Why Blue Screen of Death every day?

**Budule** · 2012-03-04 19:15

After putting windows 7 on this machine (had xp before and never did this) about once a day i will get a blue screen then a restart......it dosent stay up long enough for me to write everything down but says something to the effect of "Windows IO manager has detected a driver being naughty and is shutting down your computer and so on , at the bottom there are some codes like oxoooooc9 and several more........i have updated my drivers like video, sound, network card but still does this.......USUALLY happens after it has been on a while like when i get on it in the morning after being inactive all nite.......any ideas on a fix or just live with it?

**satrow** · 2012-03-04 20:18

Full details are needed.

If you can find the minidump files (C:\Windows\Minidump is default), copy them to your Desktop then zip them and upload the zip as an attachment to your next reply and someone will try to debug them.

**Browni** · 2012-03-04 20:25

I would also prevent Windows from automatically restarting after a BSOD, the information displayed then is useful.

Disable Automatic Reboot after Blue Screen Errors

**Budule** · 2012-03-04 20:35

Not sure if i did this right........

and thanks on the "how to disable"....i'll be able to read it now....

**satrow** · 2012-03-04 22:04

Was this a clean install or an upgrade from Vista?

I ran a selection of dumps through a quick debug, 1 of each type; the following drivers look to be to blame:
bckd.sys K9 parental web filter http://www1.k9webprotection.com/ <------- many dumps blame this!
Dot4.sys USB printer driver error? <---------- Std. Windows file so probably something else caused this; USB related, maybe sleep/power settings?
SbieDrv.sys Sandboxie Kernel Mode Driver http://www.sandboxie.com/index.php?HelpTopics
nvm62x32.sys nVidia Ethernet Networking Driver (nForce chipset driver) http://www.nvidia.com/Download/index.aspx <------------- this is a very old driver!

Code:

Debug session time: Mon Mar  5 00:59:40.562 2012 (UTC + 0:00)
System Uptime: 0 days 6:31:30.483
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C9, {203, 8d8b7292, 93c17be0, 0}

*** WARNING: Unable to verify timestamp for bckd.sys
*** ERROR: Module load completed but symbols could not be loaded for bckd.sys
Probably caused by : bckd.sys ( bckd+6292 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 00000203, A driver has called IoCallDriver without setting the CancelRoutine in the IRP
	to NULL.
Arg2: 8d8b7292, The address in the driver's code where the error was detected.
Arg3: 93c17be0, IRP address.
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc9_203

DRIVER_VERIFIER_IO_VIOLATION_TYPE:  203

FAULTING_IP: 
bckd+6292
8d8b7292 33ff            xor     edi,edi

FOLLOWUP_IP: 
bckd+6292
8d8b7292 33ff            xor     edi,edi

IRP_ADDRESS:  93c17be0

DEVICE_OBJECT: 8e000018

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 82b86f03 to 8292eef4

STACK_TEXT:  
8a9d6bc4 82b86f03 000000c9 00000203 8d8b7292 nt!KeBugCheckEx+0x1e
8a9d6be4 82b892cd 8d8b7292 8a9d6c1c 8d8b7292 nt!VerifierBugCheckIfAppropriate+0x30
8a9d6bfc 82b8932a 00000203 8d8b7292 00000000 nt!ViErrorFinishReport+0xc9
8a9d6c50 82b871d9 00000203 93c17be0 8a27b738 nt!VfErrorReport1+0x4d
8a9d6ca8 82b86d33 8a27b738 93c17be0 8a9d6cd8 nt!IovpCallDriver1+0x21b
8a9d6cb8 82b81670 8a2f0d00 93c17be0 8a2f0d00 nt!VfBeforeCallDriver+0xe7
8a9d6cd8 82887545 93c17c98 00000000 8a2f0d00 nt!IovCallDriver+0x206
8a9d6cec 8d8b7292 8e0000d0 00000001 00000000 nt!IofCallDriver+0x1b
WARNING: Stack unwind information not available. Following frames may be wrong.
8a9d6d00 8d8b3a08 8e0000d0 00000000 93c17be0 bckd+0x6292
8a9d6d34 8d8bcb54 93c17be0 00000000 00000000 bckd+0x2a08
8a9d6d50 82a58fda 8d8b327e ae857459 00000000 bckd+0xbb54
8a9d6d90 829011f9 8d8bca7e 8e0000d0 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  bckd+6292

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: bckd

IMAGE_NAME:  bckd.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4df28f33

FAILURE_BUCKET_ID:  0xc9_203_VRF_bckd+6292

BUCKET_ID:  0xc9_203_VRF_bckd+6292

Followup: MachineOwner


===============================================================================

Debug session time: Tue Feb 28 03:30:38.006 2012 (UTC + 0:00)
System Uptime: 0 days 15:48:26.709
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D5, {ad9bcfbc, 0, 8de158ff, 0}


Could not read faulting driver name
Probably caused by : Dot4.sys ( Dot4!DOT4SyncForChannel+ad )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL (d5)
Memory was referenced after it was freed.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ad9bcfbc, memory referenced
Arg2: 00000000, value 0 = read operation, 1 = write operation
Arg3: 8de158ff, if non-zero, the address which referenced memory.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from 82981848
Unable to read MiSystemVaType memory at 82960e20
 ad9bcfbc 

FAULTING_IP: 
Dot4!DOT4SyncForChannel+ad
8de158ff 8b4024          mov     eax,dword ptr [eax+24h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xD5

PROCESS_NAME:  hpqtra08.exe

CURRENT_IRQL:  0

TRAP_FRAME:  b9511a28 -- (.trap 0xffffffffb9511a28)
ErrCode = 00000000
eax=ad9bcf98 ebx=8de1fed0 ecx=9241efe0 edx=00000000 esi=00000000 edi=8de1fece
eip=8de158ff esp=b9511a9c ebp=b9511ab0 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
Dot4!DOT4SyncForChannel+0xad:
8de158ff 8b4024          mov     eax,dword ptr [eax+24h] ds:0023:ad9bcfbc=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82859408 to 828a640f

STACK_TEXT:  
b9511a10 82859408 00000000 ad9bcfbc 00000000 nt!MmAccessFault+0x106
b9511a10 8de158ff 00000000 ad9bcfbc 00000000 nt!KiTrap0E+0xdc
b9511ab0 8de19552 a8f1ef38 ad9bcf98 b9511ae4 Dot4!DOT4SyncForChannel+0xad
b9511af0 82b496c3 8fdd83f8 00dd84b0 b59c2f8c Dot4!Dot4DeviceControl+0x3d0
b9511b14 8284f545 00000000 b59c2fb0 8fdd83f8 nt!IovCallDriver+0x258
b9511b28 82b5b3d0 96ea1a58 b59c2d50 8fddaee0 nt!IofCallDriver+0x1b
b9511b40 82b496c3 8fddaf98 b59c2d50 b59c2fb0 nt!ViFilterDispatchGeneric+0x5e
b9511b64 8284f545 00000000 b59c2fd4 8fddaee0 nt!IovCallDriver+0x258
b9511b78 8de2d96c 90bd0dc8 b59c2d50 8fddaa10 nt!IofCallDriver+0x1b
b9511b8c 82b496c3 8fddaa10 b59c2d50 b59c2fd4 Dot4Prt!Dot4PrintDeviceControl+0x44
b9511bb0 8284f545 00000000 b59c2ff8 8fddaa10 nt!IovCallDriver+0x258
b9511bc4 82b5b3d0 847e1200 b59c2d50 8fdda8c0 nt!IofCallDriver+0x1b
b9511bdc 82b496c3 8fdda978 b59c2d50 8208f628 nt!ViFilterDispatchGeneric+0x5e
b9511c00 8284f545 00000000 b59c2d50 8fdda8c0 nt!IovCallDriver+0x258
b9511c14 82a42a49 8208f628 b59c2d50 b59c2fdc nt!IofCallDriver+0x1b
b9511c34 82a45c1b 8fdda8c0 8208f628 00000000 nt!IopSynchronousServiceTail+0x1f8
b9511cd0 82a8c4b4 8fdda8c0 b59c2d50 00000000 nt!IopXxxControlFile+0x6aa
b9511d04 8285621a 0000035c 00000594 00000000 nt!NtDeviceIoControlFile+0x2a
b9511d04 76f27094 0000035c 00000594 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0157fee4 00000000 00000000 00000000 00000000 0x76f27094


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Dot4!DOT4SyncForChannel+ad
8de158ff 8b4024          mov     eax,dword ptr [eax+24h]

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  Dot4!DOT4SyncForChannel+ad

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Dot4

IMAGE_NAME:  Dot4.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc701

FAILURE_BUCKET_ID:  0xD5_VRF_Dot4!DOT4SyncForChannel+ad

BUCKET_ID:  0xD5_VRF_Dot4!DOT4SyncForChannel+ad

Followup: MachineOwner


============================================================================

Debug session time: Mon Feb 13 03:50:54.283 2012 (UTC + 0:00)
System Uptime: 0 days 0:26:34.986
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {37, 0, 0, a05cafc8}

*** WARNING: Unable to verify timestamp for SbieDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for SbieDrv.sys
Probably caused by : SbieDrv.sys ( SbieDrv+15e05 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000037, a resource is being acquired but APCs are not disabled.
Arg2: 00000000, current IRQL,
Arg3: 00000000, thread APC disable count,
Arg4: a05cafc8, resource.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_37

CURRENT_IRQL:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  Start.exe

LAST_CONTROL_TRANSFER:  from 82b78f03 to 82920ef4

STACK_TEXT:  
b7a77a8c 82b78f03 000000c4 00000037 00000000 nt!KeBugCheckEx+0x1e
b7a77aac 82b81734 00000000 9fd1d500 0006ff00 nt!VerifierBugCheckIfAppropriate+0x30
b7a77ac0 82b810da a05cafc8 00000001 00000001 nt!ViResourceAcquireSanityChecks+0x76
b7a77ad4 921f0e05 a05cafc8 00000001 0006ff00 nt!VerifierExAcquireResourceSharedLite+0x11
WARNING: Stack unwind information not available. Following frames may be wrong.
b7a77aec 921eea22 9fd1d500 b7a77bac 0006ff00 SbieDrv+0x15e05
b7a77b50 921dc314 00000000 b7a77b6c 8f526aa8 SbieDrv+0x13a22
b7a77bdc 82b736c3 821bad80 b10b4f68 82072c38 SbieDrv+0x1314
b7a77c00 82879545 00000000 b10b4f68 821bad80 nt!IovCallDriver+0x258
b7a77c14 82a6ca49 82072c38 b10b4f68 b10b4fd8 nt!IofCallDriver+0x1b
b7a77c34 82a6fc1b 821bad80 82072c38 00000000 nt!IopSynchronousServiceTail+0x1f8
b7a77cd0 82ab64b4 821bad80 b10b4f68 00000000 nt!IopXxxControlFile+0x6aa
b7a77d04 8288021a 00000098 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
b7a77d04 77d97094 00000098 00000000 00000000 nt!KiFastCallEntry+0x12a
0006fea4 00000000 00000000 00000000 00000000 0x77d97094


STACK_COMMAND:  kb

FOLLOWUP_IP: 
SbieDrv+15e05
921f0e05 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  SbieDrv+15e05

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: SbieDrv

IMAGE_NAME:  SbieDrv.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4eccf223

FAILURE_BUCKET_ID:  0xc4_37_VRF_SbieDrv+15e05

BUCKET_ID:  0xc4_37_VRF_SbieDrv+15e05

Followup: MachineOwner
---------

============================================================================

Debug session time: Sun Feb  5 14:15:40.051 2012 (UTC + 0:00)
System Uptime: 0 days 0:09:00.696
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {7, 7b932, 1, 0}

Unable to load image \SystemRoot\system32\DRIVERS\nvm62x32.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvm62x32.sys
*** ERROR: Module load completed but symbols could not be loaded for nvm62x32.sys
Probably caused by : tdx.sys ( tdx!TdxSendConnectionTlRequestComplete+bd )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000007, A driver has unlocked a page more times than it locked it
Arg2: 0007b932, page frame number
Arg3: 00000001, current share count
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  iexplore.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 828bfb85 to 828e6f30

STACK_TEXT:  
8078a4dc 828bfb85 0007b932 84d32994 84d328b8 nt!MiPfnReferenceCountIsZero+0x24
8078a534 828ccab8 84d32994 850b0a58 84d328b8 nt!MmUnlockPages+0x557
8078a574 8de9c88d 00000000 86acb140 00000376 nt!IopfCompleteRequest+0x2cd
8078a58c 8888e592 02d328f8 c000020d 00000000 tdx!TdxSendConnectionTlRequestComplete+0xbd
8078a5ac 888b8818 86acb188 8578d028 850c1558 tcpip!TcpCompleteTcbSend+0x2e
8078a5ec 8886d1b4 850c1558 c000020d 00000001 tcpip!TcpShutdownTcb+0x478
8078a604 888c0393 850c1558 c000020d 8078a768 tcpip!TcpAbortTcbDelivery+0x29
8078a688 888bfdc6 857a6688 850c1558 8078a6b0 tcpip!TcpTcbCarefulDatagram+0x2a3
8078a6f4 888a3438 857a6688 850c1558 0078a768 tcpip!TcpTcbReceive+0x228
8078a75c 888a3c6a 8578d9e8 857a1000 00000000 tcpip!TcpMatchReceive+0x237
8078a7ac 888a3cab 857a6688 857a1000 00005000 tcpip!TcpPreValidatedReceive+0x293
8078a7c8 8889dfd5 857a6688 857a1000 8078a804 tcpip!TcpReceive+0x2d
8078a7d8 888a620b 8078a7ec c000023e 00000000 tcpip!TcpNlClientReceiveDatagrams+0x12
8078a804 888a5b56 8891df90 8078a858 c000023e tcpip!IppDeliverListToProtocol+0x49
8078a824 888a3f18 8891dda0 00000006 8078a858 tcpip!IppProcessDeliverList+0x2a
8078a87c 888a59ff 8891dda0 00000006 00000000 tcpip!IppReceiveHeaderBatch+0x1fb
8078a910 888b3e2c 85fe8c88 00000000 88712b01 tcpip!IpFlcReceivePackets+0xbe5
8078a98c 888ae45e 864d5cf8 86347968 00000000 tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x746
8078a9c0 828dd654 86347968 a24541d6 8579d660 tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x11e
8078aa28 888ae5cc 888ae340 8078aa50 00000000 nt!KeExpandKernelStackAndCalloutEx+0x132
8078aa64 8871218d 864d5c02 86347900 00000000 tcpip!FlReceiveNetBufferListChain+0x7c
8078aa9c 887005be 864d5798 86347968 00000000 ndis!ndisMIndicateNetBufferListsToOpen+0x188
8078aac4 887004b2 00000000 86347968 85e710e0 ndis!ndisIndicateSortedNetBufferLists+0x4a
8078ac40 886abc1d 85e710e0 00000000 00000000 ndis!ndisMDispatchReceiveNetBufferLists+0x129
8078ac5c 88700553 85e710e0 86347968 00000000 ndis!ndisMTopReceiveNetBufferLists+0x2d
8078ac84 886abc78 85e710e0 86347968 00000000 ndis!ndisMIndicateReceiveNetBufferListsInternal+0x62
8078acac 8e440616 85e710e0 86347968 00000000 ndis!NdisMIndicateReceiveNetBufferLists+0x52
WARNING: Stack unwind information not available. Following frames may be wrong.
8078acd0 8e45d33c 85688000 8e474d30 00000004 nvm62x32+0x4616
8078ad04 8e45d619 00020000 00000000 85688000 nvm62x32+0x2133c
8078ad28 8e4515a2 00000000 8078ad50 8e441af1 nvm62x32+0x21619
8078ad34 8e441af1 8e4764c4 8e474d30 00000000 nvm62x32+0x155a2
8078ad50 8870089a 85688000 00000000 8078ad7c nvm62x32+0x5af1
8078ad8c 886e218d 85feb68c 00feb678 00000000 ndis!ndisMiniportDpc+0xe2
8078adec 886b1fa4 85feb72c 8078ae70 00000000 ndis!ndisQueuedMiniportDpcWorkItem+0xd0
8078ae08 828ce019 8577e808 00000000 a37ee60e ndis!ndisPeriodicReceivesTimer+0xce
8078ae4c 828cdfbd 8297ed20 8078af78 00000001 nt!KiProcessTimerDpcTable+0x50
8078af38 828cde7a 8297ed20 8078af78 00000000 nt!KiProcessExpiredTimerList+0x101
8078afac 828cc00e 0000872c 8c111d34 00000000 nt!KiTimerExpiration+0x25c
8078aff4 828cb7dc 8c111ce4 00000000 00000000 nt!KiRetireDpcList+0xcb
8078aff8 8c111ce4 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2c
828cb7dc 00000000 0000001a 00d6850f bb830000 0x8c111ce4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
tdx!TdxSendConnectionTlRequestComplete+bd
8de9c88d 5f              pop     edi

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  tdx!TdxSendConnectionTlRequestComplete+bd

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tdx

IMAGE_NAME:  tdx.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce78935

FAILURE_BUCKET_ID:  0x4E_7_tdx!TdxSendConnectionTlRequestComplete+bd

BUCKET_ID:  0x4E_7_tdx!TdxSendConnectionTlRequestComplete+bd

Followup: MachineOwner
---------

==========================================================================

Debug session time: Sun Feb  5 14:04:11.743 2012 (UTC + 0:00)
System Uptime: 0 days 0:03:07.446
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 8e47ec82, a1df8978, 0}

*** WARNING: Unable to verify timestamp for bckd.sys
*** ERROR: Module load completed but symbols could not be loaded for bckd.sys
Probably caused by : tdx.sys ( tdx!TdxCreateControlChannel+70 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8e47ec82, The address that the exception occurred at
Arg3: a1df8978, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
tdx!TdxCreateControlChannel+70
8e47ec82 89700c          mov     dword ptr [eax+0Ch],esi

TRAP_FRAME:  a1df8978 -- (.trap 0xffffffffa1df8978)
ErrCode = 00000002
eax=00000040 ebx=00000000 ecx=00000002 edx=00000000 esi=84d60ea0 edi=00000003
eip=8e47ec82 esp=a1df89ec ebp=a1df89f4 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
tdx!TdxCreateControlChannel+0x70:
8e47ec82 89700c          mov     dword ptr [eax+0Ch],esi ds:0023:0000004c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  iexplore.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8e486009 to 8e47ec82

STACK_TEXT:  
a1df89f4 8e486009 85aee458 00000040 00000000 tdx!TdxCreateControlChannel+0x70
a1df8a2c 8284a58e 85a38ba0 84d52620 00000000 tdx!TdxTdiDispatchCreate+0x5f
a1df8a44 8e4a3292 00000000 84d526fc 84d52620 nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
a1df8a58 8e49f033 85bd40d0 00000000 84d52620 bckd+0x6292
a1df8a84 8e4a4157 00000000 a1df8aac 8e4a6837 bckd+0x2033
a1df8a90 8e4a6837 85bd4018 84d52620 85bd40d0 bckd+0x7157
a1df8aac 8e4a693e 00bd40d0 84b2ad2c 00000000 bckd+0x9837
a1df8ac8 8e4a788e 85bd40d0 84b2ad2c 84d26964 bckd+0x993e
a1df8ae4 8e4a8336 85bd40d0 84d268d0 84d26964 bckd+0xa88e
a1df8b04 8284a58e 85bd4018 84d268d0 84d268d0 bckd+0xb336
a1df8b1c 8e4d6642 00021c10 871f5b18 84c4b930 nt!IofCallDriver+0x63
a1df8b70 8e4d3dd0 871f5b18 00000000 84d471a0 afd!AfdBeginDisconnect+0x2cb
a1df8be0 8e4d42b5 84d471a0 85a1d030 a1df8c08 afd!AfdCleanupCore+0x346
a1df8bf0 8284a58e 85a1d030 84d471a0 849eca90 afd!AfdDispatch+0x125
a1df8c08 82a45abe 84866650 849eca78 00000001 nt!IofCallDriver+0x63
a1df8c48 82a36f5f 84c16d40 849eca90 00000001 nt!IopCloseFile+0x2f3
a1df8c94 82a583ac 84c16d40 9adcda28 84c47030 nt!ObpDecrementHandleCount+0x139
a1df8cdc 82a580ec 9adcda28 a47beae0 84c16d40 nt!ObpCloseHandleTableEntry+0x203
a1df8d0c 82a58486 84c16d40 84c47001 0229f7c0 nt!ObpCloseHandle+0x7f
a1df8d28 8285121a 00000570 0229f81c 77037094 nt!NtClose+0x4e
a1df8d28 77037094 00000570 0229f81c 77037094 nt!KiFastCallEntry+0x12a
0229f81c 00000000 00000000 00000000 00000000 0x77037094


