BSOD while changing the network adpaters

sjmittal · 06 Jun 2013

Hi,
I have multiple lan cards/network adapters. Each configured for a given ISP.
When I change from one say Ethernet card to say a wireless adapter I get BSD.

I am attaching the three recent dumps in one zip file created using SF diagnostic tool for your reference.

koolkat77 · 07 Jun 2013

Security App

Crashes indicate Kaspersky being a possible cause. Remove Kaspersky and replace with Microsoft Security Essentials to see if it provides more stability. Uninstallers (removal tools) for common antivirus software. Microsoft Security Essentials and Malwarebytes are recommended from a strict BSOD perspective. They do not cause blue screens on the system as other AV products do.

Microsoft Security Essentials, Free antivirus for windows and Malwarebytes Anti-Malware Free

Information

Do not start the free trial of MalwareBytes, unselect that option when prompted.
Update and make full scans with both separately.

Start up

Keep less stuff at the start-up. Only anti-virus, this helps avoid driver conflicts and improves time to log in to windows.
Troubleshoot a Problem by Performing a Clean Startup in Windows 7 or Vista
How to Change, Add, or Remove Startup Programs in Windows 7

This tutorial USB Selective Suspend - Turn On or Off may help you:

To Disable Selective Suspend:

Code:

1. open the control panel
2. go to power options (you may have to set view to small icons)
3. click change plan settings
4. in the window that opens:
5. click change plan settings
6. click change advanced power settings, expand usb and ensure usb selective suspend is disabled.

Disk Check

For errors on your Hard drive(s): How to Run Disk Check in Windows 7

Then Update these drivers:
D-Link Wifi LAN Card Driver Reference Table - Dnetr28ux.sys
Citrix Deterministic Networks DNE Driver (Cisco VPM Client) Driver Reference Table - dnelwf64.sys

BSOD BUGCHECK SUMMARY

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffffa8009306d90, 2, 0, fffff8800b7420c1}

*** WARNING: Unable to verify timestamp for Dnetr28ux.sys
*** ERROR: Module load completed but symbols could not be loaded for Dnetr28ux.sys
Probably caused by : Dnetr28ux.sys ( Dnetr28ux+e70c1 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffffa8009306d90, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8800b7420c1, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c4100
GetUlongFromAddress: unable to read from fffff800032c41c0
 fffffa8009306d90 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
Dnetr28ux+e70c1
fffff880`0b7420c1 488b00          mov     rax,qword ptr [rax]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TAG_NOT_DEFINED_c000000f:  FFFFF80000BA2FB0

TRAP_FRAME:  fffff80000b9c6d0 -- (.trap 0xfffff80000b9c6d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8009306d90 rbx=0000000000000000 rcx=0000057ff826f9d8
rdx=0000057ffbd484c8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800b7420c1 rsp=fffff80000b9c860 rbp=0000000000000000
 r8=fffffa80050f2428  r9=fffffa8007d907b0 r10=fffffa80062d5e40
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
Dnetr28ux+0xe70c1:
fffff880`0b7420c1 488b00          mov     rax,qword ptr [rax] ds:fffffa80`09306d90=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000308c1a9 to fffff8000308cc00

STACK_TEXT:  
fffff800`00b9c588 fffff800`0308c1a9 : 00000000`0000000a fffffa80`09306d90 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9c590 fffff800`0308ae20 : fffffa80`04c3d000 fffff880`06649d00 fffffa80`0828f3f0 fffffa80`07d90620 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c6d0 fffff880`0b7420c1 : 00000000`00000002 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KiPageFault+0x260
fffff800`00b9c860 00000000`00000002 : 00000000`00000000 00000000`00000002 00000000`00000000 fffffa80`074aa180 : Dnetr28ux+0xe70c1
fffff800`00b9c868 00000000`00000000 : 00000000`00000002 00000000`00000000 fffffa80`074aa180 00000000`00000000 : 0x2


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Dnetr28ux+e70c1
fffff880`0b7420c1 488b00          mov     rax,qword ptr [rax]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  Dnetr28ux+e70c1

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Dnetr28ux

IMAGE_NAME:  Dnetr28ux.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4db906aa

FAILURE_BUCKET_ID:  X64_0xD1_Dnetr28ux+e70c1

BUCKET_ID:  X64_0xD1_Dnetr28ux+e70c1

Followup: MachineOwner
---------

0: kd> lmvm Dnetr28ux
start             end                 module name
fffff880`0b65b000 fffff880`0b7ee000   Dnetr28ux T (no symbols)           
    Loaded symbol image file: Dnetr28ux.sys
    Image path: \SystemRoot\system32\DRIVERS\Dnetr28ux.sys
    Image name: Dnetr28ux.sys
    Timestamp:        Thu Apr 28 12:18:18 2011 (4DB906AA)
    CheckSum:         00193FD2
    ImageSize:        00193000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {128, 2, 0, fffff88001c86f46}

*** WARNING: Unable to verify timestamp for dnelwf64.sys
*** ERROR: Module load completed but symbols could not be loaded for dnelwf64.sys
Probably caused by : dnelwf64.sys ( dnelwf64+3409 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000128, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88001c86f46, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003302100
GetUlongFromAddress: unable to read from fffff800033021c0
 0000000000000128 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
ndis! ?? ::FNODOBFM::`string'+cc19
fffff880`01c86f46 488b8928010000  mov     rcx,qword ptr [rcx+128h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff88009297ab0 -- (.trap 0xfffff88009297ab0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa8003b1eb00 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001c86f46 rsp=fffff88009297c40 rbp=fffff88007a38210
 r8=0000000000000000  r9=0000000000000000 r10=fffff88009297ca8
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
ndis! ?? ::FNODOBFM::`string'+0xcc19:
fffff880`01c86f46 488b8928010000  mov     rcx,qword ptr [rcx+128h] ds:00000000`00000128=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030ca1a9 to fffff800030cac00

STACK_TEXT:  
fffff880`09297968 fffff800`030ca1a9 : 00000000`0000000a 00000000`00000128 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`09297970 fffff800`030c8e20 : fffff880`09297b80 fffff880`07a16108 fffffa80`00000040 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`09297ab0 fffff880`01c86f46 : 00000000`0000000e fffffa80`07dd4f20 fffffa80`06e42950 fffffa80`03b90030 : nt!KiPageFault+0x260
fffff880`09297c40 fffff880`01c664d4 : fffffa80`03c42c80 fffffa80`03c42c80 00000000`00000000 00000000`00000000 : ndis! ?? ::FNODOBFM::`string'+0xcc19
fffff880`09297c80 fffff880`04a22409 : fffffa80`03b1ec40 00000000`00000002 00000000`00000001 00000000`00000002 : ndis!NdisFSendNetBufferLists+0x64
fffff880`09297cc0 fffffa80`03b1ec40 : 00000000`00000002 00000000`00000001 00000000`00000002 fffff880`09297f78 : dnelwf64+0x3409
fffff880`09297cc8 00000000`00000002 : 00000000`00000001 00000000`00000002 fffff880`09297f78 00000000`00000022 : 0xfffffa80`03b1ec40
fffff880`09297cd0 00000000`00000001 : 00000000`00000002 fffff880`09297f78 00000000`00000022 fffffa80`21230001 : 0x2
fffff880`09297cd8 00000000`00000002 : fffff880`09297f78 00000000`00000022 fffffa80`21230001 00000000`00000000 : 0x1
fffff880`09297ce0 fffff880`09297f78 : 00000000`00000022 fffffa80`21230001 00000000`00000000 fffffa80`03b1ec40 : 0x2
fffff880`09297ce8 00000000`00000022 : fffffa80`21230001 00000000`00000000 fffffa80`03b1ec40 fffffa80`03b1ec88 : 0xfffff880`09297f78
fffff880`09297cf0 fffffa80`21230001 : 00000000`00000000 fffffa80`03b1ec40 fffffa80`03b1ec88 fffffa80`03b1ec40 : 0x22
fffff880`09297cf8 00000000`00000000 : fffffa80`03b1ec40 fffffa80`03b1ec88 fffffa80`03b1ec40 00000000`00000000 : 0xfffffa80`21230001


STACK_COMMAND:  kb

FOLLOWUP_IP: 
dnelwf64+3409
fffff880`04a22409 ??              ???

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  dnelwf64+3409

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: dnelwf64

IMAGE_NAME:  dnelwf64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4e31037c

FAILURE_BUCKET_ID:  X64_0xD1_dnelwf64+3409

BUCKET_ID:  X64_0xD1_dnelwf64+3409

Followup: MachineOwner
---------

2: kd> lmvm dnelwf64
start             end                 module name
fffff880`04a1f000 fffff880`04a44000   dnelwf64 T (no symbols)           
    Loaded symbol image file: dnelwf64.sys
    Image path: \SystemRoot\system32\DRIVERS\dnelwf64.sys
    Image name: dnelwf64.sys
    Timestamp:        Thu Jul 28 12:36:44 2011 (4E31037C)
    CheckSum:         00027709
    ImageSize:        00025000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4