Daily BSOD

npolite · Apr 19, 2010

Hello,

I've been having this ongoing problem with BSOD every day or two and can't localize where the problem is. It started around Dec 15th and has steadily become more frequent. I ran a memtest and had one error. I then started moving the 4 1GB sticks around trying to localize which one was faulty and none of them errored out. I ran another scan the other day and nothing came up on two passes.

I have a Gigabyte Board n650SLI-DS4 with a C2D E6850 and 4 1GB Corsair sticks. I also have Raid 1 with 2 1TB drives.

I would appreciate any help on this.

I ran whocrashed and this is what I see for the past few crashes:

On Mon 4/19/2010 10:43:19 PM your computer crashed
This was likely caused by the following module: win32k.sys
Bugcheck code: 0x1000008E (0xC000001D, 0x96B95051, 0x9EE5FA64, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
Dump file: C:\Windows\Minidump\041910-27799-01.dmp
file path: C:\Windows\system32\win32k.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Multi-User Win32 Driver
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.

On Sat 4/17/2010 1:26:09 PM your computer crashed
This was likely caused by the following module: [FONT=Segoe UI, Arial]cdd.dll
Bugcheck code: 0x10000050 (0x961F95FF, 0x0, 0x961F95FF, 0x0)
Error: [FONT=Segoe UI, Arial]Unknown[/FONT]
Dump file: C:\Windows\Minidump\041710-24195-01.dmp
[FONT=Segoe UI, Arial]file path: C:\Windows\system32\cdd.dll
product: [FONT=Segoe UI, Arial]Microsoft® Windows® Operating System[/FONT]
company: [FONT=Segoe UI, Arial]Microsoft Corporation[/FONT]
description: Canonical Display Driver
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.
On Fri 4/16/2010 2:01:45 AM your computer crashed
This was likely caused by the following module: [FONT=Segoe UI, Arial]vsdatant.sys[/FONT]
Bugcheck code: 0x1000008E (0xC0000005, 0x9986DA3F, 0xA0F7F87C, 0x0)
Error: [FONT=Segoe UI, Arial]KERNEL_MODE_EXCEPTION_NOT_HANDLED_M[/FONT]
Dump file: C:\Windows\Minidump\041610-21652-01.dmp
[FONT=Segoe UI, Arial]file path: C:\Windows\system32\drivers\vsdatant.sys
product: [FONT=Segoe UI, Arial]ZoneAlarm Firewalling Driver[/FONT]
company: [FONT=Segoe UI, Arial]Check Point Software Technologies LTD[/FONT]
description: ZoneAlarm Firewalling Driver[/FONT][/FONT][/FONT]
On Thu 4/15/2010 1:05:23 AM your computer crashed
This was likely caused by the following module: [FONT=Segoe UI, Arial]hardware
Bugcheck code: 0x8E (0xC0000005, 0x941C70F2, 0x8078ACF5, 0x0)
Error: [FONT=Segoe UI, Arial]KERNEL_MODE_EXCEPTION_NOT_HANDLED[/FONT]
Dump file: C:\Windows\Minidump\041510-24991-01.dmp[/FONT]

On Sat 4/10/2010 10:00:26 PM your computer crashed
This was likely caused by the following module: [FONT=Segoe UI, Arial]ntoskrnl.exe
Bugcheck code: 0x1A (0x41287, 0x0, 0x0, 0x0)
Error: [FONT=Segoe UI, Arial]MEMORY_MANAGEMENT[/FONT]
Dump file: C:\Windows\Minidump\041010-31247-01.dmp
[FONT=Segoe UI, Arial]file path: C:\Windows\system32\ntoskrnl.exe
product: [FONT=Segoe UI, Arial]Microsoft® Windows® Operating System[/FONT]
company: [FONT=Segoe UI, Arial]Microsoft Corporation[/FONT]
description: NT Kernel & System
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time. [/FONT]
[/FONT]

zigzag3143 · Apr 19, 2010

npolite said:
Hello,

I've been having this ongoing problem with BSOD every day or two and can't localize where the problem is. It started around Dec 15th and has steadily become more frequent. I ran a memtest and had one error. I then started moving the 4 1GB sticks around trying to localize which one was faulty and none of them errored out. I ran another scan the other day and nothing came up on two passes.

I have a Gigabyte Board n650SLI-DS4 with a C2D E6850 and 4 1GB Corsair sticks. I also have Raid 1 with 2 1TB drives.

I would appreciate any help on this.

I ran whocrashed and this is what I see for the past few crashes:

On Mon 4/19/2010 10:43:19 PM your computer crashed
This was likely caused by the following module: win32k.sys
Bugcheck code: 0x1000008E (0xC000001D, 0x96B95051, 0x9EE5FA64, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
Dump file: C:\Windows\Minidump\041910-27799-01.dmp
file path: C:\Windows\system32\win32k.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Multi-User Win32 Driver
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.

On Sat 4/17/2010 1:26:09 PM your computer crashed
This was likely caused by the following module: [FONT=Segoe UI, Arial]cdd.dll
Bugcheck code: 0x10000050 (0x961F95FF, 0x0, 0x961F95FF, 0x0)
Error: [FONT=Segoe UI, Arial]Unknown[/FONT]
Dump file: C:\Windows\Minidump\041710-24195-01.dmp
[FONT=Segoe UI, Arial]file path: C:\Windows\system32\cdd.dll
product: [FONT=Segoe UI, Arial]Microsoft® Windows® Operating System[/FONT]
company: [FONT=Segoe UI, Arial]Microsoft Corporation[/FONT]
description: Canonical Display Driver
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.
On Fri 4/16/2010 2:01:45 AM your computer crashed
This was likely caused by the following module: [FONT=Segoe UI, Arial]vsdatant.sys[/FONT]
Bugcheck code: 0x1000008E (0xC0000005, 0x9986DA3F, 0xA0F7F87C, 0x0)
Error: [FONT=Segoe UI, Arial]KERNEL_MODE_EXCEPTION_NOT_HANDLED_M[/FONT]
Dump file: C:\Windows\Minidump\041610-21652-01.dmp
[FONT=Segoe UI, Arial]file path: C:\Windows\system32\drivers\vsdatant.sys
product: [FONT=Segoe UI, Arial]ZoneAlarm Firewalling Driver[/FONT]
company: [FONT=Segoe UI, Arial]Check Point Software Technologies LTD[/FONT]
description: ZoneAlarm Firewalling Driver[/FONT][/FONT][/FONT]
On Thu 4/15/2010 1:05:23 AM your computer crashed
This was likely caused by the following module: [FONT=Segoe UI, Arial]hardware
Bugcheck code: 0x8E (0xC0000005, 0x941C70F2, 0x8078ACF5, 0x0)
Error: [FONT=Segoe UI, Arial]KERNEL_MODE_EXCEPTION_NOT_HANDLED[/FONT]
Dump file: C:\Windows\Minidump\041510-24991-01.dmp[/FONT]

On Sat 4/10/2010 10:00:26 PM your computer crashed
This was likely caused by the following module: [FONT=Segoe UI, Arial]ntoskrnl.exe
Bugcheck code: 0x1A (0x41287, 0x0, 0x0, 0x0)
Error: [FONT=Segoe UI, Arial]MEMORY_MANAGEMENT[/FONT]
Dump file: C:\Windows\Minidump\041010-31247-01.dmp
[FONT=Segoe UI, Arial]file path: C:\Windows\system32\ntoskrnl.exe
product: [FONT=Segoe UI, Arial]Microsoft® Windows® Operating System[/FONT]
company: [FONT=Segoe UI, Arial]Microsoft Corporation[/FONT]
description: NT Kernel & System
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time. [/FONT]
[/FONT]

We do really appreciate you trying to debug yourself but we really need the DMP files themselves. Let us know if you need help

Ken

npolite · Apr 20, 2010

I ran the debug for the last one and this is what is in there

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\041910-27939-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16481.x86fre.win7_gdr.091207-1941
Machine Name:
Kernel base = 0x82a3a000 PsLoadedModuleList = 0x82b82810
Debug session time: Mon Apr 19 20:16:53.756 2010 (GMT-4)
System Uptime: 0 days 1:33:50.410
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 100000D1, {7ffef82, 2, 1, 8c08be07}
*** WARNING: Unable to verify timestamp for avgtdix.sys
*** ERROR: Module load completed but symbols could not be loaded for avgtdix.sys
Probably caused by : memory_corruption
Followup: memory_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 07ffef82, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8c08be07, address which referenced memory
Debugging Details:
------------------

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82ba2718
Unable to read MiSystemVaType memory at 82b82160
07ffef82
CURRENT_IRQL: 2
FAULTING_IP:
tcpip!UdpSendMessagesOnPathCreation+7cd
8c08be07 6c ins byte ptr es:[edi],dx
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0xD1
PROCESS_NAME: iexplore.exe
LAST_CONTROL_TRANSFER: from 8c08db31 to 8c08be07
STACK_TEXT:
a90087c0 8c08db31 00000000 00000001 872bd2c0 tcpip!UdpSendMessagesOnPathCreation+0x7cd
a90088c4 8c08d37a 86344d20 0000899c 00000000 tcpip!UdpSendMessages+0x595
a90088d8 82aca08a a9008968 98248c7f 00000000 tcpip!UdpTlProviderSendMessagesCalloutRoutine+0x13
a9008940 8c08d170 8c08d367 a9008968 00000000 nt!KeExpandKernelStackAndCalloutEx+0x132
a9008980 90b42f56 872bd2c0 a900899c 87ad7b78 tcpip!UdpTlProviderSendMessages+0x67
a90089c4 90b4b237 87ad2008 87ad7b78 87ad7c30 tdx!TdxSendTransportAddress+0x148
a90089e0 82a764ac 864c7c68 87ad7b78 87ad7b78 tdx!TdxTdiDispatchInternalDeviceControl+0x69
a90089f8 90b635e0 864d4c68 87ad7b78 a9008a20 nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
a9008a08 90b64381 864d4c68 87ad7b78 87905970 avgtdix+0x25e0
a9008a20 90b64596 864d4c68 87ad7b78 a9008a48 avgtdix+0x3381
a9008a30 82a764ac 864d4c68 87ad7b78 87ad7d00 avgtdix+0x3596
a9008a48 9162c3c4 38613abf a9008b20 00000001 nt!IofCallDriver+0x63
a9008ab0 9161c3e1 87905970 a9008b10 00000001 afd!AfdFastDatagramSend+0x5ff
a9008c28 82c948f7 872bec01 00000001 0473f494 afd!AfdFastIoDeviceControl+0x3dc
a9008cd0 82c974ac 864c8348 0000095c 00000000 nt!IopXxxControlFile+0x2d0
a9008d04 82a7d47a 00000660 0000095c 00000000 nt!NtDeviceIoControlFile+0x2a
a9008d04 779a64f4 00000660 0000095c 00000000 nt!KiFastCallEntry+0x12a
0473f4e8 00000000 00000000 00000000 00000000 0x779a64f4

STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !tcpip
8c08be00-8c08be10 17 bytes - tcpip!UdpSendMessagesOnPathCreation+7c6
[ e4 c7 45 08 03 01 00 00:6f 27 5e db f7 b6 f4 6c ]
8c08be12-8c08be3f 46 bytes - tcpip!UdpSendMessagesOnPathCreation+7d8 (+0x12)
[ 75 e8 e8 ec 76 ff ff 83:66 e5 98 b6 31 eb 4b d3 ]
63 errors : !tcpip (8c08be00-8c08be3f)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE_64
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE_64
BUCKET_ID: MEMORY_CORRUPTION_LARGE_64
Followup: memory_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 07ffef82, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8c08be07, address which referenced memory
Debugging Details:
------------------

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82ba2718
Unable to read MiSystemVaType memory at 82b82160
07ffef82
CURRENT_IRQL: 2
FAULTING_IP:
tcpip!UdpSendMessagesOnPathCreation+7cd
8c08be07 6c ins byte ptr es:[edi],dx
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0xD1
PROCESS_NAME: iexplore.exe
LAST_CONTROL_TRANSFER: from 8c08db31 to 8c08be07
STACK_TEXT:
a90087c0 8c08db31 00000000 00000001 872bd2c0 tcpip!UdpSendMessagesOnPathCreation+0x7cd
a90088c4 8c08d37a 86344d20 0000899c 00000000 tcpip!UdpSendMessages+0x595
a90088d8 82aca08a a9008968 98248c7f 00000000 tcpip!UdpTlProviderSendMessagesCalloutRoutine+0x13
a9008940 8c08d170 8c08d367 a9008968 00000000 nt!KeExpandKernelStackAndCalloutEx+0x132
a9008980 90b42f56 872bd2c0 a900899c 87ad7b78 tcpip!UdpTlProviderSendMessages+0x67
a90089c4 90b4b237 87ad2008 87ad7b78 87ad7c30 tdx!TdxSendTransportAddress+0x148
a90089e0 82a764ac 864c7c68 87ad7b78 87ad7b78 tdx!TdxTdiDispatchInternalDeviceControl+0x69
a90089f8 90b635e0 864d4c68 87ad7b78 a9008a20 nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
a9008a08 90b64381 864d4c68 87ad7b78 87905970 avgtdix+0x25e0
a9008a20 90b64596 864d4c68 87ad7b78 a9008a48 avgtdix+0x3381
a9008a30 82a764ac 864d4c68 87ad7b78 87ad7d00 avgtdix+0x3596
a9008a48 9162c3c4 38613abf a9008b20 00000001 nt!IofCallDriver+0x63
a9008ab0 9161c3e1 87905970 a9008b10 00000001 afd!AfdFastDatagramSend+0x5ff
a9008c28 82c948f7 872bec01 00000001 0473f494 afd!AfdFastIoDeviceControl+0x3dc
a9008cd0 82c974ac 864c8348 0000095c 00000000 nt!IopXxxControlFile+0x2d0
a9008d04 82a7d47a 00000660 0000095c 00000000 nt!NtDeviceIoControlFile+0x2a
a9008d04 779a64f4 00000660 0000095c 00000000 nt!KiFastCallEntry+0x12a
0473f4e8 00000000 00000000 00000000 00000000 0x779a64f4

STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !tcpip
8c08be00-8c08be10 17 bytes - tcpip!UdpSendMessagesOnPathCreation+7c6
[ e4 c7 45 08 03 01 00 00:6f 27 5e db f7 b6 f4 6c ]
8c08be12-8c08be3f 46 bytes - tcpip!UdpSendMessagesOnPathCreation+7d8 (+0x12)
[ 75 e8 e8 ec 76 ff ff 83:66 e5 98 b6 31 eb 4b d3 ]
63 errors : !tcpip (8c08be00-8c08be3f)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE_64
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE_64
BUCKET_ID: MEMORY_CORRUPTION_LARGE_64
Followup: memory_corruption

npolite · Apr 20, 2010

Second to last debug:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\041910-27799-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16481.x86fre.win7_gdr.091207-1941
Machine Name:
Kernel base = 0x82a52000 PsLoadedModuleList = 0x82b9a810
Debug session time: Mon Apr 19 18:42:13.768 2010 (GMT-4)
System Uptime: 2 days 9:16:39.213
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c000001d, 96b95051, 9ee5fa64, 0}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: 96b95051, The address that the exception occurred at
Arg3: 9ee5fa64, Trap Frame
Arg4: 00000000
Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
FAULTING_IP:
win32k!NtGdiAlphaBlend+a85
96b95051 ff ???
TRAP_FRAME: 9ee5fa64 -- (.trap 0xffffffff9ee5fa64)
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=9ee5fae8 edx=0000001d esi=fd9474d0 edi=00000006
eip=96b95051 esp=9ee5fad8 ebp=9ee5fcfc iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
win32k!NtGdiAlphaBlend+0xa85:
96b95051 ff ???
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x8E
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 82a9547a to 96b95051
FAILED_INSTRUCTION_ADDRESS:
win32k!NtGdiAlphaBlend+a85
96b95051 ff ???
STACK_TEXT:
9ee5fcfc 82a9547a 430115bf 00ffffff fdb06658 win32k!NtGdiAlphaBlend+0xa85
9ee5fcfc 76e964f4 430115bf 00ffffff fdb06658 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0279f064 00000000 00000000 00000000 00000000 0x76e964f4

STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !win32k
96b95041-96b9507f 63 bytes - win32k!NtGdiAlphaBlend+a75
[ 42 cf 96 89 75 d0 89 5d:ff ff ff 6c 68 01 00 78 ]
63 errors : !win32k (96b95041-96b9507f)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE_64
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE_64
BUCKET_ID: MEMORY_CORRUPTION_LARGE_64
Followup: memory_corruption
---------

npolite · Apr 22, 2010

Minidumps have been attached.

Jonathan_King · Apr 22, 2010

First problem: you have both ZoneAlarm and AVG installed. Out of all the anti-virus programs that cause BSODs, they are #1 and #2, respectively. Not a good thing.

Uninstall them both using Programs and Features, then run their respective removal tools.

For AVG:

32 bit: http://download.avg.com/filedir/util/avg_arm_sup_____.dir/avgremover.exe
64-bit: http://download.avg.com/filedir/util/avg_arv_sup_____.dir/avgremoverx64.exe

For ZoneAlarm: http://download.zonealarm.com/bin/free/support/cpes_clean.exe

Then download and install Microsoft Security Essentials.

Second: how long did you let memtest run? For 4GB of RAM, let it run for at least 5 passes.

npolite · Apr 24, 2010

I uninstalled Zone Alarm and it has been 2 days now and no crashes (I probably just jinxed myself). Hopefully that was the issue. I've installed Comodo for now. I really never had any issues with ZA and have been using it for years with XP. Hopefully they will fix the problems in the near future. I know they have been slow to fix a problem with allowing everything MS through.

npolite · Apr 24, 2010

Well not 5 minutes after I posted my update it BSOD. This time it appeared to be DRIVER_IRQ_NOT_LESS_OR_EQUAL but didn't drop any minidumps. I'm going to get around to running the full 5 passes of memtest and see if anything shows up but I'm probably looking at a reinstall soon.

npolite · Apr 25, 2010

I ran a Memtest for 7 passes and it came out clean so I'm guessing that's not the issue. If I get it one more time I'm going to uninstall AVG and see if that helps.

Jonathan_King · Apr 25, 2010

Keep us posted.

npolite · Apr 25, 2010

Here is the latest minidump. This is before the uninstall of AVG.

zigzag3143 · Apr 25, 2010

npolite said:
Here is the latest minidump. This is before the uninstall of AVG.

This one was caused by your tcpip stack.

