BSoD

Lurhis · 03 Nov 2010

It's getting worse and worse and has no relation to what program is running or how long the machine has been on. 4 dumps attached.

Ran memtest86 through 5 passes and no memory error though that's what I think it might be.

Windows 7 Home Premium, fully updated. Machine is less than 4 months old.
computer:
Asus N61J
core i7-720
4GB mem

zigzag3143 · 03 Nov 2010

Lurhis said:

It's getting worse and worse and has no relation to what program is running or how long the machine has been on. 4 dumps attached.

Ran memtest86 through 5 passes and no memory error though that's what I think it might be.

Windows 7 Home Premium, fully updated. Machine is less than 4 months old.
computer:
Asus N61J
core i7-720
4GB mem

These were caused by vfilter.sys part of your vpn softwaare. I would remove it to test, or at least update the driver

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\New folder\110310-22713-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0305f000 PsLoadedModuleList = 0xfffff800`0329ce50
Debug session time: Wed Nov  3 16:43:04.702 2010 (GMT-4)
System Uptime: 0 days 23:09:02.763
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
.........................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff800030d38b6}

Unable to load image \SystemRoot\system32\DRIVERS\vfilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for vfilter.sys
*** ERROR: Module load completed but symbols could not be loaded for vfilter.sys
Probably caused by : vfilter.sys ( vfilter+29a6 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800030d38b6, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800033070e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeSetEvent+226
fffff800`030d38b6 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff88007506ee0 -- (.trap 0xfffff88007506ee0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800a4b7168 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030d38b6 rsp=fffff88007507070 rbp=0000000000000002
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac pe cy
nt!KeSetEvent+0x226:
fffff800`030d38b6 488b09          mov     rcx,qword ptr [rcx] ds:0002:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030ceca9 to fffff800030cf740

STACK_TEXT:  
fffff880`07506d98 fffff800`030ceca9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`07506da0 fffff800`030cd920 : 00000000`00000002 fffffa80`0a4b7160 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`07506ee0 fffff800`030d38b6 : fffff880`075070e0 fffff880`03dccb0e 00000000`00000049 fffff880`07507160 : nt!KiPageFault+0x260
fffff880`07507070 fffff880`03dcc9a6 : fffffa80`00000000 00000000`00000000 00000000`00000000 fffffa80`0a4b7150 : nt!KeSetEvent+0x226
fffff880`075070e0 fffffa80`00000000 : 00000000`00000000 00000000`00000000 fffffa80`0a4b7150 00000000`00000000 : vfilter+0x29a6
fffff880`075070e8 00000000`00000000 : 00000000`00000000 fffffa80`0a4b7150 00000000`00000000 fffff880`03dcc42b : 0xfffffa80`00000000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
vfilter+29a6
fffff880`03dcc9a6 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  vfilter+29a6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vfilter

IMAGE_NAME:  vfilter.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4b048bff

FAILURE_BUCKET_ID:  X64_0xA_vfilter+29a6

BUCKET_ID:  X64_0xA_vfilter+29a6

Followup: MachineOwner
---------

System uptime 23 hours.

Old drivers

Code:

ASMMAP64.sys        fffff880`057fe000    0x00007000    2/4/2007 15:52:56            0x45c63998    fffff880`057f7000                
sncduvc.SYS        fffff880`039eca80    0x00008a80    12/29/2008 05:14:26            0x495894f2    fffff880`039e4000                
spldr.sys        fffff880`016dd000    0x00008000    5/11/2009 12:56:27            0x4a0858bb    fffff880`016d5000                
ATK64AMD.sys        fffff880`048c5000    0x00008000    5/12/2009 21:04:54            0x4a0a1cb6    fffff880`048bd000                
amdxata.sys        fffff880`01016000    0x0000b000    5/19/2009 13:56:59            0x4a12f2eb    fffff880`0100b000                
RtHDMIVX.sys        fffff880`0502fb00    0x0002fb00    5/20/2009 06:04:50            0x4a13d5c2    fffff880`05000000                
lullaby.sys        fffff880`0107f000    0x00009000    6/17/2009 22:45:32            0x4a39aa4c    fffff880`01076000

How To Find Drivers:

- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: http://www.carrona.org/drvrdown.html