DFS_FILE_SYSTEM error

Citrus · May 28, 2010

My computer is randomly getting the same blue screen error from DFS_FILE_SYSTEM at 0x00000082. What is causing this and how can I fix it.

Here is the information I got with WinDBG from the latest minidump file:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [F:\Mini052810-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_qfe.100216-2016
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b0c0
Debug session time: Fri May 28 09:20:34.060 2010 (UTC - 4:00)
System Uptime: 0 days 0:02:34.546
Loading Kernel Symbols
...............................................................
..............................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 82, {f83572e0, f83514c2, 0, 0}
*** WARNING: Unable to verify timestamp for xlnfsXP.sys
*** ERROR: Module load completed but symbols could not be loaded for xlnfsXP.sys
Probably caused by : Mup.sys ( Mup!DfsBugCheck+2a )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DFS_FILE_SYSTEM (82)
Arguments:
Arg1: f83572e0
Arg2: f83514c2
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------

CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x82
PROCESS_NAME: userinit.exe
LAST_CONTROL_TRANSFER: from f835729c to 805337c6
STACK_TEXT:
ee93d128 f835729c 00000082 f83572e0 f83514c2 nt!KeBugCheckEx+0x1b
ee93d14c f83572e0 00000000 00000000 ee93d9ac Mup!DfsBugCheck+0x2a
ee93d15c f83514c2 8206bd00 c0000005 ee93d18c Mup!DfsExceptionFilter+0x3f
ee93d16c 804e2501 ee93d194 00000000 ee93d194 Mup!DfsFsdCreate+0xce
ee93d194 804db49a ee93d640 ee93d99c ee93d33c nt!_except_handler3+0x61
ee93d1b8 804db46b ee93d640 ee93d99c ee93d33c nt!ExecuteHandler2+0x26
ee93d268 8050a876 ee93d640 ee93d33c 00707558 nt!ExecuteHandler+0x24
ee93d624 804df235 ee93d640 00000000 ee93d694 nt!KiDispatchException+0x13e
ee93d68c 804df1e6 00707574 ef43f69b badb0d00 nt!CommonDispatchException+0x4d
ee93d694 ef43f69b badb0d00 00000000 73617264 nt!KiExceptionExit+0x18a
WARNING: Stack unwind information not available. Following frames may be wrong.
ee93d698 badb0d00 00000000 73617264 2e697468 xlnfsXP+0x269b
ee93d69c 00000000 73617264 2e697468 5c6d6f63 0xbadb0d00

STACK_COMMAND: kb
FOLLOWUP_IP:
Mup!DfsBugCheck+2a
f835729c 90 nop
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: Mup!DfsBugCheck+2a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Mup
IMAGE_NAME: Mup.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 41107ef8
FAILURE_BUCKET_ID: 0x82_Mup!DfsBugCheck+2a
BUCKET_ID: 0x82_Mup!DfsBugCheck+2a
Followup: MachineOwner
---------

usasma · May 28, 2010

This is an XP system - as such it's not appropriate for these forums. Please post elsewhere if you experience further problems or need more help.

Although the memory dumps blame mup.sys as the cause - it's a part of the Windows operating system, and as such it's not likely to be at fault.

Reading further down in the stack text we find xlnfsXP.sys. As it's the only 3rd party driver in the stack, it's the most likely to be at fault (and it being from 2005 increases the likelihood).

Please search your computer for xlnfsXP. Please submit those files to this free antivirus scanner: Jotti's malware scan There isn't much information on this file on the web, so I'm suspicious that this could be a virus inspection.

Then right click on it, select Properties, and then select the Details tab. That may give you information that may point to the manufacturer (File description and Product Name are the most common locations for this info). FYI - there's no information about the owner/maker of this driver when using the LMVM command in the Windows Debugging Tools.

Once all that's done, either remove or update the xlnfsXP.sys driver.
Also, it's strongly advised that you update to Service Pack 3 through the Windows Update website.

Then, please remove or update these older drivers that were loaded at the time of the crash (this is a canned speech for Windows Vista/7 - you may not find updated drivers for all the one's listed). Don't use Windows Update or the Update drivers function of Device Manager.
Please use the following instructions to locate the most currently available drivers to replace the one's that you uninstall OR remove:

How To Find Drivers:
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).

- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: http://www.carrona.org/drvrdown.html

Here's the older drivers. Please pay particular attention to any dated 2007 or earlier:

Code:

[FONT=lucida console]
f8a74000 f8a75120   aeaudio  aeaudio.sys  Mon Apr 01 10:39:14 2002 (3CA87112)
f8b21000 f8b21c00   audstub  audstub.sys  Fri Aug 17 16:59:40 2001 (3B7D85BC)
f8bb2000 f8bb2860   BANTExt  BANTExt.sys  Wed May 27 22:43:29 1998 (356CCF51)
f8678000 f8687900   Cdfs     Cdfs.SYS     Wed Aug 04 02:14:09 2004 (41107EB1)
f87c8000 f87cf1c0   cercsr6  cercsr6.sys  Wed Dec 08 18:31:10 2004 (41B78EBE)
f8493000 f84b8700   dmio     dmio.sys     Wed Aug 04 02:07:13 2004 (41107D11)
f8a3e000 f8a3f700   dmload   dmload.sys   Fri Aug 17 16:58:15 2001 (3B7D8567)
f8b3d000 f8b3dd00   dxgthk   dxgthk.sys   Fri Aug 17 16:53:12 2001 (3B7D8438)
f814f000 f8176c00   e100b325 e100b325.sys Mon Jun 13 16:58:01 2005 (42ADF359)
ef939000 ef997000   eeCtrl   eeCtrl.sys   Fri May 21 17:44:53 2010 (4BF6FED5)
ef91c000 ef939000   EraserUtilRebootDrv EraserUtilRebootDrv.sys Fri May 21 17:44:53 2010 (4BF6FED5)
f8658000 f8660880   Fips     Fips.SYS     Fri Aug 17 21:31:49 2001 (3B7DC585)
f8443000 f8462780   fltMgr   fltMgr.sys   Mon Aug 21 05:14:57 2006 (44E97991)
806ed000 8070d380   hal      halaacpi.dll Wed Aug 04 01:59:05 2004 (41107B29)
bfa3b000 bfb1d000   ialmdd5  ialmdd5.DLL  Tue Sep 20 13:59:53 2005 (43304E19)
bfa06000 bfa3a0a0   ialmdev5 ialmdev5.DLL Tue Sep 20 13:52:20 2005 (43304C54)
bf9e4000 bfa06000   ialmdnt5 ialmdnt5.dll Tue Sep 20 13:52:31 2005 (43304C5F)
f81ae000 f82ebec0   ialmnt5  ialmnt5.sys  Tue Sep 20 14:00:52 2005 (43304E54)
bf9d6000 bf9e4000   ialmrnt5 ialmrnt5.dll Tue Sep 20 13:52:37 2005 (43304C65)
f86e8000 f86f2380   imapi    imapi.sys    Wed Aug 04 02:00:12 2004 (41107B6C)
efae4000 efb04f00   ipnat    ipnat.sys    Wed Sep 29 18:28:36 2004 (415B3714)
efb8b000 efb9d400   ipsec    ipsec.sys    Wed Aug 04 02:14:27 2004 (41107EC3)
f8538000 f8540c00   isapnp   isapnp.sys   Fri Aug 17 16:58:01 2001 (3B7D8559)
eef47000 eef71180   kmixer   kmixer.sys   Wed Jun 14 04:47:45 2006 (448FCD31)
f841a000 f8430980   KSecDD   KSecDD.sys   Mon Jun 22 07:35:42 2009 (4A3F6C8E)
f8a82000 f8a83080   mnmdd    mnmdd.SYS    Fri Aug 17 16:57:28 2001 (3B7D8538)
f8548000 f8552500   MountMgr MountMgr.sys Wed Aug 04 01:58:29 2004 (41107B05)
f8758000 f8760900   msgpc    msgpc.sys    Wed Aug 04 02:04:11 2004 (41107C5B)
f8345000 f835f580   Mup      Mup.sys      Wed Aug 04 02:15:20 2004 (41107EF8)
efbbe000 efbd1400   NAVENG   NAVENG.SYS   Wed May 05 01:24:13 2010 (4BE100FD)
efbf7000 efd3e580   NAVEX15  NAVEX15.SYS  Wed May 05 01:31:05 2010 (4BE10299)
f8360000 f838ca80   NDIS     NDIS.sys     Wed Aug 04 02:14:27 2004 (41107EC3)
804d7000 806ece80   nt       ntoskrnl.exe Tue Feb 16 12:37:39 2010 (4B7AD7E3)
f89e4000 f89e7240   OMCI     OMCI.SYS     Wed Aug 22 12:42:57 2001 (3B83E111)
f87c0000 f87c4900   PartMgr  PartMgr.sys  Fri Aug 17 21:32:23 2001 (3B7DC5A7)
f8aea000 f8aeba80   ParVdm   ParVdm.SYS   Fri Aug 17 16:49:49 2001 (3B7D836D)
f8b00000 f8b00d00   PCIIde   PCIIde.sys   Fri Aug 17 16:51:49 2001 (3B7D83E5)
f803e000 f804ee00   psched   psched.sys   Wed Aug 04 02:04:16 2004 (41107C60)
f8868000 f886c580   ptilink  ptilink.sys  Fri Aug 17 16:49:53 2001 (3B7D8371)
f8870000 f8874080   raspti   raspti.sys   Fri Aug 17 16:55:32 2001 (3B7D84C4)
f8708000 f8716080   redbook  redbook.sys  Wed Aug 04 01:59:34 2004 (41107B46)
f808a000 f8117d80   smwdm    smwdm.sys    Tue May 06 09:14:31 2003 (3EB7B537)
efa31000 efa9a000   SPBBCDrv SPBBCDrv.sys Wed May 14 22:14:28 2008 (482B9C84)
f8431000 f8442f00   sr       sr.sys       Wed Aug 04 02:06:22 2004 (41107CDE)
efd3f000 efd89000   SRTSP    SRTSP.SYS    Wed Oct 08 17:00:38 2008 (48ED1F76)
f8618000 f8621100   SRTSPX   SRTSPX.SYS   Wed Oct 08 17:02:46 2008 (48ED1FF6)
efbd2000 efbf7000   SYMEVENT SYMEVENT.SYS Mon Jan 14 18:29:24 2008 (478BF054)
f8928000 f892d200   SYMREDRV SYMREDRV.SYS Tue Aug 19 16:18:20 2008 (48AB2A8C)
ef171000 ef17fd80   sysaudio sysaudio.sys Wed Aug 04 02:15:54 2004 (41107F1A)
f7f79000 f7fd1e80   update   update.sys   Mon Apr 23 06:32:54 2007 (462C8B56)
f8558000 f8564c80   VolSnap  VolSnap.sys  Wed Aug 04 02:00:14 2004 (41107B6E)
ef05d000 ef071400   wdmaud   wdmaud.sys   Wed Jun 14 05:00:44 2006 (448FD03C)
ef43d000 ef453b80   xlnfsXP  xlnfsXP.sys  Tue May 10 19:30:23 2005 (4281440F)
[/FONT]

Here's a summary of the BSOD's:

Code:

Built by: 2600.[COLOR=Red]xpsp_sp2[/COLOR]_qfe.100216-2016
Debug session time: Fri May 28 09:20:34.060 2010 (GMT-4)
System Uptime: 0 days 0:02:34.546
BugCheck 82, {f83572e0, f83514c2, 0, 0}
*** WARNING: Unable to verify timestamp for xlnfsXP.sys
*** ERROR: Module load completed but symbols could not be loaded for xlnfsXP.sys
Probably caused by : Mup.sys ( Mup!DfsBugCheck+2a )
BUGCHECK_STR:  0x82
PROCESS_NAME:  userinit.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 2600.[COLOR=Red]xpsp_sp2[/COLOR]_qfe.100216-2016
Debug session time: Fri May 28 09:05:50.883 2010 (GMT-4)
System Uptime: 0 days 0:02:21.437
BugCheck 82, {f83572e0, f83514c2, 0, 0}
*** WARNING: Unable to verify timestamp for xlnfsXP.sys
*** ERROR: Module load completed but symbols could not be loaded for xlnfsXP.sys
Probably caused by : Mup.sys ( Mup!DfsBugCheck+2a )
BUGCHECK_STR:  0x82
PROCESS_NAME:  userinit.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 2600.[COLOR=Red]xpsp_sp2[/COLOR]_qfe.100216-2016
Debug session time: Mon May 17 10:21:32.471 2010 (GMT-4)
System Uptime: 0 days 0:02:20.000
BugCheck 82, {f83572e0, f83514c2, 0, 0}
*** WARNING: Unable to verify timestamp for xlnfsXP.sys
*** ERROR: Module load completed but symbols could not be loaded for xlnfsXP.sys
Probably caused by : Mup.sys ( Mup!DfsBugCheck+2a )
BUGCHECK_STR:  0x82
PROCESS_NAME:  userinit.exe

DFS_FILE_SYSTEM error

Citrus

New member

My Computer

usasma

Mr. Cranky Pants

My Computer