Windows 8 and 8.1 Forums


Random BSODs for weeks upon end

  1. #1


    Posts : 1
    Win 8

    Random BSODs for weeks upon end Probably caused by : ndis.


    caused by : ndis.sys ( ndis+33b67 )



    I've been getting random BSOD's ever since I've downloaded a windows update for a few months back and I've finally ran the debug tool and this is what came up.

    I have a feeling it's a driver that's making it crash but can't figure out which one. I don't have Avast Anti virus installed which seems to be the answer for some people out there that was having similar problems.





    Symbol search path is: *** Invalid ***
    ****************************************************************************
    * Symbol loading may be unreliable without a symbol search path. *
    * Use .symfix to have the debugger choose a symbol path. *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ****************************************************************************
    Executable search path is:
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    * *
    * The Symbol Path can be set by: *
    * using the _NT_SYMBOL_PATH environment variable. *
    * using the -y <symbol_path> argument when starting the debugger. *
    * using .sympath and .sympath+ *
    *********************************************************************
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Windows 8 Kernel Version 9200 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0xfffff802`fc480000 PsLoadedModuleList = 0xfffff802`fc74aa60
    Debug session time: Mon Nov 19 10:40:45.705 2012 (UTC + 0:00)
    System Uptime: 0 days 0:14:46.413
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    * *
    * The Symbol Path can be set by: *
    * using the _NT_SYMBOL_PATH environment variable. *
    * using the -y <symbol_path> argument when starting the debugger. *
    * using .sympath and .sympath+ *
    *********************************************************************
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................................


    Loading User Symbols
    Loading unloaded module list
    ...................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************


    Use !analyze -v to get detailed debugging information.


    BugCheck D1, {28, 2, 1, fffff88001b34b67}


    *** WARNING: Unable to verify timestamp for ndis.sys
    *** ERROR: Module load completed but symbols could not be loaded for ndis.sys
    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.


    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    Probably caused by : ndis.sys ( ndis+33b67 )


    Followup: MachineOwner
    ---------


    3: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************


    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 0000000000000028, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
    Arg4: fffff88001b34b67, address which referenced memory


    Debugging Details:
    ------------------


    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.


    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************


    ADDITIONAL_DEBUG_TEXT:
    You can run '.symfix; .reload' to try to fix the symbol path and load symbols.


    MODULE_NAME: ndis


    FAULTING_MODULE: fffff802fc480000 nt


    DEBUG_FLR_IMAGE_TIMESTAMP: 505ab2b0


    WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
    unable to get nt!MmSpecialPoolEnd
    unable to get nt!MmPagedPoolEnd
    unable to get nt!MmNonPagedPoolStart
    unable to get nt!MmSizeOfNonPagedPoolInBytes
    0000000000000028


    CURRENT_IRQL: 0


    FAULTING_IP:
    ndis+33b67
    fffff880`01b34b67 894128 mov dword ptr [rcx+28h],eax


    CUSTOMER_CRASH_COUNT: 1


    DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT


    BUGCHECK_STR: AV


    LAST_CONTROL_TRANSFER: from fffff802fc4fa069 to fffff802fc4fad40


    STACK_TEXT:
    fffff880`016f82f8 fffff802`fc4fa069 : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000001 : nt+0x7ad40
    fffff880`016f8300 00000000`0000000a : 00000000`00000028 00000000`00000002 00000000`00000001 fffff880`01b34b67 : nt+0x7a069
    fffff880`016f8308 00000000`00000028 : 00000000`00000002 00000000`00000001 fffff880`01b34b67 00000000`00000000 : 0xa
    fffff880`016f8310 00000000`00000002 : 00000000`00000001 fffff880`01b34b67 00000000`00000000 00000000`00000000 : 0x28
    fffff880`016f8318 00000000`00000001 : fffff880`01b34b67 00000000`00000000 00000000`00000000 00000000`00000000 : 0x2
    fffff880`016f8320 fffff880`01b34b67 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x1
    fffff880`016f8328 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis+0x33b67




    STACK_COMMAND: kb


    FOLLOWUP_IP:
    ndis+33b67
    fffff880`01b34b67 894128 mov dword ptr [rcx+28h],eax


    SYMBOL_STACK_INDEX: 6


    SYMBOL_NAME: ndis+33b67


    FOLLOWUP_NAME: MachineOwner


    IMAGE_NAME: ndis.sys


    BUCKET_ID: WRONG_SYMBOLS


    Followup: MachineOwner
    ---------


    WARNING: Inaccessible path: 'symfix'
    Last edited by digzz; 20 Nov 2012 at 06:00.

      My System SpecsSystem Spec

  2. #2


    Tropical Island Pair a Dice
    Posts : 3,030
    Windows 8.1 Pro x64/ Windows 7 Ult x64


    Welcome to Eight Forums.

    I'm having no problems with Avast, that was the earlier beta builds that were having issues.

    Last 10 of crashes, all the same:
    Code:
    STOP 0x000000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL
    Usual causes:  Device driver
    Probably caused by : L1E62x64.sys ( L1E62x64+691f ) - Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller (NDIS6.20)
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    SYMBOL_NAME:  L1E62x64+691f
    IMAGE_NAME:  L1E62x64.sys
    FAILURE_BUCKET_ID:  AV_L1E62x64+691f
    Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller (NDIS6.20)
    Check for a driver: ATHEROS drivers for Microsoft Windows (Atheros?????)
    Or check your motherboard support site.

    Your program ApplePhotoStreams.exe, is crashing a lot, uninstall it for testing.
    Also uninstall DAEMON Tools Lite, it is known to cause crashes in Windows.

    You have too many Startup programs, remove what is not mandatory from startup.

    Unloaded Modules are drivers that aren't loading or have been unloaded indicating a problem driver.
    Code:
    Unloaded modules:
    fffff880`0aca7000 fffff880`0acb4000   vwifibus.sys - Virtual WiFi Bus Driver - Windows driver
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000D000
    fffff880`0ac34000 fffff880`0aca7000   netr6164.sys - Ralink RT2561 RT2661 series Wireless LAN Card (you may have a different manufacturer)
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00073000
    fffff880`0e340000 fffff880`0e34a000   vwifimp.sys -Microsoft Virtual WiFi Miniport Driver
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000A000
    fffff880`0f1bd000 fffff880`0f1f3000   WUDFRd.sys - Windows Driver Foundation - User-mode Driver Framework Reflector
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00036000
    fffff880`0f181000 fffff880`0f188000   tmp1573.tmp - ?
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00007000
    fffff880`0f0cb000 fffff880`0f113000   mfeavfk01.sy - McAfee Firewall Total Protection 2010
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00048000
    
    fffff880`0cb96000 fffff880`0cbb0000   EhStorClass. - Windows Enhanced Storage
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001A000
    fffff880`0c8f1000 fffff880`0c90b000   EhStorClass.
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001A000
    fffff880`0c8d7000 fffff880`0c8f1000   EhStorClass.
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001A000
    fffff880`0c8bd000 fffff880`0c8d7000   EhStorClass.
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001A000
    fffff880`0c8a3000 fffff880`0c8bd000   EhStorClass.
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001A000
    fffff880`0c889000 fffff880`0c8a3000   EhStorClass.
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001A000
    fffff880`017b8000 fffff880`017d2000   EhStorClass.
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001A000
    fffff880`0a3eb000 fffff880`0a3fb000   dam.sys - Windows DAM Kernel Driver
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00010000
    fffff880`00f53000 fffff880`00f5d000   tbs.sys 
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000A000
    fffff880`00f44000 fffff880`00f53000   mfeelamk.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000F000
    fffff880`023c6000 fffff880`023d2000   hwpolicy.sys - Windows Hardware Policy Driver
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000C000
    fffff880`014f4000 fffff880`01628000   sptd.sys -  DAEMON Tools
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00134000
    fffff880`00cc2000 fffff880`00ccf000   ApiSetSchema
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000D000
    Last edited by Dave76; 21 Nov 2012 at 09:37.
      My System SpecsSystem Spec

  3. #3


    Posts : 197
    Win 8 Enterprise RTM


    I have no idea where you got this driver from, which seems to be dated 9/22/2011. I can't find a newer one on windows update either. Do you know where you got yours?

    Windows has an inbox driver:

    ;*****************************************************************************
    ;*
    ;* L1E62x64.INF - Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller
    ;* "Copyright (c) 2009, Microsoft”
    ;*
    ;* INF File for NDIS6.20 Miniport Driver for Windows 7 x64
    ;*
    ;*****************************************************************************
    [Version]
    Signature = "$Windows NT$"
    Class = Net
    ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}
    Provider = %MSFT%
    DriverVer=06/03/2011,1.0.0.23

    Also uninstall any third party firewalls, virtualization (vmware), antivirus, vpn solutions and apple bonjour. Consider rolling back to the inbox driver.
      My System SpecsSystem Spec

  4. #4


    Tropical Island Pair a Dice
    Posts : 3,030
    Windows 8.1 Pro x64/ Windows 7 Ult x64


    Also run the SPTD removal tool.

    SPTD.SYS the second biggest cause of BSoDs, used by daemon tools and alcohol120.
    Remove any CD virtualization programs such as Daemon Tools and Alcohol 120%.
    They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSoDs.
    Use this SPTD uninstaller when you're done: DuplexSecure - Downloads
    You can use MagicDisc as an alternative.
    Freeware MagicISO Virtual CD/DVD-ROM(MagicDisc) Overview
      My System SpecsSystem Spec

Random BSODs for weeks upon end
Related Threads
Solved Random BSODs in BSOD Crashes and Debugging
Hi, I keep getting random BSODs. What I don't understand at all is the fact that sometimes I get several a day, and sometimes I don't get a single one for a month. Here is the info from the last few days: 52760 Thank you.
Random BSODs Out Of Nowhere in BSOD Crashes and Debugging
Without having to do all the other tool running, are you able to determine the cause from my dmp files? Running the other tools will be much harder for me.
Solved Random BSODs and restarts in BSOD Crashes and Debugging
I recently reinstalled my Windows twice because of stability issues and have now been experiencing random bluescreens and restarts. We've been trying to solve this for days, even had a guy stress test it for over 30 hours but he didn't have any BSODs then.. Now I've got it back and the problems...
Random BSODs in BSOD Crashes and Debugging
I have been having the occasional BSOD for a little while, but lately they have become more frequent. Many times while trying to upload large video files to YouTube, but also while just browsing the internet, or playing games. It is quite frustrating. I built this computer earlier this year. Here...
Random BSODs in BSOD Crashes and Debugging
Hi all. I have been having issues with bsod's for a month or two now, which is quite frustrating. I was having them every hour or so at one stage, however i debugged some issues, such as outdated drivers etc, and it isn't quite as frequent now. It now occurs 1-3 times a day on average during...
random bsods on 8.1 in BSOD Crashes and Debugging
I checked ram with hci test and cpu stability with prime95, everything went smoothly and without errors. But i got 2 bsods afterwards when i tried to type url in firefox.
Solved Random BSODs in BSOD Crashes and Debugging
Hello, I have recently replaced my motherboard and my processor and since the upgrade I have been experiencing random bluescreens. At the time I was running win7 and the error codes I got were: irql_not_less_or_equal page_fault_in_nonpaged_area system_thread_exception_not_handled I ran...
Eight Forums Android App Eight Forums IOS App Follow us on Facebook