Acer 357z BSOD

mon2010 · Feb 20, 2011

Hi,
I am having BSODS after few moments of startup,it just came from no where.I have not add any software,hardware to it.

thanks

Code:

Loading Dump File [C:\Documents and Settings\a\Desktop\Minidump\022011-35568-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*[url]http://msdl.microsoft.com/download/symbols[/url]
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`01e0f000 PsLoadedModuleList = 0xfffff800`0204ce50
Debug session time: Sun Feb 20 01:10:11.398 2011 (GMT+0)
System Uptime: 0 days 0:00:44.023
Loading Kernel Symbols
...............................................................
...............................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {246, 2, 0, fffff80001ea0c06}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000246, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80001ea0c06, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800020b70e0
 0000000000000246 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+c73
fffff800`01ea0c06 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  wlanext.exe

IRP_ADDRESS:  ffffffffffffff88

TRAP_FRAME:  fffff880039ebf60 -- (.trap 0xfffff880039ebf60)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff880039ec3b8 rbx=0000000000000000 rcx=0000000000000246
rdx=0000000000000246 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001ea0c06 rsp=fffff880039ec0f0 rbp=fffff880039ec240
 r8=fffffa8003d709a0  r9=fffff880039ec1f0 r10=0000000000000002
r11=fffffa8004028150 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!IopCompleteRequest+0xc73:
fffff800`01ea0c06 488b09          mov     rcx,qword ptr [rcx] ds:e6a8:00000000`00000246=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80001e80469 to fffff80001e80f00

STACK_TEXT:  
fffff880`039ebe18 fffff800`01e80469 : 00000000`0000000a 00000000`00000246 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`039ebe20 fffff800`01e7f0e0 : fffff8a0`03e7f140 fffffa80`03e84a50 fffff880`039ec180 fffffa80`0414ac10 : nt!KiBugCheckDispatch+0x69
fffff880`039ebf60 fffff800`01ea0c06 : fffff880`00001f86 fffffa80`00001fc4 00000006`00000000 fffff6fc`50008830 : nt!KiPageFault+0x260
fffff880`039ec0f0 fffff800`01e5d92f : 00000000`00000000 00000000`00000001 fffffa80`02494000 fffffa80`00000000 : nt!IopCompleteRequest+0xc73
fffff880`039ec1c0 fffff800`01e5dce7 : fffffa80`02e94000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`039ec240 00000000`00000200 : 00000000`00000000 00000000`00000000 fffff8a0`01106000 fffff880`039ec718 : nt!KiApcInterrupt+0xd7
fffff880`039ec3d0 00000000`00000000 : 00000000`00000000 fffff8a0`01106000 fffff880`039ec718 fffffa80`0235bc80 : 0x200


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`01e7f0e0 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0xA_nt!KiPageFault+260

BUCKET_ID:  X64_0xA_nt!KiPageFault+260

Followup: MachineOwner
---------

jcgriff2 · Feb 20, 2011

The dump has bugcheck 0xa = driver attempted to access pageable memory (or plain bad memory) when IRQL too high.

System was up for just 44 seconds before BSOD.

Process running = wlanext.exe = related to wifi.

Turn wifi switch OFF before or during bootup. If system still BSODs, boot into SAFEMODE (NO Networking) and run -

Blue Screen of Death (BSOD) Posting Instructions - Windows 7 & Vista

You'll have to copy the 2 EXE files in via USB stick or CD/DVD, then copy out resulting files.

How did you get dump file out to run Windbg if system BSODs on start-up?

Regards. . .

jcgriff2

`

mon2010 · Feb 20, 2011

I copied the dump file using live cd to other pc which has windbg

jcgriff2 · Feb 20, 2011

Just curious.... thank you.

Try the no-wifi boot as well as SAFEMODE.

mon2010 · Mar 5, 2011

Sorry for the very late reply.

I did all test with wireless on in normal boot.

When wilreless on it crash very quickly, if it is off than it also crashes but after sometime.

Here are the attachments for sysinternal file is name AutoRuns.arn and jcgriff tool

Also in sysnternal i found the following 4 process in task odd

\At1 Installer Hugiti Sinavuqyxi c:\users\a\appdata\local\temp\disma.exe

\At2 Installer Lykowi Worazytabi c:\users\a\appdata\local\temp\hostnameb.exe

\At3 Installer Vetyhy Gybojedily c:\users\a\appdata\local\temp\narratorb.exe

thanks in advance for all your help

\At4 Installer Izama Lagunijura c:\users\a\appdata\local\temp\rrinstallerb.exe

mon2010 · Mar 5, 2011

Also please suggest how can i analyze these four files.In the virus scanner it is not detecting.

thanks

reventon · Mar 8, 2011

I agree, those four files look very suspicious to me. You need to deal with them before anything else.

You should post in the Virus/Trojan/Spyware Help Forum for assistance by a trained analyst.

Make sure you follow THESE STEPS carefully before posting in the Security Forum.

Acer 357z BSOD

Attachments

Top Contributors this Month

Recommended Communities