Solved BSOD - Sometimes NDIS.sys "driver_irql_not_less_or_equal"

[Popesture]

Hi,

I have a problem with my desktop. Randomly when I am using the PC, it will blue screen with usually the following error. Most times displaying NDIS.SYS as the problem.

"driver_irql_not_less_or_equal"

I've read in a forum, a post by a guy with a similar issue.
He says that the wireless and the network card(cable) share the same IRQ and must be a conflict between them.

I do not have or used wireless on the desktop since a fresh reinstall of Win7 on new drives which are both 6 months old so, I'm it's not them causing the problem..

I have attached the 3 most recent minidumps, any help is much appreciated!

 

[Arc]

Welcome aboard.

The crash is caused by COMODO Firewall Pro Firewall Driver.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {14, 2, 0, 8bc6f2bf}

Unable to load image \SystemRoot\system32\DRIVERS\inspect.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for inspect.sys
*** ERROR: Module load completed but symbols could not be loaded for inspect.sys
*** WARNING: Unable to verify timestamp for nvmf6232.sys
*** ERROR: Module load completed but symbols could not be loaded for nvmf6232.sys
[COLOR=Red]Probably caused by : inspect.sys[/COLOR] ( inspect+1c43 )

Followup: MachineOwner
---------

Uninstall COMODO.
Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.

Let us know th results.

 

[Popesture]

Thanks for the quick reply! I have un-installed Comodo. Once restarted the PC again BSOD error from another file ending in .sys. It did not create a minidump however Will post one if it happens again

 

[Arc]

Well, uninstall Avast using Avast Uninstall Utility. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.


Let us know the result now. And, next time post it following the Blue Screen of Death (BSOD) Posting Instructions.

 

[Popesture]

Done thanks! Seems the blue screens have stopped once installing them and everything seems good. I had MBAM installed already and now have MSE since the universitys internet has been down the past 3 days..

Thanks very much for all your help!

 

[Arc]

Nice to know. Wait and see what happens there lately, and update this thread.

 

[Popesture]

Sorry to bother you again, but got another this morning.
Was working fine all day yesterday. Uploaded as I'm meant to

 

[Arc]

It is caused by the display driver.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {8177f4b8, 0, 91f7bfd7, 0}

Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys

Could not read faulting driver name
Probably caused by : nvlddmkm.sys ( nvlddmkm+15cfd7 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: 8177f4b8, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 91f7bfd7, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from 82d7f848
Unable to read MiSystemVaType memory at 82d5ee20
 8177f4b8 

FAULTING_IP: 
nvlddmkm+15cfd7
91f7bfd7 8b4a20          mov     ecx,dword ptr [edx+20h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  java.exe

CURRENT_IRQL:  0

TRAP_FRAME:  ac52b0d8 -- (.trap 0xffffffffac52b0d8)
ErrCode = 00000000
eax=875098d0 ebx=866c6314 ecx=866c6314 edx=8177f498 esi=8586f568 edi=caf012fe
eip=91f7bfd7 esp=ac52b14c ebp=ac52b168 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
nvlddmkm+0x15cfd7:
91f7bfd7 8b4a20          mov     ecx,dword ptr [edx+20h] ds:0023:8177f4b8=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82c55ae8 to 82ca2b3f

STACK_TEXT:  
ac52b0c0 82c55ae8 00000000 8177f4b8 00000000 nt!MmAccessFault+0x106
ac52b0c0 91f7bfd7 00000000 8177f4b8 00000000 nt!KiTrap0E+0xdc
WARNING: Stack unwind information not available. Following frames may be wrong.
ac52b168 91f84d55 8586f568 866c6314 00000000 nvlddmkm+0x15cfd7
ac52b18c 91fa61e6 c1d00001 ff010000 caf012fe nvlddmkm+0x165d55
ac52b270 91fa65f6 ac52b288 ac52b42c 8666c000 nvlddmkm+0x1871e6
ac52b29c 91f63742 ac52b42c ac52b2bc 00000000 nvlddmkm+0x1875f6
ac52b330 91ed7da1 ac52b42c 85ef5000 ac52b42c nvlddmkm+0x144742
ac52b34c 91ed9b25 ac52b42c 00003f00 857e13b8 nvlddmkm+0xb8da1
ac52b360 91e64f19 ac52b42c 857e1494 85ef5000 nvlddmkm+0xbab25
ac52b4dc 91e66ec9 ac52b8a0 85ef5000 00000000 nvlddmkm+0x45f19
ac52b7d4 91e6a0e6 85ef5000 ac52b90c ac52b8a0 nvlddmkm+0x47ec9
ac52b830 92668b59 857e13b8 8302d6ee 85ef5000 nvlddmkm+0x4b0e6
ac52b848 926cb5db 92668b06 ac52b8a0 86d06000 nvlddmkm+0x849b59
ac52b85c 928bdaf9 85ef5000 ac52b8a0 00000000 nvlddmkm+0x8ac5db
ac52b884 928bb41b ac52b8a0 3ed84826 b01145b0 dxgkrnl!DXGADAPTER::DdiCreateAllocation+0x49
ac52b8d8 928b985b ac52bca0 ac52ba88 ac52b90c dxgkrnl!DXGDEVICE::CreateDriverAllocations<_DXGK_ALLOCATIONINFO,_DXGKARG_CREATEALLOCATION>+0x23c
ac52bc78 928bbd41 ac52bca0 00000001 00000000 dxgkrnl!DXGDEVICE::CreateAllocation+0x6e1
ac52bd28 82c528fa 1df3e134 1df3e0d8 77b47094 dxgkrnl!DxgkCreateAllocation+0x2a6
ac52bd28 77b47094 1df3e134 1df3e0d8 77b47094 nt!KiFastCallEntry+0x12a
1df3e0d8 00000000 00000000 00000000 00000000 0x77b47094


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nvlddmkm+15cfd7
91f7bfd7 8b4a20          mov     ecx,dword ptr [edx+20h]

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nvlddmkm+15cfd7

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nvlddmkm

IMAGE_NAME:  nvlddmkm.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  506b2f5b

FAILURE_BUCKET_ID:  0x50_nvlddmkm+15cfd7

BUCKET_ID:  0x50_nvlddmkm+15cfd7

Followup: MachineOwner
---------

0: kd> lmvm nvlddmkm
start    end        module name
91e1f000 92893000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        Tue Oct 02 23:45:55 2012 (506B2F5B)
    CheckSum:         00A5C59B
    ImageSize:        00A74000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

• Download and install Driver Fusion.
• Reboot the computer in Advanced Boot Options, safe mode. Search Driver Fusion in your start menu, and remove all components of your nVidia display driver.
• Boot normally now. Go to Drivers - Download NVIDIA Drivers, Drivers > Beta and Legacy; search there with your cards particulars for GeForce 306.23 Driver, dated 13.9.2012 and install it.

Let us know the results.

 

[Popesture]

All done Thank you very much again!
Will let you know if anything else, should I mark as solved now?

 

[Arc]

Depends on the situation. If you stop getting bluescreens, you may.

 

[Popesture]

Still getting them sadly...

 

[Arc]

Your latest crash dump not showing any finite probable cause. In such a situation, it is better to enable Driver Verifier to monitor the drivers.

Driver Verifier - Enable and Disable

Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[Popesture]

Will do, thanks!

 

[Popesture]

Blue screened at 7pm. First with java and flash player running (does it quite a bit like that) and then upon pushing enter to log back in to windows following a restart.

Don't know if that information helps


Also, one blue screen error was 'paged area in non paged area' or something similar

 

[Arc]

The first one is caused by the display driver.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {91e0000c, 0, 0, 82cb0118}

*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
[COLOR=Red]Probably caused by : nvlddmkm.sys [/COLOR]( nvlddmkm+6ac2e )

Followup: MachineOwner
---------

Update it from http://www.sevenforums.com/graphic-cards/602-latest-nvidia-forceware-video-drivers-windows-7-a.html.

But the other one, Page fault in non-paged area is not giving any information. If after updating the display driver it crashes again, enable driver verifier.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[Popesture]

Crashed 3 times after another.

First saying: cyfs.sys or cyls.sys error

second saying dxgkrnl.sys - driver over ran stack based buffer, overrun allow user to gain control

third, remaining stuck at 5% when writing the dump for 15mins

 

[Arc]

You first Do some disc checks.

1. Update your SSD's Firmware (Skip it, if it is not a SSD)
2. Re-seat the sata and power.
3. Run chkdsk /f/r, following the option two of the tutorial Disk Check
4. Seatool for dos: SeaTools | Seagate download
   Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

Uninstall Spybot.
Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.

Download and install those, and then run full system scans with both of them, one by one.


Rollback the graphics driver to an older one.

• Download and install Driver Fusion.
• Reboot the computer in Advanced Boot Options, safe mode. Search Driver Fusion in your start menu, and remove all components of your nVidia display driver.
• Boot normally now. Go to Drivers - Download NVIDIA Drivers, Drivers > Beta and Legacy; search there with your cards particulars for GeForce 306.23 Driver, dated 13.9.2012 and install it.

And, plan to update the BIOS. It is too old.

BiosMajorRelease = 8
BiosMinorRelease = 15
BiosVendor = American Megatrends Inc.
BiosVersion = V2.0S
[COLOR=Red]BiosReleaseDate = 12/16/2008[/COLOR]

Let us know the results.

 

[Popesture]

I followed your steps.
The SSD resulted in the attached image. I configured the drive to IDE correctly.

Check disk found nothing.

Haven't ran Seatools yet since no free CD's, should be getting some today.

Uninstalled Spybot. Installed the NVidia driver as instructed.

Where would I go to find a BIOS update? Since I couldn't find any help

Also attached new logs

 

[Arc]

For updates, search in your SSD manufacturer's website.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C5, {c1d00004, 2, 1, 82d734c1}

Probably caused by : ntkrpamp.exe ( nt!ExAllocatePoolWithTag+4b7 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

[COLOR=Red]DRIVER_CORRUPTED_EXPOOL (c5)[/COLOR]
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  [COLOR=Red]Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.[/COLOR]
Arguments:
Arg1: c1d00004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 82d734c1, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR:  0xC5_2

CURRENT_IRQL:  2

FAULTING_IP: 
nt!ExAllocatePoolWithTag+4b7
82d734c1 897004          mov     dword ptr [eax+4],esi

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  firefox.exe

TRAP_FRAME:  a1877704 -- (.trap 0xffffffffa1877704)
ErrCode = 00000002
eax=c1d00000 ebx=82d896c0 ecx=858b3990 edx=858e1e18 esi=82d89898 edi=82d896c4
eip=82d734c1 esp=a1877778 ebp=a18777c0 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
nt!ExAllocatePoolWithTag+0x4b7:
82d734c1 897004          mov     dword ptr [eax+4],esi ds:0023:c1d00004=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82d734c1 to 82c92cdb

STACK_TEXT:  
a1877704 82d734c1 badb0d00 858e1e18 a1877774 nt!KiTrap0E+0x2cf
a18777c0 82e939ac 00000000 00000088 66496553 nt!ExAllocatePoolWithTag+0x4b7
a18777e4 82e878b6 00000000 a1877850 8ba729b3 nt!SeLocateProcessImageName+0x3a
a1877888 82e7331e 194a0a00 00002000 a1877cd0 nt!ExpGetProcessInformation+0x355
a1877d00 82e83ed4 00000005 00000000 00000000 nt!ExpQuerySystemInformation+0x1035
a1877d1c 82c8f8fa 00000005 194a0a00 00002000 nt!NtQuerySystemInformation+0x76
a1877d1c 77417094 00000005 194a0a00 00002000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
05f1f2cc 00000000 00000000 00000000 00000000 0x77417094


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExAllocatePoolWithTag+4b7
82d734c1 897004          mov     dword ptr [eax+4],esi

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExAllocatePoolWithTag+4b7

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  503f7f43

FAILURE_BUCKET_ID:  0xC5_2_nt!ExAllocatePoolWithTag+4b7

BUCKET_ID:  0xC5_2_nt!ExAllocatePoolWithTag+4b7

Followup: MachineOwner
---------

Your crash dumps are not showing any finite probable cause. In such a situation, it is better to enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Let us know the results, with the subsequent crash dumps, if any.

Also, your BIOS is very old. If possible, update it.

Machine ID Information [From Smbios 2.5, DMIVersion 0, Size=1768]
BiosMajorRelease = 8
BiosMinorRelease = 15
BiosVendor = American Megatrends Inc.
BiosVersion = V2.0S
[COLOR=Red]BiosReleaseDate = 12/16/2008[/COLOR]

 

[Popesture]

I did for the SSD, the update would not complete.

And I asked last post where about could I find BIOS update?