Another BSOD Mystery..

[BlueYoshiCoke]

First off, this forum is amazing - I can't believe how much help is offered for those that scurry on in here. I just happened to stumble upon this site while trying to find a solution to these haphazard BSODs that have just started happening today. For the past 5 hours, I've created so many scenarios trying to figure out what the cause of the problem was - but the computer always eventually crashed. Even when I just booted up the computer and let it just sit there, it crashed after 15 minutes.

System Information
Gateway Laptop NV79C47u
Intel Core i5-450M Processor
4GB DDR3 Memory
ATI Mobility Radeon HD 5650, 1 GB VRAM

Windows 7 Home Premium x64
It's the original installed OS - OEM

The Computer's History
This laptop was purchased two weeks ago and has only been used to browse the internet, download security programs (AVG, Zone Alarm, Spybot, etc.), and media players (DivX, iTunes, VLC).

These BSODs have just started happening today for no apparent reason.. and the owner of the laptop leaves for college tomorrow! Horrible timing!

 

[CarlTR6]

Welcome to the forum, BlueYoshiCoke (interesting handle ). I am about to go eat. One of the other team members will be along to help you. If not, I will take a look when I get back.

 

[Lemur]

Welcome, BlueYoshiCoke,

Please check your wifi nic card.

Event[303]:
Log Name: System
Source: Microsoft-Windows-WLAN-AutoConfig
Date: 2010-08-25T17:10:27.851
Event ID: 10000
Task: N/A
Level: Error
Opcode: Info
Keyword: N/A
User: S-1-5-18
User Name: NT AUTHORITY\SYSTEM
Computer: HKH-PC
Description:
WLAN Extensibility Module has failed to start.


**EDIT**
Atheros AR5B93 Wireless Network Adapter

 

[BlueYoshiCoke]

Welcome to the forum, BlueYoshiCoke (interesting handle ). I am about to go eat. One of the other team members will be along to help you. If not, I will take a look when I get back.

Haha yeah.. it was inspired by my younger brother. He thought this was the funniest thing in the world (it isn't):


And thank you!

Welcome, BlueYoshiCoke,

Please check your wifi nic card.

Event[303]:
Log Name: System
Source: Microsoft-Windows-WLAN-AutoConfig
Date: 2010-08-25T17:10:27.851
Event ID: 10000
Task: N/A
Level: Error
Opcode: Info
Keyword: N/A
User: S-1-5-18
User Name: NT AUTHORITY\SYSTEM
Computer: HKH-PC
Description:
WLAN Extensibility Module has failed to start.


**EDIT**
Atheros AR5B93 Wireless Network Adapter

Hmm, I disabled the wireless internet on the computer 25 minutes ago and it hasn't crashed (yet), but I've been trying to figure out how I would check the card? I ran a troubleshooter for the wireless network and it didn't provide any information. I'm so used to Windows XP that the Windows 7 environment is still unfamiliar..

 

[Capt.Jack Sparrow]

Hello and Welcome !

You have UNEXPECTED_KERNEL_MODE_TRAP mostly caused by Internet security and you have the most notorious one that can cause BSOD. Uninstall Zone Alarm and AVG completely. Use the Removal Tools to remove them. http://download.zonealarm.com/bin/free/support/cpes_clean.exe and AVG - Tools download

Install Microsoft Security Essentials http://www.microsoft.com/security_essentials/

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80050031, 6f8, fffff80002c43798}

Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 )

Followup: MachineOwner
---------

2: kd> !thread;!analyze -v;r;kv;lmtn;lmtsmn;.bugcheck;
GetPointerFromAddress: unable to read from fffff80002eb1000
THREAD fffff8800316dfc0  Cid 0000.0000  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 2
Not impersonating
GetUlongFromAddress: unable to read from fffff80002defb74
Owning Process            fffff80002e02140       Image:         <Unknown>
Attached Process          fffffa8003b4c040       Image:         System
fffff78000000000: Unable to get shared data
Wait Start TickCount      1053903      
Context Switch Count      1674031             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address nt!KiIdleLoop (0xfffff80002c836a0)
Stack Init fffff8800318bdb0 Current fffff8800318bd40
Base fffff8800318c000 Limit fffff88003186000 Call 0
Priority 16 BasePriority 0 UnusualBoost 0 ForegroundBoost 0 IoPriority 0 PagePriority 0
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`03169ce8 fffff800`02c7a469 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`03169cf0 fffff800`02c78932 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`03169e30 fffff800`02c43798 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2 (TrapFrame @ fffff880`03169e30)
fffff880`03185ee0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SeAccessCheckFromState+0x58

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff80002c43798

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002c7a469 to fffff80002c7af00

STACK_TEXT:  
fffff880`03169ce8 fffff800`02c7a469 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`03169cf0 fffff800`02c78932 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`03169e30 fffff800`02c43798 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`03185ee0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SeAccessCheckFromState+0x58


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiDoubleFaultAbort+b2
fffff800`02c78932 90              nop

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiDoubleFaultAbort+b2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2

BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2

Hope this helps,
Captain

 

[BlueYoshiCoke]

Hello and Welcome !

