Why Blue Screen of Death every day?

Topic

New Reply

After putting windows 7 on this machine (had xp before and never did this) about once a day i will get a blue screen then a restart……it dosent stay up long enough for me to write everything down but says something to the effect of “Windows IO manager has detected a driver being naughty and is shutting down your computer and so on , at the bottom there are some codes like oxoooooc9 and several more……..i have updated my drivers like video, sound, network card but still does this…….USUALLY happens after it has been on a while like when i get on it in the morning after being inactive all nite…….any ideas on a fix or just live with it?

Reply | Quote

Replies

Full details are needed.

If you can find the minidump files (C:WindowsMinidump is default), copy them to your Desktop then zip them and upload the zip as an attachment to your next reply and someone will try to debug them.

Reply | Quote

I would also prevent Windows from automatically restarting after a BSOD, the information displayed then is useful.

Disable Automatic Reboot after Blue Screen Errors

Reply | Quote

Not sure if i did this right……..

and thanks on the “how to disable”….i’ll be able to read it now….

Reply | Quote

Was this a clean install or an upgrade from Vista?

I ran a selection of dumps through a quick debug, 1 of each type; the following drivers look to be to blame:
bckd.sys K9 parental web filter http://www1.k9webprotection.com/ <——- many dumps blame this!
Dot4.sys USB printer driver error? <———- Std. Windows file so probably something else caused this; USB related, maybe sleep/power settings?
SbieDrv.sys Sandboxie Kernel Mode Driver http://www.sandboxie.com/index.php?HelpTopics
nvm62x32.sys nVidia Ethernet Networking Driver (nForce chipset driver) http://www.nvidia.com/Download/index.aspx !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 00000203, A driver has called IoCallDriver without setting the CancelRoutine in the IRP
to NULL.
Arg2: 8d8b7292, The address in the driver’s code where the error was detected.
Arg3: 93c17be0, IRP address.
Arg4: 00000000

Debugging Details:
——————

BUGCHECK_STR: 0xc9_203

DRIVER_VERIFIER_IO_VIOLATION_TYPE: 203

FAULTING_IP:
bckd+6292
8d8b7292 33ff xor edi,edi

FOLLOWUP_IP:
bckd+6292
8d8b7292 33ff xor edi,edi

IRP_ADDRESS: 93c17be0

DEVICE_OBJECT: 8e000018

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME: System

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from 82b86f03 to 8292eef4

STACK_TEXT:
8a9d6bc4 82b86f03 000000c9 00000203 8d8b7292 nt!KeBugCheckEx+0x1e
8a9d6be4 82b892cd 8d8b7292 8a9d6c1c 8d8b7292 nt!VerifierBugCheckIfAppropriate+0x30
8a9d6bfc 82b8932a 00000203 8d8b7292 00000000 nt!ViErrorFinishReport+0xc9
8a9d6c50 82b871d9 00000203 93c17be0 8a27b738 nt!VfErrorReport1+0x4d
8a9d6ca8 82b86d33 8a27b738 93c17be0 8a9d6cd8 nt!IovpCallDriver1+0x21b
8a9d6cb8 82b81670 8a2f0d00 93c17be0 8a2f0d00 nt!VfBeforeCallDriver+0xe7
8a9d6cd8 82887545 93c17c98 00000000 8a2f0d00 nt!IovCallDriver+0x206
8a9d6cec 8d8b7292 8e0000d0 00000001 00000000 nt!IofCallDriver+0x1b
WARNING: Stack unwind information not available. Following frames may be wrong.
8a9d6d00 8d8b3a08 8e0000d0 00000000 93c17be0 bckd+0x6292
8a9d6d34 8d8bcb54 93c17be0 00000000 00000000 bckd+0x2a08
8a9d6d50 82a58fda 8d8b327e ae857459 00000000 bckd+0xbb54
8a9d6d90 829011f9 8d8bca7e 8e0000d0 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19

STACK_COMMAND: kb

SYMBOL_STACK_INDEX: 8

SYMBOL_NAME: bckd+6292

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: bckd

IMAGE_NAME: bckd.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4df28f33

FAILURE_BUCKET_ID: 0xc9_203_VRF_bckd+6292

BUCKET_ID: 0xc9_203_VRF_bckd+6292

Followup: MachineOwner

===============================================================================

Debug session time: Tue Feb 28 03:30:38.006 2012 (UTC + 0:00)
System Uptime: 0 days 15:48:26.709
Loading Kernel Symbols
………………………………………………………
……………………………………………………….
…………………………
Loading User Symbols
Loading unloaded module list
…………
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D5, {ad9bcfbc, 0, 8de158ff, 0}

Could not read faulting driver name
Probably caused by : Dot4.sys ( Dot4!DOT4SyncForChannel+ad )

Followup: MachineOwner
———

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL (d5)
Memory was referenced after it was freed.
This cannot be protected by try-except.
When possible, the guilty driver’s name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ad9bcfbc, memory referenced
Arg2: 00000000, value 0 = read operation, 1 = write operation
Arg3: 8de158ff, if non-zero, the address which referenced memory.
Arg4: 00000000, (reserved)

Debugging Details:
——————

Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from 82981848
Unable to read MiSystemVaType memory at 82960e20
ad9bcfbc

FAULTING_IP:
Dot4!DOT4SyncForChannel+ad
8de158ff 8b4024 mov eax,dword ptr [eax+24h]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR: 0xD5

PROCESS_NAME: hpqtra08.exe

CURRENT_IRQL: 0

TRAP_FRAME: b9511a28 — (.trap 0xffffffffb9511a28)
ErrCode = 00000000
eax=ad9bcf98 ebx=8de1fed0 ecx=9241efe0 edx=00000000 esi=00000000 edi=8de1fece
eip=8de158ff esp=b9511a9c ebp=b9511ab0 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
Dot4!DOT4SyncForChannel+0xad:
8de158ff 8b4024 mov eax,dword ptr [eax+24h] ds:0023:ad9bcfbc=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 82859408 to 828a640f

STACK_TEXT:
b9511a10 82859408 00000000 ad9bcfbc 00000000 nt!MmAccessFault+0x106
b9511a10 8de158ff 00000000 ad9bcfbc 00000000 nt!KiTrap0E+0xdc
b9511ab0 8de19552 a8f1ef38 ad9bcf98 b9511ae4 Dot4!DOT4SyncForChannel+0xad
b9511af0 82b496c3 8fdd83f8 00dd84b0 b59c2f8c Dot4!Dot4DeviceControl+0x3d0
b9511b14 8284f545 00000000 b59c2fb0 8fdd83f8 nt!IovCallDriver+0x258
b9511b28 82b5b3d0 96ea1a58 b59c2d50 8fddaee0 nt!IofCallDriver+0x1b
b9511b40 82b496c3 8fddaf98 b59c2d50 b59c2fb0 nt!ViFilterDispatchGeneric+0x5e
b9511b64 8284f545 00000000 b59c2fd4 8fddaee0 nt!IovCallDriver+0x258
b9511b78 8de2d96c 90bd0dc8 b59c2d50 8fddaa10 nt!IofCallDriver+0x1b
b9511b8c 82b496c3 8fddaa10 b59c2d50 b59c2fd4 Dot4Prt!Dot4PrintDeviceControl+0x44
b9511bb0 8284f545 00000000 b59c2ff8 8fddaa10 nt!IovCallDriver+0x258
b9511bc4 82b5b3d0 847e1200 b59c2d50 8fdda8c0 nt!IofCallDriver+0x1b
b9511bdc 82b496c3 8fdda978 b59c2d50 8208f628 nt!ViFilterDispatchGeneric+0x5e
b9511c00 8284f545 00000000 b59c2d50 8fdda8c0 nt!IovCallDriver+0x258
b9511c14 82a42a49 8208f628 b59c2d50 b59c2fdc nt!IofCallDriver+0x1b
b9511c34 82a45c1b 8fdda8c0 8208f628 00000000 nt!IopSynchronousServiceTail+0x1f8
b9511cd0 82a8c4b4 8fdda8c0 b59c2d50 00000000 nt!IopXxxControlFile+0x6aa
b9511d04 8285621a 0000035c 00000594 00000000 nt!NtDeviceIoControlFile+0x2a
b9511d04 76f27094 0000035c 00000594 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0157fee4 00000000 00000000 00000000 00000000 0x76f27094

STACK_COMMAND: kb

FOLLOWUP_IP:
Dot4!DOT4SyncForChannel+ad
8de158ff 8b4024 mov eax,dword ptr [eax+24h]

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: Dot4!DOT4SyncForChannel+ad

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Dot4

IMAGE_NAME: Dot4.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc701

FAILURE_BUCKET_ID: 0xD5_VRF_Dot4!DOT4SyncForChannel+ad

BUCKET_ID: 0xD5_VRF_Dot4!DOT4SyncForChannel+ad

Followup: MachineOwner

============================================================================

Debug session time: Mon Feb 13 03:50:54.283 2012 (UTC + 0:00)
System Uptime: 0 days 0:26:34.986
Loading Kernel Symbols
………………………………………………………
……………………………………………………….
………………………..
Loading User Symbols
Loading unloaded module list
……
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {37, 0, 0, a05cafc8}

*** WARNING: Unable to verify timestamp for SbieDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for SbieDrv.sys
Probably caused by : SbieDrv.sys ( SbieDrv+15e05 )

Followup: MachineOwner
———

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000037, a resource is being acquired but APCs are not disabled.
Arg2: 00000000, current IRQL,
Arg3: 00000000, thread APC disable count,
Arg4: a05cafc8, resource.

Debugging Details:
——————

BUGCHECK_STR: 0xc4_37

CURRENT_IRQL: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME: Start.exe

LAST_CONTROL_TRANSFER: from 82b78f03 to 82920ef4

STACK_TEXT:
b7a77a8c 82b78f03 000000c4 00000037 00000000 nt!KeBugCheckEx+0x1e
b7a77aac 82b81734 00000000 9fd1d500 0006ff00 nt!VerifierBugCheckIfAppropriate+0x30
b7a77ac0 82b810da a05cafc8 00000001 00000001 nt!ViResourceAcquireSanityChecks+0x76
b7a77ad4 921f0e05 a05cafc8 00000001 0006ff00 nt!VerifierExAcquireResourceSharedLite+0x11
WARNING: Stack unwind information not available. Following frames may be wrong.
b7a77aec 921eea22 9fd1d500 b7a77bac 0006ff00 SbieDrv+0x15e05
b7a77b50 921dc314 00000000 b7a77b6c 8f526aa8 SbieDrv+0x13a22
b7a77bdc 82b736c3 821bad80 b10b4f68 82072c38 SbieDrv+0x1314
b7a77c00 82879545 00000000 b10b4f68 821bad80 nt!IovCallDriver+0x258
b7a77c14 82a6ca49 82072c38 b10b4f68 b10b4fd8 nt!IofCallDriver+0x1b
b7a77c34 82a6fc1b 821bad80 82072c38 00000000 nt!IopSynchronousServiceTail+0x1f8
b7a77cd0 82ab64b4 821bad80 b10b4f68 00000000 nt!IopXxxControlFile+0x6aa
b7a77d04 8288021a 00000098 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
b7a77d04 77d97094 00000098 00000000 00000000 nt!KiFastCallEntry+0x12a
0006fea4 00000000 00000000 00000000 00000000 0x77d97094

STACK_COMMAND: kb

FOLLOWUP_IP:
SbieDrv+15e05
921f0e05 ?? ???

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: SbieDrv+15e05

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: SbieDrv

IMAGE_NAME: SbieDrv.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4eccf223

FAILURE_BUCKET_ID: 0xc4_37_VRF_SbieDrv+15e05

BUCKET_ID: 0xc4_37_VRF_SbieDrv+15e05

Followup: MachineOwner
———

============================================================================

Debug session time: Sun Feb 5 14:15:40.051 2012 (UTC + 0:00)
System Uptime: 0 days 0:09:00.696
Loading Kernel Symbols
………………………………………………………
……………………………………………………….
……………………….
Loading User Symbols
Loading unloaded module list
……
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {7, 7b932, 1, 0}

Unable to load image SystemRootsystem32DRIVERSnvm62x32.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvm62x32.sys
*** ERROR: Module load completed but symbols could not be loaded for nvm62x32.sys
Probably caused by : tdx.sys ( tdx!TdxSendConnectionTlRequestComplete+bd )

Followup: MachineOwner
———

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000007, A driver has unlocked a page more times than it locked it
Arg2: 0007b932, page frame number
Arg3: 00000001, current share count
Arg4: 00000000, 0

