Random BSOD, sometimes when playing video

pilau · Jan 28, 2012

Hi everyone, I have been having BSODs since I have installed this Windows almost a year ago. However a big portion of my time since then has been enjoyed backpacking, so, having returned home two months ago - I finally decided to get hands on with this.

Ok let's get on with this:

Hardware
Custom built PC, Most hardware is 5-6 years old and was barely used when I got it - except for the RAM, which was used. The 360GB HDD and the graphics card were brand new out-of-the-box a year ago (barely used as I wasn't home), and the 450w PSU is brand new now. (you can check out all of my hardware in my specs)

Software
Windows 7 Ultimate 32bit, retail. About a year old. Second install on this machine - the previous installation (same DVD and license) got into a boot loop (turn on pc, boot up, freeze and reset) and so this is a re-install.

Symptoms
The vast majority of the BSODs I witnessed were during video playback - then the screen would distort and display a garbage version of whatever was on the screen at the time - and hop on to BSOD. The other observed occurrences happened when I was surfing the internet (not more than 2-3 crashes if I remember correctly). I cannot recall what was I browsing during these crashes.

Out of those 20-so crashes I've been having, some of them would happen during the night, while I was sleeping and so I can't say what exactly happened during those crashes. However sometimes I leave my downloads for the night and perhaps this is a factor.

Azo · Jan 28, 2012

I think it's a video driver issue. Why don't you update your graphics card drivers and check if the problem is gone or not?

pilau · Jan 28, 2012

Wow, I can't believe I skipped this one! :big facepalm:
I am downloading the driver as we speak.

Let's see if it changes anything in the coming days. Still happy to hear other input.

Azo · Jan 28, 2012

Wait....did you download all the drivers sans video driver? Say chipset etc?

pilau · Jan 28, 2012

No, I let Windows do that for me. So I guess you suggest I do, right?

Azo · Jan 28, 2012

pilau said:
No, I let Windows do that for me. So I guess you suggest I do, right?

Of course !!! :shock:

That's the major cause of issue. Once the rudimentary drivers are installed then leave it to Windows to keep you updated. There is a sequence in which you need to install the drivers:

Chipset
Video Driver
Network Driver
Audio Driver
Wireless Network Driver
Modem
Touchpad

I am sure your problem will be gone after that.

pilau · Jan 28, 2012

Fair enough - thank you for that order list - I was actually wondering about this.

I will update my drivers and I will update here hopefully in a couple of days with no crashes/the first crash.

Cheers.

pilau · Jan 28, 2012

Okay, I don't know if it is sufficient or not, but:

Chipset - i915G/P: I download the most recent Intel update which is version 9.3.0.1019. However that only updates the INF files, and the actual device (it is called Intel(R) 915G/P/GV/GL/PL/910GE/GL PCI Express Root Port - 2581 - and I hope this is the one) - keeps the same Microsoft driver from 2006.
LAN Adapter (Intel Pro100): Downloaded the latest (read: 2005!) drivers from Asus and Windows has determined that my driver is up to date.
All other drivers (which are graphics and sound drivers) are already updated.

What are your thoughts?

Azo · Jan 28, 2012

I think that is sufficient for now. Now try playing some video files ( use Vlc Media Player - VideoLAN - Official page for VLC media player, the Open Source video framework! ) and check if the problem persists.

pilau · Jan 28, 2012

Will do, and if it reoccurs I will report back.

pilau · Jan 29, 2012

It happened again today, on 12:49, nobody was home and of course the PC was unattended.

writhziden · Jan 29, 2012

Code:

[list=1]
[*]
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Mike\Downloads\pilau\Windows_NT6_BSOD_jcgriff2\012812-18406-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x8304a000 PsLoadedModuleList = 0x8318a230
Debug session time: Fri Jan 27 16:45:23.004 2012 (GMT-7)
System Uptime: 3 days 2:47:43.911
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c000001d, 830a8e17, 8bbc7c54, 0}

Probably caused by : hardware ( nt!KiTrap0E+dc )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: 830a8e17, The address that the exception occurred at
Arg3: 8bbc7c54, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

FAULTING_IP: 
nt!MmAccessFault+14e
830a8e17 ff              ???

TRAP_FRAME:  8bbc7c54 -- (.trap 0xffffffff8bbc7c54)
ErrCode = 00000000
eax=c0000000 ebx=778d8e7a ecx=8bbc7d35 edx=03e37a98 esi=c01de350 edi=778d477a
eip=830a8e17 esp=8bbc7cc8 ebp=8bbc7d1c iopl=0         ov up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010a86
nt!MmAccessFault+0x14e:
830a8e17 ff              ???
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  uTorrent.exe

CURRENT_IRQL:  0

MISALIGNED_IP: 
nt!MmAccessFault+14e
830a8e17 ff              ???

LAST_CONTROL_TRANSFER:  from 83082a48 to 830a8e17

FAILED_INSTRUCTION_ADDRESS: 
nt!MmAccessFault+14e
830a8e17 ff              ???

STACK_TEXT:  
8bbc7d1c 83082a48 00000000 778d477a 00000001 nt!MmAccessFault+0x14e
8bbc7d1c 778d477a 00000000 778d477a 00000001 nt!KiTrap0E+0xdc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0230fe90 00000000 00000000 00000000 00000000 0x778d477a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiTrap0E+dc
83082a48 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!KiTrap0E+dc

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  IP_MISALIGNED

BUCKET_ID:  IP_MISALIGNED

Followup: MachineOwner
---------
[*]
Loading Dump File [K:\BSODDmpFiles\pilau\Windows_NT6_BSOD_jcgriff2\012212-30062-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x83008000 PsLoadedModuleList = 0x83148230
Debug session time: Sat Jan 21 16:10:50.102 2012 (GMT-7)
System Uptime: 1 days 7:46:52.008
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {9d06584b, 2, 0, 89f76fbb}

Probably caused by : afd.sys ( afd!AfdBCommonChainedReceiveEventHandler+68 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 9d06584b, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 89f76fbb, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 83167828
Unable to read MiSystemVaType memory at 83147d80
 9d06584b 

CURRENT_IRQL:  2

FAULTING_IP: 
afd!AfdBCommonChainedReceiveEventHandler+68
89f76fbb 8b480c          mov     ecx,dword ptr [eax+0Ch]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  a207d254 -- (.trap 0xffffffffa207d254)
ErrCode = 00000000
eax=9d06583f ebx=a207d314 ecx=98334396 edx=67ccbc69 esi=85cecbe0 edi=87069008
eip=89f76fbb esp=a207d2c8 ebp=a207d308 iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
afd!AfdBCommonChainedReceiveEventHandler+0x68:
89f76fbb 8b480c          mov     ecx,dword ptr [eax+0Ch] ds:0023:9d06584b=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 89f76fbb to 83040c3b

STACK_TEXT:  
a207d254 89f76fbb badb0d00 67ccbc69 00000000 nt!KiTrap0E+0x2cf
a207d314 89f777e3 85cecbe0 0000000e 00000000 afd!AfdBCommonChainedReceiveEventHandler+0x68
a207d32c 8a091ce3 85cecbe0 a207d398 a207d48c afd!AfdTLConnectedReceiveEventHandler+0x19
a207d3bc 8a08e26d 868cd1c0 00001266 a207d48c tcpip!TcpIndicateData+0x203
a207d450 8a090154 87200700 872007f8 a207d48c tcpip!TcpDeliverDataToClient+0x2fa
a207d4a4 8a0c3828 87200700 872007f8 85fbc488 tcpip!TcpDeliverReceive+0x96
a207d53c 8a0c1dc6 86200548 87200700 a207d564 tcpip!TcpTcbCarefulDatagram+0x1738
a207d5a8 8a0a5438 86200548 87200700 0007d61c tcpip!TcpTcbReceive+0x228
a207d610 8a0a5c6a 861d3320 861f3000 00000000 tcpip!TcpMatchReceive+0x237
a207d660 8a0a5cab 86200548 861f3000 000038fd tcpip!TcpPreValidatedReceive+0x293
a207d67c 8a09ffd5 86200548 861f3000 a207d6b8 tcpip!TcpReceive+0x2d
a207d68c 8a0a820b a207d6a0 c000023e 00000000 tcpip!TcpNlClientReceiveDatagrams+0x12
a207d6b8 8a0a7b56 8a123198 a207d70c c000023e tcpip!IppDeliverListToProtocol+0x49
a207d6d8 8a0a5f18 8a122fa8 00000006 a207d70c tcpip!IppProcessDeliverList+0x2a
a207d730 8a0a79ff 8a122fa8 00000006 00000000 tcpip!IppReceiveHeaderBatch+0x1fb
a207d7c4 8a0b5e2c 867ce308 00000000 00000101 tcpip!IpFlcReceivePackets+0xbe5
a207d840 8a0b045e 867c6008 85fbc488 00000000 tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x746
a207d874 8305c068 85fbc488 97d8d98e 8620c768 tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x11e
a207d8dc 8a0b05cc 8a0b0340 a207d904 00000000 nt!KeExpandKernelStackAndCalloutEx+0x132
a207d918 89e9f18d 867c6002 85fbc400 00000000 tcpip!FlReceiveNetBufferListChain+0x7c
a207d950 89e8d5be 867c75e8 85fbc488 00000000 ndis!ndisMIndicateNetBufferListsToOpen+0x188
a207d978 89e8d4b2 00000000 85fbc488 866b50e0 ndis!ndisIndicateSortedNetBufferLists+0x4a
a207daf4 89e38c1d 866b50e0 00000000 00000000 ndis!ndisMDispatchReceiveNetBufferLists+0x129
a207db10 89e8d553 866b50e0 85fbc488 00000000 ndis!ndisMTopReceiveNetBufferLists+0x2d
a207db38 89e38c78 866b50e0 85fbc488 00000000 ndis!ndisMIndicateReceiveNetBufferListsInternal+0x62
a207db60 8c906ac6 866b50e0 85fbc488 00000000 ndis!NdisMIndicateReceiveNetBufferLists+0x52
a207dbd4 8c906e93 867c55c0 867c2710 85fbc488 tunnel!TunnelUserServiceWriteRequest+0x126
a207dc08 8c904acf 867c8768 00000000 a207dc34 tunnel!TunnelUserWriteFile+0x9d
a207dc18 89ea8730 867c8768 867c2710 87ca5540 tunnel!TunnelDriverDispatchWrite+0x1b
a207dc34 83037012 867c8768 867c2710 867c2710 ndis!ndisDummyIrpHandler+0x6c
a207dc4c 8320ca5d 87ca5540 867c2710 867c2780 nt!IofCallDriver+0x63
a207dc6c 832227c8 867c8768 87ca5540 00000001 nt!IopSynchronousServiceTail+0x1f8
a207dd08 8303d85a 867c8768 00000000 00000000 nt!NtWriteFile+0x6e8
a207dd08 776c7094 867c8768 00000000 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
01bff6b0 00000000 00000000 00000000 00000000 0x776c7094


STACK_COMMAND:  kb

FOLLOWUP_IP: 
afd!AfdBCommonChainedReceiveEventHandler+68
89f76fbb 8b480c          mov     ecx,dword ptr [eax+0Ch]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  afd!AfdBCommonChainedReceiveEventHandler+68

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: afd

IMAGE_NAME:  afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4db4d9d8

FAILURE_BUCKET_ID:  0xD1_afd!AfdBCommonChainedReceiveEventHandler+68

BUCKET_ID:  0xD1_afd!AfdBCommonChainedReceiveEventHandler+68

Followup: MachineOwner
---------


[/list]

Caused by a hardware fault which is typically driver related. Other possible causes are Memory problems... Hard disk errors... Viruses... Lack of Windows updates... Drivers...
Possible cause Drivers...

Thanks to Dave76 for help understanding possible causes.

We will start with the common problems first (see bold possible causes). Do the following steps and test after each to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

If you are overclocking any hardware, please stop
Update the following drivers. The drivers may already be the latest, so if you cannot find an update, do not worry too much about it. You may want to install the drivers in compatibility mode for Vista if the newest are still prior to July 13, 2009. http://www.sevenforums.com/tutorials/98073-drivers-install-vista-drivers-windows-7-a.html may be a useful resource.
Code:
```
e100b325	9324b000	93271e00	Fri Nov 16 11:53:32 2007 (473de72c)	0002bdf6		e100b325.sys
iteatapi	83fbc000	83fc8000	Wed May 14 00:18:14 2008 (482a8426)	000091d7		iteatapi.sys
```
You may use the following sites as references for finding drivers. We recommend finding the manufacturer of the driver and downloading drivers directly from the manufacturer or software developer. If you have trouble finding a driver or driver manufacturer, let us know and we will do our best to assist you. If you need help, please provide the device name, manufacturer, and the driver .sys file that you are looking for.
1. Driver Reference is a good site to find the driver .sys files, their descriptions, and the site most likely to contain an update.
2. Driver Search Methods provides driver manufacturers and links to their homepages.
There are a few methods for updating drivers.
To fully re-install a driver, use the following steps.
1. Click Start Menu
2. Right Click My Computer/Computer
3. Click Manage
4. Click Device Manager from the list on the left
5. Find the device you are trying to uninstall by expanding the appropriate set of devices
6. Right click the device
7. Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
8. Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
9. Restart your computer
10. Install the latest driver for the device once Windows starts.
Alternatively:
1. Login as an adminstrative user.
2. Click Start Menu
3. Click Control Panel
4. Click Hardware and Sound
5. Click Device Manager (the last link under Devices and Printers)
6. Find the device you are trying to uninstall by expanding the appropriate set of devices
7. Right click the device
8. Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
9. Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
10. Restart your computer
11. Install the latest driver for the device once Windows starts.
An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:

a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. Run Driver Verifier

If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using http://www.sevenforums.com/tutorials/700-system-restore.html OPTION TWO.

Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.

pilau · Jan 30, 2012

I will go through all the steps you mentioned, Thank you very, very much.

One thing though:

writhziden said:
the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around

You didn't provide any specific information about those "memory tests"

Cheers again.

writhziden · Jan 30, 2012

pilau said:
I will go through all the steps you mentioned, Thank you very, very much.

One thing though:

writhziden said:

the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around

Click to expand...

You didn't provide any specific information about those "memory tests"

Cheers again.

Ah, sorry, that is a general statement pertaining to the steps if you are supposed to test memory. You may need to test your RAM at some point, in which case you can run that step concurrently with any other steps given at that time, but for now, just follow the steps provided.

pilau · Jan 30, 2012

Fair enough. Is there a specific type of RAM test I should be aware of and perform? RAM is a pretty complex thing AFAIK...

Regarding the drivers - The iteatapi.sys one is for the ITE IT8211 IDE controller, and is the most recent one (version 1.3.4.3) and is even the original from ITE Tech and not MS.

e100b325.sys is the driver for the Intel Pro100 network adapter. The driver I am using is the most recent version according to Intel's websites (version 8.0.47.1) however it's labeled as a Microsoft driver and not Intel. I couldn't verify what specific version of Intel Pro100 is installed on my Asus P5GD1-VM motherboard though, if it matters. Intel's automatic driver utility gathered I am using the most recent version of the driver, as well.

Interestingly those two drivers you pointed me to sit under the same node when you choose to view items by connection in device manager. (on Intel 82801 PCI Bridge - 244E) along with a professional audio card by M-Audio (Audiophile 192). Professional sound cards are known to cause problems with IRQ mainly but other system and driver related problems also occur a lot with these professional sound cards. I however have never had any problems with this card and IF I recall correctly, the BSODs appeared even before installing the card, so...

Looking forward to reading you input on everything. Thank you very much.

writhziden · Jan 30, 2012

Neither of those drivers was blamed directly for the fault, so we may not have to worry about them yet. Both of your crashes were probably network related with uTorrent and afd.sys being described in the crashes. What device do you use to connect to the internet?

pilau · Jan 30, 2012

I use the Intel Pro100 (onboard) Ethernet adapter. Here are the two new crashes dump files.

writhziden · Jan 30, 2012

Code:

Loading Dump File [K:\BSODDmpFiles\pilau\013012-21890-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x83044000 PsLoadedModuleList = 0x83184230
Debug session time: Sun Jan 29 20:48:09.468 2012 (GMT-7)
System Uptime: 0 days 16:59:13.375
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {4, 2, 1, 8309b2eb}

Probably caused by : ntkrnlmp.exe ( nt!KiTimerExpiration+15f )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8309b2eb, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from 831a3828
Unable to read MiSystemVaType memory at 83183d80
 00000004 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiTimerExpiration+15f
8309b2eb 894a04          mov     dword ptr [edx+4],ecx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  80ddec0c -- (.trap 0xffffffff80ddec0c)
ErrCode = 00000002
eax=80dc00d0 ebx=80dc42e8 ecx=80dc42ec edx=00000000 esi=80dc42ec edi=80dc3a80
eip=8309b2eb esp=80ddec80 ebp=80ddecdc iopl=0         nv up ei ng nz ac pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010297
nt!KiTimerExpiration+0x15f:
8309b2eb 894a04          mov     dword ptr [edx+4],ecx ds:0023:00000004=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 8309b2eb to 8307cc3b

STACK_TEXT:  
80ddec0c 8309b2eb badb0d00 00000000 83010479 nt!KiTrap0E+0x2cf
80ddecdc 8309979e 003bb857 85a09030 80dc7800 nt!KiTimerExpiration+0x15f
80dded20 830995c8 00000000 0000000e 3f3f3f3f nt!KiRetireDpcList+0xcb
80dded24 00000000 0000000e 3f3f3f3f 3f3f3f3f nt!KiIdleLoop+0x38


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiTimerExpiration+15f
8309b2eb 894a04          mov     dword ptr [edx+4],ecx

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!KiTimerExpiration+15f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ea76e9b

FAILURE_BUCKET_ID:  0xA_nt!KiTimerExpiration+15f

BUCKET_ID:  0xA_nt!KiTimerExpiration+15f

Followup: MachineOwner
---------

This crash was fairly inconclusive. Possible causes are Memory problems... Corrupted hard disk system files... Corrupted System Files... Lack of Windows updates... Antivirus Software...

Code:

Loading Dump File [K:\BSODDmpFiles\pilau\012912-29687-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x83005000 PsLoadedModuleList = 0x83145230
Debug session time: Sun Jan 29 03:45:35.289 2012 (GMT-7)
System Uptime: 0 days 18:08:41.211
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {8, 2, 0, 89c8a066}

Probably caused by : NETIO.SYS ( NETIO!NsiEnumerateObjectsAllParametersEx+187 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000008, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 89c8a066, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 83164828
Unable to read MiSystemVaType memory at 83144d80
 00000008 

CURRENT_IRQL:  2

FAULTING_IP: 
tcpip!IppFillPathInformation+e5
89c8a066 8b5b04          mov     ebx,dword ptr [ebx+4]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  9ac77914 -- (.trap 0xffffffff9ac77914)
ErrCode = 00000000
eax=8666d3b0 ebx=00000004 ecx=00000000 edx=00000001 esi=9ac779b4 edi=86e600c0
eip=89c8a066 esp=9ac77988 ebp=9ac77994 iopl=0         nv up ei ng nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010282
tcpip!IppFillPathInformation+0xe5:
89c8a066 8b5b04          mov     ebx,dword ptr [ebx+4] ds:0023:00000008=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 89c8a066 to 8303dc3b

STACK_TEXT:  
9ac77914 89c8a066 badb0d00 00000001 9ac77a80 nt!KiTrap0E+0x2cf
9ac77994 89c8cc25 00000028 00000000 9ac779b4 tcpip!IppFillPathInformation+0xe5
9ac77a24 89c9e7fd 00000010 86e600c0 85d02784 tcpip!IppFillPathRodUnderLock+0x26
9ac77a94 89afbfe2 9ac77aac 00000024 85d02000 tcpip!Ipv6EnumerateAllPaths+0x146
9ac77b4c 90874ba1 85d02000 0a40f944 0000003c NETIO!NsiEnumerateObjectsAllParametersEx+0x187
9ac77bc0 90875efc 85d0203c 00000000 85d02054 nsiproxy!NsippEnumerateObjectsAllParameters+0xeb
9ac77be4 90875fe5 856a5401 00000000 86e2dbf8 nsiproxy!NsippDispatchDeviceControl+0x78
9ac77bfc 83034012 864f1270 856a54b0 856a54b0 nsiproxy!NsippDispatch+0x33
9ac77c14 83209a5d 86e2dbf8 856a54b0 856a5520 nt!IofCallDriver+0x63
9ac77c34 8320be50 864f1270 86e2dbf8 00000000 nt!IopSynchronousServiceTail+0x1f8
9ac77cd0 83212dff 864f1270 856a54b0 00000000 nt!IopXxxControlFile+0x6aa
9ac77d04 8303a85a 0000011c 000003f8 00000000 nt!NtDeviceIoControlFile+0x2a
9ac77d04 77357094 0000011c 000003f8 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0116f648 00000000 00000000 00000000 00000000 0x77357094


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!NsiEnumerateObjectsAllParametersEx+187
89afbfe2 8945fc          mov     dword ptr [ebp-4],eax

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  NETIO!NsiEnumerateObjectsAllParametersEx+187

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce78963

FAILURE_BUCKET_ID:  0xD1_NETIO!NsiEnumerateObjectsAllParametersEx+187

BUCKET_ID:  0xD1_NETIO!NsiEnumerateObjectsAllParametersEx+187

Followup: MachineOwner
---------

These crashes are usually due to network adapter problems (drivers, bad hardware) or antivirus software. Do you have any antivirus software installed on your system? If so, what is it?

pilau · Jan 30, 2012

I do have - NOD32 version 4

writhziden · Jan 30, 2012

ESET? Has a pretty good reputation on here for not causing crashes too often. We'll leave it for now. Start with the Verifier steps and we'll see if any drivers pop out of the system.

Random BSOD, sometimes when playing video

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

Closed by request.

My Computer

New member

My Computer

Closed by request.

My Computer

New member

My Computer

Closed by request.

My Computer

New member

My Computer

Closed by request.

My Computer

New member

My Computer

Closed by request.

My Computer