New
#1
Random BSOD on Multiple PC'sProbably caused by : nvcwfpco.sys
I'm an IT Service Desk manager for a reasonably large site, since upgrading our PC's to Win 7 we have been seeing approx. 5 BSOD's per day with the same minidump errors seeming to relate to what i assume is our clients recommended VPN software.
Results from WinDBG are as below, any assistance would be greatly appreciated:
Code:Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\dtarrant\Desktop\BSOD Issues\062514-24523-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.17514.x86fre.win7sp1_rtm.101119-1850 Machine Name: Kernel base = 0x82a08000 PsLoadedModuleList = 0x82b52850 Debug session time: Wed Jun 25 14:22:43.724 2014 (UTC + 10:00) System Uptime: 0 days 22:39:25.015 Loading Kernel Symbols ............................................................... ................................................................ ................................ Loading User Symbols Loading unloaded module list ............... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck D1, {b69b09cb, 2, 0, 95a27def} Unable to load image \SystemRoot\system32\DRIVERS\nvcwfpco.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for nvcwfpco.sys *** ERROR: Module load completed but symbols could not be loaded for nvcwfpco.sys Probably caused by : nvcwfpco.sys ( nvcwfpco+6def ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: b69b09cb, memory referenced Arg2: 00000002, IRQL Arg3: 00000000, value 0 = read operation, 1 = write operation Arg4: 95a27def, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: GetPointerFromAddress: unable to read from 82b72718 Unable to read MiSystemVaType memory at 82b521a0 b69b09cb CURRENT_IRQL: 2 FAULTING_IP: nvcwfpco+6def 95a27def 668b02 mov ax,word ptr [edx] CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT BUGCHECK_STR: 0xD1 PROCESS_NAME: System TAG_NOT_DEFINED_c000000f: FFFFFFFF8DB21000 TRAP_FRAME: 8db1be90 -- (.trap 0xffffffff8db1be90) ErrCode = 00000000 eax=000007f5 ebx=00000000 ecx=000007f5 edx=b69b09cb esi=85dc6000 edi=0000b098 eip=95a27def esp=8db1bf04 ebp=8db1bf3c iopl=0 nv up ei ng nz ac po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010292 nvcwfpco+0x6def: 95a27def 668b02 mov ax,word ptr [edx] ds:0023:b69b09cb=???? Resetting default scope LAST_CONTROL_TRANSFER: from 95a27def to 82a495cb STACK_TEXT: 8db1be90 95a27def badb0d00 b69b09cb 00000000 nt!KiTrap0E+0x2cf WARNING: Stack unwind information not available. Following frames may be wrong. 8db1bf3c 95a28210 8db1bf78 95a3144f 8db1bf80 nvcwfpco+0x6def 8db1bf84 95a25e3c 8db1bfb4 8db1bfbc 00000000 nvcwfpco+0x7210 8db1bfc0 95a24c08 000002bb 8db1bfe8 8db1c004 nvcwfpco+0x4e3c 8db1bfe0 95a24489 8db1c004 8db1c004 8db1bff4 nvcwfpco+0x3c08 8db1bff8 95a2374c 85e9fe28 8db1c018 8db1c040 nvcwfpco+0x3489 8db1c084 8b9d2ede 00000000 00000000 b69b1150 nvcwfpco+0x274c 8db1c0a8 8b9bcf32 00000000 95a23200 8db1c2e4 NETIO!ProcessNonBufferedCallout+0x23 8db1c104 8b9bdad0 00000004 8db1c2e4 8db1c2f8 NETIO!ProcessCallout+0x184 8db1c13c 8b9bda6e 00000004 858d2588 8db1c2e4 NETIO!ProcessFastCalloutClassify+0x30 8db1c248 8be75057 00000004 8db1c2e4 8db1c2f8 NETIO!KfdClassify+0x115 8db1c454 8be7d627 88a37020 876e55e8 882dc7a0 tcpip!ShimIpPacketOutV4+0x1bd 8db1c488 8be9ac1a 00000000 88a37020 876e55e8 tcpip!IppInspectLocalPacketsOut+0x5c 8db1c590 8bea06c1 876e5544 882d8fa8 87d56698 tcpip!Ipv4pFragmentPacketHelper+0x195 8db1c5e0 8be9f92a 8bf00da0 00000000 00000000 tcpip!IppFragmentPackets+0xe7 8db1c618 8be7d449 8bf00da0 876e5544 876e55e0 tcpip!IppDispatchSendPacketHelper+0x266 8db1c6b8 8be7df07 006e5544 8db1c798 85a6eac8 tcpip!IppPacketizeDatagrams+0x8d6 8db1c738 8be7b031 00000000 00000007 8bf00da0 tcpip!IppSendDatagramsCommon+0x652 8db1c758 8be72d5f 876d2690 8db1c770 00000000 tcpip!IpNlpSendDatagrams+0x4b 8db1c7e4 8be70c3c 876d2690 8db1c8e0 888c67d8 tcpip!IppSlowSendDatagram+0x31 8db1c84c 8be71beb 876d2690 00000001 8db1c8e0 tcpip!IpNlpFastSendDatagram+0x1067 8db1c99c 8be8fcf6 88dee2f0 00000002 00000002 tcpip!TcpTcbSend+0x787 8db1c9ec 8be99272 00000002 8db1caa0 00000000 tcpip!TcpFlushDelay+0x1f1 8db1ca38 82a82039 87712e38 00000002 1c26804f tcpip!TcpPeriodicTimeoutHandler+0x389 8db1ca7c 82a81fdd 8db00120 8db1cba8 00000001 nt!KiProcessTimerDpcTable+0x50 8db1cb68 82a81e9a 8db00120 8db1cba8 00000000 nt!KiProcessExpiredTimerList+0x101 8db1cbdc 82a8000e 004fc7cd 85e91030 8db05800 nt!KiTimerExpiration+0x25c 8db1cc20 82a7fe38 00000000 0000000e 0000a0a9 nt!KiRetireDpcList+0xcb 8db1cc24 00000000 0000000e 0000a0a9 a9575b80 nt!KiIdleLoop+0x38 STACK_COMMAND: kb FOLLOWUP_IP: nvcwfpco+6def 95a27def 668b02 mov ax,word ptr [edx] SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nvcwfpco+6def FOLLOWUP_NAME: MachineOwner MODULE_NAME: nvcwfpco IMAGE_NAME: nvcwfpco.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4b8be297 FAILURE_BUCKET_ID: 0xD1_nvcwfpco+6def BUCKET_ID: 0xD1_nvcwfpco+6def Followup: MachineOwner --------- 2: kd> .trap 0xffffffff8db1be90 ErrCode = 00000000 eax=000007f5 ebx=00000000 ecx=000007f5 edx=b69b09cb esi=85dc6000 edi=0000b098 eip=95a27def esp=8db1bf04 ebp=8db1bf3c iopl=0 nv up ei ng nz ac po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010292 nvcwfpco+0x6def: 95a27def 668b02 mov ax,word ptr [edx] ds:0023:b69b09cb=????
Last edited by Brink; 25 Jun 2014 at 08:09. Reason: code box