Need help with dump file
I have a dell inspiron 1545 64 w/ windows 7 64 bit OS. I am unable to read the minidump file so I used the app crash view and the details for the blue screen are below. I need to know if there is a fix for this error. Thanks.
Version=1
EventType=BlueScreen
EventTime=129453856123501472
ReportType=4
Consent=1
UploadTime=129453986108925681
ReportIdentifier=d86f9492-558b-11e0-8f47-a194fb93c69b
IntegratorReportIdentifier=032311-32526-01
Response.type=4
Response.AnalysisBucket=X64_0xD1_NETIO!NetioDereferenceNetBufferList+86
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=6.1.7601.2.1.0.768.3
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1033
UI[2]=C:\Windows\system32\wer.dll
UI[3]=Windows has recovered from an unexpected shutdown
UI[4]=Windows can check online for a solution to the problem the next time you go online.
UI[5]=&Check for solution
UI[6]=&Check later
UI[7]=Cancel
UI[8]=Windows has recovered from an unexpected shutdown
UI[9]=A problem caused Windows to stop working correctly. Windows will notify you if a solution is available.
UI[10]=Close
Sec[0].Key=BCCode
Sec[0].Value=d1
Sec[1].Key=BCP1
Sec[1].Value=0000000000000000
Sec[2].Key=BCP2
Sec[2].Value=0000000000000002
Sec[3].Key=BCP3
Sec[3].Value=0000000000000000
Sec[4].Key=BCP4
Sec[4].Value=FFFFF88001AAEF92
Sec[5].Key=OS Version
Sec[5].Value=6_1_7601
Sec[6].Key=Service Pack
Sec[6].Value=1_0
Sec[7].Key=Product
Sec[7].Value=768_1
State[0].Key=Transport.DoneStage1
State[0].Value=1
State[1].Key=CA
State[1].Value=1
State[2].Key=BLOB
State[2].Value=CHKSUM=A24CDEF70D419F0F3124ABC0BA0E0D18;BID=OCATAG;ID=d4518014-7c9f-4749-9105-6a43867f32c4;SUB=3//23//2011 5:03:35 PM
File[0].CabName=032311-32526-01.dmp
File[0].Path=032311-32526-01.dmp
File[0].Flags=851970
File[0].Type=2
File[0].Original.Path=C:\Windows\Minidump\032311-32526-01.dmp
File[1].CabName=sysdata.xml
File[1].Path=WER-66752-0.sysdata.xml
File[1].Flags=851970
File[1].Type=5
File[1].Original.Path=C:\Users\RLLOYD\AppData\Local\Temp\WER-66752-0.sysdata.xml
File[2].CabName=WERInternalMetadata.xml
File[2].Path=WER48B2.tmp.WERInternalMetadata.xml
File[2].Flags=589826
File[2].Type=5
File[2].Original.Path=C:\Users\RLLOYD\AppData\Local\Temp\WER48B2.tmp.WERInternalMetadata.xml
File[3].CabName=Report.cab
File[3].Path=Report.cab
File[3].Flags=196608
File[3].Type=7
File[3].Original.Path=Report.cab
FriendlyEventName=Shut down unexpectedly
ConsentKey=BlueScreen
AppName=Windows
AppPath=C:\Windows\System32\WerFault.exe
March 24th, 2011 7:32pm
To read the minidump, you can use Windbg and refer to this Microsoft article:
http://support.microsoft.com/kb/315263
You can also use Microsoft Skydrive to upload dump files. Once done, post a link here and I will try to debug them.
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Microsoft
Student Partner
Microsoft Certified Professional
Microsoft Certified Systems Administrator: Security
Microsoft Certified Systems Engineer: Security
Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Free Windows Admin Tool Kit Click here and download it now
March 24th, 2011 11:23pm
*******************************************************************************
*
*
* Bugcheck Analysis *
*
*
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88001941f92, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310e0e8
0000000000000000
CURRENT_IRQL: 2
FAULTING_IP:
tcpip! ?? ::FNODOBFM::`string'+5f94
fffff880`01941f92 488b01 mov rax,qword ptr [rcx]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: fffff88002b4a540 -- (.trap 0xfffff88002b4a540)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001941f92 rsp=fffff88002b4a6d0 rbp=0000000000000000
r8=0000000000000000 r9=00000000000000d0 r10=fffff80003050b80
r11=fffffa80092f7480 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
tcpip! ?? ::FNODOBFM::`string'+0x5f94:
fffff880`01941f92 488b01 mov rax,qword ptr [rcx] ds:0ea0:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002edcbe9 to fffff80002edd640
STACK_TEXT:
fffff880`02b4a3f8 fffff800`02edcbe9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`02b4a400 fffff800`02edb860 : 00000000`00000000 fffff880`01751a63 fffffa80`05df01a0 fffffa80`0953b030 : nt!KiBugCheckDispatch+0x69
fffff880`02b4a540 fffff880`01941f92 : fffffa80`0953b030 fffff880`0188ba3a fffff880`206c644d fffffa80`039fb560 : nt!KiPageFault+0x260
fffff880`02b4a6d0 fffff880`01788336 : fffffa80`0953b030 00000000`00000005 00000000`00000001 fffffa80`e0000001 : tcpip! ?? ::FNODOBFM::`string'+0x5f94
fffff880`02b4a720 fffff880`01787a92 : 00000000`00000000 fffffa80`039fb560 00000000`00000000 fffffa80`039fb560 : NETIO!NetioDereferenceNetBufferList+0x86
fffff880`02b4a750 fffff880`018f7986 : 00000000`00000000 fffffa80`042f9a01 fffff880`02b4a800 fffffa80`0434a000 : NETIO!NetioDereferenceNetBufferListChain+0x332
fffff880`02b4a820 fffff880`018eb30b : fffffa80`039fb560 fffff880`01a1b9a0 fffff880`01a1b9a0 00000000`00000000 : tcpip!IppCompleteAndFreePacketList+0xc6
fffff880`02b4a850 fffff880`019d81e2 : fffffa80`07841430 00000000`00000000 fffffa80`0bd1c601 00000000`0000016c : tcpip! ?? ::FNODOBFM::`string'+0x3265b
fffff880`02b4aa50 fffff880`01ab7af6 : fffffa80`059c8202 fffffa80`059c82b0 00000000`00000002 00000000`00000000 : tcpip!IppInspectInjectReceive+0xf2
fffff880`02b4aa90 fffff880`0188468e : fffffa80`07772ec0 fffffa80`0bd1c6c0 00000000`c0000000 fffff880`00000000 : fwpkclnt!FwpsInjectTransportReceiveAsync0+0x256
fffff880`02b4ab40 fffffa80`07772ec0 : fffffa80`0bd1c6c0 00000000`c0000000 fffff880`00000000 fffffa80`08a50002 : PctWfpFilter64+0xd68e
fffff880`02b4ab48 fffffa80`0bd1c6c0 : 00000000`c0000000 fffff880`00000000 fffffa80`08a50002 fffffa80`00000001 : 0xfffffa80`07772ec0
fffff880`02b4ab50 00000000`c0000000 : fffff880`00000000 fffffa80`08a50002 fffffa80`00000001 fffffa80`0000000b : 0xfffffa80`0bd1c6c0
fffff880`02b4ab58 fffff880`00000000 : fffffa80`08a50002 fffffa80`00000001 fffffa80`0000000b fffffa80`00000000 : 0xc0000000
fffff880`02b4ab60 fffffa80`08a50002 : fffffa80`00000001 fffffa80`0000000b fffffa80`00000000 fffffa80`00000000 : 0xfffff880`00000000
fffff880`02b4ab68 fffffa80`00000001 : fffffa80`0000000b fffffa80`00000000 fffffa80`00000000 fffff880`018841d0 : 0xfffffa80`08a50002
fffff880`02b4ab70 fffffa80`0000000b : fffffa80`00000000 fffffa80`00000000 fffff880`018841d0 fffffa80`0bd1c6c0 : 0xfffffa80`00000001
fffff880`02b4ab78 fffffa80`00000000 : fffffa80`00000000 fffff880`018841d0 fffffa80`0bd1c6c0 00000000`53636670 : 0xfffffa80`0000000b
fffff880`02b4ab80 fffffa80`00000000 : fffff880`018841d0 fffffa80`0bd1c6c0 00000000`53636670 fffffa80`039fb560 : 0xfffffa80`00000000
fffff880`02b4ab88 fffff880`018841d0 : fffffa80`0bd1c6c0 00000000`53636670 fffffa80`039fb560 fffff880`01893338 : 0xfffffa80`00000000
fffff880`02b4ab90 fffffa80`0bd1c6c0 : 00000000`53636670 fffffa80`039fb560 fffff880`01893338 00000000`00000000 : PctWfpFilter64+0xd1d0
fffff880`02b4ab98 00000000`53636670 : fffffa80`039fb560 fffff880`01893338 00000000`00000000 00000000`00000000 : 0xfffffa80`0bd1c6c0
fffff880`02b4aba0 fffffa80`039fb560 : fffff880`01893338 00000000`00000000 00000000`00000000 00000000`53636670 : 0x53636670
fffff880`02b4aba8 fffff880`01893338 : 00000000`00000000 00000000`00000000 00000000`53636670 fffffa80`05cd6790 : 0xfffffa80`039fb560
fffff880`02b4abb0 00000000`00000000 : 00000000`00000000 00000000`53636670 fffffa80`05cd6790 fffff880`01896128 : PctWfpFilter64+0x1c338
STACK_COMMAND: kb
FOLLOWUP_IP:
NETIO!NetioDereferenceNetBufferList+86
fffff880`01788336 4885ff test rdi,rdi
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: NETIO!NetioDereferenceNetBufferList+86
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: NETIO
IMAGE_NAME: NETIO.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce79381
FAILURE_BUCKET_ID: X64_0xD1_NETIO!NetioDereferenceNetBufferList+86
BUCKET_ID: X64_0xD1_NETIO!NetioDereferenceNetBufferList+86
Followup: MachineOwner
---------
Try this Microsoft hotfix and check if it solves the problem.
http://support.microsoft.com/kb/979278/en
Do you use ZoneAlarm? if yes update the network card drivers and try this hotfix (or install the Sp1 which includes the fix):
Stop error message when you run an application that transfers
data by using the UDP protocol in Windows Server 2008 R2 or in Windows 7: "STOP 0x0000007F"
http://support.microsoft.com/kb/981180/en-us
If this doesn't solve it, uninstall ZoneAlarm.
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Microsoft
Student Partner
Microsoft Certified Professional
Microsoft Certified Systems Administrator: Security
Microsoft Certified Systems Engineer: Security
Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
March 27th, 2011 12:11pm