Debugging Details:
——————

BUGCHECK_STR: 0x4E_7

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: iexplore.exe

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from 828bfb85 to 828e6f30

STACK_TEXT:
8078a4dc 828bfb85 0007b932 84d32994 84d328b8 nt!MiPfnReferenceCountIsZero+0x24
8078a534 828ccab8 84d32994 850b0a58 84d328b8 nt!MmUnlockPages+0x557
8078a574 8de9c88d 00000000 86acb140 00000376 nt!IopfCompleteRequest+0x2cd
8078a58c 8888e592 02d328f8 c000020d 00000000 tdx!TdxSendConnectionTlRequestComplete+0xbd
8078a5ac 888b8818 86acb188 8578d028 850c1558 tcpip!TcpCompleteTcbSend+0x2e
8078a5ec 8886d1b4 850c1558 c000020d 00000001 tcpip!TcpShutdownTcb+0x478
8078a604 888c0393 850c1558 c000020d 8078a768 tcpip!TcpAbortTcbDelivery+0x29
8078a688 888bfdc6 857a6688 850c1558 8078a6b0 tcpip!TcpTcbCarefulDatagram+0x2a3
8078a6f4 888a3438 857a6688 850c1558 0078a768 tcpip!TcpTcbReceive+0x228
8078a75c 888a3c6a 8578d9e8 857a1000 00000000 tcpip!TcpMatchReceive+0x237
8078a7ac 888a3cab 857a6688 857a1000 00005000 tcpip!TcpPreValidatedReceive+0x293
8078a7c8 8889dfd5 857a6688 857a1000 8078a804 tcpip!TcpReceive+0x2d
8078a7d8 888a620b 8078a7ec c000023e 00000000 tcpip!TcpNlClientReceiveDatagrams+0x12
8078a804 888a5b56 8891df90 8078a858 c000023e tcpip!IppDeliverListToProtocol+0x49
8078a824 888a3f18 8891dda0 00000006 8078a858 tcpip!IppProcessDeliverList+0x2a
8078a87c 888a59ff 8891dda0 00000006 00000000 tcpip!IppReceiveHeaderBatch+0x1fb
8078a910 888b3e2c 85fe8c88 00000000 88712b01 tcpip!IpFlcReceivePackets+0xbe5
8078a98c 888ae45e 864d5cf8 86347968 00000000 tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x746
8078a9c0 828dd654 86347968 a24541d6 8579d660 tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x11e
8078aa28 888ae5cc 888ae340 8078aa50 00000000 nt!KeExpandKernelStackAndCalloutEx+0x132
8078aa64 8871218d 864d5c02 86347900 00000000 tcpip!FlReceiveNetBufferListChain+0x7c
8078aa9c 887005be 864d5798 86347968 00000000 ndis!ndisMIndicateNetBufferListsToOpen+0x188
8078aac4 887004b2 00000000 86347968 85e710e0 ndis!ndisIndicateSortedNetBufferLists+0x4a
8078ac40 886abc1d 85e710e0 00000000 00000000 ndis!ndisMDispatchReceiveNetBufferLists+0x129
8078ac5c 88700553 85e710e0 86347968 00000000 ndis!ndisMTopReceiveNetBufferLists+0x2d
8078ac84 886abc78 85e710e0 86347968 00000000 ndis!ndisMIndicateReceiveNetBufferListsInternal+0x62
8078acac 8e440616 85e710e0 86347968 00000000 ndis!NdisMIndicateReceiveNetBufferLists+0x52
WARNING: Stack unwind information not available. Following frames may be wrong.
8078acd0 8e45d33c 85688000 8e474d30 00000004 nvm62x32+0x4616
8078ad04 8e45d619 00020000 00000000 85688000 nvm62x32+0x2133c
8078ad28 8e4515a2 00000000 8078ad50 8e441af1 nvm62x32+0x21619
8078ad34 8e441af1 8e4764c4 8e474d30 00000000 nvm62x32+0x155a2
8078ad50 8870089a 85688000 00000000 8078ad7c nvm62x32+0x5af1
8078ad8c 886e218d 85feb68c 00feb678 00000000 ndis!ndisMiniportDpc+0xe2
8078adec 886b1fa4 85feb72c 8078ae70 00000000 ndis!ndisQueuedMiniportDpcWorkItem+0xd0
8078ae08 828ce019 8577e808 00000000 a37ee60e ndis!ndisPeriodicReceivesTimer+0xce
8078ae4c 828cdfbd 8297ed20 8078af78 00000001 nt!KiProcessTimerDpcTable+0x50
8078af38 828cde7a 8297ed20 8078af78 00000000 nt!KiProcessExpiredTimerList+0x101
8078afac 828cc00e 0000872c 8c111d34 00000000 nt!KiTimerExpiration+0x25c
8078aff4 828cb7dc 8c111ce4 00000000 00000000 nt!KiRetireDpcList+0xcb
8078aff8 8c111ce4 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2c
828cb7dc 00000000 0000001a 00d6850f bb830000 0x8c111ce4

STACK_COMMAND: kb

FOLLOWUP_IP:
tdx!TdxSendConnectionTlRequestComplete+bd
8de9c88d 5f pop edi

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: tdx!TdxSendConnectionTlRequestComplete+bd

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: tdx

IMAGE_NAME: tdx.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4ce78935

FAILURE_BUCKET_ID: 0x4E_7_tdx!TdxSendConnectionTlRequestComplete+bd

BUCKET_ID: 0x4E_7_tdx!TdxSendConnectionTlRequestComplete+bd

Followup: MachineOwner
———

==========================================================================

Debug session time: Sun Feb 5 14:04:11.743 2012 (UTC + 0:00)
System Uptime: 0 days 0:03:07.446
Loading Kernel Symbols
………………………………………………………
……………………………………………………….
……………………….
Loading User Symbols
Loading unloaded module list
…..
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 8e47ec82, a1df8978, 0}

*** WARNING: Unable to verify timestamp for bckd.sys
*** ERROR: Module load completed but symbols could not be loaded for bckd.sys
Probably caused by : tdx.sys ( tdx!TdxCreateControlChannel+70 )

Followup: MachineOwner
———

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but …
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8e47ec82, The address that the exception occurred at
Arg3: a1df8978, Trap Frame
Arg4: 00000000

Debugging Details:
——————

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 – The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
tdx!TdxCreateControlChannel+70
8e47ec82 89700c mov dword ptr [eax+0Ch],esi

TRAP_FRAME: a1df8978 — (.trap 0xffffffffa1df8978)
ErrCode = 00000002
eax=00000040 ebx=00000000 ecx=00000002 edx=00000000 esi=84d60ea0 edi=00000003
eip=8e47ec82 esp=a1df89ec ebp=a1df89f4 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
tdx!TdxCreateControlChannel+0x70:
8e47ec82 89700c mov dword ptr [eax+0Ch],esi ds:0023:0000004c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: iexplore.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 8e486009 to 8e47ec82

STACK_TEXT:
a1df89f4 8e486009 85aee458 00000040 00000000 tdx!TdxCreateControlChannel+0x70
a1df8a2c 8284a58e 85a38ba0 84d52620 00000000 tdx!TdxTdiDispatchCreate+0x5f
a1df8a44 8e4a3292 00000000 84d526fc 84d52620 nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
a1df8a58 8e49f033 85bd40d0 00000000 84d52620 bckd+0x6292
a1df8a84 8e4a4157 00000000 a1df8aac 8e4a6837 bckd+0x2033
a1df8a90 8e4a6837 85bd4018 84d52620 85bd40d0 bckd+0x7157
a1df8aac 8e4a693e 00bd40d0 84b2ad2c 00000000 bckd+0x9837
a1df8ac8 8e4a788e 85bd40d0 84b2ad2c 84d26964 bckd+0x993e
a1df8ae4 8e4a8336 85bd40d0 84d268d0 84d26964 bckd+0xa88e
a1df8b04 8284a58e 85bd4018 84d268d0 84d268d0 bckd+0xb336
a1df8b1c 8e4d6642 00021c10 871f5b18 84c4b930 nt!IofCallDriver+0x63
a1df8b70 8e4d3dd0 871f5b18 00000000 84d471a0 afd!AfdBeginDisconnect+0x2cb
a1df8be0 8e4d42b5 84d471a0 85a1d030 a1df8c08 afd!AfdCleanupCore+0x346
a1df8bf0 8284a58e 85a1d030 84d471a0 849eca90 afd!AfdDispatch+0x125
a1df8c08 82a45abe 84866650 849eca78 00000001 nt!IofCallDriver+0x63
a1df8c48 82a36f5f 84c16d40 849eca90 00000001 nt!IopCloseFile+0x2f3
a1df8c94 82a583ac 84c16d40 9adcda28 84c47030 nt!ObpDecrementHandleCount+0x139
a1df8cdc 82a580ec 9adcda28 a47beae0 84c16d40 nt!ObpCloseHandleTableEntry+0x203
a1df8d0c 82a58486 84c16d40 84c47001 0229f7c0 nt!ObpCloseHandle+0x7f
a1df8d28 8285121a 00000570 0229f81c 77037094 nt!NtClose+0x4e
a1df8d28 77037094 00000570 0229f81c 77037094 nt!KiFastCallEntry+0x12a
0229f81c 00000000 00000000 00000000 00000000 0x77037094

