# Help with "Windows has recovered from unexpected shutdown"



## jcgriff2 (Sep 30, 2007)

rd0105 said:


> Hello jcgriff2,
> I came to this site through a Google search for a fix of a recurring problem.
> "Windows has recovered from an unexpected shutdown"
> In hopes that you or another would be willing and able to help me I am posting the Zip file of my minidump folder. This sounds just like vistauser's problem. I hope it is one that can be fixxed...
> ...





Hi rd0105. . . 

The error that you have received may or not be the same, but I must ask that you start your own thread on this matter. Doing this will ensure that all in that thread relates to you and to you only.

Once you have done this, please PM me so I can respond. In the interim, I will download your dump files and run them through the debugger as time permits. OK?

Also, please download and execute Belarc Advisor, save the report and upload it here in your thread. Please save it as an mht/html document by selecting "Page" top right of ie7; then "Save as" - save it to your HDD; and upload and attach. Click *HERE* for the download site. Be sure to remove the product key code in the report as I do not need to see them.


Regards. . .

jcgriff2


----------



## rd0105 (Mar 14, 2008)

*"Windows has recovered from an unexpected shutdown"*

I am starting a new thread for "Windows has recovered from an unexpected shutdown"
In hopes that someone can help me. I am posting the Zip file of my minidump folder with a Belarc Advisor mht/html document included. I hope it can be fixxed...
Thanks in advance.
rd0105


----------



## jcgriff2 (Sep 30, 2007)

*Re: "Windows has recovered from an unexpected shutdown"*



rd0105 said:


> I am starting a new thread for "Windows has recovered from an unexpected shutdown"
> In hopes that someone can help me. I am posting the Zip file of my minidump folder with a Belarc Advisor mht/html document included. I hope it can be fixxed...
> Thanks in advance.
> rd0105





Hi rd105. . .

Welcome to your own thread in the Tech Support Forum - Vista!

Thanks for making the new thread. Now we can concentrate on your issues and yours alone.

I have downloaded the minidumps and the Belarc report (I should have looked before I asked!). They are running now and I expect results later today. OK??

Regards. . .

JC


----------



## rd0105 (Mar 14, 2008)

*Re: "Windows has recovered from an unexpected shutdown"*

Greetings jcgriff2,

I'll be checking back tomorrow.
This is an awesome place!

Thanks,

rd


----------



## jcgriff2 (Sep 30, 2007)

*Re: "Windows has recovered from an unexpected shutdown"*



Greetings rd105. . .

I hope that all is going well tonight.

I have the results of the 33 minidumps that you submitted. 32 of these BSOD related minidumps reveal one faulting system driver - "USBEHCI.sys".

The debugger information on this driver is as follows:


```
InternalName:         USBEHCI.sys
    OriginalFilename:  USBEHCI.sys
    ProductVersion:   6.0.6000.16553
    FileVersion:         6.0.6000.16553 (vista_gdr.070830-1500)
    FileDescription:    EHCI eUSB Miniport Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved
\\\
 BUGCODE_USB_DRIVER (fe)
USB Driver bugcheck, first parameter is USB bugcheck code.
Arguments:
Arg1: 00000005, USBBUGCODE_INVALID_PHYSICAL_ADDRESS 
The host controller is using a physical memory address that was not allocated by
	the USBport driver.
Arg2: 87bbe0e0, Device extension pointer of the host controller
Arg3: 10de026e, PCI Vendor,Product id for the controller
Arg4: 88c7b1bc, Pointer to Endpoint data structure
```
The area highlighted in red says it all - incompatibility issues between the USB device and Vista. One of your four USB devices or something related to one is the likely cause here.

The first BSOD memory dump submitted dated January 25, 2008, was caused by a memory leak in a system driver while being accessed by the Vista executable file " ntkrpamp.exe".

I don't believe it is worth while at this time to be too concerned with the BSOD related to "ntkrpamp" as it may have just been the precursor to the USB BSODs. However, I should note that this BSOD occurred about one month prior to the initial USB related BSODs. Therefore, perform the following system scan and repair to ensure system file integrity:

From an Elevated command prompt *(START | type cmd.exe | Right-click on "Run as Administrator")* type the following:

*sfc /scannow* 

There is a space before the "/" 

I would also like you to check in with the Device Manager to see if there are any driver issues noted therein.