You have UNEXPECTED_KERNEL_MODE_TRAP mostly caused by Internet security and you have the most notorious one that can cause BSOD. Uninstall Zone Alarm and AVG completely. Use the Removal Tools to remove them. http://download.zonealarm.com/bin/free/support/cpes_clean.exe and AVG - Tools download

Install Microsoft Security Essentials http://www.microsoft.com/security_essentials/

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80050031, 6f8, fffff80002c43798}

Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 )

Followup: MachineOwner
---------

2: kd> !thread;!analyze -v;r;kv;lmtn;lmtsmn;.bugcheck;
GetPointerFromAddress: unable to read from fffff80002eb1000
THREAD fffff8800316dfc0  Cid 0000.0000  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 2
Not impersonating
GetUlongFromAddress: unable to read from fffff80002defb74
Owning Process            fffff80002e02140       Image:         <Unknown>
Attached Process          fffffa8003b4c040       Image:         System
fffff78000000000: Unable to get shared data
Wait Start TickCount      1053903      
Context Switch Count      1674031             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address nt!KiIdleLoop (0xfffff80002c836a0)
Stack Init fffff8800318bdb0 Current fffff8800318bd40
Base fffff8800318c000 Limit fffff88003186000 Call 0
Priority 16 BasePriority 0 UnusualBoost 0 ForegroundBoost 0 IoPriority 0 PagePriority 0
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`03169ce8 fffff800`02c7a469 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`03169cf0 fffff800`02c78932 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`03169e30 fffff800`02c43798 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2 (TrapFrame @ fffff880`03169e30)
fffff880`03185ee0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SeAccessCheckFromState+0x58

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff80002c43798

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002c7a469 to fffff80002c7af00

STACK_TEXT:  
fffff880`03169ce8 fffff800`02c7a469 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`03169cf0 fffff800`02c78932 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`03169e30 fffff800`02c43798 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`03185ee0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SeAccessCheckFromState+0x58


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiDoubleFaultAbort+b2
fffff800`02c78932 90              nop

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiDoubleFaultAbort+b2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2

BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2

Hope this helps,
Captain

I was thinking it might have something to do with the security software because when I was Googling the problem, a few results came up with people citing that their anti-virus/firewalls/anti-malware programs were causing the crashes.

I'll try the Microsoft programs instead and hopefully everything will be smooth sailing from here on out.

Thank you so much! All of you deserve an award of some sort.

 

[cluberti]

OK, this is the third one today, and all have been AVG + ZoneAlarm:

http://support.microsoft.com/kb/981180

I'm with Capt. Jack at this point - remove AVG and ZoneAlarm, install MSE and the hotfix linked above, and you should be good to go.

 

[Tews]

Thank you so much! All of you deserve an award of some sort.

Actually we got one... Best Windows Seven forum on the Internet for 2009!

 

[Lemur]

Thank you so much! All of you deserve an award of some sort.

Actually we got one... Best Windows Seven forum on the Internet for 2009!

And 2010, only they don't know it yet

 

[CarlTR6]

Captain Jack and cluberti are spot on. AVG causes crashes on some Win 7 systems and Zone Alarm is notorious for doing so. I knew some of the team would come along to help you.

I like the video! Cute! . Post back and let us know how your system is running after you make these changes.

 

[Lemur]

Here's the driver for your wi-fi card
Gateway Support Drivers & Downloads

 

[BlueYoshiCoke]

OK, this is the third one today, and all have been AVG + ZoneAlarm:

http://support.microsoft.com/kb/981180

I'm with Capt. Jack at this point - remove AVG and ZoneAlarm, install MSE and the hotfix linked above, and you should be good to go.

Sorry.. If I knew how to check other system reports and compare them with mine I would. I did uninstall AVG and ZoneAlarm and installed MSE and it has yet to crash, so I think that was the problem. With my XP machine, AVG + ZoneAlarm was pretty much an award winning recipe for free protection.

Thank you so much! All of you deserve an award of some sort.

Actually we got one... Best Windows Seven forum on the Internet for 2009!

You go Seven Forums!

Here's the driver for your wi-fi card
Gateway Support Drivers & Downloads

I'll update the drivers in a little bit, just to air on the side of caution and to make sure the system is 100% good to go. I tip my hat to you good sir.

 

[cluberti]

You might still want to install that hotfix, but yes, the issue that hotfix fixes seems to be caused by interactions between antivirus products, firewalls, and Windows' netio/tcpip components and UDP. McAfee HIP is known to cause this, and apparently so is AVG+ZoneAlarm.

Don't worry about comparing, these sorts of things aren't easy even for us to do, so in this case don't feel bad. We're just starting to notice this today (which means it's likely an AVG def update started triggering it, considering you don't appear to have actually updated anything in the last 24 - 48 hours). Live and learn, it's what we all do.