Windows Vista Forums
Vista Forums Home Join Vista Forums Windows 7 Forum Vista Tutorials Tags
Welcome to Windows Vista Forums. Our forum is dedicated to helping you find solutions with any problems, errors or issues you are experiencing with Windows Vista. The Vista forum also covers news and updates and has an extensive Windows Vista tutorial section that covers a wide range of tips and tricks.

Go Back   Vista Forums > Vista Newsgroups > Vista General
Reload this Page BSOD -- need help understanding minidump
Join Now FAQ Search Today's Posts Mark Forums Read

Vista - BSOD -- need help understanding minidump

Reply
 
Old 03-05-2008   #1 (permalink)
fastartcee


 
 

BSOD -- need help understanding minidump
I have been averaging one bsod every three or four days for the past three
weeks. I've done a minidump of the last crash and then used the debugging
tool, which indicated that the "probable cause" was fwpkclnt.sys, but I don't
know what to do about it.

I also did the "kd> !analyze -v" command; all the debugging results are below.

Thanks for any help.

Art
======================================

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini030408-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x81c00000 PsLoadedModuleList = 0x81d11e10
Debug session time: Tue Mar 4 20:02:27.027 2008 (GMT-8)
System Uptime: 1 days 12:15:25.727
Loading Kernel Symbols
...........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {98, 2, 0, 8c175f5b}

Unable to load image vsdatant.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for vsdatant.sys
*** ERROR: Module load completed but symbols could not be loaded for
vsdatant.sys


Probably caused by : fwpkclnt.sys (
fwpkclnt!FwpsInjectTransportSendAsync0+220 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000098, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8c175f5b, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: GetPointerFromAddress: unable to read from 81d315ac
Unable to read MiSystemVaType memory at 81d117e0
00000098

CURRENT_IRQL: 2

FAULTING_IP:
tcpip!IppProcessRawData+3c
8c175f5b f6401801 test byte ptr [eax+18h],1

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: vsmon.exe

LAST_CONTROL_TRANSFER: from 8c196e50 to 8c175f5b

STACK_TEXT:
96c55904 8c196e50 8c1e29c8 96c55a8c 96c55980 tcpip!IppProcessRawData+0x3c
96c55a64 8c1c032f 00000000 00000007 8c1e29c8 tcpip!IppSendDatagramsCommon+0xbb
96c55afc 8c119e9d 00000000 00000007 86828408 tcpip!IppInspectInjectTlSend+0xd7
96c55b58 8c040dba 86fdd058 00000000 00001c97
fwpkclnt!FwpsInjectTransportSendAsync0+0x220
WARNING: Stack unwind information not available. Following frames may be
wrong.
96c55ba8 8c03e51e 8697a550 84230f80 84230f84 vsdatant+0x26dba
96c55bbc 8c04413e 021eee58 00000001 84230f80 vsdatant+0x2451e
96c55be0 8c0444f0 86760340 00000001 021eee58 vsdatant+0x2a13e
96c55c18 8c043413 86733098 84230f68 86733098 vsdatant+0x2a4f0
96c55c2c 81c27f83 86733098 84230f68 84230f68 vsdatant+0x29413
96c55c44 81d88f37 86760340 84230f68 84230fd8 nt!IofCallDriver+0x63
96c55c64 81d89efb 86733098 86760340 021eee00
nt!IopSynchronousServiceTail+0x1e0
96c55d00 81d8ee55 86733098 84230f68 00000000 nt!IopXxxControlFile+0x6b7
96c55d34 81c8caaa 00000274 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
96c55d34 77c90f34 00000274 00000000 00000000 nt!KiFastCallEntry+0x12a
021eedf0 00000000 00000000 00000000 00000000 0x77c90f34


STACK_COMMAND: kb

FOLLOWUP_IP:
fwpkclnt!FwpsInjectTransportSendAsync0+220
8c119e9d ff75f4 push dword ptr [ebp-0Ch]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: fwpkclnt!FwpsInjectTransportSendAsync0+220

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: fwpkclnt

IMAGE_NAME: fwpkclnt.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4549b2f6

FAILURE_BUCKET_ID: 0xD1_fwpkclnt!FwpsInjectTransportSendAsync0+220

BUCKET_ID: 0xD1_fwpkclnt!FwpsInjectTransportSendAsync0+220

Followup: MachineOwner
---------

0: kd> lmvm fwpkclnt
start end module name
8c115000 8c12e000 fwpkclnt (pdb symbols)
c:\symbols\fwpkclnt.pdb\0CDD1AD5ACD047479C8FB2FAC02E87B01\fwpkclnt.pdb
Loaded symbol image file: fwpkclnt.sys
Mapped memory image file:
c:\symbols\fwpkclnt.sys\4549B2F619000\fwpkclnt.sys
Image path: fwpkclnt.sys
Image name: fwpkclnt.sys
Timestamp: Thu Nov 02 01:57:26 2006 (4549B2F6)
CheckSum: 0002402A
ImageSize: 00019000
File version: 6.0.6000.16386
Product version: 6.0.6000.16386
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: fwpkclnt.sys
OriginalFilename: fwpkclnt.sys
ProductVersion: 6.0.6000.16386
FileVersion: 6.0.6000.16386 (vista_rtm.061101-2205)
FileDescription: FWP/IPsec Kernel-Mode API
LegalCopyright: © Microsoft Corporation. All rights reserved.


=====================================

FOLLOWUP_IP:
fwpkclnt!FwpsInjectTransportSendAsync0+220
8c119e9d ff75f4 push dword ptr [ebp-0Ch]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: fwpkclnt!FwpsInjectTransportSendAsync0+220

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: fwpkclnt

IMAGE_NAME: fwpkclnt.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4549b2f6

FAILURE_BUCKET_ID: 0xD1_fwpkclnt!FwpsInjectTransportSendAsync0+220

BUCKET_ID: 0xD1_fwpkclnt!FwpsInjectTransportSendAsync0+220

Followup: MachineOwner
---------
My System SpecsSystem Spec
Old 03-05-2008   #2 (permalink)
fastartcee


 
 

RE: BSOD -- need help understanding minidump
I forgot to mention these recent installations:
- HP Windows Home Server (seems to be operating okay)
- I'm trying out Firefox 3 Beta 3 (which seems to run okay, but I have had
crashes)

Also, I'm using:
- AVG for anti-virus
- Zone Alarm for firewall
My System SpecsSystem Spec
Old 03-05-2008   #3 (permalink)
AJR


 
 

Re: BSOD -- need help understanding minidump
Goggle "vsdatant.sys.

"fastartcee" <fastartcee@xxxxxx> wrote in message
news:4F226A72-91BC-4BAA-BB1F-AEF988279889@xxxxxx
Quote:

>I have been averaging one bsod every three or four days for the past three
> weeks. I've done a minidump of the last crash and then used the debugging
> tool, which indicated that the "probable cause" was fwpkclnt.sys, but I
> don't
> know what to do about it.
>
> I also did the "kd> !analyze -v" command; all the debugging results are
> below.
>
> Thanks for any help.
>
> Art
> ======================================
>
> Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\Windows\Minidump\Mini030408-01.dmp]
> Mini Kernel Dump File: Only registers and stack trace are available
>
> Symbol search path is:
> SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
>
> Executable search path is:
> Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
> Product: WinNt, suite: TerminalServer SingleUserTS Personal
> Built by: 6000.16584.x86fre.vista_gdr.071023-1545
> Kernel base = 0x81c00000 PsLoadedModuleList = 0x81d11e10
> Debug session time: Tue Mar 4 20:02:27.027 2008 (GMT-8)
> System Uptime: 1 days 12:15:25.727
> Loading Kernel Symbols
> ..........................................................................................................................................................
> Loading User Symbols
> Loading unloaded module list
> .....
> *******************************************************************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> *******************************************************************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 100000D1, {98, 2, 0, 8c175f5b}
>
> Unable to load image vsdatant.sys, Win32 error 0n2
> *** WARNING: Unable to verify timestamp for vsdatant.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> vsdatant.sys
>
>
> Probably caused by : fwpkclnt.sys (
> fwpkclnt!FwpsInjectTransportSendAsync0+220 )
>
> Followup: MachineOwner
> ---------
>
> 0: kd> !analyze -v
> *******************************************************************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> *******************************************************************************
>
> DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
> An attempt was made to access a pageable (or completely invalid) address
> at an
> interrupt request level (IRQL) that is too high. This is usually
> caused by drivers using improper addresses.
> If kernel debugger is available get stack backtrace.
> Arguments:
> Arg1: 00000098, memory referenced
> Arg2: 00000002, IRQL
> Arg3: 00000000, value 0 = read operation, 1 = write operation
> Arg4: 8c175f5b, address which referenced memory
>
> Debugging Details:
> ------------------
>
> READ_ADDRESS: GetPointerFromAddress: unable to read from 81d315ac
> Unable to read MiSystemVaType memory at 81d117e0
> 00000098
>
> CURRENT_IRQL: 2
>
> FAULTING_IP:
> tcpip!IppProcessRawData+3c
> 8c175f5b f6401801 test byte ptr [eax+18h],1
>
> CUSTOMER_CRASH_COUNT: 1
>
> DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
>
> BUGCHECK_STR: 0xD1
>
> PROCESS_NAME: vsmon.exe
>
> LAST_CONTROL_TRANSFER: from 8c196e50 to 8c175f5b
>
> STACK_TEXT:
> 96c55904 8c196e50 8c1e29c8 96c55a8c 96c55980 tcpip!IppProcessRawData+0x3c
> 96c55a64 8c1c032f 00000000 00000007 8c1e29c8
> tcpip!IppSendDatagramsCommon+0xbb
> 96c55afc 8c119e9d 00000000 00000007 86828408
> tcpip!IppInspectInjectTlSend+0xd7
> 96c55b58 8c040dba 86fdd058 00000000 00001c97
> fwpkclnt!FwpsInjectTransportSendAsync0+0x220
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 96c55ba8 8c03e51e 8697a550 84230f80 84230f84 vsdatant+0x26dba
> 96c55bbc 8c04413e 021eee58 00000001 84230f80 vsdatant+0x2451e
> 96c55be0 8c0444f0 86760340 00000001 021eee58 vsdatant+0x2a13e
> 96c55c18 8c043413 86733098 84230f68 86733098 vsdatant+0x2a4f0
> 96c55c2c 81c27f83 86733098 84230f68 84230f68 vsdatant+0x29413
> 96c55c44 81d88f37 86760340 84230f68 84230fd8 nt!IofCallDriver+0x63
> 96c55c64 81d89efb 86733098 86760340 021eee00
> nt!IopSynchronousServiceTail+0x1e0
> 96c55d00 81d8ee55 86733098 84230f68 00000000 nt!IopXxxControlFile+0x6b7
> 96c55d34 81c8caaa 00000274 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
> 96c55d34 77c90f34 00000274 00000000 00000000 nt!KiFastCallEntry+0x12a
> 021eedf0 00000000 00000000 00000000 00000000 0x77c90f34
>
>
> STACK_COMMAND: kb
>
> FOLLOWUP_IP:
> fwpkclnt!FwpsInjectTransportSendAsync0+220
> 8c119e9d ff75f4 push dword ptr [ebp-0Ch]
>
> SYMBOL_STACK_INDEX: 3
>
> SYMBOL_NAME: fwpkclnt!FwpsInjectTransportSendAsync0+220
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: fwpkclnt
>
> IMAGE_NAME: fwpkclnt.sys
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 4549b2f6
>
> FAILURE_BUCKET_ID: 0xD1_fwpkclnt!FwpsInjectTransportSendAsync0+220
>
> BUCKET_ID: 0xD1_fwpkclnt!FwpsInjectTransportSendAsync0+220
>
> Followup: MachineOwner
> ---------
>
> 0: kd> lmvm fwpkclnt
> start end module name
> 8c115000 8c12e000 fwpkclnt (pdb symbols)
> c:\symbols\fwpkclnt.pdb\0CDD1AD5ACD047479C8FB2FAC02E87B01\fwpkclnt.pdb
> Loaded symbol image file: fwpkclnt.sys
> Mapped memory image file:
> c:\symbols\fwpkclnt.sys\4549B2F619000\fwpkclnt.sys
> Image path: fwpkclnt.sys
> Image name: fwpkclnt.sys
> Timestamp: Thu Nov 02 01:57:26 2006 (4549B2F6)
> CheckSum: 0002402A
> ImageSize: 00019000
> File version: 6.0.6000.16386
> Product version: 6.0.6000.16386
> File flags: 0 (Mask 3F)
> File OS: 40004 NT Win32
> File type: 2.0 Dll
> File date: 00000000.00000000
> Translations: 0409.04b0
> CompanyName: Microsoft Corporation
> ProductName: Microsoft® Windows® Operating System
> InternalName: fwpkclnt.sys
> OriginalFilename: fwpkclnt.sys
> ProductVersion: 6.0.6000.16386
> FileVersion: 6.0.6000.16386 (vista_rtm.061101-2205)
> FileDescription: FWP/IPsec Kernel-Mode API
> LegalCopyright: © Microsoft Corporation. All rights reserved.
>
>
> =====================================
>
> FOLLOWUP_IP:
> fwpkclnt!FwpsInjectTransportSendAsync0+220
> 8c119e9d ff75f4 push dword ptr [ebp-0Ch]
>
> SYMBOL_STACK_INDEX: 3
>
> SYMBOL_NAME: fwpkclnt!FwpsInjectTransportSendAsync0+220
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: fwpkclnt
>
> IMAGE_NAME: fwpkclnt.sys
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 4549b2f6
>
> FAILURE_BUCKET_ID: 0xD1_fwpkclnt!FwpsInjectTransportSendAsync0+220
>
> BUCKET_ID: 0xD1_fwpkclnt!FwpsInjectTransportSendAsync0+220
>
> Followup: MachineOwner
> ---------
>
>
My System SpecsSystem Spec
Old 03-05-2008   #4 (permalink)
C.B.


 
 

Re: BSOD -- need help understanding minidump


"fastartcee" <fastartcee@xxxxxx> wrote in message
news:E3FA0E69-B08D-499D-A468-1FD6F2B6DEB5@xxxxxx
Quote:

> I forgot to mention these recent installations:
> - HP Windows Home Server (seems to be operating okay)
> - I'm trying out Firefox 3 Beta 3 (which seems to run okay, but I have
> had
> crashes)
>
> Also, I'm using:
> - AVG for anti-virus
> - Zone Alarm for firewall
>
>
fastartcee,

Uninstall your ZoneAlarm and use the native Windows firewall or get
another third party firewall. ZoneAlarm is not compatible with Vista
regardless of what ZoneAlarm says to the contrary.

C.B.


--
It is the responsibility and duty of everyone to help the underprivileged
and unfortunate among us.
My System SpecsSystem Spec
Old 03-06-2008   #5 (permalink)
fastartcee


 
 

Re: BSOD -- need help understanding minidump
Thanks, C.B. I have done a clean uninstall of ZoneAlarm, and now I'll
monitor things for a week or so to see if this has solved my problem.

Art

"C.B." wrote:
Quote:

> "fastartcee" <fastartcee@xxxxxx> wrote in message
> news:E3FA0E69-B08D-499D-A468-1FD6F2B6DEB5@xxxxxx
Quote:

> > I forgot to mention these recent installations:
> > - HP Windows Home Server (seems to be operating okay)
> > - I'm trying out Firefox 3 Beta 3 (which seems to run okay, but I have
> > had
> > crashes)
> >
> > Also, I'm using:
> > - AVG for anti-virus
> > - Zone Alarm for firewall
> >
> >
>
> fastartcee,
>
> Uninstall your ZoneAlarm and use the native Windows firewall or get
> another third party firewall. ZoneAlarm is not compatible with Vista
> regardless of what ZoneAlarm says to the contrary.
>
> C.B.
>
>
> --
> It is the responsibility and duty of everyone to help the underprivileged
> and unfortunate among us.
>
My System SpecsSystem Spec
Reply

« Converting Vista to English | Can't run exe in Windows Vista SP1 »
Thread Tools


Similar Threads
Thread Forum
Solved BSOD (with minidump) Drivers
BSOD (IRQL and Service Exception) Minidump HELP!! General Discussion
0x124 BSoD (with minidump) General Discussion
BSOD minidump analysis Vista performance & maintenance
BSOD and minidump points to ntfs.sys Vista performance & maintenance


Vista Forums is an independent web site and has not been authorized,
sponsored, or otherwise approved by Microsoft Corporation.
"Windows Vista", the Start Orb, and related materials are trademarks of Microsoft Corp.
© Designer Media Ltd
Contact Us - Windows Vista Forums - Archive - Privacy - Legal - Top

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46