Blue Screen issue - NT Kernel

supes · 02 Feb 2012

not sure if this reveals anything new...

writhziden · 02 Feb 2012

Code:


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [G:\Kingston\BSODDmpFiles\supes\minidmp\020212-47187-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) UP Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0284e000 PsLoadedModuleList = 0xfffff800`02a93670
Debug session time: Thu Feb  2 04:21:33.171 2012 (GMT-7)
System Uptime: 0 days 0:00:14.937
Loading Kernel Symbols
...............................................................
...................................
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc000001d, fffff88000000000, 0, fffffa8003ad2800}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4977d )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc000001d, The exception code that was not handled
Arg2: fffff88000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: fffffa8003ad2800, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

FAULTING_IP: 
+6429952f02ecdb60
fffff880`00000000 ff              ???

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  fffffa8003ad2800

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0x1E

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002916588 to fffff800028cac40

FAILED_INSTRUCTION_ADDRESS: 
+6429952f02ecdb60
fffff880`00000000 ff              ???

STACK_TEXT:  
fffff880`02f61558 fffff800`02916588 : 00000000`0000001e ffffffff`c000001d fffff880`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`02f61560 fffff800`028ca2c2 : fffff880`02f61d38 00000001`03ad2c30 fffff880`02f61de0 fffffa80`03abed80 : nt! ?? ::FNODOBFM::`string'+0x4977d
fffff880`02f61c00 fffff800`028c841f : fffff880`02f61de0 fffff880`02f61f00 00000000`00000000 fffff800`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`02f61de0 fffff880`00000000 : fffffa80`03444c00 00000001`03ad2c30 fffffa80`03abed80 fffffa80`03abed80 : nt!KiInvalidOpcodeFault+0x11f
fffff880`02f61f70 fffffa80`03444c00 : 00000001`03ad2c30 fffffa80`03abed80 fffffa80`03abed80 00000000`00000000 : 0xfffff880`00000000
fffff880`02f61f78 00000001`03ad2c30 : fffffa80`03abed80 fffffa80`03abed80 00000000`00000000 fffff880`0365e960 : 0xfffffa80`03444c00
fffff880`02f61f80 fffffa80`03abed80 : fffffa80`03abed80 00000000`00000000 fffff880`0365e960 fffff800`02a55400 : 0x1`03ad2c30
fffff880`02f61f88 fffffa80`03abed80 : 00000000`00000000 fffff880`0365e960 fffff800`02a55400 fffff880`02f62068 : 0xfffffa80`03abed80
fffff880`02f61f90 00000000`00000000 : fffff880`0365e960 fffff800`02a55400 fffff880`02f62068 fffffa80`03aba1e0 : 0xfffffa80`03abed80


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4977d
fffff800`02916588 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4977d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x1E_VRF_BAD_IP_nt!_??_::FNODOBFM::_string_+4977d

BUCKET_ID:  X64_0x1E_VRF_BAD_IP_nt!_??_::FNODOBFM::_string_+4977d

Followup: MachineOwner
---------

Loading Dump File [G:\Kingston\BSODDmpFiles\supes\minidmp\020112-34156-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) UP Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0284f000 PsLoadedModuleList = 0xfffff800`02a94670
Debug session time: Wed Feb  1 07:36:54.887 2012 (GMT-7)
System Uptime: 0 days 0:01:55.637
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3D, {fffff80000b9be50, 0, 0, fffff88004a5f94d}

Probably caused by : ntkrnlmp.exe ( nt!KiInterruptHandler+29 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

INTERRUPT_EXCEPTION_NOT_HANDLED (3d)
Arguments:
Arg1: fffff80000b9be50
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: fffff88004a5f94d

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0x3D

PROCESS_NAME:  System

CURRENT_IRQL:  5

EXCEPTION_RECORD:  fffff80000b9c5f8 -- (.exr 0xfffff80000b9c5f8)
Cannot read Exception record @ fffff80000b9c5f8

TRAP_FRAME:  fffff80000b9c6a0 -- (.trap 0xfffff80000b9c6a0)
Unable to read trap frame at fffff800`00b9c6a0

LAST_CONTROL_TRANSFER:  from fffff800028cb1e9 to fffff800028cbc40

STACK_TEXT:  
fffff800`00b9b598 fffff800`028cb1e9 : 00000000`0000003d fffff800`00b9be50 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9b5a0 fffff800`028c7529 : fffff980`0488c2a0 fffff880`04a1fc8f fffff800`00b9be50 fffff800`028f7830 : nt!KiBugCheckDispatch+0x69
fffff800`00b9b6e0 fffff800`028f74fd : fffff880`0538b890 fffff880`04fc800c fffff880`048e1000 fffff800`00b9c5f8 : nt!KiInterruptHandler+0x29
fffff800`00b9b710 fffff800`028f62d5 : fffff800`02a15f04 fffff800`00b9b788 fffff800`00b9c5f8 fffff800`0284f000 : nt!RtlpExecuteHandlerForException+0xd
fffff800`00b9b740 fffff800`02907361 : fffff800`00b9c5f8 fffff800`00b9be50 fffff800`00000000 00000000`00000004 : nt!RtlDispatchException+0x415
fffff800`00b9be20 fffff800`028cb2c2 : fffff800`00b9c5f8 fffff980`0488c2a0 fffff800`00b9c6a0 00000000`00000000 : nt!KiDispatchException+0x135
fffff800`00b9c4c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiInterruptHandler+29
fffff800`028c7529 90              nop

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiInterruptHandler+29

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x3D_VRF_nt!KiInterruptHandler+29

BUCKET_ID:  X64_0x3D_VRF_nt!KiInterruptHandler+29

Followup: MachineOwner
---------

Loading Dump File [G:\Kingston\BSODDmpFiles\supes\minidmp\020112-34625-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) UP Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0281b000 PsLoadedModuleList = 0xfffff800`02a60670
Debug session time: Wed Feb  1 02:41:55.202 2012 (GMT-7)
System Uptime: 0 days 0:12:12.967
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffffa8007bec94d, 5, 8, fffffa8007bec94d}

Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : nvlddmkm.sys ( nvlddmkm+12a5b0 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffffa8007bec94d, memory referenced
Arg2: 0000000000000005, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: fffffa8007bec94d, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002aca100
 fffffa8007bec94d 

CURRENT_IRQL:  5

FAULTING_IP: 
+6429952f0324ded4
fffffa80`07bec94d ??              ???

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b9c6a0 -- (.trap 0xfffff80000b9c6a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000009 rbx=0000000000000000 rcx=fffff980049822a0
rdx=000000000000000c rsi=0000000000000000 rdi=0000000000000000
rip=fffffa8007bec94d rsp=fffff80000b9c830 rbp=fffff980049822a0
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
fffffa80`07bec94d ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800028971e9 to fffff80002897c40

FAILED_INSTRUCTION_ADDRESS: 
+6429952f0324ded4
fffffa80`07bec94d ??              ???

STACK_TEXT:  
fffff800`00b9c558 fffff800`028971e9 : 00000000`0000000a fffffa80`07bec94d 00000000`00000005 00000000`00000008 : nt!KeBugCheckEx
fffff800`00b9c560 fffff800`02895e60 : fffff980`049822a0 fffff880`04a145b0 00000000`00000002 fffff980`049822a0 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c6a0 fffffa80`07bec94d : fffff980`049822a0 fffff880`04a145b0 fffff980`028cc9f0 fffffa80`03bc8000 : nt!KiPageFault+0x260
fffff800`00b9c830 fffff980`049822a0 : fffff880`04a145b0 fffff980`028cc9f0 fffffa80`03bc8000 00000000`ffffffff : 0xfffffa80`07bec94d
fffff800`00b9c838 fffff880`04a145b0 : fffff980`028cc9f0 fffffa80`03bc8000 00000000`ffffffff 00000000`00000000 : 0xfffff980`049822a0
fffff800`00b9c840 fffff980`028cc9f0 : fffffa80`03bc8000 00000000`ffffffff 00000000`00000000 fffff980`049822a0 : nvlddmkm+0x12a5b0
fffff800`00b9c848 fffffa80`03bc8000 : 00000000`ffffffff 00000000`00000000 fffff980`049822a0 00000000`00000001 : 0xfffff980`028cc9f0
fffff800`00b9c850 00000000`ffffffff : 00000000`00000000 fffff980`049822a0 00000000`00000001 00000000`00000000 : 0xfffffa80`03bc8000
fffff800`00b9c858 00000000`00000000 : fffff980`049822a0 00000000`00000001 00000000`00000000 fffff880`04a16de6 : 0xffffffff


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nvlddmkm+12a5b0
fffff880`04a145b0 ??              ???

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  nvlddmkm+12a5b0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nvlddmkm

IMAGE_NAME:  nvlddmkm.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a0c8387

FAILURE_BUCKET_ID:  X64_0xD1_VRF_CODE_AV_BAD_IP_nvlddmkm+12a5b0

BUCKET_ID:  X64_0xD1_VRF_CODE_AV_BAD_IP_nvlddmkm+12a5b0

Followup: MachineOwner
---------

kd> lmvm nvlddmkm
start             end                 module name
fffff880`048ea000 fffff880`053f1b00   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        Thu May 14 14:48:07 2009 (4A0C8387)
    CheckSum:         00B1940A
    ImageSize:        00B07B00
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Loading Dump File [G:\Kingston\BSODDmpFiles\supes\minidmp\013112-37000-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) UP Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02849000 PsLoadedModuleList = 0xfffff800`02a8e670
Debug session time: Tue Jan 31 13:09:14.906 2012 (GMT-7)
System Uptime: 0 days 0:00:10.671
Loading Kernel Symbols
...............................................................
................................
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff800028db5b5}

Probably caused by : ndis.sys ( ndis! ?? ::FNODOBFM::`string'+68c )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800028db5b5, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002af8100
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+ae5
fffff800`028db5b5 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

IRP_ADDRESS:  ffffffffffffff89

TRAP_FRAME:  fffff88002f4cbc0 -- (.trap 0xfffff88002f4cbc0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88002f4cf80 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800028db5b5 rsp=fffff88002f4cd50 rbp=0000000000000000
 r8=fffff88002f4ce58  r9=fffff88002f4ce50 r10=0000000000000002
r11=fffff800028daad0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe cy
nt!IopCompleteRequest+0xae5:
fffff800`028db5b5 488b09          mov     rcx,qword ptr [rcx] ds:0001:00000000`00000000=????????????????
Resetting default scope

LOCK_ADDRESS:  fffff80002ac4b80 -- (!locks fffff80002ac4b80)

Resource @ nt!PiEngineLock (0xfffff80002ac4b80)    Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE: 
	Lock address  : 0xfffff80002ac4b80
	Thread Count  : 0
	Thread address: 0x0000000000000000
	Thread wait   : 0x0

LAST_CONTROL_TRANSFER:  from fffff800028c51e9 to fffff800028c5c40

STACK_TEXT:  
fffff880`02f4ca78 fffff800`028c51e9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`02f4ca80 fffff800`028c3e60 : fffff980`02f84fb8 00000000`00000001 fffff880`02f4d080 fffff980`012feee0 : nt!KiBugCheckDispatch+0x69
fffff880`02f4cbc0 fffff800`028db5b5 : fffffa80`02439040 fffff800`028c84da fffffa80`039111c8 fffff880`00f65722 : nt!KiPageFault+0x260
fffff880`02f4cd50 fffff800`028b92f7 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopCompleteRequest+0xae5
fffff880`02f4ce20 fffff800`028cb13d : fffffa80`02439040 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1c7
fffff880`02f4cea0 fffff800`028cd74f : fffffa80`0393ab20 fffff800`02d657e5 fffffa80`00000000 fffff800`02a3be80 : nt!KiCommitThreadWait+0x3dd
fffff880`02f4cf30 fffff800`02d625b1 : 00000000`00000000 00000000`00000000 fffffa80`037a6900 fffff800`02d6bc00 : nt!KeWaitForSingleObject+0x19f
fffff880`02f4cfd0 fffff880`014d27a4 : fffff880`02f4d080 fffffa80`00000000 fffffa80`03943790 fffffa80`037a69b0 : nt!VerifierKeWaitForSingleObject+0x151
fffff880`02f4d050 fffff880`0156a8a1 : fffffa80`03ac11a0 00000000`00000000 00000000`00000000 00000000`00000000 : ndis! ?? ::FNODOBFM::`string'+0x68c
fffff880`02f4d0b0 fffff880`0152f2aa : fffffa80`03ac11a0 00000000`00000000 00000000`00000005 fffff880`02f4d218 : ndis!ndisQueryBusInterface+0x101
fffff880`02f4d190 fffff880`01566ba8 : 00000000`00000004 00000000`c0000001 40000080`00000002 fffffa80`03ac11a0 : ndis! ?? ::NNGAKEGL::`string'+0xe22
fffff880`02f4d3b0 fffff880`01531981 : 00060000`06000000 fffffa80`017f0000 fffffa80`03940201 00060000`06000000 : ndis!ndisAddDevice+0x5e8
fffff880`02f4d500 fffff800`029c1e15 : fffff880`02f4d860 fffff880`02f4d828 00000000`00000000 fffff880`02f4d704 : ndis!ndisPnPAddDevice+0x6a1
fffff880`02f4d6e0 fffff800`02ca8fe5 : 00000000`00000000 fffffa80`03940250 00000000`00000002 fffffa80`017f7010 : nt!PpvUtilCallAddDevice+0x45
fffff880`02f4d720 fffff800`02cb0511 : fffffa80`017f7010 fffffa80`017f7010 00000000`00000000 00000000`00000000 : nt!PnpCallAddDevice+0xd5
fffff880`02f4d7a0 fffff800`02cb1aa2 : fffffa80`017f6390 fffffa80`017f7010 00000000`00000001 fffffa80`017f3a40 : nt!PipCallDriverAddDevice+0x661
fffff880`02f4d950 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PipProcessDevNodeTree+0x2b2


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ndis! ?? ::FNODOBFM::`string'+68c
fffff880`014d27a4 8b4730          mov     eax,dword ptr [rdi+30h]

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  ndis! ?? ::FNODOBFM::`string'+68c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ndis

IMAGE_NAME:  ndis.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79392

FAILURE_BUCKET_ID:  X64_0xA_VRF_ndis!_??_::FNODOBFM::_string_+68c

BUCKET_ID:  X64_0xA_VRF_ndis!_??_::FNODOBFM::_string_+68c

Followup: MachineOwner
---------

Loading Dump File [G:\Kingston\BSODDmpFiles\supes\minidmp\013112-60562-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) UP Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02813000 PsLoadedModuleList = 0xfffff800`02a58670
Debug session time: Tue Jan 31 11:11:14.576 2012 (GMT-7)
System Uptime: 0 days 0:16:40.341
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {3, 5, 1, fffff880049fc7b0}

Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : hardware ( nvlddmkm+12e7b0 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000003, memory referenced
Arg2: 0000000000000005, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff880049fc7b0, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ac2100
 0000000000000003 

CURRENT_IRQL:  5

FAULTING_IP: 
nvlddmkm+12e7b0
fffff880`049fc7b0 c07402ffc6      sal     byte ptr [rdx+rax-1],0C6h

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b9c690 -- (.trap 0xfffff80000b9c690)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffff98004902430
rdx=0000000000000003 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880049fc7b0 rsp=fffff80000b9c820 rbp=0000000000000003
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nvlddmkm+0x12e7b0:
fffff880`049fc7b0 c07402ffc6      sal     byte ptr [rdx+rax-1],0C6h ds:0140:00000000`00000003=??
Resetting default scope

MISALIGNED_IP: 
nvlddmkm+12e7b0
fffff880`049fc7b0 c07402ffc6      sal     byte ptr [rdx+rax-1],0C6h

LAST_CONTROL_TRANSFER:  from fffff8000288f1e9 to fffff8000288fc40

STACK_TEXT:  
fffff800`00b9c548 fffff800`0288f1e9 : 00000000`0000000a 00000000`00000003 00000000`00000005 00000000`00000001 : nt!KeBugCheckEx
fffff800`00b9c550 fffff800`0288de60 : fffff800`00b9c610 fffff800`00b9d000 fffff800`02a05e80 fffff980`04902430 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c690 fffff880`049fc7b0 : 00000000`00000001 00000000`00000000 00000000`00000000 fffff880`049f85b0 : nt!KiPageFault+0x260
fffff800`00b9c820 00000000`00000001 : 00000000`00000000 00000000`00000000 fffff880`049f85b0 fffff980`045189f0 : nvlddmkm+0x12e7b0
fffff800`00b9c828 00000000`00000000 : 00000000`00000000 fffff880`049f85b0 fffff980`045189f0 fffff980`04fdc2a0 : 0x1


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nvlddmkm+12e7b0
fffff880`049fc7b0 c07402ffc6      sal     byte ptr [rdx+rax-1],0C6h

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nvlddmkm+12e7b0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: hardware

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED_nvlddmkm.sys

BUCKET_ID:  X64_IP_MISALIGNED_nvlddmkm.sys

Followup: MachineOwner
---------

Loading Dump File [G:\Kingston\BSODDmpFiles\supes\minidmp\013112-77203-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) UP Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0284c000 PsLoadedModuleList = 0xfffff800`02a91670
Debug session time: Tue Jan 31 08:38:01.209 2012 (GMT-7)
System Uptime: 0 days 0:46:26.959
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffff88007ff57f0, 5, 8, fffff88007ff57f0}

Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : nvlddmkm.sys ( nvlddmkm+13600f )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff88007ff57f0, memory referenced
Arg2: 0000000000000005, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: fffff88007ff57f0, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002afb100
 fffff88007ff57f0 

CURRENT_IRQL:  5

FAULTING_IP: 
+6a16952f0387daf4
fffff880`07ff57f0 ??              ???

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b9c790 -- (.trap 0xfffff80000b9c790)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffffa8002d1f010
rdx=0000000000000003 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88007ff57f0 rsp=fffff80000b9c920 rbp=0000000000000003
 r8=0000000000000000  r9=0000000000000000 r10=fffffa8002d1f010
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
fffff880`07ff57f0 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800028c81e9 to fffff800028c8c40

FAILED_INSTRUCTION_ADDRESS: 
+6a16952f0387daf4
fffff880`07ff57f0 ??              ???

STACK_TEXT:  
fffff800`00b9c648 fffff800`028c81e9 : 00000000`0000000a fffff880`07ff57f0 00000000`00000005 00000000`00000008 : nt!KeBugCheckEx
fffff800`00b9c650 fffff800`028c6e60 : fffffa80`036842f0 fffff880`0499c02f fffffa80`036842f0 fffffa80`02d1f010 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c790 fffff880`07ff57f0 : fffffa80`02d36000 fffff880`0499a00f 00000000`00000005 00000000`00000000 : nt!KiPageFault+0x260
fffff800`00b9c920 fffffa80`02d36000 : fffff880`0499a00f 00000000`00000005 00000000`00000000 00000000`00000000 : 0xfffff880`07ff57f0
fffff800`00b9c928 fffff880`0499a00f : 00000000`00000005 00000000`00000000 00000000`00000000 00000000`00000001 : 0xfffffa80`02d36000
fffff800`00b9c930 00000000`00000005 : 00000000`00000000 00000000`00000000 00000000`00000001 fffffa80`02d1f010 : nvlddmkm+0x13600f
fffff800`00b9c938 00000000`00000000 : 00000000`00000000 00000000`00000001 fffffa80`02d1f010 fffff880`0499993f : 0x5


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nvlddmkm+13600f
fffff880`0499a00f ??              ???

