Old Kerio Personal Firewall (KPF) v2.1.5 blue screening XP Pro. SP3 with fwdrv.sys.
Ant
Pro. SP3 machine about a KPF driver. It usually happens when I am
downloading datas like streaming videos, downloading files, etc.
I ran WinDbg from a complete 2 GB memory dump and saw this:
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [c:\windows\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available
Symbol search path is:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86
compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090804-1435
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Tue Nov 3 07:27:10.044 2009 (GMT-8)
System Uptime: 6 days 11:43:42.103
Loading Kernel Symbols
...............................................................
................................................................
............................................................
Loading User Symbols
......................................
Loading unloaded module list
..................................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 8E, {c0000005, aa297084, a54514c0, 0}
*** ERROR: Module load completed but symbols could not be loaded for
fwdrv.sys
*** ERROR: Module load completed but symbols could not be loaded for
Champions Online.exe
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
Probably caused by : fwdrv.sys ( fwdrv+c084 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: aa297084, The address that the exception occurred at
Arg3: a54514c0, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
fwdrv+c084
aa297084 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
TRAP_FRAME: a54514c0 -- (.trap 0xffffffffa54514c0)
ErrCode = 00000000
eax=89b04000 ebx=8aa2f7e8 ecx=00000004 edx=00000010 esi=000001d8
edi=a545157c
eip=aa297084 esp=a5451534 ebp=a545154c iopl=0 nv up ei pl nz na
po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010202
fwdrv+0xc084:
aa297084 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
Resetting default scope
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: Champions Onlin
LAST_CONTROL_TRANSFER: from 804fe827 to 804f9f43
STACK_TEXT:
a5451088 804fe827 0000008e c0000005 aa297084 nt!KeBugCheckEx+0x1b
a5451450 80542095 a545146c 00000000 a54514c0 nt!KiDispatchException+0x3b1
a54514b8 80542046 a545154c aa297084 badb0d00 nt!CommonDispatchException+0x4d
a545154c aa29d4a0 a5451594 a545157c 00000010 nt!Kei386EoiHelper+0x18a
WARNING: Stack unwind information not available. Following frames may be
wrong.
a5451550 a5451594 a545157c 00000010 aa2a4834 fwdrv+0x124a0
a5451554 a545157c 00000010 aa2a4834 87aa29b0 0xa5451594
a5451594 48435c4f 49504d41 20534e4f 494c4e4f 0xa545157c
a5451694 aa29ebfb 879ddd70 00000006 00000000 0x48435c4f
a54516b0 aa29f61b 89b26d58 8aa2f7e8 00000006 fwdrv+0x13bfb
a54516d0 aa29f91b 89b26d58 8aa2f7e8 00000006 fwdrv+0x1461b
a54516f0 aa29fb52 89c87020 89b26d58 8aa2f7e8 fwdrv+0x1491b
a5451714 aa28dd85 89c87020 8aa2f7e8 a5451750 fwdrv+0x14b52
a5451724 804ef19f 89c87020 8aa2f7e8 8aa2f8e8 fwdrv+0x2d85
a54517f0 805831fa 89b26d40 897555dc a5451988 nt!IopfCallDriver+0x31
a54518d0 805bf452 89b26d58 00000000 89755538 nt!IopParseDevice+0xa12
a5451948 805bb9de 00000000 a5451988 00000240 nt!ObpLookupObjectName+0x53c
a545199c 80576033 00000000 00000000 53919c00 nt!ObOpenObjectByName+0xea
a5451a18 805769aa 89521e00 02000000 a5451bc0 nt!IopCreateFile+0x407
a5451a74 aa0cb65e 89521e00 02000000 a5451bc0 nt!IoCreateFile+0x8e
a5451c30 aa0d22d7 8796aa58 8992b978 a5451c64 afd!AfdBind+0x34e
a5451c40 804ef19f 898fe338 88d73168 806e6410
afd!AfdDispatchDeviceControl+0x53
a5451c50 8057f982 88d73244 8796aa58 88d73168 nt!IopfCallDriver+0x31
a5451c64 805807f7 898fe338 88d73168 8796aa58
nt!IopSynchronousServiceTail+0x70
