TechSpot

Shutting down randomly, the computer has rebooted from a bugcheck

By heathws2000
Apr 12, 2012
Post New Reply
  1. My computer keeps turning off and rebooting at random intervals. The error I see in the logs is:

    The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x0000000000000000, 0x0000000000000002, 0x0000000000000008, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 041212-94177-01.

    Every once in a while it gives a BSOD with the error:

    DRIVER.IRQL_NOT_LESS_OR_EQUAL

    The Memory Dump is below for debugging.

    Any help is greatly appreciated.

    I am running Windows 7 Home Edition 64-bit.

    Attached Files:

  2. Tmagic650

    Tmagic650 TS Ambassador Posts: 20,800   +158

    Okay, what is this computer? Make and model?
  3. heathws2000

    heathws2000 TS Rookie Topic Starter

    It is an HP dv7 Notebook computer. The specific specs of it can be found at the link below to HP's website.

    http://h10025.www1.hp.com/ewfrf/wc/...lc=en&lang=en&lc=en&product=5052170&x=15&y=13

    As far as what I am doing on the computer when it gives the BSOD, I have been either browsing the web or working via VPN which I have done without issue for over a year now. The computer started showing these issues about a week ago, almost two now. I did get to run a debugger on the dumps and all of the dumps give the same output which is below.


    Loading Dump File [C:\Users\Heath\Desktop\041412-90402-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505
    Machine Name:
    Kernel base = 0xfffff800`0300d000 PsLoadedModuleList = 0xfffff800`03251650
    Debug session time: Sat Apr 14 20:51:09.337 2012 (UTC - 5:00)
    System Uptime: 0 days 2:44:36.820
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..............................................................
    Loading User Symbols
    Loading unloaded module list
    ..........
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck D1, {0, 2, 8, 0}

    *** WARNING: Unable to verify timestamp for NEOFLTR_710_20169.SYS
    *** ERROR: Module load completed but symbols could not be loaded for NEOFLTR_710_20169.SYS
    Probably caused by : NEOFLTR_710_20169.SYS ( NEOFLTR_710_20169+c63d )

    Followup: MachineOwner
    ---------

    3: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
    Arg4: 0000000000000000, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032bb100
    0000000000000000

    CURRENT_IRQL: 2

    FAULTING_IP:
    +6634663862336237
    00000000`00000000 ?? ???

    PROCESS_NAME: System

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    BUGCHECK_STR: 0xD1

    TRAP_FRAME: fffff88003d7e2f0 -- (.trap 0xfffff88003d7e2f0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffffa800621d9a0 rbx=0000000000000000 rcx=0000000000000000
    rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
    rip=0000000000000000 rsp=fffff88003d7e488 rbp=0000000000000032
    r8=fffff88003d7e670 r9=0000000000000018 r10=0000000000000002
    r11=fffff88003d7e678 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei ng nz na pe nc
    00000000`00000000 ?? ???
    Resetting default scope

    LAST_CONTROL_TRANSFER: from fffff80003089229 to fffff80003089c80

    FAILED_INSTRUCTION_ADDRESS:
    +6634663862336237
    00000000`00000000 ?? ???

    STACK_TEXT:
    fffff880`03d7e488 fffff880`0443b63d : 00000000`000003a1 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0
    fffff880`03d7e490 00000000`000003a1 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`0b986270 : NEOFLTR_710_20169+0xc63d
    fffff880`03d7e498 00000000`00000000 : 00000000`00000000 00000000`00000000 fffffa80`0b986270 00000000`00001000 : 0x3a1


    STACK_COMMAND: .trap 0xfffff88003d7e2f0 ; kb

    FOLLOWUP_IP:
    NEOFLTR_710_20169+c63d
    fffff880`0443b63d ?? ???

    SYMBOL_STACK_INDEX: 1

    SYMBOL_NAME: NEOFLTR_710_20169+c63d

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: NEOFLTR_710_20169

    IMAGE_NAME: NEOFLTR_710_20169.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP: 4f1019a0

    FAILURE_BUCKET_ID: X64_0xD1_CODE_AV_NULL_IP_NEOFLTR_710_20169+c63d

    BUCKET_ID: X64_0xD1_CODE_AV_NULL_IP_NEOFLTR_710_20169+c63d

    Followup: MachineOwner
    ---------

    3: kd> .trap 0xfffff88003d7e2f0
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffffa800621d9a0 rbx=0000000000000000 rcx=0000000000000000
    rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
    rip=0000000000000000 rsp=fffff88003d7e488 rbp=0000000000000032
    r8=fffff88003d7e670 r9=0000000000000018 r10=0000000000000002
    r11=fffff88003d7e678 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei ng nz na pe nc
    00000000`00000000 ?? ???
    ---------
    3: kd> .trap 0xfffff88003d7e2f0
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffffa800621d9a0 rbx=0000000000000000 rcx=0000000000000000
    rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
    rip=0000000000000000 rsp=fffff88003d7e488 rbp=0000000000000032
    r8=fffff88003d7e670 r9=0000000000000018 r10=0000000000000002
    r11=fffff88003d7e678 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei ng nz na pe nc
    00000000`00000000 ?? ???
    -----------
    3: kd> lmvm NEOFLTR_710_20169
    start end module name
    fffff880`0442f000 fffff880`0444a000 NEOFLTR_710_20169 T (no symbols)
    Loaded symbol image file: NEOFLTR_710_20169.SYS
    Image path: \??\C:\Windows\system32\Drivers\NEOFLTR_710_20169.SYS
    Image name: NEOFLTR_710_20169.SYS
    Timestamp: Fri Jan 13 05:46:40 2012 (4F1019A0)
    CheckSum: 000242F0
    ImageSize: 0001B000
    Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
    =========================
    I researched online about the faulting driver and found that it belongs to the Juniper Networks Secure Application Manager via this link http://systemexplorer.net/db/neofltr_710_20169.sys.html.
    I have since uninstalled all applications from Juniper networks as they are not needed for anything that I use on the computer. I even verified in the C:\Windows\System32\drivers folder that the file does not exist yet i had another crash since about two hours after I uninstalled the programs that use the driver. At the time of this post I have Norton 360 running a scan of my registry which will take some time and I will leave running through the night to hopefully clean any references to the driver from the registry that may have been left by the uninstaller. I will let you know if I have anymore crashes, but my research on this driver online did not turn up much information as to what may have caused it to suddenly function the way it has. Any help you could give would be greatly appreciated, I would love to not have my computer turning off at random times because none of my activities seem to trigger it since it has done it during a multitude of times of the day and situations, none of which were issues before.
    I installed the Secure Application manager back in January to test something for my work and have never used it since, therefore I do not know why it suddenly became the cause of my issues.
    Thank you for you help.
  4. Tmagic650

    Tmagic650 TS Ambassador Posts: 20,800   +158

    All the minidumps are the same:
    DRIVER_IRQL_NOT_LESS_OR_EQUAL
    Ntoskrnl.exe

    as originally posted...
    Have you run the memory and hard drive tests mentioned here?:
    Code:
    http://www.techspot.com/community/topics/before-posting-your-minidumps-please-read-this.51365/
  5. HPdv7MOM

    HPdv7MOM TS Rookie

    So I have the exact same problem with my dv7... so what finally fixed yours? Was it the RAM? Any advice would help. Thx.
  6. Tmagic650

    Tmagic650 TS Ambassador Posts: 20,800   +158

    Hey HPdv7MOM, please start your own thread by going to this:
    Windows BSOD, Freezing, Restarting Help

    Start a New Thread, and give us your exact problem and a few more details if possible, and the laptops full model number


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.