BSOD Error on oa002afx.sys, oa002ufd.sys and ndis.sys

writhziden · 16 Mar 2012

Problem Devices:

Code:

Monitor Webcam #3	USB\VID_05A9&PID_264B&MI_00\8&23E0EF4D&0&0000	39
Monitor Webcam	USB\VID_05A9&PID_264B&MI_02\8&23E0EF4D&0&0002	39

Antivirus Software:

Code:

ccsvchst.exe	c:\program files (x86)\norton 360\engine\5.2.0.13\ccsvchst.exe	1208	8	1024	10240	17/03/2012 10:06 a.m.	10.1.1.16	126.96 KB (130,008 bytes)	1/02/2012 8:55 a.m.
ccsvchst.exe	c:\program files (x86)\norton 360\engine\5.2.0.13\ccsvchst.exe	3068	8	1024	10240	17/03/2012 10:06 a.m.	10.1.1.16	126.96 KB (130,008 bytes)	1/02/2012 8:55 a.m.

Tune-up software:

Code:

tuneuputilitiesapp64.exe	c:\program files (x86)\tuneup utilities 2012\tuneuputilitiesapp64.exe	2984	8	200	1380	17/03/2012 10:06 a.m.	12.0.3010.5	1.29 MB (1,352,512 bytes)	9/02/2012 2:13 p.m.
tuneuputilitiesservice64.exe	c:\program files (x86)\tuneup utilities 2012\tuneuputilitiesservice64.exe	2376	8	200	1380	17/03/2012 10:06 a.m.	12.0.3010.5	2.04 MB (2,143,552 bytes)	9/02/2012 2:13 p.m.

Many of us on the forums actually do not recommend automated optimization tools for Windows 7. Windows 7 does a much better job of handling its own optimization than its predecessors did. We especially do not recommend registry cleaning as an "optimization" step because automated registry cleaning causes more harm to the registry than it actually repairs.

In the future, if you need help optimizing Windows 7, please post a thread in Performance & Maintenance - Windows 7 Forums or follow the tutorial enclosed in that forum to Optimize Windows 7.

Possible out of date drivers:

Code:

wsimdx	fffff880`05856000	fffff880`0586c000	Tue Mar 17 00:19:55 2009 (49bf410b)	0001dda9	None	wsimdx.sys
CtClsFlt	fffff880`05d67000	fffff880`05d912a0	Sun Jun 14 23:06:41 2009 (4a35d6e1)	00037d92		CtClsFlt.sys
LHidFilt	fffff880`06a73000	fffff880`06a86000	Wed Jun 17 10:49:39 2009 (4a391ea3)	00014ede		LHidFilt.Sys
LMouFilt	fffff880`06a93000	fffff880`06aa7000	Wed Jun 17 10:49:43 2009 (4a391ea7)	0001d7ff		LMouFilt.Sys
LUsbFilt	fffff880`06a31000	fffff880`06a41000	Wed Jun 17 10:49:46 2009 (4a391eaa)	0001245f		LUsbFilt.Sys
PxHlpa64	fffff880`010e4000	fffff880`010efe00	Tue Jun 23 17:16:35 2009 (4a416253)	000111b7		PxHlpa64.sys

wsimdx.sys AR5005G row, windows 7 64-bit column, click on the blue check mark to get the driver.
CtClsFlt.sys
LHidFilt.Sys
LMouFilt.Sys
LUsbFilt.Sys
PxHlpa64.sys

If you are using your wireless network adapter for network or internet connections, please update your driver above.

