BSOD: An attempt was made to write to read-only memory

poisonedfire · 31 Dec 2011

My laptop has been crashing for these two days now... Please ignore the minidump before December 2011 because it might be irrelevant?

By the way, I got BSOD "usually" when I play games and video calling through skype.

Hope someone can see what's the problem. Thanks! :)

EDIT: I tried to update my intel wifi driver but it just wont update to the newest version after installing it >.<

System Spec:
HP ENVY 14
Intel(R) Core(TM) i7-2630QM CPU@2.00GHz
RAM: 8GB

Is Windows 7 . . . - x86 (32-bit) or x64 ? x64 - the original installed OS on the system? Yes - an OEM or full retail version? OEM - What is the age of system (hardware)? 4 months - What is the age of OS installation (have you re-installed the OS?) No

writhziden · 31 Dec 2011

Taking a look... Will post back within 10-20 minutes with steps to take. Welcome to SevenForums. :)

writhziden · 31 Dec 2011

Code:


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\PoisonedFire\Windows_NT6_BSOD_jcgriff2\122711-21528-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e5c000 PsLoadedModuleList = 0xfffff800`030a1670
Debug session time: Tue Dec 27 21:37:02.440 2011 (GMT-7)
System Uptime: 0 days 7:21:49.331
Loading Kernel Symbols
...............................................................
................................................................
........................................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff7ffffb9c410, 2, 1, fffff80002e1ab42}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff7ffffb9c410, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002e1ab42, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310b100
 fffff7ffffb9c410 

CURRENT_IRQL:  2

FAULTING_IP: 
hal!HalSendSoftwareInterrupt+a
fffff800`02e1ab42 9c              pushfq

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b9c280 -- (.trap 0xfffff80000b9c280)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000002
rdx=ffffffffffffff02 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e1ab42 rsp=fffff80000b9c418 rbp=0000000000000002
 r8=0000000000000004  r9=000000000000000b r10=fffff80002e5c000
r11=fffff80000b9c470 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
hal!HalSendSoftwareInterrupt+0xa:
fffff800`02e1ab42 9c              pushfq
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ed81e9 to fffff80002ed8c40

STACK_TEXT:  
fffff800`00b9c138 fffff800`02ed81e9 : 00000000`0000000a fffff7ff`ffb9c410 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`00b9c140 fffff800`02ed6e60 : fffffa80`070a11a0 fffffa80`072d2bd0 fffffa80`070a1050 fffff880`03965180 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c280 fffff800`02e1ab42 : fffff800`02edefbd fffff880`03965180 fffffa80`0d560370 fffffa80`00000002 : nt!KiPageFault+0x260
fffff800`00b9c418 fffff800`02edefbd : fffff880`03965180 fffffa80`0d560370 fffffa80`00000002 00000000`000000ff : hal!HalSendSoftwareInterrupt+0xa
fffff800`00b9c420 fffff800`02ee4527 : fffffa80`0bc6ac20 fffffa80`0d560478 fffffa80`0d560478 fffffa80`0dce7670 : nt!KiDeferredReadyThread+0x2fd
fffff800`00b9c4a0 fffff800`02ee437e : 0000003d`b8caf5bc fffff800`00b9cb18 00000000`0019ede9 fffff800`03052fa8 : nt!KiProcessExpiredTimerList+0x157
fffff800`00b9caf0 fffff800`02ee4167 : 0000000c`0729c0ca 0000000c`0019ede9 0000000c`0729c0df 00000000`000000e9 : nt!KiTimerExpiration+0x1be
fffff800`00b9cb90 fffff800`02ed096a : fffff800`0304ee80 fffff800`0305ccc0 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`00b9cc40 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cc00 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`02ed6e60 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0xA_nt!KiPageFault+260

BUCKET_ID:  X64_0xA_nt!KiPageFault+260

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\PoisonedFire\Windows_NT6_BSOD_jcgriff2\122811-18470-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e0b000 PsLoadedModuleList = 0xfffff800`03050670
Debug session time: Wed Dec 28 19:27:56.593 2011 (GMT-7)
System Uptime: 0 days 2:44:14.499
Loading Kernel Symbols
...............................................................
................................................................
........................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff80003cbfb58, 1, fffff80002e914a4, 2}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!PoIdle+525 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff80003cbfb58, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80002e914a4, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030ba100
 fffff80003cbfb58 

FAULTING_IP: 
nt!PoIdle+525
fffff800`02e914a4 41ff542430      call    qword ptr [r12+30h]

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff80004cbf9d0 -- (.trap 0xfffff80004cbf9d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffffa800b1fc180
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e914a4 rsp=fffff80004cbfb60 rbp=0000000000000000
 r8=fffff80002e0b000  r9=000000036df41dcf r10=000000000000079f
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di ng nz ac pe cy
nt!PoIdle+0x525:
fffff800`02e914a4 41ff542430      call    qword ptr [r12+30h] ds:00000000`00000030=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e323f0 to fffff80002e87c40

STACK_TEXT:  
fffff800`04cbf868 fffff800`02e323f0 : 00000000`00000050 fffff800`03cbfb58 00000000`00000001 fffff800`04cbf9d0 : nt!KeBugCheckEx
fffff800`04cbf870 fffff800`02e85d6e : 00000000`00000001 fffff800`03cbfb58 00000000`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x447c6
fffff800`04cbf9d0 fffff800`02e914a4 : 00000000`001dbc30 fffffa80`07b98dd0 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff800`04cbfb60 fffff800`02e7f93c : fffff800`02ffde80 fffff800`00000001 00000000`00000001 fffff880`00000000 : nt!PoIdle+0x525
fffff800`04cbfc40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x2c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!PoIdle+525
fffff800`02e914a4 41ff542430      call    qword ptr [r12+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!PoIdle+525

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x50_nt!PoIdle+525

BUCKET_ID:  X64_0x50_nt!PoIdle+525

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\PoisonedFire\Windows_NT6_BSOD_jcgriff2\123011-18049-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e11000 PsLoadedModuleList = 0xfffff800`03056670
Debug session time: Fri Dec 30 19:27:30.217 2011 (GMT-7)
System Uptime: 0 days 0:11:54.122
Loading Kernel Symbols
...............................................................
................................................................
...................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck BE, {fffff88009011fc8, 800000023f805121, fffff80000b9bfb0, a}

Unable to load image \SystemRoot\system32\DRIVERS\NETwNs64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NETwNs64.sys
*** ERROR: Module load completed but symbols could not be loaded for NETwNs64.sys
Probably caused by : NETwNs64.sys ( NETwNs64+3b2f62 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory.  The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff88009011fc8, Virtual address for the attempted write.
Arg2: 800000023f805121, PTE contents.
Arg3: fffff80000b9bfb0, (reserved)
Arg4: 000000000000000a, (reserved)

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xBE

PROCESS_NAME:  System

CURRENT_IRQL:  2

TRAP_FRAME:  fffff80000b9bfb0 -- (.trap 0xfffff80000b9bfb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff8800a011fd8
rdx=0000020000cd7250 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88009bc8f62 rsp=fffff80000b9c148 rbp=fffff8800a0117a0
 r8=00000000000009a0  r9=000000000000003c r10=0000000000000000
r11=fffff8800a011db8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
NETwNs64+0x3b2f62:
fffff880`09bc8f62 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e37f57 to fffff80002e8dc40

STACK_TEXT:  
fffff800`00b9be48 fffff800`02e37f57 : 00000000`000000be fffff880`09011fc8 80000002`3f805121 fffff800`00b9bfb0 : nt!KeBugCheckEx
fffff800`00b9be50 fffff800`02e8bd6e : fffffa80`0b77d000 fffff800`4534475f 00000000`00002000 fffffa80`0ace9008 : nt! ?? ::FNODOBFM::`string'+0x442cb
fffff800`00b9bfb0 fffff880`09bc8f62 : fffff880`099e2d93 fffffa80`0ace9008 fffff880`0a0117a0 fffffa80`0acf0a48 : nt!KiPageFault+0x16e
fffff800`00b9c148 fffff880`099e2d93 : fffffa80`0ace9008 fffff880`0a0117a0 fffffa80`0acf0a48 00000000`00000001 : NETwNs64+0x3b2f62
fffff800`00b9c150 fffffa80`0ace9008 : fffff880`0a0117a0 fffffa80`0acf0a48 00000000`00000001 fffff800`00b9c181 : NETwNs64+0x1ccd93
fffff800`00b9c158 fffff880`0a0117a0 : fffffa80`0acf0a48 00000000`00000001 fffff800`00b9c181 fffff800`00b9c238 : 0xfffffa80`0ace9008
fffff800`00b9c160 fffffa80`0acf0a48 : 00000000`00000001 fffff800`00b9c181 fffff800`00b9c238 00000000`00000000 : NETwNs64+0x7fb7a0
fffff800`00b9c168 00000000`00000001 : fffff800`00b9c181 fffff800`00b9c238 00000000`00000000 fffff880`00000010 : 0xfffffa80`0acf0a48
fffff800`00b9c170 fffff800`00b9c181 : fffff800`00b9c238 00000000`00000000 fffff880`00000010 00000000`00000001 : 0x1
fffff800`00b9c178 fffff800`00b9c238 : 00000000`00000000 fffff880`00000010 00000000`00000001 fffffa80`0ace9008 : 0xfffff800`00b9c181
fffff800`00b9c180 00000000`00000000 : fffff880`00000010 00000000`00000001 fffffa80`0ace9008 00000000`00000000 : 0xfffff800`00b9c238


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETwNs64+3b2f62
fffff880`09bc8f62 ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  NETwNs64+3b2f62

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETwNs64

IMAGE_NAME:  NETwNs64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d237525

FAILURE_BUCKET_ID:  X64_0xBE_NETwNs64+3b2f62

BUCKET_ID:  X64_0xBE_NETwNs64+3b2f62

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\PoisonedFire\Windows_NT6_BSOD_jcgriff2\123011-18704-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e5f000 PsLoadedModuleList = 0xfffff800`030a4670
Debug session time: Fri Dec 30 20:08:53.651 2011 (GMT-7)
System Uptime: 0 days 0:20:35.557
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff80003cc0410, 2, 1, fffff80002e1db42}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff80003cc0410, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002e1db42, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310e100
 fffff80003cc0410 

CURRENT_IRQL:  2

FAULTING_IP: 
hal!HalSendSoftwareInterrupt+a
fffff800`02e1db42 9c              pushfq

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff80004cc0280 -- (.trap 0xfffff80004cc0280)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000002
rdx=ffffffffffffff02 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e1db42 rsp=fffff80004cc0418 rbp=0000000000000002
 r8=0000000000000004  r9=000000000000000c r10=fffff80002e5f000
r11=fffff80004cc0470 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
hal!HalSendSoftwareInterrupt+0xa:
fffff800`02e1db42 9c              pushfq
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002edb1e9 to fffff80002edbc40

STACK_TEXT:  
fffff800`04cc0138 fffff800`02edb1e9 : 00000000`0000000a fffff800`03cc0410 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`04cc0140 fffff800`02ed9e60 : 00000000`00000000 00000000`00000000 fffff800`04cc0b00 fffff880`03965180 : nt!KiBugCheckDispatch+0x69
fffff800`04cc0280 fffff800`02e1db42 : fffff800`02ee1fbd fffff880`03965180 fffffa80`0d75cb60 00000000`00000004 : nt!KiPageFault+0x260
fffff800`04cc0418 fffff800`02ee1fbd : fffff880`03965180 fffffa80`0d75cb60 00000000`00000004 00000000`000000ff : hal!HalSendSoftwareInterrupt+0xa
fffff800`04cc0420 fffff800`02ee7527 : fffffa80`07231c20 fffffa80`0d75cc68 fffffa80`0d75cc68 fffffa80`0c9d8800 : nt!KiDeferredReadyThread+0x2fd
fffff800`04cc04a0 fffff800`02ee737e : 00000002`e0730ad9 fffff800`04cc0b18 00000000`00013561 fffff800`03054ea8 : nt!KiProcessExpiredTimerList+0x157
fffff800`04cc0af0 fffff800`02ee7167 : 00000000`8f9428cb 00000000`00013561 00000000`8f942867 00000000`00000061 : nt!KiTimerExpiration+0x1be
fffff800`04cc0b90 fffff800`02ed396a : fffff800`03051e80 fffff800`0305fcc0 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`04cc0c40 00000000`00000000 : fffff800`04cc1000 fffff800`04cbb000 fffff800`04cc0c00 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`02ed9e60 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0xA_nt!KiPageFault+260

BUCKET_ID:  X64_0xA_nt!KiPageFault+260

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\PoisonedFire\Windows_NT6_BSOD_jcgriff2\123011-20170-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e0a000 PsLoadedModuleList = 0xfffff800`0304f670
Debug session time: Fri Dec 30 19:15:13.510 2011 (GMT-7)
System Uptime: 0 days 0:40:45.415
Loading Kernel Symbols
...............................................................
................................................................
...................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff7ffffb9c410, 2, 1, fffff800033fab42}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff7ffffb9c410, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800033fab42, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b9100
 fffff7ffffb9c410 

CURRENT_IRQL:  2

FAULTING_IP: 
hal!HalSendSoftwareInterrupt+a
fffff800`033fab42 9c              pushfq

