1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

BSOD. afd.sys - 0x000000d1

Discussion in 'Windows 7' started by ludda, Feb 13, 2013.

Thread Status:
Not open for further replies.
Advertisement
  1. ludda

    ludda Thread Starter

    Joined:
    Feb 13, 2013
    Messages:
    6
    Hello TSG,

    I've attached a dump file of the BSOD. I'm pretty sure it has to do with an external USB network adaptor but these adaptors have been work fine with many client end computers. I want to find out exactly what is causing the problem. I have a feeling it might have to do with Mcafee..
     

    Attached Files:

  2. kanaitpro

    kanaitpro Account Closed

    Joined:
    Feb 13, 2013
    Messages:
    493
    you should try an application called bluescreen view. we had it at work, and you just paste the mini dump there and it analyzes it for you. you'll forgive my trepidation in downloading a zip file from a forum and opening it i hope. shouldn't be too hard to find though, and i don't remember if it was freeware or not.
     
  3. rainforest123

    rainforest123

    Joined:
    Dec 28, 2004
    Messages:
    8,256
    ludda:
    Hello & Welcome to TechGuy.org .

    If you would be so kind as to go to C:\windows\minidump and copy the 3 most recent files to a folder, then .zip the folder & attach it to a reply, that would be really helpful.

    I have used bluescreen but the full minidump file provides information not always supplied with the bluescreen output.

    When did the computer last work well? When did the problem begin? Sometimes the exact date is important.

    What changed; a hardware or software installation or removal; an update to W7 [ check your W7 update history ] or update to your anti malware or other antimalware program / programs ]; an update to Java or an Adobe program for example?

    Please run this forum's system info utility & post the results in your next reply.
    http://library.techguy.org/wiki/TSG_Valuable_links

    Also, please provide the brand, model & model # of your computer if applicable.

    BlueScreen View was freeware, the last time I checked; edit < end edit 30 days ago.

    RF123
     
  4. ludda

    ludda Thread Starter

    Joined:
    Feb 13, 2013
    Messages:
    6
    Hi RF123,

    Thanks for your reply. The situation is quite difficult, I work in an business environment with different working specs with still the same BSOD.

    I don't think it will have anything to do with the brand or model since this is happening across the whole site with 2 different laptop builds, HP and Dell. I've already ran the BlueScreen view and have identified which .dll files are caused the BSOD. I'm finding hard to understand is that they machines previously worked and did not BSOD. The only update that I can think of which might have caused the issue is McAfee.

    So I've already found the issue but I want to solve the problem. These USB network adaptors are used by quite a few people. I think the issue might be to do with Mcafee denying part of the memory. Sorry I don't have anymore dumpfiles.

    OS- Win732bit Enterprise - 4GB RAM -
    McAfee - Enterprise 8.8 Dat - 6986
    Dlink - Ethernet USB2.0 Adapter DUB-E100 - H/W Ver: B1

    Bluescreen view output-
    021313-28672-01.dmp
    Crash Time:13/02/2013 10:02:15 AM
    Bug Chedk String: DRIVER_IRQL_NOT_LESS_OR_EQUAL
    Bug Check Code: 0x000000d1
    Parameter 1: 0x00000004
    Parameter 2: 0x00000002
    Parameter 3: 0x00000000
    Parameter 4: 0xc9da0493
    Cased By Driver: afd.sys
    Caused by address: afd.sys+4493
    Processor: 32-bit
    Crash address: ntkrnlpa.exe+44f5b
    Stack address 1: afd.sys+4493
    Stack address 2: afd.sys+210de
    Stack address 3: afd.sys+4d2d
    Dump File Size: 161,784


    ==================================================
    Filename : afd.sys
    Address In Stack : afd.sys+4493
    From Address : 0xc9d9c000
    To Address : 0xc9df6000
    Size : 0x0005a000
    Time Stamp : 0x4db4ddf9
    Time String : 25/04/2011 1:35:37 PM
    Product Name :
    File Description :
    File Version :
    Company :
    Full Path :
    ==================================================
    ==================================================
    Filename : halmacpi.dll
    Address In Stack : halmacpi.dll+5ba9
    From Address : 0xe2e1f000
    To Address : 0xe2e56000
    Size : 0x00037000
    Time Stamp : 0x4a5bbf07
    Time String : 14/07/2009 10:11:03 AM
    Product Name :
    File Description :
    File Version :
    Company :
    Full Path :
    ==================================================
    ==================================================
    Filename : ntkrnlpa.exe
    Address In Stack : ntkrnlpa.exe+7ef8a
    From Address : 0xe2e56000
    To Address : 0xe326a000
    Size : 0x00414000
    Time Stamp : 0x503f8c6b
    Time String : 31/08/2012 2:53:15 AM
    Product Name :
    File Description :
    File Version :
    Company :
    Full Path :
    ==================================================
    ==================================================
    Filename : tcpip.sys
    Address In Stack : tcpip.sys+f5178
    From Address : 0xca602000
    To Address : 0xca74c000
    Size : 0x0014a000
    Time Stamp : 0x4f756aff
    Time String : 30/03/2012 7:12:47 PM
    Product Name :
    File Description :
    File Version :
    Company :
    Full Path :
    ==================================================
     
  5. rainforest123

    rainforest123

    Joined:
    Dec 28, 2004
    Messages:
    8,256
    Your choice. Sometimes hardware is involved. The W7 version is frequently important.

    Is that BlueScreen output from a single .dmp? If so, run ram diags for a minimum or 8 hours, or until an error appears.

    Thanks, ludda, for the .dmp. I'll analyze it, or some other forum member will analyze it.

    http://www.carrona.org/hwdiag.html

    RF123
     
  6. rainforest123

    rainforest123

    Joined:
    Dec 28, 2004
    Messages:
    8,256
    Is this the computer on which the BSODs appear?
    OS- Win732bit Enterprise - 4GB RAM -
    McAfee - Enterprise 8.8 Dat - 6986
    Dlink - Ethernet USB2.0 Adapter DUB-E100 - H/W Ver: B1

    If not, please provide the corresponding info for the computer on which the BSOD appears.

    What is the computer doing when the BSOD appears?

    You could uninstall McAfee, as a test.
    If you do, run the McAfee removal tool after using the integrated McAfee program uninstaller
    Shut down
    run mcafee remover; shut downa

    repeat run mcafee remover; shut down

    RF123
     
  7. kanaitpro

    kanaitpro Account Closed

    Joined:
    Feb 13, 2013
    Messages:
    493
    have you looked at some other comuters which didn't blue screen? if they have the same dll files, try to copy those to an affected box and see what happens. if the files are the same, i would use somethng like karens hash tool to see if they are identical. i've had problems like this in one of the schools i used to work in and i know what you mean about solving it. one piece of advice: don't spend too much time on it, sometimes it really does take a reinstall to fix it. i used to think that was admitting defeat, it isn't.
     
  8. rainforest123

    rainforest123

    Joined:
    Dec 28, 2004
    Messages:
    8,256
    kanaitpro:
    Interestng approach to copy the files. I am not criticizing it.

    I think it is important, when copying files from 1 computer to another computer, that both computers have the same version of W7 installed.

    RF123
     
  9. kanaitpro

    kanaitpro Account Closed

    Joined:
    Feb 13, 2013
    Messages:
    493
    rainforest123:
    you can criticize if you like, i'm rather thick-skinned and always open to any kind of debate, it's a learning experience. i like this site, and have been trying to keep my tech skills sharp during my time of unemployment. and i like helping others. if you see anything that is not how you may do things, please let me know. we may all learn something. i feel learning is very vital in the it field.
    in the case of the op, if i had done what he did and found the source of the error, that's how i would approach the troubleshooting, trying to find the difference. the very important thing is to only work on one at a time. and i did forget to mention to save a copy of the original dll file, in case it causes worse problems.
     
  10. ludda

    ludda Thread Starter

    Joined:
    Feb 13, 2013
    Messages:
    6
    I wish it was that simple, I cannot force a replicated BSOD since users report it happens inconsistently but only when copying over the network with these USB adaptors. McAfee is also apart of our policy and cannot be removed for a long period of time. I will try this method though and keep you posted!
     
  11. ludda

    ludda Thread Starter

    Joined:
    Feb 13, 2013
    Messages:
    6
    I still find it troubling to work out that the issue wasn't happening before, and now suddenly it's happening on quite a few machines. I don't really want to touch the .dll files as yet, I'm going to have a look at the recent installations and program updates, to work out what has changed.

    Does anyone know how I can view the active/live RAM entries while windows in running? with a possible file path location also?
     
  12. rainforest123

    rainforest123

    Joined:
    Dec 28, 2004
    Messages:
    8,256
    Do the BSODs appear on a server or on a client?
    Does it happen when the file is copied to the USB drive?

    Does it happen when a file is copied from the USB drive?

    What happens if the file is copied to the HDD?

    What type of file; .txt; .jpg; .mp3?

    What size file? Is the file size greater than the MB / GB of ram on the computer [ server or client ]?

    RF123
     
  13. ludda

    ludda Thread Starter

    Joined:
    Feb 13, 2013
    Messages:
    6
    Hi Rain,

    Sorry, it's a USB ethernet adaptor.
    Dlink - Ethernet USB2.0 Adapter DUB-E100 - H/W Ver: B1

    And it is a client. Users say the it happens when copying large data amounts.
     
  14. rainforest123

    rainforest123

    Joined:
    Dec 28, 2004
    Messages:
    8,256
    To or from the client?

    USB 2.0 or USB 3.0?

    Does the amount of free space on the client matter?

    Are the client computer specs these?

    Is this the device?
    http://www.dlink.com/us/en/home-sol...b-e100-high-speed-usb-2-fast-ethernet-adapter is not a HDD.

    I suggest clean boot troubleshooting.
    http://support.microsoft.com/kb/929135

    Edit
    I would start by booting to safe mode with networking. Does the issue occur when copying large amounts [ #GB or # of files ].

    Please try to re-produce the error. If the error can not be re-produced using S M w/ N, create a system restore point, use the system config utility & logically disable items.
    My method involves disabling all non Microsoft services; & all startup items.
    If no problem, enable a specific manufacturer's services & startup items. I would start with McAfee, since the mini dump points to a McAfee file.


    RF123
     
  15. ludda

    ludda Thread Starter

    Joined:
    Feb 13, 2013
    Messages:
    6
    Hi Rain,

    I downloaded and ran an !analyze -v

    output -
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: ce81f9b3, The address that the exception occurred at
    Arg3: e79e4a14, Trap Frame
    Arg4: 00000000
    Debugging Details:
    ------------------

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    FAULTING_IP:
    afd!AfdTLReleaseIndications+20
    ce81f9b3 8b4804 mov ecx,dword ptr [eax+4]
    TRAP_FRAME: e79e4a14 -- (.trap 0xffffffffe79e4a14)
    ErrCode = 00000000
    eax=00000000 ebx=e79e4ac0 ecx=00000000 edx=e79e4a8c esi=c30ca138 edi=e79e4a98
    eip=ce81f9b3 esp=e79e4a88 ebp=e79e4a98 iopl=0 nv up ei pl zr na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
    afd!AfdTLReleaseIndications+0x20:
    ce81f9b3 8b4804 mov ecx,dword ptr [eax+4] ds:0023:00000004=????????
    Resetting default scope
    CUSTOMER_CRASH_COUNT: 1
    DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
    BUGCHECK_STR: 0x8E
    PROCESS_NAME: ntaskldr.exe
    CURRENT_IRQL: 0
    LAST_CONTROL_TRANSFER: from ce83d0de to ce81f9b3
    STACK_TEXT:
    e79e4a98 ce83d0de 00000000 c7837dc0 c7aa5898 afd!AfdTLReleaseIndications+0x20
    e79e4ac0 ce840d71 c30ca138 c7874c48 c7aa5898 afd!AfdReturnBuffer+0xd9
    e79e4ae4 ce82f22d c7aa5898 e6a0e440 e6a0e440 afd!AfdCloseConnection+0x10a
    e79e4af8 ce83f21d e6a0e440 c4e419a0 e79e4b20 afd!AfdCloseCore+0x3a
    e79e4b08 e3243c29 c4e419a0 e6a0e440 00000800 afd!AfdDispatch+0x8d
    e79e4b20 e343faff c25c3838 df598310 00000000 nt!IofCallDriver+0x63
    e79e4b64 e34306f9 df598328 df598328 df598310 nt!IopDeleteFile+0x10c
    e79e4b7c e32854c0 00000000 c322ad48 df598310 nt!ObpRemoveObjectRoutine+0x59
    e79e4b90 e3285430 df598328 e34534a6 ebffe740 nt!ObfDereferenceObjectWithTag+0x88
    e79e4b98 e34534a6 ebffe740 c322ad48 0000034c nt!ObfDereferenceObject+0xd
    e79e4bdc e34531cc ebffe740 d973e698 c7874c48 nt!ObpCloseHandleTableEntry+0x21d
    e79e4c0c e3453566 c7874c48 c322ad01 03d6a490 nt!ObpCloseHandle+0x7f
    e79e4c28 e324a8fa 0000034c 03d6a4ec 77d67094 nt!NtClose+0x4e
    e79e4c28 77d67094 0000034c 03d6a4ec 77d67094 nt!KiFastCallEntry+0x12a
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    03d6a4ec 00000000 00000000 00000000 00000000 0x77d67094

    STACK_COMMAND: kb
    FOLLOWUP_IP:
    afd!AfdTLReleaseIndications+20
    ce81f9b3 8b4804 mov ecx,dword ptr [eax+4]
    SYMBOL_STACK_INDEX: 0
    SYMBOL_NAME: afd!AfdTLReleaseIndications+20
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: afd
    IMAGE_NAME: afd.sys
    DEBUG_FLR_IMAGE_TIMESTAMP: 4db4d9d8
    FAILURE_BUCKET_ID: 0x8E_afd!AfdTLReleaseIndications+20
    BUCKET_ID: 0x8E_afd!AfdTLReleaseIndications+20
    Followup: MachineOwner
    ---------

    It states that it could not reference the memory and ran into a breakpoint.I'm guessing within the program Lotus Notes (ntaskldr.exe). I have had some werid administrator rights issues before, so I might also enable the debugging user for that user to give more memory access on the local machine.

    EDIT: No luck...
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1089402

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice