NDIS.sys BSOD

[Uber Philf]

EUCK! formatted my computer the other day hoping not to get another BSOD, but heres a new one, dump provided.

NDIS.sys.

 

[zigzag3143]

EUCK! formatted my computer the other day hoping not to get another BSOD, but heres a new one, dump provided.

NDIS.sys.

Enzo


There is a slight disagreement between two tools. One says NIDS.sys, one pacer.sys. Both are win 7 files and so running a system file check to verify and repair them is in order

Run a system file check to verify and repair your system files.
To do this type cmd in search, then right click to run as administrator, then
SFC /SCANNOW

Let us know the results from the report at the end.

Ken

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\082810-18735-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols;*http://msdl.microsoft.com/download/symbols ;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a15000 PsLoadedModuleList = 0xfffff800`02c52e50
Debug session time: Sat Aug 28 01:33:07.469 2010 (GMT-4)
System Uptime: 0 days 0:10:02.967
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff88009fbf778, 0, fffff8800144fc3b, 2}


Could not read faulting driver name
Probably caused by : pacer.sys ( pacer!PcFilterRequestComplete+68 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff88009fbf778, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8800144fc3b, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cbd0e0
 fffff88009fbf778 

FAULTING_IP: 
ndis!ndisOidRequestComplete+9b
fffff880`0144fc3b 803e05          cmp     byte ptr [rsi],5

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  Rainmeter.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88008f3e910 -- (.trap 0xfffff88008f3e910)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000002000d rbx=0000000000000000 rcx=fffff88008f3f160
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800144fc3b rsp=fffff88008f3eaa0 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=fffff880009e6fa0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
ndis!ndisOidRequestComplete+0x9b:
fffff880`0144fc3b 803e05          cmp     byte ptr [rsi],5 ds:0001:00000000`00000000=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002b048f2 to fffff80002a85740

STACK_TEXT:  
fffff880`08f3e7a8 fffff800`02b048f2 : 00000000`00000050 fffff880`09fbf778 00000000`00000000 fffff880`08f3e910 : nt!KeBugCheckEx
fffff880`08f3e7b0 fffff800`02a8382e : 00000000`00000000 fffff880`08f3f160 00000000`c0000000 fffffa80`06714400 : nt! ?? ::FNODOBFM::`string'+0x40ec0
fffff880`08f3e910 fffff880`0144fc3b : 00000000`00000000 fffff880`10b79fa2 fffffa80`0418c9b0 fffff800`02bba2dd : nt!KiPageFault+0x16e
fffff880`08f3eaa0 fffff880`01450be1 : fffff880`08f3f100 00000000`00000000 fffff880`08f3f160 fffffa80`0582a010 : ndis!ndisOidRequestComplete+0x9b
fffff880`08f3eb30 fffff880`02d1c078 : fffffa80`0418c9c0 fffffa80`0582a540 fffff880`08f3f160 fffffa80`0418c900 : ndis!NdisFOidRequestComplete+0x91
fffff880`08f3ebb0 fffff880`0144fde0 : fffffa80`0418ca08 fffffa80`054c11a0 00000000`00000000 fffffa80`054c11a0 : pacer!PcFilterRequestComplete+0x68
fffff880`08f3ebe0 fffff880`014d4a24 : 00000000`00000000 00000000`00000000 fffffa80`0418c9c0 fffffa80`054c11a0 : ndis!ndisOidRequestComplete+0x240
fffff880`08f3ec70 fffff880`01450a19 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`054c1200 : ndis!ndisMDoOidRequest+0x364
fffff880`08f3ed20 fffff880`01450629 : 00000208`00980101 fffff880`014b0110 00000000`00000000 fffffa80`054c11a0 : ndis!ndisFQueueRequestOnNext+0x389
fffff880`08f3ed90 fffff880`02d1c11b : fffff880`08f3f160 00000000`00020106 fffff880`08f3f160 fffffa80`0582a540 : ndis!NdisFOidRequest+0xc9
fffff880`08f3ee70 fffff880`014d4d0b : fffffa80`0418c9c0 fffffa80`0582a010 fffffa80`054c11a0 fffffa80`0582a010 : pacer!PcFilterRequest+0x5b
fffff880`08f3eea0 fffff880`0145022f : fffffa80`00000000 fffffa80`0582a010 fffffa80`054c11a0 fffff880`08f3f160 : ndis!ndisFDoOidRequest+0x21b
fffff880`08f3ef70 fffff880`014541bd : fffffa80`054c1101 fffff880`08f3f160 fffffa80`0582a010 fffff880`01453f00 : ndis!ndisQueueRequestOnTop+0x21f
fffff880`08f3f000 fffff880`01455a53 : fffffa80`054c11a0 fffffa80`0582a010 fffffa80`03fa5350 fffffa80`056701a0 : ndis!ndisQuerySetMiniportEx+0x13d
fffff880`08f3f070 fffff880`0146bc5b : 00500020`0053006f 0065006b`00630061 00630053`00200074 fffff880`08f3f4e8 : ndis!ndisIfGetMiniportStatistics+0x163
fffff880`08f3f2a0 fffff880`014529e3 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis! ?? ::FNODOBFM::`string'+0x95d7
fffff880`08f3f430 fffff880`0145361d : fffffa80`0582a630 00000000`00000000 fffff880`08f3f510 00060000`00000000 : ndis!ndisNsiGetInterfaceRodInformation+0x1c3
fffff880`08f3f4d0 fffff880`015424b6 : fffff880`014b1890 fffffa80`03fa5000 00000000`00000000 fffffa80`06864b00 : ndis!ndisNsiGetAllInterfaceInformation+0x42e
fffff880`08f3f590 fffff880`03e98e29 : fffffa80`03fa5000 00000000`00000070 fffffa80`05375ab0 00000000`0012f470 : NETIO!NsiEnumerateObjectsAllParametersEx+0x6df
fffff880`08f3f770 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nsiproxy!NsippEnumerateObjectsAllParameters+0x305


STACK_COMMAND:  kb

FOLLOWUP_IP: 
pacer!PcFilterRequestComplete+68
fffff880`02d1c078 f0834564ff      lock add dword ptr [rbp+64h],0FFFFFFFFh

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  pacer!PcFilterRequestComplete+68

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: pacer

IMAGE_NAME:  pacer.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bccc5

FAILURE_BUCKET_ID:  X64_0x50_pacer!PcFilterRequestComplete+68

BUCKET_ID:  X64_0x50_pacer!PcFilterRequestComplete+68

Followup: MachineOwner
---------

 

[Uber Philf]

Ok, it found incorrect system files, but they are only the ones ive modified. as in Explorer.exe for the start button, imgres.dll, shell32.dll, zipfldr.dll and authui.dll. Ive read these before so i kinda knew where i was going.

Anything else?

Something i saw in the bsod log u posted, something about rainmeter? is that something i should be concerned about?

 

[Flavius]

Something i saw in the bsod log u posted, something about rainmeter? is that something i should be concerned about?

I almost in 100% sure Rainmeter cause this BSOD.Try update this soft or uninstall it completely and check results...

 

[reventon]

EUCK! formatted my computer the other day hoping not to get another BSOD, but heres a new one, dump provided.

NDIS.sys.

If you have had many BSODs previously then I would suspect hardware - as the problem remaining after a re-format is a sure sign.

This fits in with Microsoft Drivers being blamed here - as well as the fact that your system has only the necessary 3rd Party drivers installed and all appear to be up to date.

Given the STOP code of 0x50 - "Invalid system memory was referenced", my first suspicion here would be the RAM.

Memtest -> http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Just incase one of the few drivers that are present is at fault also turn Driver Verifier on.

Driver Verifier -> http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

Regards,
Reventon

 

[Uber Philf]

Well the rainmeter would explain a bit, it's a beta copy, ive done runs with memtest before already with suspected RAM issues and came up clean... ill try the rainmeter update & drive verifier.