BSOD - Event View Source: Kernel Power, EventID 41

[bilbi]

Hi

Today i've got the 3rd BSOD this month - on a new purchased Laptop / Windows 7 64Bit.

Dump file from today's crash is attached.

Thanks!

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" /> 
  <EventID>41</EventID> 
  <Version>2</Version> 
  <Level>1</Level> 
  <Task>63</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000002</Keywords> 
  <TimeCreated SystemTime="2010-01-18T19:05:46.232818800Z" /> 
  <EventRecordID>17092</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4" ThreadID="8" /> 
  <Channel>System</Channel> 
  <Computer>LAPTOP</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="BugcheckCode">194</Data> 
  <Data Name="BugcheckParameter1">0x7</Data> 
  <Data Name="BugcheckParameter2">0x1097</Data> 
  <Data Name="BugcheckParameter3">0x210005</Data> 
  <Data Name="BugcheckParameter4">0xfffffa8007ed7e00</Data> 
  <Data Name="SleepInProgress">false</Data> 
  <Data Name="PowerButtonTimestamp">0</Data> 
  </EventData>
  </Event>

 

[TimStitt]

Hi bilbi,

There seems to be a power issue on the kernel, however this can be caused by many things and is not solely indicative of a power loss. It's a good place to start though. I see by the computer name that this is a laptop?

• Was it running on batteries or power when the issue occured?
• Are there many USB (or other external) deveices plugged in to it?

Head off to your manufacturers website and download the latest drivers (don't use windows update as these may not be the newest available). Update everything! note: For chipset drivers you may want to check with AMD or intel directly.

The bug report suggests that your wireless drivers are the culprit (netw5v64.sys). you may want to start with these first.

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Tim\Desktop\011810-19952-01\011810-19952-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02e0f000 PsLoadedModuleList = 0xfffff800`0304ce50
Debug session time: Tue Jan 19 06:04:55.580 2010 (GMT+11)
System Uptime: 0 days 11:17:34.281
Loading Kernel Symbols
...............................................................
................................................................
...........................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, 1097, 210005, fffffa8007ed7e00}

Unable to load image \SystemRoot\system32\DRIVERS\netw5v64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for netw5v64.sys
*** ERROR: Module load completed but symbols could not be loaded for netw5v64.sys
GetPointerFromAddress: unable to read from fffff800030b70e0
Probably caused by : netw5v64.sys ( netw5v64+1b8283 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 0000000000001097, (reserved)
Arg3: 0000000000210005, Memory contents of the pool block
Arg4: fffffa8007ed7e00, Address of the block of pool being deallocated

Debugging Details:
------------------


POOL_ADDRESS:  fffffa8007ed7e00 

FREED_POOL_TAG:  W3Rx

BUGCHECK_STR:  0xc2_7_W3Rx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  IDMan.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002fb260e to fffff80002e80f00

STACK_TEXT:  
fffff880`0bd59008 fffff800`02fb260e : 00000000`000000c2 00000000`00000007 00000000`00001097 00000000`00210005 : nt!KeBugCheckEx
fffff880`0bd59010 fffff880`020a7ad2 : fffffa80`06128ad0 00000000`00000000 00000000`00000100 fffffa80`07ed7e20 : nt!ExFreePool+0xccb
fffff880`0bd590c0 fffff880`05429283 : fffff780`00000014 fffffa80`045e1100 fffffa80`0311efe0 fffff880`05280fd4 : ndis!NdisFreeNetBufferList+0x112
fffff880`0bd590f0 fffff780`00000014 : fffffa80`045e1100 fffffa80`0311efe0 fffff880`05280fd4 00000000`00000000 : netw5v64+0x1b8283
fffff880`0bd590f8 fffffa80`045e1100 : fffffa80`0311efe0 fffff880`05280fd4 00000000`00000000 fffff880`0527efc9 : 0xfffff780`00000014
fffff880`0bd59100 fffffa80`0311efe0 : fffff880`05280fd4 00000000`00000000 fffff880`0527efc9 fffff880`0553e650 : 0xfffffa80`045e1100
fffff880`0bd59108 fffff880`05280fd4 : 00000000`00000000 fffff880`0527efc9 fffff880`0553e650 fffffa80`045e1100 : 0xfffffa80`0311efe0
fffff880`0bd59110 00000000`00000000 : fffff880`0527efc9 fffff880`0553e650 fffffa80`045e1100 fffffa80`045ac760 : netw5v64+0xffd4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
netw5v64+1b8283
fffff880`05429283 ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  netw5v64+1b8283

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: netw5v64

IMAGE_NAME:  netw5v64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a688998

FAILURE_BUCKET_ID:  X64_0xc2_7_W3Rx_netw5v64+1b8283

BUCKET_ID:  X64_0xc2_7_W3Rx_netw5v64+1b8283

Followup: MachineOwner
---------

EDIT: I missed in the dump, that IDMAN.exe is also flagged, this can sometimes be a virus so please disable sleep-mode and do a full virus check. Honestly I don't think yours is the virus (just being safe). This process is the windows download manager and it's appearance also supports a problem with the wireless network adapter drivers.

 

[TimStitt]

Other thoughts, the same issue can occur if the RAM, paging file, or windows OS is corrupted.

Running checkdisk
1. Press the windows Key+E to open windows explorer
2. Right click on your windows drive and select properties
3. On the tools menu, click check now.
4. Check your drive and repeat for other drives on your system

Checking windows system files
Open an elevated command prompt.
1. Start globe
2. Type in CMD
3. Right click and open as administrator
4. type SFC /SCANNOW and press enter

Purging your pagefile
1. Start globe
2. search for secpol.msc
3. Open it
4. Under local policies / security options
5. Look for Shutdown: clear virtual memory pagefile
6. Enable this
7. Reboot your PC
8. Remember to disable when you are done (unless you always want to clear it

- Tim

 

[bilbi]

Wow thanks for the quick response!

Yes it's a laptop - the crash happened on both battery/power adapter. But wait! it seems that the crash happened only when I had heavy wireless activity with IDM. so it might be some sort of a problem with IDM compatability under heavy load.

Anyways, before I had IDM - the BSOD have never appeared.

Thanks!

 

[TimStitt]

Wow thanks for the quick response!

Yes it's a laptop - the crash happened on both battery/power adapter. But wait! it seems that the crash happened only when I had heavy wireless activity with IDM. so it might be some sort of a problem with IDM compatability under heavy load.

Anyways, before I had IDM - the BSOD have never appeared.

Thanks!

Yep, I also saw that in the bug report and edited my post above (seconds after posting it ). Please check it again and let me know how you go after the drivers are updated.

 

[Capt.Jack Sparrow]

Just an FYI
IDMan.exe is Internet Download Manager

 

[bilbi]

Updated wireless drivers to the latest - hope it will solve the problem (I have a good feeling about it). The crash happens randomly, so if you won't hear from me in the next couple of days - problem solved

Thanks!

 

[TimStitt]

No problem, we can pick this up at any time.
*Fingers crossed*

 

[jeffro0625]

Im having the same problem with idman.exe, I also ran the windbg program and came up with this:

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\030810-39702-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x83415000 PsLoadedModuleList = 0x8355d810
Debug session time: Mon Mar  8 20:48:07.306 2010 (UTC - 6:00)
System Uptime: 0 days 8:16:19.038
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols
Loading unloaded module list
.........................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 1, 88e84a0a}

Probably caused by : ntkrpamp.exe ( nt!KiTrap0E+2cf )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 88e84a0a, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from 8357d718
Unable to read MiSystemVaType memory at 8355d160
 00000000 

CURRENT_IRQL:  2

FAULTING_IP: 
+63552faf0517de10
88e84a0a f3a5            rep movs dword ptr es:[edi],dword ptr [esi]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  IDMan.exe

TRAP_FRAME:  b6488dd0 -- (.trap 0xffffffffb6488dd0)
ErrCode = 00000002
eax=dd2e9b4c ebx=00000000 ecx=000006d2 edx=00000000 esi=dd2e8004 edi=00000000
eip=88e84a0a esp=b6488e44 ebp=b6488e4c iopl=0         nv up ei pl nz ac pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010216
88e84a0a f3a5            rep movs dword ptr es:[edi],dword ptr [esi]
Resetting default scope

LAST_CONTROL_TRANSFER:  from 88e84a0a to 8345b7eb

STACK_TEXT:  
b6488dd0 88e84a0a badb0d00 00000000 83484439 nt!KiTrap0E+0x2cf
WARNING: Frame IP not in any known module. Following frames may be wrong.
b6488e4c 88e5fc43 00000000 dd2e8004 00001b48 0x88e84a0a
b6488e50 00000000 dd2e8004 00001b48 00000246 0x88e5fc43


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiTrap0E+2cf
8345b7eb 833dc48a578300  cmp     dword ptr [nt!KiFreezeFlag (83578ac4)],0

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KiTrap0E+2cf

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc007

FAILURE_BUCKET_ID:  0xD1_nt!KiTrap0E+2cf

BUCKET_ID:  0xD1_nt!KiTrap0E+2cf

Followup: MachineOwner
---------