Solved A BSOD-stricken Win7HP 64-bit

[Gshegosh]

Greetings from Poland.

Having been tormented for the last 2 weeks with the BSODs I decided to ask you a favor to point me in the direction as to where I can find the culprit of my laptop's misoperation.

WhoCrashed and WinDbg blame ntoskrnl.exe but I'm sure it isn't so therefore I count on your directions.

Attached please find the Windows_NT6_BSOD_jcgriff2 scan. Regretfully, the perfmon /report task results either in a time-out or another BSOD therefore it is the one that's missing.

Win7 HP 64-bit SP1
Original OEM system
laptop bought ca. 1 month ago (i.e. in May 2011)
no reinstallation of the system


Any help will be appreciated.

 

[Wallonn7]

Hi Gshegosh and welcome to SF!
I imagine that Kaspersky - kl1.sys - has been preinstalled and that is the trial version. If so, I recommend that you uninstall it and install the Microsoft Security Essentials or Avast Free or or another of your choice. Uninstall NetWorx too. Use NetSpeedMonitor. Update Ethernet NIC NetLink Driver here.

Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631
Machine Name:
Kernel base = 0xfffff800`0300f000 PsLoadedModuleList = 0xfffff800`03254650
Debug session time: Thu Jun 23 10:07:52.966 2011 (UTC - 3:00)
System Uptime: 0 days 1:59:31.760
Loading Kernel Symbols
...............................................................
................................................................
...................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {18000000408, 2, 1, fffff80003094cf8}

Unable to load image \SystemRoot\system32\DRIVERS\[B][COLOR=Red]kl1.sys[/COLOR][/B], Win32 error 0n2
*** WARNING: Unable to verify timestamp for kl1.sys
*** ERROR: Module load completed but symbols could not be loaded for kl1.sys
Probably caused by : tdx.sys ( tdx!TdxSendDatagramTransportAddress+2f5 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000018000000408, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80003094cf8, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032be100
 0000018000000408 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeReleaseInStackQueuedSpinLockFromDpcLevel+68
fffff800`03094cf8 f04883700801    lock xor qword ptr [rax+8],1

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  [B][COLOR=Red]networx[/COLOR][/B].exe

TRAP_FRAME:  fffff8800bf43e60 -- (.trap 0xfffff8800bf43e60)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000018000000400 rbx=0000000000000000 rcx=fffff8800bf44250
rdx=fffffa8011686ec0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003094cf8 rsp=fffff8800bf43ff0 rbp=0000000000000000
 r8=fffff8800bf44250  r9=0000000000000001 r10=fffff88003afba60
r11=fffffa801065fc00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KeReleaseInStackQueuedSpinLockFromDpcLevel+0x68:
fffff800`03094cf8 f04883700801    lock xor qword ptr [rax+8],1 ds:3fa0:00000180`00000408=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000308e2a9 to fffff8000308ed00

STACK_TEXT:  
fffff880`0bf43d18 fffff800`0308e2a9 : 00000000`0000000a 00000180`00000408 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0bf43d20 fffff800`0308cf20 : 00000000`00000001 fffff880`03afba60 fffffa80`1065fc00 fffff880`0bf44250 : nt!KiBugCheckDispatch+0x69
fffff880`0bf43e60 fffff800`03094cf8 : 00000000`00000001 00000000`00000000 fffff880`0bf44550 fffff880`0bf445f0 : nt!KiPageFault+0x260
fffff880`0bf43ff0 fffff880`0187a860 : fffffa80`09dbe740 fffff880`0bf445f0 00000000`00000000 00000000`00000000 : nt!KeReleaseInStackQueuedSpinLockFromDpcLevel+0x68
fffff880`0bf44020 fffff880`018ab495 : fffff880`0bf44550 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip! ?? ::FNODOBFM::`string'+0x38860
fffff880`0bf44410 fffff800`0309b668 : fffff880`04f94110 fffffa80`1065fc10 00000000`030a9206 00000000`00000000 : tcpip!UdpTlProviderSendMessagesCalloutRoutine+0x15
fffff880`0bf44440 fffff880`018ab528 : fffff880`018ab480 fffffa80`11ca4700 00000000`00000000 fffffa80`09c0f401 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`0bf44520 fffff880`04f7c675 : fffffa80`07ed5110 fffffa80`1065fc00 fffffa80`11bda010 fffffa80`13708e06 : tcpip!UdpTlProviderSendMessages+0x78
fffff880`0bf445a0 fffff880`04f7c8c2 : 00000000`00000000 fffffa80`135e0510 fffffa80`12033678 00177bd8`00000028 : tdx!TdxSendDatagramTransportAddress+0x2f5
fffff880`0bf44680 fffff880`01e4af22 : fffffa80`135e0510 fffffa80`135e0560 fffffa80`11d106a0 fffffa80`135e0510 : tdx!TdxTdiDispatchInternalDeviceControl+0x52
fffff880`0bf44700 fffffa80`135e0510 : fffffa80`135e0560 fffffa80`11d106a0 fffffa80`135e0510 00000000`00000000 : kl1+0x1bcf22
fffff880`0bf44708 fffffa80`135e0560 : fffffa80`11d106a0 fffffa80`135e0510 00000000`00000000 fffff880`01c909b3 : 0xfffffa80`135e0510
fffff880`0bf44710 fffffa80`11d106a0 : fffffa80`135e0510 00000000`00000000 fffff880`01c909b3 fffa8009`db9c9000 : 0xfffffa80`135e0560
fffff880`0bf44718 fffffa80`135e0510 : 00000000`00000000 fffff880`01c909b3 fffa8009`db9c9000 00000000`000008ff : 0xfffffa80`11d106a0
fffff880`0bf44720 00000000`00000000 : fffff880`01c909b3 fffa8009`db9c9000 00000000`000008ff 00000000`00028000 : 0xfffffa80`135e0510


STACK_COMMAND:  kb

FOLLOWUP_IP: 
tdx!TdxSendDatagramTransportAddress+2f5
fffff880`04f7c675 448be0          mov     r12d,eax

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  tdx!TdxSendDatagramTransportAddress+2f5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tdx

IMAGE_NAME:  [B][COLOR=Red]tdx.sys[/COLOR][/B]

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79332

FAILURE_BUCKET_ID:  X64_0xA_tdx!TdxSendDatagramTransportAddress+2f5

BUCKET_ID:  X64_0xA_tdx!TdxSendDatagramTransportAddress+2f5

Followup: MachineOwner

 

[Gshegosh]

Wallon7,

Thanks for prompt reply.

However, there are a few things to ponder concerning Kaspersky Internet Security 2011 for which I have been licensed.

1. I've had problems with KIS2011 to be properly turned on in the "Action Center" (or whatever it is called in the English version of Win7) since Windows Defender and Windows Firewall services both had to be turned off in the System Configuration panel (msconfig), yet I had to also switch off the system firewall and spyware notifications in the system panel because there always have been infos that the system is not protected. Any idea how to handle that?

2. In May I switched from my former Toshiba laptop to the new one by ASUS and had to admit I didn't have any such problems with OS (KIS2011 having been installed there as well),

3. In my diagnostics package I sent to WS forum I attached 20 dump files. Do all of them hint that KIS 2011 is to blame?

Hoping this will not alleviate your interest in my case and I will hear from you on the above as well.

 

[Wallonn7]

Wallon7,

Thanks for prompt reply.

My pleasure.

However, there are a few things to ponder concerning Kaspersky Internet Security 2011 for which I have been licensed.

That's why I said "If".

1. I've had problems with KIS2011 to be properly turned on in the "Action Center" (or whatever it is called in the English version of Win7) since Windows Defender and Windows Firewall services both had to be turned off in the System Configuration panel (msconfig), yet I had to also switch off the system firewall and spyware notifications in the system panel because there always have been infos that the system is not protected. Any idea how to handle that?

Turn on Windows Defender and Windows Firewall in msconfig. Then:

1. Windows Defender > type MSASCui at windows explorer search bar. Click it to open WD. Go to Tools > Options > Administrator > uncheck "Use this program" box, save an ok.
2. Windows Firewall > open Control Panel > System and Security > Windows Firewall > Activate or Deactivate Windows Firewall - left pane > check "deactivate Windows Firewall ( ... ) box, ok.

2. In May I switched from my former Toshiba laptop to the new one by ASUS and had to admit I didn't have any such problems with OS (KIS2011 having been installed there as well),

3. In my diagnostics package I sent to WS forum I attached 20 dump files. Do all of them hint that KIS 2011 is to blame?

Kaspersky is well known to cause this type of conflict. In the four most recent dumps I analyzed there were involvement of its driver "k1s.sys." I suggest that you contact Kaspersky support and report this issue as well.

Hoping this will not alleviate your interest in my case and I will hear from you on the above as well.

No way!


Remember... Uninstall NetWorx too. Use NetSpeedMonitor. Update Ethernet NIC NetLink Driver here.
Hope that helps.

 

[Gshegosh]

Wallon7,

Your assitance has been indispensable.

It is networx.exe indeed that crashed my system which was proven under the strain of verifier.exe.

As to KIS2011 I resolved that there was one mistake I had made during its setup: I should have switched off Windows Defender/Firewall prior to installing KIS2011.

Following your instructions I just switched WD/WF off and reinstalled KIS2011 and haven't experienced any BSODs whatsoever ever since.

The credits go to you, Wallon7, and thank you once again.

 

[Wallonn7]

Glad we were able to solve it all. Keep reporting to be sure.
You're welcome.