Random BSODs for weeks upon end

Random BSODs for weeks upon end Probably caused by : ndis.

caused by : ndis.sys ( ndis+33b67 )



I've been getting random BSOD's ever since I've downloaded a windows update for a few months back and I've finally ran the debug tool and this is what came up.

I have a feeling it's a driver that's making it crash but can't figure out which one. I don't have Avast Anti virus installed which seems to be the answer for some people out there that was having similar problems.





Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff802`fc480000 PsLoadedModuleList = 0xfffff802`fc74aa60
Debug session time: Mon Nov 19 10:40:45.705 2012 (UTC + 0:00)
System Uptime: 0 days 0:14:46.413
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
................................................................


Loading User Symbols
Loading unloaded module list
...................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************


Use !analyze -v to get detailed debugging information.


BugCheck D1, {28, 2, 1, fffff88001b34b67}


*** WARNING: Unable to verify timestamp for ndis.sys
*** ERROR: Module load completed but symbols could not be loaded for ndis.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.


*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ndis.sys ( ndis+33b67 )


Followup: MachineOwner
---------


3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************


DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff88001b34b67, address which referenced memory


Debugging Details:
------------------


***** Kernel symbols are WRONG. Please fix symbols to do analysis.


*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************


ADDITIONAL_DEBUG_TEXT:
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.


MODULE_NAME: ndis


FAULTING_MODULE: fffff802fc480000 nt


DEBUG_FLR_IMAGE_TIMESTAMP: 505ab2b0


WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
0000000000000028


CURRENT_IRQL: 0


FAULTING_IP:
ndis+33b67
fffff880`01b34b67 894128 mov dword ptr [rcx+28h],eax


CUSTOMER_CRASH_COUNT: 1


DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT


BUGCHECK_STR: AV


LAST_CONTROL_TRANSFER: from fffff802fc4fa069 to fffff802fc4fad40


STACK_TEXT:
fffff880`016f82f8 fffff802`fc4fa069 : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000001 : nt+0x7ad40
fffff880`016f8300 00000000`0000000a : 00000000`00000028 00000000`00000002 00000000`00000001 fffff880`01b34b67 : nt+0x7a069
fffff880`016f8308 00000000`00000028 : 00000000`00000002 00000000`00000001 fffff880`01b34b67 00000000`00000000 : 0xa
fffff880`016f8310 00000000`00000002 : 00000000`00000001 fffff880`01b34b67 00000000`00000000 00000000`00000000 : 0x28
fffff880`016f8318 00000000`00000001 : fffff880`01b34b67 00000000`00000000 00000000`00000000 00000000`00000000 : 0x2
fffff880`016f8320 fffff880`01b34b67 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x1
fffff880`016f8328 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis+0x33b67




STACK_COMMAND: kb


FOLLOWUP_IP:
ndis+33b67
fffff880`01b34b67 894128 mov dword ptr [rcx+28h],eax


SYMBOL_STACK_INDEX: 6


SYMBOL_NAME: ndis+33b67


FOLLOWUP_NAME: MachineOwner


IMAGE_NAME: ndis.sys


BUCKET_ID: WRONG_SYMBOLS


Followup: MachineOwner
---------


WARNING: Inaccessible path: 'symfix'

Welcome to Eight Forums.

I'm having no problems with Avast, that was the earlier beta builds that were having issues.

Last 10 of crashes, all the same:
Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller (NDIS6.20)
Check for a driver: ATHEROS drivers for Microsoft Windows (Atheros?????)
Or check your motherboard support site.

Your program ApplePhotoStreams.exe, is crashing a lot, uninstall it for testing.
Also uninstall DAEMON Tools Lite, it is known to cause crashes in Windows.

You have too many Startup programs, remove what is not mandatory from startup.

Unloaded Modules are drivers that aren't loading or have been unloaded indicating a problem driver.

I have no idea where you got this driver from, which seems to be dated 9/22/2011. I can't find a newer one on windows update either. Do you know where you got yours?

Windows has an inbox driver:

;*****************************************************************************
;*
;* L1E62x64.INF - Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller
;* "Copyright (c) 2009, Microsoft”
;*
;* INF File for NDIS6.20 Miniport Driver for Windows 7 x64
;*
;*****************************************************************************
[Version]
Signature = "$Windows NT$"
Class = Net
ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}
Provider = %MSFT%
DriverVer=06/03/2011,1.0.0.23

Also uninstall any third party firewalls, virtualization (vmware), antivirus, vpn solutions and apple bonjour. Consider rolling back to the inbox driver.

Also run the SPTD removal tool.

SPTD.SYS the second biggest cause of BSoDs, used by daemon tools and alcohol120.
Remove any CD virtualization programs such as Daemon Tools and Alcohol 120%.
They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSoDs.
Use this SPTD uninstaller when you're done: DuplexSecure - Downloads
You can use MagicDisc as an alternative.
Freeware MagicISO Virtual CD/DVD-ROM(MagicDisc) Overview