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\christianb9632\Windows_NT6_BSOD_jcgriff2\031712-29624-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0324e000 PsLoadedModuleList = 0xfffff800`03492650
Debug session time: Fri Mar 16 02:20:21.056 2012 (UTC - 6:00)
System Uptime: 0 days 0:04:37.539
Loading Kernel Symbols
...............................................................
................................................................
............................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffff8800172f6a0, 2, 8, fffff8800172f6a0}

Unable to load image \SystemRoot\system32\DRIVERS\wsimdx.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for wsimdx.sys
*** ERROR: Module load completed but symbols could not be loaded for wsimdx.sys
Probably caused by : wsimdx.sys ( wsimdx+7959 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff8800172f6a0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: fffff8800172f6a0, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034fc100
 fffff8800172f6a0 

CURRENT_IRQL:  2

FAULTING_IP: 
ndis!NdisIMNotifyPnPEvent+0
fffff880`0172f6a0 48895c2408      mov     qword ptr [rsp+8],rbx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff88007cd41f0 -- (.trap 0xfffff88007cd41f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8006ab01a0
rdx=fffff88007cd4518 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800172f6a0 rsp=fffff88007cd4388 rbp=fffff88007cd4518
 r8=000000000000013c  r9=fffff880058698b8 r10=fffff88007cd4430
r11=0000000000000005 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
ndis!NdisIMNotifyPnPEvent:
fffff880`0172f6a0 48895c2408      mov     qword ptr [rsp+8],rbx ss:0018:fffff880`07cd4390=fffff880016b57a3
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032ca2e9 to fffff800032cad40

FAILED_INSTRUCTION_ADDRESS: 
ndis!NdisIMNotifyPnPEvent+0
fffff880`0172f6a0 48895c2408      mov     qword ptr [rsp+8],rbx

STACK_TEXT:  
fffff880`07cd40a8 fffff800`032ca2e9 : 00000000`0000000a fffff880`0172f6a0 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff880`07cd40b0 fffff800`032c8f60 : 00000000`00000000 fffffa80`03adcd98 00000000`00000007 fffff980`25978b80 : nt!KiBugCheckDispatch+0x69
fffff880`07cd41f0 fffff880`0172f6a0 : fffff880`0585d959 fffff880`016b57a3 fffff980`25978b80 fffff880`07cd4518 : nt!KiPageFault+0x260
fffff880`07cd4388 fffff880`0585d959 : fffff880`016b57a3 fffff980`25978b80 fffff880`07cd4518 fffff880`0170c110 : ndis!NdisIMNotifyPnPEvent
fffff880`07cd4390 fffff880`016b57a3 : fffff980`25978b80 fffff880`07cd4518 fffff880`0170c110 00000000`00000000 : wsimdx+0x7959
fffff880`07cd4398 fffff980`25978b80 : fffff880`0585f39c 00000000`c0000000 fffff800`0375a491 00000000`00000005 : ndis!ndisReferenceNextUnprocessedOpenEx+0x83
fffff880`07cd43e8 fffff880`0585f39c : 00000000`c0000000 fffff800`0375a491 00000000`00000005 fffff800`03387dbb : 0xfffff980`25978b80
fffff880`07cd43f0 00000000`c0000000 : fffff800`0375a491 00000000`00000005 fffff800`03387dbb fffff980`258588d0 : wsimdx+0x939c
fffff880`07cd43f8 fffff800`0375a491 : 00000000`00000005 fffff800`03387dbb fffff980`258588d0 fffff880`07cd4510 : 0xc0000000
fffff880`07cd4400 fffff880`01747b2f : 00000000`c00000bb fffff880`07cd4510 fffffa80`03adcab0 00000000`00000000 : nt!VerifierKeInitializeEvent+0x21
fffff880`07cd4430 fffff880`017482cf : fffff980`258588d0 00000000`00000000 00000000`00000000 fffff880`0170c101 : ndis!ndisPnPNotifyBinding+0xbf
fffff880`07cd44c0 fffff880`0172e792 : fffff980`00000000 00000000`00000000 00000000`00000000 fffff880`00000001 : ndis!ndisPnPNotifyAllTransports+0x18f
fffff880`07cd4630 fffff880`0172e760 : fffff980`3afdec90 fffffa80`068f21a0 fffff980`2669cc90 fffff880`07cd4710 : ndis!NdisFNetPnPEvent+0xd2
fffff880`07cd4670 fffff880`02eff06b : fffff880`07cd4710 fffff880`07cd4834 fffff880`02f06110 fffff980`266d4310 : ndis!NdisFNetPnPEvent+0xa0
fffff880`07cd46b0 fffff880`016fa328 : fffff980`2669cc90 fffffa80`068f21a0 fffffa80`068f21a0 fffff800`0324f77f : vwififlt!FilterNetPnPEvent+0x53
fffff880`07cd46e0 fffff880`01764e4c : 00000000`00000004 00000000`00000000 fffffa80`068f21a0 fffff880`0170c110 : ndis!ndisDevicePnPEventNotifyFiltersAndAllTransports+0x128
fffff880`07cd47e0 fffff880`016fb16f : fffff980`60946e90 00000000`00000002 fffffa80`06029cf0 fffff800`0376bd86 : ndis!ndisSetPower+0xabc
fffff880`07cd48a0 fffff800`033c81d2 : fffff980`60946d30 00000000`00000002 fffffa80`068f2050 fffffa80`050c8270 : ndis!ndisPowerDispatch+0x1ef
fffff880`07cd48f0 fffff800`0376fc02 : fffff980`60946d30 00000000`00000002 fffff980`60946d30 fffff800`0376b37e : nt!IopPoHandleIrp+0x32
fffff880`07cd4920 fffff800`0376ec42 : fffff980`60946e90 00000000`00000002 fffffa80`068cef50 fffffa80`050c8270 : nt!IovCallDriver+0x552
fffff880`07cd4980 fffff800`033c81d2 : fffff980`60946d30 00000000`00000002 fffffa80`068cee00 fffffa80`049e3350 : nt!ViFilterDispatchGeneric+0x62
fffff880`07cd49b0 fffff800`0376fc02 : fffff980`60946d30 00000000`00000002 fffff880`07cd4b12 fffffa80`0561f7a0 : nt!IopPoHandleIrp+0x32
fffff880`07cd49e0 fffff880`00f90c34 : fffff980`60946ed8 fffff880`07cd4b60 fffffa80`0561f7a0 fffffa80`049e3350 : nt!IovCallDriver+0x552
fffff880`07cd4a40 fffff880`00f90f4c : fffffa80`0561f7a0 fffff880`07cd4b60 fffff980`1abf0b60 fffff980`1abf0b60 : Wdf01000!FxPkgFdo::_PowerPassDown+0x6c
fffff880`07cd4a70 fffff880`00f90c8a : 00000000`00000002 00000000`00000002 00000000`00000000 00000000`00000000 : Wdf01000!FxPkgFdo::DispatchSystemSetPower+0x194
fffff880`07cd4ac0 fffff880`00f7ff38 : fffff980`1aa68e70 00000000`00000000 fffff980`1abf0b60 fffff800`033e0200 : Wdf01000!FxPkgFdo::_DispatchSetPower+0x1a
fffff880`07cd4af0 fffff880`00f4f245 : fffff980`60946d30 fffff980`60946d30 fffffa80`0561f7a0 fffff800`033c8112 : Wdf01000!FxPkgPnp::Dispatch+0x314
fffff880`07cd4b60 fffff880`00f4f14b : fffff980`60946d30 00000000`00000002 fffffa80`0561f7a0 fffffa80`04bd2830 : Wdf01000!FxDevice::Dispatch+0xa9
fffff880`07cd4b90 fffff800`033c81d2 : fffff980`60946d30 00000000`00000002 fffffa80`0561f7a0 fffffa80`04bd2830 : Wdf01000!FxDevice::DispatchWithLock+0x93
fffff880`07cd4bd0 fffff800`0376fc02 : fffff980`60946d30 00000000`00000002 fffff980`60946d30 fffff800`0376b37e : nt!IopPoHandleIrp+0x32
fffff880`07cd4c00 fffff800`0376ec42 : fffff980`60946f20 00000000`00000000 fffffa80`067ecd60 fffffa80`04bd2830 : nt!IovCallDriver+0x552
fffff880`07cd4c60 fffff800`033e0695 : 00000000`00000001 00000000`00000000 fffffa80`067ecc10 fffff980`60946dd8 : nt!ViFilterDispatchGeneric+0x62
fffff880`07cd4c90 fffff800`03564f7a : ffffffff`fa0a1f00 fffffa80`04cecb60 00000000`00000080 fffff800`032c2857 : nt!PopIrpWorker+0x3c5
fffff880`07cd4d40 fffff800`032bb9c6 : fffff800`0343fe80 fffffa80`04cecb60 fffffa80`082e3610 fffff880`01210a20 : nt!PspSystemThreadStartup+0x5a
fffff880`07cd4d80 00000000`00000000 : fffff880`07cd5000 fffff880`07ccf000 fffff880`07cd4080 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
wsimdx+7959
fffff880`0585d959 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  wsimdx+7959

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: wsimdx

IMAGE_NAME:  wsimdx.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49bf410b

FAILURE_BUCKET_ID:  X64_0xD1_VRF_CODE_AV_BAD_IP_wsimdx+7959

BUCKET_ID:  X64_0xD1_VRF_CODE_AV_BAD_IP_wsimdx+7959

Followup: MachineOwner
---------

Points to the wireless adapter mentioned above that needs to have its drivers updated. See if updating the drivers resolves the issue.

christianb9632 · 17 Mar 2012

Hello again,
How do I update my webcam?
It is an integrated cam to my monitor. It's a Dell SX2210 Monitor.

And, I don't know if I have done this right, but I changed PxHlpa64.sys to PxHlpa64.BAK

Regards,
Christian

christianb9632 · 17 Mar 2012

Hello, I have a big problem.
I 'updated' the ATHEROS driver, BUT now after i restarted computer, I cannot access the internet at all.

Please Help,

I cannot do anything without internet (I am writing this from another computer)

Regards,
Christian

zigzag3143 · 17 Mar 2012

You still have the drivers from 2009 that both I and writhziden told you (including a link from where to get the newer ones) to update.

Until you do, and you upload any further DMP files we have no new information to go on.

christianb9632 · 17 Mar 2012

I am truly sorry if I don't quite understand, as english is not my 1st language.

I have updated the drivers:

wsimdx.sys AR5005G row, windows 7 64-bit column, click on the blue check mark to get the driver.
CtClsFlt.sys
LHidFilt.Sys
LMouFilt.Sys
LUsbFilt.Sys
PxHlpa64.sys

I have a problem with updating the ATHEROS driver which caused the adapter to stop working
How do I repair this/get it to work again.

Regards,
Christian

zigzag3143 · 17 Mar 2012

Now we wait for it to crash. If it does upload the DMP's to us.

go to device manager (start>search>type device manager)

Find the device and un-install the driver for it. Reboot

christianb9632 · 17 Mar 2012

Great news, I entered Sleep mode successfully

I can also access the internet now

Thankyou to everybody for your help.
Greatly appreciated.

I would definetly recommend this forum to anybody

Kindest Regards,
Christian

christianb9632 · 17 Mar 2012

Ok, just when I least expect it, I had another BSOD -___-

This time it was when I started Dell Webcam Central

(Files attached)

Regards,
Christian

writhziden · 17 Mar 2012

Code:

Loading Dump File [D:\Kingston\BSODDmpFiles\christianb9632\Windows_NT6_BSOD_jcgriff2\031812-51105-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0321a000 PsLoadedModuleList = 0xfffff800`0345e650
Debug session time: Sat Mar 17 06:00:03.839 2012 (UTC - 6:00)
System Uptime: 0 days 2:03:41.947
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C9, {226, fffff8800b580000, fffff98069be0ee0, 0}

Unable to load image \??\C:\Program Files\Unlocker\UnlockerDriver5.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for UnlockerDriver5.sys
*** ERROR: Module load completed but symbols could not be loaded for UnlockerDriver5.sys
Probably caused by : UnlockerDriver5.sys ( UnlockerDriver5+2000 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 0000000000000226, An IRP dispatch handler has returned without passing down or completing this IRP,
	or someone forgot to return STATUS_PENDING.
Arg2: fffff8800b580000, The address in the driver's code where the error was detected.
Arg3: fffff98069be0ee0, IRP address.
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc9_226

DRIVER_VERIFIER_IO_VIOLATION_TYPE:  226

FAULTING_IP: 
UnlockerDriver5+2000
fffff880`0b580000 33c0            xor     eax,eax

FOLLOWUP_IP: 
UnlockerDriver5+2000
fffff880`0b580000 33c0            xor     eax,eax

IRP_ADDRESS:  fffff98069be0ee0

DEVICE_OBJECT: fffffa8008b484a0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  Unlocker.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff8000371f3dc to fffff80003296d40

STACK_TEXT:  
fffff880`0bc094e8 fffff800`0371f3dc : 00000000`000000c9 00000000`00000226 fffff880`0b580000 fffff980`69be0ee0 : nt!KeBugCheckEx
fffff880`0bc094f0 fffff800`0372947a : fffff800`0371d9f0 fffff880`0b580000 fffff980`69be0ee0 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`0bc09530 fffff800`0372a483 : 00000000`00000226 fffffa80`05224b28 fffff980`69be0ee0 00000000`ffffffff : nt!ViErrorFinishReport+0xda
fffff880`0bc09580 fffff800`0373579c : fffffa80`0ca80010 fffffa80`05224a70 fffffa80`05224b28 fffffa80`04f63090 : nt!VfErrorReport1+0x63
fffff880`0bc09620 fffff800`03735b63 : fffffa80`05224a70 00000000`00000002 fffffa80`08b484a0 fffff880`0b580000 : nt!IovpCallDriver2+0x1bc
fffff880`0bc09680 fffff800`0373bc2e : fffff980`69be0ee0 fffff980`69be0ee0 00000000`00000002 fffffa80`08b484a0 : nt!VfAfterCallDriver+0x353
fffff880`0bc096d0 fffff800`03593cd5 : 00000000`00000025 fffffa80`058291c8 fffffa80`09818010 fffffa80`05224a70 : nt!IovCallDriver+0x57e
fffff880`0bc09730 fffff800`03590578 : fffffa80`08b484a0 00000000`00000000 fffffa80`05829010 fffffa80`00000001 : nt!IopParseDevice+0x5a5
fffff880`0bc098c0 fffff800`03591796 : 00000000`00000000 fffffa80`05829010 00000000`00000000 fffffa80`03b91750 : nt!ObpLookupObjectName+0x588
fffff880`0bc099b0 fffff800`0359309c : 00000000`00000000 00000000`00000000 00000000`00000101 00000000`00000000 : nt!ObOpenObjectByName+0x306
fffff880`0bc09a80 fffff800`0359dce4 : 00000000`00122c68 fffff800`c0100080 00000000`00122cb8 00000000`00122c78 : nt!IopCreateFile+0x2bc
fffff880`0bc09b20 fffff800`03295fd3 : fffffa80`07c6db60 00000000`00122c58 fffff880`0bc09bc8 fffffa80`00000000 : nt!NtCreateFile+0x78
fffff880`0bc09bb0 00000000`774d186a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00122be8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774d186a


STACK_COMMAND:  .bugcheck ; kb

SYMBOL_NAME:  UnlockerDriver5+2000

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: UnlockerDriver5

IMAGE_NAME:  UnlockerDriver5.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4be0adcb

FAILURE_BUCKET_ID:  X64_0xc9_226_VRF_UnlockerDriver5+2000

BUCKET_ID:  X64_0xc9_226_VRF_UnlockerDriver5+2000

Followup: MachineOwner
---------

Please remove Unlocker. It is used to delete files that are in use, but it is known to cause issues on Windows systems.

christianb9632 · 17 Mar 2012

Would that be the only problem?
I also noticed OA002Afx/Ufd.sys came back

Do you want me to do another perfmon /report ?