Windows 7 BSOD's

dominik04u

Member
Joined
Dec 9, 2016
Posts
10
From two months I have a problem with BSOD's. I reinstalled OS two times, but problem doesn't disappear. I attach file with PC specification and required files. The PERFMON report is in polish.

Original and installed system: Windows 7 Home Premium x64
Two graphic cards: Intel(r) HD Graphics 4000 and AMD Radeon HD 8570M


Thank you for help ;)
 

Attachments

Please remove all IObit programs and Daemon Tools
If possible use a system restore or another backup to revert the changes the programs have made.
Especially for driver booster programs, if you have installed any driver from these programs please uninstall them a.s.a.p.
Your only source for drivers should be HP, and sometimes Windows Update.
In regards to Daemon Tools, it is a program that is known for causing BSODs due to unstable drivers.
In regards to IObit programs, most (if not all) of the programs may cause more harm than good.
Code:
Start Menu\Programs\Advanced SystemCare	Public:Start Menu\Programs\Advanced SystemCare	Public
Start Menu\Programs\DAEMON Tools Lite	Public:Start Menu\Programs\DAEMON Tools Lite	Public
Start Menu\Programs\Driver Booster 4	Public:Start Menu\Programs\Driver Booster 4	Public
Start Menu\Programs\Driver Identifier	Public:Start Menu\Programs\Driver Identifier	Public
Start Menu\Programs\IObit Malware Fighter	Public:Start Menu\Programs\IObit Malware Fighter	Public
Start Menu\Programs\IObit Uninstaller	Public:Start Menu\Programs\IObit Uninstaller	Public



It looks to me like AVG is triggering many crashes, please uninstall AVG while troubleshooting.

Did you add memory? It is not recommended to run a system with mixed memory.
Code:
[Memory Device (Type 17) - Length 34 - Handle 0006h]
  Physical Memory Array Handle  0005h
  Memory Error Info Handle      [Not Provided]
  Total Width                   64 bits
  Data Width                    64 bits
  Size                          4096MB
  Form Factor                   0dh - SODIMM
  Device Set                    [None]
  Device Locator                Bottom-Slot 1(top)
  Bank Locator                  BANK 0
  Memory Type                   18h - Specification Reserved
  Type Detail                   0080h - Synchronous
  Speed                         1600MHz
  Manufacturer                  Kingston
  Serial Number                         
  Asset Tag Number                        
  Part Number                   SNY16D3LS1KBG/4G  
[Memory Device (Type 17) - Length 34 - Handle 0008h]
  Physical Memory Array Handle  0005h
  Memory Error Info Handle      [Not Provided]
  Total Width                   64 bits
  Data Width                    64 bits
  Size                          4096MB
  Form Factor                   0dh - SODIMM
  Device Set                    [None]
  Device Locator                Bottom-Slot 2(under)
  Bank Locator                  BANK 2
  Memory Type                   18h - Specification Reserved
  Type Detail                   0080h - Synchronous
  Speed                         1600MHz
  Manufacturer                  Samsung
  Serial Number                         
  Asset Tag Number                        
  Part Number                   M471B5173QH0-YK0
 
I didn't add memory. I know that it is not recommended but I bought computer with this memory and for two years it worked without any problems.

"if you have installed any driver from these programs please uninstall them a.s.a.p."
But I don't know which drivers have been installed by driver booster.
 
Some driver update programs provide(d) an option to revert the installations.

If the programs don't provide such options, you could use a backup (like Macrium Reflect image, Acronis image, etc.) or a restore point.
If there is no backup then a last resort is a clean install.

I bought computer with this memory and for two years it worked without any problems
Ok, but time isn't relevant.
Windows is frequently updated, a 'bad' update could cause your system to become unstable somehow.
Although this risk is always present, it is a greater risk with parts that may be incompatible but haven't yet caused problems.
 
I didn't add memory. I know that it is not recommended but I bought computer with this memory and for two years it worked without any problems.

"if you have installed any driver from these programs please uninstall them a.s.a.p."
But I don't know which drivers have been installed by driver booster.

Let's face to the BSOD you get first,

Code:
BugCheck C5, {fffff8a014876888, 2, 0, fffff80003fac127}

*** WARNING: Unable to verify timestamp for netr28x.sys
*** ERROR: Module load completed but symbols could not be loaded for netr28x.sys
Probably caused by : [COLOR=#ff0000]netr28x.sys[/COLOR] ( netr28x+4b94f )

That is your Realtek / Mediatek Adapter for Wireless RT 3290

Within the very small Stack there is absolutely no interaction of any other software visible on your machine like
Daemontools / Elby
IO.. whatever
Virtual Box
Acronis
nor is the ram blamed for malfunction

link above to the original Vendor for your WLAN as no OEM writes any driver by itself, so it is safe to grab it from the Vendor and not the OEM.

btw: @Axe0
Windows Update has a previous release of drivers which work but not with the full functionality, they are not the best and
should be taken only as a fallback.


Memory: none of the RAM's are original, but fulfill proper the Specs HP gave for the Machine, see page 55.
http://h20565.www2.hp.com/hpsc/doc/...359405&docLocale=en_US&docId=emr_na-c03765776
Mixing RAM is not as critical as it was in former Years ™ unless its a performance machine for gaming or construction (Workstation)

Your Win7 is not original if its Home because it was shipped with Win7 Pro, it is a probook, at least reinstalled with some parts of HP left over, which are usually
found in HP machines, not in your's.

> Now I can't install updates. I have error 80080005.
Access denied what can be caused by numerous things, AVG and others but the minidumps will never point to that problem.


in this particular case you can / should follow the advise of @Axe0,

for fixing the BSOD you should investigate in a driver for the failing WLAN as linked above.

Why Mediatek? := simple because RALINK was purchased by Mediatek about 2 or more years ago.


for clearing up failures a full dump is required.

regards
Michael
 
WinDbg tells us:

121316-42557-01.dmp

tells us:

INVALID_PROCESS_ATTACH_ATTEMPT (5)
Arguments:
Arg1: fffffa8007001380
Arg2: fffffa8009b245d0
Arg3: 0000000000000000
Arg4: 0000000000000001

may be AVG caused this.

affected: your WLAN while browsing via Firefox.

Code:
STACK_TEXT:  
fffff800`00ba1c78 fffff800`03f3f56a : 00000000`00000005 fffffa80`07001380 fffffa80`09b245d0 00000000`00000000 : nt!KeBugCheckEx
fffff800`00ba1c80 fffff800`041d1a2d : fffff8a0`1204eb30 00000000`00000000 fffff800`00ba1cb0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x2563b
fffff800`00ba1d00 fffff800`041d1721 : 00000000`00000000 fffffa80`00000000 fffff8a0`00001590 00000000`00000000 : nt!ObpDecrementHandleCount+0x17d
fffff800`00ba1d80 fffff800`041d1ce4 : 00000000`00002bb8 fffffa80`09b245d0 fffff8a0`00001590 00000000`00002bb8 : nt!ObpCloseHandleTableEntry+0xb1
fffff800`00ba1e10 fffff800`03ed9e53 : fffffa80`07ae9060 fffff800`00ba1ee0 fffff800`041dc8d0 fffff800`041a889c : nt!ObpCloseHandle+0x94
fffff800`00ba1e60 fffff800`03ed6410 : fffff800`0414b7ab fffffa80`07f95a10 fffff800`041dc8d0 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
fffff800`00ba1ff8 fffff800`0414b7ab : fffffa80`07f95a10 fffff800`041dc8d0 00000000`00000000 00000000`00000000 : nt!KiServiceLinkage
fffff800`00ba2000 fffff800`0414b94c : fffffa80`07f95a10 00000000`00000001 fffffa80`07f7f830 00000000`00000000 : nt!PiGetDeviceRegistryProperty+0xab
fffff800`00ba2160 fffff800`0414b5dc : fffffa80`07f95a10 fffffa80`07f95a10 00000000`00000000 00000000`00000000 : nt!IoGetDeviceProperty+0xbc
fffff800`00ba2240 fffff800`0414b6bd : 00000000`ffff0000 fffffa80`0b639c70 fffff880`016f3110 fffffa80`087765d0 : nt!IopOpenOrCreateDeviceRegistryKey+0x14c
fffff800`00ba2400 fffff880`01739f02 : 00000000`00000000 fffff800`00ba2590 00000000`00000000 00000000`000007ff : nt!IoOpenDeviceRegistryKey+0x11
fffff800`00ba2440 fffff880`016a2cd4 : fffff800`00ba2590 fffff800`00ba2568 fffffa80`085dc1a0 00000000`00000000 : ndis!NdisOpenConfiguration+0xb2
fffff800`00ba2480 fffff880`04ea78b7 : 00000000`00000000 fffff800`00ba2590 fffff880`050b5ae8 00000000`00000000 : ndis!NdisOpenConfigurationEx+0xa4
fffff800`00ba24f0 00000000`00000000 : fffff800`00ba2590 fffff880`050b5ae8 00000000`00000000 00000000`001801a9 : netr28x+0x4b8b7
121316-78437-01.dmp

has to say:

INVALID_PROCESS_ATTACH_ATTEMPT (5)
Arguments:
Arg1: fffffa8006fe5380
Arg2: fffffa800b0d0b30
Arg3: 0000000000000000
Arg4: 0000000000000001

fails within System
PROCESS_NAME: svchost.exe

Code:
STACK_TEXT:  
fffff800`00ba1c78 fffff800`03f2d56a : 00000000`00000005 fffffa80`06fe5380 fffffa80`0b0d0b30 00000000`00000000 : nt!KeBugCheckEx
fffff800`00ba1c80 fffff800`041bfa2d : fffff8a0`04d74ed0 00000000`00000000 fffff800`00ba1cb0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x2563b
fffff800`00ba1d00 fffff800`041bf721 : 00000000`00000000 fffffa80`00000000 fffff8a0`00001590 00000000`00000000 : nt!ObpDecrementHandleCount+0x17d
fffff800`00ba1d80 fffff800`041bfce4 : 00000000`00002290 fffffa80`0b0d0b30 fffff8a0`00001590 00000000`00002290 : nt!ObpCloseHandleTableEntry+0xb1
fffff800`00ba1e10 fffff800`03ec7e53 : fffffa80`071ea060 fffff800`00ba1ee0 fffff800`041ca8d0 fffff800`0419689c : nt!ObpCloseHandle+0x94
fffff800`00ba1e60 fffff800`03ec4410 : fffff800`041397ab fffffa80`07f97a10 fffff800`041ca8d0 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
fffff800`00ba1ff8 fffff800`041397ab : fffffa80`07f97a10 fffff800`041ca8d0 00000000`00000000 00000000`00000000 : nt!KiServiceLinkage
fffff800`00ba2000 fffff800`0413994c : fffffa80`07f97a10 00000000`00000001 fffffa80`07f7f830 00000000`00000000 : nt!PiGetDeviceRegistryProperty+0xab
fffff800`00ba2160 fffff800`041395dc : fffffa80`07f97a10 fffffa80`07f97a10 00000000`00000000 00000000`00000000 : nt!IoGetDeviceProperty+0xbc
fffff800`00ba2240 fffff800`041396bd : 00000000`ffff0000 fffffa80`084ef9f0 fffff880`0152b110 fffffa80`0876e0c0 : nt!IopOpenOrCreateDeviceRegistryKey+0x14c
fffff800`00ba2400 fffff880`01571f02 : 00000000`00000000 fffff800`00ba2590 00000000`0000012b 00000000`000007ff : nt!IoOpenDeviceRegistryKey+0x11
fffff800`00ba2440 fffff880`014dacd4 : fffff800`00ba2590 fffff800`00ba2568 fffffa80`0861c1a0 0000057f`00000042 : ndis!NdisOpenConfiguration+0xb2
fffff800`00ba2480 fffff880`04f488b7 : fffffa80`00000000 fffff800`00ba2590 fffff880`05156ae8 00000000`00000000 : ndis!NdisOpenConfigurationEx+0xa4
fffff800`00ba24f0 fffffa80`00000000 : fffff800`00ba2590 fffff880`05156ae8 00000000`00000000 fffff880`001801a9 : netr28x+0x4b8b7
fffff800`00ba24f8 fffff800`00ba2590 : fffff880`05156ae8 00000000`00000000 fffff880`001801a9 fffffa80`0861c1a0 : 0xfffffa80`00000000
fffff800`00ba2500 fffff880`05156ae8 : 00000000`00000000 fffff880`001801a9 fffffa80`0861c1a0 00000000`00000000 : 0xfffff800`00ba2590
fffff800`00ba2508 00000000`00000000 : fffff880`001801a9 fffffa80`0861c1a0 00000000`00000000 fffff800`03ece22a : netr28x+0x259ae8

again WLAN involved, but are you sure no undetected payload is involved like Ransomeware / PopUps,
most found in freeware like driverbooster or something else?

scan, remove those utilities mentioned above, those small dumps don't give more information.
 
When I wake up system after sleeping I have BSOD 0x100000EA (memoru dump attached)

Yes, your ati-grafik (driver) did not respond in time.

Code:
THREAD_STUCK_IN_DEVICE_DRIVER_M (100000ea)
The device driver is spinning in an infinite loop, most likely waiting for
hardware to become idle. This usually indicates problem with the hardware
itself or with the device driver programming the hardware incorrectly.

as the dump shows, the driver is pretty new but its not the one HP provides, so roll back that driver.

Daemontools seem to be no longer in the system.

did you ever check your harddrive via chkdsk c: /f ?

would be good as well to check your hardware via Bios like this:

power on
press ESC
Press F2 (hardwarediagnostic)

run disk, System & memory
if no error, would be a good point to reinstall Windows.
 
> Sorry for my English

Mine isn't much better, but you wouldn't understand german as well?

at the current state, at least me cannot help you any further, anything is said
as well to install a clean system.
the hardwarediagnostic was not invoked by you?
 
I invoked hardwarediagnostic via chkdsk two times and via bios diagnostic tool and each test is ok. I will reinstall system at weekend. Thank you all for help.
 
I reinstalled system and all drivers and almost everything is fine. I have problem with Intel HD Graphics 4000. When I installed driver from hp support the screen blinks. I had to disable aero, and then is fine. When I turn off this graphic card, then aero is good but I can't hibernate or sleep system. Please help and I appologize for my teribble English :)
 
I reinstalled system and all drivers and almost everything is fine. I have problem with Intel HD Graphics 4000. When I installed driver from hp support the screen blinks. I had to disable aero, and then is fine. When I turn off this graphic card, then aero is good but I can't hibernate or sleep system. Please help and I appologize for my teribble English :)

Great,
your Business-Notebook is supported here, Link below but not in this forum

Business PCs, Workstations and Point of Sale Systems - HP Support Forum
 
This is the same crash debugged previously by MichaelB on 13th December:

Code:
// Bugcheck 0x5 indicates the device in question either was attached to another thread at the time,
// or was itself the target of an attach while attached - both are invalid and cause a bugcheck:
0: kd> .bugcheckBugcheck code 00000005
Arguments fffffa80`06fe5990 fffffa80`0b935060 00000000`00000000 00000000`00000001

// This is a minidump so this could be a red herring, but it could also be indicative of a thread that has
// gone before it's time, which would cause this bugcheck if the handle to the object is closed prematurely:
0: kd> !locks fffff800030e0be0


Resource @ nt!PiEngineLock (0xfffff800030e0be0)    Available


WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.




WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.


1 total locks

// The dispatcher header that is referenced in the bugcheck:
0: kd> dt nt!_DISPATCHER_HEADER fffffa80`06fe5990
   +0x000 Type             : 0x3 ''
   +0x001 TimerControlFlags : 0 ''
   +0x001 Absolute         : 0y0
   +0x001 Coalescable      : 0y0
   +0x001 KeepShifting     : 0y0
   +0x001 EncodedTolerableDelay : 0y00000 (0)
   +0x001 Abandoned        : 0 ''
   +0x001 Signalling       : 0 ''
   +0x002 ThreadControlFlags : 0x58 'X'
   +0x002 CpuThrottled     : 0y0
   +0x002 CycleProfiling   : 0y0
   +0x002 CounterProfiling : 0y0
   +0x002 Reserved         : 0y01011 (0xb)
   +0x002 Hand             : 0x58 'X'
   +0x002 Size             : 0x58 'X'
   +0x003 TimerMiscFlags   : 0 ''
   +0x003 Index            : 0y000000 (0)
   +0x003 Inserted         : 0y0
   +0x003 Expired          : 0y0
   +0x003 DebugActive      : 0 ''
   +0x003 ActiveDR7        : 0y0
   +0x003 Instrumented     : 0y0
   +0x003 Reserved2        : 0y0000
   +0x003 UmsScheduled     : 0y0
   +0x003 UmsPrimary       : 0y0
   +0x003 DpcActive        : 0 ''
   +0x000 Lock             : 0n5767171
   +0x004 SignalState      : 0n0
   +0x008 WaitListHead     : _LIST_ENTRY [ 0xfffffa80`06fe5998 - 0xfffffa80`06fe5998 ]

// Is that KTHREAD valid?
0: kd> dt nt!_KWAIT_BLOCK fffffa80`06fe5990
   +0x000 WaitListEntry    : _LIST_ENTRY [ 0x00000000`00580003 - 0xfffffa80`06fe5998 ]
   +0x010 Thread           : 0xfffffa80`06fe5998 _KTHREAD
   +0x018 Object           : 0xfffffa80`06fe59a8 Void
   +0x020 NextWaitBlock    : 0xfffffa80`06fe59a8 _KWAIT_BLOCK
   +0x028 WaitKey          : 0xa000
   +0x02a WaitType         : 0x1a ''
   +0x02b BlockState       : 0 ''
   +0x02c SpareLong        : 0n0

// The TEB is invalid, and there's no thread anywhere in the stack init/limit - the thread that caused
// this has likely gone away, given it should be in this dump if it was active:
0: kd> dx -r1 (*((ntkrnlmp!_KTHREAD *)0xfffffa80`06fe5998))
(*((ntkrnlmp!_KTHREAD *)0xfffffa80`06fe5998))                 [Type: _KTHREAD]
    [+0x000] Header           [Type: _DISPATCHER_HEADER]
    [+0x018] CycleTime        : 0xfffffa8006fe59a8 [Type: unsigned __int64]
    [+0x020] QuantumTarget    : 0x1aa000 [Type: unsigned __int64]
    [+0x028] InitialStack     : 0xfffffa8007009338 [Type: void *]
    [+0x030] StackLimit       : 0xfffffa800a3646a8 [Type: void *]
    [+0x038] KernelStack      : 0x0 [Type: void *]
    [+0x040] ThreadLock       : 0x40001 [Type: unsigned __int64]
    [+0x048] WaitRegister     [Type: _KWAIT_STATUS_REGISTER]
    [+0x049] Running          : 0x0 [Type: unsigned char]
    [+0x04a] Alerted          [Type: unsigned char [2]]
    [+0x04c ( 0: 0)] KernelStackResident : 0x0 [Type: unsigned long]
    [+0x04c ( 1: 1)] ReadyTransition  : 0x0 [Type: unsigned long]
    [+0x04c ( 2: 2)] ProcessReadyQueue : 0x0 [Type: unsigned long]
    [+0x04c ( 3: 3)] WaitNext         : 0x0 [Type: unsigned long]
    [+0x04c ( 4: 4)] SystemAffinityActive : 0x0 [Type: unsigned long]
    [+0x04c ( 5: 5)] Alertable        : 0x0 [Type: unsigned long]
    [+0x04c ( 6: 6)] GdiFlushActive   : 0x0 [Type: unsigned long]
    [+0x04c ( 7: 7)] UserStackWalkActive : 0x0 [Type: unsigned long]
    [+0x04c ( 8: 8)] ApcInterruptRequest : 0x0 [Type: unsigned long]
    [+0x04c ( 9: 9)] ForceDeferSchedule : 0x0 [Type: unsigned long]
    [+0x04c (10:10)] QuantumEndMigrate : 0x0 [Type: unsigned long]
    [+0x04c (11:11)] UmsDirectedSwitchEnable : 0x0 [Type: unsigned long]
    [+0x04c (12:12)] TimerActive      : 0x0 [Type: unsigned long]
    [+0x04c (13:13)] SystemThread     : 0x0 [Type: unsigned long]
    [+0x04c (31:14)] Reserved         : 0x0 [Type: unsigned long]
    [+0x04c] MiscFlags        : 0 [Type: long]
    [+0x050] ApcState         [Type: _KAPC_STATE]
    [+0x050] ApcStateFill     [Type: unsigned char [43]]
    [+0x07b] Priority         : 0 [Type: char]
    [+0x07c] NextProcessor    : 0x0 [Type: unsigned long]
    [+0x080] DeferredProcessor : 0x40004 [Type: unsigned long]
    [+0x088] ApcQueueLock     : 0xe [Type: unsigned __int64]
    [+0x090] WaitStatus       : 0 [Type: __int64]
    [+0x098] WaitBlockList    : 0x0 [Type: _KWAIT_BLOCK *]
    [+0x0a0] WaitListEntry    [Type: _LIST_ENTRY]
    [+0x0a0] SwapListEntry    [Type: _SINGLE_LIST_ENTRY]
    [+0x0b0] Queue            : 0x1 [Type: _KQUEUE *]
    [+0x0b8] Teb              : 0x0 [Type: void *]
    [+0x0c0] Timer            [Type: _KTIMER]
    [+0x100 ( 0: 0)] AutoAlignment    : 0x0 [Type: unsigned long]
    [+0x100 ( 1: 1)] DisableBoost     : 0x0 [Type: unsigned long]
    [+0x100 ( 2: 2)] EtwStackTraceApc1Inserted : 0x0 [Type: unsigned long]
    [+0x100 ( 3: 3)] EtwStackTraceApc2Inserted : 0x0 [Type: unsigned long]
    [+0x100 ( 4: 4)] CalloutActive    : 0x0 [Type: unsigned long]
    [+0x100 ( 5: 5)] ApcQueueable     : 0x0 [Type: unsigned long]
    [+0x100 ( 6: 6)] EnableStackSwap  : 0x0 [Type: unsigned long]
    [+0x100 ( 7: 7)] GuiThread        : 0x0 [Type: unsigned long]
    [+0x100 ( 8: 8)] UmsPerformingSyscall : 0x0 [Type: unsigned long]
    [+0x100 ( 9: 9)] VdmSafe          : 0x0 [Type: unsigned long]
    [+0x100 (10:10)] UmsDispatched    : 0x0 [Type: unsigned long]
    [+0x100 (31:11)] ReservedFlags    : 0x0 [Type: unsigned long]
    [+0x100] ThreadFlags      : 0 [Type: long]
    [+0x104] Spare0           : 0x0 [Type: unsigned long]
    [+0x108] WaitBlock        [Type: _KWAIT_BLOCK [4]]
    [+0x108] WaitBlockFill4   [Type: unsigned char [44]]
    [+0x134] ContextSwitches  : 0x0 [Type: unsigned long]
    [+0x108] WaitBlockFill5   [Type: unsigned char [92]]
    [+0x164] State            : 0x66 [Type: unsigned char]
    [+0x165] NpxState         : 89 'Y' [Type: char]
    [+0x166] WaitIrql         : 0xd2 [Type: unsigned char]
    [+0x167] WaitMode         : 1 [Type: char]
    [+0x108] WaitBlockFill6   [Type: unsigned char [140]]
    [+0x194] WaitTime         : 0x0 [Type: unsigned long]
    [+0x108] WaitBlockFill7   [Type: unsigned char [168]]
    [+0x1b0] TebMappedLowVa   : 0x3b [Type: void *]
    [+0x1b8] Ucb              : 0xfffff8000306a940 [Type: _UMS_CONTROL_BLOCK *]
    [+0x108] WaitBlockFill8   [Type: unsigned char [188]]
    [+0x1c4] KernelApcDisable : 0 [Type: short]
    [+0x1c6] SpecialApcDisable : 0 [Type: short]
    [+0x1c4] CombinedApcDisable : 0x0 [Type: unsigned long]
    [+0x1c8] QueueListEntry   [Type: _LIST_ENTRY]
    [+0x1d8] TrapFrame        : 0x0 [Type: _KTRAP_FRAME *]
    [+0x1e0] FirstArgument    : 0x0 [Type: void *]
    [+0x1e8] CallbackStack    : 0x0 [Type: void *]
    [+0x1e8] CallbackDepth    : 0x0 [Type: unsigned __int64]
    [+0x1f0] ApcStateIndex    : 0x0 [Type: unsigned char]
    [+0x1f1] BasePriority     : 0 [Type: char]
    [+0x1f2] PriorityDecrement : 0 [Type: char]
    [+0x1f2 ( 3: 0)] ForegroundBoost  : 0x0 [Type: unsigned char]
    [+0x1f2 ( 7: 4)] UnusualBoost     : 0x0 [Type: unsigned char]
    [+0x1f3] Preempted        : 0x0 [Type: unsigned char]
    [+0x1f4] AdjustReason     : 0x0 [Type: unsigned char]
    [+0x1f5] AdjustIncrement  : 0 [Type: char]
    [+0x1f6] PreviousMode     : 0 [Type: char]
    [+0x1f7] Saturation       : 0 [Type: char]
    [+0x1f8] SystemCallNumber : 0x1750 [Type: unsigned long]
    [+0x1fc] FreezeCount      : 0xfffff8a0 [Type: unsigned long]
    [+0x200] UserAffinity     [Type: _GROUP_AFFINITY]
    [+0x210] Process          : 0x0 [Type: _KPROCESS *]
    [+0x218] Affinity         [Type: _GROUP_AFFINITY]
    [+0x228] IdealProcessor   : 0x0 [Type: unsigned long]
    [+0x22c] UserIdealProcessor : 0x0 [Type: unsigned long]
    [+0x230] ApcStatePointer  [Type: _KAPC_STATE * [2]]
    [+0x240] SavedApcState    [Type: _KAPC_STATE]
    [+0x240] SavedApcStateFill [Type: unsigned char [43]]
    [+0x26b] WaitReason       : 0x0 [Type: unsigned char]
    [+0x26c] SuspendCount     : 0 [Type: char]
    [+0x26d] Spare1           : 0 [Type: char]
    [+0x26e] CodePatchInProgress : 0x0 [Type: unsigned char]
    [+0x270] Win32Thread      : 0x0 [Type: void *]
    [+0x278] StackBase        : 0x0 [Type: void *]
    [+0x280] SuspendApc       [Type: _KAPC]
    [+0x280] SuspendApcFill0  [Type: unsigned char [1]]
    [+0x281] ResourceIndex    : 0x0 [Type: unsigned char]
    [+0x280] SuspendApcFill1  [Type: unsigned char [3]]
    [+0x283] QuantumReset     : 0x0 [Type: unsigned char]
    [+0x280] SuspendApcFill2  [Type: unsigned char [4]]
    [+0x284] KernelTime       : 0x0 [Type: unsigned long]
    [+0x280] SuspendApcFill3  [Type: unsigned char [64]]
    [+0x2c0] WaitPrcb         : 0x779c9000 [Type: _KPRCB *]
    [+0x280] SuspendApcFill4  [Type: unsigned char [72]]
    [+0x2c8] LegoData         : 0x0 [Type: void *]
    [+0x280] SuspendApcFill5  [Type: unsigned char [83]]
    [+0x2d3] LargeStack       : 0x0 [Type: unsigned char]
    [+0x2d4] UserTime         : 0x0 [Type: unsigned long]
    [+0x2d8] SuspendSemaphore [Type: _KSEMAPHORE]
    [+0x2d8] SuspendSemaphorefill [Type: unsigned char [28]]
    [+0x2f4] SListFaultCount  : 0x0 [Type: unsigned long]
    [+0x2f8] ThreadListEntry  [Type: _LIST_ENTRY]
    [+0x308] MutantListHead   [Type: _LIST_ENTRY]
    [+0x318] SListFaultAddress : 0x0 [Type: void *]
    [+0x320] ReadOperationCount : 158 [Type: __int64]
    [+0x328] WriteOperationCount : 5 [Type: __int64]
    [+0x330] OtherOperationCount : 0 [Type: __int64]
    [+0x338] ReadTransferCount : 0 [Type: __int64]
    [+0x340] WriteTransferCount : 13 [Type: __int64]
    [+0x348] OtherTransferCount : 167 [Type: __int64]
    [+0x350] ThreadCounters   : 0x277 [Type: _KTHREAD_COUNTERS *]
    [+0x358] StateSaveArea    : 0x30349e2 [Type: _XSAVE_FORMAT *]
    [+0x360] XStateSave       : 0x1940400 [Type: _XSTATE_SAVE *]

// So what object is being dereferenced?  Looks like a handle to netr28x.sys:
0: kd> kn
 # Child-SP          RetAddr           Call Site
00 fffff800`00ba1c78 fffff800`02f4156a nt!KeBugCheckEx
01 fffff800`00ba1c80 fffff800`031d3a2d nt! ?? ::FNODOBFM::`string'+0x2563b
02 fffff800`00ba1d00 fffff800`031d3721 nt!ObpDecrementHandleCount+0x17d
03 fffff800`00ba1d80 fffff800`031d3ce4 nt!ObpCloseHandleTableEntry+0xb1
04 fffff800`00ba1e10 fffff800`02edbe53 nt!ObpCloseHandle+0x94
05 fffff800`00ba1e60 fffff800`02ed8410 nt!KiSystemServiceCopyEnd+0x13
06 fffff800`00ba1ff8 fffff800`0314d7ab nt!KiServiceLinkage
07 fffff800`00ba2000 fffff800`0314d94c nt!PiGetDeviceRegistryProperty+0xab
08 fffff800`00ba2160 fffff800`0314d5dc nt!IoGetDeviceProperty+0xbc
09 fffff800`00ba2240 fffff800`0314d6bd nt!IopOpenOrCreateDeviceRegistryKey+0x14c
0a fffff800`00ba2400 fffff880`016e2f02 nt!IoOpenDeviceRegistryKey+0x11
0b fffff800`00ba2440 fffff880`0164bcd4 ndis!NdisOpenConfiguration+0xb2
0c fffff800`00ba2480 fffff880`05e9d883 ndis!NdisOpenConfigurationEx+0xa4
0d fffff800`00ba24f0 00000000`00000000 netr28x+0x4b883

// From December 2014, not the latest for your machine from HP for Win7 (new version from May 2015 on HP's site):
0: kd> lmvm netr28x
Browse full module list
start             end                 module name
fffff880`05e52000 fffff880`060b7000   netr28x  T (no symbols)           
    Loaded symbol image file: netr28x.sys
    Image path: \SystemRoot\system32\DRIVERS\netr28x.sys
    Image name: netr28x.sys
    Browse all global symbols  functions  data
    Timestamp:        Tue Dec 30 18:44:09 2014 (54A362F9)
    CheckSum:         0025F414
    ImageSize:        00265000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

// May 2015:
// http://h20565.www2.hp.com/hpsc/swd/public/detail?sp4ts.oid=5359406&swItemId=ob_148570_1&swEnvOid=4059

0: kd> !sysinfo machineid
Machine ID Information [From Smbios 2.7, DMIVersion 39, Size=1626]
BiosMajorRelease = 15
BiosMinorRelease = 100
FirmwareMajorRelease = 144
FirmwareMinorRelease = 15
BiosVendor = Hewlett-Packard
BiosVersion = 68IRF Ver. F.64
BiosReleaseDate = 09/29/2016
SystemManufacturer = Hewlett-Packard
SystemProductName = HP ProBook 450 G0
SystemFamily = 103C_5336AN G=N L=BUS B=HP S=PRO
SystemVersion = A2018CD200
SystemSKU = H0V97EA#BED
BaseBoardManufacturer = Hewlett-Packard
BaseBoardProduct = 1949
BaseBoardVersion = KBC Version 90.0F




// More critically, it appears that you're not patching properly, I can see that - if you were, your
// kernel ("nt") would be at 6.1.23xxx version, not a .18xxx version from 2013:
0: kd> lmvm nt
Browse full module list
start             end                 module name
fffff800`02e67000 fffff800`0344c000   nt         (pdb symbols)          C:\ProgramData\dbg\sym\ntkrnlmp.pdb\F69D000687EC491E87FC0425D4D378AC2\ntkrnlmp.pdb
    Loaded symbol image file: ntkrnlmp.exe
    Mapped memory image file: C:\ProgramData\dbg\sym\ntoskrnl.exe\521EA0355e5000\ntoskrnl.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Browse all global symbols  functions  data
    Timestamp:        Wed Aug 28 18:13:25 2013 (521EA035)
    CheckSum:         0054CBB3
    ImageSize:        005E5000
    File version:     6.1.7601.18247
    Product version:  6.1.7601.18247
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntkrnlmp.exe
    OriginalFilename: ntkrnlmp.exe
    ProductVersion:   6.1.7601.18247
    FileVersion:      6.1.7601.18247 (win7sp1_gdr.130828-1532)
    FileDescription:  NT Kernel & System
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

The same recommendations made previously still apply, as well as get that machine patched with at least the latest quality cumulative update from December 2016. If you can't patch, you have bigger problems than bugchecking - back up your data, reinstall from OEM recovery media, update drivers to the latest, then carefully reinstall software **and test each step** to make sure things work (and if they don't, you'll know what recent change caused this).
 
Last edited:

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top