PDA

View Full Version : ndis.sys Blue screen of death Stop error



nutman
20.07.2006, 12:50
i only started getting this BSOD once i had downloaded/installed v4.00 of daemon-tools so im guessing dtools is the problem. on the blue screen it says:

DRIVER_IRQL_NOT_LESS_OR_EQUAL

nydis.sys

STOP (0x00140014) (0x00000002) (0x000000000) (0x0XF710B7D5)

it happened 3 times on the 12th July, once on the 13th. and then no more until today (20th).. which seems a little iregular. chkdsk didnt find any problems either.

The minidump for the first bsod is below, and followed by the one for the latest bsod. they're a bit different:


************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0093000c, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804f9f4b, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


MODULE_NAME: nt

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1e

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
0093000c

CURRENT_IRQL: 1c

FAULTING_IP:
nt+22f4b
804f9f4b 8b7904 mov edi,dword ptr [ecx+4]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 8050a51b to 804f9f4b

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
f78c6c50 8050a51b 00930008 00000000 00000000 nt+0x22f4b
f78c6c7c 8051a685 860c7320 00000000 00000000 nt+0x3351b
f78c6cbc 805699cc c6380000 0044b8d8 00000000 nt+0x43685
f78c6cd4 804e816d 863b3f18 86284828 00000000 nt+0x929cc
f78c6d04 804e5da2 00000000 00000000 e16ea848 nt+0x1116d
f78c6d28 8062a3b7 862a9934 00000000 00000000 nt+0xeda2
f78c6d4c 80628ed8 e1750b60 00000000 80561f70 nt+0x1533b7
f78c6d68 8064eae9 80563720 863c8530 00000000 nt+0x151ed8
f78c6d7c 80537757 00000000 00000000 863c8530 nt+0x177ae9
f78c6dac 805ce794 00000000 00000000 00000000 nt+0x60757
f78c6ddc 805450ce 80537668 00000000 00000000 nt+0xf7794
00000000 00000000 00000000 00000000 00000000 nt+0x6e0ce


STACK_COMMAND: kb

FOLLOWUP_IP:
nt+22f4b
804f9f4b 8b7904 mov edi,dword ptr [ecx+4]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntoskrnl.exe

SYMBOL_NAME: nt+22f4b

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------



************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {140014, 2, 0, f710b7d5}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** WARNING: Unable to verify timestamp for NVNRM.SYS
*** ERROR: Module load completed but symbols could not be loaded for NVNRM.SYS
Probably caused by : NVENETFD.sys ( NVENETFD+38f0 )

Followup: MachineOwner
---------

1: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00140014, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f710b7d5, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 42e6d9db

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
00140014

CURRENT_IRQL: 2

FAULTING_IP:
NDIS+237d5
f710b7d5 035014 add edx,dword ptr [eax+14h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from ef3af8f0 to f710b7d5

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
f78b2cb4 ef3af8f0 861f0008 85c39e54 00000001 NDIS+0x237d5
f78b2cf0 f5584cc1 00000001 f5597580 85fa8544 NVENETFD+0x38f0
f78b2cf4 00000000 f5597580 85fa8544 806e4900 NVNRM+0x8cc1


STACK_COMMAND: kb

FOLLOWUP_IP:
NVENETFD+38f0
ef3af8f0 ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: NVENETFD+38f0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: NVENETFD

IMAGE_NAME: NVENETFD.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------



Hope i have provided enough info. please help!

thanks

dan

Copytrooper
20.07.2006, 15:44
Please remove v4.00 and the SPTD layer version that came with it, then install v4.03 incl. SPTD layer v1.25 and report if it helps.

Jito463
20.07.2006, 18:45
The BSOD's are related to your network card driver for your nForce chipset. Make sure you have the latest drivers for your onboard NIC (probably should update all your mobo drivers at the same time also).

nutman
21.07.2006, 00:34
i already have all the latest drivers for my mobo. also i had removed daemon tools already, but hadnt realised it didnt remove the SPTD layer with it. so now i have removed that too..

ill let you know how things go. thanks

ps. i was already using the latest version, i just thought it was called v4.00 when i posted the original post!

thanks for your help... so far :)