ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY MsMpEng.exe on Windows 8

S

Sebazzz

Member
Joined
Jan 2, 2013
Posts
12
Hi all,

Having the same issue as this guy: A BSOD of ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY on Windows 8 is either left idle or when explicitly scanning using Windows Defender.

To start, the following details of my system:
Windows 8 64-bit, retail
Original OS: Windows 7 Pro 64-bit (Windows 8 supported)
Age of system: one year.
Age of OS installation: 10 days.

CPU: Intel Core i7
Video Card: NVIDIA NVS 4200 and Intel integrated
Chipset: Intel ICH9

System manufacturer: Dell
Model number: Latitude E6520

Before Windows 8, I used Windows 7 Pro 64-bit, and had never any BSOD issue. Each BSOD on Windows 8 has now been the exact same problem.

Attached you'il find the BSOD summary as per BSOD posting instructions and a bugcheck analysis from the Windows Debugger (Windbg). I can upload a memory dump if you like.
 

Attachments

perfmon reports that Broadcom USH w/swipe sensor drivers haven't been installed. Please visit the manufacture's website to download and install these drivers.

We've seen a number of BSOD issues with SSD's. Here's the information that I've compiled so far:
There's not a whole bunch available to test SSD's. The "easiest" test is to remove the SSD, install a platter-based hard drive, install Windows and test for stability that way.

Here's some suggestions:
- Update the SSD's firmware to the latest available version (VERY IMPORTANT!!!)
- Update the motherboard controllers drivers to the latest available version from the controller manufacturer (NOT the mobo manufacturer unless you can't find any on the controller manufacturer's website)
- Slow the memory (RAM) down to the next slower speed (I've only seen one person who claimed that this worked for them).
- Use any manufacturer's utilities that you may have. If you don't have any, then try this free one (I haven't used it myself): Crystal Dew World
- Update chipset and storage controller drivers to the latest available from the manufacturer of the device (not the manufacturer of the motherboard). Be sure to update ALL controllers on the motherboard!
....NOTE: Recently (Nov 2011) we had BSOD issues with the Marvell 91xx controller and an SSD. You may have to switch controllers also.
- Replace the SSD with a platter based hard drive and see if that stops the BSOD's. If it does, then it's likely that there's a problem with the SSD OR an incompatibility with your system.
It's my opinion that SSD's aren't reliable enough (with current hardware) to be used on a system that needs to work reliably. Until I see reliability I will not recommend, nor will I use, SSD's for critical applications.
06 Dec 2011 - This post tends to confirm issues with certain SSD chipsets and certain controllers - [SOLVED] cant find the cause of BSOD F4 - Tech Support Forum
29 May 2012 - The frequency of BSOD's with SSD's seems to have been decreasing over the last several months. It may be approaching time to re-evaluate my stand on their suitability for use in production systems.
10 Nov 2012 - I'm seeing an upswing in SSD errors - but most appear due to older storage controller drivers. I strongly suggest NOT using storage controller drivers that don't date from 2012 (if none are available, don't connect an SSD to that controller)
Click to expand...

Daemon Tools (and Alcohol 120% software) are known to cause BSOD's on some Win7 systems (mostly due to the sptd.sys driver, although I have seen dtsoftbus01.sys blamed on several occasions). I strongly suspect that this hold true for Win8 systems also.
Please un-install the program, then use the following free tool to ensure that the troublesome sptd.sys driver is removed from your system (pick the 32 or 64 bit system depending on your system's configuration): DuplexSecure - FAQ Link broken as of 21 Jul 2012
New link (15 Aug 2012): DuplexSecure - Downloads (pick the appropriate version for your system and select "Un-install" when you run it).
Alternate link: Disc-Tools.com
Manual procedure here: Registry and SPTD problems | DAEMON Pro Help
Click to expand...

I note issues with your Microsoft Security Essentials software not releasing it's dynamic drivers. Please:
- uninstall the program, then immediately download and install a fresh copy
- scan your system for viruses (free scans here: Free Online AntiMalware Resources )

Please update these older drivers. Links are included to assist in looking up the source of the drivers. If unable to find an update, please remove (un-install) the program responsible for that driver. DO NOT manually delete/rename the driver as it may make the system unbootable! :

You MUST un-install this one. It dates from 2005 and isn't compatible with your Win7 system.
usbVM31b.sys Mon Sep 19 02:57:34 2005 (432E615E)
vm301b intelli kingstone usb vimicro USB PC camera (zc0301PL) - NO Vista drivers
http://www.carrona.org/drivers/driver.php?id=usbVM31b.sys

HECIx64.sys Tue Oct 19 19:33:43 2010 (4CBE2AD7)
Intel Management Engine Interface
http://www.carrona.org/drivers/driver.php?id=HECIx64.sys

O2MDRw7x64.sys Mon Jan 3 01:14:59 2011 (4D216963)
O2Micro Integrated MS/MSPRO/xD Controller
http://www.carrona.org/drivers/driver.php?id=O2MDRw7x64.sys

o2sdjw7x64.sys Tue Mar 22 07:56:31 2011 (4D888E6F)
O2Micro Integrated MMC/SD controller
http://www.carrona.org/drivers/driver.php?id=o2sdjw7x64.sys

Apfiltr.sys Wed May 25 21:54:58 2011 (4DDDB2F2)
Alps pointing device
http://www.carrona.org/drivers/driver.php?id=Apfiltr.sys

stdcfltn.sys Sat Jul 16 00:31:13 2011 (4E211411)
Disk Class Filter Driver for Accelerometer by ST MicroElectronics
http://www.carrona.org/drivers/driver.php?id=stdcfltn.sys

accelern.sys Fri Jul 22 15:28:40 2011 (4E29CF68)
ST MicroElectronics Accelerometer
http://www.carrona.org/drivers/driver.php?id=accelern.sys

ksaud.sys Tue Sep 13 02:45:04 2011 (4E6EFBF0)
Creative Technology Sound Blaster USB Audio
http://www.carrona.org/drivers/driver.php?id=ksaud.sys

NETwNs64.sys Thu Oct 6 10:45:03 2011 (4E8DBEEF)
Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7
http://www.carrona.org/drivers/driver.php?id=NETwNs64.sys

vmm.sys Wed Dec 28 08:28:47 2011 (4EFB198F)
Virtual Machine Monitor driver - Microsoft Virtual PC 2004
http://www.carrona.org/drivers/driver.php?id=vmm.sys

sptd.sys Sat Aug 18 17:05:38 2012 (503003A2)
SCSI Pass Through Direct Host - Daemon Tools (known BSOD issues with Win7)
http://www.carrona.org/drivers/driver.php?id=sptd.sys



Analysis:
The following is for informational purposes only.
Code: 
[font=lucida console]**************************Wed Jan  2 11:03:33.127 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\010213-12136-01.dmp]
Windows 8 Kernel Version 9200 MP (8 procs) Free x64
Built by: [B]9200[/B].16461.amd64fre.win8_gdr.121119-1606
System Uptime:[B]0 days 22:43:14.853[/B]
Probably caused by :[B]ndis.sys ( ndis!ndisDummyIrpHandler+8b )[/B]
BugCheck [B]FC, {fffff88001cdadb0, 8000000227f13963, fffff8801c178210, 2}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000FC]ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)[/url]
Arguments: 
Arg1: fffff88001cdadb0, Virtual address for the attempted execute.
Arg2: 8000000227f13963, PTE contents.
Arg3: fffff8801c178210, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME: [B]MsMpEng.exe[/B]
FAILURE_BUCKET_ID: [B]0xFC_ndis!ndisDummyIrpHandler[/B]
CPUID:        "Intel(R) Core(TM) i7-2760QM CPU @ 2.40GHz"
MaxSpeed:     2400
CurrentSpeed: [B]2395[/B]
  BIOS Version                  A15
  BIOS Release Date             08/15/2012
  Manufacturer                  Dell Inc.
  Product Name                  Latitude E6520
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Mon Dec 31 05:26:34.770 2012 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\123112-13509-01.dmp]
Windows 8 Kernel Version 9200 MP (8 procs) Free x64
Built by: [B]9200[/B].16461.amd64fre.win8_gdr.121119-1606
System Uptime:[B]0 days 23:03:37.496[/B]
Probably caused by :[B]ndis.sys ( ndis!ndisDummyIrpHandler+8b )[/B]
BugCheck [B]FC, {fffff88001d76db0, 8000000227f13963, fffff8801d2fb210, 2}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000FC]ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)[/url]
Arguments: 
Arg1: fffff88001d76db0, Virtual address for the attempted execute.
Arg2: 8000000227f13963, PTE contents.
Arg3: fffff8801d2fb210, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME: [B]MsMpEng.exe[/B]
FAILURE_BUCKET_ID: [B]0xFC_ndis!ndisDummyIrpHandler[/B]
CPUID:        "Intel(R) Core(TM) i7-2760QM CPU @ 2.40GHz"
MaxSpeed:     2400
CurrentSpeed: [B]2395[/B]
  BIOS Version                  A15
  BIOS Release Date             08/15/2012
  Manufacturer                  Dell Inc.
  Product Name                  Latitude E6520
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Dec 30 06:22:23.769 2012 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\123012-12823-01.dmp]
Windows 8 Kernel Version 9200 MP (8 procs) Free x64
Built by: [B]9200[/B].16461.amd64fre.win8_gdr.121119-1606
System Uptime:[B]0 days 0:11:13.494[/B]
Probably caused by :[B]ndis.sys ( ndis!ndisDummyIrpHandler+8b )[/B]
BugCheck [B]FC, {fffff88001cefdb0, 8000000227f13963, fffff8801cb10210, 2}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000FC]ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)[/url]
Arguments: 
Arg1: fffff88001cefdb0, Virtual address for the attempted execute.
Arg2: 8000000227f13963, PTE contents.
Arg3: fffff8801cb10210, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME: [B]MsMpEng.exe[/B]
FAILURE_BUCKET_ID: [B]0xFC_ndis!ndisDummyIrpHandler[/B]
CPUID:        "Intel(R) Core(TM) i7-2760QM CPU @ 2.40GHz"
MaxSpeed:     2400
CurrentSpeed: [B]2395[/B]
  BIOS Version                  A15
  BIOS Release Date             08/15/2012
  Manufacturer                  Dell Inc.
  Product Name                  Latitude E6520
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Dec 30 06:10:33.605 2012 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\123012-16910-01.dmp]
Windows 8 Kernel Version 9200 MP (8 procs) Free x64
Built by: [B]9200[/B].16461.amd64fre.win8_gdr.121119-1606
System Uptime:[B]0 days 13:41:08.330[/B]
Probably caused by :[B]ndis.sys ( ndis!ndisDummyIrpHandler+8b )[/B]
BugCheck [B]FC, {fffff88001f10db0, 8000000227f13963, fffff88003713210, 2}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000FC]ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)[/url]
Arguments: 
Arg1: fffff88001f10db0, Virtual address for the attempted execute.
Arg2: 8000000227f13963, PTE contents.
Arg3: fffff88003713210, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME: [B]MsMpEng.exe[/B]
FAILURE_BUCKET_ID: [B]0xFC_ndis!ndisDummyIrpHandler[/B]
CPUID:        "Intel(R) Core(TM) i7-2760QM CPU @ 2.40GHz"
MaxSpeed:     2400
CurrentSpeed: [B]2395[/B]
  BIOS Version                  A15
  BIOS Release Date             08/15/2012
  Manufacturer                  Dell Inc.
  Product Name                  Latitude E6520
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/font]

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.
Code: 
[font=lucida console]**************************Wed Jan  2 11:03:33.127 2013 (UTC - 5:00)**************************
[COLOR=RED][B]usbVM31b.sys           Mon Sep 19 02:57:34 2005 (432E615E)[/B][/COLOR]
[COLOR=RED][B]HECIx64.sys            Tue Oct 19 19:33:43 2010 (4CBE2AD7)[/B][/COLOR]
[COLOR=RED][B]O2MDRw7x64.sys         Mon Jan  3 01:14:59 2011 (4D216963)[/B][/COLOR]
[COLOR=RED][B]o2sdjw7x64.sys         Tue Mar 22 07:56:31 2011 (4D888E6F)[/B][/COLOR]
[COLOR=RED][B]Apfiltr.sys            Wed May 25 21:54:58 2011 (4DDDB2F2)[/B][/COLOR]
[COLOR=RED][B]stdcfltn.sys           Sat Jul 16 00:31:13 2011 (4E211411)[/B][/COLOR]
[COLOR=RED][B]accelern.sys           Fri Jul 22 15:28:40 2011 (4E29CF68)[/B][/COLOR]
[COLOR=RED][B]ksaud.sys              Tue Sep 13 02:45:04 2011 (4E6EFBF0)[/B][/COLOR]
[COLOR=RED][B]MpKslc7e4e21e.sys      Fri Sep 16 18:25:48 2011 (4E73CCEC)[/B][/COLOR]
[COLOR=RED][B]NETwNs64.sys           Thu Oct  6 10:45:03 2011 (4E8DBEEF)[/B][/COLOR]
[COLOR=RED][B]ask4gxy6.SYS           Wed Dec 28 04:10:52 2011 (4EFADD1C)[/B][/COLOR]
[COLOR=RED][B]vmm.sys                Wed Dec 28 08:28:47 2011 (4EFB198F)[/B][/COLOR]
[COLOR=RED][B]sptd.sys               Sat Aug 18 17:05:38 2012 (503003A2)[/B][/COLOR]
e1c63x64.sys           Mon Sep 24 15:36:26 2012 (5060B63A)
igdkmd64.sys           Wed Oct 17 15:12:29 2012 (507F031D)
intelppm.sys           Mon Nov  5 22:55:02 2012 (50988A16)
iaStorA.sys            Mon Nov 19 15:09:40 2012 (50AA9204)
dump_iaStorA.sys       Mon Nov 19 15:09:40 2012 (50AA9204)
nvlddmkm.sys           Fri Nov 30 22:24:02 2012 (50B97852)
nvpciflt.sys           Fri Nov 30 22:24:28 2012 (50B9786C)
nvkflt.sys             Fri Nov 30 22:24:39 2012 (50B97877)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Mon Dec 31 05:26:34.770 2012 (UTC - 5:00)**************************
[COLOR=RED][B]MpKsle2ed0d2e.sys      Fri Sep 16 18:25:48 2011 (4E73CCEC)[/B][/COLOR]
[COLOR=RED][B]a9o4my48.SYS           Wed Dec 28 04:10:52 2011 (4EFADD1C)[/B][/COLOR]
nvhda64v.sys           Tue Jul  3 11:25:04 2012 (4FF30ED0)
lunparser.sys          Wed Jul 25 22:28:26 2012 (5010AB4A)
passthruparser.sys     Wed Jul 25 22:28:35 2012 (5010AB53)
vhdparser.sys          Wed Jul 25 22:28:37 2012 (5010AB55)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Dec 30 06:22:23.769 2012 (UTC - 5:00)**************************
[COLOR=RED][B]ajvz84of.SYS           Wed Dec 28 04:10:52 2011 (4EFADD1C)[/B][/COLOR]
point64.sys            Tue Sep 18 06:18:08 2012 (50584A60)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Dec 30 06:10:33.605 2012 (UTC - 5:00)**************************
[COLOR=RED][B]an1igoda.SYS           Wed Dec 28 04:10:52 2011 (4EFADD1C)[/B][/COLOR]
[/font]
http://www.carrona.org/drivers/driver.php?id=usbVM31b.sys
http://www.carrona.org/drivers/driver.php?id=HECIx64.sys
http://www.carrona.org/drivers/driver.php?id=O2MDRw7x64.sys
http://www.carrona.org/drivers/driver.php?id=o2sdjw7x64.sys
http://www.carrona.org/drivers/driver.php?id=Apfiltr.sys
http://www.carrona.org/drivers/driver.php?id=stdcfltn.sys
http://www.carrona.org/drivers/driver.php?id=accelern.sys
http://www.carrona.org/drivers/driver.php?id=ksaud.sys
MpKslc7e4e21e.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=NETwNs64.sys
ask4gxy6.SYS - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=vmm.sys
http://www.carrona.org/drivers/driver.php?id=sptd.sys
http://www.carrona.org/drivers/driver.php?id=e1c63x64.sys
http://www.carrona.org/drivers/driver.php?id=igdkmd64.sys
http://www.carrona.org/drivers/driver.php?id=intelppm.sys
http://www.carrona.org/drivers/driver.php?id=iaStorA.sys
http://www.carrona.org/drivers/driver.php?id=dump_iaStorA.sys
http://www.carrona.org/drivers/driver.php?id=nvlddmkm.sys
http://www.carrona.org/drivers/driver.php?id=nvpciflt.sys
http://www.carrona.org/drivers/driver.php?id=nvkflt.sys
MpKsle2ed0d2e.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
a9o4my48.SYS - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=nvhda64v.sys
lunparser.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
passthruparser.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
vhdparser.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
ajvz84of.SYS - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=point64.sys
an1igoda.SYS - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
 
Hi -

Bugcheck was 0xfc on all dumps = attempt to execute non-executable memory

Remove Daemon Tools for now.

Run - https://www.sysnative.com/forums/bs...river-verifier-blue-screen-death-related.html

Let Driver Verifier run for 24 hours minimum. You can continue to use the system as D/V will run in the background. Save your work often as Driver Verifier will force a BSOD if it detects a violation.

Regards. . .

jcgriff2

EDIT: Sorry, John - did not see you there!


Code: 
Debug session time: Wed Jan  2 11:03:33.127 2013 (UTC - 5:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\010213-12136-01.dmp]
Built by: 9200.16461.amd64fre.win8_gdr.121119-1606
System Uptime: 0 days 22:43:14.853
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff88001cdadb0, 8000000227f13963, fffff8801c178210, 2}
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000FC]ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)[/url]
Bugcheck code 000000fC
Arguments: 
Arg1: fffff88001cdadb0, Virtual address for the attempted execute.
Arg2: 8000000227f13963, PTE contents.
Arg3: fffff8801c178210, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
MaxSpeed:     2400
CurrentSpeed: 2395
BiosVersion = A15
BiosReleaseDate = 08/15/2012
SystemManufacturer = Dell Inc.
SystemProductName = Latitude E6520
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Mon Dec 31 05:26:34.770 2012 (UTC - 5:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\123112-13509-01.dmp]
Built by: 9200.16461.amd64fre.win8_gdr.121119-1606
System Uptime: 0 days 23:03:37.496
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff88001d76db0, 8000000227f13963, fffff8801d2fb210, 2}
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000FC]ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)[/url]
Bugcheck code 000000fC
Arguments: 
Arg1: fffff88001d76db0, Virtual address for the attempted execute.
Arg2: 8000000227f13963, PTE contents.
Arg3: fffff8801d2fb210, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
MaxSpeed:     2400
CurrentSpeed: 2395
BiosVersion = A15
BiosReleaseDate = 08/15/2012
SystemManufacturer = Dell Inc.
SystemProductName = Latitude E6520
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sun Dec 30 06:22:23.769 2012 (UTC - 5:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\123012-12823-01.dmp]
Built by: 9200.16461.amd64fre.win8_gdr.121119-1606
System Uptime: 0 days 0:11:13.494
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff88001cefdb0, 8000000227f13963, fffff8801cb10210, 2}
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000FC]ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)[/url]
Bugcheck code 000000fC
Arguments: 
Arg1: fffff88001cefdb0, Virtual address for the attempted execute.
Arg2: 8000000227f13963, PTE contents.
Arg3: fffff8801cb10210, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
MaxSpeed:     2400
CurrentSpeed: 2395
BiosVersion = A15
BiosReleaseDate = 08/15/2012
SystemManufacturer = Dell Inc.
SystemProductName = Latitude E6520
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sun Dec 30 06:10:33.605 2012 (UTC - 5:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\123012-16910-01.dmp]
Built by: 9200.16461.amd64fre.win8_gdr.121119-1606
System Uptime: 0 days 13:41:08.330
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff88001f10db0, 8000000227f13963, fffff88003713210, 2}
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000FC]ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)[/url]
Bugcheck code 000000fC
Arguments: 
Arg1: fffff88001f10db0, Virtual address for the attempted execute.
Arg2: 8000000227f13963, PTE contents.
Arg3: fffff88003713210, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
MaxSpeed:     2400
CurrentSpeed: 2395
BiosVersion = A15
BiosReleaseDate = 08/15/2012
SystemManufacturer = Dell Inc.
SystemProductName = Latitude E6520
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

         
       [color=#000033]J. C. Griffith, Microsoft MVP (jcgriff2)[/color]   
             
           [url=http://mvp.microsoft.com/profiles/Griffith][color=#000055][u][url]https://mvp.support.microsoft.com/profile/Griffith[/url][/u][/color][/url]   

           [url=https://www.sysnative.com][color=#000033][u][url]www.sysnative.com[/url][/u][/color][/url]
             

¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
 
Hello. Thank you for responding.

jcgriff2 said:
Remove Daemon Tools for now.
Click to expand...
I don't have Daemon Tools installed, never have actually.

Let Driver Verifier run for 24 hours minimum. You can continue to use the system as D/V will run in the background. Save your work often as Driver Verifier will force a BSOD if it detects a violation.
Click to expand...
Í have it already configured, but I have not been able to reproduce it yet.

usasma said:
perfmon reports that Broadcom USH w/swipe sensor drivers haven't been installed. Please visit the manufacture's website to download and install these drivers.
Click to expand...
That won't cause any BSOD. These are drivers for my finger print sensor, smart card reader and wireless smart card reader.

There's not a whole bunch available to test SSD's. The "easiest" test is to remove the SSD, install a platter-based hard drive, install Windows and test for stability that way.
Click to expand...
That's not really an option with this notebook. The only thing I can try is switching drivers. However, as noted before, everything was fine with Windows 7.


I note issues with your Microsoft Security Essentials software not releasing it's dynamic drivers. Please:
- uninstall the program, then immediately download and install a fresh copy
- scan your system for viruses (free scans here: Free Online AntiMalware Resources )
Click to expand...
Not really an option: Windows Defender is baked into Windows 8.

You MUST un-install this one. It dates from 2005 and isn't compatible with your Win7 system.
Click to expand...
I run Windows 8, but aside from that: Webcam drivers were automatically installed, Intel Management drivers were supplied by Dell as Windows 8 64-bit drivers, 02Micro card reader drivers were supplied by Dell, Alps drivers were supplied by Dell, Hard drive free fall sensor drivers were supplied by Dell, the Sound card drivers were actually downloaded from the Creative Site for Windows 8 64-bit.
 
Hi -

If not Daemon, there must be another virtual device installed (or was...?) The dumps clearly show sptd.sys + dynamically allocated drivers (sptd variants) -
Code: 
[COLOR="#FF0000"]sptd.sys   [/COLOR]            Sat Aug 18 17:05:38 2012 (503003A2)
a9o4my48.SYS           Wed Dec 28 04:10:52 2011 (4EFADD1C)
ajvz84of.SYS           Wed Dec 28 04:10:52 2011 (4EFADD1C)
an1igoda.SYS           Wed Dec 28 04:10:52 2011 (4EFADD1C)
ask4gxy6.SYS           Wed Dec 28 04:10:52 2011 (4EFADD1C)

I only mention this as virtual devices are known to cause BSODs in Vista, W7 and W8 and should be removed until BSOD epidemic is solved.

This driver needs to be updated - Written long before Windows 8 RTM -
Code: 
usbVM31b.sys           Mon Sep 19 02:57:34 [COLOR="#FF0000"]2005 [/COLOR](432E615E)
http://sysnative.com/drivers/driver.php?id=usbVM31b.sys

Regards. . .

jcgriff2
 
Hi,

Thanks for the reply.