Finally, one of my systems suffered a USB problem around the same time as you. I never did resolve it as I had to re-install Vista due to another issue. I am attaching five screen shots in this post and four in the next one depicting the trouble I had.

Should the BSODs return after a thorough check of the USB devices, gather the usual minidumps and POST again... OK?

Godspeed.

JC


----------



## jcgriff2 (Sep 30, 2007)

Here are the other four screen shots.

JC


----------



## rd0105 (Mar 14, 2008)

JC,

I replaced a USB extension cable with a longer single cable to connect the Hub.
I eliminated one USB wireless mouse receiver. (Now the mouse and keyboard talk to the same receiver)
I unplugged my Ipod dock just because...
I am still using the USB Hub but it will go too if I get another "Windows has recovered from an unexpected shutdown" message.
I will post again after I do the system scan and check device manager.

Thanks for all your help and advice,

rd


----------



## rd0105 (Mar 14, 2008)

JC,

Device manager show no conflicts but then again I removed some of the possible offenders before checking.
The system scan found corrupt files but was not able to fix some of them.

Here are some screen shots.

Thanks,

rd


----------



## jcgriff2 (Sep 30, 2007)

Hello again. . .

Glad to hear of the progress thus far.

In your 4th screenshot - of the DOS box - it mentions a "CBS.log". Please get that, copy it to your desktop, or where ever, then upload to your next post. You may have to rename the file extension from .log to .txt. I will take a look to see what files are corrupt and well go on from there. OK?

Regards. . .

JC


----------



## rd0105 (Mar 14, 2008)

JC,

I just opened the CBS.log with notepad...
Wow there is a lot of data in there!
Let me know if you have any more instructions.

take care,

rd


----------



## rd0105 (Mar 14, 2008)

JC,

Here it is,

Thanks,

rd


----------



## jcgriff2 (Sep 30, 2007)

Hi. . .

I was unable to find any errors or failures within the CBS log with the search methods that I usually employ. I did see the screen shot of the command that you issued. I don't have an immediate answer for you on this. If any other BSODs surface, let me know.


Regards. . .

JC


----------



## rd0105 (Mar 14, 2008)

Thanks again JC.
I'll post again if there are any more BSOD.

take care,

rd


----------



## rd0105 (Mar 14, 2008)

Hey JC,

Bad news.
Well it lasted a few days but I did get another BSOD...
This time it was Black instead of Blue and I had to tell it to continue instead of it just rebooting itself.
I have only had the one BSOD since changing some of the USB connections.
I am posting another zip with only the latest minidump, a few screen shots and the latest Belarc profile.

I just read that there is a Vista SP1

Let me know if there is anything else I can do.

Thanks,

rd


----------



## jcgriff2 (Sep 30, 2007)

Hi rd0105. . .

I ran the minidump and am coming up with the same system driver as before - related to the USB. Here is the debugger information regarding this driver:


```
[color=#000066][size=2][font=arial]
Image name: [B]usbehci.sys[/B]
    Timestamp:        Thu Aug 30 21:19:59 2007 (46D76CBF)
    CheckSum:         00011485
    ImageSize:        0000E000
    File version:     6.0.6000.16553
    Product version:  6.0.6000.16553
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     USBEHCI.sys
    OriginalFilename: USBEHCI.sys
    ProductVersion:   6.0.6000.16553
    FileVersion:      6.0.6000.16553 (vista_gdr.070830-1500)
    FileDescription:  EHCI eUSB Miniport Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.[/color][/size]
```


I have searched in vein over the last few hours for more information. I even went into the Device Manager on three Vista laptops here and went through each item looking for this specific driver and cannot locate it. It is found in every system, including XP's, in the c:\windows\system32\drivers folder. Should I come upon further information on this, I will let you know.

Regards. . .

JC

[/font]


----------



## rd0105 (Mar 14, 2008)

JC,

I found usbehci.sys driver in c:windows\system32\drivers.
It is listed as the driver for all but one of the USB controllers, the one for "USB Mass Storage Device" which is the internal memory card reader.
Here are screen shots of the listed drivers per controller if it helps.

Thanks,

rd


----------



## rd0105 (Mar 14, 2008)

Hi JC,

When it rains it pours.

The video died today while I was at work and when I came home to troubleshoot I found that I had a bad 1 Gig stick of memory...

I came to the conclusion by shutting down and first unseating and reseating the memory in opposite slots and rebooting. 
Video restored! 
But wait my computer properties show only 1022MB memory instead of the 2046MB normally shown??? 
So I shut down and removed one of the sticks and rebooted.
No video again! 
Shut down again switched sticks and rebooted. 
Video restored.
Conclusion a bad 1GB stick of RAM.
Could this have been the root of all the BSOD?
New replacement Memory is on it's way. Till then 1GB RAM...

I'll update if I get any more BSOD.

Also until I've heard the reviews I'm not going to load SP1.
Any thoughts on that?

Thanks,

rd


----------



## jcgriff2 (Sep 30, 2007)

rd0105 said:


> Hi JC,
> 
> When it rains it pours.
> 
> ...





Hi rd0105. . .

I may have found something... Let's see:

Those excellent screen shots you took got me thinking and then investigating once again. I pulled up the Device Manager on all in-house Vista systems looking for the "usbehci.sys" USB driver but could not find it listed - even when comparing the screens with yours. All systems do have it in the \windows\system32\drivers\ folder. Further comparison lead to a difference - the systems here have "Intel(R) ICH8 Family USB Universal Host Controller - 28xx" listed as the description and use different drivers than your system does. Another fascinating item caught my eye - one begging to be looked into further - the Dynamic Link Library (DLL) file named "hcrstco.dll". It is listed in your Device Manager, but not mine. Whenever I see so many consonants together, especially a DLL file, I look into it as I have found more times than not it to be viral. But that is not the case here - at least I have no evidence to suggest such. What I did find is that on October 2, 2007, Microsoft issued Knowledge Base Bulletin 941600 found HERE, entitled "Cumulative update rollup for USB core components in Windows Vista" - and look what is in there - and I quote (see RED highlighted items):


```
[FONT="Arial"][SIZE="2"]File name File version File size Date Time Platform 
[color=#0000FF]Usbccgp.sys 6.0.6000.16553 73,216 31-Aug-2007 01:20 x86 
Usbhub.sys 6.0.6000.16553 192,000 31-Aug-2007 01:20 x86 
Usbccgp.sys 6.0.6000.20672 73,216 31-Aug-2007 01:23 x86 
Usbhub.sys 6.0.6000.20672 193,536 31-Aug-2007 01:24 x86 
Hccoin.dll 6.0.6000.16553 8,704 31-Aug-2007 02:16 x86 
Hcrstco.dll 6.0.6000.16553 8,704 31-Aug-2007 02:16 x86 
Usbd.sys 6.0.6000.16553 5,888 31-Aug-2007 01:19 Not Applicable 
Usbehci.sys 6.0.6000.16553 38,400 31-Aug-2007 01:20 x86 
Usbhub.sys 6.0.6000.16553 192,000 31-Aug-2007 01:20 x86 
Usbohci.sys 6.0.6000.16553 19,456 31-Aug-2007 01:20 x86 
Usbport.sys 6.0.6000.16553 224,768 31-Aug-2007 01:20 x86 
Usbuhci.sys 6.0.6000.16553 23,040 31-Aug-2007 01:20 x86 
Hccoin.dll 6.0.6000.20672 8,704 31-Aug-2007 02:12 x86 
Hcrstco.dll 6.0.6000.20672 8,704 31-Aug-2007 02:12 x86 
Usbd.sys 6.0.6000.20672 5,888 31-Aug-2007 01:23 Not Applicable 
Usbehci.sys 6.0.6000.20672 38,400 31-Aug-2007 01:23 x86 Usbhub.sys 6.0.6000.20672 193,536 31-Aug-2007 01:24 x86 
Usbohci.sys 6.0.6000.20672 19,456 31-Aug-2007 01:23 x86 
Usbport.sys 6.0.6000.20672 224,768 31-Aug-2007 01:23 x86 
Usbuhci.sys 6.0.6000.20672 23,040 31-Aug-2007 01:23 x86 
Update-bf.mum Not Applicable 2,649 31-Aug-2007 14:54 Not Applicable 
Update.mum Not Applicable 4,119 31-Aug-2007 14:54 Not Applicable 
X86_usb.inf_31bf3856ad364e35_6.0.6000.16553_none_c8df17ac11719d11.manifest Not Applicable 2,356 31-Aug-2007 14:54 Not Applicable 
X86_usb.inf_31bf3856ad364e35_6.0.6000.20672_none_c95214552aa05b66.manifest Not Applicable 2,356 31-Aug-2007 14:54 Not Applicable 
X86_usbport.inf_31bf3856ad364e35_6.0.6000.16553_none_bba91029068ceaf8.manifest Not Applicable 5,870 31-Aug-2007 14:54 Not Applicable 
X86_usbport.inf_31bf3856ad364e35_6.0.6000.20672_none_bc1c0cd21fbba94d.manifest Not Applicable 5,870 31-Aug-2007 14:54 Not Applicable [/SIZE][/FONT][/COLOR]
```
As you can see, the problematic driver "usbehci.sys" is listed twice - the first is the version of your current driver, but the second was complied just three minutes later and contains a newer version number and thus is an updated driver! So let's get this update installed - you can find KB941600 HERE.

