memory dump

please help me to check this problem....tq..

khairi90 said:

please help me to check this problem....tq..

Hi khair

When I read a dmp from you on 11/06, and today same cause same fix
NETw5s32.sys still netwrok driver.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\010210-23368-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82c07000 PsLoadedModuleList = 0x82d4f810
Debug session time: Fri Jan  1 23:25:56.318 2010 (GMT-5)
System Uptime: 0 days 0:04:05.596
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 1, 8e78295d}

Unable to load image \SystemRoot\system32\DRIVERS\NETw5s32.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NETw5s32.sys
*** ERROR: Module load completed but symbols could not be loaded for NETw5s32.sys
Probably caused by : NETw5s32.sys ( NETw5s32+18095d )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8e78295d, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82d6f718
Unable to read MiSystemVaType memory at 82d4f160
 00000000 

CURRENT_IRQL:  2

FAULTING_IP: 
NETw5s32+18095d
8e78295d f3a5            rep movs dword ptr es:[edi],dword ptr [esi]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  af1809f0 -- (.trap 0xffffffffaf1809f0)
ErrCode = 00000002
eax=00000000 ebx=867c9000 ecx=0000000c edx=00000000 esi=867ca500 edi=00000000
eip=8e78295d esp=af180a64 ebp=af180a84 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
NETw5s32+0x18095d:
8e78295d f3a5            rep movs dword ptr es:[edi],dword ptr [esi]
Resetting default scope

LAST_CONTROL_TRANSFER:  from 8e78295d to 82c4d7eb

STACK_TEXT:  
af1809f0 8e78295d badb0d00 00000000 8301cba9 nt!KiTrap0E+0x2cf
WARNING: Stack unwind information not available. Following frames may be wrong.
af180a84 8e782cdd 867c9000 847d1eb8 867ca500 NETw5s32+0x18095d
af180ac4 8e60fef1 867c9000 847d1eb8 86185038 NETw5s32+0x180cdd
af180af4 8e61067a 847d1eb8 96b43ff0 847d1eb8 NETw5s32+0xdef1
af180b0c 8e60e8da 847d1eb8 96b43fd0 00000004 NETw5s32+0xe67a
af180b28 8e76202a 862bc970 00000074 00000000 NETw5s32+0xc8da
af180b6c 8e630f19 862bc930 60040084 86b4d004 NETw5s32+0x16002a
af180b94 8e628133 84355210 00000000 8634d128 NETw5s32+0x2ef19
af180bcc 8e628407 8634d128 8634d5f8 86b4d040 NETw5s32+0x26133
af180c18 8e623627 00000001 8634d5f8 000000ff NETw5s32+0x26407
af180c54 8e6215cc 00355080 80000000 af180c70 NETw5s32+0x21627
af180c64 8e835d35 8634d5f8 af180cb0 876fc301 NETw5s32+0x1f5cc
af180c70 876fc301 862e3560 00000000 00000000 NETw5s32+0x233d35
af180cb0 876dd6b2 8632b98c 0032b878 00000000 ndis!ndisMiniportDpc+0xda
af180d10 876c4976 8632b9ac 00000000 8498a768 ndis!ndisQueuedMiniportDpcWorkItem+0xd0
af180d50 82e1566d 00000000 b5c9d2f7 00000000 ndis!ndisReceiveWorkerThread+0xeb
af180d90 82cc70d9 876c488b 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETw5s32+18095d
8e78295d f3a5            rep movs dword ptr es:[edi],dword ptr [esi]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  NETw5s32+18095d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETw5s32

IMAGE_NAME:  NETw5s32.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4aafed9f

FAILURE_BUCKET_ID:  0xD1_NETw5s32+18095d

BUCKET_ID:  0xD1_NETw5s32+18095d

Followup: MachineOwner
---------

the scan shows this result:
windows resorce protection found corrupt files but was unable to fix some of them.
Details are included in the CBS.log