Windows 7 BSOD ndiswan.sys
I've been having Windows 7 blues screen on me a few times a week.This is on a Dell laptop that ran Vista without issue.New install, just Windows 7, no dual boot, etc.Log Name: SystemSource: Microsoft-Windows-WER-SystemErrorReportingDate: 2/2/2009 12:14:36 PMEvent ID: 1001Task Category: NoneLevel: ErrorKeywords: ClassicUser: N/AComputer: BOPPERMANNPC.srct.corpDescription:The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x96e4dddc, 0x00000002, 0x00000008, 0x96e4dddc). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 020209-24819-01.Event Xml:<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" /> <EventID Qualifiers="16384">1001</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2009-02-02T18:14:36.000000000Z" /> <EventRecordID>6369</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>BOPPERMANNPC.srct.corp</Computer> <Security /> </System> <EventData> <Data Name="param1">0x000000d1 (0x96e4dddc, 0x00000002, 0x00000008, 0x96e4dddc)</Data> <Data Name="param2">C:\Windows\MEMORY.DMP</Data> <Data Name="param3">020209-24819-01</Data> </EventData></Event>Microsoft (R) Windows Debugger Version 6.9.0003.113 X86Copyright (c) Microsoft Corporation. All rights reserved.Loading Dump File [C:\Windows\MEMORY.DMP]Kernel Summary Dump File: Only kernel address space is availableSymbol search path is: SRV*c:\Symbols*http://msdl.microsoft.com/download/symbolsExecutable search path is: Windows 7 Kernel Version 7000 MP (2 procs) Free x86 compatibleProduct: WinNt, suite: TerminalServer SingleUserTSBuilt by: 7000.0.x86fre.winmain_win7beta.081212-1400Kernel base = 0x82a45000 PsLoadedModuleList = 0x82b9c830Debug session time: Mon Feb 2 12:13:39.191 2009 (GMT-6)System Uptime: 0 days 3:59:40.385Loading Kernel Symbols...............................................................................................................................................................................................Loading User SymbolsLoading unloaded module list.............******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************Use !analyze -v to get detailed debugging information.BugCheck D1, {96e4dddc, 2, 8, 96e4dddc}*** ERROR: Module load completed but symbols could not be loaded for klim6.sysProbably caused by : ndiswan.sys ( ndiswan!MPSendPackets+0 )Followup: MachineOwner---------1: kd> !analyze -v******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)An attempt was made to access a pageable (or completely invalid) address at aninterrupt request level (IRQL) that is too high. This is usuallycaused by drivers using improper addresses.If kernel debugger is available get stack backtrace.Arguments:Arg1: 96e4dddc, memory referencedArg2: 00000002, IRQLArg3: 00000008, value 0 = read operation, 1 = write operationArg4: 96e4dddc, address which referenced memoryDebugging Details:------------------READ_ADDRESS: 96e4dddc Special poolCURRENT_IRQL: 2FAULTING_IP: ndiswan!MPSendPackets+096e4dddc 8bff mov edi,ediDEFAULT_BUCKET_ID: VISTA_DRIVER_FAULTBUGCHECK_STR: 0xD1PROCESS_NAME: SystemTRAP_FRAME: 9643f62c -- (.trap 0xffffffff9643f62c)ErrCode = 00000010eax=24473090 ebx=893e3600 ecx=9643f6e4 edx=00000000 esi=8649ce28 edi=86b6c0e0eip=96e4dddc esp=9643f6a0 ebp=9643f6c4 iopl=0 nv up ei pl nz na po nccs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202ndiswan!MPSendPackets:96e4dddc 8bff mov edi,ediResetting default scopeLAST_CONTROL_TRANSFER: from 96e4dddc to 82a9f9ebFAILED_INSTRUCTION_ADDRESS: ndiswan!MPSendPackets+096e4dddc 8bff mov edi,ediSTACK_TEXT: 9643f62c 96e4dddc badb0d00 00000000 8c62045f nt!KiTrap0E+0x2cf9643f69c 8c670472 881da910 9643f6e4 00000001 ndiswan!MPSendPackets9643f6c4 8c670297 9643f6e8 9643f6e4 00000001 ndis!ndisMSendPacketsXToMiniport+0x1429643f72c 8c609249 86b6c0e0 893e3678 00000000 ndis!ndisMSendNetBufferListsToPackets+0x849643f74c 8c609196 893e3678 893e3678 00000000 ndis!ndisFilterSendNetBufferLists+0x879643f764 8c7f6ad5 881dd0a8 893e3678 00000000 ndis!NdisFSendNetBufferLists+0x18WARNING: Stack unwind information not available. Following frames may be wrong.9643f858 82a14449 00000000 86a3cf02 87d876f8 klim6+0x2ad59643f868 82a1204b 32000045 00005700 e9488bff hal!KfLowerIrql+0x659643f8a8 8c7f65d4 85ad60d0 00000000 85ad60d0 hal!KfReleaseSpinLock+0xb9643f8c0 8c7f66a4 85ad60d0 8c7f70a8 8c7f70a4 klim6+0x25d400000000 00000000 00000000 00000000 00000000 klim6+0x26a4STACK_COMMAND: kbFOLLOWUP_IP: ndiswan!MPSendPackets+096e4dddc 8bff mov edi,ediSYMBOL_STACK_INDEX: 1SYMBOL_NAME: ndiswan!MPSendPackets+0FOLLOWUP_NAME: MachineOwnerMODULE_NAME: ndiswanIMAGE_NAME: ndiswan.sysDEBUG_FLR_IMAGE_TIMESTAMP: 4943237bFAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_ndiswan!MPSendPackets+0BUCKET_ID: 0xD1_CODE_AV_BAD_IP_ndiswan!MPSendPackets+0Followup: MachineOwner---------
February 2nd, 2009 9:27pm

I'd suspect the klim6 file that's referenced in the stack. This should be a part of your Kaspersky installation - so an uninstall of Kaspersky should show you if this is the issue or not.Further, I'd suspect it's either a part of the Kaspersky "phone home" stuff, or a part of their update manager that's causing the issue (because it's associated with your network).- John
Free Windows Admin Tool Kit Click here and download it now
February 3rd, 2009 12:44am

Had the same problem, I went over to the developers blog and they have a link up to Kaspersky's windows 7 test AV program. You can find it here:http://www.kaspersky.com/windows7Haven't had a BSOD since. Hope that helps!
February 19th, 2009 7:10pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics