Random BSOD's

[darrynv]

Hi

Have 2 machines

One windows 7 64bit (business edition)
One windows 7 32bit (business edition)

Both machines randomly BSOD when working with Word documents on a SuSe 10 SP3 OES2 network server. I cannot duplicate the error as it is totally random and only affecting 2 machine in the network.

I've attached the minidump files for both machines

 

[zigzag3143]

Hi

Have 2 machines

One windows 7 64bit (business edition)
One windows 7 32bit (business edition)

Both machines randomly BSOD when working with Word documents on a SuSe 10 SP3 OES2 network server. I cannot duplicate the error as it is totally random and only affecting 2 machine in the network.

I've attached the minidump files for both machines

Business Edition??


Since it is happening on two machines I can only assume their cause is the same and that is Your novell client. I also noted the Mac OS folder. So what is the deal here?? without info I really cant help much

C:\Program Files\Novell\Client\XTier\Drivers\ncpl.sys, Win32


edit:: You Kaspersky AV isnt helping either. replace with Microsoft Security Essentials.
http://support.kaspersky.com/downloads/utils/kavremover10.zip

http://www.microsoft.com/security_essentials/

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\120210-11372-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82802000 PsLoadedModuleList = 0x8294a810
Debug session time: Wed Dec  1 18:29:36.159 2010 (GMT-5)
System Uptime: 0 days 0:13:33.953
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
......
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: baadf011, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 97452b69, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 00000002, (reserved)

Debugging Details:
------------------

Unable to load image \??\C:\Program Files\Novell\Client\XTier\Drivers\ncpl.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ncpl.sys
*** ERROR: Module load completed but symbols could not be loaded for ncpl.sys
Unable to load image \??\C:\Program Files\Novell\Client\XTier\Drivers\nccache.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nccache.sys
*** ERROR: Module load completed but symbols could not be loaded for nccache.sys
*** WARNING: Unable to verify timestamp for nciom.sys
*** ERROR: Module load completed but symbols could not be loaded for nciom.sys
*** WARNING: Unable to verify timestamp for ncfsd.sys
*** ERROR: Module load completed but symbols could not be loaded for ncfsd.sys
*** WARNING: Unable to verify timestamp for NCRecognizer.sys
*** ERROR: Module load completed but symbols could not be loaded for NCRecognizer.sys
*** WARNING: Unable to verify timestamp for NCFilter.sys
*** ERROR: Module load completed but symbols could not be loaded for NCFilter.sys
*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys

Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 8296a718
Unable to read MiSystemVaType memory at 8294a160
 baadf011 

FAULTING_IP: 
ncpl+4b69
97452b69 895104          mov     dword ptr [ecx+4],edx

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  avp.exe

CURRENT_IRQL:  0

TRAP_FRAME:  94782458 -- (.trap 0xffffffff94782458)
ErrCode = 00000002
eax=852c4998 ebx=895a7e40 ecx=baadf00d edx=baadf00d esi=852c4998 edi=852c4a10
eip=97452b69 esp=947824cc ebp=947824cc iopl=0         nv up ei ng nz ac pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010297
ncpl+0x4b69:
97452b69 895104          mov     dword ptr [ecx+4],edx ds:0023:baadf011=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82848638 to 82887903

STACK_TEXT:  
94782440 82848638 00000001 baadf011 00000000 nt!MmAccessFault+0x106
94782440 97452b69 00000001 baadf011 00000000 nt!KiTrap0E+0xdc
WARNING: Stack unwind information not available. Following frames may be wrong.
947824cc b0256ba4 885982c0 852c4998 8859a700 ncpl+0x4b69
947824e8 b0257394 00000014 00000001 b148127c nccache+0x3ba4
94782500 b02557de 852bc1b8 2b770001 c0000000 nccache+0x4394
94782518 b0255924 8859a718 b8694ae0 b148127c nccache+0x27de
9478254c 974ca95d 8859a718 b8694ae0 b148127c nccache+0x2924
9478257c 9740a904 87fafe00 853f3018 11370073 nciom+0x595d
947825b4 97405c1f 853f3000 853f406e 00000080 ncfsd+0xa904
94782638 974021e9 853f3000 00000000 851e0c28 ncfsd+0x5c1f
947826e4 97402fd4 853f3000 853c6008 853c6108 ncfsd+0x21e9
94782708 8283e4bc 8776a500 013c6008 853c612c ncfsd+0x2fd4
94782720 8b006bb0 00000103 85082d20 851e0bf8 nt!IofCallDriver+0x63
9478273c 8b005b52 85082d20 c0000016 853c6108 mup!MupiCallUncProvider+0x10f
94782754 8b005f5b 85082d20 1f786718 00000000 mup!MupStateMachine+0x9b
947827a0 8283e4bc 85d96030 853c6008 853c6008 mup!MupCreate+0x109
947827b8 82fa720c 853c6008 00000000 853c612c nt!IofCallDriver+0x63
947827dc 82fba8c9 947827fc 85d97e10 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
94782828 8283e4bc 85d97e10 85d978e0 85d972c8 fltmgr!FltpCreate+0x2db
94782840 82fd9561 0173f640 00000000 b7903ec0 nt!IofCallDriver+0x63
9478285c 82fd9712 85d972c8 853c6008 00000000 NCRecognizer+0x4561
9478287c 8283e4bc 85d972c8 853c6008 85d98020 NCRecognizer+0x4712
94782894 82e0d9de 94fac927 00000000 85d98020 nt!IofCallDriver+0x63
947828d0 82e0ae51 85d980d8 853c6008 00000397 NCFilter+0xd9de
94782998 8283e4bc 85d98020 853c6008 853c6008 NCFilter+0xae51
947829b0 82fa720c 853c6008 00000000 853c6174 nt!IofCallDriver+0x63
947829d4 82fba8c9 947829f4 86020490 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
94782a20 8283e4bc 86020490 8601f6d0 851e0c54 fltmgr!FltpCreate+0x2db
94782a38 82a426ad babd5643 94782be0 00000000 nt!IofCallDriver+0x63
94782b10 82a2326b 85d96030 85fc2838 852644c8 nt!IopParseDevice+0xed7
94782b8c 82a492d9 00000000 94782be0 00000040 nt!ObpLookupObjectName+0x4fa
94782bec 82a4162b 0173f53c 84fc2838 00000701 nt!ObOpenObjectByName+0x165
94782c68 82a4cf42 0173f598 00100080 0173f53c nt!IopCreateFile+0x673
94782cb4 8f648f34 0173f598 00100080 0173f53c nt!NtCreateFile+0x34
94782d00 8284544a 0173f598 00100080 0173f53c klif+0xef34
94782d00 776164f4 0173f598 00100080 0173f53c nt!KiFastCallEntry+0x12a
0173f5a0 00000000 00000000 00000000 00000000 0x776164f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ncpl+4b69
97452b69 895104          mov     dword ptr [ecx+4],edx

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  ncpl+4b69

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ncpl

IMAGE_NAME:  ncpl.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c4ba9f1

FAILURE_BUCKET_ID:  0x50_ncpl+4b69

BUCKET_ID:  0x50_ncpl+4b69

Followup: MachineOwner
---------