Sudden restarts every month or so (L1C62x64.sys)


  1. Posts : 69
    Win 7 64 bit
       #1

    Sudden restarts every month or so (L1C62x64.sys)


    I seem to have sudden restarts, without any notice, every month or so...
    WINDBG tells me it's "L1C62x64.sys".

    In system managment I get 2 errors.
    1. Kernel- Microsoft Security Client OOBE stopped. error 0xC000000D
    EVENT ID: 3
    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
    <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />

    <EventID>3</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>2</Task>

    <Opcode>14</Opcode>

    <Keywords>0x8000000000000010</Keywords>

    <TimeCreated SystemTime="2014-11-19T14:52:05.719616200Z" />

    <EventRecordID>40</EventRecordID>

    <Correlation />

    <Execution ProcessID="4" ThreadID="168" />

    <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>

    <Computer>MaoR-PC</Computer>

    <Security UserID="S-1-5-18" />

    </System>


    - <EventData>
    <Data Name="SessionName">Microsoft Security Client OOBE</Data>

    <Data Name="FileName">C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl</Data>

    <Data Name="ErrorCode">3221225485</Data>

    <Data Name="LoggingMode">5</Data>

    </EventData>


    </Event>

    2. Bug check
    " 0x000000d1 (0x0000000000000000, 0x0000000000000002, 0x0000000000000000, 0xfffff88002dccc9b). Dump file saved in: C:\Windows\MEMORY.DMP. Report: 111914-13806-01."
    EVENT ID: 1001


    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-11-19T14:52:18.000000000Z" />
    <EventRecordID>12594</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>MaoR-PC</Computer>
    <Security />
    </System>
    <EventData>
    <Data Name="param1">0x000000d1 (0x0000000000000000, 0x0000000000000002, 0x0000000000000000, 0xfffff88002dccc9b)</Data>
    <Data Name="param2">C:\Windows\MEMORY.DMP</Data>
    <Data Name="param3">111914-13806-01</Data>
    </EventData>
    </Event>
    And A critical error:
    ID: 41, Task: 63

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />

    <EventID>41</EventID>

    <Version>2</Version>

    <Level>1</Level>

    <Task>63</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8000000000000002</Keywords>

    <TimeCreated SystemTime="2014-11-19T14:52:02.459210500Z" />

    <EventRecordID>12586</EventRecordID>

    <Correlation />

    <Execution ProcessID="4" ThreadID="8" />

    <Channel>System</Channel>

    <Computer>MaoR-PC</Computer>

    <Security UserID="S-1-5-18" />

    </System>


    - <EventData>
    <Data Name="BugcheckCode">209</Data>

    <Data Name="BugcheckParameter1">0x0</Data>

    <Data Name="BugcheckParameter2">0x2</Data>

    <Data Name="BugcheckParameter3">0x0</Data>

    <Data Name="BugcheckParameter4">0xfffff88002dccc9b</Data>

    <Data Name="SleepInProgress">false</Data>

    <Data Name="PowerButtonTimestamp">0</Data>

    </EventData>


    </Event>


    I added 2 files from each date I've had this.

    Thank you.
      My Computer


  2. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #2

    Just as an initial test, can you uninstall the network driver and try the Version: 2.1.0.17?
    ____________________________________________
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
    Arg4: fffff88002dccc9b, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003105100
    GetUlongFromAddress: unable to read from fffff800031051c0
     0000000000000000 Nonpaged pool
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    L1C62x64+6c9b
    fffff880`02dccc9b 488b08          mov     rcx,qword ptr [rax]
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    BUGCHECK_STR:  0xD1
    
    PROCESS_NAME:  uTorrent.exe
    
    ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
    
    TRAP_FRAME:  fffff8800a6529a0 -- (.trap 0xfffff8800a6529a0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=00000000000015f2
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff88002dccc9b rsp=fffff8800a652b30 rbp=fffffa8008093938
     r8=0000000000000090  r9=fffffa8007f39000 r10=fffffa8007f3cdf0
    r11=fffff8800a652b50 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe nc
    L1C62x64+0x6c9b:
    fffff880`02dccc9b 488b08          mov     rcx,qword ptr [rax] ds:00000000`00000000=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80002ecd169 to fffff80002ecdbc0
    
    STACK_TEXT:  
    fffff880`0a652858 fffff800`02ecd169 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
    fffff880`0a652860 fffff800`02ecbde0 : 00000000`00000002 00000000`00000033 fffffa80`070c36c0 00000000`00000001 : nt!KiBugCheckDispatch+0x69
    fffff880`0a6529a0 fffff880`02dccc9b : fffffa80`07f3cbb0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
    fffff880`0a652b30 fffffa80`07f3cbb0 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`07f3cbb0 : L1C62x64+0x6c9b
    fffff880`0a652b38 00000000`00000000 : 00000000`00000000 00000000`00000000 fffffa80`07f3cbb0 fffffa80`08039570 : 0xfffffa80`07f3cbb0
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    L1C62x64+6c9b
    fffff880`02dccc9b 488b08          mov     rcx,qword ptr [rax]
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  L1C62x64+6c9b
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: L1C62x64
    
    IMAGE_NAME:  L1C62x64.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  51e4eeac
    
    FAILURE_BUCKET_ID:  X64_0xD1_L1C62x64+6c9b
    
    BUCKET_ID:  X64_0xD1_L1C62x64+6c9b
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0xd1_l1c62x64+6c9b
    
    FAILURE_ID_HASH:  {4f36e892-6520-6945-a431-fc9a3e012c6c}
    
    Followup: MachineOwner
    ---------
    
    0: kd> lmvm L1C62x64
    start             end                 module name
    fffff880`02dc6000 fffff880`02de8000   L1C62x64 T (no symbols)           
        Loaded symbol image file: L1C62x64.sys
        Image path: \SystemRoot\system32\DRIVERS\L1C62x64.sys
        Image name: L1C62x64.sys
        Timestamp:        Tue Jul 16 12:26:44 2013 (51E4EEAC)
        CheckSum:         0002912C
        ImageSize:        00022000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
      My Computer


  3. Posts : 69
    Win 7 64 bit
    Thread Starter
       #3

    Arc said:
    Just as an initial test, can you uninstall the network driver and try the Version: 2.1.0.17?
    ____________________________________________
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
    Arg4: fffff88002dccc9b, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003105100
    GetUlongFromAddress: unable to read from fffff800031051c0
     0000000000000000 Nonpaged pool
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    L1C62x64+6c9b
    fffff880`02dccc9b 488b08          mov     rcx,qword ptr [rax]
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    BUGCHECK_STR:  0xD1
    
    PROCESS_NAME:  uTorrent.exe
    
    ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
    
    TRAP_FRAME:  fffff8800a6529a0 -- (.trap 0xfffff8800a6529a0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=00000000000015f2
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff88002dccc9b rsp=fffff8800a652b30 rbp=fffffa8008093938
     r8=0000000000000090  r9=fffffa8007f39000 r10=fffffa8007f3cdf0
    r11=fffff8800a652b50 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe nc
    L1C62x64+0x6c9b:
    fffff880`02dccc9b 488b08          mov     rcx,qword ptr [rax] ds:00000000`00000000=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80002ecd169 to fffff80002ecdbc0
    
    STACK_TEXT:  
    fffff880`0a652858 fffff800`02ecd169 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
    fffff880`0a652860 fffff800`02ecbde0 : 00000000`00000002 00000000`00000033 fffffa80`070c36c0 00000000`00000001 : nt!KiBugCheckDispatch+0x69
    fffff880`0a6529a0 fffff880`02dccc9b : fffffa80`07f3cbb0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
    fffff880`0a652b30 fffffa80`07f3cbb0 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`07f3cbb0 : L1C62x64+0x6c9b
    fffff880`0a652b38 00000000`00000000 : 00000000`00000000 00000000`00000000 fffffa80`07f3cbb0 fffffa80`08039570 : 0xfffffa80`07f3cbb0
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    L1C62x64+6c9b
    fffff880`02dccc9b 488b08          mov     rcx,qword ptr [rax]
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  L1C62x64+6c9b
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: L1C62x64
    
    IMAGE_NAME:  L1C62x64.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  51e4eeac
    
    FAILURE_BUCKET_ID:  X64_0xD1_L1C62x64+6c9b
    
    BUCKET_ID:  X64_0xD1_L1C62x64+6c9b
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0xd1_l1c62x64+6c9b
    
    FAILURE_ID_HASH:  {4f36e892-6520-6945-a431-fc9a3e012c6c}
    
    Followup: MachineOwner
    ---------
    
    0: kd> lmvm L1C62x64
    start             end                 module name
    fffff880`02dc6000 fffff880`02de8000   L1C62x64 T (no symbols)           
        Loaded symbol image file: L1C62x64.sys
        Image path: \SystemRoot\system32\DRIVERS\L1C62x64.sys
        Image name: L1C62x64.sys
        Timestamp:        Tue Jul 16 12:26:44 2013 (51E4EEAC)
        CheckSum:         0002912C
        ImageSize:        00022000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    You think that might help? Anyhow, we only can see the results probably only a month from now :\

    Any idea what "uTorrent" has to do with this error? It shows up in the code you pasted here.

    What is weird is that this problem occures when MSE collapses too..
    I remember I've had this problem before. I have formatted my PC since then.
    I dont remember how I solved the MSE problem.. I just remember I used to delete a file in the MSE folder each time it happned, as a temp solution.

    Thanks :)
      My Computer


  4. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #4

    The "Process Name" field shows the name of the program that was running when the BSOD occurred. So uTorrent is. In most of the analysis, the Process Name results "System".

    uTorrent usually does not contribute to BSOD at its own, but some of its settings may cause network blockage to the rest. If there is any default settings in the program, you may apply it.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 16:34.
Find Us