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  nvlddmkm+13600f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nvlddmkm

IMAGE_NAME:  nvlddmkm.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49a757e3

FAILURE_BUCKET_ID:  X64_0xD1_CODE_AV_BAD_IP_nvlddmkm+13600f

BUCKET_ID:  X64_0xD1_CODE_AV_BAD_IP_nvlddmkm+13600f

Followup: MachineOwner
---------

Possible causes are Memory problems... Viruses... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...
Thanks to JMH for helping with my understanding of this crash.
Possible causes are Memory problems... Drivers...
Your graphics driver is a bit outdated and is pre-Windows 7. Please update as described in my previous post.
Possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Antivirus Software...
Your graphics driver is a bit outdated and is pre-Windows 7. Please update as described in my previous post.
Your graphics driver is a bit outdated and is pre-Windows 7. Please update as described in my previous post.

Thanks to Dave76 for help understanding possible causes.

We will start with the common problems first (see bold possible causes). Do the following steps and test after each to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
Disable Driver Verifier before proceeding with the next steps
Update your graphics card driver using the steps from my previous post. Follow the https://www.sevenforums.com/crashes-d...tructions.html to give us information about your display card so we can help you update or roll back the driver.
Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log
Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.

Britton30 · 02 Feb 2012

Sorry to come late to the party. Sometimes the latest driver isn't the best. Graphics driver are especially prone to bugginess, I've had issues with my own nVIDIA drivers.
Try, again, uninstalling nVIDIA drivers with Driver Sweeper (link in my sig). Download and save a previous version and have it ready to install.

writhziden · 02 Feb 2012

Britton30 said:

Sorry to come late to the party. Sometimes the latest driver isn't the best. Graphics driver are especially prone to bugginess, I've had issues with my own nVIDIA drivers.
Try, again, uninstalling nVIDIA drivers with Driver Sweeper (link in my sig). Download and save a previous version and have it ready to install.

Thanks, I just realized I was looking at someone else's msinfo32 file when I gave the link. You reminded me that supes has not yet followed the https://www.sevenforums.com/crashes-d...tructions.html so I can get the necessary info to help find the proper display card drivers.

Supes, please follow those instructions so we may better help you. :)

supes · 03 Feb 2012

Ok here goes...

writhziden · 03 Feb 2012

Thanks for uploading those files. It really does help us help you better. :)

You can download the latest driver from Graphics Driver - GeForce 285.62 Driver - GeForce for your graphics card. If that does not work, we can track down older drivers as Britton30 suggested, but you definitely need a newer one than your current driver since yours is before Windows 7 was released.

supes · 04 Feb 2012

Thanks for all the help writhzeden..

Getting really close to giving up now. I downloaded and installed that driver but still getting blue screens as you can see. If it's not a blue screen it's just a total freeze.

writhziden · 04 Feb 2012

Freezing is usually memory related (either your RAM or your graphics card memory) or it may be caused by overheating. Proceed with the following steps.

Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
Download and install the appropriate version of HWINFO: HWiNFO32 for 32-bit Windows 7 or HWiNFO64 for 64-bit Windows 7 to check hardware temperatures by running in sensor-only mode.
Use FurMark: VGA Stress Test, Graphics Card and GPU Stability Test, Burn-in Test, OpenGL Benchmark and GPU Temperature | oZone3D.Net to test the graphics card GPU. Then use the |MG| Video Memory Stress Test 1.7.116 Download to test your graphics card memory.
Run Hardware - Stress Test With Prime95 to determine any hardware problems. Run all three tests for a few hours each. If you get errors, stop the test and post back here.

Did you give up?