Windows 7: NDIS.sys BSOD

Uber Philf · 28 Aug 2010

EUCK! formatted my computer the other day hoping not to get another BSOD, but heres a new one, dump provided.

NDIS.sys.

zigzag3143 · 28 Aug 2010

Quote: Originally Posted by Uber Philf

EUCK! formatted my computer the other day hoping not to get another BSOD, but heres a new one, dump provided.

NDIS.sys.

Enzo

There is a slight disagreement between two tools. One says NIDS.sys, one pacer.sys. Both are win 7 files and so running a system file check to verify and repair them is in order

Run a system file check to verify and repair your system files.
To do this type cmd in search, then right click to run as administrator, then
SFC /SCANNOW

Let us know the results from the report at the end.

Ken

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\082810-18735-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols;*http://msdl.microsoft.com/download/symbols ;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a15000 PsLoadedModuleList = 0xfffff800`02c52e50
Debug session time: Sat Aug 28 01:33:07.469 2010 (GMT-4)
System Uptime: 0 days 0:10:02.967
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff88009fbf778, 0, fffff8800144fc3b, 2}


Could not read faulting driver name
Probably caused by : pacer.sys ( pacer!PcFilterRequestComplete+68 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff88009fbf778, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8800144fc3b, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cbd0e0
 fffff88009fbf778 

FAULTING_IP: 
ndis!ndisOidRequestComplete+9b
fffff880`0144fc3b 803e05          cmp     byte ptr [rsi],5

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  Rainmeter.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88008f3e910 -- (.trap 0xfffff88008f3e910)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000002000d rbx=0000000000000000 rcx=fffff88008f3f160
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800144fc3b rsp=fffff88008f3eaa0 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=fffff880009e6fa0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
ndis!ndisOidRequestComplete+0x9b:
fffff880`0144fc3b 803e05          cmp     byte ptr [rsi],5 ds:0001:00000000`00000000=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002b048f2 to fffff80002a85740

STACK_TEXT:  
fffff880`08f3e7a8 fffff800`02b048f2 : 00000000`00000050 fffff880`09fbf778 00000000`00000000 fffff880`08f3e910 : nt!KeBugCheckEx
fffff880`08f3e7b0 fffff800`02a8382e : 00000000`00000000 fffff880`08f3f160 00000000`c0000000 fffffa80`06714400 : nt! ?? ::FNODOBFM::`string'+0x40ec0
fffff880`08f3e910 fffff880`0144fc3b : 00000000`00000000 fffff880`10b79fa2 fffffa80`0418c9b0 fffff800`02bba2dd : nt!KiPageFault+0x16e
fffff880`08f3eaa0 fffff880`01450be1 : fffff880`08f3f100 00000000`00000000 fffff880`08f3f160 fffffa80`0582a010 : ndis!ndisOidRequestComplete+0x9b
fffff880`08f3eb30 fffff880`02d1c078 : fffffa80`0418c9c0 fffffa80`0582a540 fffff880`08f3f160 fffffa80`0418c900 : ndis!NdisFOidRequestComplete+0x91
fffff880`08f3ebb0 fffff880`0144fde0 : fffffa80`0418ca08 fffffa80`054c11a0 00000000`00000000 fffffa80`054c11a0 : pacer!PcFilterRequestComplete+0x68
fffff880`08f3ebe0 fffff880`014d4a24 : 00000000`00000000 00000000`00000000 fffffa80`0418c9c0 fffffa80`054c11a0 : ndis!ndisOidRequestComplete+0x240
fffff880`08f3ec70 fffff880`01450a19 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`054c1200 : ndis!ndisMDoOidRequest+0x364
fffff880`08f3ed20 fffff880`01450629 : 00000208`00980101 fffff880`014b0110 00000000`00000000 fffffa80`054c11a0 : ndis!ndisFQueueRequestOnNext+0x389
fffff880`08f3ed90 fffff880`02d1c11b : fffff880`08f3f160 00000000`00020106 fffff880`08f3f160 fffffa80`0582a540 : ndis!NdisFOidRequest+0xc9
fffff880`08f3ee70 fffff880`014d4d0b : fffffa80`0418c9c0 fffffa80`0582a010 fffffa80`054c11a0 fffffa80`0582a010 : pacer!PcFilterRequest+0x5b
fffff880`08f3eea0 fffff880`0145022f : fffffa80`00000000 fffffa80`0582a010 fffffa80`054c11a0 fffff880`08f3f160 : ndis!ndisFDoOidRequest+0x21b
fffff880`08f3ef70 fffff880`014541bd : fffffa80`054c1101 fffff880`08f3f160 fffffa80`0582a010 fffff880`01453f00 : ndis!ndisQueueRequestOnTop+0x21f
fffff880`08f3f000 fffff880`01455a53 : fffffa80`054c11a0 fffffa80`0582a010 fffffa80`03fa5350 fffffa80`056701a0 : ndis!ndisQuerySetMiniportEx+0x13d
fffff880`08f3f070 fffff880`0146bc5b : 00500020`0053006f 0065006b`00630061 00630053`00200074 fffff880`08f3f4e8 : ndis!ndisIfGetMiniportStatistics+0x163
fffff880`08f3f2a0 fffff880`014529e3 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis! ?? ::FNODOBFM::`string'+0x95d7
fffff880`08f3f430 fffff880`0145361d : fffffa80`0582a630 00000000`00000000 fffff880`08f3f510 00060000`00000000 : ndis!ndisNsiGetInterfaceRodInformation+0x1c3
fffff880`08f3f4d0 fffff880`015424b6 : fffff880`014b1890 fffffa80`03fa5000 00000000`00000000 fffffa80`06864b00 : ndis!ndisNsiGetAllInterfaceInformation+0x42e
fffff880`08f3f590 fffff880`03e98e29 : fffffa80`03fa5000 00000000`00000070 fffffa80`05375ab0 00000000`0012f470 : NETIO!NsiEnumerateObjectsAllParametersEx+0x6df
fffff880`08f3f770 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nsiproxy!NsippEnumerateObjectsAllParameters+0x305


STACK_COMMAND:  kb

FOLLOWUP_IP: 
pacer!PcFilterRequestComplete+68
fffff880`02d1c078 f0834564ff      lock add dword ptr [rbp+64h],0FFFFFFFFh

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  pacer!PcFilterRequestComplete+68

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: pacer

IMAGE_NAME:  pacer.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bccc5

FAILURE_BUCKET_ID:  X64_0x50_pacer!PcFilterRequestComplete+68

BUCKET_ID:  X64_0x50_pacer!PcFilterRequestComplete+68

Followup: MachineOwner
---------

Uber Philf · 28 Aug 2010

Ok, it found incorrect system files, but they are only the ones ive modified. as in Explorer.exe for the start button, imgres.dll, shell32.dll, zipfldr.dll and authui.dll. Ive read these before so i kinda knew where i was going.

Anything else?

Something i saw in the bsod log u posted, something about rainmeter? is that something i should be concerned about?

Flavius · 28 Aug 2010

Quote: Originally Posted by Uber Philf

Something i saw in the bsod log u posted, something about rainmeter? is that something i should be concerned about?

I almost in 100% sure Rainmeter cause this BSOD.Try update this soft or uninstall it completely and check results...

reventon · 28 Aug 2010

Quote: Originally Posted by Uber Philf

EUCK! formatted my computer the other day hoping not to get another BSOD, but heres a new one, dump provided.

NDIS.sys.

If you have had many BSODs previously then I would suspect hardware - as the problem remaining after a re-format is a sure sign.

This fits in with Microsoft Drivers being blamed here - as well as the fact that your system has only the necessary 3rd Party drivers installed and all appear to be up to date.

Given the STOP code of 0x50 - "Invalid system memory was referenced", my first suspicion here would be the RAM.

Memtest -> RAM - Test with Memtest86+

Just incase one of the few drivers that are present is at fault also turn Driver Verifier on.

Driver Verifier -> Driver Verifier - Enable and Disable

Regards,
Reventon

Uber Philf · 28 Aug 2010

Well the rainmeter would explain a bit, it's a beta copy, ive done runs with memtest before already with suspected RAM issues and came up clean... ill try the rainmeter update & drive verifier.

Windows 7: NDIS.sys BSOD

NDIS.sys BSOD problems?