Bsod - tcpip/sys ?

[icos]

First, sorry for my bad english !

This happen specialy after install or uninstall drivers or programs .

I attached the zipfile as asked.

My computer is a laptop, Toshiba F60-10J 6 months old.

Intel Core i5 M 430
Nvidia GForce GT M330
OS : Window 7 Home Premium 64 bit.

Folder "minidump" is empty

Thanks

 

[Tews]

Unfortunately there were no .dmp files in your attachment... Go to c:/windows/minidump and zip up any .dmp files and attach them to your next post..

 

[icos]

Thanks for your answer but the folder "minidump" is empty.

If it can help, I attached a file with the id even

 

[Tews]

Im sorry, I cant speak French...enable driver verifier...

- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

 

[icos]

Thanks and sorry but driver verifier doesn't work as expected.
I'm going to wait the next bsod and check what's happened in the "minidump" folder.
Thanks

 

[icos]

DMP file

Ok, here come the dmp file after my last bsod !

I hope that's the right file ?

Thanks for help !

 

[cluberti]

Looks like the G.Data firewall packet filter driver has injected itself and caused a problem with NETIO parsing the packet it scanned. You need to do two things - one, update the G.Data PktIcpt driver if there is a new one available, and two, install this hotfix from Microsoft.

0: kd> kn
 # Child-SP          RetAddr           Call Site
00 fffff880`033af418 fffff800`0327dca9 nt!KeBugCheckEx
01 fffff880`033af420 fffff800`0327c920 nt!KiBugCheckDispatch+0x69
02 fffff880`033af560 fffff880`02e8c7a0 nt!KiPageFault+0x260
03 fffff880`033af6f0 fffff880`016046a6 tcpip! ?? ::FNODOBFM::`string'+0x56f4
04 fffff880`033af740 fffff880`0160235d NETIO!NetioDereferenceNetBufferList+0x86
05 fffff880`033af770 fffff880`02e60e26 NETIO!NetioDereferenceNetBufferListChain+0x2dd
06 fffff880`033af7f0 fffff880`02e5fb21 tcpip!IppReceiveHeaderBatch+0x3c7
07 fffff880`033af8d0 fffff880`02f37542 tcpip!IpFlcReceivePackets+0x651
08 fffff880`033afad0 fffff880`04340afa tcpip!IppInspectInjectReceive+0xf2
09 fffff880`033afb10 fffff880`070ad58d fwpkclnt!FwpsInjectTransportReceiveAsync0+0x256
0a fffff880`033afbc0 fffffa80`08b05880 PktIcpt+0x258d
0b fffff880`033afbc8 fffffa80`03fb5930 0xfffffa80`08b05880
0c fffff880`033afbd0 fffffa80`04414d00 0xfffffa80`03fb5930
0d fffff880`033afbd8 fffffa80`00000000 0xfffffa80`04414d00
0e fffff880`033afbe0 fffffa80`03fb0017 0xfffffa80`00000000
0f fffff880`033afbe8 00000000`00000001 0xfffffa80`03fb0017
10 fffff880`033afbf0 fffff880`0000000c 0x1
11 fffff880`033afbf8 fffff880`00000000 0xfffff880`0000000c
12 fffff880`033afc00 fffffa80`00000000 0xfffff880`00000000
13 fffff880`033afc08 fffff880`070ad318 0xfffffa80`00000000

0: kd> lmvm PktIcpt
start             end                 module name
fffff880`070ab000 fffff880`070be000   PktIcpt  T (no symbols)           
    Loaded symbol image file: PktIcpt.sys
    Image path: \??\C:\windows\system32\drivers\PktIcpt.sys
    Image name: PktIcpt.sys
    Timestamp:        Thu Aug 27 08:31:33 2009 (4A967CA5)
    CheckSum:         0001BFA1
    ImageSize:        00013000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[icos]

Ok, thanks a lot ! I uninstalled Gdata internet security, 'cause it's the last version of this soft (no new driver) and I reinstalled it .
The hotfix is also installed.
Now waiting for "no BSOD"
Thanks again !

 

[icos]

Hello

Unfortunately 2 more "BSOD" in 4 minutes !

DMP files attached.

Thanks

 

[icos]

Somebody can help me please ?

Thanks a lot !

 

[zigzag3143]

Somebody can help me please ?

Thanks a lot !

These appear to have been caused by PkIcpt.sys which is a part of GData antivirus. If you are running that you need to remove it and replace it with Microsoft Security Essentals.

Other antivirus and firewalls use PKT as well, like zone alarm

Let us know if that doesnt fix the problem

Ken



Analysis

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\New folder\090410-18267-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols;*http://msdl.microsoft.com/download/symbols ;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03215000 PsLoadedModuleList = 0xfffff800`03452e50
Debug session time: Sat Sep  4 14:43:32.547 2010 (GMT-4)
System Uptime: 0 days 3:52:41.139
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 0, fffff88003c9146c}

*** ERROR: Module load completed but symbols could not be loaded for tcpip.sys
Unable to load image \??\C:\windows\system32\drivers\PktIcpt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for PktIcpt.sys
*** ERROR: Module load completed but symbols could not be loaded for PktIcpt.sys
Probably caused by : NETIO.SYS ( NETIO!NetioDereferenceNetBufferList+86 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88003c9146c, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034bd0e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
tcpip+8d46c
fffff880`03c9146c 488b01          mov     rax,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff880033a1560 -- (.trap 0xfffff880033a1560)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800a7ae5e0 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa800a7ae5e1 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88003c9146c rsp=fffff880033a16f0 rbp=0000000000000000
 r8=fffffa800a7ae5e0  r9=00000000000000d0 r10=fffff80003400b80
r11=fffffa8008cb4310 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
tcpip+0x8d46c:
fffff880`03c9146c 488b01          mov     rax,qword ptr [rcx] ds:07ff:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003284ca9 to fffff80003285740

STACK_TEXT:  
fffff880`033a1418 fffff800`03284ca9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`033a1420 fffff800`03283920 : 00000000`00000000 fffffa80`09b2db10 00000000`00000000 00000000`e42d50d8 : nt!KiBugCheckDispatch+0x69
fffff880`033a1560 fffff880`03c9146c : fffffa80`09b2db10 fffff880`051ceb37 00000000`206c644d fffffa80`0891d5e0 : nt!KiPageFault+0x260
fffff880`033a16f0 fffff880`016046a6 : fffffa80`09b2db10 00000000`00000006 00000000`00000000 00000000`00000006 : tcpip+0x8d46c
fffff880`033a1740 fffff880`0160235d : 00000000`00000000 fffffa80`0a3ac0f0 00000000`00000000 fffff880`03c629b5 : NETIO!NetioDereferenceNetBufferList+0x86
fffff880`033a1770 fffff880`03c6307f : 00000000`00000006 00000000`00000000 fffff880`03d71bc8 fffffa80`09b2db10 : NETIO!NetioDereferenceNetBufferListChain+0x2dd
fffff880`033a17f0 fffff880`03c61d40 : 00000000`00000000 fffffa80`06bc6000 fffff880`03d6d9a0 00000000`0a7ae501 : tcpip+0x5f07f
fffff880`033a18d0 fffff880`03d2f712 : fffffa80`08543120 00000000`00000000 fffffa80`0a7ae501 fffff880`00000001 : tcpip+0x5dd40
fffff880`033a1ad0 fffff880`04209afa : fffffa80`0473ac02 fffffa80`0473ac80 00000000`00000002 00000000`00000000 : tcpip+0x12b712
fffff880`033a1b10 fffff880`051cb58d : fffffa80`08f22510 fffffa80`0a7ae5e0 fffffa80`0a9ddf00 00000000`00000000 : fwpkclnt!FwpsInjectTransportReceiveAsync0+0x256
fffff880`033a1bc0 fffffa80`08f22510 : fffffa80`0a7ae5e0 fffffa80`0a9ddf00 00000000`00000000 fffffa80`0a7a0002 : PktIcpt+0x258d
fffff880`033a1bc8 fffffa80`0a7ae5e0 : fffffa80`0a9ddf00 00000000`00000000 fffffa80`0a7a0002 fffffa80`00000001 : 0xfffffa80`08f22510
fffff880`033a1bd0 fffffa80`0a9ddf00 : 00000000`00000000 fffffa80`0a7a0002 fffffa80`00000001 fffff880`0000000c : 0xfffffa80`0a7ae5e0
fffff880`033a1bd8 00000000`00000000 : fffffa80`0a7a0002 fffffa80`00000001 fffff880`0000000c fffff880`00000000 : 0xfffffa80`0a9ddf00


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!NetioDereferenceNetBufferList+86
fffff880`016046a6 4885ff          test    rdi,rdi

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  NETIO!NetioDereferenceNetBufferList+86

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc18a

FAILURE_BUCKET_ID:  X64_0xD1_NETIO!NetioDereferenceNetBufferList+86

BUCKET_ID:  X64_0xD1_NETIO!NetioDereferenceNetBufferList+86

Followup: MachineOwner
---------

drivers needing upgrade

pcouffin.sys        fffff880`10085000    fffff880`10099380    0x00014380    0x457584a2    12/5/2006 10:39:30                        
ElbyCDFL.sys        fffff880`04e00000    fffff880`04e0e000    0x0000e000    0x4581c093    12/14/2006 17:22:27                        
regi.sys        fffff880`03e71000    fffff880`03e79000    0x00008000    0x462393ee    4/16/2007 11:19:10                        
tifsfilt.sys        fffff880`06b87000    fffff880`06b9e000    0x00017000    0x46d56889    8/29/2007 08:37:29                        
seehcri.sys        fffff880`04bee000    fffff880`04bfa000    0x0000c000    0x478488bf    1/9/2008 04:41:35                        
spldr.sys        fffff880`01b80000    fffff880`01b88000    0x00008000    0x4a0858bb    5/11/2009 12:56:27                        
amdxata.sys        fffff880`0131a000    fffff880`01325000    0x0000b000    0x4a12f2eb    5/19/2009 13:56:59                        
tosrfec.sys        fffff880`04e5e000    fffff880`04e67000    0x00009000    0x4a237c2d    6/1/2009 02:58:53                        
dvb7700all.sys        fffff880`06a10000    fffff880`06b00000    0x000f0000    0x4a309157    6/11/2009 01:08:39                        
TVALZFL.sys        fffff880`04e57000    fffff880`04e5e000    0x00007000    0x4a3b62f8    6/19/2009 06:05:44                        
pgeffect.sys        fffff880`06b4f000    fffff880`06b55e80    0x00006e80    0x4a3f481b    6/22/2009 05:00:11                        
tos_sps64.sys        fffff880`01953000    fffff880`019cd000    0x0007a000    0x4a41ba1d    6/24/2009 01:31:09                        
thpdrv.sys        fffff880`019cf000    fffff880`019db000    0x0000c000    0x4a4820d0    6/28/2009 22:02:56                        
Thpevm.SYS        fffff880`019cd000    fffff880`019cef80    0x00001f80    0x4a487829    6/29/2009 04:15:37                        
rimspe64.sys        fffff880`04a00000    fffff880`04a19000    0x00019000    0x4a4bf749    7/1/2009 19:54:49                        
rixdpe64.sys        fffff880`10d84000    fffff880`10dda000    0x00056000    0x4a4f2e74    7/4/2009 06:27:00

 

[icos]

Thank you !

 

[icos]

I don't no if it can change something but I use my pc with a fix ip, in my modem I use specific ports for utorrent and emule.
Do you think this could be the solution in my case : http://www.sevenforums.com/crashes-debugging/89108-random-bsod-windows-7-pro-x64.html

 

[icos]

I really don't understand in fact, it mean that I can't use gdata software anymore (in theory) ?
I use the same soft on two other laptop, one xp the other windows 7 32bit and no problems !
Is it a problem with antivirus and windows 7 64 bit ??
Thanks

 

[cluberti]

It may be - however, it's hard to say. Really, G.Data themselves would be the best to answer that question, as they've got access to source for that program and we would not.

 

[icos]

Thanks for your answer.
And what do you think about this solution ?http://www.sevenforums.com/crashes-debugging/89108-random-bsod-windows-7-pro-x64.html

 

[icos]

Well, what I did for the moment is to keep only GData antivirus without the firewall and use Comodo firewall , it mean no more "PkIcpt.sys". I hope the solution is ok ? I'll come back in a few days to tell you if there is no more "bsod" this way.
Thanks again ! Your forum is great !

 

[icos]

Hi
I really want to understand why I can't use the firewall included in gdata internet security and phone the gdata helpdesk.
First I bought my laptop with preinstalled os wish had macafee antivirus included, it seems that if the specific macafee uninstaller is not used rather than the normal windows uninstaller a lot of mcafee files stay everywhere in the pc.
Now that I have used this uninstaller, no more "bsod" since some days. I use the complete gdata suite again !
But I don't say that's the solution, it's to fast to be sure. If in one or two weeks everything is ok, than I can think that it was the problem. I'll come back to tell you.
For the moment I'm also waiting for gdata helpdesk wish analyse my dump file !
Again, sorry for my poor english, I hope it's possible to understand what I wrote !?

 

[icos]

Unfortunately a new "bsod", can you tell me if the problem still the same please ?

Thanks a lot !

 

[icos]

No one to read my dmp file please ?
Thanks