The web cam driver has been updated now to a version from 2007, downloaded from the manufacturer website.

I actually use Alcohol 120% and using the software has never been a problem. I have mounted many images by now and had no problems with it. The developer also states compatibility with Windows 8. I will try to uninstall it for the moment though.

Now just wait until anything does crash :)
 
I cannot reproduce it. I will leave verifier enabled for a week and if the issue doesn't occur anymore disable it and consider the issue closed.
 
Actually, I'm glad to hear it & do hope the BSOD epidemic is over.

Regards. . .

jcgriff2
 
Sorry to say the BSOD has returned. Or actually, it was always there. Please read my explanation.

I found my system to be quite slow for some time, but at least stable. But then I remembered I left driver verifier on because I got one time at boot time an IO_Something_something BSOD which pointed to driver verifier.

Once I disabled Driver Verifier, my problems started occuring again. Now my system crashes when it's left idle, as I describe in the opening post.

Can anyone help me?
 
Hi. Thanks for your reply.

No I haven't tried that since I do not have a second 2,5" HDD with the required capacity. However, when using Windows 7, I had no problems whatoever.

---

The BSOD report is attached below. Thanks again :)
 
Remove Daemon Tools/Alcohol 120 for now.

sptd.sys is known to cause BSODs.
Code: 
[font=lucida console]
sptd.sys               Sat Aug 18 17:05:38 2012 (503003A2)[/font]
http://www.sysnative.com/drivers/driver.php?id=sptd.sys

Regards. . .

jcgriff2


BSOD SUMMARY

Code: 
[font=lucida console]
Debug session time: Tue Apr 16 15:34:10.536 2013 (UTC - 4:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\041613-11668-01.dmp]
Built by: 9200.16551.amd64fre.win8_gdr.130306-1502
System Uptime: 0 days 0:45:05.261
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff88001f14db0, 8000000227e79963, fffff8801d3fe200, 2}
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000FC]ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)[/url]
Bugcheck code 000000fC
Arguments: 
Arg1: fffff88001f14db0, Virtual address for the attempted execute.
Arg2: 8000000227e79963, PTE contents.
Arg3: fffff8801d3fe200, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
MaxSpeed:     2400
CurrentSpeed: 2395
BiosVersion = A17
BiosReleaseDate = 03/07/2013
SystemManufacturer = Dell Inc.
SystemProductName = Latitude E6520
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Tue Apr 16 13:30:03.730 2013 (UTC - 4:00)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\041613-12604-01.dmp]
Built by: 9200.16551.amd64fre.win8_gdr.130306-1502
System Uptime: 1 days 21:16:21.388
Probably caused by : ndis.sys ( ndis!ndisDummyIrpHandler+8b )
BugCheck FC, {fffff88001d16db0, 8000000227ef6963, fffff8801f879200, 2}
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000FC]ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)[/url]
Bugcheck code 000000fC
Arguments: 
Arg1: fffff88001d16db0, Virtual address for the attempted execute.
Arg2: 8000000227ef6963, PTE contents.
Arg3: fffff8801f879200, (reserved)
Arg4: 0000000000000002, (reserved)
BUGCHECK_STR:  0xFC
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xFC_ndis!ndisDummyIrpHandler+8b
MaxSpeed:     2400
CurrentSpeed: 2395
BiosVersion = A17
BiosReleaseDate = 03/07/2013
SystemManufacturer = Dell Inc.
SystemProductName = Latitude E6520
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``


         
       [color=#000033]J. C. Griffith, Microsoft MVP (jcgriff2)[/color]   
             
           [url=http://mvp.microsoft.com/en-us/mvp/John%20C.%20Griffith-4025562]John C. Griffith[/url]   

           [url=https://www.sysnative.com][color=#000033][u][url]www.sysnative.com[/url][/u][/color][/url]
             
           [url=http://jcgriff2.com][color=#000055][u][url]www.jcgriff2.com[/url][/u][/color][/url] 


¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨

[/font]
 
jcgriff2 said:
Remove Daemon Tools/Alcohol 120 for now.

sptd.sys is known to cause BSODs.
Code: 
[FONT=lucida console]
sptd.sys               Sat Aug 18 17:05:38 2012 (503003A2)[/FONT]
http://www.sysnative.com/drivers/driver.php?id=sptd.sys
Click to expand...

Yes, Alcohol 120% is kind of a problem. It's sort of stuck on my computer, it is installed and at the same time isnt. Deinstalling fails because "the setup could not validate the installation" but installation fails because the SPTD driver does install but the SPTD installer doesn't recognize it as installed after the computer has rebooted.

Using Autoruns I tried to remove as much traces from Alcohol 120% and related stuff, but this has, unfortunately, not helped.

In the mean while I have actually removed or disabled a lot of stuff, including everything from ViMicro and stuff from my card reader. Has not helped unfortunately.
 
Have you tried re-installing a fresh version of Alochol 120% and then uninstalling it?


Also, this may be a software incompatibility causing issues with Windows Defender. I see a lot of network software on your system for GIT, VNC, SVN, etc. Try a clean boot and see if problems persist.



If the above does not resolve your network related crashes, start removing programs you have installed, especially network intensive software, and see if the removal of a program results in stability.
 
writhziden said:
Have you tried re-installing a fresh version of Alochol 120% and then uninstalling it?
Click to expand...
Cannot do, Alcohol installer wants to install SPTD but SPTD installer doesn't detect SPTD as installed after reboot. So Alcohol never installs.

I will try your other suggestions.
 
Also, this may be a software incompatibility causing issues with Windows Defender. I see a lot of network software on your system for GIT, VNC, SVN, etc. Try a clean boot and see if problems persist.

Click to expand...
I have tried disabling run-time protection of Windows Defender. This has not helped however.

I have done a clean boot and then observed my computer. I noticed the following strange behavior:

1. Computer sits idle for X minutes
2. Computer begins making a lot of noise (CPU fan at 100%)
3. When I try to use the computer, in a attempt to go to task manager, the noise returns to normal and everything's fine
4. If I do not use the computer, I'Il BSOD.

I will try again a few times to confirm my findings.
 
conhost-BSOD.jpg

Please find the attached screenshot. This is what task manager shows me as soon as I hear the noise from my computer. Just after I pressed 'print screen', all the conhost entries except one disappeared.
 
Hi -

There is nothing wrong with System Idle @ 61%. It will fluctuate depending on CPU utilization by other processes.

Use SysInternals Process Explorer in lieu of Task Manager for now - http://technet.microsoft.com/en-us/sysinternals/bb896653

Download & save ProcExp from Microsoft TechNet - http://live.sysinternals.com/procexp.exe

RIGHT-click on procexp.exe, "Run as Administrator"

Click on CPU column. What it utilizing CPU?

Screenshot of ProcExp -

04-18-2013_ProcessExplorer.png
​


Run Speccy - http://www.piriform.com/speccy
- "File" | "Publish Snapshot" | Paste URL into your next post

Regards. . .

jcgriff2
 
Last edited:
There is nothing wrong with System Idle @ 61%. It will fluctuate depending on CPU utilization by other processes.
Click to expand...
That's not my point :) It's those conhost entries popping up what I thought the problem was. It isn't, though.

Speccy URL: http://speccy.piriform.com/results/smDduKIQ6o4ZjoXQQXRGio2
---

I discovered a service was spawning those conhost processes, I disabled the service, and the conhost processes were not spawned anymore. The problem remained, though. I tried to run both Malwarebytes Anti-Malware and Windows Defender in Safe Mode. I found no malware, and the system didn't BSOD in Safe Mode. It has not helped either.

I also tried to disable any power features in my system BIOS, this has not helped.

I tried another approach. I got an AutoHotKey script from a collegue, which moves the mouse every X minutes. If I run this script, no BSOD happens. This means it has something to do with the system going idle. BSOD's do not happen while running the script, watching movies or using the computer. They do happen while scanning. I have not tried other CPU-intensive operations.
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top