Blue Screen. Issue with atheros network card. ndis.sys & l1c62x64

jarnaez · 13 Nov 2014

I'v had a couple blue screens this week on Tuesday and Thursday. I've gotten error messages for both ndis.sys and l1c62x64. This has been a recurring issue for a while, but it recently started occurring very frequently.

koolkat77 · 14 Nov 2014

Code:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\USER\Downloads\Compressed\SAMAEL-PC-Thu_11_13_2014_102956_69\111114-69186-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18526.amd64fre.win7sp1_gdr.140706-1506
Machine Name:
Kernel base = 0xfffff800`02e4c000 PsLoadedModuleList = 0xfffff800`0308f890
Debug session time: Wed Nov 12 07:16:25.568 2014 (UTC + 6:00)
System Uptime: 0 days 11:27:37.770
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
.........................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 0, fffff880073d0c9b}

*** WARNING: Unable to verify timestamp for L1C62x64.sys
*** ERROR: Module load completed but symbols could not be loaded for L1C62x64.sys
Probably caused by : L1C62x64.sys ( L1C62x64+6c9b )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff880073d0c9b, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030f9100
GetUlongFromAddress: unable to read from fffff800030f91c0
 0000000000000000 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
L1C62x64+6c9b
fffff880`073d0c9b 488b08          mov     rcx,qword ptr [rax]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff8800b2f2c90 -- (.trap 0xfffff8800b2f2c90)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=00000000000015f2
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880073d0c9b rsp=fffff8800b2f2e20 rbp=fffffa800d6d8010
 r8=0000000000000292  r9=fffffa800d582000 r10=9bb8410000000060
r11=fffff8800b2f2e40 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
L1C62x64+0x6c9b:
fffff880`073d0c9b 488b08          mov     rcx,qword ptr [rax] ds:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ec1169 to fffff80002ec1bc0

STACK_TEXT:  
fffff880`0b2f2b48 fffff800`02ec1169 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0b2f2b50 fffff800`02ebfde0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffff880`0b2f2c90 fffff880`073d0c9b : fffffa80`0d572c60 39226ff3`d7c0f1bb fffffa80`0e29e7c8 00000000`00000000 : nt!KiPageFault+0x260
fffff880`0b2f2e20 fffffa80`0d572c60 : 39226ff3`d7c0f1bb fffffa80`0e29e7c8 00000000`00000000 fffffa80`0d572c60 : L1C62x64+0x6c9b
fffff880`0b2f2e28 39226ff3`d7c0f1bb : fffffa80`0e29e7c8 00000000`00000000 fffffa80`0d572c60 fffffa80`0d6b41b0 : 0xfffffa80`0d572c60
fffff880`0b2f2e30 fffffa80`0e29e7c8 : 00000000`00000000 fffffa80`0d572c60 fffffa80`0d6b41b0 fffffa80`0f064dd4 : 0x39226ff3`d7c0f1bb
fffff880`0b2f2e38 00000000`00000000 : fffffa80`0d572c60 fffffa80`0d6b41b0 fffffa80`0f064dd4 00000000`00000000 : 0xfffffa80`0e29e7c8


STACK_COMMAND:  kb

FOLLOWUP_IP: 
L1C62x64+6c9b
fffff880`073d0c9b 488b08          mov     rcx,qword ptr [rax]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  L1C62x64+6c9b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: L1C62x64

IMAGE_NAME:  L1C62x64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  51e4eeac

FAILURE_BUCKET_ID:  X64_0xD1_L1C62x64+6c9b

BUCKET_ID:  X64_0xD1_L1C62x64+6c9b

Followup: MachineOwner
---------

1: kd> lmvm L1C62x64
start             end                 module name
fffff880`073ca000 fffff880`073ec000   L1C62x64 T (no symbols)           
    Loaded symbol image file: L1C62x64.sys
    Image path: \SystemRoot\system32\DRIVERS\L1C62x64.sys
    Image name: L1C62x64.sys
    Timestamp:        Tue Jul 16 12:56:44 2013 (51E4EEAC)
    CheckSum:         0002912C
    ImageSize:        00022000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Uninstall Symantec for testing purpose.

Microsoft Security Essentials is recommended from a strict BSOD perspective, compatibility & stability compared to other internet security software. Malwarebytes is a great combo to MSE. They are free and lightweight.

Also uninstall your existing Antivirus software before you install MSE.

Good and Free system security combination.

Warning

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Perform a Clean boot:

Troubleshoot Application Conflicts by Performing a Clean Startup

Reduce items at start-up. No software except anti-virus is required plus doing this improves the time for logging into windows:

How to Change, Add, or Remove Startup Programs in Windows 7

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

Click on the
Type CMD on Search
Left click and Run as Administrator
Type SFC /scannow

Full tutorial here:

SFC /SCANNOW Command - System File Checker

Hard Drive Diagnostics

Run Disk Check on your Hard Drive for file system errors and bad sectors on it.

Double click and open my computer.
Right click on desired drive and hit properties.
Click on tools tab and Check now.

Read complete instructions on the tutorial: Disk Check

Other Tests: