Windows 7 Can't find the cause

bochane

Excellent Member
A fairly new desktop, I can work a day, a week and than suddenly a BSOD.

To my best knowledge I have updated evrything.

Thanks in advance,
Henk
 

Attachments

  • SF_18-10-2012.zip
    1.7 MB · Views: 452
  • HENK-PC.txt
    96.3 KB · Views: 421
Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86Copyright (c) Microsoft Corporation. All rights reserved.




Loading Dump File [C:\Debuggers\dmp_files\101812-18127-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff800`0360b000 PsLoadedModuleList = 0xfffff800`0384f670
Debug session time: Thu Oct 18 18:59:14.733 2012 (UTC + 11:00)
System Uptime: 0 days 0:28:40.607
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************


Use !analyze -v to get detailed debugging information.


BugCheck D1, {0, 2, 8, 0}


Unable to load image \??\C:\Windows\system32\Drivers\NEOFLTR_710_19243.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NEOFLTR_710_19243.SYS
*** ERROR: Module load completed but symbols could not be loaded for NEOFLTR_710_19243.SYS
[COLOR=#ff0000]Probably caused by : NEOFLTR_710_19243.SYS ( NEOFLTR_710_19243+c63d )[/COLOR]


Followup: MachineOwner
---------


6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

[COLOR=#ff0000]
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.[/COLOR]
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory


Debugging Details:
------------------




READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800038b9100
 0000000000000000 


CURRENT_IRQL:  2


[COLOR=#ff0000]FAULTING_IP: 
+69d92faf03c6db1c
00000000`00000000 ??              ???[/COLOR]


[COLOR=#ff0000]PROCESS_NAME:  System[/COLOR]


CUSTOMER_CRASH_COUNT:  1


[COLOR=#ff0000]DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT[/COLOR]


BUGCHECK_STR:  0xD1


TRAP_FRAME:  fffff8800b44e2a0 -- (.trap 0xfffff8800b44e2a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800ae63d40 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000000 rsp=fffff8800b44e438 rbp=0000000000000032
 r8=fffff8800b44e620  r9=0000000000000018 r10=0000000000000002
r11=fffff8800b44e628 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
00000000`00000000 ??              ???
Resetting default scope


LAST_CONTROL_TRANSFER:  from fffff80003689569 to fffff80003689fc0


FAILED_INSTRUCTION_ADDRESS: 
+69d92faf03c6db1c
00000000`00000000 ??              ???


STACK_TEXT:  
fffff880`0b44e438 fffff880`03e7763d : 00000000`00001975 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0
[COLOR=#ff0000]fffff880`0b44e440 00000000`00001975 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`0b3cc110 : NEOFLTR_710_19243+0xc63d[/COLOR]
fffff880`0b44e448 00000000`00000000 : 00000000`00000000 00000000`00000000 fffffa80`0b3cc110 00000000`00001000 : 0x1975




STACK_COMMAND:  .trap 0xfffff8800b44e2a0 ; kb


FOLLOWUP_IP: 
NEOFLTR_710_19243+c63d
fffff880`03e7763d ??              ???


SYMBOL_STACK_INDEX:  1


SYMBOL_NAME:  NEOFLTR_710_19243+c63d


FOLLOWUP_NAME:  MachineOwner


MODULE_NAME: NEOFLTR_710_19243


IMAGE_NAME:  NEOFLTR_710_19243.SYS


DEBUG_FLR_IMAGE_TIMESTAMP:  4e686da8


FAILURE_BUCKET_ID:  X64_0xD1_CODE_AV_NULL_IP_NEOFLTR_710_19243+c63d


BUCKET_ID:  X64_0xD1_CODE_AV_NULL_IP_NEOFLTR_710_19243+c63d


Followup: MachineOwner
---------

6: kd> lmvm NEOFLTR_710_19243
start             end                 module name
fffff880`03e6b000 fffff880`03e86000   NEOFLTR_710_19243 T (no symbols)           
    Loaded symbol image file: NEOFLTR_710_19243.SYS
[COLOR=#ff0000]    Image path: \??\C:\Windows\system32\Drivers\NEOFLTR_710_19243.SYS[/COLOR]
[COLOR=#ff0000]    Image name: NEOFLTR_710_19243.SYS[/COLOR]
    Timestamp:        Thu Sep 08 17:24:24 2011 (4E686DA8)
    CheckSum:         0001A6EA
    ImageSize:        0001B000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

It points to neofltr_710_19243.sys, neofltr_710_19243.sys - What is neofltr_710_19243.sys ?
First try updating the driver. http://www.juniper.net/support/downloads/
If that fails, uninstall it and see if it gives you BSoD's anymore
 
Last edited:
Thanks for the quick answer.

To start with I deinstalled the Juniper software. Furthermore I found in the Device Manager a hidden non PnP leftover of the NEOFLTR driver, I removed that one also.

I will continue to test this computer and I think that if no more crashes appear, say in the next 2 weeks, I am rather sure that this was the solution. I will be back.

Thanks again for all the help
 
Last edited:
May I make suggestion?
if you get another bsod, post back to his thread BUT upload a new .zip file (ie: create a new error report for us to analyze)

Hopefully there won't be another crash though,
good luck!

:)
 
After 2 month without BSOD's I thought it to be a good idea to install and test a newer version of the offending Juniper software.

The current version of the Juniper Secure Application Manager is 7.1.12.21827 (it was I think 7.1.0.19243).
And guess what, another BSOD.

Please find the crash info in the attachment

I think my Pc dislikes Juniper and I will remove it asap


Greetings, Henk
 

Attachments

  • W7F_07-12-2012.zip
    1.9 MB · Views: 553
Last edited:
BSOD blames Juniper again. Un-install it.

Also, you have Pinnacle Studio's MarvinBus software that dates from 2005 and this is known to cause problems on Win7 systems. Please un-install it also.

Please update these older drivers. Links are included to assist in looking up the source of the drivers. If unable to find an update, please remove (un-install) the program responsible for that driver. DO NOT manually delete/rename the driver as it may make the system unbootable! :

MarvinBus64.sys Fri Sep 23 17:17:03 2005 (433470CF)
likely a part of Pinnacle Studio's Marvin Bus
http://www.carrona.org/drivers/driver.php?id=MarvinBus64.sys

RtNdPt60.sys Sun Jul 19 22:27:32 2009 (4A63D614)
Realtek NDIS User mode I/O Driver - Ethernet
http://www.carrona.org/drivers/driver.php?id=RtNdPt60.sys

EIO64.sys Tue Jul 21 22:34:42 2009 (4A667AC2)
ASUS Kernel Mode Driver for NT
http://www.carrona.org/drivers/driver.php?id=EIO64.sys



Analysis:
The following is for informational purposes only.
Code:
[font=lucida console]**************************Fri Dec  7 09:53:11.290 2012 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\120712-17830-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Built by: [B]7601[/B].17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime:[B]0 days 6:11:02.054[/B]
*** WARNING: Unable to verify timestamp for NEOFLTR_7112_21827.SYS
*** ERROR: Module load completed but symbols could not be loaded for NEOFLTR_7112_21827.SYS
Probably caused by :[B]NEOFLTR_7112_21827.SYS ( NEOFLTR_7112_21827+c63d )[/B]
BugCheck [B]D1, {0, 2, 8, 0}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000D1]DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)[/url]
Arguments: 
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory
PROCESS_NAME: [B]System[/B]
BUGCHECK_STR:  0xD1
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
FAILURE_BUCKET_ID: [B]X64_0xD1_CODE_AV_NULL_IP_NEOFLTR_7112_21827+c63d[/B]
CPUID:        "Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz"
MaxSpeed:     3400
CurrentSpeed: [B]3392[/B]
  BIOS Version                  4002
  BIOS Release Date             06/26/2012
  Manufacturer                  ASUSTeK Computer INC.
  Product Name                  CM6630_CM6730_CM6830.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/font]

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.
Code:
[font=lucida console]**************************Fri Dec  7 09:53:11.290 2012 (UTC - 5:00)**************************
[COLOR=RED][B]MarvinBus64.sys             Fri Sep 23 17:17:03 2005 (433470CF)[/B][/COLOR]
intelppm.sys                Mon Jul 13 19:19:25 2009 (4A5BC0FD)
[COLOR=RED][B]RtNdPt60.sys                Sun Jul 19 22:27:32 2009 (4A63D614)[/B][/COLOR]
[COLOR=RED][B]EIO64.sys                   Tue Jul 21 22:34:42 2009 (4A667AC2)[/B][/COLOR]
IOMap64.sys                 Thu Feb  4 20:55:34 2010 (4B6B7A96)
amdxata.sys                 Fri Mar 19 12:18:18 2010 (4BA3A3CA)
AsUpIO.sys                  Mon Aug  2 22:47:59 2010 (4C57835F)
AsIO.sys                    Mon Aug 23 21:53:02 2010 (4C7325FE)
HECIx64.sys                 Tue Oct 19 19:33:43 2010 (4CBE2AD7)
RTKVHD64.sys                Tue Nov 23 05:14:08 2010 (4CEB93F0)
asmtxhci.sys                Wed Feb 23 21:25:47 2011 (4D65C1AB)
asmthub3.sys                Wed Feb 23 21:25:56 2011 (4D65C1B4)
asahci64.sys                Wed Mar 23 03:36:15 2011 (4D89A2EF)
Rt64win7.sys                Fri Jun 10 02:33:15 2011 (4DF1BAAB)
mfehidk.sys                 Wed May 30 11:35:13 2012 (4FC63E31)
mfewfpk.sys                 Wed May 30 11:35:28 2012 (4FC63E40)
mfeapfk.sys                 Wed May 30 11:35:57 2012 (4FC63E5D)
mfeavfk.sys                 Wed May 30 11:36:18 2012 (4FC63E72)
mfefirek.sys                Wed May 30 11:38:10 2012 (4FC63EE2)
cfwids.sys                  Wed May 30 11:38:43 2012 (4FC63F03)
nvhda64v.sys                Tue Jul  3 11:25:04 2012 (4FF30ED0)
NEOFLTR_7112_21827.SYS      Mon Sep 10 03:57:18 2012 (504D9D5E)
nvlddmkm.sys                Fri Nov 30 22:24:02 2012 (50B97852)
[/font]
http://www.carrona.org/drivers/driver.php?id=MarvinBus64.sys
http://www.carrona.org/drivers/driver.php?id=intelppm.sys
http://www.carrona.org/drivers/driver.php?id=RtNdPt60.sys
http://www.carrona.org/drivers/driver.php?id=EIO64.sys
http://www.carrona.org/drivers/driver.php?id=IOMap64.sys
http://www.carrona.org/drivers/driver.php?id=amdxata.sys
http://www.carrona.org/drivers/driver.php?id=AsUpIO.sys
http://www.carrona.org/drivers/driver.php?id=AsIO.sys
http://www.carrona.org/drivers/driver.php?id=HECIx64.sys
http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys
http://www.carrona.org/drivers/driver.php?id=asmtxhci.sys
http://www.carrona.org/drivers/driver.php?id=asmthub3.sys
http://www.carrona.org/drivers/driver.php?id=asahci64.sys
http://www.carrona.org/drivers/driver.php?id=Rt64win7.sys
http://www.carrona.org/drivers/driver.php?id=mfehidk.sys
http://www.carrona.org/drivers/driver.php?id=mfewfpk.sys
http://www.carrona.org/drivers/driver.php?id=mfeapfk.sys
http://www.carrona.org/drivers/driver.php?id=mfeavfk.sys
http://www.carrona.org/drivers/driver.php?id=mfefirek.sys
http://www.carrona.org/drivers/driver.php?id=cfwids.sys
http://www.carrona.org/drivers/driver.php?id=nvhda64v.sys
NEOFLTR_7112_21827.SYS - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=nvlddmkm.sys
 
Hallo John

Thank you for your fast and accurate answer.

The Juniper software has been removed. There are 2 references in 'Currently installed programs', which can be used to undelete, and one 'Hidden Device' in the 'Non-plug and Play Drivers' in the Device Manager which should be uninstalled manually.

I have 2 Pinnacle products installed: Pinnacle Studio 15 and Avis Studio 1 installed. One of them should be responsable for the old Marvin driver. I will look in that.

I should be able to update the Realtek and Asus drivers either from Asus site or from the Microsoft site.

Thanks again for the quick help and have a nice weekend
 
Last edited:
For the two Pinnacle Products, try uninstalling both of them first, instead of figuring it out one at a time.

Realtek Drivers should be from Realtek's driver download site: Realtek
 
To start with, my PC is an Asus CM6730, Mobo CM6330_CM6630_CM6730_CM6830, I upgraded the graphics card with an ASUS GTX560 Ti and put in some more memory.

The old drivers:
EIO64.sys - 1.9.7.0: part of either 'ASUS AI Suite' or 'Smartdoctor for the ASUS GTX560 Ti'. I don't need them, removing them removed that driver.

RtNdPt60.sys - 6.0.717.2009: I downloaded from the Realtek site for my 'Realtek PCIe GBE Family Controller' 'Win7 and WinServer 2008 R2 Auto Installation Program (SID:1546351)' 7.065 update time 2012/11/23 and 'repaired' my current installation. Whatever I did that NDIS driver kept the same version. Now I don't know how to get a newer NDIS driver installed.

Marvinbus
That is a different story. The main reason I bought this PC is video editing. And now Pinnacle has left me with a buggy old driver. Removing S15 and AS1.1 leaves me with a reliable and stable computer but unable to do the task I bought it for. I think the best way to proceed is finishing my current project, then removing one by one both S15 and AS1.1. The old line Studio 7 until Studio 15 has not been continued, the new line is Avid Studio 1.1, Studio 16. It has a new engine. And I hope that the old Marvin bus has been dropped also. I will be back on this topic.

Thanks for all your help
 
Last edited:
The Juniper software is used to login from home onto my company's computer system. I reported these crashes at the service desk, they, in turn, reported it to the firm they bought it from Avensus.

The reply of Avensus is "Not recognized"

Grrrrrrr, they did not even try. For them I am just an oldtimer from a different time (and indeed I work with computers since 1968) ......... *^*&^^^@#

Season greetings, Henk
 
Last edited:
Back
Top