topic Re: Vista AW21 M/H BlueScreening in PCs & Accessories

Vista AW21 M/H BlueScreening

PBathuk — Wed, 27 May 2009 16:38:30 GMT

Hi all,

I have had my laptop for about 2 weeks now and it has started to bluescreen of death often.
Today it has done it over 5 times.
I have been trying to fix it myself and so far have got the following from my memory.dmp using windbg

Can anyone help?

I have tried installing the newest version of my intel wifi drivers but to no avail.

Not sure if I need to post specs of pc but if needed I can!

From below I can see that NEOFLTR_550_11711.SYS seems to be the error, but can't find anything on it on the internet

*************************************

Loading Dump File [C:\MemoryDumps\MEMORY_1st.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6002.18005.x86fre.lh_sp2rtm.090410-1830
Machine Name:
Kernel base = 0x81e4c000 PsLoadedModuleList = 0x81f63c70
Debug session time: Wed May 27 17:29:30.278 2009 (GMT+1)
System Uptime: 0 days 7:11:30.244
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols

Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 8, 0}

*** ERROR: Module load completed but symbols could not be loaded for NEOFLTR_550_11711.SYS
*** ERROR: Module load completed but symbols could not be loaded for mux.sys
*** ERROR: Module load completed but symbols could not be loaded for NETw5v32.sys
Probably caused by : NEOFLTR_550_11711.SYS ( NEOFLTR_550_11711+9646 )

Followup: MachineOwner
********************************************************

Then if I do full analysis it comes up with

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: 00000000, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: 00000000

CURRENT_IRQL: 2

FAULTING_IP:
+60d0952f033ad944
00000000 ?? ???

PROCESS_NAME: System

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xD1

TRAP_FRAME: 805ec04c -- (.trap 0xffffffff805ec04c)
ErrCode = 00000010
eax=00000000 ebx=00001000 ecx=86408f70 edx=86408f70 esi=936e007c edi=90b9a1e0
eip=00000000 esp=805ec0c0 ebp=805ec118 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
00000000 ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from 00000000 to 81e99fb9

FAILED_INSTRUCTION_ADDRESS:
+60d0952f033ad944
00000000 ?? ???

STACK_COMMAND: kb

FOLLOWUP_IP:
NEOFLTR_550_11711+9646
9ddaf646 8945f4 mov dword ptr [ebp-0Ch],eax

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: NEOFLTR_550_11711+9646

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: NEOFLTR_550_11711

IMAGE_NAME: NEOFLTR_550_11711.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 461c4604

FAILURE_BUCKET_ID: 0xD1_CODE_AV_NULL_IP_NEOFLTR_550_11711+9646

BUCKET_ID: 0xD1_CODE_AV_NULL_IP_NEOFLTR_550_11711+9646

Followup: MachineOwner
---------

Re: Vista AW21 M/H BlueScreening

PBathuk — Wed, 27 May 2009 19:31:41 GMT

New addition to this post, I have been doing more digging and have found under the device manager the
"Show hidden devices"

Did this then went to Non-Plug and Play Drivers instantly saw something that looked like it might help
"Juniper Networks TDI Filter Driver (NEOFLTR_550_11711)" with an ! over the top of the icon
When I opened it I saw
"This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Click 'Check for solutions' to send data about this device to Microsoft and to see if there is a solution available."

So have now disabled it and going to run some test like remote access and media sharing (some of the things that caused it to crash last time)

If anyone knows what this is for, I would be greatful

Re: Vista AW21 M/H BlueScreening

Blencogo — Wed, 27 May 2009 20:19:30 GMT

The file is part of Juniper Networks Secure Application Manager.

Are you using any Juniper VPN devices or Routers for remote access that use the Intranet Security software?

http://www.juniper.net/gb/en/

Do you have any other virtual machine software running?

Re: Vista AW21 M/H BlueScreening

PBathuk — Thu, 28 May 2009 08:10:50 GMT

I have just noticed that my remote access for work installs a juniper client.
However I need this for work and cannot find any updates for it.
Seems to be what ever version they push onto my pc is the version I use.

May give work a call and ask them if there are any updates that I can use!

Cheers

Re: Vista AW21 M/H BlueScreening

PBathuk — Fri, 29 May 2009 12:36:41 GMT

Just wanted to close this off.

Spoke to my work and they advised me of a different site to login through for them and it uses a java client as auth not Juniper. Problem gone.
Because of the volume of crashes (and not really installing much else on the PC) I have done a full rebuild, and its now working better than ever

Cheers for your help.