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b9c280 -- (.trap 0xfffff80000b9c280)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000004
rdx=ffffffffffffff02 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800033fab42 rsp=fffff80000b9c418 rbp=0000000000000004
 r8=0000000000000014  r9=0000000000000005 r10=fffff80002e0a000
r11=fffff80000b9c470 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
hal!HalSendSoftwareInterrupt+0xa:
fffff800`033fab42 9c              pushfq
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e861e9 to fffff80002e86c40

STACK_TEXT:  
fffff800`00b9c138 fffff800`02e861e9 : 00000000`0000000a fffff7ff`ffb9c410 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`00b9c140 fffff800`02e84e60 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`009b3180 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c280 fffff800`033fab42 : fffff800`02e8cfbd fffff880`009b3180 fffffa80`0d9f4b60 fffffa80`07c80e88 : nt!KiPageFault+0x260
fffff800`00b9c418 fffff800`02e8cfbd : fffff880`009b3180 fffffa80`0d9f4b60 fffffa80`07c80e88 fffff880`0473074d : hal!HalSendSoftwareInterrupt+0xa
fffff800`00b9c420 fffff800`02e92527 : fffffa80`0d0d9c20 fffffa80`0d9f4c68 fffffa80`0d9f4c68 fffffa80`0d557100 : nt!KiDeferredReadyThread+0x2fd
fffff800`00b9c4a0 fffff800`02e9237e : 00000005`b194d9a6 fffff800`00b9cb18 00000000`00026454 fffff800`02fffd08 : nt!KiProcessExpiredTimerList+0x157
fffff800`00b9caf0 fffff800`02e92167 : 00000001`1c1b85c4 00000001`00026454 00000001`1c1b85e4 00000000`00000054 : nt!KiTimerExpiration+0x1be
fffff800`00b9cb90 fffff800`02e7e96a : fffff800`02ffce80 fffff800`0300acc0 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`00b9cc40 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cc00 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`02e84e60 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0xA_nt!KiPageFault+260

BUCKET_ID:  X64_0xA_nt!KiPageFault+260

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\PoisonedFire\Windows_NT6_BSOD_jcgriff2\123011-20685-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e66000 PsLoadedModuleList = 0xfffff800`030ab670
Debug session time: Fri Dec 30 20:24:28.094 2011 (GMT-7)
System Uptime: 0 days 0:15:14.000
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff7ffffb9c3e0, 2, 1, fffff80002eee96e}

Probably caused by : ntkrnlmp.exe ( nt!KiInsertTimerTable+e )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff7ffffb9c3e0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002eee96e, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003115100
 fffff7ffffb9c3e0 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiInsertTimerTable+e
fffff800`02eee96e 4157            push    r15

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b9c250 -- (.trap 0xfffff80000b9c250)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000401d4288 rbx=0000000000000000 rcx=fffff80003058e80
rdx=fffffa800b244568 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002eee96e rsp=fffff80000b9c3e8 rbp=0000000000000001
 r8=fffffa800b2445a8  r9=000000000000001d r10=fffff80003058e80
r11=fffff800030e2800 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!KiInsertTimerTable+0xe:
fffff800`02eee96e 4157            push    r15
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ee21e9 to fffff80002ee2c40

STACK_TEXT:  
fffff800`00b9c108 fffff800`02ee21e9 : 00000000`0000000a fffff7ff`ffb9c3e0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`00b9c110 fffff800`02ee0e60 : fffffa80`0b535c60 fffffa80`0a32f050 fffffa80`0a32f1a0 ffffffff`ff676980 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c250 fffff800`02eee96e : fffff800`03058e80 fffff800`0305b080 00000000`0000dd42 fffffa80`0b244568 : nt!KiPageFault+0x260
fffff800`00b9c3e8 fffff800`02eeb5fa : ffffffff`ff676980 fffffa80`0cb75510 fffffa80`0b23e050 fffffa80`00000000 : nt!KiInsertTimerTable+0xe
fffff800`00b9c420 fffff800`02eee43d : fffffa80`0b244568 fffffa80`0c85c558 fffffa80`0c85c558 00000000`00000000 : nt!KiTimerWaitTest+0x15a
fffff800`00b9c4a0 fffff800`02eee37e : 00000002`20c95b17 fffff800`00b9cb18 00000000`0000e4dd fffff800`0305ce28 : nt!KiProcessExpiredTimerList+0x6d
fffff800`00b9caf0 fffff800`02eee167 : 00000000`6a3abec6 00000000`0000e4dd 00000000`6a3abe03 00000000`000000dd : nt!KiTimerExpiration+0x1be
fffff800`00b9cb90 fffff800`02eda96a : fffff800`03058e80 fffff800`03066cc0 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`00b9cc40 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cc00 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiInsertTimerTable+e
fffff800`02eee96e 4157            push    r15

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!KiInsertTimerTable+e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0xA_nt!KiInsertTimerTable+e

BUCKET_ID:  X64_0xA_nt!KiInsertTimerTable+e

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\PoisonedFire\Windows_NT6_BSOD_jcgriff2\123011-23244-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e1f000 PsLoadedModuleList = 0xfffff800`03064670
Debug session time: Fri Dec 30 20:26:10.519 2011 (GMT-7)
System Uptime: 0 days 0:01:22.425
Loading Kernel Symbols
...............................................................
................................................................
.................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff7ffffb9c488, 2, 1, fffff80002ea44a2}

Probably caused by : ntkrnlmp.exe ( nt!KiTimerWaitTest+2 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff7ffffb9c488, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ea44a2, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030ce100
 fffff7ffffb9c488 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiTimerWaitTest+2
fffff800`02ea44a2 56              push    rsi

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b9c300 -- (.trap 0xfffff80000b9c300)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffff80003011e80
rdx=fffffa800d842c20 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ea44a2 rsp=fffff80000b9c490 rbp=00000000000014a3
 r8=fffff80003014001  r9=0000000000000002 r10=00000000000000a3
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!KiTimerWaitTest+0x2:
fffff800`02ea44a2 56              push    rsi
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e9b1e9 to fffff80002e9bc40

STACK_TEXT:  
fffff800`00b9c1b8 fffff800`02e9b1e9 : 00000000`0000000a fffff7ff`ffb9c488 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`00b9c1c0 fffff800`02e99e60 : 00000000`00000000 fffffa80`07f8aa70 00000000`00000000 fffffa80`0d842c20 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c300 fffff800`02ea44a2 : 00000000`000014a3 fffff800`02ea743d fffffa80`0be64c10 fffffa80`0bda0c20 : nt!KiPageFault+0x260
fffff800`00b9c490 fffff800`02ea743d : fffffa80`0be64c10 fffffa80`0bda0c20 fffffa80`0bda0c20 00000000`00000000 : nt!KiTimerWaitTest+0x2
fffff800`00b9c4a0 fffff800`02ea737e : 00000000`312117a6 fffff800`00b9cb18 00000000`000014a3 fffff800`030156e8 : nt!KiProcessExpiredTimerList+0x6d
fffff800`00b9caf0 fffff800`02ea7167 : 00000000`09a40ac1 00000000`000014a3 00000000`09a40a08 00000000`000000a3 : nt!KiTimerExpiration+0x1be
fffff800`00b9cb90 fffff800`02e9396a : fffff800`03011e80 fffff800`0301fcc0 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`00b9cc40 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cc00 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiTimerWaitTest+2
fffff800`02ea44a2 56              push    rsi

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!KiTimerWaitTest+2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0xA_nt!KiTimerWaitTest+2

BUCKET_ID:  X64_0xA_nt!KiTimerWaitTest+2

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\PoisonedFire\Windows_NT6_BSOD_jcgriff2\123111-27253-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e06000 PsLoadedModuleList = 0xfffff800`0304b670
Debug session time: Sat Dec 31 05:52:18.031 2011 (GMT-7)
System Uptime: 0 days 0:10:02.936
Loading Kernel Symbols
...............................................................
................................................................
...................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck BE, {fffff8800789f8c0, 23e109121, fffff8800889f730, b}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+45c6e )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory.  The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff8800789f8c0, Virtual address for the attempted write.
Arg2: 000000023e109121, PTE contents.
Arg3: fffff8800889f730, (reserved)
Arg4: 000000000000000b, (reserved)

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xBE

PROCESS_NAME:  avp.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800889f730 -- (.trap 0xfffff8800889f730)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8009fcbbb0 rbx=0000000000000000 rcx=fffffa800c960060
rdx=fffffa800c960060 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e8ca2a rsp=fffff8800889f8c8 rbp=0000000000000001
 r8=fffffa8006fa1c10  r9=0000000000000001 r10=fffffa800c0c4630
r11=00000000002c8900 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!ObfDereferenceObject+0xa:
fffff800`02e8ca2a 57              push    rdi
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e2e5d2 to fffff80002e82c40

STACK_TEXT:  
fffff880`0889f5c8 fffff800`02e2e5d2 : 00000000`000000be fffff880`0789f8c0 00000002`3e109121 fffff880`0889f730 : nt!KeBugCheckEx
fffff880`0889f5d0 fffff800`02e80d6e : 00000000`00000001 fffff880`0789f8c0 00000000`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x45c6e
fffff880`0889f730 fffff800`02e8ca2a : fffff800`03121cab 00000000`00000001 00000000`00000001 fffffa80`0c960060 : nt!KiPageFault+0x16e
fffff880`0889f8c8 fffff800`03121cab : 00000000`00000001 00000000`00000001 fffffa80`0c960060 00000000`222dfd20 : nt!ObfDereferenceObject+0xa
fffff880`0889f8d0 fffff800`0314c6e7 : 00000000`00000000 fffff880`0889fb60 fffffa80`0c960060 00000000`00000701 : nt!PsGetNextProcessThread+0xe3
fffff880`0889f920 fffff800`02e81ed3 : fffffa80`09fcbb60 fffffa80`09fcbb60 00000000`7e625000 00000000`7e625000 : nt!NtSetInformationThread+0x4e6
fffff880`0889fae0 00000000`76dc13ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`222de7a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76dc13ea


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+45c6e
fffff800`02e2e5d2 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+45c6e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0xBE_nt!_??_::FNODOBFM::_string_+45c6e

BUCKET_ID:  X64_0xBE_nt!_??_::FNODOBFM::_string_+45c6e

Followup: MachineOwner
---------

Nearly all of your blue screen errors were system related. The possible causes are: corrupted system files, hardware going bad, or an underlying driver that is incompatible with Windows 7.

Please remove Daemon Tools, as it uses a driver called dtsoftbus01.sys that is known to cause BSODs.

I prefer TotalMounter as my CD/DVD virtualization software as it allows me to burn images to a virtual CD/DVD if I just want an ISO file instead of a disc, and it is free.

Many use MagicISO - Convert BIN to ISO, Create, Edit, Burn, Extract ISO file, ISO/BIN converter/extractor/editor as well, which is also free.

poisonedfire · 31 Dec 2011

Thanks Writhziden

I uninstalled daemon tools... And I'll see how it goes.

Is there any way to check whether it's corrupted system files, hardware etc?

sometimes it comes out to be win32k.sys, netwNs64.sys, PAGE_FAULT_IN_NONPAGED_AREA, IRQL NOT LESS OR EQUAL...

thanks again

writhziden · 31 Dec 2011

poisonedfire said:

Thanks Writhziden

I uninstalled daemon tools... And I'll see how it goes.

Is there any way to check whether it's corrupted system files, hardware etc?

sometimes it comes out to be win32k.sys, netwNs64.sys, PAGE_FAULT_IN_NONPAGED_AREA, IRQL NOT LESS OR EQUAL...

thanks again

There are many ways to check. If you continue to have crashes, we will go through the steps for each. I just want to run through solutions to each possible cause at a time so we know what fixes the problem.

poisonedfire · 31 Dec 2011

I tried but it still crashes randomly. =(

This is the new one

writhziden · 01 Jan 2012

Code:


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\PoisonedFire\Windows_NT6_BSOD_jcgriff2\123111-43992-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e68000 PsLoadedModuleList = 0xfffff800`030ad670
Debug session time: Sat Dec 31 07:32:11.208 2011 (UTC - 7:00)
System Uptime: 0 days 0:08:36.114
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff88006b2b828, 0, fffff80002eff510, 0}

Unable to load image \SystemRoot\System32\win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys

Could not read faulting driver name
Probably caused by : win32k.sys ( win32k+cc636 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff88006b2b828, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002eff510, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003117100
 fffff88006b2b828 

FAULTING_IP: 
nt!PsGetCurrentThreadWin32Thread+10
fffff800`02eff510 c3              ret

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88007b2b690 -- (.trap 0xfffff88007b2b690)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c07fd010 rbx=0000000000000000 rcx=00000000000203b4
rdx=fffff900c0864701 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002eff510 rsp=fffff88007b2b828 rbp=fffff900c0872560
 r8=fffff900c0580a70  r9=0000000000000012 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!PsGetCurrentThreadWin32Thread+0x10:
fffff800`02eff510 c3              ret
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e909fc to fffff80002ee4c40

STACK_TEXT:  
fffff880`07b2b528 fffff800`02e909fc : 00000000`00000050 fffff880`06b2b828 00000000`00000000 fffff880`07b2b690 : nt!KeBugCheckEx
fffff880`07b2b530 fffff800`02ee2d6e : 00000000`00000000 fffff880`06b2b828 00000000`00000000 fffff900`c2595310 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`07b2b690 fffff800`02eff510 : fffff960`000cc636 fffff900`c2595010 00000000`00000000 00000000`ffeb1d38 : nt!KiPageFault+0x16e
fffff880`07b2b828 fffff960`000cc636 : fffff900`c2595010 00000000`00000000 00000000`ffeb1d38 00000000`00000000 : nt!PsGetCurrentThreadWin32Thread+0x10
fffff880`07b2b830 fffff900`c2595010 : 00000000`00000000 00000000`ffeb1d38 00000000`00000000 fffff900`c2595410 : win32k+0xcc636
fffff880`07b2b838 00000000`00000000 : 00000000`ffeb1d38 00000000`00000000 fffff900`c2595410 fffff960`000759c1 : 0xfffff900`c2595010


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k+cc636
fffff960`000cc636 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  win32k+cc636

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ecdcd5b

FAILURE_BUCKET_ID:  X64_0x50_win32k+cc636

BUCKET_ID:  X64_0x50_win32k+cc636

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\PoisonedFire\Windows_NT6_BSOD_jcgriff2\123111-42307-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e67000 PsLoadedModuleList = 0xfffff800`030ac670
Debug session time: Sat Dec 31 07:40:31.300 2011 (UTC - 7:00)
System Uptime: 0 days 0:05:27.206
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff9600009729b, fffff8800e5d3d30, 0}

Probably caused by : win32k.sys ( win32k+8729b )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff9600009729b, Address of the instruction which caused the bugcheck
Arg3: fffff8800e5d3d30, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k+8729b
fffff960`0009729b 48897008        mov     qword ptr [rax+8],rsi

CONTEXT:  fffff8800e5d3d30 -- (.cxr 0xfffff8800e5d3d30)
rax=00000007000008e6 rbx=fffff900c2212b70 rcx=fffffa80077b2630
rdx=fffff900c2d61c50 rsi=fffff900c2212b50 rdi=fffff960000972d0
rip=fffff9600009729b rsp=fffff8800e5d4710 rbp=0000000000000001
 r8=fffff960000972d0  r9=fffff8800d29e440 r10=fffff8800d29dcc8
r11=fffff900c2d61c20 r12=fffff900c3e00000 r13=0000000000000044
r14=000000000000028f r15=0000000000000000
iopl=0         nv up ei ng nz ac po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010296
win32k+0x8729b:
fffff960`0009729b 48897008        mov     qword ptr [rax+8],rsi ds:002b:00000007`000008ee=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  PPStream.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff9600009729b

STACK_TEXT:  
fffff880`0e5d4710 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k+0x8729b


FOLLOWUP_IP: 
win32k+8729b
fffff960`0009729b 48897008        mov     qword ptr [rax+8],rsi

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k+8729b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ecdcd5b

STACK_COMMAND:  .cxr 0xfffff8800e5d3d30 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_win32k+8729b

BUCKET_ID:  X64_0x3B_win32k+8729b

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\PoisonedFire\Windows_NT6_BSOD_jcgriff2\123111-18704-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e18000 PsLoadedModuleList = 0xfffff800`0305d670
Debug session time: Sat Dec 31 08:53:56.055 2011 (UTC - 7:00)
System Uptime: 0 days 1:04:17.961
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8801fbe6f48, 1, fffff8000323cb45, 1}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!CmpCallCallBacks+15 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8801fbe6f48, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff8000323cb45, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000001, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c7100
 fffff8801fbe6f48 

FAULTING_IP: 
nt!CmpCallCallBacks+15
fffff800`0323cb45 4154            push    r12

MM_INTERNAL_CODE:  1

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88020be6dc0 -- (.trap 0xfffff88020be6dc0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88020be6f68 rbx=0000000000000000 rcx=000000000000001d
rdx=fffff88020be6fa0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000323cb45 rsp=fffff88020be6f50 rbp=000000000000001d
 r8=0000000000000000  r9=000000000000001d r10=fffff8000300c720
r11=fffffa800d88eb60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!CmpCallCallBacks+0x15:
fffff800`0323cb45 4154            push    r12
Resetting default scope

LOCK_ADDRESS:  fffff80003093b80 -- (!locks fffff80003093b80)

Resource @ nt!PiEngineLock (0xfffff80003093b80)    Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE: 
	Lock address  : 0xfffff80003093b80
	Thread Count  : 0
	Thread address: 0x0000000000000000
	Thread wait   : 0x0

LAST_CONTROL_TRANSFER:  from fffff80002e27b24 to fffff80002e94c40

STACK_TEXT:  
fffff880`20be6c58 fffff800`02e27b24 : 00000000`00000050 fffff880`1fbe6f48 00000000`00000001 fffff880`20be6dc0 : nt!KeBugCheckEx
fffff880`20be6c60 fffff800`02e92d6e : 00000000`00000001 fffff880`1fbe6f48 00000000`00000000 fffff880`20be7130 : nt! ?? ::FNODOBFM::`string'+0x461e2
fffff880`20be6dc0 fffff800`0323cb45 : 00000000`00000000 fffff8a0`0fda05c0 fffff880`20be7130 fffff800`031c925a : nt!KiPageFault+0x16e
fffff880`20be6f50 fffff800`031c925a : fffff880`0000001d fffff880`20be6fa0 fffff8a0`0fda0500 00000000`0000001d : nt!CmpCallCallBacks+0x15
fffff880`20be6f70 fffff800`030f6abe : fffff880`20be7348 fffff880`20be7530 fffff8a0`00024010 fffff880`20be7460 : nt! ?? ::NNGAKEGL::`string'+0x1232b
fffff880`20be6ff0 fffff800`0318f838 : fffffa80`071541c8 fffffa80`00000000 fffffa80`07154010 fffff800`00000000 : nt! ?? ::NNGAKEGL::`string'+0x2ec86
fffff880`20be72f0 fffff800`03190a56 : ffffffff`8000318c fffffa80`07154010 fffff8a0`0f98e370 fffffa80`07016660 : nt!ObpLookupObjectName+0x588
fffff880`20be73e0 fffff800`031642bc : 00000000`00000099 00000000`00000000 00000000`00000000 00000000`00000200 : nt!ObOpenObjectByName+0x306
fffff880`20be74b0 fffff800`0316f392 : fffff880`20be78a8 00000000`00020019 fffff880`20be7800 fffff880`00000000 : nt!CmOpenKey+0x28a
fffff880`20be7600 fffff800`02e93ed3 : fffffa80`00000000 fffff8a0`043cc220 fffff880`00000200 fffff880`20be7884 : nt!NtOpenKey+0x12
fffff880`20be7640 fffff800`02e90470 : fffff800`03103e58 00000000`0000000e 00000000`00000200 00000000`00000099 : nt!KiSystemServiceCopyEnd+0x13
fffff880`20be77d8 fffff800`03103e58 : 00000000`0000000e 00000000`00000200 00000000`00000099 fffff8a0`043cc220 : nt!KiServiceLinkage
fffff880`20be77e0 fffff800`03100ab8 : 00000000`00000108 fffff8a0`043cc220 00000000`000000a3 fffff8a0`0ef7cc0c : nt!IopOpenRegistryKeyEx+0x38
fffff880`20be7840 fffff800`031012a1 : 00000000`00000002 00000000`00000000 fffff880`00000000 00000000`00000001 : nt!IopGetDeviceInterfaces+0x32c
fffff880`20be79b0 fffff800`0310056d : 00000000`00000002 00000000`00000000 00000000`00000000 fffff8a0`0b11ebc0 : nt!PiGetInterfaceDeviceList+0x41
fffff880`20be7a10 fffff800`031596dc : fffff8a0`0b11ebc0 fffff800`00008000 fffff880`20be7b01 fffff800`0335fda0 : nt!PiControlGetInterfaceDeviceList+0x111
fffff880`20be7a90 fffff800`02e93ed3 : fffffa80`0d88eb60 00000000`012ae790 fffff880`20be7b60 00000000`012ae818 : nt!NtPlugPlayControl+0x100
fffff880`20be7ae0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!CmpCallCallBacks+15
fffff800`0323cb45 4154            push    r12

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!CmpCallCallBacks+15

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x50_nt!CmpCallCallBacks+15

BUCKET_ID:  X64_0x50_nt!CmpCallCallBacks+15

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\PoisonedFire\Windows_NT6_BSOD_jcgriff2\123111-18408-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e65000 PsLoadedModuleList = 0xfffff800`030aa670
Debug session time: Sat Dec 31 08:57:55.054 2011 (UTC - 7:00)
System Uptime: 0 days 0:00:15.960
Loading Kernel Symbols
...............................................................
................................................................
.....
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffff80003ccba60, 2, 1, fffff88007c67572}

Probably caused by : HDAudBus.sys ( HDAudBus!HDABusWmiLogETW+12 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff80003ccba60, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff88007c67572, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003114100
 fffff80003ccba60 

CURRENT_IRQL:  2

FAULTING_IP: 
HDAudBus!HDABusWmiLogETW+12
fffff880`07c67572 56              push    rsi

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff80004ccb8d0 -- (.trap 0xfffff80004ccb8d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000001
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88007c67572 rsp=fffff80004ccba68 rbp=fffffa800a950000
 r8=0000000000000004  r9=0000000000000003 r10=fffff80002e65000
r11=fffffa800a950000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
HDAudBus!HDABusWmiLogETW+0x12:
fffff880`07c67572 56              push    rsi
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ee11e9 to fffff80002ee1c40

STACK_TEXT:  
fffff800`04ccb788 fffff800`02ee11e9 : 00000000`0000000a fffff800`03ccba60 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`04ccb790 fffff800`02edfe60 : 00000000`00000000 00000000`00001ae6 00000000`00000002 fffff800`03057e80 : nt!KiBugCheckDispatch+0x69
fffff800`04ccb8d0 fffff880`07c67572 : fffff880`07c5bd49 fffffa80`00000001 fffffa80`00000002 00000000`00000004 : nt!KiPageFault+0x260
fffff800`04ccba68 fffff880`07c5bd49 : fffffa80`00000001 fffffa80`00000002 00000000`00000004 fffff800`03057e03 : HDAudBus!HDABusWmiLogETW+0x12
fffff800`04ccba70 fffff880`07c5a5a8 : fffffa80`0a950000 80000000`00000004 00000000`00000004 00000000`00000003 : HDAudBus!HdaController::ProcessCodecTransferList+0x669
fffff800`04ccbb30 fffff800`02eed0ac : fffffa80`0a956c68 fffffa80`0a950000 00000000`00000000 00000000`00000000 : HDAudBus!HdaController::CodecDpc+0xd8
fffff800`04ccbb90 fffff800`02ed996a : fffff800`03057e80 fffff800`03065cc0 00000000`00000000 fffff880`07c5a4d0 : nt!KiRetireDpcList+0x1bc
fffff800`04ccbc40 00000000`00000000 : fffff800`04ccc000 fffff800`04cc6000 fffff800`04ccbc00 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
HDAudBus!HDABusWmiLogETW+12
fffff880`07c67572 56              push    rsi

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  HDAudBus!HDABusWmiLogETW+12

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: HDAudBus

IMAGE_NAME:  HDAudBus.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7a65e

FAILURE_BUCKET_ID:  X64_0xD1_HDAudBus!HDABusWmiLogETW+12

BUCKET_ID:  X64_0xD1_HDAudBus!HDABusWmiLogETW+12

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\PoisonedFire\Windows_NT6_BSOD_jcgriff2\123111-18782-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e08000 PsLoadedModuleList = 0xfffff800`0304d670
Debug session time: Sat Dec 31 09:09:07.132 2011 (UTC - 7:00)
System Uptime: 0 days 0:01:44.927
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffff7ffffb9c1b8, 2, 1, fffff8800983897e}

Unable to load image \SystemRoot\system32\DRIVERS\NETwNs64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NETwNs64.sys
*** ERROR: Module load completed but symbols could not be loaded for NETwNs64.sys
Probably caused by : NETwNs64.sys ( NETwNs64+e97e )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff7ffffb9c1b8, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff8800983897e, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b7100
 fffff7ffffb9c1b8 

CURRENT_IRQL:  2

FAULTING_IP: 
NETwNs64+e97e
fffff880`0983897e e85df9ffff      call    NETwNs64+0xe2e0 (fffff880`098382e0)

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b9c030 -- (.trap 0xfffff80000b9c030)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8007f21a90
rdx=0000000000000006 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800983897e rsp=fffff80000b9c1c0 rbp=fffffa800dd7c420
 r8=fffffa800dd7c400  r9=0000000000000000 r10=fffff8800a0352c0
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
NETwNs64+0xe97e:
fffff880`0983897e e85df9ffff      call    NETwNs64+0xe2e0 (fffff880`098382e0)
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e841e9 to fffff80002e84c40

STACK_TEXT:  
fffff800`00b9bee8 fffff800`02e841e9 : 00000000`0000000a fffff7ff`ffb9c1b8 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`00b9bef0 fffff800`02e82e60 : 00000000`00000000 fffff880`0985205c 3ac830e3`dad72400 fffffa80`07f21a90 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c030 fffff880`0983897e : fffffa80`07f21a90 fffffa80`0a98be1b 00000000`00000000 fffff880`0982f5d0 : nt!KiPageFault+0x260
fffff800`00b9c1c0 fffffa80`07f21a90 : fffffa80`0a98be1b 00000000`00000000 fffff880`0982f5d0 fffffa80`0d92be00 : NETwNs64+0xe97e
fffff800`00b9c1c8 fffffa80`0a98be1b : 00000000`00000000 fffff880`0982f5d0 fffffa80`0d92be00 fffffa80`0a98b888 : 0xfffffa80`07f21a90
fffff800`00b9c1d0 00000000`00000000 : fffff880`0982f5d0 fffffa80`0d92be00 fffffa80`0a98b888 fffffa80`0a98b888 : 0xfffffa80`0a98be1b


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETwNs64+e97e
fffff880`0983897e e85df9ffff      call    NETwNs64+0xe2e0 (fffff880`098382e0)

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  NETwNs64+e97e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETwNs64

IMAGE_NAME:  NETwNs64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4e39e7aa

FAILURE_BUCKET_ID:  X64_0xD1_NETwNs64+e97e

BUCKET_ID:  X64_0xD1_NETwNs64+e97e

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\PoisonedFire\Windows_NT6_BSOD_jcgriff2\123111-23056-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e04000 PsLoadedModuleList = 0xfffff800`03049670
Debug session time: Sat Dec 31 09:10:41.603 2011 (UTC - 7:00)
System Uptime: 0 days 0:00:45.508
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck BE, {fffff8800907bcf0, 800000023f7ce121, fffff80000b9bfb0, a}

Unable to load image \SystemRoot\system32\DRIVERS\NETwNs64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NETwNs64.sys
*** ERROR: Module load completed but symbols could not be loaded for NETwNs64.sys
Probably caused by : NETwNs64.sys ( NETwNs64+3c5516 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory.  The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff8800907bcf0, Virtual address for the attempted write.
Arg2: 800000023f7ce121, PTE contents.
Arg3: fffff80000b9bfb0, (reserved)
Arg4: 000000000000000a, (reserved)

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xBE

PROCESS_NAME:  System

CURRENT_IRQL:  2

TRAP_FRAME:  fffff80000b9bfb0 -- (.trap 0xfffff80000b9bfb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff8800a07bcf8
rdx=0000020000e07c30 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88009c2d516 rsp=fffff80000b9c148 rbp=fffff8800a07adc0
 r8=0000000000000a18  r9=0000000000000007 r10=0000000000000000
r11=fffff8800a07b3d8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
NETwNs64+0x3c5516:
fffff880`09c2d516 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e2af57 to fffff80002e80c40

STACK_TEXT:  
fffff800`00b9be48 fffff800`02e2af57 : 00000000`000000be fffff880`0907bcf0 80000002`3f7ce121 fffff800`00b9bfb0 : nt!KeBugCheckEx
fffff800`00b9be50 fffff800`02e7ed6e : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`0ae83008 : nt! ?? ::FNODOBFM::`string'+0x442cb
fffff800`00b9bfb0 fffff880`09c2d516 : fffff880`09a3c443 fffffa80`0ae83008 fffff880`0a07adc0 fffffa80`0ae8aac0 : nt!KiPageFault+0x16e
fffff800`00b9c148 fffff880`09a3c443 : fffffa80`0ae83008 fffff880`0a07adc0 fffffa80`0ae8aac0 00000000`00000001 : NETwNs64+0x3c5516
fffff800`00b9c150 fffffa80`0ae83008 : fffff880`0a07adc0 fffffa80`0ae8aac0 00000000`00000001 fffff800`00b9c181 : NETwNs64+0x1d4443
fffff800`00b9c158 fffff880`0a07adc0 : fffffa80`0ae8aac0 00000000`00000001 fffff800`00b9c181 00000000`00000001 : 0xfffffa80`0ae83008
fffff800`00b9c160 fffffa80`0ae8aac0 : 00000000`00000001 fffff800`00b9c181 00000000`00000001 00000000`00000000 : NETwNs64+0x812dc0
fffff800`00b9c168 00000000`00000001 : fffff800`00b9c181 00000000`00000001 00000000`00000000 fffff800`03004cc0 : 0xfffffa80`0ae8aac0
fffff800`00b9c170 fffff800`00b9c181 : 00000000`00000001 00000000`00000000 fffff800`03004cc0 00000000`00000001 : 0x1
fffff800`00b9c178 00000000`00000001 : 00000000`00000000 fffff800`03004cc0 00000000`00000001 fffffa80`0ae83008 : 0xfffff800`00b9c181
fffff800`00b9c180 00000000`00000000 : fffff800`03004cc0 00000000`00000001 fffffa80`0ae83008 00000000`00000002 : 0x1


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETwNs64+3c5516
fffff880`09c2d516 ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  NETwNs64+3c5516

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETwNs64

IMAGE_NAME:  NETwNs64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4e39e7aa

FAILURE_BUCKET_ID:  X64_0xBE_NETwNs64+3c5516

BUCKET_ID:  X64_0xBE_NETwNs64+3c5516

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\PoisonedFire\Windows_NT6_BSOD_jcgriff2\123111-31902-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e55000 PsLoadedModuleList = 0xfffff800`0309a670
Debug session time: Sat Dec 31 09:40:18.744 2011 (UTC - 7:00)
System Uptime: 0 days 0:00:24.649
Loading Kernel Symbols
...............................................................
................................................................
......
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff8800cc4b278, 2, 0, fffff80002ec86ba}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff8800cc4b278, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ec86ba, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003104100
 fffff8800cc4b278 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!memcpy+ca
fffff800`02ec86ba 4c8b540af8      mov     r10,qword ptr [rdx+rcx-8]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff80004cb91c0 -- (.trap 0xfffff80004cb91c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff88004b1c890
rdx=000000000912e9f0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ec86ba rsp=fffff80004cb9358 rbp=fffff88004b1c670
 r8=0000000000000320  r9=0000000000000009 r10=0000000000000000
r11=fffff88004b1c670 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!memcpy+0xca:
fffff800`02ec86ba 4c8b540af8      mov     r10,qword ptr [rdx+rcx-8] ds:7998:fffff880`0dc4b278=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ed11e9 to fffff80002ed1c40

