BSOD caused by driver ndis.sys

[SingerGuy]

I have rebooted into safe mode without networking, deleted all drivers for my RealTek network card (currently running Realtek PCIe GBE Driver Win7 7067 01/22/2013) and restarted the computer several times. This does not seem to alleviate the problem. I have spent hours researching this and can't find anything for ndis.sys other than to reload the Realtek driver in the manner I just described. I must be missing something. I'm hoping a fresh pair of eyes can help me see what must be staring me in the face.

 

[Arc]

Sometimes AVG network filter service (avgfwfd) may cause a Ndis.sys blocking.

Removing AVG and applying MSE may be a good thing to test.

 

[SingerGuy]

It seems a shame to dump AVG, especially since I just paid for another full year of it. I've had it on this computer for four years now and this BSOD problem just surfaced a couple of weeks ago. I'm going to disable AVG at startup and run with nothing for a day or two to see if the problem goes away. If it does I'll look at adding MSE. I just don't want to walk away from the investment yet.

 

[VistaKing]

Hi singerguy

Try this version of the Realtek RTL8111C Driver

   Note

Version:7.067 Date: 1/31/2013


Download

 

[SingerGuy]

Hi singerguy

Try this version of the Realtek RTL8111C Driver

   Note

Version:7.067 Date: 1/31/2013


Download

If you look in my first post you'll see that is the version I am already running. Just to be sure I downloaded it and compared time stamps and file sizes against my Drivers directory and verified it is the same. Thanks, though.

 

[Northernsoul55]

Hi,

From your dumps:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 109, {a3a039d89fdfb58b, b3b7465ef25d939d, fffff88001b5efe0, 1}
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
or data. See Patching Policy for x64-Based Systems
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal breakpoints,
"bp", can only be set if the debugger is attached at boot time. Hardware
breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.

STOP 0x00000109: CRITICAL_STRUCTURE_CORRUPTION
Usual causes: Device driver, Breakpoint set with no debugger attached, Hardware (Memory in particular)

The analysis is Inclonclusive.

Run Driver Verifier to scan for any corrupted drivers which may be causing problems,
this program works by running various stress tests on drivers,
in order to produce a BSOD which will locate the driver; run for least 24 hours:

:ar: http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

I have observed past dump files in recent weeks that shows possible Memory corruption issues,
and 109 stop errors can also have this fault:

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

:ar: http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

I also observed that your AVG drivers are causing issues as Arc suggested.
For testing purposes Uninstall AVG (you can reinstall if found not to be the cause).

:ar: http://www.sevenforums.com/tutorials/78961-av-uninstallers.html
As an alternative install:
Microsoft Security Essentials.
Recommended from a strict BSOD perspective, compatibility & stability
compared to other antiviruses/internet security software.

:ar: Microsoft Security Essentials - Microsoft Windows

I would strongly advise to remove AVG PC TUNEUP and Registry Mechanic, they will do more harm
than good as there is almost no tweaking that can be done to Windows 7 to help to speed it up any.
The system is designed to self-diagnose itself.
Windows 7 maintains itself and that includes the registry, which we can check:

Run SFC to check the integrity of all Windows 7 system files:
Click on the Start > Type in search cmd
Right click cmd at top and Run as Administrator
Type SFC /scannow at the prompt (note the space between SFC and /scannow)

:ar: http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

For your Realtek driver try the one issued by Gigabyte (if you have not already)

:ar: http://www.gigabyte.com/products/product-page.aspx?pid=2851&dl=1#driver

Choose your operating system, select Show all.
Scroll down and you can try the driver there or there is also a Diagnostic Utility:

Realtek Ethernet Diagnostic Utility
Realtek LAN Driver

Post back any results / observations
Cheers
Dave

 

[SingerGuy]

I have observed past dump files in recent weeks that shows possible Memory corruption issues, and 109 stop errors can also have this fault:

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

:ar: http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Well, after just one pass I received 47 errors with memtest, so now I get to go back and try and figure out which stick is bad. Just thought I'd update this thread with my progress.

Oh, and I tried to use that AVG utility to uninstall the application but all it did was make it so the program is unstable and now I can't uninstall or fully reinstall it. It's stuck "inbetween." In the immortal words or Eeyore, "oh, bother!"

 

[Northernsoul55]

Hi,

Firstly thats good news with memtest, which is most likely the root of your BSOD's.

Secondly use revouninstaller to uninstall AVG:

:ar: http://www.revouninstaller.com/revo_uninstaller_free_download.html

Then use this to clean up:

:ar: http://www.filehippo.com/download_ccleaner/

ccleaner is a registry cleaner i know...but is an exception to the rule and safe to use.
Once installed, run it and select Tools and click Uninstall and look for AVG and uninstall.
Then click Registry and scan for issues, once done click fix selected issues. It may ask you to back up the registry, click no.

Once complete either install MSE or re-install AVG if you prefer. (I would install MSE until we see if
new memory corrects your BSOD).

Post back any progress,

Cheers

Dave

 

[SingerGuy]

OK, I nave now done the following items and I'm still getting dumps.

1. Ran Driver Verifier
2. Ran memtest. Ended up taking out my two newer and faster sticks and I'm now only running on 4GB of RAM, but it was error free for eight passes overnight.
3. AVG is now totally removed from my system. I have not installed MSE yet to replace it. I wanted a plainer system until I find the cause.
4. AVG PC TUNEUP and Registry Mechanic have been uninstalled.
5. Ran SFC
6. I'm running the Realtek driver issued by Gigabyte
7. I ran verify for several days.

After all that I'm still getting dumps. I have attached the latest SF_Diagnostic_Tool output to this post.

 

[Northernsoul55]

Hi,

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 109, {a3a039d89b8826bf, b3b7465eee060541, fffff8800199a470, 1}
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
or data. See Patching Policy for x64-Based Systems
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal breakpoints,
"bp", can only be set if the debugger is attached at boot time. Hardware
breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.

First try disabling your NIC:

1. Open Network Connections by clicking the Start button
   
   , clicking Control Panel, clicking Network and Internet, clicking Network and Sharing Center, and then clicking Manage network connections.

Right-click the network adapter, and then do one of the following:

1. To disable the network adapter, click Disable.
   
   If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

• To enable the network adapter, click Enable.
  
  If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

See if your issue persists?
If your issue persists maybe a repair install should be the next step.

:ar: http://www.sevenforums.com/tutorials/3413-repair-install.html

cheers

Dave