BOSD after clean up

[lorddenis]

Today was my clean the PC day. Meaning opening it up blowing the dust out etc and the PC worked like always until now. i got a BOSD.

The file is attached. i hope its the right one.

i shuld mention that my C: partiotion on was formated and the win re-instaled less that a mouth ago. Evrything instaling the drivers etc was done at the shop.

I have a felling that something is wrong with the hard drive.


the message that i get:

Podpis težave:
Ime težave: BlueScreen
Različica operacijskega sistema: 6.1.7601.2.1.0.256.48
Področne nastavitve: 1060

Dodatne informacije o težavi:
BCCode: a
BCP1: 0000000000000008
BCP2: 0000000000000002
BCP3: 0000000000000000
BCP4: FFFFF80002E1633E
OS Version: 6_1_7601
Service Pack: 1_0
Product: 256_1

Datoteke, v katerih je opisana težava:
C:\Windows\Minidump\072013-64381-01.dmp
C:\Users\Denis\AppData\Local\Temp\WER-72883-0.sysdata.xml

V spletu preberite izjavo o zasebnosti:
Izjava o zasebnosti za sistem Windows 7 - Microsoft Windows

Če v spletu izjava o zasebnost ni na voljo, preberite našo izjavo o zasebnosti brez povezave:
C:\Windows\system32\sl-SI\erofflps.txt

 

[koolkat77]

Hi

Update the driver below and tell us if you continue to get BSOD's. Driver Reference Table - Rt64win7.sys

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {8, 2, 0, fffff80002e1833e}

*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
Probably caused by : Rt64win7.sys ( Rt64win7+10bb8 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002e1833e, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310c100
GetUlongFromAddress: unable to read from fffff8000310c1c0
 0000000000000008 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
hal!HalpDmaFreeMapRegisters+1a
fffff800`02e1833e 488b5a08        mov     rbx,qword ptr [rdx+8]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff88002fb6800 -- (.trap 0xfffff88002fb6800)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88002fb6930 rbx=0000000000000000 rcx=fffffa8005260458
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e1833e rsp=fffff88002fb6990 rbp=0000000000000e00
 r8=fffff88002fb6930  r9=fffff80002e42c60 r10=0000000000000038
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
hal!HalpDmaFreeMapRegisters+0x1a:
fffff800`02e1833e 488b5a08        mov     rbx,qword ptr [rdx+8] ds:00000000`00000008=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ed41a9 to fffff80002ed4c00

STACK_TEXT:  
fffff880`02fb66b8 fffff800`02ed41a9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`02fb66c0 fffff800`02ed2e20 : fffffa80`0639b950 00000000`000007ff 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`02fb6800 fffff800`02e1833e : fffffa80`0410cd50 fffffa80`0410cd50 fffffa80`05577570 00000000`00000001 : nt!KiPageFault+0x260
fffff880`02fb6990 fffff800`02e1ab82 : fffffa80`052603e0 00000000`00000000 fffffa80`052603e0 00000000`000005d7 : hal!HalpDmaFreeMapRegisters+0x1a
fffff880`02fb69c0 fffff800`02e1a825 : fffffa80`05497a00 00000000`00000e80 00000000`00000000 fffffa80`04085e40 : hal!IoFreeMapRegisters+0x62
fffff880`02fb6a30 fffff880`0140a6e1 : fffffa80`04085d70 fffffa80`04085c40 fffffa80`0547dd80 fffffa80`0410cd50 : hal!HalPutScatterGatherList+0xd5
fffff880`02fb6a90 fffff880`04194bb8 : fffff800`0307a201 fffffa80`0547dd80 00000000`00000000 fffff800`0307a201 : ndis!NdisMFreeNetBufferSGList+0x31
fffff880`02fb6ad0 fffff800`0307a201 : fffffa80`0547dd80 00000000`00000000 fffff800`0307a201 00000000`00000000 : Rt64win7+0x10bb8
fffff880`02fb6ad8 fffffa80`0547dd80 : 00000000`00000000 fffff800`0307a201 00000000`00000000 00000000`00000000 : nt!ExpWorkerThreadBalanceManagerPtr+0x1
fffff880`02fb6ae0 00000000`00000000 : fffff800`0307a201 00000000`00000000 00000000`00000000 00000000`00000001 : 0xfffffa80`0547dd80


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Rt64win7+10bb8
fffff880`04194bb8 ??              ???

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  Rt64win7+10bb8

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Rt64win7

IMAGE_NAME:  Rt64win7.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49a65b0d

FAILURE_BUCKET_ID:  X64_0xA_Rt64win7+10bb8

BUCKET_ID:  X64_0xA_Rt64win7+10bb8

Followup: MachineOwner
---------

0: kd> lmvm Rt64win7
start             end                 module name
fffff880`04184000 fffff880`041b6000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: \SystemRoot\system32\DRIVERS\Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:        Thu Feb 26 15:04:13 2009 (49A65B0D)
    CheckSum:         0002EB30
    ImageSize:        00032000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[lorddenis]

i did as instructed and so far so good. i hope it fixed the problem. will report in a fev hours if its ok!
Thank you!

 

[lorddenis]

For 24 hours it was ok. but now it happent again

 

[Arc]

Hi Lordy my old friend Your monster is still dancing :shock:

Here it is the same BSOD again .... network failure.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, 109b, 300005, fffffa80047caa70}

*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
GetPointerFromAddress: unable to read from fffff800030ca100
GetUlongFromAddress: unable to read from fffff800030ca1c0
Probably caused by : NETIO.SYS ( NETIO!NetioDereferenceNetBufferListChain+132 )

Followup: MachineOwner
---------

But this time, the driver is the latest version.

fffff880`04226000 fffff880`042f8000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: \SystemRoot\system32\DRIVERS\Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:        Wed Apr 10 08:30:34 2013 (5164D5D2)
    CheckSum:         000DB44C
    ImageSize:        000D2000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Make it sure that tverything is placed properly.

And enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[lorddenis]

Hello Arc how are you ?
So i did as u asked but there was no blue screan.. so does that i mean its over ?

 

[Arc]

I am apparently fine, my friend

Observe the computer for a few more days. Let us know how it is working.
Will be eager to know

 

[lorddenis]

Didnt know you are a thor fan

So yesterday and again today another BSOD :S and i thot i got rid off it...rar is attached.

 

[Arc]

You noticed Thor there

But the problem here is, it is still crashing on the same network adapter driver.

BugCheck D1, {1800135, 2, 0, fffff880016fb360}

*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
[COLOR=Red]Probably caused by : Rt64win7.sys[/COLOR] ( Rt64win7+17aaa )

Followup: MachineOwner
---------

Despite of the fact that you have updated the driver.

fffff880`04800000 fffff880`048d2000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: \SystemRoot\system32\DRIVERS\Rt64win7.sys
[COLOR=Red]    Image name: Rt64win7.sys
    Timestamp:        Wed Apr 10 08:30:34 2013[/COLOR] (5164D5D2)
    CheckSum:         000DB44C
    ImageSize:        000D2000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

So it may not be the driver itself, but something else is making the driver crash. Now the question is ... what it may be?

As a first try, scan the system for possible virus infection with the following programs only.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Let us know the results.

 

[lorddenis]

You noticed Thor there

But the problem here is, it is still crashing on the same network adapter driver.

BugCheck D1, {1800135, 2, 0, fffff880016fb360}

*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
[COLOR=Red]Probably caused by : Rt64win7.sys[/COLOR] ( Rt64win7+17aaa )

Followup: MachineOwner
---------

Despite of the fact that you have updated the driver.

fffff880`04800000 fffff880`048d2000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: \SystemRoot\system32\DRIVERS\Rt64win7.sys
[COLOR=Red]    Image name: Rt64win7.sys
    Timestamp:        Wed Apr 10 08:30:34 2013[/COLOR] (5164D5D2)
    CheckSum:         000DB44C
    ImageSize:        000D2000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

So it may not be the driver itself, but something else is making the driver crash. Now the question is ... what it may be?

As a first try, scan the system for possible virus infection with the following programs only.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Let us know the results.

Thor for me was an awsome movie. looking forward to the next one

do i have to scan with both of them ? i used the first one and there are no threats.

usualy when the BSOD happens on the interned or watching something. so maybe java ? graphic card ?

 

[Arc]

It says it is the network adopter driver. If the second scan comes free, we must to think it alternatively.

And yes, waiting for the dark world, too

 

[lorddenis]

i cant instal the second program i need an empy cd for that. or i have to find an usb wich proves problematic

 

[Arc]

Take your time
It is needed to decide whether the system is free from threats or not, specially where there is internet related crash out of no solid reason.

 

[lorddenis]

So for a fev day evrything was fine..and then today it happent twice :S

 

[Arc]

Mate I think its the time for a Clean reinstall now, as it is crashing on the same driver, again and again.

If it is simply a driver issue, the clean reinstall will recover it.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {1800135, 2, 0, fffff88001671360}

*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
Probably caused by : Rt64win7.sys ( Rt64win7+17aaa )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000001800135, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88001671360, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030fc100
GetUlongFromAddress: unable to read from fffff800030fc1c0
 0000000001800135 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
ndis! ?? ::FNODOBFM::`string'+15cd
fffff880`01671360 8b4728          mov     eax,dword ptr [rdi+28h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff880084a37a0 -- (.trap 0xfffff880084a37a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000001e0 rbx=0000000000000000 rcx=0000000000000b08
rdx=fffffa8004794a90 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001671360 rsp=fffff880084a3930 rbp=fffffa8005574000
 r8=fffffa8004ad7130  r9=0000000000000001 r10=0000000000000000
r11=fffffa80053051a0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
ndis! ?? ::FNODOBFM::`string'+0x15cd:
fffff880`01671360 8b4728          mov     eax,dword ptr [rdi+28h] ds:00000000`00000028=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ec41a9 to fffff80002ec4c00

STACK_TEXT:  
fffff880`084a3658 fffff800`02ec41a9 : 00000000`0000000a 00000000`01800135 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`084a3660 fffff800`02ec2e20 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`04794a90 : nt!KiBugCheckDispatch+0x69
fffff880`084a37a0 fffff880`01671360 : fffffa80`06e829f0 fffffa80`05574000 fffffa80`000000a0 fffffa80`047b6230 : nt!KiPageFault+0x260
fffff880`084a3930 fffff880`04817aaa : fffffa80`053051a0 fffffa80`053051a0 fffffa80`04ad7130 fffffa80`05574000 : ndis! ?? ::FNODOBFM::`string'+0x15cd
fffff880`084a39d0 fffffa80`053051a0 : fffffa80`053051a0 fffffa80`04ad7130 fffffa80`05574000 fffffa80`05582740 : Rt64win7+0x17aaa
fffff880`084a39d8 fffffa80`053051a0 : fffffa80`04ad7130 fffffa80`05574000 fffffa80`05582740 00000000`000001c0 : 0xfffffa80`053051a0
fffff880`084a39e0 fffffa80`04ad7130 : fffffa80`05574000 fffffa80`05582740 00000000`000001c0 00000000`00000000 : 0xfffffa80`053051a0
fffff880`084a39e8 fffffa80`05574000 : fffffa80`05582740 00000000`000001c0 00000000`00000000 ffff0000`00000103 : 0xfffffa80`04ad7130
fffff880`084a39f0 fffffa80`05582740 : 00000000`000001c0 00000000`00000000 ffff0000`00000103 00000000`00000001 : 0xfffffa80`05574000
fffff880`084a39f8 00000000`000001c0 : 00000000`00000000 ffff0000`00000103 00000000`00000001 fffffa80`047b0000 : 0xfffffa80`05582740
fffff880`084a3a00 00000000`00000000 : ffff0000`00000103 00000000`00000001 fffffa80`047b0000 00000000`00000000 : 0x1c0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Rt64win7+17aaa
fffff880`04817aaa ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  Rt64win7+17aaa

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Rt64win7

IMAGE_NAME:  Rt64win7.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5164d5d2

FAILURE_BUCKET_ID:  X64_0xD1_Rt64win7+17aaa

BUCKET_ID:  X64_0xD1_Rt64win7+17aaa

Followup: MachineOwner
---------

1: kd> lmvm Rt64win7
start             end                 module name
fffff880`04800000 fffff880`048d2000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: \SystemRoot\system32\DRIVERS\Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:        Wed Apr 10 08:30:34 2013 (5164D5D2)
    CheckSum:         000DB44C
    ImageSize:        000D2000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[lorddenis]

My instal was made by come tech firm i dont have a code.

 

[Arc]

My instal was made by come tech firm i dont have a code.

I can read you, my friend We are the same with keyboards
Now that's a problem. Do one thing as a more try. Uninstall and update the network driver.
First, download the network card driver from manufactuer's website. You have done it already. Perhaps there is a further update I guess.
Then reinstall the driver:

1. Click the Start Button, type "devmgmt.msc" (without quotation marks) in the Start Menu Search box and press Enter.
2. Double click to expand "Network adaptors".
3. Right click your network card and click Uninstall.
4. Check "Delete driver software for this device" check box, click OK.
5. Restart the computer
6. If windows does not auto configure the appropriate drivers at startup, install the downloaded one manually. http://www.sevenforums.com/tutorials/97061-driver-install-device-manager.html

Let us know the result?

 

[lorddenis]

Im sorry for my late replay. Working all the time. and today i went out.. its 4 in the morning.. im so drunk that ..well lets just say im drunk hahaha

so i did as instructed.. the windows configured the drivers at startup and now all i can do i wait and see if this happens again.

Thank you!

 

[lorddenis]

EDIT .
Like 30 seconds after i posted the post above i got a blue screan of death. and then the pc restarted tryed doing the SF-DIAGNOSTIC TOOL. 1 try got a BSOD, 2 try got a BSOD 3th try was a succes and the file is attached.

:/

 

[Arc]

Crashed on the same thing ... the Realtek network driver.

A new version is out on 2013/8/1, you may have a try ..... Realtek

But do it after the hangover is over

Not finding any real cause of failing the same thing over and over. We need to make it sure that it is not a network chip corruption, and so a clean reinstall was needed there.