a5451d00 80579274 00000150 000000d4 00000000 nt!IopXxxControlFile+0x5c5
a5451d34 8054162c 00000150 000000d4 00000000 nt!NtDeviceIoControlFile+0x2a
a5451d34 7c90e514 00000150 000000d4 00000000 nt!KiFastCallEntry+0xfc
0013e134 7c90d28a 71a54f14 00000150 000000d4 ntdll!KiFastSystemCallRet
0013e138 71a54f14 00000150 000000d4 00000000 ntdll!ZwDeviceIoControlFile+0xc
0013e1f0 71a56a32 00000150 0013e258 00000010 mswsock!WSPBind+0x1b6
0013e294 71a5542d 00000150 01e59270 00000010 mswsock!SockDoConnect+0x263
0013e2c4 71ab4a5a 00000150 01e59270 00000010 mswsock!WSPConnect+0xc6
0013e310 00491c9c 00000150 01e59270 00000010 WS2_32!connect+0x4f
0013e390 00491964 0170ec64 0000020a 00000104 Champions_Online+0x91c9c
0013e418 0041661c 0170ec64 0000020a 00000004 Champions_Online+0x91964
0013e44c 0041dad0 01e56868 00614ec8 0013e590 Champions_Online+0x1661c
0013e520 004204ff 01e56868 0061410c 00001313 Champions_Online+0x1dad0
0013e590 00572187 01e56868 0013e6f0 0013e6f4 Champions_Online+0x204ff
0013e6e4 0056fd68 0015237d 00000001 d16fd662 Champions_Online+0x172187
0013fef8 005982c0 00400000 00000000 0015237d Champions_Online+0x16fd68
0013ffb8 0059800d 0013fff0 7c817077 00360033 Champions_Online+0x1982c0
0013ffc0 7c817077 00360033 00350030 7ffd8000 Champions_Online+0x19800d
0013fff0 00000000 00598000 00000000 78746341 kernel32!BaseProcessStart+0x23
STACK_COMMAND: kb
FOLLOWUP_IP:
fwdrv+c084
aa297084 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: fwdrv+c084
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fwdrv
IMAGE_NAME: fwdrv.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 3cbaab4f
FAILURE_BUCKET_ID: 0x8E_fwdrv+c084
BUCKET_ID: 0x8E_fwdrv+c084
Followup: MachineOwner
---------
1: kd> lmvm fwdrv
start end module name
aa28b000 aa2a9000 fwdrv (no symbols)
Loaded symbol image file: fwdrv.sys
Image path: \SystemRoot\system32\Drivers\fwdrv.sys
Image name: fwdrv.sys
Timestamp: Mon Apr 15 03:28:31 2002 (3CBAAB4F)
CheckSum: 00020E53
ImageSize: 0001E000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
1: kd> .trap 0xffffffffa54514c0
ErrCode = 00000000
eax=89b04000 ebx=8aa2f7e8 ecx=00000004 edx=00000010 esi=000001d8
edi=a545157c
eip=aa297084 esp=a5451534 ebp=a545154c iopl=0 nv up ei pl nz na
po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010202
fwdrv+0xc084:
aa297084 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
Thank you in advance. :)
--
"Maybe it's like an ant hive..." "Bees man, bees have hives." "You know
what I mean. It's like one female that runs the whole show." "Yes, the
queen." "Yeah the mamma. She is bad*ss, man. I mean big." "These things
ain't ants estupido." "I know that." --Aliens movie
/\___/\
/ /\ /\ \ Phil/Ant @ http://antfarm.ma.cx (Personal Web Site)
| |o o| | Ant's Quality Foraged Links (AQFL): http://aqfl.net
\ _ / Nuke ANT from e-mail address: phi...@earthlink.netANT
( ) or ANT...@zimage.com
Ant is currently not listening to any songs on his home computer.
Giorgos
Have you tried uninstalling and installing it again?
Giorgos
--
NetPros Community and Forums
Connecting IT Professionals from all over the World
http://netpros.freeforums.org
"Ant" <a...@zimage.comANT> wrote in message
news:rLCdnaERYZa9z23X...@earthlink.com...
Giorgos
Have you tried uninstalling and installing it again?
Giorgos
--
NetPros Community and Forums
Connecting IT Professionals from all over the World
http://netpros.freeforums.org
"Ant" <a...@zimage.comANT> wrote in message
news:rLCdnaERYZa9z23X...@earthlink.com...
Ant
> Have you tried uninstalling and installing it again?
No, but I might had fixed the problem with the help from
http://www.dslreports.com/forum/remark,23283834 ... Basically, KPF had a
small MaxBufferSize. So, I needed to increase its value to 20000 in
HKLM\System\ControlSet003\Services\fwdrv. So far, it is working.
However, these blue screens are very rare. We'll see...
--
* <-- Tribble ... *********************** <-- Tribbles imitating ants
(unknown author)
/\___/\
/ /\ /\ \ Ant @ http://antfarm.ma.cx (Personal Web Site)
| |o o| |
\ _ / Please nuke ANT if replying by e-mail.
( )
Ant
>> Have you tried uninstalling and installing it again?
>
> No, but I might had fixed the problem with the help from
> http://www.dslreports.com/forum/remark,23283834 ... Basically, KPF had a
> small MaxBufferSize. So, I needed to increase its value to 20000 in
> HKLM\System\ControlSet003\Services\fwdrv. So far, it is working.
> However, these blue screens are very rare. We'll see...
Nope. The same darn blue screen struck again this morning. :(
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86
compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090804-1435
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sun Dec 13 12:41:32.614 2009 (GMT-8)
System Uptime: 0 days 14:57:20.952
Loading Kernel Symbols
...............................................................
................................................................
...........................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffde00c). Type ".hh dbgerr001" for details
Loading unloaded module list
.............................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 8E, {c0000005, aa297084, a66f54c0, 0}
*** ERROR: Module load completed but symbols could not be loaded for
fwdrv.sys
PEB is paged out (Peb.Ldr = 7ffde00c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffde00c). Type ".hh dbgerr001" for details
Probably caused by : fwdrv.sys ( fwdrv+c084 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: aa297084, The address that the exception occurred at
Arg3: a66f54c0, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
PEB is paged out (Peb.Ldr = 7ffde00c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffde00c). Type ".hh dbgerr001" for details
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
fwdrv+c084
aa297084 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
TRAP_FRAME: a66f54c0 -- (.trap 0xffffffffa66f54c0)
ErrCode = 00000000
eax=89afe000 ebx=892b0c50 ecx=00000004 edx=00000010 esi=000001d8
edi=a66f557c
eip=aa297084 esp=a66f5534 ebp=a66f554c iopl=0 nv up ei pl nz na
po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010202
fwdrv+0xc084:
aa297084 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
Resetting default scope
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: firefox.exe
LAST_CONTROL_TRANSFER: from 804fe827 to 804f9f43
STACK_TEXT:
a66f5088 804fe827 0000008e c0000005 aa297084 nt!KeBugCheckEx+0x1b
a66f5450 80542095 a66f546c 00000000 a66f54c0 nt!KiDispatchException+0x3b1
a66f54b8 80542046 a66f554c aa297084 badb0d00 nt!CommonDispatchException+0x4d
a66f554c aa29d4a0 a66f5594 a66f557c 00000010 nt!Kei386EoiHelper+0x18a
WARNING: Stack unwind information not available. Following frames may be
wrong.
a66f5550 a66f5594 a66f557c 00000010 aa2a4834 fwdrv+0x124a0
a66f5554 a66f557c 00000010 aa2a4834 89020058 0xa66f5594
a66f5594 54534e49 5c464655 4f524558 4b4e4142 0xa66f557c
a66f5694 aa29ebfb 8925ff90 00000006 00000000 0x54534e49
a66f56b0 aa29f61b 89b202f0 892b0c50 00000006 fwdrv+0x13bfb
a66f56d0 aa29f91b 89b202f0 892b0c50 00000006 fwdrv+0x1461b
a66f56f0 aa29fb52 899ea8b0 89b202f0 892b0c50 fwdrv+0x1491b
a66f5714 aa28dd85 899ea8b0 892b0c50 a66f5750 fwdrv+0x14b52
a66f5724 804ef19f 899ea8b0 892b0c50 892b0d50 fwdrv+0x2d85
a66f57f0 805831fa 89b202d8 8982039c a66f5988 nt!IopfCallDriver+0x31
a66f58d0 805bf452 89b202f0 00000000 898202f8 nt!IopParseDevice+0xa12
a66f5948 805bb9de 00000000 a66f5988 00000240 nt!ObpLookupObjectName+0x53c
a66f599c 80576033 00000000 00000000 53919c00 nt!ObOpenObjectByName+0xea
a66f5a18 805769aa 8937ef78 02000000 a66f5bc0 nt!IopCreateFile+0x407
a66f5a74 aa0cb65e 8937ef78 02000000 a66f5bc0 nt!IoCreateFile+0x8e
a66f5c30 aa0d22d7 89315028 89947030 a66f5c64 afd!AfdBind+0x34e
a66f5c40 804ef19f 8990e2c0 893cbc68 806e6410
afd!AfdDispatchDeviceControl+0x53
a66f5c50 8057f982 893cbd44 89315028 893cbc68 nt!IopfCallDriver+0x31
a66f5c64 805807f7 8990e2c0 893cbc68 89315028
nt!IopSynchronousServiceTail+0x70
a66f5d00 80579274 00000330 000001b8 00000000 nt!IopXxxControlFile+0x5c5
a66f5d34 8054162c 00000330 000001b8 00000000 nt!NtDeviceIoControlFile+0x2a
a66f5d34 7c90e514 00000330 000001b8 00000000 nt!KiFastCallEntry+0xfc
019cfc14 7c90d28a 71a54f14 00000330 000001b8 0x7c90e514
019cfcd0 71a56a32 00000330 019cfd38 00000010 0x7c90d28a
019cfd74 71a5542d 00000330 02e62590 00000010 0x71a56a32
019cfda4 71ab4a5a 00000330 02e62590 00000010 0x71a5542d
019cfdf0 601b8afd 00000330 02e62590 00000010 0x71ab4a5a
019cfee0 004b947c 019cff28 02eb26c0 019cff30 0x601b8afd
019cfee4 019cff28 02eb26c0 019cff30 ffffffff 0x4b947c
019cfee8 02eb26c0 019cff30 ffffffff 004b8884 0x19cff28
019cff28 00000000 00000000 0049335b 016a7f5c 0x2eb26c0
STACK_COMMAND: kb
FOLLOWUP_IP:
fwdrv+c084
aa297084 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: fwdrv+c084
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fwdrv
IMAGE_NAME: fwdrv.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 3cbaab4f
FAILURE_BUCKET_ID: 0x8E_fwdrv+c084
BUCKET_ID: 0x8E_fwdrv+c084
Followup: MachineOwner
---------
3: kd> .trap 0xffffffffa66f54c0
ErrCode = 00000000
eax=89afe000 ebx=892b0c50 ecx=00000004 edx=00000010 esi=000001d8
edi=a66f557c
eip=aa297084 esp=a66f5534 ebp=a66f554c iopl=0 nv up ei pl nz na
po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010202
fwdrv+0xc084:
aa297084 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
3: kd> lmvm fwdrv
start end module name
aa28b000 aa2a9000 fwdrv (no symbols)
Loaded symbol image file: fwdrv.sys
Image path: \SystemRoot\system32\Drivers\fwdrv.sys
Image name: fwdrv.sys
Timestamp: Mon Apr 15 03:28:31 2002 (3CBAAB4F)
CheckSum: 00020E53
ImageSize: 0001E000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
MaxBufferSize in HKLM\System\ControlSet003\Services\fwdrv with 20000
value did not help. :(
I wished there was a light and simple firewall (did like Conseal PC
Firewall during 9x days too) to block mostly outbound traffics in
updated Windows XP Pro. SP3. :(
--
"We ants are runnin' the show! We're the lords of the earth!" --ANTZ
/\___/\
/ /\ /\ \ Phil./Ant @ http://antfarm.ma.cx (Personal Web Site)
| |o o| | Ant's Quality Foraged Links: http://aqfl.net
Hutton Conyers
>Once in a while, I get a get blue screen on my old, updated Windows XP
>Pro. SP3 machine about a KPF driver. It usually happens when I am
>downloading datas like streaming videos, downloading files, etc.
I've had this with the same setup. The problem seems to be a Kerio
file fwdrv.sys in Win32.
I've switched to Comodo until I can work out how to get back to Kerio.
I got the BSOD when opening T'bird and F'fox
Deep Joy ............ Hutton Conyers
--
"Genius may have its limitations, but stupidity is not thus handicapped."
Ant
wrote:
> On Tue, 03 Nov 2009 07:54:08 -0800, Ant <a...@zimage.comANT> wrote:
> >Once in a while, I get a get blue screen on my old, updated Windows XP
> >Pro. SP3 machine about a KPF driver. It usually happens when I am
> >downloading datas like streaming videos, downloading files, etc.
>
> I've had this with the same setup. The problem seems to be a Kerio
> file fwdrv.sys in Win32.
>
> I've switched to Comodo until I can work out how to get back to Kerio.
> I got the BSOD when opening T'bird and F'fox
Wow, everytime? Weird. How is Comodo? Is it free, light/fast, etc.
like KPF v2.1.5?