chlubb Posted January 13, 2008 Share Posted January 13, 2008 DRIVER_IRQL_NOT_LESS_OR_EQUALSTOP: 0x000000D1 (0x00000000, 0x00000002, 0x00000008, 0x00000000)Obviously this is a driver issue but I cannot determine which one, it does not give me a file name error. The stop error is also somewhat devoid of info, virtually all 0's.Can anyone decode this or point me on my way? I get the BSOD 2-5 times per day.Thanks,Chris Link to comment Share on other sites More sharing options...
hansen_dk Posted January 13, 2008 Share Posted January 13, 2008 hey chlubb.I think some more info would help. When does it happend? What are your specs? It is definately a driver problem, I would recommend you check for newest drivers for all your hardware. Link to comment Share on other sites More sharing options...
nitroshift Posted January 13, 2008 Share Posted January 13, 2008 Does it happen when you start in Safe Mode? If not, configure your pc for a full memory dump, archive the resulting file and upload it somewhere on the internet for us to have a look at it. Link to comment Share on other sites More sharing options...
chlubb Posted January 13, 2008 Author Share Posted January 13, 2008 Hansen and Nitroshift,It happens every day, no specific task.Specs:Asus M2N-EAMD 64 X2 5600+ ,4gb ram, Nvidia GeForce 7300GT, Maxtor 10,000rpmVista Ultimate 32bitI have looked through every driver in the device manager, nothing needs updating. The only thing left is my BIOS but since Windows is crashing I was hesitant to do the LiveUpdate with the Asus software through Windows.I have not run a day in Safe Mode to check it.Thanks,Chris Link to comment Share on other sites More sharing options...
cluberti Posted January 14, 2008 Share Posted January 14, 2008 Configure the box for a complete memory dump, and then compress it and post it somewhere where we can get to it and download/analyze it. Link to comment Share on other sites More sharing options...
nitroshift Posted January 14, 2008 Share Posted January 14, 2008 Configure the box for a complete memory dump, and then compress it and post it somewhere where we can get to it and download/analyze it.My point in different words (sorry cluberti, couldn't resist ) Link to comment Share on other sites More sharing options...
chlubb Posted January 14, 2008 Author Share Posted January 14, 2008 thanks, doing so. Link to comment Share on other sites More sharing options...
chlubb Posted January 14, 2008 Author Share Posted January 14, 2008 does anyone have a place i can post this, its 800meg.thanks,chris Link to comment Share on other sites More sharing options...
cluberti Posted January 14, 2008 Share Posted January 14, 2008 Send me a PM and I'll give you a place to upload the .zip file. Link to comment Share on other sites More sharing options...
cluberti Posted January 16, 2008 Share Posted January 16, 2008 // Thread causing the crash:0: kd> !thread 85711ad0THREAD 85711ad0 Cid 0004.0040 Teb: 00000000 Win32Thread: 00000000 RUNNING on processor 0Not impersonatingDeviceMap 83403068Owning Process 0 Image: <Unknown>Attached Process 856c6ab0 Image: SystemWait Start TickCount 10556 Ticks: 134 (0:00:00:02.090)Context Switch Count 6587 UserTime 00:00:00.000KernelTime 00:00:00.140Win32 Start Address nt!ExpWorkerThread (0x82078ea3)Stack Init 83395000 Current 83394c90 Base 83395000 Limit 83392000 Call 0Priority 13 BasePriority 12 PriorityDecrement 0 IoPriority 2 PagePriority 5ChildEBP RetAddr Args to Child 833949fc 00000000 badb0d00 00000002 85711ad0 nt!_KiTrap0E+0x2ac (FPO: [0,0] TrapFrame @ 833949fc) (CONV: cdecl)WARNING: Frame IP not in any known module. Following frames may be wrong.83394a6c 8e9ea0f4 00000000 00000016 83394b48 0x083394aac 90c062ce 8a34d764 00000016 83394b48 nnrnstdi+0x20f483394bd4 91595ded 85d1ebf8 83394bf8 85ca1d78 tdx!TdxEventReceiveMessagesTransportAddress+0x48e (FPO: [Non-Fpo]) (CONV: stdcall)83394c0c 91593954 00000000 00000001 00000000 tcpip!UdpDeliverDatagrams+0x1fd (FPO: [Non-Fpo]) (CONV: stdcall)83394c58 91593834 893ee2c8 0032aaa0 83394c94 tcpip!UdpReceiveDatagrams+0x118 (FPO: [Non-Fpo]) (CONV: stdcall)83394c68 91591204 83394c7c c000023e 00000000 tcpip!UdpNlClientReceiveDatagrams+0x12 (FPO: [Non-Fpo]) (CONV: stdcall)83394c94 91590fd4 915e2d38 83394cf0 c000023e tcpip!IppDeliverListToProtocol+0x49 (FPO: [Non-Fpo]) (CONV: stdcall)83394cb4 91590f03 915e29c8 00000011 83394cf0 tcpip!IppProcessDeliverList+0x2a (FPO: [Non-Fpo]) (CONV: stdcall)83394d08 9155b56f 915e29c8 00000011 820fde7c tcpip!IppReceiveHeaderBatch+0x1da (FPO: [Non-Fpo]) (CONV: stdcall)83394d30 8218c85a 892d4690 005e29c8 85711ad0 tcpip!IppLoopbackTransmit+0x52 (FPO: [Non-Fpo]) (CONV: stdcall)83394d44 82078fa0 893efed8 00000000 85711ad0 nt!IopProcessWorkItem+0x23 (CONV: stdcall)83394d7c 822254e0 893efed8 8339f680 00000000 nt!ExpWorkerThread+0xfd (CONV: stdcall)83394dc0 8209159e 82078ea3 00000001 00000000 nt!PspSystemThreadStartup+0x9d (CONV: stdcall)00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16// The 0x0 frame in the dump above appears to be nt!KiTimerTableListHead+0x1f60, which// is just a timer and synchronization call (multiproc box, it appears you have). Since we// appear to have crashed after doing whatever nnrnstdi.sys requested in frame 2, I'd have// to say that it's probably invalid data passed in parameter 3 (whatever that is), as both the// handle from parameter 2 (0x00000016) and the pointer from parameter 3 (0x83394b48)// both appear to be valid:// The handle:0: kd> !handle 16 7processor number 0, process 856c6ab0PROCESS 856c6ab0 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000 DirBase: 00122000 ObjectTable: 83400188 HandleCount: 1940. Image: SystemHandle table at 9a0e3000 with 1940 Entries in use0016: Object: 83462fd0 GrantedAccess: 000f003f Entry: 83402028Object: 83462fd0 Type: (85718040) Key ObjectHeader: 83462fb8 (old version) HandleCount: 1 PointerCount: 1 Directory Object: 00000000 Name: \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\MEMORY MANAGEMENT\PREFETCHPARAMETERS// The pointer:0: kd> dc 83394b48 83394b48 00000001 0002000e 007f5dc0 00000100 .........]......83394b58 00000000 00000000 00005dc0 85ca1d78 .........]..x...83394b68 8a32aaa0 893ee2c8 017f0900 900b44de ..2...>......D..83394b78 7fffffff 80000000 00000002 83394bb0 .............K9.83394b88 85ca1d78 83394ba4 83394ba4 83394bb0 x....K9..K9..K9.83394b98 915962cd 83394ba4 89100000 00000000 .bY..K9.........83394ba8 893f5020 83394bd0 85ca1d78 893ee2c8 P?..K9.x.....>.83394bb8 83394bd0 91595be7 00000000 83394c0c .K9..[Y......L9.// I'd say this is the culprit:0: kd> lmvm nnrnstdistart end module name8e9e8000 8e9f0000 nnrnstdi (no symbols) Loaded symbol image file: nnrnstdi.SYS Image path: \SystemRoot\System32\Drivers\nnrnstdi.SYS Image name: nnrnstdi.SYS Timestamp: Fri Jun 08 12:47:14 2007 (46698812) CheckSum: 0000686B ImageSize: 00008000 Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0Not sure what that binary is, but according to Google it could be anything from NetRatings (Nielsen Online) to a Nokia driver, to potential malware. I'd say whatever installed that file, you should uninstall it . Link to comment Share on other sites More sharing options...
chlubb Posted January 16, 2008 Author Share Posted January 16, 2008 so you believe that:nnrnstdi.SYSis the culprit file???i do have a nokia driver installed for my phone, could be it, otherwise pretty much spyware free, i do weekly cleanings with 5 programs.thanks for the tremendous help.chris Link to comment Share on other sites More sharing options...
chlubb Posted January 16, 2008 Author Share Posted January 16, 2008 ok, i deleted that file specifically and ran all anti spyware.lets see if it bsod again. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now