[MLCS]

I've attempted opening the dump file in WinDbg but not familiar with the process and it seems I'm not getting the right symbols. Tried pointing the symbol path to microsoft's site, but no change. System is randomly Blue Screening, sometimes it goes a week without issue, others it's 3 times in a row when trying to log in.

I tried uploading the MEMORY.DMP ... But it doesn't like the 392MB size for some reason. LoL

Any ideas here?

Thanks in advance,
-Shawn

[Advertisements]

As further info... Here is what I get before trying to analyze.

------------------------------------------------------------------


Microsoft ® Windows Debugger Version 6.12.0002.633 AMD64
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\shawn_matheson\Desktop\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols ;srv*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`02c03000 PsLoadedModuleList = 0xfffff800`02e48e90
Debug session time: Fri Aug 26 09:20:04.465 2011 (UTC - 6:00)
System Uptime: 0 days 0:00:56.260
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols

Loading unloaded module list
................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80050031, 406f8, fffff80002dae0f1}

*** ERROR: Module load completed but symbols could not be loaded for ipnat.sys
*** ERROR: Module load completed but symbols could not be loaded for ncplelhp.sys
Probably caused by : tcpip.sys ( tcpip!WfpAuditEventGeneral+1da )

Followup: MachineOwner
---------

[MLCS]

As further info... Here is what I get before trying to analyze.

------------------------------------------------------------------


Microsoft ® Windows Debugger Version 6.12.0002.633 AMD64
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\shawn_matheson\Desktop\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols ;srv*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`02c03000 PsLoadedModuleList = 0xfffff800`02e48e90
Debug session time: Fri Aug 26 09:20:04.465 2011 (UTC - 6:00)
System Uptime: 0 days 0:00:56.260
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols

Loading unloaded module list
................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80050031, 406f8, fffff80002dae0f1}

*** ERROR: Module load completed but symbols could not be loaded for ipnat.sys
*** ERROR: Module load completed but symbols could not be loaded for ncplelhp.sys
Probably caused by : tcpip.sys ( tcpip!WfpAuditEventGeneral+1da )

Followup: MachineOwner
---------

[MLCS]

Sorry for the multiple replies, I'm trying to walk myself through this one step at a time.

Reviewing the analyze and also using BlueScreenView I get this error out of it....

UNEXPECTED_KERNEL_MODE_TRAP with bugcheck of 7f

Seems to have something to do with a double fault. Could this be memory? I ran a Memtest on the memory for about an hour with no errors, but I've known memory to fail before without showing errors on memtest.

[MLCS]

bump?

[SRX660]

The usual culprit with tcp/ip errors is your network drivers. Check to see if you can update your network driver (Only). Once in a while a user profile will get corrupted. See if you can and add another user to see if the bsod goes away when you use that user profile.

On Mini Dump files

Check the methods in the 2 replies in this thread which describe Bluescreen troubleshooting
methods that you can use. You can read the minidumps, compare times to EventViewer and
use general troubleshooting techniques as indicated there.

http://social.answer...3e-0f05c7745117

These tools are used in the above - BlueScreenView and MyEventViewer

This is an excellent tool for posting Blue Screen Error Information

BlueScreenView scans all your minidump files created during 'blue screen of death' crashes, and
displays the information about all crashes in one table - Free
http://www.nirsoft.n...creen_view.html

MyEventViewer can be checked at the time of the BlueScreen (BSOD) to within a second or so of the
time of the BSOD to provide more information as to possible cause - see TIP)

MyEventViewer - Free - a simple alternative to the standard event viewer of Windows.
TIP - Options - Advanced Filter allows you to see a time frame instead of the whole file -
set it to a bit before and after the time of the BSOD.
http://www.nirsoft.n...ent_viewer.html

Some people have problems with security toolssoftware like PC Tools internet security that can cause blue screens. Removing the software usually fixes the problem.

SRX660