locked
Blue screen error RRS feed

  • Question

  • Hello, I have this laptop dell xps from last month. It gives blue screen error peridically and ramdomly. Dell's support agents said me that it has a problem related to nic and nvidia drivers, but they uninstalled and reinstalled them and the problem continues.

    System Windows 7 home premium 64 bit

    Bellow I attach file memory.dmp. Moreover I already uninstalled mcafee and I used the tool verifier.exe in safe mode. Thera are 2 drivers that cause blue screen error and force to use system recovery to boot the system: acpi.sys and ntoskrnl.exe. Unfortunately I do not have dmp files for these last bsod because I have  to use system restore to reboot my laptop. 

    Thanks in advance.

    Regards.

     


    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631
    Machine Name:
    Kernel base = 0xfffff800`03849000 PsLoadedModuleList = 0xfffff800`03a8e650
    Debug session time: Tue Aug 2 14:34:26.561 2011 (GMT-4)
    System Uptime: 0 days 4:54:35.513
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................
    Loading User Symbols

    Loading unloaded module list
    ......
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck D1, {28, 2, 0, fffff88001958b2d}

    *** ERROR: Module load completed but symbols could not be loaded for mfenlfk.sys
    Probably caused by : NETIO.SYS ( NETIO!RtlCopyBufferToMdl+1d )

    Followup: MachineOwner
    ---------

    4: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 0000000000000028, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
    Arg4: fffff88001958b2d, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: 0000000000000028

    CURRENT_IRQL: 2

    FAULTING_IP:
    NETIO!RtlCopyBufferToMdl+1d
    fffff880`01958b2d 448b5228 mov r10d,dword ptr [rdx+28h]

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    BUGCHECK_STR: 0xD1

    PROCESS_NAME: System

    TRAP_FRAME: fffff8800399a520 -- (.trap 0xfffff8800399a520)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffff8800399a740 rbx=0000000000000000 rcx=0000000000000000
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff88001958b2d rsp=fffff8800399a6b0 rbp=fffff8800399a7e0
    r8=00000000ffffffbc r9=0000000000000044 r10=0000000000000000
    r11=fffffa800b047640 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei pl zr na po nc
    NETIO!RtlCopyBufferToMdl+0x1d:
    fffff880`01958b2d 448b5228 mov r10d,dword ptr [rdx+28h] ds:de50:0028=????????
    Resetting default scope

    LAST_CONTROL_TRANSFER: from fffff800038c82a9 to fffff800038c8d00

    STACK_TEXT:
    fffff880`0399a3d8 fffff800`038c82a9 : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
    fffff880`0399a3e0 fffff800`038c6f20 : 00000000`00000000 fffff880`01ad07a2 fffffa80`0b19ed50 00000000`00000044 : nt!KiBugCheckDispatch+0x69
    fffff880`0399a520 fffff880`01958b2d : 00000000`000004e3 fffff880`01a88fec 00000000`0000000d fffffa80`0b1d3f58 : nt!KiPageFault+0x260
    fffff880`0399a6b0 fffff880`01b0f66c : 00000000`00000000 fffff880`01ade2d6 00000000`00000001 fffff880`09e7200f : NETIO!RtlCopyBufferToMdl+0x1d
    fffff880`0399a710 fffff880`01adb8c3 : fffffa80`0b047640 00000000`00000001 fffffa80`0b0e3cf0 00000000`00000000 : tcpip! ?? ::FNODOBFM::`string'+0x1d74f
    fffff880`0399a780 fffff880`01ace724 : fffff880`0399ac38 fffffa80`00000029 fffffa80`0b0e3cf0 00000000`00000001 : tcpip!TcpTcbCarefulDatagram+0x543
    fffff880`0399a930 fffff880`01acd04a : fffffa80`0646d910 fffff880`01ac5504 fffffa80`06428718 00000000`00000000 : tcpip!TcpTcbReceive+0x694
    fffff880`0399aae0 fffff880`01acec7b : fffff880`06c360f4 fffffa80`065ae000 00000000`00000000 fffff880`0399ae00 : tcpip!TcpMatchReceive+0x1fa
    fffff880`0399ac30 fffff880`01ac5b97 : fffffa80`0646d910 fffffa80`0646c9e9 fffffa80`000051f1 00000000`000051f1 : tcpip!TcpPreValidatedReceive+0x36b
    fffff880`0399ad00 fffff880`01ac570a : 00000000`00000000 fffff880`01be1800 fffff880`0399aec0 00000000`00000000 : tcpip!IppDeliverListToProtocol+0x97
    fffff880`0399adc0 fffff880`01ac4d09 : 00000000`00000000 00000000`00000000 fffff880`0399aea8 fffff880`0399aeb0 : tcpip!IppProcessDeliverList+0x5a
    fffff880`0399ae60 fffff880`01ac2a7f : fffff880`01be1800 fffff880`06c360e4 fffff880`01be1800 fffff880`01be1800 : tcpip!IppReceiveHeaderBatch+0x23a
    fffff880`0399af40 fffff880`01ac2072 : fffffa80`062b5a10 00000000`00000000 fffffa80`07226b00 00000000`00000001 : tcpip!IpFlcReceivePackets+0x64f
    fffff880`0399b140 fffff880`01b423da : 00000000`00000000 fffff880`0399b450 fffffa80`07226ba0 fffff880`01711aa4 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
    fffff880`0399b220 fffff800`038d5668 : fffffa80`06551e00 fffffa80`0b1a13b0 fffffa80`05500040 00000000`00000001 : tcpip! ?? ::FNODOBFM::`string'+0x568e2
    fffff880`0399b270 fffff880`01ac1bd2 : fffff880`01ac1430 00000000`00000000 fffff8a0`00387000 fffff880`01703d01 : nt!KeExpandKernelStackAndCalloutEx+0xd8
    fffff880`0399b350 fffff880`019130eb : fffffa80`0722a010 00000000`00000000 fffffa80`06cab1a0 fffff880`0399b510 : tcpip!FlReceiveNetBufferListChain+0xb2
    fffff880`0399b3c0 fffff880`018dcad6 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb
    fffff880`0399b430 fffff880`0185e9c4 : fffffa80`06cab1a0 fffff880`0462b2c4 00000000`00000001 fffff880`0465b30e : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6
    fffff880`0399b8b0 fffff880`0185e939 : fffff880`0399b9f8 fffff880`0465b071 fffff880`0399b9b0 fffff880`0452750c : ndis!ndisMTopReceiveNetBufferLists+0x24
    fffff880`0399b8f0 fffff880`0185e8d0 : fffff880`0399b9b0 fffff880`0452762e fffffa80`0b2137e0 fffff880`0399b9b0 : ndis!ndisFilterIndicateReceiveNetBufferLists+0x29
    fffff880`0399b930 fffff880`0452433e : 00000000`00000001 fffffa80`07228010 fffff880`0399b9f8 00000000`00000000 : ndis!NdisFIndicateReceiveNetBufferLists+0x50
    fffff880`0399b970 fffff880`018774f7 : 00000000`00000001 fffffa80`06cab1a0 fffffa80`059b6030 00000000`00000000 : mfenlfk+0x133e
    fffff880`0399ba80 fffff880`0443866c : 00000000`00000001 fffff800`03a662b8 fffffa80`05500040 fffffa80`0aa6ebc0 : ndis! ?? ::FNODOBFM::`string'+0xcf1f
    fffff880`0399bad0 fffff880`04432c17 : fffff880`04448e30 fffffa80`05500040 fffffa80`05500040 00000000`00000000 : tunnel!TeredoWfpIndicationWorker+0xb4
    fffff880`0399bb10 fffff800`03bbf0c3 : fffffa80`0721f060 00000000`00000001 fffffa80`0aa6ebc0 fffffa80`05500040 : tunnel!LwWorker+0x1b
    fffff880`0399bb40 fffff800`038d3021 : fffff800`03a66200 fffff800`03bbf001 fffffa80`05500000 fffff800`03a662b8 : nt!IopProcessWorkItem+0x23
    fffff880`0399bb70 fffff800`03b6532e : ffffeeb7`f7deefff fffffa80`05500040 00000000`00000080 fffffa80`054ea990 : nt!ExpWorkerThread+0x111
    fffff880`0399bc00 fffff800`038ba666 : fffff880`03789180 fffffa80`05500040 fffff880`037940c0 ffffffff`ffff7fff : nt!PspSystemThreadStartup+0x5a
    fffff880`0399bc40 00000000`00000000 : fffff880`0399c000 fffff880`03996000 fffff880`0399b8a0 00000000`00000000 : nt!KiStartSystemThread+0x16


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    NETIO!RtlCopyBufferToMdl+1d
    fffff880`01958b2d 448b5228 mov r10d,dword ptr [rdx+28h]

    SYMBOL_STACK_INDEX: 3

    SYMBOL_NAME: NETIO!RtlCopyBufferToMdl+1d

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: NETIO

    IMAGE_NAME: NETIO.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP: 4ce79381

    FAILURE_BUCKET_ID: X64_0xD1_NETIO!RtlCopyBufferToMdl+1d

    BUCKET_ID: X64_0xD1_NETIO!RtlCopyBufferToMdl+1d

    Followup: MachineOwner
    ---------

     

    Monday, August 8, 2011 5:50 AM

Answers

  • I've already solved the problem and without formating. McAfee was not the problem. It was a combination of two things:
     1.a pirate version (activated with a betamaster's keymaker, supposedly clean according to mcafee) of alcohol 120% software, that was installed without a register (it did not appear in remove programs), which seemed me suspect. It installed a driver that caused big part of the problem. I had to uninstall it manually.

    2. a Windows 7 error related to the interaction between tcpipreg.sys and verifier.exe, that is explained here:

    http://support.microsoft.com/kb/2550576

    Thank to everyone.


    • Marked as answer by fhiguera Wednesday, August 10, 2011 6:57 AM
    Wednesday, August 10, 2011 6:48 AM

All replies

  • Hello,

    bug check code 0xD1: http://msdn.microsoft.com/fr-fr/library/ff560244(v=VS.85).aspx

    That means a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

    Please use Microsoft Skydrive to upload dump files (c:\windows\minidumps) and post a link here.

    Start by updating all possible drivers (start by NIC ones).

    You can also contact Microsoft CSS.

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified IT Professional: Enterprise Administrator
    Microsoft Certified IT Professional: Server Administrator 

    Monday, August 8, 2011 7:09 AM
  • Thanks Mr X for aswering. Bellow it is the link to minidumps:

    https://skydrive.live.com/redir.aspx?cid=3838e3f24819425e&resid=3838E3F24819425E!103&authkey=IRoa!GAJANY%24

    My drivers are updated but I will check them anyway.

    My Windows 7 copy is OEM so I have support only from dell.

    Monday, August 8, 2011 4:16 PM
  • Please disable McCafee and check again.

    Also, please run msconfig and disable startup items except Microsoft ones. Once done, restart your computer and check if BSODs occur again.

    Don't forget to uninstall all programs that you don't use.

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified IT Professional: Enterprise Administrator
    Microsoft Certified IT Professional: Server Administrator 

    Monday, August 8, 2011 7:09 PM
  • I've already solved the problem and without formating. McAfee was not the problem. It was a combination of two things:
     1.a pirate version (activated with a betamaster's keymaker, supposedly clean according to mcafee) of alcohol 120% software, that was installed without a register (it did not appear in remove programs), which seemed me suspect. It installed a driver that caused big part of the problem. I had to uninstall it manually.

    2. a Windows 7 error related to the interaction between tcpipreg.sys and verifier.exe, that is explained here:

    http://support.microsoft.com/kb/2550576

    Thank to everyone.


    • Marked as answer by fhiguera Wednesday, August 10, 2011 6:57 AM
    Wednesday, August 10, 2011 6:48 AM