New
#41
A system driver... Caused by: sytem file corruption, hardware failing, or a device driver that is incompatible with Windows. I note thatCode:Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\xthequwit\123111-21203-01\123111-21203-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (3 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`02c09000 PsLoadedModuleList = 0xfffff800`02e4e670 Debug session time: Sat Dec 31 10:30:06.329 2011 (UTC - 7:00) System Uptime: 0 days 0:53:02.547 Loading Kernel Symbols ............................................................... ................................................................ ...................... Loading User Symbols Loading unloaded module list ....... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {fffffa80e79b0448, 2, 1, fffff80002c8d72c} Probably caused by : ndis.sys ( ndis!ndisReceiveWorkerThread+d0 ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: fffffa80e79b0448, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000001, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff80002c8d72c, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb8100 fffffa80e79b0448 CURRENT_IRQL: 2 FAULTING_IP: nt!KeWaitForSingleObject+17c fffff800`02c8d72c 4c8938 mov qword ptr [rax],r15 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xA PROCESS_NAME: System TRAP_FRAME: fffff8800724da80 -- (.trap 0xfffff8800724da80) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffffa80e79b0448 rbx=0000000000000000 rcx=fffffa80079b0448 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80002c8d72c rsp=fffff8800724dc10 rbp=0000000000000000 r8=fffff78000000008 r9=0000000000000000 r10=0000000000000000 r11=fffff880009e8180 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!KeWaitForSingleObject+0x17c: fffff800`02c8d72c 4c8938 mov qword ptr [rax],r15 ds:61a0:fffffa80`e79b0448=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002c851e9 to fffff80002c85c40 STACK_TEXT: fffff880`0724d938 fffff800`02c851e9 : 00000000`0000000a fffffa80`e79b0448 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx fffff880`0724d940 fffff800`02c83e60 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69 fffff880`0724da80 fffff800`02c8d72c : 00000000`00000002 00000000`00000001 00000000`00000000 00000000`00000001 : nt!KiPageFault+0x260 fffff880`0724dc10 fffff880`0152fe50 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`08621600 : nt!KeWaitForSingleObject+0x17c fffff880`0724dcb0 fffff800`02f20fee : fffff880`06772690 fffffa80`07545b60 00000000`00000080 fffff800`02c7d757 : ndis!ndisReceiveWorkerThread+0xd0 fffff880`0724dd40 fffff800`02c775e6 : fffff880`02f64180 fffffa80`07545b60 fffffa80`07381b60 fffff880`01231cb0 : nt!PspSystemThreadStartup+0x5a fffff880`0724dd80 00000000`00000000 : fffff880`0724e000 fffff880`07248000 fffff880`0724da00 00000000`00000000 : nt!KxStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: ndis!ndisReceiveWorkerThread+d0 fffff880`0152fe50 440f20c5 mov rbp,cr8 SYMBOL_STACK_INDEX: 4 SYMBOL_NAME: ndis!ndisReceiveWorkerThread+d0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: ndis IMAGE_NAME: ndis.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4ce79392 FAILURE_BUCKET_ID: X64_0xA_ndis!ndisReceiveWorkerThread+d0 BUCKET_ID: X64_0xA_ndis!ndisReceiveWorkerThread+d0 Followup: MachineOwner ---------are still loaded. Are they listed in C:\Windows\System32\Drivers as .sys and .sys.bak now?Code:JmtFltr fffff880`0750b000 fffff880`07516580 Fri Sep 28 11:04:57 2007 (46fd3439) 0001641e JmtFltr.sys vhidmini fffff880`0487e000 fffff880`04881680 Fri Sep 28 11:21:57 2007 (46fd3835) 0000ddea vhidmini.sys