random BSOD crashes - 5 times in past 3 weeks

megagigaBR · 02 Feb 2012

Hello,
I'm having random Windows-7 Ultimate - x64 crashes.
System was recently installed, some updates as well, so should have low number of registry or drivers "garbage".

I just started to search the reason, so far checked minidump with BlueScreenViewer:

020212-20529-01.dmp 02/02/2012 12:35:50 UNEXPECTED_KERNEL_MODE_TRAP 0x0000007f 00000000`00000008 00000000`80050033 00000000`000406f8 fffff800`02c40ea4 ntoskrnl.exe ntoskrnl.exe+705c0 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7600.16841 (win7_gdr.110622-1503) x64 ntoskrnl.exe+705c0 C:\Windows\Minidump\020212-20529-01.dmp 2 15 7600 291.000
012512-22386-01.dmp 25/01/2012 12:11:12 DRIVER_VERIFIER_DETECTED_VIOLATION 0x000000c4 00000000`00000091 00000000`00000002 fffff800`02e45c40 00000000`00000000 vsdatant.sys vsdatant.sys+10a8c x64 ntoskrnl.exe+705c0 C:\Windows\Minidump\012512-22386-01.dmp 2 15 7600 291.000
012412-23649-01.dmp 24/01/2012 10:07:52 UNEXPECTED_KERNEL_MODE_TRAP 0x0000007f 00000000`00000008 00000000`80050033 00000000`000406f8 fffff800`02c3bea4 ntoskrnl.exe ntoskrnl.exe+705c0 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7600.16841 (win7_gdr.110622-1503) x64 ntoskrnl.exe+705c0 C:\Windows\Minidump\012412-23649-01.dmp 2 15 7600 291.000
011912-20810-01.dmp 19/01/2012 15:07:12 UNEXPECTED_KERNEL_MODE_TRAP 0x0000007f 00000000`00000008 00000000`80050033 00000000`000406f8 fffff800`02c9d798 ntoskrnl.exe ntoskrnl.exe+71f00 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7600.16841 (win7_gdr.110622-1503) x64 ntoskrnl.exe+71f00 C:\Windows\Minidump\011912-20810-01.dmp 2 15 7600 291.000
011812-27175-01.dmp 18/01/2012 11:52:15 KERNEL_DATA_INPAGE_ERROR 0x0000007a fffff6fc`40008490 ffffffff`c0000185 00000000`1f974860 fffff880`01092008 ataport.SYS ataport.SYS+19008 x64 ntoskrnl.exe+71f00 C:\Windows\Minidump\011812-27175-01.dmp 2 15 7600 298.712

ntoskrnl.exe ntoskrnl.exe+38ea4 fffff800`02c08000 fffff800`031e4000 0x005dc000 0x4e02aa44 22/06/2011 23:51:48 Microsoft® Windows® Operating System NT Kernel & System 6.1.7600.16841 (win7_gdr.110622-1503) Microsoft Corporation C:\Windows\system32\ntoskrnl.exe
hal.dll fffff800`031e4000 fffff800`0322d000 0x00049000 0x4a5bdf08 13/07/2009 22:27:36
kdcom.dll fffff800`00bc2000 fffff800`00bcc000 0x0000a000 0x4d4d40d9 05/02/2011 09:21:45
mcupdate_GenuineIntel.dll fffff880`00c31000 fffff880`00c75000 0x00044000 0x4a5bdf66 13/07/2009 22:29:10
PSHED.dll fffff880`00c75000 fffff880`00c89000 0x00014000 0x4a5be027 13/07/2009 22:32:23 Sistema Operacional Microsoft® Windows® Driver de Erro de Hardware Específico da Plataforma 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:\Windows\system32\PSHED.dll
CLFS.SYS fffff880`00c89000 fffff880`00ce7000 0x0005e000 0x4a5bc11d 13/07/2009 20:19:57
CI.dll fffff880`00ce7000 fffff880`00da7000 0x000c0000 0x4a5be01d 13/07/2009 22:32:13

Find attached the minidump files.
Appreciate any help or advice.

Thanks a lot

Pablo

usasma · 02 Feb 2012

From your post, Driver Verifier blamed vsdatant.sys - a component of ZoneAlarm. Please do this:
- Uninstall ZoneAlarm
- use the free tool from this link to remove the remnants of ZoneAlarm: Antivirus Uninstallers (scroll down to the direct download link for ZoneAlarm)
- enable your Windows Firewall
- monitor for further BSOD's.

Running the memory dumps now, will post back with the results.....

usasma · 02 Feb 2012

If you'd like a more detailed analysis, please provide this info: https://www.sevenforums.com/crashes-d...tructions.html

A driver for your Cisco VPN client dates from 2008 (dne64x.sys). Please either update it or uninstall it until we're done troubleshooting.

The vnaap.sys driver (likely from ZoneAlarm) dates from 2008 also. Please uninstall it from your system as described above.

Further info on BSOD error messages available at: http://www.carrona.org/bsodindx.html

The following info is just FYI, I've already addressed the issues that I saw in the above paragraphs:
3RD PARTY DRIVERS PRESENT IN THE DUMP FILES
- Create a System Restore Point prior to doing any of this. DO NOT mess with the drivers themselves - leave the Windows\System32\drivers directory alone unless we specifically direct you to it!
- Please either update the older drivers from the device manufacturer's website - or uninstall them from your system. Reference links are included below.
- DO NOT use Windows Update or the Update Drivers function of Device Manager.
- Please feel free to post back about any drivers that you are having difficulty locating.
- Windows Update exceptions may be noted below for Windows drivers.

Code:


dtsoftbus01.sys   Mon Oct 17 08:12:30 2011 (4E9C1BAE)
amdxata.sys       Tue May 19 13:56:59 2009 (4A12F2EB)
hpdskflt.sys      Wed Jul 08 14:41:38 2009 (4A54E862)
aswMonFlt.sys     Mon Nov 28 12:52:10 2011 (4ED3CA4A)
aswFsBlk.SYS      Mon Nov 28 12:51:52 2011 (4ED3CA38)
aswTdi.SYS        Mon Nov 28 12:52:18 2011 (4ED3CA52)
aswRdr.SYS        Mon Nov 28 12:52:20 2011 (4ED3CA54)
aswSnx.SYS        Mon Nov 28 12:54:05 2011 (4ED3CABD)
vsdatant.sys      Mon Aug 30 11:11:16 2010 (4C7BCA14)
aswSP.SYS         Mon Nov 28 12:53:57 2011 (4ED3CAB5)
dne64x.sys        Mon Nov 10 20:01:24 2008 (4918D964)
bcmwl664.sys      Mon Mar 22 23:08:39 2010 (4BA830B7)
Rt64win7.sys      Thu Feb 26 04:04:13 2009 (49A65B0D)
Accelerometer.sys Wed Jul 08 14:41:38 2009 (4A54E862)
vnaap.sys         Mon Dec 29 07:10:44 2008 (4958BE44)
stwrt64.sys       Wed Mar 24 00:01:24 2010 (4BA98E94)
nvlddmkm.sys      Sat Oct 03 14:02:29 2009 (4AC791B5)
nvBridge.kmd      Sat Oct 03 13:34:49 2009 (4AC78B39)
nvhda64v.sys      Fri Jun 26 18:54:59 2009 (4A4551C3)
npf.sys           Fri Jun 25 12:50:58 2010 (4C24DE72)
CVPNDRVA.sys      Fri Mar 04 14:43:37 2011 (4D7140E9)
nvlddmkm.sys      Thu Jul 23 17:48:25 2009 (4A68DAA9)
nvBridge.kmd      Thu Jul 23 17:25:16 2009 (4A68D53C)
stwrt64.sys       Tue Jul 21 18:42:28 2009 (4A664454)

Code:


Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\020212-20529-01.dmp]
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Debug session time: Thu Feb  2 10:14:56.173 2012 (UTC - 5:00)
System Uptime: 0 days 2:59:43.031
Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 )
BUGCHECK_STR:  0x7f_8
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  wfica32.exe
FAILURE_BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2
Bugcheck code 0000007F
Arguments 00000000`00000008 00000000`80050033 00000000`000406f8 fffff800`02c40ea4
BiosVersion = F.66
BiosReleaseDate = 05/18/2010
CPUID:        "Intel(R) Core(TM)2 Duo CPU     P8700  @ 2.53GHz"
MaxSpeed:     2530
CurrentSpeed: 2527
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\012512-22386-01.dmp]
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Debug session time: Wed Jan 25 10:10:02.968 2012 (UTC - 5:00)
System Uptime: 0 days 2:42:39.825
*** WARNING: Unable to verify timestamp for vsdatant.sys
*** ERROR: Module load completed but symbols could not be loaded for vsdatant.sys
Probably caused by : vsdatant.sys ( vsdatant+10a8c )
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
BUGCHECK_STR:  0xc4_91
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_0xc4_91_vsdatant+10a8c
Bugcheck code 000000C4
Arguments 00000000`00000091 00000000`00000002 fffff800`02e45c40 00000000`00000000
BiosVersion = F.66
BiosReleaseDate = 05/18/2010
CPUID:        "Intel(R) Core(TM)2 Duo CPU     P8700  @ 2.53GHz"
MaxSpeed:     2530
CurrentSpeed: 2527
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\012412-23649-01.dmp]
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Debug session time: Tue Jan 24 08:06:33.657 2012 (UTC - 5:00)
System Uptime: 0 days 1:06:01.514
Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 )
BUGCHECK_STR:  0x7f_8
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2
Bugcheck code 0000007F
Arguments 00000000`00000008 00000000`80050033 00000000`000406f8 fffff800`02c3bea4
BiosVersion = F.66
BiosReleaseDate = 05/18/2010
CPUID:        "Intel(R) Core(TM)2 Duo CPU     P8700  @ 2.53GHz"
MaxSpeed:     2530
CurrentSpeed: 2527
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\011912-20810-01.dmp]
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Jan 19 13:03:01.376 2012 (UTC - 5:00)
System Uptime: 0 days 5:00:27.233
Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 )
BUGCHECK_STR:  0x7f_8
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2
Bugcheck code 0000007F
Arguments 00000000`00000008 00000000`80050033 00000000`000406f8 fffff800`02c9d798
BiosVersion = F.66
BiosReleaseDate = 05/18/2010
CPUID:        "Intel(R) Core(TM)2 Duo CPU     P8700  @ 2.53GHz"
MaxSpeed:     2530
CurrentSpeed: 2527
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\011812-27175-01.dmp]
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Wed Jan 18 09:51:05.074 2012 (UTC - 5:00)
System Uptime: 0 days 2:13:09.931
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
DISK_HARDWARE_ERROR: There was error with disk hardware
BUGCHECK_STR:  0x7a_c0000185
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE_4096
Bugcheck code 0000007A
Arguments fffff6fc`40008490 ffffffff`c0000185 00000000`1f974860 fffff880`01092008
BiosVersion = F.66
BiosReleaseDate = 05/18/2010
CPUID:        "Intel(R) Core(TM)2 Duo CPU     P8700  @ 2.53GHz"
MaxSpeed:     2530
CurrentSpeed: 2527
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``