Windows 7: BSOD'ing pretty randomly

SomeoneElse · 14 Mar 2011

This has been going on for a few weeks. I'm sure it's a driver issue but the problem is that I'm not really sure which driver it is. If anybody could help it'd be really appreciated.

Running Windows 7 Home Premium 64bit, retail version. I've had this computer for only about two months. My profile has some specs if it helps (can't remember what my motherboard is though :P) Haven't re-installed my OS yet.

Maguscreed · 14 Mar 2011

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880096bf7f0, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+3930356661653133
fffff880`096bf7f0 0807            or      byte ptr [rdi],al

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030ae0e0
 0000000000000000 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  Skype.exe

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff880096c0708 -- (.exr 0xfffff880096c0708)
ExceptionAddress: fffff880040467f6 (IDSvia64+0x00000000000307f6)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff880096c07b0 -- (.trap 0xfffff880096c07b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=7ffffa8004808a18 rbx=0000000000000000 rcx=00000000000000ac
rdx=fffffa80071ebbb8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880040467f6 rsp=fffff880096c0948 rbp=fffff880096c0aa8
 r8=fffffa800724fb38  r9=0000000000000088 r10=00000000000000ac
r11=fffff880096c0aa8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
IDSvia64+0x307f6:
fffff880`040467f6 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002f08bdb to fffff80002e76740

STACK_TEXT:  
fffff880`096bf738 fffff800`02f08bdb : 00000000`0000001e ffffffff`c0000005 fffff880`096bf7f0 00000000`00000000 : nt!KeBugCheckEx
fffff880`096bf740 fffff800`02ec7d30 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KipFatalFilter+0x1b
fffff880`096bf780 fffff800`02ea4d1c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x95d
fffff880`096bf7c0 fffff800`02e9c40d : fffff800`02fc2be4 fffff880`096c22e0 00000000`00000000 fffff800`02e06000 : nt!_C_specific_handler+0x8c
fffff880`096bf830 fffff800`02ea3a90 : fffff800`02fc2be4 fffff880`096bf8a8 fffff880`096c0708 fffff800`02e06000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`096bf860 fffff800`02eb09ef : fffff880`096c0708 fffff880`096bff70 fffff880`00000000 fffffa80`0724f680 : nt!RtlDispatchException+0x410
fffff880`096bff40 fffff800`02e75d82 : fffff880`096c0708 fffffa80`0724fb38 fffff880`096c07b0 00000000`00000000 : nt!KiDispatchException+0x16f
fffff880`096c05d0 fffff800`02e7468a : 00000000`00080000 00000901`0000000f fffffa80`0724fe68 fffffa80`0724fea8 : nt!KiExceptionDispatch+0xc2
fffff880`096c07b0 fffff880`040467f6 : fffff880`0404da6c fffffa80`0724fb38 00000000`00000000 00000000`00000001 : nt!KiGeneralProtectionFault+0x10a
fffff880`096c0948 fffff880`0404da6c : fffffa80`0724fb38 00000000`00000000 00000000`00000001 fffff800`02faa4d3 : IDSvia64+0x307f6
fffff880`096c0950 fffffa80`0724fb38 : 00000000`00000000 00000000`00000001 fffff800`02faa4d3 fffffa80`0724fb18 : IDSvia64+0x37a6c
fffff880`096c0958 00000000`00000000 : 00000000`00000001 fffff800`02faa4d3 fffffa80`0724fb18 fffff880`0404aba8 : 0xfffffa80`0724fb38


STACK_COMMAND:  kb

FOLLOWUP_IP: 
IDSvia64+307f6
fffff880`040467f6 ??              ???

SYMBOL_STACK_INDEX:  9

SYMBOL_NAME:  IDSvia64+307f6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: IDSvia64

IMAGE_NAME:  IDSvia64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4cd47367

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_IDSvia64+307f6

BUCKET_ID:  X64_0x1E_c0000005_IDSvia64+307f6

Followup: MachineOwner
---------

The source of the problem is sadly norton.
All the dumps read essentially the same. It is a norton 'driver' IDSvia64.sys.
I don't know of a fix for this outside of removing norton and choosing a different security software.
Microsoft security essentials is a option, it's not quite as good as norton but it's not known to have any conflicts. It's also free.
http://www.microsoft.com/security_essentials/

There is also AVAST! and AVG which offer free protection (just google them for links)

SomeoneElse · 18 Mar 2011

Still getting BSODs and I used the official Norton Removal Tool. Uploaded another dump.

EDIT: Hmm... actually, I'm guessing the problem is that driver is still there and I need to remove it by hand. But it's midnight at the time of this post so I'll have to do it later :P

SomeoneElse · 19 Mar 2011

Would really appreciate someone taking a look, still getting blue screens.

Maguscreed · 19 Mar 2011

Code:

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002efc589, Address of the instruction which caused the bugcheck
Arg3: fffff88005858ed0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MiCheckForConflictingVadExistence+1d
fffff800`02efc589 483b5120        cmp     rdx,qword ptr [rcx+20h]

CONTEXT:  fffff88005858ed0 -- (.cxr 0xfffff88005858ed0)
rax=00000000000716a5 rbx=0000000000000000 rcx=7ffffa8003b1d830
rdx=00000000000716a0 rsi=fffffa8006b16640 rdi=fffffa800508db30
rip=fffff80002efc589 rsp=fffff880058598a8 rbp=fffffa800508dd48
 r8=00000000716a5fff  r9=00000000716a0000 r10=0000000000000001
r11=fffff88005859b58 r12=fffff88005859b58 r13=fffff88005859b50
r14=0000000000000000 r15=fffffa8006b16640
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
nt!MiCheckForConflictingVadExistence+0x1d:
fffff800`02efc589 483b5120        cmp     rdx,qword ptr [rcx+20h] ds:002b:7ffffa80`03b1d850=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  firefox.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002efc589

STACK_TEXT:  
fffff880`058598a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiCheckForConflictingVadExistence+0x1d


FOLLOWUP_IP: 
nt!MiCheckForConflictingVadExistence+1d
fffff800`02efc589 483b5120        cmp     rdx,qword ptr [rcx+20h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MiCheckForConflictingVadExistence+1d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc791bd

STACK_COMMAND:  .cxr 0xfffff88005858ed0 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x3B_nt!MiCheckForConflictingVadExistence+1d

BUCKET_ID:  X64_0x3B_nt!MiCheckForConflictingVadExistence+1d

Followup: MachineOwner
---------

This points to memory corruption, in the absence of norton.
Best way to check memory is to run memtest86 overnight (5-7 passes minimum)
RAM - Test with Memtest86+
^^that link will run you through how to use the application and where to get it.

SomeoneElse · 23 Mar 2011

I think I've fixed it now. Thanks a lot for helping me!

Windows 7: BSOD'ing pretty randomly

BSOD'ing pretty randomly problems?