BSOD using utorrent and streaming video

ecrocke · 26 Feb 2014

Every time I try to use utorrent and sometimes when I'm simply streaming music or movies I get a BSOD and have been for a while now. I can't seem to figure out the origin.

here is the text for the dump file as taken from the windows debugger

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`0345d000 PsLoadedModuleList = 0xfffff800`036a06d0
Debug session time: Wed Feb 26 16:21:12.058 2014 (UTC - 6:00)
System Uptime: 0 days 4:11:45.088
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols

Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {38800000040, 2, 8, 38800000040}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000038800000040, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: 0000038800000040, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: 0000038800000040

CURRENT_IRQL: 2

FAULTING_IP:
+3539653061326232
00000388`00000040 ?? ???

PROCESS_NAME: System

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xD1

TRAP_FRAME: fffff80004a913d0 -- (.trap 0xfffff80004a913d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffff8800428327c
rdx=0000000100000001 rsi=0000000000000000 rdi=0000000000000000
rip=0000038800000040 rsp=fffff80004a91568 rbp=0000000000000000
r8=000000000e2a3adc r9=0000000001cf3341 r10=fffff8000345d000
r11=000000232edb9d00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
00000388`00000040 ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800034d2169 to fffff800034d2bc0

FAILED_INSTRUCTION_ADDRESS:
+3539653061326232
00000388`00000040 ?? ???

STACK_TEXT:
fffff800`04a91288 fffff800`034d2169 : 00000000`0000000a 00000388`00000040 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff800`04a91290 fffff800`034d0de0 : fffff800`036d78a0 00000000`00000002 fffffa80`0711e030 fffff800`04a91708 : nt!KiBugCheckDispatch+0x69
fffff800`04a913d0 00000388`00000040 : fffff800`034dd85c fffff800`04a916d8 00000000`00000000 01cf3341`0e2a3adc : nt!KiPageFault+0x260
fffff800`04a91568 fffff800`034dd85c : fffff800`04a916d8 00000000`00000000 01cf3341`0e2a3adc 00000000`fffffffe : 0x388`00000040
fffff800`04a91570 fffff800`034dd6f6 : fffffa80`08372800 00000000`000ec64c 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
fffff800`04a915e0 fffff800`034dd5de : 00000023`2b5578e5 fffff800`04a91c58 00000000`000ec64c fffff800`03650c08 : nt!KiProcessExpiredTimerList+0xc6
fffff800`04a91c30 fffff800`034dd3c7 : 00000009`a8902bc1 00000009`000ec64c 00000009`a8902b44 00000000`0000004c : nt!KiTimerExpiration+0x1be
fffff800`04a91cd0 fffff800`034ca8ca : fffff800`0364de80 fffff800`0365bcc0 00000000`00000000 fffff880`0ff57480 : nt!KiRetireDpcList+0x277
fffff800`04a91d80 00000000`00000000 : fffff800`04a92000 fffff800`04a8c000 fffff800`04a91d40 00000000`00000000 : nt!KiIdleLoop+0x5a

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiPageFault+260
fffff800`034d0de0 440f20c0 mov rax,cr8

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!KiPageFault+260

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 521ea035

FAILURE_BUCKET_ID: X64_0xD1_CODE_AV_BAD_IP_nt!KiPageFault+260

BUCKET_ID: X64_0xD1_CODE_AV_BAD_IP_nt!KiPageFault+260

Followup: MachineOwner
---------

koolkat77 · 26 Feb 2014

Reduce items at start-up: Startup Programs - Change

Perform a clean boot: Troubleshoot Application Conflicts by Performing a Clean Startup

Code:

Start Menu\Programs\Sophos\Sophos Endpoint Security and Control	Public:Start Menu\Programs\Sophos\Sophos Endpoint Security and Control	Public

Sophos Endpoint Security may contribute to your BSOD's. Please remove it for testing purpose. Use Microsoft Security Essentials.

Recommended from a strict BSOD perspective, compatibility & stability compared to other security software:

Microsoft Security Essentials - Free Antivirus for Windows

Malwarebytes - Free

Good and Free system security combination.

Scan with Kaspersky TDSSKiller:Anti-rootkit utility TDSSKiller

ESET online scanner: Free Online Virus Scanner | ESET

Run a System file check (SFC): SFC /SCANNOW Command - System File Checker

Run Disk Check on your Hard Drive(s): Disk Check

Post screenshot(s) of your Hard Drive(s) using Crystal Disk Info Software: CrystalDiskInfo - Software - Crystal Dew World

Run a Hard Drive test: https://www.sevenforums.com/tutorials/313457-seatools-dos-windows-how-use.html

Check for heating issues using Speccy or HWmonitor

Upload a screen shot: Screenshots and Files - Upload and Post in Seven Forums

Please update these older drivers. Links are included to assist in looking up the source of the drivers. If unable to find an update, please remove (un-install) the program responsible for that driver. DO NOT manually delete/rename the driver as it may make the system unbootable!:-

Sentinel64.sys Thu Feb 1 17:39:44 2007 (45C1D180)
Rainbow Tech/SafeNet USB Security Device
Driver Reference Table - Sentinel64.sys

adfs.SYS Fri Jun 27 02:52:37 2008 (48640195)
Adobe File System Driver
Driver Reference Table - adfs.SYS

e1y60x64.sys Tue Aug 19 03:45:05 2008 (48A9ED61)
Intel(R) 82567LM Gigabit Network Connection
Driver Reference Table - e1y60x64.sys

PxHlpa64.sys Wed Jun 24 05:16:35 2009 (4A416253)
Sonic CD/DVD driver (used by many different CD/DVD programs)
Driver Reference Table - PxHlpa64.sys

AsUpIO.sys Mon Jul 6 08:21:38 2009 (4A515FB2)
ASUS hardware monitoring software related
Driver Reference Table - AsUpIO.sys

ASACPI.sys Thu Jul 16 09:31:29 2009 (4A5E9F11)
Asus ATK0110 ACPI Utility (a known BSOD maker in Win7 and Win8). Also a part of many Asus utilities (Win8 versions available from Windows Update as an Optional Update - but check Asus first!)
Driver Reference Table - ASACPI.sys

nusb3hub.sys Fri Jan 22 09:22:18 2010 (4B5919EA)
NEC Electronics USB 3.0 Host Controller Driver (previous BSOD issues with 2010 and earlier versions)
Driver Reference Table - nusb3hub.sys

nusb3xhc.sys Fri Jan 22 09:22:21 2010 (4B5919ED)
NEC Electronics USB 3.0 Host Controller Driver (previous BSOD issues with 2010 and earlier versions)
Driver Reference Table - nusb3xhc.sys

netr28ux.sys Tue Sep 15 10:36:45 2009 (4AAF19DD)
Ralink RT2870 series USB802.11n Wireless Adapter Driver (you may have a different manufacturer)
Driver Reference Table - netr28ux.sys

mvxxmm.sys Fri Dec 25 12:45:15 2009 (4B345F7B)
Marvell Aux NV Bridge DLL - related to mv91xx SCSI HD Controller
Driver Reference Table - mvxxmm.sys

mv91xx.sys Fri Dec 25 12:45:39 2009 (4B345F93)
Marvell MV91xx AHCI/RAID driver
Driver Reference Table - mv91xx.sys

Perform a clean install of a driver following: How to Clean Left Over Driver Files with Driver Sweeper

Use Revo Uninstaller to uninstall stubborn software. Opt for Advance Mode while uninstalling which allows leftover registry removal:Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems
Bsod Summary

Code:

Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Debug session time: Thu Feb 27 04:21:12.058 2014 (UTC + 6:00)
System Uptime: 0 days 4:11:45.088
BugCheck D1, {38800000040, 2, 8, 38800000040}
Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )
BUGCHECK_STR:  0xD1
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Debug session time: Thu Feb 27 00:08:22.671 2014 (UTC + 6:00)
System Uptime: 0 days 0:17:27.702
BugCheck A, {fffff6fb41738170, 2, 0, fffff800034c15e1}
*** WARNING: Unable to verify timestamp for netr28ux.sys
*** ERROR: Module load completed but symbols could not be loaded for netr28ux.sys
Probably caused by : netr28ux.sys ( netr28ux+b214 )
BUGCHECK_STR:  0xA
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Debug session time: Wed Feb 26 23:49:43.004 2014 (UTC + 6:00)
System Uptime: 0 days 0:29:19.924
BugCheck 1E, {ffffffffc0000005, fffff8800170e418, 0, ffffffffffffffff}
Probably caused by : ndis.sys ( ndis!ndisDereferenceDriver+68 )
BUGCHECK_STR:  0x1E_c0000005_R
PROCESS_NAME:  WerFault.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Debug session time: Wed Feb 26 15:07:41.308 2014 (UTC + 6:00)
System Uptime: 1 days 0:01:34.338
BugCheck A, {fffff6fb41744170, 2, 0, fffff800034b65e1}
*** WARNING: Unable to verify timestamp for netr28ux.sys
*** ERROR: Module load completed but symbols could not be loaded for netr28ux.sys
Probably caused by : netr28ux.sys ( netr28ux+b214 )
BUGCHECK_STR:  0xA
PROCESS_NAME:  audiodg.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Debug session time: Tue Feb 25 15:04:33.812 2014 (UTC + 6:00)
System Uptime: 0 days 10:49:26.842
BugCheck A, {fffff6fb40200140, 2, 0, fffff800034705e1}
*** WARNING: Unable to verify timestamp for netr28ux.sys
*** ERROR: Module load completed but symbols could not be loaded for netr28ux.sys
Probably caused by : netr28ux.sys ( netr28ux+b214 )
BUGCHECK_STR:  0xA
PROCESS_NAME:  WerFault.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Debug session time: Mon Feb 24 23:32:12.636 2014 (UTC + 6:00)
System Uptime: 0 days 1:11:46.667
BugCheck 1E, {ffffffffc0000005, fffff88001706418, 0, ffffffffffffffff}
Probably caused by : ndis.sys ( ndis!ndisDereferenceDriver+68 )
BUGCHECK_STR:  0x1E_c0000005_R
PROCESS_NAME:  WerFault.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff6fb41744170, 2, 0, fffff800034b65e1}

*** WARNING: Unable to verify timestamp for netr28ux.sys
*** ERROR: Module load completed but symbols could not be loaded for netr28ux.sys
Probably caused by : netr28ux.sys ( netr28ux+b214 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff6fb41744170, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800034b65e1, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036ff100
GetUlongFromAddress: unable to read from fffff800036ff1c0
 fffff6fb41744170 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MmBuildMdlForNonPagedPool+81
fffff800`034b65e1 488b4500        mov     rax,qword ptr [rbp]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  audiodg.exe

TAG_NOT_DEFINED_c000000f:  FFFFF80004A97FB0

TRAP_FRAME:  fffff80004a97180 -- (.trap 0xfffff80004a97180)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000005d0 rbx=0000000000000000 rcx=00000000000005d1
rdx=0000000000001ba0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800034b65e1 rsp=fffff80004a97318 rbp=fffff6fb41744170
 r8=0000000000000000  r9=00000002e882e880 r10=fffffa8008779490
r11=05d105d105d10000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MmBuildMdlForNonPagedPool+0x81:
fffff800`034b65e1 488b4500        mov     rax,qword ptr [rbp] ss:fffff6fb`41744170=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800034c7169 to fffff800034c7bc0

STACK_TEXT:  
fffff800`04a97038 fffff800`034c7169 : 00000000`0000000a fffff6fb`41744170 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`04a97040 fffff800`034c5de0 : fffffa80`00000000 00000000`00000000 fffffa80`09364010 fffffa80`087794c0 : nt!KiBugCheckDispatch+0x69
fffff800`04a97180 fffff800`034b65e1 : fffffa80`08334430 00000000`00000000 fffff880`05a3c214 00000000`00000000 : nt!KiPageFault+0x260
fffff800`04a97318 fffff880`05a3c214 : 00000000`00000000 fffff800`04a97e88 fffffa80`08378800 fffffa80`071021a0 : nt!MmBuildMdlForNonPagedPool+0x81
fffff800`04a97330 00000000`00000000 : fffff800`04a97e88 fffffa80`08378800 fffffa80`071021a0 00000000`00000002 : netr28ux+0xb214


STACK_COMMAND:  kb

FOLLOWUP_IP: 
netr28ux+b214
fffff880`05a3c214 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  netr28ux+b214

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: netr28ux

IMAGE_NAME:  netr28ux.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4aaf19dd

FAILURE_BUCKET_ID:  X64_0xA_netr28ux+b214

BUCKET_ID:  X64_0xA_netr28ux+b214

Followup: MachineOwner
---------

0: kd> lmvm netr28ux
start             end                 module name
fffff880`05a31000 fffff880`05b3e000   netr28ux T (no symbols)           
    Loaded symbol image file: netr28ux.sys
    Image path: \SystemRoot\system32\DRIVERS\netr28ux.sys
    Image name: netr28ux.sys
    Timestamp:        Tue Sep 15 10:36:45 2009 (4AAF19DD)
    CheckSum:         00103A77
    ImageSize:        0010D000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4