[kkurenaii]

I experienced auto shut down which followed by a bluescreen below.
I have sent it to the maker (Toshiba) for a repair. They said there was a problem with my mainboard and I paid a large sum of money to replace it just to get it back and experience the same problem. (I just got it back today and after 10-minute use, it shut down.)
Would appreciate expert help on this topic. I started a new post because I saw somebody's post with a similar problem but when someone else asked further question, they were asked to start their own post.
-----------------------------------------------------
A problem has been detected and windows has been shut down to prevent damage to your computer.

DRIVER_IRQL_NOT_LESS_OR_EQUAL

If this is the first time you've seen this error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart
you computer, press F8 to select Advanced startup options, and then select safe mode.

Technical Information:
*** STOP: 0x000000D1 (0x00040019,0x00000002,0x00000000,0x898E6F5B)
*** tcpip.sys - Address 898E6F5B base at 8989F000, Datestamp 478ad415

Collecting data for carsh dump ...
Initializing disk for crash dump ...
Beginning dump of physical memory ...
Dumping physical memory to disk: 100
Physical memory dump complete.
Cantact your system admin or technical support group for further assistance.
------------------------------------------------------
Computer Spec:
Toshiba Dynabook CX/47A (Notebook)
Bought in April 2007
Vista Home Basic (already updated service pack1)
Intel Core 2 Duo
RAM 1G

[Rollin' Rog]

Are they all the same?

The tcpip.sys drive involved suggests a networking or firewall related issue.

Upload any other recent minidumps and post a HijackThis scanlog as well.

1 > create a new folder on the desktop and call it "dumpcheck" or whatever you like
2 > navigate to %systemroot%\minidump and copy the last few minidump files to that folder.

%systemroot%\minidump

is normally

c:\windows\minidump

. They are numbered by date. You can paste that address in address bar to get there.
3 > close the folder and right click on it and select Send to Compressed (zipped) Folder.
4 > use the "manage attachments" in the "advanced" reply window to upload that zip file here as an attachment.


Download and install HijackThis. Run it and select "do a system scan and save the log file". Then copy/paste the contents of the log to a reply

http://www.trendsecure.com/portal/en...ols/hijackthis

[kkurenaii]

Hi,
Thank you so much for your reply.
The message on the bluescreen was sometimes without the "tcpip.sys" line.
Here is the scan result. What shall I do next?
--------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:16:05, on 2008/06/15
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal
Running processes:
C:\Windows\Explorer.EXE
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Users\Eibby\Desktop\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\IDM\QUICKF~1\PlugIns\IEHelp.dll
O3 - Toolbar: The翻訳ツールバー - {FF278623-9AA4-489c-84CE-CF14D90CC70C} - c:\Program Files\TTI_V11LE\def_bar.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [IMJPMIG12.0] C:\Program Files\Common Files\Microsoft Shared\IME12\IMEJP\IMJPRMZB.EXE /RmZombie
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: Microsoft Excel にエクスポート(&X) - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun の Java コンソール - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://dynabook.fresheye.com (HKLM)
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
--
End of file - 5864 bytes

[Rollin' Rog]

All the ones I looked at return this (just basic data):

BugCheck D1, {6b495366, 2, 0, 89c73f5b}

Unable to load image \SystemRoot\system32\DRIVERS\vsdatant.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for vsdatant.sys
*** ERROR: Module load completed but symbols could not be loaded for vsdatant.sys

Probably caused by : fwpkclnt.sys (

fwpkclnt!FwpsInjectTransportSendAsync0+220 )

The faulting module actually belongs to the Windows Firewall client -- but as you can see from this Google search -- the "real" culprit is probably ZoneAlarm >>

http://www.google.com/search?hl=en&c...ys&btnG=Search

I would uninstall ZA for a test period -- and see if there is a later version available if you really want it.

Personally I stick with the Windows Firewall and never have any problems.

[kkurenaii]

Thank you Rollin' Rog.
I will uninstall ZA and see if the auto-shut down comes back.
If problem continues, will formating the computer help?

[Rollin' Rog]

I would not recommend a format; post any new minidumps you get.

We can also try "clean boot" troubleshooting if necessary.

General instructions for that below:

CLEAN BOOT TROUBLESHOOTING technique

First, restart in Safe Mode if necessary -- (tap the f8 key promptly on startup and choose the Safe Mode option from the boot menu) or Normal mode

Then:

Run msconfig and select the "Services" tab. Check "Hide Microsoft Services" and then disable the rest. Also uncheck "load startup group" on the general page.

See this link for detailed information:


http://support.microsoft.com/kb/929135 << for Vista, but applies equally to XP, and better written.

Now restart and test the issue at hand

If no problems, run msconfig and recheck half the disabled items on the Services tab. Test again. If the problem recurs, UNcheck half the items you just checked to narrow down the culprit.

If the problem didn't occur, check the other half, so all the Services are enabled -- proceed to do this on the startup tab as well.

Get the idea? You want to isolate the problem to a specific startup if possible.

Note: if you already have items unchecked under msconfig > startups and are in “selective” startup mode – you should note what these are before beginning. They will need to be de-selected again.

[kkurenaii]

I have uninstalled ZoneAlarm and did the cleanboot (up to step 2 in Microsoft support). Now waiting to see if problem occurs again. Will post here if any update.

Thank you.

[Rollin' Rog]

I would test just with ZA uninstalled for now -- and do the clean boot only if you get a BSOD with ZA uninstalled -- Keep in mind that you have no antivirus support in clean boot -- so use extra caution if you want to test all installed software at once.

[Rich-M]

Wow I have been reading more and more such issues with Zone Alarm. Do you think it is really possible they replace a motherboard because of a software issue? And how could they not have tested it? I guess it is possibhle since this does not do it all the time.

[kkurenaii]

Rollin' Rog: Hi. I have completed the clean boot. The computer did not auto-shut down (I turned it on for about half an hour each session). Seems ok at the moment. Now I'm back to running on Normal Startup option. But it is difficult to determine whether the problem returns. Cuz sometimes it shuts down after a few hours. But after all it may be because of ZA. I have been using ZA a year now. There was no problem until service pack update. Anyway, will see whether problem comes back after a few hours. Many thanks.

Rich-M: Thank you for your comment. I experienced around 6 shut downs before I sent it in for repair. Probably sudden shut downs had adverse effect on mainboard? But it was just 6 times?? No idea how they go about repairing and testing. I tried turning it on before bringing home but that was a few minutes and without internet connection. I felt frustrated with Toshiba since this is the 2nd time in one year it got repaired.

[kkurenaii]

There has been no problem these few days (^ v ^)
I will mark this issue solved. Thank you everyone for your kind support!

[Rollin' Rog]