If if were you I would

Re-install your wifi/lan driver.
run a system file check. ( type sfc /scannow)

If you are overclocking stop
if you are running a raid update your driver

Let us know your results

Ken

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\042510-25225-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*F:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16481.x86fre.win7_gdr.091207-1941
Machine Name:
Kernel base = 0x82c48000 PsLoadedModuleList = 0x82d90810
Debug session time: Sun Apr 25 22:10:26.508 2010 (GMT-4)
System Uptime: 0 days 6:16:14.050
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {3000a1e8, 2, 1, 8c02c1e2}

*** WARNING: Unable to verify timestamp for cmdhlp.sys
*** ERROR: Module load completed but symbols could not be loaded for cmdhlp.sys
Probably caused by : NETIO.SYS ( NETIO!KfdClassify+ed )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 3000a1e8, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8c02c1e2, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82db0718
Unable to read MiSystemVaType memory at 82d90160
 3000a1e8 

CURRENT_IRQL:  2

FAULTING_IP: 
NETIO!KfdClassify+ed
8c02c1e2 f00fc108        lock xadd dword ptr [eax],ecx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from 8c0f4d7c to 8c02c1e2

STACK_TEXT:  
8fbdf4fc 8c0f4d7c 00000004 8fbdf598 8fbdf5ac NETIO!KfdClassify+0xed
8fbdf708 8c0fdbc3 86756020 87735444 86755dc0 tcpip!ShimIpPacketOutV4+0x1bd
8fbdf73c 8c0cf560 00000000 86756020 87735444 tcpip!IppInspectLocalPacketsOut+0x5c
8fbdf790 8c0f3363 8fbdf7bc 8c173d98 00000001 tcpip!IppLoopbackEnqueue+0xa6
8fbdf7d0 8c0fb273 8c173d98 8673a5f4 8673a690 tcpip!IppDispatchSendPacketHelper+0xf6
8fbdf870 8c10130e 0073a5f4 00000000 88e9f658 tcpip!IppPacketizeDatagrams+0x8d6
8fbdf8f0 8c101595 00000000 00000004 8c173d98 tcpip!IppSendDatagramsCommon+0x652
8fbdf910 8c0fcdfa 86738098 8fbdf99c 00000000 tcpip!IpNlpSendDatagrams+0x4b
8fbdfaec 8c0feb31 00000000 00000001 875ef488 tcpip!UdpSendMessagesOnPathCreation+0x7c0
8fbdfbf0 8c0fe37a 86738008 00bdfcc8 00000000 tcpip!UdpSendMessages+0x595
8fbdfc04 82cd808a 8fbdfc94 bedc8de6 00000000 tcpip!UdpTlProviderSendMessagesCalloutRoutine+0x13
8fbdfc6c 8c0fe170 8c0fe367 8fbdfc94 00000000 nt!KeExpandKernelStackAndCalloutEx+0x132
8fbdfcac 90cf1f56 875ef488 8fbdfcc8 876f47f0 tcpip!UdpTlProviderSendMessages+0x67
8fbdfcf0 90cfa237 875ecde0 876f47f0 876f48a8 tdx!TdxSendTransportAddress+0x148
8fbdfd0c 82c844ac 86904f00 876f47f0 90d16178 tdx!TdxTdiDispatchInternalDeviceControl+0x69
8fbdfd24 90d134fa 8fbdfd50 90d13759 861ca480 nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
8fbdfd2c 90d13759 861ca480 00000000 8690c020 cmdhlp+0x34fa
8fbdfd50 82e5666d 00000000 bedc8c1a 00000000 cmdhlp+0x3759
8fbdfd90 82d081d9 90d136b6 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!KfdClassify+ed
8c02c1e2 f00fc108        lock xadd dword ptr [eax],ecx

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  NETIO!KfdClassify+ed

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bbf63

FAILURE_BUCKET_ID:  0xD1_NETIO!KfdClassify+ed

BUCKET_ID:  0xD1_NETIO!KfdClassify+ed

Followup: MachineOwner
---------

baarod · Apr 25, 2010

Jonathan_King said:
First problem: you have both ZoneAlarm and AVG installed. Out of all the anti-virus programs that cause BSODs, they are #1 and #2, respectively. Not a good thing.

