Stop error, please help.

[chlubb]

DRIVER_IRQL_NOT_LESS_OR_EQUAL

STOP: 0x000000D1 (0x00000000, 0x00000002, 0x00000008, 0x00000000)

Obviously this is a driver issue but I cannot determine which one, it does not give me a file name error. The stop error is also somewhat devoid of info, virtually all 0's.

Can anyone decode this or point me on my way? I get the BSOD 2-5 times per day.

Thanks,

Chris

[hansen_dk]

hey chlubb.

I think some more info would help.

When does it happend?

What are your specs?

It is definately a driver problem, I would recommend you check for newest drivers for all your hardware.

[nitroshift]

Does it happen when you start in Safe Mode? If not, configure your pc for a full memory dump, archive the resulting file and upload it somewhere on the internet for us to have a look at it.

[chlubb]

Hansen and Nitroshift,

It happens every day, no specific task.

Specs:

Asus M2N-E

AMD 64 X2 5600+ ,4gb ram, Nvidia GeForce 7300GT, Maxtor 10,000rpm

Vista Ultimate 32bit

I have looked through every driver in the device manager, nothing needs updating. The only thing left is my BIOS but since Windows is crashing I was hesitant to do the LiveUpdate with the Asus software through Windows.

I have not run a day in Safe Mode to check it.

Thanks,

Chris

[cluberti]

Configure the box for a complete memory dump, and then compress it and post it somewhere where we can get to it and download/analyze it.

[nitroshift]

Configure the box for a complete memory dump, and then compress it and post it somewhere where we can get to it and download/analyze it.

My point in different words (sorry cluberti, couldn't resist )

[chlubb]

thanks, doing so.

[chlubb]

does anyone have a place i can post this, its 800meg.

thanks,

chris

[cluberti]

Send me a PM and I'll give you a place to upload the .zip file.

[cluberti]

// Thread causing the crash:
0: kd> !thread 85711ad0
THREAD 85711ad0  Cid 0004.0040  Teb: 00000000 Win32Thread: 00000000 RUNNING on processor 0
Not impersonating
DeviceMap				 83403068
Owning Process			0	   Image:		 <Unknown>
Attached Process		  856c6ab0	   Image:		 System
Wait Start TickCount	  10556		  Ticks: 134 (0:00:00:02.090)
Context Switch Count	  6587			 
UserTime				  00:00:00.000
KernelTime				00:00:00.140
Win32 Start Address nt!ExpWorkerThread (0x82078ea3)
Stack Init 83395000 Current 83394c90 Base 83395000 Limit 83392000 Call 0
Priority 13 BasePriority 12 PriorityDecrement 0 IoPriority 2 PagePriority 5
ChildEBP RetAddr  Args to Child			  
833949fc 00000000 badb0d00 00000002 85711ad0 nt!_KiTrap0E+0x2ac (FPO: [0,0] TrapFrame @ 833949fc) (CONV: cdecl)
WARNING: Frame IP not in any known module. Following frames may be wrong.
83394a6c 8e9ea0f4 00000000 00000016 83394b48 0x0
83394aac 90c062ce 8a34d764 00000016 83394b48 nnrnstdi+0x20f4
83394bd4 91595ded 85d1ebf8 83394bf8 85ca1d78 tdx!TdxEventReceiveMessagesTransportAddress+0x48e (FPO: [Non-Fpo]) (CONV: stdcall)
83394c0c 91593954 00000000 00000001 00000000 tcpip!UdpDeliverDatagrams+0x1fd (FPO: [Non-Fpo]) (CONV: stdcall)
83394c58 91593834 893ee2c8 0032aaa0 83394c94 tcpip!UdpReceiveDatagrams+0x118 (FPO: [Non-Fpo]) (CONV: stdcall)
83394c68 91591204 83394c7c c000023e 00000000 tcpip!UdpNlClientReceiveDatagrams+0x12 (FPO: [Non-Fpo]) (CONV: stdcall)
83394c94 91590fd4 915e2d38 83394cf0 c000023e tcpip!IppDeliverListToProtocol+0x49 (FPO: [Non-Fpo]) (CONV: stdcall)
83394cb4 91590f03 915e29c8 00000011 83394cf0 tcpip!IppProcessDeliverList+0x2a (FPO: [Non-Fpo]) (CONV: stdcall)
83394d08 9155b56f 915e29c8 00000011 820fde7c tcpip!IppReceiveHeaderBatch+0x1da (FPO: [Non-Fpo]) (CONV: stdcall)
83394d30 8218c85a 892d4690 005e29c8 85711ad0 tcpip!IppLoopbackTransmit+0x52 (FPO: [Non-Fpo]) (CONV: stdcall)
83394d44 82078fa0 893efed8 00000000 85711ad0 nt!IopProcessWorkItem+0x23 (CONV: stdcall)
83394d7c 822254e0 893efed8 8339f680 00000000 nt!ExpWorkerThread+0xfd (CONV: stdcall)
83394dc0 8209159e 82078ea3 00000001 00000000 nt!PspSystemThreadStartup+0x9d (CONV: stdcall)
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

// The 0x0 frame in the dump above appears to be nt!KiTimerTableListHead+0x1f60, which
// is just a timer and synchronization call (multiproc box, it appears you have).  Since we
// appear to have crashed after doing whatever nnrnstdi.sys requested in frame 2, I'd have
// to say that it's probably invalid data passed in parameter 3 (whatever that is), as both the
// handle from parameter 2 (0x00000016) and the pointer from parameter 3  (0x83394b48)
// both appear to be valid:

// The handle:
0: kd> !handle 16 7
processor number 0, process 856c6ab0
PROCESS 856c6ab0  SessionId: none  Cid: 0004	Peb: 00000000  ParentCid: 0000
	DirBase: 00122000  ObjectTable: 83400188  HandleCount: 1940.
	Image: System

Handle table at 9a0e3000 with 1940 Entries in use
0016: Object: 83462fd0  GrantedAccess: 000f003f Entry: 83402028
Object: 83462fd0  Type: (85718040) Key
	ObjectHeader: 83462fb8 (old version)
		HandleCount: 1  PointerCount: 1
		Directory Object: 00000000  Name: \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\MEMORY MANAGEMENT\PREFETCHPARAMETERS

// The pointer:
0: kd> dc 83394b48 
83394b48  00000001 0002000e 007f5dc0 00000100  .........]......
83394b58  00000000 00000000 00005dc0 85ca1d78  .........]..x...
83394b68  8a32aaa0 893ee2c8 017f0900 900b44de  ..2...>......D..
83394b78  7fffffff 80000000 00000002 83394bb0  .............K9.
83394b88  85ca1d78 83394ba4 83394ba4 83394bb0  x....K9..K9..K9.
83394b98  915962cd 83394ba4 89100000 00000000  .bY..K9.........
83394ba8  893f5020 83394bd0 85ca1d78 893ee2c8   P?..K9.x.....>.
83394bb8  83394bd0 91595be7 00000000 83394c0c  .K9..[Y......L9.


// I'd say this is the culprit:
0: kd> lmvm nnrnstdi
start	end		module name
8e9e8000 8e9f0000   nnrnstdi   (no symbols)		   
	Loaded symbol image file: nnrnstdi.SYS
	Image path: \SystemRoot\System32\Drivers\nnrnstdi.SYS
	Image name: nnrnstdi.SYS
	Timestamp:		Fri Jun 08 12:47:14 2007 (46698812)
	CheckSum:		 0000686B
	ImageSize:		00008000
	Translations:	 0000.04b0 0000.04e0 0409.04b0 0409.04e0

Not sure what that binary is, but according to Google it could be anything from NetRatings (Nielsen Online) to a Nokia driver, to potential malware. I'd say whatever installed that file, you should uninstall it .

[chlubb]

so you believe that:

nnrnstdi.SYS

is the culprit file???

i do have a nokia driver installed for my phone, could be it, otherwise pretty much spyware free, i do weekly cleanings with 5 programs.

thanks for the tremendous help.

chris

[chlubb]

ok, i deleted that file specifically and ran all anti spyware.

lets see if it bsod again.