STACK_COMMAND:  kb

FOLLOWUP_IP: 
tdx!TdxCreateControlChannel+70
8e47ec82 89700c          mov     dword ptr [eax+0Ch],esi

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  tdx!TdxCreateControlChannel+70

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tdx

IMAGE_NAME:  tdx.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce78935

FAILURE_BUCKET_ID:  0x8E_tdx!TdxCreateControlChannel+70

BUCKET_ID:  0x8E_tdx!TdxCreateControlChannel+70

Followup: MachineOwner
---------

==========================================================================

Debug session time: Thu Feb  2 11:33:35.115 2012 (UTC + 0:00)
System Uptime: 0 days 8:34:06.416
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 8d6d4c82, 8c16bbcc, 8c16b7b0}

*** WARNING: Unable to verify timestamp for bckd.sys
*** ERROR: Module load completed but symbols could not be loaded for bckd.sys
Probably caused by : tdx.sys ( tdx!TdxCreateControlChannel+70 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8d6d4c82, The address that the exception occurred at
Arg3: 8c16bbcc, Exception Record Address
Arg4: 8c16b7b0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
tdx!TdxCreateControlChannel+70
8d6d4c82 89700c          mov     dword ptr [eax+0Ch],esi

EXCEPTION_RECORD:  8c16bbcc -- (.exr 0xffffffff8c16bbcc)
ExceptionAddress: 8d6d4c82 (tdx!TdxCreateControlChannel+0x00000070)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 0000060c
Attempt to write to address 0000060c

CONTEXT:  8c16b7b0 -- (.cxr 0xffffffff8c16b7b0)
eax=00000600 ebx=00000000 ecx=00000002 edx=00000000 esi=858a0a78 edi=00000003
eip=8d6d4c82 esp=8c16bc94 ebp=8c16bc9c iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
tdx!TdxCreateControlChannel+0x70:
8d6d4c82 89700c          mov     dword ptr [eax+0Ch],esi ds:0023:0000060c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000001

EXCEPTION_PARAMETER2:  0000060c

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 829b1848
Unable to read MiSystemVaType memory at 82990e20
 0000060c 

FOLLOWUP_IP: 
tdx!TdxCreateControlChannel+70
8d6d4c82 89700c          mov     dword ptr [eax+0Ch],esi

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from 8d6dc009 to 8d6d4c82

STACK_TEXT:  
8c16bc9c 8d6dc009 859e8d90 00000600 00000000 tdx!TdxCreateControlChannel+0x70
8c16bcd4 8287f58e 859e8c88 857ca4f8 00000000 tdx!TdxTdiDispatchCreate+0x5f
8c16bcec 8d6f9292 85afa0d0 00000000 00000000 nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
8c16bd00 8d6f5a08 85afa0d0 00000000 857ca4f8 bckd+0x6292
8c16bd34 8d6feb54 857ca4f8 00000000 00000000 bckd+0x2a08
8c16bd50 82a50fda 8d6f527e ae03581c 00000000 bckd+0xbb54
8c16bd90 828f91f9 8d6fea7e 85afa0d0 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  tdx!TdxCreateControlChannel+70

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tdx

IMAGE_NAME:  tdx.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce78935

STACK_COMMAND:  .cxr 0xffffffff8c16b7b0 ; kb

FAILURE_BUCKET_ID:  0x7E_tdx!TdxCreateControlChannel+70

BUCKET_ID:  0x7E_tdx!TdxCreateControlChannel+70

Followup: MachineOwner
---------

**Budule** · 2012-03-04 22:23

it was clean as i went from xp....i'll uninstall the k9 (have a 9 year old thats likes "boobies") and i dont really use the sandbox thingy so its gone too.....i'll go check on that other driver too.......thank you sir for the debug!!

EDIT: well i uninstalled the K9 and the sandbox and did the driver but it just did it again.......this time it had STOP : 0x000000C4
(ox00000062 ox8e3f5aa4 ox8e3f59bo ox00000002

**Medico** · 2012-03-05 03:40

Graphics drivers can be very finicky. I would definitely try the site that satrow points out for Nvidia drivers. It seems users are reporting more problems with Nvidia drivers recently than others here. Not sure why.

Have you tried ensuring everything is cleaned and all connectors are reseated properly. I would open the case and use some compressed air to blow out any dust bunnies you might find and reseat all cables and cards. Make sure you have shut down and unplugged the PC first and grounded yourself to the case to discharge any static you might have. Reseat the Ram modules as well if you can. Over time things tend to get dirty, get corrosion work loose, etc.

**satrow** · 2012-03-05 04:55

Originally Posted by Budule

it was clean as i went from xp....i'll uninstall the k9 (have a 9 year old thats likes "boobies") and i dont really use the sandbox thingy so its gone too.....i'll go check on that other driver too.......thank you sir for the debug!!

EDIT: well i uninstalled the K9 and the sandbox and did the driver but it just did it again.......this time it had STOP : 0x000000C4
(ox00000062 ox8e3f5aa4 ox8e3f59bo ox00000002

Some of the drivers in the dumps pre-dated W7, like the nForce drivers noted earlier, which is why I wondered if it was upgraded.

Upload the most recent dump, then turn off Driver Verifier, you need to test what's happening without it for a few days/weeks. To turn off Driver Verifier: open it and select "Delete existing settings", then click on "Finish", reboot to remove the settings.

**Budule** · 2012-03-05 08:46

Ok, i'll try that.....and im starting to think it is a graphics problem as sometimes during a reboot (on the black "starting windows" screen) my screen is all messed up, like its sliced in a hundred horizontal sections that zig zag.....once the blue screen come up though, its fine....did the same thing when i installed the new driver.....i may take it apart, replug everything in and just reformat tha thing to see if that helps.......

**satrow** · 2012-03-05 08:52

Originally Posted by Budule

Ok, i'll try that.....and im starting to think it is a graphics problem as sometimes during a reboot (on the black "starting windows" screen) my screen is all messed up, like its sliced in a hundred horizontal sections that zig zag.....once the blue screen come up though, its fine....did the same thing when i installed the new driver.....i may take it apart, replug everything in and just reformat tha thing to see if that helps.......

That reads like hardware, can you borrow a known good graphics card for testing?

**Budule** · 2012-03-05 11:11

No borrow, i guess i could buy one if they aint to much$$$$.......if you could recommend one maybe, no gaming at all on this machine, just online mainly.......

**satrow** · 2012-03-05 12:03

I'm not going to recommend throwing any money at it - until we know for sure where the problems are!

**Budule** · 2012-03-05 12:11

Originally Posted by satrow

I'm not going to recommend throwing any money at it - until we know for sure where the problems are!

Well sir, it's obvious your not in politics........

**happylady** · 2012-03-05 13:20

I don't know if the answer to my problem is already answered so I am posting the data here. This is the info I copied when my hubby got it started:

C:\Windows\Minidump\03412-32713-01.dmp
C:\Users\ \AppData\Local\Temp\WER-1072350-0.sysdata.xml
BCCode: f4
BCP1: 0000000000000003
BCP2: FFFFF A8005 BECB30
BCP3: FFFFF A8005 BEC10
BCP4: FFFFF 80002 FDB8B0

OSVER 6_1_7601
Service Pack 1_0
Product 768_1
Thank you

**satrow** · 2012-03-05 13:52

Originally Posted by happylady

I don't know if the answer to my problem is already answered so I am posting the data here. This is the info I copied when my hubby got it started:

C:\Windows\Minidump\03412-32713-01.dmp
C:\Users\ \AppData\Local\Temp\WER-1072350-0.sysdata.xml
BCCode: f4
BCP1: 0000000000000003
BCP2: FFFFF A8005 BECB30
BCP3: FFFFF A8005 BEC10
BCP4: FFFFF 80002 FDB8B0

OSVER 6_1_7601
Service Pack 1_0
Product 768_1
Thank you

This really needs its' own thread.

0xF4 could be a malware problem, it's frequently related to file security checks within Windows soon after startup.

@ Budule: are you going to upload the latest dump?

Thread: Why Blue Screen of Death every day?

Thread Tools