Uninstall them both using Programs and Features, then run their respective removal tools.

For AVG:

32 bit: http://download.avg.com/filedir/util/avg_arm_sup_____.dir/avgremover.exe
64-bit: http://download.avg.com/filedir/util/avg_arv_sup_____.dir/avgremoverx64.exe

For ZoneAlarm: http://download.zonealarm.com/bin/free/support/cpes_clean.exe

Then download and install Microsoft Security Essentials.

Second: how long did you let memtest run? For 4GB of RAM, let it run for at least 5 passes.

I concur. What do you use Zone Alarm for? You can set the firewall built into the Windows 7 stack to alert you of the same behaviors. AVG is ok but there are better including Microsoft Security Essentials.

baarod · Apr 25, 2010

npolite said:
I ran a Memtest for 7 passes and it came out clean so I'm guessing that's not the issue. If I get it one more time I'm going to uninstall AVG and see if that helps.

What "memtest"? Some third party thing or the one built into Windows 7?

baarod · Apr 25, 2010

zigzag3143 said:

npolite said:
Here is the latest minidump. This is before the uninstall of AVG.

This one was caused by your tcpip stack.

If if were you I would

Re-install your wifi/lan driver.
run a system file check. ( type sfc /scannow)

If you are overclocking stop
if you are running a raid update your driver

Let us know your results

Ken

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\042510-25225-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*F:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16481.x86fre.win7_gdr.091207-1941
Machine Name:
Kernel base = 0x82c48000 PsLoadedModuleList = 0x82d90810
Debug session time: Sun Apr 25 22:10:26.508 2010 (GMT-4)
System Uptime: 0 days 6:16:14.050
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {3000a1e8, 2, 1, 8c02c1e2}

*** WARNING: Unable to verify timestamp for cmdhlp.sys
*** ERROR: Module load completed but symbols could not be loaded for cmdhlp.sys
Probably caused by : NETIO.SYS ( NETIO!KfdClassify+ed )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 3000a1e8, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8c02c1e2, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82db0718
Unable to read MiSystemVaType memory at 82d90160
 3000a1e8 

CURRENT_IRQL:  2

FAULTING_IP: 
NETIO!KfdClassify+ed
8c02c1e2 f00fc108        lock xadd dword ptr [eax],ecx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from 8c0f4d7c to 8c02c1e2

STACK_TEXT:  
8fbdf4fc 8c0f4d7c 00000004 8fbdf598 8fbdf5ac NETIO!KfdClassify+0xed
8fbdf708 8c0fdbc3 86756020 87735444 86755dc0 tcpip!ShimIpPacketOutV4+0x1bd
8fbdf73c 8c0cf560 00000000 86756020 87735444 tcpip!IppInspectLocalPacketsOut+0x5c
8fbdf790 8c0f3363 8fbdf7bc 8c173d98 00000001 tcpip!IppLoopbackEnqueue+0xa6
8fbdf7d0 8c0fb273 8c173d98 8673a5f4 8673a690 tcpip!IppDispatchSendPacketHelper+0xf6
8fbdf870 8c10130e 0073a5f4 00000000 88e9f658 tcpip!IppPacketizeDatagrams+0x8d6
8fbdf8f0 8c101595 00000000 00000004 8c173d98 tcpip!IppSendDatagramsCommon+0x652
8fbdf910 8c0fcdfa 86738098 8fbdf99c 00000000 tcpip!IpNlpSendDatagrams+0x4b
8fbdfaec 8c0feb31 00000000 00000001 875ef488 tcpip!UdpSendMessagesOnPathCreation+0x7c0
8fbdfbf0 8c0fe37a 86738008 00bdfcc8 00000000 tcpip!UdpSendMessages+0x595
8fbdfc04 82cd808a 8fbdfc94 bedc8de6 00000000 tcpip!UdpTlProviderSendMessagesCalloutRoutine+0x13
8fbdfc6c 8c0fe170 8c0fe367 8fbdfc94 00000000 nt!KeExpandKernelStackAndCalloutEx+0x132
8fbdfcac 90cf1f56 875ef488 8fbdfcc8 876f47f0 tcpip!UdpTlProviderSendMessages+0x67
8fbdfcf0 90cfa237 875ecde0 876f47f0 876f48a8 tdx!TdxSendTransportAddress+0x148
8fbdfd0c 82c844ac 86904f00 876f47f0 90d16178 tdx!TdxTdiDispatchInternalDeviceControl+0x69
8fbdfd24 90d134fa 8fbdfd50 90d13759 861ca480 nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
8fbdfd2c 90d13759 861ca480 00000000 8690c020 cmdhlp+0x34fa
8fbdfd50 82e5666d 00000000 bedc8c1a 00000000 cmdhlp+0x3759
8fbdfd90 82d081d9 90d136b6 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!KfdClassify+ed
8c02c1e2 f00fc108        lock xadd dword ptr [eax],ecx