I suggest that you first create a restore point via System Restore. The system does do this automatically prior to an update, but I have seen cases where the creation of the restore point fails. So do it yourself manually to be on the safe side. Then download the 32-bit (x-86) version of the USB driver updates and install them. This is definitely worth the effort. Once installed, verify via Device Manager that the driver(s) have been updated. An updated driver is what I usually look for in BSOD cases of this nature. I came across this KB earlier in this case, but I can only surmise that I dismissed it when I came across the first driver's information believing it to be the updated version. I can only say to you that I apparently made a mistake of oversight here and apologize for that as you likely incurred additional BSODs as a result.

The memory dumps did not give me cause to suspect that any BSOD may have been related to a hardware issue - including memory. A hardware failure of this type is usually fairly easy to spot as the indicted cause(s) of the BSODs will point toward such or as is typical, will name many unrelated drivers. The case in point led to one primary suspect - the USB driver "usbehci.sys". 

As far as Vista SP1 is concerned - we had reports here that some did receive it via Windows Update starting just over 24 hours ago. I believe that you should install the updated drivers first and see the results. I suggest that you turn Windows Updates off for now and let's see if his works first.

Regards. . .

JC


----------



## rd0105 (Mar 14, 2008)

Hi JC,

After downloading KB941600 and trying to apply it I received the message that "This update does not apply to your system". 

I made 2 attempts to install it with the same message both times.
I'm headed out to work now but I wll do some more digging around tonight.
Oh yeah, I'm on west coast time...

Thanks,

rd


----------



## jcgriff2 (Sep 30, 2007)

Hi again rd0105. . .

Sorry to hear about the driver update not installing. I think that this is certainly worth pursuing as all indications found in the memory dumps point toward usbechi.sys as the faulting driver. Updating this driver with the newer version - if in fact it is a new or different version - can't hurt. At worst, you will have the ability to either restore the system or to roll the driver back.

Please give me some time and I will look into this further. I will have access to another Vista system next week that contains the same version of the USB driver in question. I'll then attempt to install that package myself or try to figure out a way to get that driver in the system for testing purposes.

In the interim -- remember the CBS log? Please get it again and attach to the next post or email it to me at TSFjcgriff2*at*gmail.com (as an attachment, please). I'll take a look to see if there is any additional information pertaining to the driver installation failure. Thanks.

Hang in there... OK??

Regards. . .

JC


----------



## rd0105 (Mar 14, 2008)

Hi JC,

It's been at least 4 days and no BSOD!

Here are the Minidumps again and the CBS.log.

Thanks for taking the time to get to the root of this...

BTY SP1 was waiting for me in my windows update but I did not load it and a couple days later it's not there and not showing as an installed update either. Is that strange?

rd


----------

