BSOD - Twice in 3 days, VISTA_DRIVER_FAULT

wolverex · 27 Jul 2010

Hi guys,

I'm new on a forum, thanks to everyone who keeps this place going and service delivered promptly =) kudos to you all

my system crashed twice in the last 3 days so i'm wondering what might have caused it. I have attached the 2 dump files and also copied the debug messages from WinDBG into 2 txt files

Any help is fully appreciated

zigzag3143 · 27 Jul 2010

wolverex said:

Hi guys,

I'm new on a forum, thanks to everyone who keeps this place going and service delivered promptly =) kudos to you all

my system crashed twice in the last 3 days so i'm wondering what might have caused it. I have attached the 2 dump files and also copied the debug messages from WinDBG into 2 txt files

Any help is fully appreciated

Hi wolverex and welcome

These two (bugcheck 1A) are pretty straight forward, memory management. To test your memory I suggest you:

Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Boot from the CD, and leave it running for at least 5 or 6 passes.

Analysis

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\New folder\072710-22510-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02851000 PsLoadedModuleList = 0xfffff800`02a8ee50
Debug session time: Tue Jul 27 00:37:15.321 2010 (GMT-4)
System Uptime: 0 days 13:21:28.179
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5002, fffff70001080000, a8ae, 2000b414fffffffe}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+21b71 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005002, The subtype of the bugcheck.
Arg2: fffff70001080000
Arg3: 000000000000a8ae
Arg4: 2000b414fffffffe

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_5002

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  firefox.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800029298b1 to fffff800028c1600

STACK_TEXT:  
fffff880`08797a68 fffff800`029298b1 : 00000000`0000001a 00000000`00005002 fffff700`01080000 00000000`0000a8ae : nt!KeBugCheckEx
fffff880`08797a70 fffff800`028dbf2c : fffff680`000778b8 fffff880`08797b40 00000000`00000000 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x21b71
fffff880`08797ac0 fffff800`028bf6ee : 00000000`00000001 00000000`00100000 00000000`0a040301 00000000`7efdb000 : nt!MmAccessFault+0xc4c
fffff880`08797c20 00000000`7240801e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0021b434 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7240801e


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+21b71
fffff800`029298b1 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+21b71

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+21b71

BUCKET_ID:  X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+21b71

Followup: MachineOwner
---------

Old drivers from as far back as 2005 that need updating

Code:

DB3G.sys        fffff880`043f9000    fffff880`043fe280    0x00005280    0x436ef527    11/7/2005 02:33:11                        
mfpvbus.sys        fffff880`04360000    fffff880`04363080    0x00003080    0x45388f6d    10/20/2006 04:57:17                        
Pd71Wdm.sys        fffff880`043d0000    fffff880`043dd000    0x0000d000    0x4614bec4    4/5/2007 05:17:56                        
Pd71.sys        fffff880`02c51000    fffff880`02c63000    0x00012000    0x4614bedc    4/5/2007 05:18:20                        
mfpec.sys        fffff880`06b2e000    fffff880`06b37a80    0x00009a80    0x463ea08f    5/6/2007 23:44:15                        
Rt64win7.sys        fffff880`04095000    fffff880`040c7000    0x00032000    0x49a65b0d    2/26/2009 05:04:13                        
dsNcAdpt.sys        fffff880`0405e000    fffff880`0406b000    0x0000d000    0x49d180fd    3/30/2009 22:33:33                        
spldr.sys        fffff880`0174a000    fffff880`01752000    0x00008000    0x4a0858bb    5/11/2009 12:56:27                        
amdxata.sys        fffff880`00ec0000    fffff880`00ecb000    0x0000b000    0x4a12f2eb    5/19/2009 13:56:59

ttran · 27 Jul 2010

Third party antivirus softwares are known for causing BSOD, please remove Avira completely for testing purpose, then if you need an alternative program, you can use Microsoft security essential:
Avira Antivirus Solution - Download AntiVir Removal Tool
http://www.microsoft.com/security_essentials

Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads

Update these drivers:

Code:

fffff880`02c51000 fffff880`02c63000   Pd71     Pd71.sys     Thu Apr 05 16:18:20 2007 (4614BEDC)
fffff880`043d0000 fffff880`043dd000   Pd71Wdm  Pd71Wdm.sys  Thu Apr 05 16:17:56 2007 (4614BEC4)  looks like audio drivers ????

BUGCHECK SUMMARY:

Code:

BugCheck 1A, {5002, fffff70001080000, a8ae, 2000b414fffffffe}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+21b71 )

Followup: MachineOwner
---------

PROCESS_NAME:  firefox.exe
BugCheck 1A, {41790, fffffa8000d291b0, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )

Followup: MachineOwner
---------
PROCESS_NAME:  wmplayer.exe

Edit: Ken is right...stop code 1A is usually memory related, please do what he advise as well

Jonathan_King · 27 Jul 2010

To eliminate as many factors as possible, let's remove some high-risk programs.

First comes Daemon Tools, or whatever other CD virtualization program you have. Run this STPD installer/uninstaller when you're done: DuplexSecure - Downloads

Also, remove Avira and replace it with Microsoft Security Essentials.

Here is the Avira removal tool: http://www.avira.com/en/documents/ut...ninstXPeng.zip

MSE: www.microsoft.com/Security_Essentials/

When you have finished those 2 steps, please enable driver verifier: Using Driver Verifier to identify issues with Drivers

EDIT: I see Ken posted first. Go ahead and follow his instructions first.

wolverex · 27 Jul 2010

Awesome guys I'll be on it

wolverex · 27 Jul 2010

One stick of my ram is crippled ;( showed up many errors

Thanks again

Tews · 27 Jul 2010

You will need to replace that module, but at least you know where your problem was...

Jonathan_King · 27 Jul 2010

Thanks for the report!