BSOD, help please

[kuleee]

hi all

i have bsod problems since i've put new processor 3 weeks ago (i had intel e8200 now i have e8400...), windows just crash and restart at least 2 times per day. . anyway i would appreciate if someone take a look at my minidump files and help me with this annoying issue

i hope i put all information needed, including all of my computer specifications! thanks in advance guys!

 

[zigzag3143]

hi all

i have bsod problems since i've put new processor 3 weeks ago (i had intel e8200 now i have e8400...), windows just crash and restart at least 2 times per day. . anyway i would appreciate if someone take a look at my minidump files and help me with this annoying issue

i hope i put all information needed, including all of my computer specifications! thanks in advance guys!

Hi Kuleee and welcome


You have several causes of these crashes. the analysis points towards NETIO.sys but usually when that happens it is caused by either a firewall, or anti virus app like Zone Alarm.

If you are running ZA remove it. what ever AV you are running pull it and replace with Microsoft Security Essentials.

You have some ancient drivers from as far back as 2002. By themselves they can and do cause these. They need to be updated.

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Windows7_BSOD_jcgriff2\073110-19796-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82c37000 PsLoadedModuleList = 0x82d76570
Debug session time: Sat Jul 31 05:39:57.069 2010 (GMT-4)
System Uptime: 0 days 8:27:58.069
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {1e, 2, 0, 8d08c950}

Probably caused by : NETIO.SYS ( NETIO!NsiEnumerateObjectsAllParametersEx+187 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000001e, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8d08c950, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82d96700
Unable to read MiSystemVaType memory at 82d760c0
 0000001e 

CURRENT_IRQL:  2

FAULTING_IP: 
tcpip!IppFillPathBandwidthInformation+26
8d08c950 38591d          cmp     byte ptr [ecx+1Dh],bl

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  8eba08fc -- (.trap 0xffffffff8eba08fc)
ErrCode = 00000000
eax=8eba09d4 ebx=00000000 ecx=00000001 edx=05f5e100 esi=8eba09bc edi=00000000
eip=8d08c950 esp=8eba0970 ebp=8eba0978 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
tcpip!IppFillPathBandwidthInformation+0x26:
8d08c950 38591d          cmp     byte ptr [ecx+1Dh],bl      ds:0023:0000001e=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from 8d08c950 to 82c6fb7b

STACK_TEXT:  
8eba08fc 8d08c950 badb0d00 05f5e100 856741f8 nt!KiTrap0E+0x2cf
8eba0978 8d08c893 00000001 05f5e100 00000000 tcpip!IppFillPathBandwidthInformation+0x26
8eba099c 8d08cce3 00000014 00000000 8eba09bc tcpip!IppFillPathInformation+0x153
8eba0a2c 8d08cbcd 00000004 85f71dc8 8781f084 tcpip!IppFillPathRodUnderLock+0x26
8eba0a94 8cf9d10b 8eba0aac 0000022a 87819000 tcpip!Ipv4EnumerateAllPaths+0x132
8eba0b4c 8f8b7ba1 87819000 0131ba39 0000003c NETIO!NsiEnumerateObjectsAllParametersEx+0x187
8eba0bc0 8f8b8efc 8781903c 00000000 87819054 nsiproxy!NsippEnumerateObjectsAllParameters+0xeb
8eba0be4 8f8b8fe5 86223801 00000000 8724e0b8 nsiproxy!NsippDispatchDeviceControl+0x78
8eba0bfc 82c65f44 867f0f08 86223818 86223818 nsiproxy!NsippDispatch+0x33
8eba0c14 82e3b2e7 8724e0b8 86223818 86223888 nt!IofCallDriver+0x63
8eba0c34 82e3d6da 867f0f08 8724e0b8 00000000 nt!IopSynchronousServiceTail+0x1f8
8eba0cd0 82e44727 867f0f08 86223818 00000000 nt!IopXxxControlFile+0x6aa
8eba0d04 82c6c79a 0000011c 000006ec 00000000 nt!NtDeviceIoControlFile+0x2a
8eba0d04 772664f4 0000011c 000006ec 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
013af4e0 00000000 00000000 00000000 00000000 0x772664f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!NsiEnumerateObjectsAllParametersEx+187
8cf9d10b 8945fc          mov     dword ptr [ebp-4],eax

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  NETIO!NsiEnumerateObjectsAllParametersEx+187

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bbf63

FAILURE_BUCKET_ID:  0xD1_NETIO!NsiEnumerateObjectsAllParametersEx+187

BUCKET_ID:  0xD1_NETIO!NsiEnumerateObjectsAllParametersEx+187

Followup: MachineOwner
---------

ov519cmd.sys        0x8ec3e000    0x8ec43b40    0x00005b40    0x3d6eb7c3    8/29/2002 20:09:39                        
ov519vid.sys        0x8ec07000    0x8ec2f2e0    0x000282e0    0x3e5bf6d0    2/25/2003 19:05:52                        
secdrv.SYS        0x8efe6000    0x8eff0000    0x0000a000    0x45080528    9/13/2006 09:18:32                        
dadder.sys        0x8ec63000    0x8ec68900    0x00005900    0x46b1a4a8    8/2/2007 05:32:24                        
Rt86win7.sys        0x94f37000    0x94f5c000    0x00025000    0x49a65b16    2/26/2009 05:04:22                        
lirsgt.sys        0x8ef4a000    0x8ef4e880    0x00004880    0x49b29007    3/7/2009 11:17:27                        
atksgt.sys        0x8eeed000    0x8ef30000    0x00043000    0x4a06e9d2    5/10/2009 10:50:58                        
spldr.sys        0x8d1cd000    0x8d1d5000    0x00008000    0x4a084ebb    5/11/2009 12:13:47                        
amdxata.sys        0x8ccd1000    0x8ccda000    0x00009000    0x4a12f30f    5/19/2009 13:57:35

 

[kuleee]

thank you for your quick response!

i am using eset antivirus, worked just fine for me previous years.. but i would prefer to update my drivers first, and if that wont help me then i will uninstall nod and install microsoft essentials. tell me please, which drivers do i need to upadte? for which device?
ov519cmd.sys 0x8ec3e000 0x8ec43b40 0x00005b40 0x3d6eb7c3 8/29/2002 20:09:39
ov519vid.sys 0x8ec07000 0x8ec2f2e0 0x000282e0 0x3e5bf6d0 2/25/2003 19:05:52 i see these are old ones, but which devices are these? can i find them my self by some way

 

[kuleee]

i found out which are these problematic devices

 

[CarlTR6]

Here is how to update drivers:

- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.
- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

 

[kuleee]

i didn't find any newer drivers for that device so i decided to plug it out and give it a try. of course, computer froze after some time. but not with BSOD, just froze, cannot move mouse or anything and need to restart machine manualy. i also followed that advice with removing AV and installing microsoft security essentials. should i upload files again?

 

[zigzag3143]

i didn't find any newer drivers for that device so i decided to plug it out and give it a try. of course, computer froze after some time. but not with BSOD, just froze, cannot move mouse or anything and need to restart machine manualy. i also followed that advice with removing AV and installing microsoft security essentials. should i upload files again?

Of course. the more info we have the better.


Ken

 

[kuleee]

ok now i get another bsod, 5min ago. here are the files! help please

 

[CarlTR6]

STOP 0x0000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

Usual causes: Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control,

STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL



Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

This means the BSOD's are hard ware or hardware related problem. Note that Code A mentions virus scanner as a possible cause. The code A dump points to rdbss.sys as the cause. However, this is unlikely as this is a Microsoft driver.

I find you still have some obsolete drivers; the ones in red font are very out of date. Update these drivers as ZigZag recommended. Simply unplugging a device will not remove the drivers.

atksgt.sys Sun May 10 10:50:58 2009
dadder.sys Thu Aug 02 05:32:24 2007
lirsgt.sys Sat Mar 07 10:17:27 2009
ov519cmd.sys Thu Aug 29 20:09:39 2002
ov519vid.sys Tue Feb 25 18:05:52 2003
Rt86win7.sys Thu Feb 26 04:04:22 2009

I would also suggest that your follow his advice to uninstall Eset antivirus. Troubleshooting is process of elimination. You want to eliminate all possible causes. Once you get your system running smoothly, you can try Eset again and see what happens. It has caused BSOD's on some Win 7 systems. Use this tool to uninstall it > Info > Tool[FONT=&quot]

[/FONT]

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\Downloads\A-Rar\Windows7_BSOD_jcgriff2\080110-29906-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*[URL="http://msdl.microsoft.com/download/symbols"]Symbol information[/URL]
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82c05000 PsLoadedModuleList = 0x82d44570
Debug session time: Sun Aug  1 11:28:29.817 2010 (GMT-4)
System Uptime: 0 days 7:12:21.833
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 1, 82c73486}

Probably caused by : rdbss.sys ( rdbss!RxConstructLogicalView+71 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82c73486, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82d64700
Unable to read MiSystemVaType memory at 82d440c0
 00000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeReleaseSemaphore+44
82c73486 f00fba2807      lock bts dword ptr [eax],7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  9f6e45a4 -- (.trap 0xffffffff9f6e45a4)
ErrCode = 00000002
eax=00000000 ebx=82d26d20 ecx=866f0302 edx=00000000 esi=00000000 edi=00000000
eip=82c73486 esp=9f6e4618 ebp=9f6e4628 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
nt!KeReleaseSemaphore+0x44:
82c73486 f00fba2807      lock bts dword ptr [eax],7   ds:0023:00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82c73486 to 82c3db7b

STACK_TEXT:  
9f6e45a4 82c73486 badb0d00 00000000 82c59d83 nt!KiTrap0E+0x2cf
9f6e4628 82c5d175 00000000 00000000 00000001 nt!KeReleaseSemaphore+0x44
9f6e4670 82c5cffe 85e32d48 930635d3 930557b8 nt!ExpReleaseResourceForThreadLite+0x171
9f6e4678 930635d3 930557b8 93052000 00000000 nt!ExReleaseResourceLite+0xf
9f6e4694 93065427 866f0020 872428a8 877a67c0 rdbss!RxConstructLogicalView+0x71
9f6e4728 93058725 866f0020 872428a8 9f6e47a8 rdbss!RxFindOrConstructLogicalView+0xbea
9f6e4800 93056e23 872428a8 8580b6c0 9f6e482c rdbss!RxFindOrConstructVirtualNetRoot+0x8f8
9f6e4844 9305a8cd 872428a8 8580b6c0 86b1ffb0 rdbss!RxCanonicalizeNameAndObtainNetRoot+0x2cb
9f6e487c 93041fb1 872428a8 8580b6c0 0c6b6e6a rdbss!RxCommonCreate+0x25b
9f6e4904 9305ce2b 93052240 8580b6c0 86b1ff80 rdbss!RxFsdCommonDispatch+0x646
9f6e4934 9156b298 86b68860 0080b6c0 8580b778 rdbss!RxFsdDispatch+0x1ab
9f6e4950 82c33f44 86b68860 0180b6c0 8580b79c mrxsmb!MRxSmbFsdDispatch+0x9a
9f6e4968 8d221bb0 00000103 856bebe8 86b1ff80 nt!IofCallDriver+0x63
9f6e4984 8d220b52 856bebe8 c0000016 8580b778 mup!MupiCallUncProvider+0x10f
9f6e499c 8d220f5b 856bebe8 124fb97b 00000000 mup!MupStateMachine+0x9b
9f6e49e8 82c33f44 86416a70 8580b6c0 8580b6c0 mup!MupCreate+0x109
9f6e4a00 8ccd920c 8580b6c0 00000000 8580b79c nt!IofCallDriver+0x63
9f6e4a24 8ccec8c9 9f6e4a44 864165e0 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
9f6e4a70 82c33f44 864165e0 86417008 86b1ffdc fltmgr!FltpCreate+0x2db
9f6e4a88 82e0778d af6a3ea9 9f6e4c30 00000000 nt!IofCallDriver+0x63
9f6e4b60 82e0a968 86416a70 855ea838 8742b678 nt!IopParseDevice+0xed7
9f6e4bdc 82e49332 00000000 9f6e4c30 00000040 nt!ObpLookupObjectName+0x4fa
9f6e4c38 82e04d2e 017aed9c 855ea838 84d0ed01 nt!ObOpenObjectByName+0x159
9f6e4cb4 82e4fcb3 017aee58 00100080 017aed9c nt!IopCreateFile+0x673
9f6e4d00 82c3a79a 017aee58 00100080 017aed9c nt!NtCreateFile+0x34
9f6e4d00 77cf64f4 017aee58 00100080 017aed9c nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
017aee00 00000000 00000000 00000000 00000000 0x77cf64f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
rdbss!RxConstructLogicalView+71
930635d3 a100200593      mov     eax,dword ptr [rdbss!WPP_GLOBAL_Control (93052000)]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  rdbss!RxConstructLogicalView+71

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: rdbss

IMAGE_NAME:  rdbss.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bbfd2

FAILURE_BUCKET_ID:  0xA_rdbss!RxConstructLogicalView+71

BUCKET_ID:  0xA_rdbss!RxConstructLogicalView+71

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\Downloads\A-Rar\Windows7_BSOD_jcgriff2\080210-17968-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*[URL="http://msdl.microsoft.com/download/symbols"]Symbol information[/URL]
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82c3a000 PsLoadedModuleList = 0x82d79570
Debug session time: Sun Aug  1 18:39:58.704 2010 (GMT-4)
System Uptime: 0 days 5:52:35.705
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 82e80e1a, 80e6bb48, 80e6b720}

Probably caused by : ntkrnlmp.exe ( nt!IopDeleteFileObjectExtension+98 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 82e80e1a, The address that the exception occurred at
Arg3: 80e6bb48, Exception Record Address
Arg4: 80e6b720, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!IopDeleteFileObjectExtension+98
82e80e1a 8b4014          mov     eax,dword ptr [eax+14h]

EXCEPTION_RECORD:  80e6bb48 -- (.exr 0xffffffff80e6bb48)
ExceptionAddress: 82e80e1a (nt!IopDeleteFileObjectExtension+0x00000098)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000015
Attempt to read from address 00000015

CONTEXT:  80e6b720 -- (.cxr 0xffffffff80e6b720)
eax=00000001 ebx=85895f80 ecx=82d9a300 edx=00000000 esi=866a5f78 edi=80e6bc44
eip=82e80e1a esp=80e6bc10 ebp=80e6bc24 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
nt!IopDeleteFileObjectExtension+0x98:
82e80e1a 8b4014          mov     eax,dword ptr [eax+14h] ds:0023:00000015=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  00000015

READ_ADDRESS: GetPointerFromAddress: unable to read from 82d99700
Unable to read MiSystemVaType memory at 82d790c0
 00000015 

FOLLOWUP_IP: 
nt!IopDeleteFileObjectExtension+98
82e80e1a 8b4014          mov     eax,dword ptr [eax+14h]

BUGCHECK_STR:  0x7E

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from 82e52932 to 82e80e1a

STACK_TEXT:  
80e6bc24 82e52932 85895f80 855ea838 85895f68 nt!IopDeleteFileObjectExtension+0x98
80e6bc6c 82e8227f 85895f80 85895f80 85895f68 nt!IopDeleteFile+0x1df
80e6bc84 82c903aa 00000000 8786a690 00000000 nt!ObpRemoveObjectRoutine+0x59
80e6bc98 82c9031a 85895f80 82e5cdc7 858a6008 nt!ObfDereferenceObjectWithTag+0x88
80e6bca0 82e5cdc7 858a6008 858a6030 82d9b680 nt!ObfDereferenceObject+0xd
80e6bccc 82cf54b0 858a6008 00000000 00000000 nt!MiSegmentDelete+0x191
80e6bd28 82c5802a 85611020 00000000 fba0fbe0 nt!MiProcessDereferenceList+0xdb
80e6bd50 82e21d6e 00000000 b0eb91e0 00000000 nt!MiDereferenceSegmentThread+0xc5
80e6bd90 82cc3159 82c57f63 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!IopDeleteFileObjectExtension+98

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cac3

STACK_COMMAND:  .cxr 0xffffffff80e6b720 ; kb

FAILURE_BUCKET_ID:  0x7E_nt!IopDeleteFileObjectExtension+98

BUCKET_ID:  0x7E_nt!IopDeleteFileObjectExtension+98

Followup: MachineOwner
---------

Update the obsolete drivers or uninstall the hardware or software associated with them. If you need help with this, please ask. Uninstall Eset. Run your system and see what happens. Upload any new BSOD's

 

[kuleee]

hi

first i would like to thank you for help

well, i have decided last night to go with full system format and installing fresh windows 7 ultimate x86. i left my computer turned on over night and all the morning. now i get back from work computer was still working so it was almost 20 hours without BSOD. only programs that i installed last night was winrar, microsoft security essentials, latest graphic, sound and network card drivers, nvidia physix and daemon tools. all was fine, then i started installing windows updates (common stuff like <important> updates, security issues etc.) and left the room. when i get back there was message "windows recovered from unexpected shutdown" and these lines:

Problem signature:
  Problem Event Name:    BlueScreen
  OS Version:    6.1.7600.2.0.0.256.1
  Locale ID:    1050

Additional information about the problem:
  BCCode:    50
  BCP1:    FFFFFFFB
  BCP2:    00000000
  BCP3:    82D1EF03
  BCP4:    00000000
  OS Version:    6_1_7600
  Service Pack:    0_0
  Product:    256_1

Files that help describe the problem:
  C:\Windows\Minidump\080310-31671-01.dmp
  C:\Users\kule\AppData\Local\Temp\WER-46328-0.sysdata.xml

Read our privacy statement online:
  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
  C:\Windows\system32\en-US\erofflps.txt

don't need to tell you how frustrated i was so i uninstalled ALL updates and now will try to solve something with windows debugger. btw here is my new files

 

[ttran]

STOP 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA

Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS

I suspect that Microsoft Security Essential cause this BSODs as MpFilter.sys was blamed in the crash dump. Usually MSE is known for BSODs free so this is very strange. You might want to reinstall MSE. I'm not sure it gonna fix but never hurt to try

Run a system file check please:

Open an elevated command prompt and enter sfc /scannow.

Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads

BUGCHECK SUMMARY:

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\TUANTR~1\AppData\Local\Temp\Rar$DI00.888\080310-31671-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*e:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82c07000 PsLoadedModuleList = 0x82d46570
Debug session time: Tue Aug  3 18:23:09.818 2010 (UTC + 7:00)
System Uptime: 0 days 5:36:17.412
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
.....
0: kd> !analyze
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffffb, 0, 82d1ef03, 0}

Unable to load image \SystemRoot\system32\DRIVERS\MpFilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for MpFilter.sys
*** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys
Probably caused by : MpFilter.sys ( MpFilter+8e8b )

Followup: MachineOwner
---------

Let us know if you need help

 

[CarlTR6]

I would get rid of sptd first and see what happens. It is very unusual for MSE to cause a crash and sptd is known to cause crashes.

 

[kuleee]

i have uninstalled cd virtualization program (is driver for it still here?). anyway, i didn't get 1 bsod since yesterday, that one time after installing updates, but my computer froze this one time 5 hours ago (without BSOD)... could windows updates cause freezing and BSOD? :S should i install windows updates, but only improtant ones (not optional)? and btw i saw that my type of mouse could get me in troubles with BSOD, some other guy have a problem too with Razer's DeathAdder mouse... i didn't install any software or driver for mouse after reinstalling windows, so now mouse cannot make any problems i think..

 

[kuleee]

ok, i just get another bsod 2min ago :S here are the files and blue screen info

Problem signature:
  Problem Event Name:    BlueScreen
  OS Version:    6.1.7600.2.0.0.256.1
  Locale ID:    1050

Additional information about the problem:
  BCCode:    1000008e
  BCP1:    C0000005
  BCP2:    9A2FB545
  BCP3:    925F98FC
  BCP4:    00000000
  OS Version:    6_1_7600
  Service Pack:    0_0
  Product:    256_1

Files that help describe the problem:
  C:\Windows\Minidump\080410-17015-01.dmp
  C:\Users\kule\AppData\Local\Temp\WER-27734-0.sysdata.xml

Read our privacy statement online:
  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
  C:\Windows\system32\en-US\erofflps.txt

 

[ttran]

Could you tell me what was the result from the system file check?

Exception code c0000005 indicated memory access violation, Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Boot from the CD, and leave it running for at least 5 or 6 passes.

Please turn on driver Verifier:

I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

In Windows 7 you can make a Startup Repair disk by going to Start....All Programs...Maintenance...Create a System Repair Disc - with Windows Vista you'll have to use your installation disk or the "Repair your computer" option at the top of the Safe Mode menu .

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\TUANTR~1\AppData\Local\Temp\Rar$DI00.278\080410-17015-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*e:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82c0c000 PsLoadedModuleList = 0x82d4b570
Debug session time: Wed Aug  4 20:21:14.611 2010 (UTC + 7:00)
System Uptime: 0 days 0:23:40.611
Loading Kernel Symbols
...............................................................
................................................................
............
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 9a2fb545, 925f98fc, 0}

Probably caused by : win32k.sys ( win32k!D3DXVec4Transform+e )

Followup: MachineOwner
---------

I would double Check with your hardware vendor for any BIOS updates.

Regard,

Tuan

 

[kuleee]

how do i know my bios version? where is it? and how to update it? never done this before...

 

[kuleee]

ok here is the file check results on picture cause i don't know what info do you need...

http://a.imageshack.us/img228/3976/49636556.jpg

i have also make 6 passes on memory check with memtest86 with no errors, almost 4 hours for testing... do i have results from test somewhere for you to see?

 

[ttran]

Please run cmd command as administrator my friend, the result from what I saw show that It was not SFC result because you didn't run cmd as administrator. Please follow this direction carefully:
http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

To know what BIOS version that you have, you can try go to Start->Run-->msinfo32 and look for BIOS version

 

[kuleee]

ok sry, i got it... results from file check are good, it says that
"windows resource protection did not find any integrity violations"

i find my bios version:

Bios Version/Date: American Megatrends Inc. P1.60, 31.10.2007
SMBIOS Version: 2.4

but how to update it? i would really appreciate help in step by step

 

[ttran]

It belong to American Megatrend Inc, please follow this article to identify your motherboard and download
AMI | American Megatrends Inc. : AMIBIOS Support

Before updating BIOS, I would like to hear the result from Memtestx86