BSoD, fresh install, win7 enterprise

[dusko88]

Hello

Please help me with my blue screen of death issues.

All info is included in the attached files.

Thank you

 

[richc46]

Welcome
Code D1 cause by device driver

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
Loading Dump File [C:\Users\richc46\AppData\Local\Temp\Temp2_bsod report 10.07.10.zip\Windows_NT6_BSOD_jcgriff2\070911-23946-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16481.x86fre.win7_gdr.091207-1941
Machine Name:
Kernel base = 0x8280c000 PsLoadedModuleList = 0x82954810
Debug session time: Fri Jul  8 18:00:41.464 2011 (GMT-4)
System Uptime: 0 days 1:15:45.680
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {3, 2, 1, 88a27888}
Unable to load image \SystemRoot\system32\DRIVERS\Epfwndis.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Epfwndis.sys
*** ERROR: Module load completed but symbols could not be loaded for Epfwndis.sys
Unable to load image \SystemRoot\system32\DRIVERS\nvm62x32.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvm62x32.sys
*** ERROR: Module load completed but symbols could not be loaded for nvm62x32.sys
Probably caused by : Epfwndis.sys ( Epfwndis+305d )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000003, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 88a27888, address which referenced memory
Debugging Details:
------------------
 
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82974718
Unable to read MiSystemVaType memory at 82954160
 00000003 
CURRENT_IRQL:  2
FAULTING_IP: 
ndis!NdisFreePacket+144
88a27888 897104          mov     dword ptr [ecx+4],esi
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0xD1
PROCESS_NAME:  System
TRAP_FRAME:  923177b0 -- (.trap 0xffffffff923177b0)
ErrCode = 00000002
eax=8541d000 ebx=861ae13c ecx=ffffffff edx=00000f06 esi=861ae150 edi=861ae120
eip=88a27888 esp=92317824 ebp=92317838 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
ndis!NdisFreePacket+0x144:
88a27888 897104          mov     dword ptr [ecx+4],esi ds:0023:00000003=????????
Resetting default scope
LAST_CONTROL_TRANSFER:  from 88a27888 to 8285285b
STACK_TEXT:  
923177b0 88a27888 badb0d00 00000f06 88a2af1c nt!KiTrap0E+0x2cf
92317838 9214905d 02450064 86292008 85450064 ndis!NdisFreePacket+0x144
WARNING: Stack unwind information not available. Following frames may be wrong.
9231785c 921483fb 85450064 86292008 82c1f700 Epfwndis+0x305d
92317878 921486d1 8629212c 85c3a9d8 00000000 Epfwndis+0x23fb
923178ac 88a96ee6 85450064 856dd31c 8617a640 Epfwndis+0x26d1
9231791c 88a73bb4 00ee07f0 9231793c 00000001 ndis!ethFilterDprIndicateReceivePacket+0x2e5
923179e8 88a625af 02317a00 85ee06e8 85af30e0 ndis!ndisIndicateXlatedPacketsToNdis5Protocols+0xba
92317b64 88a0dca5 85af30e0 86292408 00000000 ndis!ndisMDispatchReceiveNetBufferLists+0xf1
92317b80 88a62a2e 85af30e0 85ee06e8 00000000 ndis!ndisMTopReceiveNetBufferLists+0x2d
92317ba8 88a0dc1e 85af30e0 85ee06e8 00000000 ndis!ndisMIndicateReceiveNetBufferListsInternal+0x62
92317bd0 91100616 85af30e0 85ee06e8 00000000 ndis!NdisMIndicateReceiveNetBufferLists+0x52
92317bf4 9111d33c 85f1d000 91134d30 00000004 nvm62x32+0x4616
92317c28 9111d619 00008000 00000001 85f1d000 nvm62x32+0x2133c
92317c4c 911115a2 00000000 92317c74 91101af1 nvm62x32+0x21619
92317c58 91101af1 911364c4 91134d30 00000000 nvm62x32+0x155a2
92317c74 88a62309 85f1d000 00000000 92317ca0 nvm62x32+0x5af1
92317cb0 88a436b2 8624fee4 0024fed0 00000000 ndis!ndisMiniportDpc+0xe2
92317d10 88a2a976 8624ffd0 00000000 84c10848 ndis!ndisQueuedMiniportDpcWorkItem+0xd0
92317d50 82a1a66d 00000001 b625dc0a 00000000 ndis!ndisReceiveWorkerThread+0xeb
92317d90 828cc1d9 88a2a88b 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
 
STACK_COMMAND:  kb
FOLLOWUP_IP: 
Epfwndis+305d
9214905d ??              ???
SYMBOL_STACK_INDEX:  2
SYMBOL_NAME:  Epfwndis+305d
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: Epfwndis
IMAGE_NAME:  Epfwndis.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  4d006836
FAILURE_BUCKET_ID:  0xD1_Epfwndis+305d
BUCKET_ID:  0xD1_Epfwndis+305d
Followup: MachineOwner
---------

You have given us two BSOD reports. One is rarely enough to solve the problem and two if theyare not in agreement are not much better.
In your situation one report gave the anti virus as the cause. I think this is verylikely since Anti Virus have been the cause of many BSODs.
Uninstall your anti virus, use the uninstalll tool from the website.
Then replace with Microsoft Security Essentials. I would also scan once a week with Malwarbytes for extra protection.
When done go to search type the word
cmd
in cmd typ driverquery. Make sure that this driver is gone
Epfwndis.sys
If it is have fun with the computer. If you experience more BSODs post and you will be given further help.

 

[dusko88]

Thanks a lot for your input richc46 it's very valuable, can you point me to the uninstall tool from the website that you mention?

 

[dusko88]

Thanks a lot for your input richc46 it's very valuable, can you point me to the uninstall tool from the website that you mention?

Alright, i found the tool, and uninstalled the AV. The mentioned driver is gone. After that i installed Microsoft Security Essentials, and ran a MalwareBytes scan (came out clean).

If any more BSODs occur, I ll report here.

Thanks sevenforums

 

[theog]

To be sure Run this tool:
http://www.sevenforums.com/tutorials/166445-microsoft-standalone-system-sweeper.html?ltr=M

 

[dusko88]

To be sure Run this tool:
http://www.sevenforums.com/tutorials/166445-microsoft-standalone-system-sweeper.html?ltr=M

Honestly, that seems like way too much hustle. I'll just wait and see what happens

 

[richc46]

I wish you luck
If you get any more BSODs, just post. As I said sometimes it takes several attempts to find the true culprit.

 

[dusko88]

Alright guys, i have had a few more blue screens. The report is attached with this post. Any and all help is greatly appreciated and will get rep =)

 

[dusko88]

4 new BSoDs this morning, i'm getting desperate.

Here is the new report. Please help guys

 

[richc46]

Sorry for the delay, but have a lot going on here.
May be memory, take this memory test and report back
http://www.geekstogo.com/forum/topic/246994-guide-to-using-memtest86/
Run test for 8 passes and then take a good stick and test each slot for 8 passes.

If you fail, fix memory problems.
If you pass take driver test
Driver Verifier Inst
Since the driver that crashed you has not been listed you should run driver verifier
Please run Verifier with these settings:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.
So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Windows 7 Startup Repair feature).
Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
NOTE: You can use Low Resource Simulation if you'd like. From my limited experimentation it makes the BSOD's come faster.
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.
Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).
Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.
If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

Enable the driver verifier
www.sevenforums.com/crash-lockup-debug-how/65331-using-driver-verifier-identify-issues-drivers.html

For a few weeks, I will no longer be able to read the reports. I will be around to answer questions, etc.