BSOD - Twice in 3 days, VISTA_DRIVER_FAULT part 1

wolverex

Hi guys,

I'm new on a forum, thanks to everyone who keeps this place going and service delivered promptly =) kudos to you all

my system crashed twice in the last 3 days so i'm wondering what might have caused it. I have attached the 2 dump files and also copied the debug messages from WinDBG into 2 txt files

Any help is fully appreciated

ttran

�� Quote: Originally Posted by wolverex

Hi guys,

I'm new on a forum, thanks to everyone who keeps this place going and service delivered promptly =) kudos to you all

my system crashed twice in the last 3 days so i'm wondering what might have caused it. I have attached the 2 dump files and also copied the debug messages from WinDBG into 2 txt files

Any help is fully appreciated

Hi wolverex and welcome

These two (bugcheck 1A) are pretty straight forward, memory management. To test your memory I suggest you:

Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Boot from the CD, and leave it running for at least 5 or 6 passes.





Analysis

Code:

 Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved.   Loading Dump File [C:\Users\K\Desktop\New folder\072710-22510-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available  Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols *http://msdl.microsoft.com/download/symbols Executable search path is:  Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16539.amd64fre.win7_gdr.100226-1909 Machine Name: Kernel base = 0xfffff800`02851000 PsLoadedModuleList = 0xfffff800`02a8ee50 Debug session time: Tue Jul 27 00:37:15.321 2010 (GMT-4) System Uptime: 0 days 13:21:28.179 Loading Kernel Symbols ............................................................... ................................................................ ..................... Loading User Symbols Loading unloaded module list ....... ******************************************************************************* *                                                                             * *                        Bugcheck Analysis                                    * *                                                                             * *******************************************************************************  Use !analyze -v to get detailed debugging information.  BugCheck 1A, {5002, fffff70001080000, a8ae, 2000b414fffffffe}  Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+21b71 )  Followup: MachineOwner ---------  2: kd> !analyze -v ******************************************************************************* *                                                                             * *                        Bugcheck Analysis                                    * *                                                                             * *******************************************************************************  MEMORY_MANAGEMENT (1a)     # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 0000000000005002, The subtype of the bugcheck. Arg2: fffff70001080000 Arg3: 000000000000a8ae Arg4: 2000b414fffffffe  Debugging Details: ------------------   BUGCHECK_STR:  0x1a_5002  CUSTOMER_CRASH_COUNT:  1  DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT  PROCESS_NAME:  firefox.exe  CURRENT_IRQL:  0  LAST_CONTROL_TRANSFER:  from fffff800029298b1 to fffff800028c1600  STACK_TEXT:   fffff880`08797a68 fffff800`029298b1 : 00000000`0000001a 00000000`00005002 fffff700`01080000 00000000`0000a8ae : nt!KeBugCheckEx fffff880`08797a70 fffff800`028dbf2c : fffff680`000778b8 fffff880`08797b40 00000000`00000000 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x21b71 fffff880`08797ac0 fffff800`028bf6ee : 00000000`00000001 00000000`00100000 00000000`0a040301 00000000`7efdb000 : nt!MmAccessFault+0xc4c fffff880`08797c20 00000000`7240801e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e 00000000`0021b434 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7240801e   STACK_COMMAND:  kb  FOLLOWUP_IP:  nt! ?? ::FNODOBFM::`string'+21b71 fffff800`029298b1 cc              int     3  SYMBOL_STACK_INDEX:  1  SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+21b71  FOLLOWUP_NAME:  MachineOwner  MODULE_NAME: nt  IMAGE_NAME:  ntkrnlmp.exe  DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb  FAILURE_BUCKET_ID:  X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+21b71  BUCKET_ID:  X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+21b71  Followup: MachineOwner ---------

Old drivers from as far back as 2005 that need updating

Code:

DB3G.sys        fffff880`043f9000    fffff880`043fe280    0x00005280    0x436ef527    11/7/2005 02:33:11                         mfpvbus.sys        fffff880`04360000    fffff880`04363080    0x00003080    0x45388f6d    10/20/2006 04:57:17                         Pd71Wdm.sys        fffff880`043d0000    fffff880`043dd000    0x0000d000    0x4614bec4    4/5/2007 05:17:56                         Pd71.sys        fffff880`02c51000    fffff880`02c63000    0x00012000    0x4614bedc    4/5/2007 05:18:20                         mfpec.sys        fffff880`06b2e000    fffff880`06b37a80    0x00009a80    0x463ea08f    5/6/2007 23:44:15                         Rt64win7.sys        fffff880`04095000    fffff880`040c7000    0x00032000    0x49a65b0d    2/26/2009 05:04:13                         dsNcAdpt.sys        fffff880`0405e000    fffff880`0406b000    0x0000d000    0x49d180fd    3/30/2009 22:33:33                         spldr.sys        fffff880`0174a000    fffff880`01752000    0x00008000    0x4a0858bb    5/11/2009 12:56:27                         amdxata.sys        fffff880`00ec0000    fffff880`00ecb000    0x0000b000    0x4a12f2eb    5/19/2009 13:56:59

Jonathan_King

Third party antivirus softwares are known for causing BSOD, please remove Avira completely for testing purpose, then if you need an alternative program, you can use Microsoft security essential:
Avira Antivirus Solution - Download AntiVir Removal Tool
http://www.microsoft.com/security_essentials

Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads

Update these drivers:

Code:

fffff880`02c51000 fffff880`02c63000   Pd71     Pd71.sys     Thu Apr 05 16:18:20 2007 (4614BEDC) fffff880`043d0000 fffff880`043dd000   Pd71Wdm  Pd71Wdm.sys  Thu Apr 05 16:17:56 2007 (4614BEC4)  looks like audio drivers ????

BUGCHECK SUMMARY:

Code:

BugCheck 1A, {5002, fffff70001080000, a8ae, 2000b414fffffffe}  Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+21b71 )  Followup: MachineOwner ---------  PROCESS_NAME:  firefox.exe BugCheck 1A, {41790, fffffa8000d291b0, ffff, 0}  Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )  Followup: MachineOwner --------- PROCESS_NAME:  wmplayer.exe

Edit: Ken is right...stop code 1A is usually memory related, please do what he advise as well

wolverex

To eliminate as many factors as possible, let's remove some high-risk programs.

First comes Daemon Tools, or whatever other CD virtualization program you have. Run this STPD installer/uninstaller when you're done: DuplexSecure - Downloads

Also, remove Avira and replace it with Microsoft Security Essentials.

Here is the Avira removal tool: http://www.avira.com/en/documents/ut...ninstXPeng.zip

MSE: www.microsoft.com/Security_Essentials/

When you have finished those 2 steps, please enable driver verifier: Using Driver Verifier to identify issues with Drivers

EDIT: I see Ken posted first. Go ahead and follow his instructions first.

wolverex

Awesome guys I'll be on it

Tews

One stick of my ram is crippled ;( showed up many errors

Thanks again

Jonathan_King

You will need to replace that module, but at least you know where your problem was...

Guest

Thanks for the report!