Sudden frequent BSODs

[coldrain]

My specs:

Sony Vaio VPCF12M1E 1 year old laptop
Windows 7 Home Premium x64 OEM

Up until now i never experienced any BSODs whatsoever, starting yesterday though i had several and they continue today. They are mostly happening while I'm playing back videos but happened also when pc was idle.

Any help would be greatly appreciated!

Thanks

 

[Maguscreed]

Okay nothing immediately jumped out so we're going to try another route. Let's enable driver verifier and see if we can get a minidump that points to something other than a core windows system file.
http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html (read the whole thread before starting as you'll need to know how to turn it back off in the event it renders the system unbootable don't get nervous it's easy)
The ideal is to create a minidump that's specific to a problematic driver instead of a core windows system file, that's crashing as a result of the bad driver.

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff800035b6719

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  mpc-hc.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff8000348d2a9 to fffff8000348dd00

STACK_TEXT:  
fffff880`03369ce8 fffff800`0348d2a9 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`03369cf0 fffff800`0348b772 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`03369e30 fffff800`035b6719 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`0338cff0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiAllocatePoolPages+0x99


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiDoubleFaultAbort+b2
fffff800`0348b772 90              nop

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiDoubleFaultAbort+b2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4d9fdd5b

FAILURE_BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2

BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2

Followup: MachineOwner
---------

2: kd> lm t n
start             end                 module name
fffff800`00bb1000 fffff800`00bbb000   kdcom    kdcom.dll    Sat Feb 05 10:52:49 2011 (4D4D8061)
fffff800`0340e000 fffff800`039f7000   nt       ntkrnlmp.exe Fri Apr 08 23:15:23 2011 (4D9FDD5B)
fffff800`039f7000 fffff800`03a40000   hal      hal.dll      Sat Nov 20 07:00:25 2010 (4CE7C669)
fffff880`00c43000 fffff880`00c92000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Sat Nov 20 07:03:51 2010 (4CE7C737)
fffff880`00c92000 fffff880`00ca6000   PSHED    PSHED.dll    Mon Jul 13 20:32:23 2009 (4A5BE027)
fffff880`00ca6000 fffff880`00d04000   CLFS     CLFS.SYS     Mon Jul 13 18:19:57 2009 (4A5BC11D)
fffff880`00d04000 fffff880`00dc4000   CI       CI.dll       Sat Nov 20 07:12:36 2010 (4CE7C944)
fffff880`00e00000 fffff880`00e5c000   volmgrx  volmgrx.sys  Sat Nov 20 03:20:43 2010 (4CE792EB)
fffff880`00e5c000 fffff880`00e76000   mountmgr mountmgr.sys Sat Nov 20 03:19:21 2010 (4CE79299)
fffff880`00e76000 fffff880`00eb9000   ks       ks.sys       Sat Nov 20 04:33:23 2010 (4CE7A3F3)
fffff880`00ebf000 fffff880`00f63000   Wdf01000 Wdf01000.sys Mon Jul 13 18:22:07 2009 (4A5BC19F)
fffff880`00f63000 fffff880`00f72000   WDFLDR   WDFLDR.SYS   Mon Jul 13 18:19:54 2009 (4A5BC11A)
fffff880`00f72000 fffff880`00fa5000   pci      pci.sys      Sat Nov 20 03:19:11 2010 (4CE7928F)
fffff880`00fa5000 fffff880`00fba000   volmgr   volmgr.sys   Sat Nov 20 03:19:28 2010 (4CE792A0)
fffff880`01000000 fffff880`0102f000   SCSIPORT SCSIPORT.SYS Sat Nov 20 04:34:01 2010 (4CE7A419)
fffff880`0102f000 fffff880`01086000   ACPI     ACPI.sys     Sat Nov 20 03:19:16 2010 (4CE79294)
fffff880`01086000 fffff880`01090000   msisadrv msisadrv.sys Mon Jul 13 18:19:26 2009 (4A5BC0FE)
fffff880`01090000 fffff880`0109d000   vdrvroot vdrvroot.sys Mon Jul 13 19:01:31 2009 (4A5BCADB)
fffff880`0109d000 fffff880`010a9000   BATTC    BATTC.SYS    Mon Jul 13 18:31:01 2009 (4A5BC3B5)
fffff880`010b0000 fffff880`011d6000   sptd     sptd.sys     Sun Oct 11 15:55:14 2009 (4AD24632)
fffff880`011d6000 fffff880`011df000   WMILIB   WMILIB.SYS   Mon Jul 13 18:19:51 2009 (4A5BC117)
fffff880`011df000 fffff880`011f4000   partmgr  partmgr.sys  Sat Nov 20 03:20:00 2010 (4CE792C0)
fffff880`011f4000 fffff880`011fd000   compbatt compbatt.sys Mon Jul 13 18:31:02 2009 (4A5BC3B6)
fffff880`01200000 fffff880`0121e000   dfsc     dfsc.sys     Sat Nov 20 03:26:31 2010 (4CE79447)
fffff880`0121e000 fffff880`01240000   avipbb   avipbb.sys   Mon Feb 22 04:08:50 2010 (4B8257B2)
fffff880`01240000 fffff880`01266000   tunnel   tunnel.sys   Sat Nov 20 04:51:50 2010 (4CE7A846)
fffff880`0126e000 fffff880`01476000   iaStor   iaStor.sys   Fri Nov 20 17:09:41 2009 (4B0721B5)
fffff880`01476000 fffff880`0147f000   atapi    atapi.sys    Mon Jul 13 18:19:47 2009 (4A5BC113)
fffff880`0147f000 fffff880`014a9000   ataport  ataport.SYS  Sat Nov 20 03:19:15 2010 (4CE79293)
fffff880`014a9000 fffff880`014b4000   amdxata  amdxata.sys  Fri Mar 19 11:18:18 2010 (4BA3A3CA)
fffff880`014b4000 fffff880`01500000   fltmgr   fltmgr.sys   Sat Nov 20 03:19:24 2010 (4CE7929C)
fffff880`01500000 fffff880`01514000   fileinfo fileinfo.sys Mon Jul 13 18:34:25 2009 (4A5BC481)
fffff880`01514000 fffff880`01572000   msrpc    msrpc.sys    Sat Nov 20 03:21:56 2010 (4CE79334)
fffff880`01572000 fffff880`015e4000   cng      cng.sys      Sat Nov 20 04:08:45 2010 (4CE79E2D)
fffff880`01600000 fffff880`01611000   blbdrive blbdrive.sys Mon Jul 13 18:35:59 2009 (4A5BC4DF)
fffff880`0161b000 fffff880`017be000   Ntfs     Ntfs.sys     Thu Mar 10 21:39:39 2011 (4D79997B)
fffff880`017be000 fffff880`017d9000   ksecdd   ksecdd.sys   Sat Nov 20 03:21:15 2010 (4CE7930B)
fffff880`017d9000 fffff880`017ea000   pcw      pcw.sys      Mon Jul 13 18:19:27 2009 (4A5BC0FF)
fffff880`017ea000 fffff880`017f4000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 18:19:45 2009 (4A5BC111)
fffff880`01800000 fffff880`0182b000   ksecpkg  ksecpkg.sys  Sat Nov 20 04:10:34 2010 (4CE79E9A)
fffff880`0182b000 fffff880`0187c000   rdbss    rdbss.sys    Sat Nov 20 03:27:51 2010 (4CE79497)
fffff880`0187c000 fffff880`01887000   mssmbios mssmbios.sys Mon Jul 13 18:31:10 2009 (4A5BC3BE)
fffff880`01887000 fffff880`01896000   discache discache.sys Mon Jul 13 18:37:18 2009 (4A5BC52E)
fffff880`0189f000 fffff880`01992000   ndis     ndis.sys     Sat Nov 20 03:23:30 2010 (4CE79392)
fffff880`01992000 fffff880`019f2000   NETIO    NETIO.SYS    Sat Nov 20 03:23:13 2010 (4CE79381)
fffff880`01a00000 fffff880`01a30000   CLASSPNP CLASSPNP.SYS Sat Nov 20 03:19:23 2010 (4CE7929B)
fffff880`01a3e000 fffff880`01a64000   pacer    pacer.sys    Sat Nov 20 04:52:18 2010 (4CE7A862)
fffff880`01a64000 fffff880`01a73000   netbios  netbios.sys  Mon Jul 13 19:09:26 2009 (4A5BCCB6)
fffff880`01a73000 fffff880`01a8e000   wanarp   wanarp.sys   Sat Nov 20 04:52:36 2010 (4CE7A874)
fffff880`01a8e000 fffff880`01aa2000   termdd   termdd.sys   Sat Nov 20 05:03:40 2010 (4CE7AB0C)
fffff880`01aa9000 fffff880`01cad000   tcpip    tcpip.sys    Sat Nov 20 03:25:52 2010 (4CE79420)
fffff880`01cad000 fffff880`01cf7000   fwpkclnt fwpkclnt.sys Sat Nov 20 03:21:37 2010 (4CE79321)
fffff880`01cf7000 fffff880`01d43000   volsnap  volsnap.sys  Sat Nov 20 03:20:08 2010 (4CE792C8)
fffff880`01d43000 fffff880`01d4b000   spldr    spldr.sys    Mon May 11 11:56:27 2009 (4A0858BB)
fffff880`01d4b000 fffff880`01d85000   rdyboost rdyboost.sys Sat Nov 20 03:43:10 2010 (4CE7982E)
fffff880`01d85000 fffff880`01d97000   mup      mup.sys      Mon Jul 13 18:23:45 2009 (4A5BC201)
fffff880`01d97000 fffff880`01da0000   hwpolicy hwpolicy.sys Sat Nov 20 03:18:54 2010 (4CE7927E)
fffff880`01da0000 fffff880`01dda000   fvevol   fvevol.sys   Sat Nov 20 03:24:06 2010 (4CE793B6)
fffff880`01dda000 fffff880`01df0000   disk     disk.sys     Mon Jul 13 18:19:57 2009 (4A5BC11D)
fffff880`01df0000 fffff880`01dfc000   nsiproxy nsiproxy.sys Mon Jul 13 18:21:02 2009 (4A5BC15E)
fffff880`02200000 fffff880`02287000   btwaudio btwaudio.sys Fri Feb 12 17:49:33 2010 (4B75E90D)
fffff880`02287000 fffff880`02295000   btwl2cap btwl2cap.sys Mon Mar 01 20:25:23 2010 (4B8C7713)
fffff880`02295000 fffff880`02298a00   btwrchid btwrchid.sys Wed Jan 13 18:05:35 2010 (4B4E5FCF)
fffff880`02299000 fffff880`022b0000   LEqdUsb  LEqdUsb.Sys  Tue Aug 24 12:21:23 2010 (4C73FF93)
fffff880`022b0000 fffff880`022be000   kbdhid   kbdhid.sys   Sat Nov 20 04:33:25 2010 (4CE7A3F5)
fffff880`022be000 fffff880`022c6000   LHidEqd  LHidEqd.Sys  Tue Aug 24 12:21:26 2010 (4C73FF96)
fffff880`022c7000 fffff880`024cf000   dump_iaStor dump_iaStor.sys Fri Nov 20 17:09:41 2009 (4B0721B5)
fffff880`024cf000 fffff880`024e2000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 18:21:51 2009 (4A5BC18F)
fffff880`024e2000 fffff880`0250e000   rfcomm   rfcomm.sys   Mon Jul 13 19:06:56 2009 (4A5BCC20)
fffff880`0250e000 fffff880`0251e000   BthEnum  BthEnum.sys  Mon Jul 13 19:06:52 2009 (4A5BCC1C)
fffff880`0251e000 fffff880`0253e000   bthpan   bthpan.sys   Mon Jul 13 19:07:00 2009 (4A5BCC24)
fffff880`0253e000 fffff880`02555000   bthmodem bthmodem.sys Mon Jul 13 19:06:52 2009 (4A5BCC1C)
fffff880`02555000 fffff880`02564000   modem    modem.sys    Mon Jul 13 19:10:48 2009 (4A5BCD08)
fffff880`02564000 fffff880`025e1000   btwavdt  btwavdt.sys  Wed Jan 13 18:03:59 2010 (4B4E5F6F)
fffff880`025e1000 fffff880`025ef000   monitor  monitor.sys  Mon Jul 13 18:38:52 2009 (4A5BC58C)
fffff880`025ef000 fffff880`025f9000   vwifimp  vwifimp.sys  Mon Jul 13 19:07:28 2009 (4A5BCC40)
fffff880`03000000 fffff880`03024000   HDAudBus HDAudBus.sys Sat Nov 20 04:43:42 2010 (4CE7A65E)
fffff880`03024000 fffff880`03035000   usbehci  usbehci.sys  Thu Mar 24 22:29:04 2011 (4D8C0C00)
fffff880`03035000 fffff880`0308b000   USBPORT  USBPORT.SYS  Thu Mar 24 22:29:12 2011 (4D8C0C08)
fffff880`0308b000 fffff880`030a3000   rspndr   rspndr.sys   Mon Jul 13 19:08:50 2009 (4A5BCC92)
fffff880`030a4000 fffff880`03198000   dxgkrnl  dxgkrnl.sys  Sat Nov 20 03:50:50 2010 (4CE799FA)
fffff880`03198000 fffff880`031de000   dxgmms1  dxgmms1.sys  Sat Nov 20 03:49:53 2010 (4CE799C1)
fffff880`031de000 fffff880`031fc000   bowser   bowser.sys   Tue Feb 22 22:55:04 2011 (4D649328)
fffff880`04200000 fffff880`04245000   netbt    netbt.sys    Sat Nov 20 03:23:18 2010 (4CE79386)
fffff880`04245000 fffff880`042ce000   afd      afd.sys      Sat Nov 20 03:23:27 2010 (4CE7938F)
fffff880`042ce000 fffff880`042d9000   ws2ifsl  ws2ifsl.sys  Mon Jul 13 19:10:33 2009 (4A5BCCF9)
fffff880`042d9000 fffff880`04365000   bthport  bthport.sys  Sat Nov 20 04:44:51 2010 (4CE7A6A3)
fffff880`04365000 fffff880`0442e000   HTTP     HTTP.sys     Sat Nov 20 03:24:30 2010 (4CE793CE)
fffff880`0442e000 fffff880`0445b000   mrxsmb   mrxsmb.sys   Tue Feb 22 22:56:22 2011 (4D649376)
fffff880`0445b000 fffff880`044a8000   mrxsmb10 mrxsmb10.sys Tue Feb 22 22:55:12 2011 (4D649330)
fffff880`044a8000 fffff880`044cc000   mrxsmb20 mrxsmb20.sys Tue Feb 22 22:55:12 2011 (4D649330)
fffff880`044f6000 fffff880`04520000   cdrom    cdrom.sys    Sat Nov 20 03:19:20 2010 (4CE79298)
fffff880`04520000 fffff880`04529000   Null     Null.SYS     Mon Jul 13 18:19:37 2009 (4A5BC109)
fffff880`04529000 fffff880`04530000   Beep     Beep.SYS     Mon Jul 13 19:00:13 2009 (4A5BCA8D)
fffff880`04530000 fffff880`0453e000   vga      vga.sys      Mon Jul 13 18:38:47 2009 (4A5BC587)
fffff880`0453e000 fffff880`04563000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 18:38:51 2009 (4A5BC58B)
fffff880`04563000 fffff880`04573000   watchdog watchdog.sys Mon Jul 13 18:37:35 2009 (4A5BC53F)
fffff880`04573000 fffff880`0457c000   RDPCDD   RDPCDD.sys   Mon Jul 13 19:16:34 2009 (4A5BCE62)
fffff880`0457c000 fffff880`04585000   rdpencdd rdpencdd.sys Mon Jul 13 19:16:34 2009 (4A5BCE62)
fffff880`04585000 fffff880`0458e000   rdprefmp rdprefmp.sys Mon Jul 13 19:16:35 2009 (4A5BCE63)
fffff880`0458e000 fffff880`04599000   Msfs     Msfs.SYS     Mon Jul 13 18:19:47 2009 (4A5BC113)
fffff880`04599000 fffff880`045aa000   Npfs     Npfs.SYS     Mon Jul 13 18:19:48 2009 (4A5BC114)
fffff880`045aa000 fffff880`045cc000   tdx      tdx.sys      Sat Nov 20 03:21:54 2010 (4CE79332)
fffff880`045cc000 fffff880`045d9000   TDI      TDI.SYS      Sat Nov 20 03:22:06 2010 (4CE7933E)
fffff880`045d9000 fffff880`045e2000   wfplwf   wfplwf.sys   Mon Jul 13 19:09:26 2009 (4A5BCCB6)
fffff880`045e2000 fffff880`045f8000   vwififlt vwififlt.sys Mon Jul 13 19:07:22 2009 (4A5BCC3A)
fffff880`04c00000 fffff880`04c1e000   i8042prt i8042prt.sys Mon Jul 13 18:19:57 2009 (4A5BC11D)
fffff880`04c1e000 fffff880`04c2d000   kbdclass kbdclass.sys Mon Jul 13 18:19:50 2009 (4A5BC116)
fffff880`04c3a000 fffff880`052e7000   NETw5s64 NETw5s64.sys Tue Sep 15 14:40:39 2009 (4AAFEDB7)
fffff880`052e7000 fffff880`052f4000   vwifibus vwifibus.sys Mon Jul 13 19:07:21 2009 (4A5BCC39)
fffff880`052f4000 fffff880`05314000   sdbus    sdbus.sys    Sat Nov 20 03:37:42 2010 (4CE796E6)
fffff880`05314000 fffff880`05334000   rimssne64 rimssne64.sys Wed Dec 16 00:10:18 2009 (4B2879CA)
fffff880`05334000 fffff880`05372000   1394ohci 1394ohci.sys Sat Nov 20 04:44:56 2010 (4CE7A6A8)
fffff880`05372000 fffff880`0538b000   risdsne64 risdsne64.sys Fri Dec 25 04:02:58 2009 (4B348DD2)
fffff880`0538b000 fffff880`053ef000   yk62x64  yk62x64.sys  Mon Jun 15 11:49:34 2009 (4A367B9E)
fffff880`05600000 fffff880`05612000   umbus    umbus.sys    Sat Nov 20 04:44:37 2010 (4CE7A695)
fffff880`05612000 fffff880`05625000   ndisuio  ndisuio.sys  Sat Nov 20 04:50:08 2010 (4CE7A7E0)
fffff880`05630000 fffff880`0567f000   Apfiltr  Apfiltr.sys  Tue Feb 23 09:06:35 2010 (4B83EEFB)
fffff880`0567f000 fffff880`0568e000   mouclass mouclass.sys Mon Jul 13 18:19:50 2009 (4A5BC116)
fffff880`0568e000 fffff880`05690f00   SFEP     SFEP.sys     Thu Nov 26 23:39:13 2009 (4B0F6601)
fffff880`05691000 fffff880`056b7c00   Impcd    Impcd.sys    Wed Feb 10 17:01:59 2010 (4B733AE7)
fffff880`056b8000 fffff880`056fd000   aw6ar4rl aw6ar4rl.SYS Tue Jul 14 16:12:55 2009 (4A5CF4D7)
fffff880`056fd000 fffff880`05706000   wmiacpi  wmiacpi.sys  Mon Jul 13 18:31:02 2009 (4A5BC3B6)
fffff880`05706000 fffff880`0571c000   intelppm intelppm.sys Mon Jul 13 18:19:25 2009 (4A5BC0FD)
fffff880`0571c000 fffff880`05720500   CmBatt   CmBatt.sys   Mon Jul 13 18:31:03 2009 (4A5BC3B7)
fffff880`05721000 fffff880`05731000   CompositeBus CompositeBus.sys Sat Nov 20 04:33:17 2010 (4CE7A3ED)
fffff880`05731000 fffff880`05747000   AgileVpn AgileVpn.sys Mon Jul 13 19:10:24 2009 (4A5BCCF0)
fffff880`05747000 fffff880`0576b000   rasl2tp  rasl2tp.sys  Sat Nov 20 04:52:34 2010 (4CE7A872)
fffff880`0576b000 fffff880`05777000   ndistapi ndistapi.sys Mon Jul 13 19:10:00 2009 (4A5BCCD8)
fffff880`05777000 fffff880`057a6000   ndiswan  ndiswan.sys  Sat Nov 20 04:52:32 2010 (4CE7A870)
fffff880`057a6000 fffff880`057c1000   raspppoe raspppoe.sys Mon Jul 13 19:10:17 2009 (4A5BCCE9)
fffff880`057c1000 fffff880`057e2000   raspptp  raspptp.sys  Sat Nov 20 04:52:31 2010 (4CE7A86F)
fffff880`057e2000 fffff880`057fc000   rassstp  rassstp.sys  Mon Jul 13 19:10:25 2009 (4A5BCCF1)
fffff880`057fc000 fffff880`057fd480   swenum   swenum.sys   Mon Jul 13 19:00:18 2009 (4A5BCA92)
fffff880`05a01000 fffff880`065daa80   nvlddmkm nvlddmkm.sys Sat Oct 16 12:12:46 2010 (4CB9DD0E)
fffff880`065db000 fffff880`065dc180   nvBridge nvBridge.kmd Sat Oct 16 12:06:16 2010 (4CB9DB88)
fffff880`065dd000 fffff880`065f5000   mpsdrv   mpsdrv.sys   Mon Jul 13 19:08:25 2009 (4A5BCC79)
fffff880`06800000 fffff880`06821000   WudfPf   WudfPf.sys   Sat Nov 20 04:42:44 2010 (4CE7A624)
fffff880`06821000 fffff880`06836000   lltdio   lltdio.sys   Mon Jul 13 19:08:50 2009 (4A5BCC92)
fffff880`06836000 fffff880`06889000   nwifi    nwifi.sys    Mon Jul 13 19:07:23 2009 (4A5BCC3B)
fffff880`0688a000 fffff880`068e4000   usbhub   usbhub.sys   Thu Mar 24 22:29:25 2011 (4D8C0C15)
fffff880`068e4000 fffff880`068f9000   NDProxy  NDProxy.SYS  Sat Nov 20 04:52:20 2010 (4CE7A864)
fffff880`068f9000 fffff880`06926000   nvhda64v nvhda64v.sys Thu Mar 03 09:59:02 2011 (4D6FBAC6)
fffff880`06926000 fffff880`06963000   portcls  portcls.sys  Mon Jul 13 19:06:27 2009 (4A5BCC03)
fffff880`06963000 fffff880`06985000   drmk     drmk.sys     Mon Jul 13 20:01:25 2009 (4A5BD8E5)
fffff880`06985000 fffff880`0698a200   ksthunk  ksthunk.sys  Mon Jul 13 19:00:19 2009 (4A5BCA93)
fffff880`0698b000 fffff880`06998000   mouhid   mouhid.sys   Mon Jul 13 19:00:20 2009 (4A5BCA94)
fffff880`06998000 fffff880`069ac000   LMouFilt LMouFilt.Sys Tue Aug 24 12:21:43 2010 (4C73FFA7)
fffff880`069ac000 fffff880`069ba000   crashdmp crashdmp.sys Mon Jul 13 19:01:01 2009 (4A5BCABD)
fffff880`069ba000 fffff880`069dd000   luafv    luafv.sys    Mon Jul 13 18:26:13 2009 (4A5BC295)
fffff880`069dd000 fffff880`069fa000   avgntflt avgntflt.sys Thu Nov 11 09:59:48 2010 (4CDC12F4)
fffff880`08400000 fffff880`08415000   LHidFilt LHidFilt.Sys Tue Aug 24 12:21:36 2010 (4C73FFA0)
fffff880`08418000 fffff880`08640780   RTKVHD64 RTKVHD64.sys Tue Feb 09 09:28:17 2010 (4B717F11)
fffff880`08641000 fffff880`0865e000   usbccgp  usbccgp.sys  Thu Mar 24 22:29:14 2011 (4D8C0C0A)
fffff880`0865e000 fffff880`0865ff00   USBD     USBD.SYS     Thu Mar 24 22:28:59 2011 (4D8C0BFB)
fffff880`08660000 fffff880`0868d280   usbvideo usbvideo.sys Sat Nov 20 04:44:34 2010 (4CE7A692)
fffff880`0868e000 fffff880`08698000   ArcSoftKsUFilter ArcSoftKsUFilter.sys Mon May 25 03:27:31 2009 (4A1A5673)
fffff880`08698000 fffff880`08797000   btwampfl btwampfl.sys Fri Feb 12 16:16:16 2010 (4B75D330)
fffff880`08797000 fffff880`087af000   BTHUSB   BTHUSB.sys   Sat Nov 20 04:44:33 2010 (4CE7A691)
fffff880`087af000 fffff880`087bb000   Dxapi    Dxapi.sys    Mon Jul 13 18:38:28 2009 (4A5BC574)
fffff880`087bb000 fffff880`087cb000   LUsbFilt LUsbFilt.Sys Tue Aug 24 12:21:47 2010 (4C73FFAB)
fffff880`087cb000 fffff880`087d9000   hidusb   hidusb.sys   Sat Nov 20 04:43:49 2010 (4CE7A665)
fffff880`087d9000 fffff880`087f2000   HIDCLASS HIDCLASS.SYS Sat Nov 20 04:43:49 2010 (4CE7A665)
fffff880`087f2000 fffff880`087fa080   HIDPARSE HIDPARSE.SYS Mon Jul 13 19:06:17 2009 (4A5BCBF9)
fffff880`0b638000 fffff880`0b6de000   peauth   peauth.sys   Mon Jul 13 20:01:19 2009 (4A5BD8DF)
fffff880`0b6de000 fffff880`0b6e6000   regi     regi.sys     Mon Apr 16 10:19:10 2007 (462393EE)
fffff880`0b6e6000 fffff880`0b6f1000   secdrv   secdrv.SYS   Wed Sep 13 08:18:38 2006 (4508052E)
fffff880`0b6f1000 fffff880`0b722000   srvnet   srvnet.sys   Tue Feb 22 22:55:44 2011 (4D649350)
fffff880`0b722000 fffff880`0b734000   tcpipreg tcpipreg.sys Sat Nov 20 04:51:48 2010 (4CE7A844)
fffff880`0b734000 fffff880`0b73f000   tdtcp    tdtcp.sys    Mon Jul 13 19:16:32 2009 (4A5BCE60)
fffff880`0b73f000 fffff880`0b74e000   tssecsrv tssecsrv.sys Sat Nov 20 05:04:09 2010 (4CE7AB29)
fffff880`0b74e000 fffff880`0b787000   RDPWD    RDPWD.SYS    Sat Nov 20 05:04:37 2010 (4CE7AB45)
fffff880`0b787000 fffff880`0b7f1000   srv2     srv2.sys     Tue Feb 22 22:56:00 2011 (4D649360)
fffff880`0c460000 fffff880`0c4f8000   srv      srv.sys      Tue Feb 22 22:56:21 2011 (4D649375)
fffff880`0c4f8000 fffff880`0c527000   ipnat    ipnat.sys    Mon Jul 13 19:10:03 2009 (4A5BCCDB)
fffff960`00070000 fffff960`00382000   win32k   win32k.sys   Wed Mar 02 21:51:40 2011 (4D6F104C)
fffff960`00530000 fffff960`0053a000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff960`006c0000 fffff960`006e7000   cdd      cdd.dll      Sat Nov 20 06:55:34 2010 (4CE7C546)
fffff960`00940000 fffff960`009a1000   ATMFD    ATMFD.DLL    Sat Feb 19 03:00:32 2011 (4D5F86B0)

Unloaded modules:
fffff880`0c527000 fffff880`0c598000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00071000
fffff880`01a30000 fffff880`01a3e000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff880`042db000 fffff880`044e3000   dump_iaStor.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00208000
fffff880`044e3000 fffff880`044f6000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00013000

 

[coldrain]

I tried it and windows couldn't load. I got 2 bluescreens and 2 restarts before the windows login screen appears then after the 3rd restart it froze on the windows logo screen. I had to remove battery>safemode>disable verifier to make it load.

 

[Maguscreed]

This is actually what I wanted believe it or not.

There should be a couple of new files in the windows\minidump folder
please zip/rar and upload those now.

 

[coldrain]

Actually there is nothing new, maybe it's because i removed the battery?

 

[usasma]

Pardon my jumping in here, but I noticed this error in MSINFO32:

Security Processor Loader Driver ROOT\LEGACY_SPLDR\0000 This device is not present, is not working properly, or does not have all its drivers installed.

I frequently get this error at work when malware is involved. Have you scanned with MalwareBytes AntiMalware? Did it find any infections? Also, if you had problems with the scan, please try a couple of these free online scans: Free Online AntiMalware Resources (read the details at the link)

 

[Maguscreed]

Actually there is nothing new, maybe it's because i removed the battery?

That is quite odd please follow the above advice.
It would seem the security loader has been compromised somehow.
His step is the next best thing to do.

 

[coldrain]

Actually there is nothing new, maybe it's because i removed the battery?

That is quite odd please follow the above advice.
It would seem the security loader has been compromised somehow.
His step is the next best thing to do.

Ok, Done. It found a few infected files and i cleaned them. What's next, wait to see if i get BSODs again?

 

[coldrain]

I just tried the Verifier again and this time it worked and windows loaded. I guess i should just wait now?

 

[usasma]

Wait for Driver Verifier to cause the system to crash with a BSOD (I suggest waiting at least 36 hours of continuous operation).

While waiting, run the scans from BitDefender, Panda and Kaspersky to see if they come up clean.
Keep running scans until things come up clean at least 2 times in a row. If you run out of scans, use the Rescue CD entries also. Once it's cleaned up, then see if you get further BSOD's.

I'm going to bow out now, since my intent wasn't to hijack this thread - but rather to suggest another approach.
Thanks for the work that you've done - and good luck to you!

 

[coldrain]

Wait for Driver Verifier to cause the system to crash with a BSOD (I suggest waiting at least 36 hours of continuous operation).

While waiting, run the scans from BitDefender, Panda and Kaspersky to see if they come up clean.
Keep running scans until things come up clean at least 2 times in a row. If you run out of scans, use the Rescue CD entries also. Once it's cleaned up, then see if you get further BSOD's.

I'm going to bow out now, since my intent wasn't to hijack this thread - but rather to suggest another approach.
Thanks for the work that you've done - and good luck to you!

Thank you very much for your input usasma, it is greatly appreciated!

 

[Maguscreed]

No hijack man I always welcome additional input.

And since we did find some infection until we are sure it's routed out there's no point in trying to debug further anyhow.
​

 

[coldrain]

Ok i ran the verifier for 2 days straight and it didn't crash not even once. Music and videos were sometimes choppy and laggy but i guess that's cause the verifier was running in the background. Running the malware scan seems to have worked!

Can't thank you enough for the help guys, you saved me a lot of trouble!!
Cheers!!!

 

[Maguscreed]

You can disable driver verifier now, it would have caused crashes right away if there was a significant driver problem. ...and there really is no benefit to having it run all the time. Just follow the instructions in the thread linked above to turn it back off.

 

[coldrain]

Hello,

I started getting blue screens again last week. This time not as often as before. I've been getting a blue screen randomly every 24-36 hours. I ran full scans with avira professional and Malware bytes and both didn't find anything malicious.

Any suggestions?

Thanks in advance!

 

[Maguscreed]

The debugger is pointing directly to your intel wifi device (I think it's a 5100 series just based on the driver name)
http://downloadcenter.intel.com/Default.aspx
I suggest reinstalling it, and that you also consider uninstalling/reinstalling your av/security software, in case they have gotten over zealous and are blocking needed services or resources from the device.

Probably caused by : NETw5s64.sys ( NETw5s64+b6bd )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800039ed7f7, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036af100
 0000000000000008 

CURRENT_IRQL:  2

FAULTING_IP: 
hal!HalPutScatterGatherList+a7
fffff800`039ed7f7 4d8b642408      mov     r12,qword ptr [r12+8]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff8800e3a33e0 -- (.trap 0xfffff8800e3a33e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000001
rdx=0000000000000fff rsi=0000000000000000 rdi=0000000000000000
rip=fffff800039ed7f7 rsp=fffff8800e3a3570 rbp=0000000000000b04
 r8=0000000000000000  r9=fffffa8003c78b04 r10=0100000000000001
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
hal!HalPutScatterGatherList+0xa7:
fffff800`039ed7f7 4d8b642408      mov     r12,qword ptr [r12+8] ds:69f0:00000000`00000008=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000347c1e9 to fffff8000347cc40

STACK_TEXT:  
fffff880`0e3a3298 fffff800`0347c1e9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0e3a32a0 fffff800`0347ae60 : 00000000`000007ff fffff880`03370000 00000000`00000000 fffffa80`09e5a010 : nt!KiBugCheckDispatch+0x69
fffff880`0e3a33e0 fffff800`039ed7f7 : fffffa80`09e5a010 fffffa80`03c78b04 00000000`0000001c fffffa80`07f4e600 : nt!KiPageFault+0x260
fffff880`0e3a3570 fffff880`01873831 : fffffa80`04201470 fffffa80`03f40180 fffffa80`03f401d8 fffffa80`07038f10 : hal!HalPutScatterGatherList+0xa7
fffff880`0e3a35d0 fffff880`04c1f6bd : fffffa80`09f79fe8 fffffa80`03f401d8 00000000`00000002 00000000`000005f6 : ndis!NdisMFreeNetBufferSGList+0x31
fffff880`0e3a3610 fffffa80`09f79fe8 : fffffa80`03f401d8 00000000`00000002 00000000`000005f6 00000000`00000000 : NETw5s64+0xb6bd
fffff880`0e3a3618 fffffa80`03f401d8 : 00000000`00000002 00000000`000005f6 00000000`00000000 fffff880`04dc5ef8 : 0xfffffa80`09f79fe8
fffff880`0e3a3620 00000000`00000002 : 00000000`000005f6 00000000`00000000 fffff880`04dc5ef8 fffffa80`09f79fe8 : 0xfffffa80`03f401d8
fffff880`0e3a3628 00000000`000005f6 : 00000000`00000000 fffff880`04dc5ef8 fffffa80`09f79fe8 fffffa80`03f40180 : 0x2
fffff880`0e3a3630 00000000`00000000 : fffff880`04dc5ef8 fffffa80`09f79fe8 fffffa80`03f40180 fffffa80`03f401d8 : 0x5f6


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETw5s64+b6bd
fffff880`04c1f6bd ??              ???

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  NETw5s64+b6bd

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETw5s64

IMAGE_NAME:  NETw5s64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4aafedb7

FAILURE_BUCKET_ID:  X64_0xA_NETw5s64+b6bd

BUCKET_ID:  X64_0xA_NETw5s64+b6bd

Followup: MachineOwner
---------

 

[coldrain]

I'm going to try that!
Thanks a lot for the quick reply, much appreciated!