STACK_COMMAND: kb

FOLLOWUP_IP:
tdx!TdxCreateControlChannel+70
8e47ec82 89700c mov dword ptr [eax+0Ch],esi

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: tdx!TdxCreateControlChannel+70

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: tdx

IMAGE_NAME: tdx.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4ce78935

FAILURE_BUCKET_ID: 0x8E_tdx!TdxCreateControlChannel+70

BUCKET_ID: 0x8E_tdx!TdxCreateControlChannel+70

Followup: MachineOwner
———

==========================================================================

Debug session time: Thu Feb 2 11:33:35.115 2012 (UTC + 0:00)
System Uptime: 0 days 8:34:06.416
Loading Kernel Symbols
………………………………………………………
……………………………………………………….
…………………………
Loading User Symbols
Loading unloaded module list
………
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 8d6d4c82, 8c16bbcc, 8c16b7b0}

*** WARNING: Unable to verify timestamp for bckd.sys
*** ERROR: Module load completed but symbols could not be loaded for bckd.sys
Probably caused by : tdx.sys ( tdx!TdxCreateControlChannel+70 )

Followup: MachineOwner
———

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but …
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8d6d4c82, The address that the exception occurred at
Arg3: 8c16bbcc, Exception Record Address
Arg4: 8c16b7b0, Context Record Address

Debugging Details:
——————

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 – The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
tdx!TdxCreateControlChannel+70
8d6d4c82 89700c mov dword ptr [eax+0Ch],esi

EXCEPTION_RECORD: 8c16bbcc — (.exr 0xffffffff8c16bbcc)
ExceptionAddress: 8d6d4c82 (tdx!TdxCreateControlChannel+0x00000070)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 0000060c
Attempt to write to address 0000060c

CONTEXT: 8c16b7b0 — (.cxr 0xffffffff8c16b7b0)
eax=00000600 ebx=00000000 ecx=00000002 edx=00000000 esi=858a0a78 edi=00000003
eip=8d6d4c82 esp=8c16bc94 ebp=8c16bc9c iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
tdx!TdxCreateControlChannel+0x70:
8d6d4c82 89700c mov dword ptr [eax+0Ch],esi ds:0023:0000060c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 – The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 00000001

EXCEPTION_PARAMETER2: 0000060c

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 829b1848
Unable to read MiSystemVaType memory at 82990e20
0000060c

FOLLOWUP_IP:
tdx!TdxCreateControlChannel+70
8d6d4c82 89700c mov dword ptr [eax+0Ch],esi

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from 8d6dc009 to 8d6d4c82

STACK_TEXT:
8c16bc9c 8d6dc009 859e8d90 00000600 00000000 tdx!TdxCreateControlChannel+0x70
8c16bcd4 8287f58e 859e8c88 857ca4f8 00000000 tdx!TdxTdiDispatchCreate+0x5f
8c16bcec 8d6f9292 85afa0d0 00000000 00000000 nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
8c16bd00 8d6f5a08 85afa0d0 00000000 857ca4f8 bckd+0x6292
8c16bd34 8d6feb54 857ca4f8 00000000 00000000 bckd+0x2a08
8c16bd50 82a50fda 8d6f527e ae03581c 00000000 bckd+0xbb54
8c16bd90 828f91f9 8d6fea7e 85afa0d0 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: tdx!TdxCreateControlChannel+70

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: tdx

IMAGE_NAME: tdx.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4ce78935

STACK_COMMAND: .cxr 0xffffffff8c16b7b0 ; kb

FAILURE_BUCKET_ID: 0x7E_tdx!TdxCreateControlChannel+70

BUCKET_ID: 0x7E_tdx!TdxCreateControlChannel+70

Followup: MachineOwner
———
[/CODE]

Reply | Quote

it was clean as i went from xp….i’ll uninstall the k9 (have a 9 year old thats likes “boobies”) and i dont really use the sandbox thingy so its gone too…..i’ll go check on that other driver too…….thank you sir for the debug!!

EDIT: well i uninstalled the K9 and the sandbox and did the driver but it just did it again…….this time it had STOP : 0x000000C4
(ox00000062 ox8e3f5aa4 ox8e3f59bo ox00000002

Reply | Quote

it was clean as i went from xp….i’ll uninstall the k9 (have a 9 year old thats likes “boobies”) and i dont really use the sandbox thingy so its gone too…..i’ll go check on that other driver too…….thank you sir for the debug!!

EDIT: well i uninstalled the K9 and the sandbox and did the driver but it just did it again…….this time it had STOP : 0x000000C4
(ox00000062 ox8e3f5aa4 ox8e3f59bo ox00000002

Some of the drivers in the dumps pre-dated W7, like the nForce drivers noted earlier, which is why I wondered if it was upgraded.

Upload the most recent dump, then turn off Driver Verifier, you need to test what’s happening without it for a few days/weeks. To turn off Driver Verifier: open it and select “Delete existing settings”, then click on “Finish”, reboot to remove the settings.

Reply | Quote

Graphics drivers can be very finicky. I would definitely try the site that satrow points out for Nvidia drivers. It seems users are reporting more problems with Nvidia drivers recently than others here. Not sure why.

Have you tried ensuring everything is cleaned and all connectors are reseated properly. I would open the case and use some compressed air to blow out any dust bunnies you might find and reseat all cables and cards. Make sure you have shut down and unplugged the PC first and grounded yourself to the case to discharge any static you might have. Reseat the Ram modules as well if you can. Over time things tend to get dirty, get corrosion work loose, etc.

Reply | Quote

Ok, i’ll try that…..and im starting to think it is a graphics problem as sometimes during a reboot (on the black “starting windows” screen) my screen is all messed up, like its sliced in a hundred horizontal sections that zig zag…..once the blue screen come up though, its fine….did the same thing when i installed the new driver…..i may take it apart, replug everything in and just reformat tha thing to see if that helps…….

Reply | Quote

Ok, i’ll try that…..and im starting to think it is a graphics problem as sometimes during a reboot (on the black “starting windows” screen) my screen is all messed up, like its sliced in a hundred horizontal sections that zig zag…..once the blue screen come up though, its fine….did the same thing when i installed the new driver…..i may take it apart, replug everything in and just reformat tha thing to see if that helps…….

That reads like hardware, can you borrow a known good graphics card for testing?

Reply | Quote

No borrow, i guess i could buy one if they aint to much$$$$…….if you could recommend one maybe, no gaming at all on this machine, just online mainly…….

Reply | Quote

I’m not going to recommend throwing any money at it – until we know for sure where the problems are!

Reply | Quote

I’m not going to recommend throwing any money at it – until we know for sure where the problems are!

Well sir, it’s obvious your not in politics……..

Reply | Quote

I don’t know if the answer to my problem is already answered so I am posting the data here. This is the info I copied when my hubby got it started:

C:WindowsMinidump3412-32713-01.dmp
C:Users AppDataLocalTempWER-1072350-0.sysdata.xml
BCCode: f4
BCP1: 0000000000000003
BCP2: FFFFF A8005 BECB30
BCP3: FFFFF A8005 BEC10
BCP4: FFFFF 80002 FDB8B0

OSVER 6_1_7601
Service Pack 1_0
Product 768_1
Thank you

Reply | Quote

I don’t know if the answer to my problem is already answered so I am posting the data here. This is the info I copied when my hubby got it started:

C:WindowsMinidump3412-32713-01.dmp
C:Users AppDataLocalTempWER-1072350-0.sysdata.xml
BCCode: f4
BCP1: 0000000000000003
BCP2: FFFFF A8005 BECB30
BCP3: FFFFF A8005 BEC10
BCP4: FFFFF 80002 FDB8B0

OSVER 6_1_7601
Service Pack 1_0
Product 768_1
Thank you

This really needs its’ own thread.

0xF4 could be a malware problem, it’s frequently related to file security checks within Windows soon after startup.

@ Budule: are you going to upload the latest dump?

Reply | Quote

@ Budule: are you going to upload the latest dump?

Yes, when it goes down again i will, but i already deleated everything in there so it’s blank right now…………….i did reinstall the graphics driver though and this time the screen didnt go crazy……..

Reply | Quote

A good app to try analyzing a BSOD is WhoCrashed, which allows to easily read a dmp file plus can reveal the drivers responsible for crashing your computer. A free home edition is available at http://www.resplendence.com/whocrashed .Once you have confirmed that the BSOD has been caused by a driver conflict, my favorite app for easily updating all the drivers is Driver Genius Pro. Backup current drivers first plus create a restore point, rebooting after each update to eliminate possible conflicts.

Reply | Quote

Open your case and check fans are working, especially the one on your graphics card, also the CPU fan. If they’re clogged with dust, clean them off with a toothpick or similar–be careful about blasting them with compressed air from close range.

Lugh.
~
Alienware Aurora R6; Win10 Home x64 1803; Office 365 x32
i7-7700; GeForce GTX 1060; 16GB DDR4 2400; 1TB SSD, 256GB SSD, 4TB HD

Reply | Quote

I had the dreaded BSOD for over a year, spent countless hours with Dell tech support, they updated all drivers, no help, finally they said to re-install Windows 7, I refused at first but nothing else seemed to help so I finally bit the bullet and did a clean re-install of W7. Still no help. Finally I did sort of what Ted Meyers , Lounge VIP, suggested and swapped memory modules by rearranging which slot each module occupied. I was especially careful to make sure each module was properly seated. Eureka!!

I’ve now been running for two months without a BSOD. Apparently one of the memory modules was not seated correctly although programs, such as CPUID, Belarc, and Windows, reported the correct value for memory; 6 Gb. I’d take Ted’s suggestion and reseat all modules and keep my fingures crossed. Good luck.

Reply | Quote

I had a problem once where the error message flashed to fast to write it down.
Someone suggested taking a picture of the event with a camera.
With a picture of the error message it was easier to track down and fix the problem.

Reply | Quote

I had a problem once where the error message flashed to fast to write it down.
Someone suggested taking a picture of the event with a camera.
With a picture of the error message it was easier to track down and fix the problem.

You can prevent it from disappearing off the screen.

See post #3 earlier in this thread

http://windowssecrets.com/forums/showthread//144848-Why-Blue-Screen-of-Death-every-day?p=843989&viewfull=1#post843989

Reply | Quote

No. You just have to be ready and fast with the camera.

Reply | Quote

I had a problem once where the error message flashed to fast to write it down.
Someone suggested taking a picture of the event with a camera.
With a picture of the error message it was easier to track down and fix the problem.

Depending on how the message in question has been generated, hitting the PAUSE key may be faster than running for your camera and focusing on the message. If you have the possibility of launching a screen capture app in time before the message disappears, it could also be an option.

Reply | Quote

I’m not a technical wizard, but I had the BSOD problem with my new Dell N5110 Inspiron i7 laptop. The problem would occur at random times and, as you well know, was very annoying and puzzling. When the laptop crashed I would reinstall the prog I had been using to see if that resolved the problem, No joy there. I ran all the memory tests I’d seen mentioned on sites like this. No joy again.

Just by chance I wondered if IE9 was the problem. IE9 had been open or recently-used each time a crash occurred. I removed it and ran IE8 with no problems! Just to test the theory I reinstalled IE9 and the problem returned. I no longer use IE, much preferring Chrome anyway, and haven’t had a single BSOD in 3 months.

I know this isn’t a fix, but it may give you peace of mind as you continue to research your pc problem.

Regards

Esef

Reply | Quote

I had a similar problem and tried debugging to no avail. My problem was a bad memory stick. Changed it out, now everything works perfectly.

Reply | Quote

well, it’s been a couple of days and no problems so maybe it’s good now…….finger’s crossed though…..

Reply | Quote

If memory modules should be suspected Memtest86+ should be used for memory failures detection
http://www.memtest.org/

Reply | Quote

You might try an app called Who Crashed. Might give a clue, who knows.

Reply | Quote

it’s been several days now with no problems so i guess it’s ok now………not sure if it was a driver or one of the programs i uninstalled but i do think the K9 program was at least slowing it down as it is MUCH faster now…….

Reply | Quote

http://www.tigerdirect.com/applications/SearchTools/item-details.asp?EdpNo=7192074&CatId=3670
here is a good card for 30$. Should Be engough for Areo. This is from tigerdirect, sometimes I think it is better than newegg. Very reliable

Reply | Quote