STACK_TEXT:  
fffff800`04cb9078 fffff800`02ed11e9 : 00000000`0000000a fffff880`0cc4b278 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`04cb9080 fffff800`02ecfe60 : fffffa80`00000000 fffff880`06e6a7bd ffff0080`03ee4551 fffff880`0dc4b018 : nt!KiBugCheckDispatch+0x69
fffff800`04cb91c0 fffff800`02ec86ba : fffff800`0337f419 fffff880`0764dd80 fffffa80`0aa25560 fffffa80`0af9b860 : nt!KiPageFault+0x260
fffff800`04cb9358 fffff800`0337f419 : fffff880`0764dd80 fffffa80`0aa25560 fffffa80`0af9b860 00000000`00000050 : nt!memcpy+0xca
fffff800`04cb9360 fffff800`03382178 : 00000000`00000000 00000000`00000000 fffffa80`07032800 fffffa80`07032804 : nt!GxpWriteFrameBufferPixels+0xb9
fffff800`04cb93b0 fffff800`03383757 : 00000000`00000000 00000000`0001fb7e 00000000`00000000 fffff880`04fc78e9 : nt!BgpGxDrawRectangle+0x48
fffff800`04cb93e0 fffff800`02edd5fc : fffff800`04cb94d8 00000000`00000000 00000000`00000002 fffff800`04cb9500 : nt!AnFwpProgressIndicatorTimer+0x107
fffff800`04cb9430 fffff800`02edd496 : fffffa80`07eff0e0 00000000`0000062c 00000000`00000000 fffff800`04cb94c0 : nt!KiProcessTimerDpcTable+0x6c
fffff800`04cb94a0 fffff800`02edd37e : 00000000`0eb13ca0 fffff800`04cb9b18 00000000`0000062c fffff800`0304a808 : nt!KiProcessExpiredTimerList+0xc6
fffff800`04cb9af0 fffff800`02edd167 : 00000000`02ee88c3 00000000`0000062c 00000000`02ee882a 00000000`0000002c : nt!KiTimerExpiration+0x1be
fffff800`04cb9b90 fffff800`02ec996a : fffff800`03047e80 fffff800`03055cc0 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`04cb9c40 00000000`00000000 : fffff800`04cba000 fffff800`04cb4000 fffff800`04cb9c00 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`02ecfe60 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0xA_nt!KiPageFault+260

BUCKET_ID:  X64_0xA_nt!KiPageFault+260

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\PoisonedFire\Windows_NT6_BSOD_jcgriff2\123111-20264-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e03000 PsLoadedModuleList = 0xfffff800`03048670
Debug session time: Sat Dec 31 15:13:21.246 2011 (UTC - 7:00)
System Uptime: 0 days 0:11:20.152
Loading Kernel Symbols
...............................................................
................................................................
...................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff7ffffb9c218, 2, 1, fffff80002e61117}

Probably caused by : afd.sys ( afd!AfdCompletePollIrp+d2 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff7ffffb9c218, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002e61117, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b2100
 fffff7ffffb9c218 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiExitDispatcher+7
fffff800`02e61117 4155            push    r13

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b9c090 -- (.trap 0xfffff80000b9c090)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff80002ff5e80
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e61117 rsp=fffff80000b9c220 rbp=0000000000000002
 r8=0000000000000001  r9=0000000000000002 r10=0000000000000000
r11=fffff80000b9c302 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KiExitDispatcher+0x7:
fffff800`02e61117 4155            push    r13
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e7f1e9 to fffff80002e7fc40

STACK_TEXT:  
fffff800`00b9bf48 fffff800`02e7f1e9 : 00000000`0000000a fffff7ff`ffb9c218 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`00b9bf50 fffff800`02e7de60 : 00000000`0000000e fffffa80`0c62d640 fffffa80`0a9af700 fffffa80`07131780 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c090 fffff800`02e61117 : fffff800`02ff5e80 fffffa80`07907001 00000000`00000000 00000000`00000002 : nt!KiPageFault+0x260
fffff800`00b9c220 fffff800`02e61406 : fffffa80`07131780 00000000`00000002 00000000`00000000 fffffa80`07907088 : nt!KiExitDispatcher+0x7
fffff800`00b9c250 fffff800`02e83843 : fffffa80`074c2c90 00000000`a000000c 00000000`00000000 00000000`00000002 : nt!KeInsertQueueApc+0xa2
fffff800`00b9c2b0 fffff880`013a2282 : ffffffff`ffffffff fffffa80`07bdb602 fffffa80`07907010 00000000`00000000 : nt!IopfCompleteRequest+0xb63
fffff800`00b9c3a0 fffff880`013a22ee : 00000000`00000000 fffff800`00b9c4c0 fffff800`00b9c400 00000000`00000002 : afd!AfdCompletePollIrp+0xd2
fffff800`00b9c400 fffff800`02e8b5fc : 00000000`00000000 00000000`00000000 fffff800`404f1288 fffff880`016cb929 : afd!AfdTimeoutPoll+0x2e
fffff800`00b9c430 fffff800`02e8b496 : fffffa80`07bdb620 00000000`0000aa4f 00000000`00000000 fffffa80`0acf89b0 : nt!KiProcessTimerDpcTable+0x6c
fffff800`00b9c4a0 fffff800`02e8b37e : 00000001`9566fb3e fffff800`00b9cb18 00000000`0000aa4f fffff800`02ff8c68 : nt!KiProcessExpiredTimerList+0xc6
fffff800`00b9caf0 fffff800`02e8b167 : 00000000`4f1151c1 00000000`0000aa4f 00000000`4f11511c 00000000`0000004f : nt!KiTimerExpiration+0x1be
fffff800`00b9cb90 fffff800`02e7796a : fffff800`02ff5e80 fffff800`03003cc0 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`00b9cc40 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cc00 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
afd!AfdCompletePollIrp+d2
fffff880`013a2282 488b6c2460      mov     rbp,qword ptr [rsp+60h]

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  afd!AfdCompletePollIrp+d2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: afd

IMAGE_NAME:  afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4db4dd96

FAILURE_BUCKET_ID:  X64_0xA_afd!AfdCompletePollIrp+d2

BUCKET_ID:  X64_0xA_afd!AfdCompletePollIrp+d2

Followup: MachineOwner
---------

Most of these were system related, but one non-system related driver showed up twice. Update your Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 (see NETwNs64.sys) and see if that resolves the issue.

If you continue to get blue screen crashes after updating your wireless, run SFC /SCANNOW Command - System File Checker to check for system file errors. You may have to run it up to three times to fix all errors. Post back with your results.

If no errors are found with the system file check and you are still having crashes after updating your wireless driver, run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and finds no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete.

writhziden · 21 Jan 2012

Did updating your wireless driver help system stability, or did you have to do other steps? Post back if you need further assistance.

poisonedfire · 21 Jan 2012

Hi, sorry for the late reply. That actually didn't work... I'm planning to send the laptop to the factory for repair because I think it's hardware problem. the BSOD became more frequent and frequent as I use the laptop. Someone suggested me maybe it's overheating problem. But I havn't talk to the HP personnel... Do you have any suggestion on how to repair it? I'd be very glad if I can fix it myself. Thanks

writhziden · 21 Jan 2012

Laptops are a lot more difficult to repair than desktops. If you have a warranty, it is better to send it to the manufacturer than try to fix it yourself. You are more likely to cause problems than fix them when working with hardware in a laptop (I speak from experience

), and it may void the warranty. Have you backed up your important files and tried to do a restore to the factory image (put Windows back as it was when you bought it) to see if it is definitely a hardware problem? If not, we can instruct you in the process to do so.