffffe000`1e009010 00000000`00000000 : FLTMGR!FltpGetFileNameInformation+0x5e7
ffffd001`a2f5b000 fffff800`dc9c51e1 : ffffe000`230c6cd0 ffffe000`2333c5b8 00000000`00120010 fffff800`dc6a9e10 : FLTMGR!FltGetFileNameInformation+0x1b0
ffffd001`a2f5b080 fffff800`d9c66d21 : ffffe000`2333c4e0 ffffd001`a2f5b268 ffffd001`a2f5b250 00000000`00000000 : avgmfx64+0x51e1
ffffd001`a2f5b1f0 fffff800`d9c668cc : ffffd001`a2f5b370 ffffd001`a2f5b300 ffffe000`00000000 00000000`00000000 : FLTMGR!FltpPerformPreCallbacks+0x2f1
ffffd001`a2f5b300 fffff800`d9c962c3 : ffffe000`18e55920 ffffd001`a2f5b350 ffffd001`a2f5b3f8 fffff800`d9c95d5d : FLTMGR!FltpPassThroughInternal+0x8c
ffffd001`a2f5b330 fffff803`43605328 : 00000000`00000000 00000000`00000045 00000000`00000000 00000000`00000001 : FLTMGR!FltpCreate+0x333
ffffd001`a2f5b3e0 fffff803`435fbc96 : ffffc001`f4028d88 ffffc001`f4028d88 ffffd001`a2f5b6b0 ffffe000`18e15c50 : nt!IopParseDevice+0x7c8
ffffd001`a2f5b5b0 fffff803`435fa69c : ffffe000`233e7201 ffffd001`a2f5b7c0 ffffe000`00000040 ffffe000`16f5ddc0 : nt!ObpLookupObjectName+0x776
ffffd001`a2f5b750 fffff803`4362300b : 00000000`00000001 00000000`1010f4a0 00000000`01a82f08 00000000`00000028 : nt!ObOpenObjectByNameEx+0x1ec
ffffd001`a2f5b870 fffff803`4335dfa3 : ffffe000`1fa47080 00000000`ffffffff ffffe000`1fa47080 ffffe000`1f8ade70 : nt!NtQueryFullAttributesFile+0x18b
ffffd001`a2f5bb00 00007ff9`da7c73f4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1010f418 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`da7c73f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+1857b
fffff803`4337a67b cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+1857b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  565189c8

BUCKET_ID_FUNC_OFFSET:  1857b

FAILURE_BUCKET_ID:  0xE3_nt!_??_::FNODOBFM::_string_

BUCKET_ID:  0xE3_nt!_??_::FNODOBFM::_string_

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0xe3_nt!_??_::fnodobfm::_string_

FAILURE_ID_HASH:  {d56602d2-ddd7-783a-b2b0-88383bab84bd}

Followup: MachineOwner
---------

windbg> .hh dbgerr004

Answer
Answer

Driver verified and Related to ndisrd.sys NDISRD helper driver.

There is some ambiguity about who makes this driver.  I can find no definative information about it.  The best I can find is here

http://www.carrona.org/drivers/driver.php?id=ndisrd.sys

I would remove the current driver and install the newest driver available.  Your current one is dated 2013

Cat herder
Windows Insider MVP
MVP-Windows and Devices for IT
http://www.zigzag3143.com/

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

 
 

Question Info


Last updated April 24, 2020 Views 900 Applies to: