BSOD - Having Trouble

[ymichael12]

This is a Dell Latitude E6400 purchased about one year ago. Never had any problems until approximately 3 weeks ago. I am continuing to recieve BSOD but I can not pinpoint the issue.

Here are a few minidump files so hopefully one of you can point me in the right direction.

There have been no new hardware changes on this computer and I have already ran a full memcheck without any issues.




*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 807cd750
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_8

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME: System

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from 82e0fe87 to 82e0fe32

STACK_TEXT:
807e4010 82e0fe87 00000000 807e4078 000000e1 hal!HalpRequestIpiSpecifyVector+0x52
807e4024 82ea3cc5 00000000 807e4078 807e4084 hal!HalRequestIpi+0x17
807e4038 82ea3a99 859cea20 859fb4c0 00000001 nt!KiIpiSend+0x31
807e40b4 82ea45c9 859fb4c0 00000000 859fb4c0 nt!KiDeferredReadyThread+0x7e2
807e40d0 82ea4587 00000000 807ca120 82f6ee0c nt!KiReadyThread+0x30
807e40e8 82e9e7b1 00000000 00000001 859fb580 nt!KiProcessThreadWaitList+0x3f
807e4124 82e73848 807ca120 00000000 00000001 nt!KiExitDispatcher+0x2a
807e415c 82e9e693 859fb0e0 00000000 00000000 nt!KiInsertQueue+0xf6
807e4178 82ef3ba3 82f6ee0c 00000001 a8407d20 nt!ExQueueWorkItem+0x44
807e419c 82ef7b58 017e41d7 859c9728 807e44e0 nt!SepQueueWorkItem+0x125
807e41dc 82ed7acf 807e4208 00000009 807e48cc nt!SepAdtLogAuditRecord+0xe0
807e44a0 864a7d79 00000000 807e4768 00000000 nt!SeReportSecurityEventWithSubCategory+0x1c9
807e477c 864a80e0 807e47c4 807e4948 864a5896 tcpip!WfpAuditEventGeneral+0x288
807e4788 864a5896 807e47c4 9929e3e8 807e4d9c tcpip!KfdAuditEvent+0x38
807e4948 864a6f82 0000002c 807e4cdc 807e4d9c tcpip!IndicateDropAudit+0x35f
807e4b08 8649787a 0000002c 0000002d 807e4cdc tcpip!ShimIndicateDiscard+0x90
807e4b4c 8649a6f1 0000002c 807e4cdc 807e4d9c tcpip!WfpShimIndicateDiscardGeneral+0x54
807e4b7c 864964b2 807e4cdc 807e4d9c 9929e3e8 tcpip!WfpAleClassify+0xb3
807e4f08 864974da 980a0268 0000002c 864fc450 tcpip!WfpAlepAuthorizeReceive+0xa63
807e4f08 00000000 980a0268 0000002c 864fc450 tcpip!WfpAleAuthorizeReceive+0x32b


STACK_COMMAND: kb

FOLLOWUP_IP:
tcpip!WfpAuditEventGeneral+288
864a7d79 395dfc cmp dword ptr [ebp-4],ebx

SYMBOL_STACK_INDEX: c

SYMBOL_NAME: tcpip!WfpAuditEventGeneral+288

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: tcpip

IMAGE_NAME: tcpip.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bbf8e

FAILURE_BUCKET_ID: 0x7f_8_VRF_tcpip!WfpAuditEventGeneral+288

BUCKET_ID: 0x7f_8_VRF_tcpip!WfpAuditEventGeneral+288

Followup: MachineOwner

 

[usasma]

Please tell us what settings that you used when running Driver Verifier.
Also, let us know what memory dumps you were getting that prompted you to use Driver Verifier.
With this info we can figure out if the Driver Verifier Minidumps present any information that we can use.

If you don't have this info, please stop using Driver Verfier and post the next memory dump that you get.

 

[ymichael12]

Here are the memory dumps that I got prior to having verifier running.

They all seem to be the same (to me at least).

And I used verifier /all.

I probably don't really know what I am doing, but more testing theories. Then decided just to post about the issue.

 

[usasma]

This isn't a problem - but we need to know what type of error to look for (so we can set the proper settings on Driver Verifier). The Verifier Enabled Minidump is remarkably similar to the dumps when Verifier wasn't enabled (which means that verifier didn't cause any faults to occur - so the selected drivers weren't to blame).

Remarkably, these all seem to point at networking issues - so I'd have to suspect either compatibility of your networking devices/drivers - or a malfunction of the device itself. Another possibility is an issue with an Internet Security application.

To rule out the Internet Security stuff, please do the following:

Anti-Virus Removal:
Please do the following:
- download a free antivirus for testing purposes: Free AntiVirus
- uninstall the Norton from your system (you can reinstall it, if so desired, when we're done troubleshooting)
- remove any remnants of Norton using this free tool: KB Article Not Found
- IMMEDIATELY install and update the free antivirus
- check to see if this fixes the BSOD's

All the dump files are STOP 0x7F's (more info here: BSOD Index )
Looking at the Usual Causes in the above link reveals a number of different causes - mostly hardware, but some are driver related.

So, I'd start with these free, bootable hardware diagnostics:

H/W Diagnostics:
Please start by running these bootable hardware diagnostics:
Memory Diagnostics (read the details at the link)
HD Diagnostic (read the details at the link)

Also, please run one of these free, independent online malware scans to ensure that your current protection hasn't been compromised: Malware (read the details at the link)

Your copy of Belarc Advisor has a 1998 driver (BANText.sys) installed on your system - please uninstall the program IMMEDIATELY and verify that BANText.sys is removed from C:\Windows\System32\drivers.

Beyond that, please run Verifier with these settings:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
NOTE: You can use Low Resource Simulation if you'd like. From my limited experimentation it makes the BSOD's come faster.
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

If that doesn't work, post back and we'll have to see about fixing the registry entry off-line:

Delete these registry keys (works in XP, Vista, Win7):
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDrivers
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDriverLevel

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users

BSOD BUGCHECK SUMMARY

[font=lucida console]
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Debug session time: Wed Jul 14 13:50:32.037 2010 (UTC - 4:00)
System Uptime: 0 days 3:04:37.555
BugCheck 1000007F, {8, 807cd750, 0, 0}
Probably caused by : tcpip.sys ( tcpip!WfpAuditEventGeneral+288 )
BUGCHECK_STR:  0x7f_8
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Debug session time: Wed Jul 14 15:55:13.510 2010 (UTC - 4:00)
System Uptime: 0 days 2:04:15.936
BugCheck 1000007F, {8, 807cd750, 0, 0}
Probably caused by : tcpip.sys ( tcpip!WfpAuditEventGeneral+288 )
BUGCHECK_STR:  0x7f_8
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Debug session time: Thu Jul 15 15:30:00.264 2010 (UTC - 4:00)
System Uptime: 0 days 0:18:09.973
BugCheck 1000007F, {8, 807cd750, 0, 0}
Probably caused by : tcpip.sys ( tcpip!WfpAuditEventGeneral+288 )
BUGCHECK_STR:  0x7f_8
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Debug session time: Thu Jul 15 13:14:34.203 2010 (UTC - 4:00)
System Uptime: 0 days 2:36:56.826
BugCheck 1000007F, {8, 807cd750, 0, 0}
Probably caused by : tcpip.sys ( tcpip!WfpAuditEventGeneral+288 )
BUGCHECK_STR:  0x7f_8
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Debug session time: Thu Jul 15 14:01:21.230 2010 (UTC - 4:00)
System Uptime: 0 days 0:45:57.242
BugCheck 1000007F, {8, 807cd750, 0, 0}
Probably caused by : tcpip.sys ( tcpip!WfpAuditEventGeneral+288 )
BUGCHECK_STR:  0x7f_8
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Debug session time: Fri Jul 16 15:01:21.954 2010 (UTC - 4:00)
System Uptime: 0 days 2:24:45.660
BugCheck 1000007F, {8, 807cd750, 0, 0}
Probably caused by : tcpip.sys ( tcpip!WfpAuditEventGeneral+288 )
BUGCHECK_STR:  0x7f_8
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Debug session time: Fri Jul 16 12:36:01.690 2010 (UTC - 4:00)
System Uptime: 0 days 1:50:01.696
BugCheck 1000007F, {8, 807cd750, 0, 0}
Probably caused by : tcpip.sys ( tcpip!WfpAuditEventGeneral+288 )
BUGCHECK_STR:  0x7f_8
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Debug session time: Fri Jul 16 15:33:02.799 2010 (UTC - 4:00)
System Uptime: 0 days 0:31:17.414
BugCheck 1000007F, {8, 807cd750, 0, 0}
Probably caused by : tcpip.sys ( tcpip!WfpAuditEventGeneral+288 )
BUGCHECK_STR:  0x7f_8
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Debug session time: Tue Jul 20 13:40:45.285 2010 (UTC - 4:00)
System Uptime: 0 days 2:50:09.483
BugCheck 1000007F, {8, 807cd750, 0, 0}
Probably caused by : tcpip.sys ( tcpip!WfpAuditEventGeneral+288 )
BUGCHECK_STR:  0x7f_8
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Debug session time: Wed Jul 21 11:46:36.486 2010 (UTC - 4:00)
System Uptime: 0 days 1:20:52.452
BugCheck 1000007F, {8, 807cd750, 0, 0}
Probably caused by : tcpip.sys ( tcpip!WfpAuditEventGeneral+288 )
BUGCHECK_STR:  0x7f_8
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Debug session time: Wed Jul 21 12:15:45.008 2010 (UTC - 4:00)
System Uptime: 0 days 0:28:17.583
BugCheck 1000007F, {8, 807cd750, 0, 0}
Probably caused by : tcpip.sys ( tcpip!WfpAuditEventGeneral+288 )
BUGCHECK_STR:  0x7f_8
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
  
  
 
[/font]

 

[ymichael12]

Thanks usasma.

I have completed the following:

1. Uninstalled Norton
2. Installed AVG
3. Uninstalled Belarc
4. Scanned the whole computer for virus and malware.

I no longer seem to be receiving the blue screen while the computer is running and I am operating it normally. Thanks for that!

However, I have started receiving a blue screen with an error of 'Cvusbdv.sys'. The interesting part is that I only receive this error have I shutdown the computer. The computer starts the shutdown process and then goes to a blue screen. Also, I do not see any new Minidump files after I made the changes above.

I am trying to figure out what I might be doing while using the computer to recreate this problem. If I just turn on the computer and then shutdown, I do not receive the above BSOD error.

Any ideas?

 

[usasma]

Do you have a Broadcom Credential system (USB) on your computer? That's what the Cvusbdv.sys driver is for.

 

[ymichael12]

After some searching, I think that has to do with the finger print reader installed on the machine.

I'll try installing an updated driver from dell and see if that fixes things.

 

[Jonathan_King]

Keep us posted!

 

[ymichael12]

After updating the dell control point firmware and my intel drivers everything seems to be stable. I hate BSOD!!