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  NETIO!KfdClassify+ed

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bbf63

FAILURE_BUCKET_ID:  0xD1_NETIO!KfdClassify+ed

BUCKET_ID:  0xD1_NETIO!KfdClassify+ed

Followup: MachineOwner
---------

That's the same stack crawl profile as the Alureon rootkit variant I saw last week. Try the latest Malwarebytes for a free scan. This thing is incredibly polymorphic and has stopped showing outward signs as of late.

npolite · Apr 26, 2010

The test was using memtest86+. I checked Gigabyte's website (N650SLI_DS4) and didn't find any network driver updates for Win 7. The latest dirvers from Nvidia's website are 15.51 and haven't been updated since Oct 2009. I'll try going down the upgrade route for MS Security Essentials but I must have a driver conflict in Win 7.

I really like Zone Alarm over the MS firewall because it tells me when any request goes outbound, I get notified. Sometimes this doesn't happen with the MS one.

Jonathan_King · Apr 26, 2010

npolite said:
The test was using memtest86+. I checked Gigabyte's website (N650SLI_DS4) and didn't find any network driver updates for Win 7. The latest dirvers from Nvidia's website are 15.51 and haven't been updated since Oct 2009. I'll try going down the upgrade route for MS Security Essentials but I must have a driver conflict in Win 7.

I really like Zone Alarm over the MS firewall because it tells me when any request goes outbound, I get notified. Sometimes this doesn't happen with the MS one.

May I recommend the free firewall Comodo for that?

CarlTR6 · Apr 26, 2010

Jonathan_King said:
npolite said:

The test was using memtest86+. I checked Gigabyte's website (N650SLI_DS4) and didn't find any network driver updates for Win 7. The latest dirvers from Nvidia's website are 15.51 and haven't been updated since Oct 2009. I'll try going down the upgrade route for MS Security Essentials but I must have a driver conflict in Win 7.

I really like Zone Alarm over the MS firewall because it tells me when any request goes outbound, I get notified. Sometimes this doesn't happen with the MS one.

Click to expand...

May I recommend the free firewall Comodo for that?

I will second Comodo free firewall or PCTools free firewall for that reason. Both of these work well for me. I currently have Comodo running. ZA does not seem to play nice with Win7.

Jonathan_King · Apr 27, 2010

BTW PCTools does not play well with Windows 7 either. Many BSODs caused by it.

CarlTR6 · Apr 27, 2010

Jonathan_King said:
BTW PCTools does not play well with Windows 7 either. Many BSODs caused by it.

Interesting. I had no problems with it on my 32 bit system. It runs smoothly and uses less RAM than Comodo. I prefer Comodo's interface.

Daily BSOD

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Antique Senior Member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Antique Senior Member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer