Windows 7: Another BSOD Mystery..

BlueYoshiCoke · 25 Aug 2010

First off, this forum is amazing - I can't believe how much help is offered for those that scurry on in here. I just happened to stumble upon this site while trying to find a solution to these haphazard BSODs that have just started happening today. For the past 5 hours, I've created so many scenarios trying to figure out what the cause of the problem was - but the computer always eventually crashed. Even when I just booted up the computer and let it just sit there, it crashed after 15 minutes.

System Information
Gateway Laptop NV79C47u
Intel Core i5-450M Processor
4GB DDR3 Memory
ATI Mobility Radeon HD 5650, 1 GB VRAM

Windows 7 Home Premium x64
It's the original installed OS - OEM

The Computer's History
This laptop was purchased two weeks ago and has only been used to browse the internet, download security programs (AVG, Zone Alarm, Spybot, etc.), and media players (DivX, iTunes, VLC).

These BSODs have just started happening today for no apparent reason.. and the owner of the laptop leaves for college tomorrow! Horrible timing!

CarlTR6 · 25 Aug 2010

Welcome to the forum, BlueYoshiCoke (interesting handle

). I am about to go eat. One of the other team members will be along to help you. If not, I will take a look when I get back.

Lemur · 25 Aug 2010

Welcome, BlueYoshiCoke,

Please check your wifi nic card.

Event[303]:
Log Name: System
Source: Microsoft-Windows-WLAN-AutoConfig
Date: 2010-08-25T17:10:27.851
Event ID: 10000
Task: N/A
Level: Error
Opcode: Info
Keyword: N/A
User: S-1-5-18
User Name: NT AUTHORITY\SYSTEM
Computer: HKH-PC
Description:
WLAN Extensibility Module has failed to start.

**EDIT**
Atheros AR5B93 Wireless Network Adapter

BlueYoshiCoke · 25 Aug 2010

Quote: Originally Posted by CarlTR6

Welcome to the forum, BlueYoshiCoke (interesting handle

). I am about to go eat. One of the other team members will be along to help you. If not, I will take a look when I get back.

Haha yeah.. it was inspired by my younger brother. He thought this was the funniest thing in the world (it isn't):

And thank you!

Quote: Originally Posted by Lemur

Welcome, BlueYoshiCoke,

Please check your wifi nic card.

Event[303]:
Log Name: System
Source: Microsoft-Windows-WLAN-AutoConfig
Date: 2010-08-25T17:10:27.851
Event ID: 10000
Task: N/A
Level: Error
Opcode: Info
Keyword: N/A
User: S-1-5-18
User Name: NT AUTHORITY\SYSTEM
Computer: HKH-PC
Description:
WLAN Extensibility Module has failed to start.

**EDIT**
Atheros AR5B93 Wireless Network Adapter

Hmm, I disabled the wireless internet on the computer 25 minutes ago and it hasn't crashed (yet), but I've been trying to figure out how I would check the card? I ran a troubleshooter for the wireless network and it didn't provide any information. I'm so used to Windows XP that the Windows 7 environment is still unfamiliar..

Capt.Jack Sparrow · 25 Aug 2010

Hello and Welcome !

You have UNEXPECTED_KERNEL_MODE_TRAP mostly caused by Internet security and you have the most notorious one that can cause BSOD. Uninstall Zone Alarm and AVG completely. Use the Removal Tools to remove them. http://download.zonealarm.com/bin/fr...cpes_clean.exe and AVG - Tools download

Install Microsoft Security Essentials http://www.microsoft.com/security_essentials/

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80050031, 6f8, fffff80002c43798}

Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 )

Followup: MachineOwner
---------

2: kd> !thread;!analyze -v;r;kv;lmtn;lmtsmn;.bugcheck;
GetPointerFromAddress: unable to read from fffff80002eb1000
THREAD fffff8800316dfc0  Cid 0000.0000  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 2
Not impersonating
GetUlongFromAddress: unable to read from fffff80002defb74
Owning Process            fffff80002e02140       Image:         <Unknown>
Attached Process          fffffa8003b4c040       Image:         System
fffff78000000000: Unable to get shared data
Wait Start TickCount      1053903      
Context Switch Count      1674031             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address nt!KiIdleLoop (0xfffff80002c836a0)
Stack Init fffff8800318bdb0 Current fffff8800318bd40
Base fffff8800318c000 Limit fffff88003186000 Call 0
Priority 16 BasePriority 0 UnusualBoost 0 ForegroundBoost 0 IoPriority 0 PagePriority 0
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`03169ce8 fffff800`02c7a469 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`03169cf0 fffff800`02c78932 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`03169e30 fffff800`02c43798 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2 (TrapFrame @ fffff880`03169e30)
fffff880`03185ee0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SeAccessCheckFromState+0x58

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff80002c43798

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002c7a469 to fffff80002c7af00

STACK_TEXT:  
fffff880`03169ce8 fffff800`02c7a469 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`03169cf0 fffff800`02c78932 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`03169e30 fffff800`02c43798 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`03185ee0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SeAccessCheckFromState+0x58


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiDoubleFaultAbort+b2
fffff800`02c78932 90              nop

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiDoubleFaultAbort+b2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2

BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2

Hope this helps,
Captain

BlueYoshiCoke · 25 Aug 2010

Quote: Originally Posted by Capt.Jack Sparrow

Hello and Welcome !

You have UNEXPECTED_KERNEL_MODE_TRAP mostly caused by Internet security and you have the most notorious one that can cause BSOD. Uninstall Zone Alarm and AVG completely. Use the Removal Tools to remove them. http://download.zonealarm.com/bin/fr...cpes_clean.exe and AVG - Tools download

Install Microsoft Security Essentials http://www.microsoft.com/security_essentials/

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80050031, 6f8, fffff80002c43798}

Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 )

Followup: MachineOwner
---------

2: kd> !thread;!analyze -v;r;kv;lmtn;lmtsmn;.bugcheck;
GetPointerFromAddress: unable to read from fffff80002eb1000
THREAD fffff8800316dfc0  Cid 0000.0000  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 2
Not impersonating
GetUlongFromAddress: unable to read from fffff80002defb74
Owning Process            fffff80002e02140       Image:         <Unknown>
Attached Process          fffffa8003b4c040       Image:         System
fffff78000000000: Unable to get shared data
Wait Start TickCount      1053903      
Context Switch Count      1674031             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address nt!KiIdleLoop (0xfffff80002c836a0)
Stack Init fffff8800318bdb0 Current fffff8800318bd40
Base fffff8800318c000 Limit fffff88003186000 Call 0
Priority 16 BasePriority 0 UnusualBoost 0 ForegroundBoost 0 IoPriority 0 PagePriority 0
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`03169ce8 fffff800`02c7a469 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`03169cf0 fffff800`02c78932 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`03169e30 fffff800`02c43798 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2 (TrapFrame @ fffff880`03169e30)
fffff880`03185ee0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SeAccessCheckFromState+0x58

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff80002c43798

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002c7a469 to fffff80002c7af00

STACK_TEXT:  
fffff880`03169ce8 fffff800`02c7a469 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`03169cf0 fffff800`02c78932 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`03169e30 fffff800`02c43798 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`03185ee0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SeAccessCheckFromState+0x58


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiDoubleFaultAbort+b2
fffff800`02c78932 90              nop

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiDoubleFaultAbort+b2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2

BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2

Hope this helps,
Captain

I was thinking it might have something to do with the security software because when I was Googling the problem, a few results came up with people citing that their anti-virus/firewalls/anti-malware programs were causing the crashes.

I'll try the Microsoft programs instead and hopefully everything will be smooth sailing from here on out.

Thank you so much! All of you deserve an award of some sort.

**cluberti** · 25 Aug 2010

OK, this is the third one today, and all have been AVG + ZoneAlarm:

http://support.microsoft.com/kb/981180

I'm with Capt. Jack at this point - remove AVG and ZoneAlarm, install MSE and the hotfix linked above, and you should be good to go.

Tews · 25 Aug 2010

Quote: Originally Posted by BlueYoshiCoke

Thank you so much! All of you deserve an award of some sort.

Actually we got one... Best Windows Seven forum on the Internet for 2009!

Lemur · 25 Aug 2010

Quote: Originally Posted by Tews

Quote: Originally Posted by BlueYoshiCoke

Thank you so much! All of you deserve an award of some sort.

Actually we got one... Best Windows Seven forum on the Internet for 2009!

And 2010, only they don't know it yet

CarlTR6 · 25 Aug 2010

Captain Jack and cluberti are spot on. AVG causes crashes on some Win 7 systems and Zone Alarm is notorious for doing so. I knew some of the team would come along to help you.

I like the video! Cute!

. Post back and let us know how your system is running after you make these changes.

Windows 7: Another BSOD Mystery..

Another BSOD Mystery.. problems?