I appear to be seeing a repeating blue screen on an HP z400 workstation that uses the shrewsoft vpn client v2.2.2 on Windows 8 Enterprise x64. The minidumps blame vfilter.sys
Attached is the minidump as translated by windbg with standard MS symbols. I've seen 2 bsod's in 1 day so far so I'll be removing the client for now. If you want any more info let me know. Thanks, Mathew Hunter CCNA, MCITP-ET IT Infrastructure Site Lead 1220 Homer St., Vancouver, BC V6B 2Y5 t: 604.484.1030 f: 604.684.5447 e: [email protected]<mailto:[email protected]> www.perkinswill.ca<http://www.perkinswill.ca/> | Facebook<http://www.facebook.com/ideasandbuildings> | Twitter<http://www.perkinswill.com/pages/twitter.html> Perkins+Will Canada. Ideas + buildings that honour the broader goals of society This email and any files transmitted with it are confidential and intended solely for the addressee. If you are not the named addressee you should not disseminate, distribute, copy, or alter this email. Please consider the environment before printing this email.
Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: srv*c:\mss*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 8 Kernel Version 9200 MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 9200.16581.amd64fre.win8_gdr.130410-1505 Machine Name: Kernel base = 0xfffff803`37609000 PsLoadedModuleList = 0xfffff803`378d5a20 Debug session time: Tue Sep 24 12:35:10.693 2013 (UTC - 7:00) System Uptime: 22 days 20:07:06.070 Loading Kernel Symbols ............................................................... ................................................................ ................. Loading User Symbols Loading unloaded module list .......................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck D1, {fffff88020c8169d, 2, 0, fffff880039379c0} *** WARNING: Unable to verify timestamp for vfilter.sys *** ERROR: Module load completed but symbols could not be loaded for vfilter.sys Probably caused by : vfilter.sys ( vfilter+49c0 ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: fffff88020c8169d, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, value 0 = read operation, 1 = write operation Arg4: fffff880039379c0, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80337961168 GetUlongFromAddress: unable to read from fffff803379611f8 fffff88020c8169d Nonpaged pool CURRENT_IRQL: 2 FAULTING_IP: vfilter+49c0 fffff880`039379c0 488b040a mov rax,qword ptr [rdx+rcx] CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT BUGCHECK_STR: AV PROCESS_NAME: System TRAP_FRAME: fffff880009d2060 -- (.trap 0xfffff880009d2060) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=000000000000004c rbx=0000000000000000 rcx=fffff880009d2320 rdx=00000000202af37d rsi=0000000000000000 rdi=0000000000000000 rip=fffff880039379c0 rsp=fffff880009d21f8 rbp=0000000000000000 r8=000000000000004c r9=0000000000000002 r10=fffffa800c2af4f8 r11=fffff880009d2320 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na pe cy vfilter+0x49c0: fffff880`039379c0 488b040a mov rax,qword ptr [rdx+rcx] ds:fffff880`20c8169d=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80337662769 to fffff80337663440 STACK_TEXT: fffff880`009d1f18 fffff803`37662769 : 00000000`0000000a fffff880`20c8169d 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx fffff880`009d1f20 fffff803`37660fe0 : 00000000`00000000 fffffa80`0c2af4c0 00000000`00000000 fffff880`009d2060 : nt!KiBugCheckDispatch+0x69 fffff880`009d2060 fffff880`039379c0 : fffff880`03935f77 fffffa80`00000001 ffffc272`00000006 00000000`0c2af1b0 : nt!KiPageFault+0x260 fffff880`009d21f8 fffff880`03935f77 : fffffa80`00000001 ffffc272`00000006 00000000`0c2af1b0 00000000`00000000 : vfilter+0x49c0 fffff880`009d2200 fffffa80`00000001 : ffffc272`00000006 00000000`0c2af1b0 00000000`00000000 00000000`00000000 : vfilter+0x2f77 fffff880`009d2208 ffffc272`00000006 : 00000000`0c2af1b0 00000000`00000000 00000000`00000000 fffff803`00000010 : 0xfffffa80`00000001 fffff880`009d2210 00000000`0c2af1b0 : 00000000`00000000 00000000`00000000 fffff803`00000010 fffffa80`0bdac001 : 0xffffc272`00000006 fffff880`009d2218 00000000`00000000 : 00000000`00000000 fffff803`00000010 fffffa80`0bdac001 fffff880`009d22f0 : 0xc2af1b0 STACK_COMMAND: kb FOLLOWUP_IP: vfilter+49c0 fffff880`039379c0 488b040a mov rax,qword ptr [rdx+rcx] SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: vfilter+49c0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: vfilter IMAGE_NAME: vfilter.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4d0af841 FAILURE_BUCKET_ID: AV_vfilter+49c0 BUCKET_ID: AV_vfilter+49c0 Followup: MachineOwner ---------
_______________________________________________ vpn-help mailing list [email protected] https://lists.shrew.net/mailman/listinfo/vpn-help
