locked
Bluescreen - Computer crash RRS feed

  • Question

  • Hello,

     

    I have a problem with my computer. It happens just for 5 days, and still occurs. I have Windows 7 ultimate SP1 installed and i have a DUAL CORE 6600 intel processor with 4GB of memory (only 3.3GB used!) and i have a Geforce 7950GT graphic card.

    In this last days, suddenly the computer shuts down and appears a blue sreen with some information. After restarts appears a message with this (i'm from Portugal, so i will translate this! :))

    Assinatura do problema (signature problem):
      Nome do Evento de Problema(Name of problem event):    BlueScreen
      Versão do SO (OS version):    6.1.7601.2.1.0.256.1
      ID de Região (Region ID):    2070

    Informações adicionais sobre o problema (Additional information about the system):
      BCCode:    d1
      BCP1:    00000014
      BCP2:    00000002
      BCP3:    00000000
      BCP4:    8CD61BF2
      OS Version:    6_1_7601
      Service Pack:    1_0
      Product:    256_1

    I have also the minidump report if need it.

    I need help with this please. I don't know what it could be.

    Thanks.

    Regards,

    Nuno Freire


    Wednesday, March 30, 2011 7:50 AM

Answers

  • Run pnputil -e to detect all 3rd party drivers. Look if the mfenlfk driver is installed by an OEM.inf.

    if yes, run pnputil.exe -d oem(replace the number with your).inf to remove the driver.


    if this doesn't work, rename the driver in the C:\Windows\System32\drivers folder.



    [Offtopic]
    @Mr X<abbr class="affil"></abbr>

    I don't tell names, 1 MVP posts in every topic (if there are already enough information posted or not) and posts 2-3 replies in a row with useless links, the other MVP replies useless nonsense, proposes this as answers even if it's completely useless. This causes a huge amount of emails I get each day because all replies and proposal cause me to get a email. So my email is flooded with 60-70 emails each day. I look at your topics and don't need to post the same again, if I think it's ok, I propose it as answer and reply a short message ifI think you overlooked something. This is how MVPs should reply, not posting nonsense all the time. Next the signatue of the 2nd MVP contains advertisements. Both things should not be allowed. because I got no official answer of MS, I'm going to draw the obvious conclusion and leave the forum.
    [/Offtopic]



    "A programmer is just a tool which converts caffeine into code"

    I'm going to leave the forum on 31th March 2011 if I don't get a Feedback about the SPAM of 2 MVPs. So if you want an answer, be fast so that I can help you before I leave the Technet forum.
    • Marked as answer by Leo Huang Thursday, April 7, 2011 7:39 AM
    Wednesday, March 30, 2011 8:50 PM

All replies

  • Bug Check Code 0xD1: http://msdn.microsoft.com/en-us/library/ff560244.aspx

    Please use Microsoft Skydrive to upload dump files (%systemroot%\minidumps like c:\windows\minidumps). Once done post a link here.

    If you want to debug dump files without my help, refer to this Microsoft article:

    http://support.microsoft.com/kb/315263

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

    • Proposed as answer by Andre.Ziegler Wednesday, March 30, 2011 2:18 PM
    Wednesday, March 30, 2011 8:12 AM
  • Hello,

     

    I don't know how to debug this so i post here the link for the dump file (i think i did it right, im using the skydrive for the first time!):

    https://cid-6ba01b9c6b8e9b2e.skydrive.live.com/redir.aspx?resid=6BA01B9C6B8E9B2E!120&authkey=Sxuoaxg3aI8%24

    this is the dump for today crash but i have also the dump file from 5 days ago if need it!

    thanks!

    Nuno Freire

     

     

     

     


    Wednesday, March 30, 2011 8:21 AM
  • *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 00000014, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: 8cd62bf2, address which referenced memory
    Debugging Details:
    ------------------
    READ_ADDRESS: GetPointerFromAddress: unable to read from 82d70700
    Unable to read MiSystemVaType memory at 82d50100
     00000014 
    CURRENT_IRQL:  2
    FAULTING_IP: 
    NETIO!RtlCopyBufferToMdl+1c
    8cd62bf2 394614          cmp     dword ptr [esi+14h],eax
    CUSTOMER_CRASH_COUNT:  1
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    BUGCHECK_STR:  0xD1
    PROCESS_NAME:  System
    TRAP_FRAME:  80e42488 -- (.trap 0xffffffff80e42488)
    ErrCode = 00000000
    eax=00000000 ebx=00000000 ecx=00000044 edx=ffffffbc esi=00000000 edi=ffffffbc
    eip=8cd62bf2 esp=80e424fc ebp=80e4250c iopl=0         nv up ei pl zr na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
    NETIO!RtlCopyBufferToMdl+0x1c:
    8cd62bf2 394614          cmp     dword ptr [esi+14h],eax ds:0023:00000014=????????
    Resetting default scope
    LAST_CONTROL_TRANSFER:  from 8cd62bf2 to 82c48c5b
    STACK_TEXT:  
    80e42488 8cd62bf2 badb0d00 ffffffbc 00000000 nt!KiTrap0E+0x2cf
    80e4250c 8cdfeaea e4eae448 00000000 ffffffbc NETIO!RtlCopyBufferToMdl+0x1c
    80e4253c 8ce4d652 ccbbedf8 80e4258c 80e42588 tcpip!TcpTcbReassemblyRetrieveSegments+0xad
    80e425d0 8ce4bc9e 863266d8 ccbbedf8 80e425f8 tcpip!TcpTcbCarefulDatagram+0x168a
    80e4263c 8ce2f2d8 863266d8 ccbbedf8 00e426b0 tcpip!TcpTcbReceive+0x228
    80e426a4 8ce2fb0a 862fa8d8 8631e000 00000000 tcpip!TcpMatchReceive+0x237
    80e426f4 8ce2fb4b 863266d8 8631e000 00003cc3 tcpip!TcpPreValidatedReceive+0x293
    80e42710 8ce29e77 863266d8 8631e000 80e4274c tcpip!TcpReceive+0x2d
    80e42720 8ce320ab 80e42734 c000023e 00000000 tcpip!TcpNlClientReceiveDatagrams+0x12
    80e4274c 8ce319f6 8cead198 80e427a0 c000023e tcpip!IppDeliverListToProtocol+0x49
    80e4276c 8ce2fdb8 8ceacfa8 00000006 80e427a0 tcpip!IppProcessDeliverList+0x2a
    80e427c4 8ce3189f 8ceacfa8 00000006 00000000 tcpip!IppReceiveHeaderBatch+0x1fb
    80e42858 8ce3fccc 8750c2a8 00000000 8ce22800 tcpip!IpFlcReceivePackets+0xbe5
    80e428d4 8ce3a2fe 8750a658 c7c80970 00000000 tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x746
    80e42908 82c64068 c7c80970 ad4342c3 00000000 tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x11e
    80e42970 8ce3a46c 8ce3a1e0 80e42998 00000000 nt!KeExpandKernelStackAndCalloutEx+0x132
    80e429ac 8cd0d18d 8750a600 c7c80901 00000000 tcpip!FlReceiveNetBufferListChain+0x7c
    80e429e4 8ccfb5be 8750b990 c7c80970 00000000 ndis!ndisMIndicateNetBufferListsToOpen+0x188
    80e42a0c 8ccfb4b2 00000000 8750bef0 00000001 ndis!ndisIndicateSortedNetBufferLists+0x4a
    80e42b88 8cca6c1d 872120e0 00000000 00000000 ndis!ndisMDispatchReceiveNetBufferLists+0x129
    80e42ba4 8ccd756a 872120e0 c7c80970 00000000 ndis!ndisMTopReceiveNetBufferLists+0x2d
    80e42bc0 8ccd7504 8750aac8 c7c80970 00000000 ndis!ndisFilterIndicateReceiveNetBufferLists+0x46
    80e42bdc 8d24cd02 8750aac8 c7c80970 00000000 ndis!NdisFIndicateReceiveNetBufferLists+0x2f
    WARNING: Stack unwind information not available. Following frames may be wrong.
    80e42c68 8ccfb553 8750bef0 c7c80970 00000000 mfenlfk+0xd02
    80e42c90 8cca6c78 872120e0 c7c80970 00000000 ndis!ndisMIndicateReceiveNetBufferListsInternal+0x62
    80e42cb8 95e4f6b7 872120e0 c7c80970 00000000 ndis!NdisMIndicateReceiveNetBufferLists+0x52
    80e42cd8 95e4a730 875083a0 c7c80970 875083a0 tunnel!TeredoWfpIndicationWorker+0xa9
    80e42cec 82dfe620 875083a0 95e5b6e8 8554cbb8 tunnel!LwWorker+0x12
    80e42d00 82c6b183 8832d0c8 00000000 8554cbb8 nt!IopProcessWorkItem+0x23
    80e42d50 82df9400 00000001 ad434623 00000000 nt!ExpWorkerThread+0x10d
    80e42d90 82c99969 82c6b076 00000001 00000000 nt!PspSystemThreadStartup+0x9e
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
    STACK_COMMAND:  kb
    FOLLOWUP_IP: 
    NETIO!RtlCopyBufferToMdl+1c
    8cd62bf2 394614          cmp     dword ptr [esi+14h],eax
    SYMBOL_STACK_INDEX:  1
    SYMBOL_NAME:  NETIO!RtlCopyBufferToMdl+1c
    FOLLOWUP_NAME:  MachineOwner
    MODULE_NAME: NETIO
    IMAGE_NAME:  NETIO.SYS
    DEBUG_FLR_IMAGE_TIMESTAMP:  4ce78963
    FAILURE_BUCKET_ID:  0xD1_NETIO!RtlCopyBufferToMdl+1c
    BUCKET_ID:  0xD1_NETIO!RtlCopyBufferToMdl+1c
    Followup: MachineOwner
    ---------
    -----------------------------------------
    Please update your BIOS and your NIC driver and check if this solve your problem.
    If this does not help, please update all possible drivers.

    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

    Wednesday, March 30, 2011 10:49 AM
  • Is there any freeware software that i can use to see what drivers are out of date? I will try to update the drivers and see if it works and then i will report here.

     

    Thanks

    Nuno Freire

    Wednesday, March 30, 2011 11:02 AM

  • WARNING: Stack unwind information not available. Following frames may be wrong.
    80e42c68 8ccfb553 8750bef0 c7c80970 00000000 mfenlfk+0xd02
    80e42c90 8cca6c78 872120e0 c7c80970 00000000 ndis!ndisMIndicateReceiveNetBufferListsInternal+0x62
    80e42cb8 95e4f6b7 872120e0 c7c80970 00000000 ndis!NdisMIndicateReceiveNetBufferLists+0x52
    80e42cd8 95e4a730 875083a0 c7c80970 875083a0 tunnel!TeredoWfpIndicationWorker+0xa9
    80e42cec 82dfe620 875083a0 95e5b6e8 8554cbb8 tunnel!LwWorker+0x12
    80e42d00 82c6b183 8832d0c8 00000000 8554cbb8 nt!IopProcessWorkItem+0x23
    80e42d50 82df9400 00000001 ad434623 00000000 nt!ExpWorkerThread+0x10d
    80e42d90 82c99969 82c6b076 00000001 00000000 nt!PspSystemThreadStartup+0x9e
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19

    -----------------------------------------
    Please update your BIOS and your NIC driver and check if this solve your problem.

    better update this driver:

    mfenlfk.sys (McAfee)


    "A programmer is just a tool which converts caffeine into code"

    I'm going to leave the forum on 31th March 2011 if I don't get a Feedback about the SPAM of 2 MVPs. So if you want an answer, be fast so that I can help you before I leave the Technet forum.
    • Proposed as answer by Andre.Ziegler Wednesday, March 30, 2011 2:18 PM
    Wednesday, March 30, 2011 12:38 PM
  • Hello,

     

    I don't have McAfee installed. I mean i had but i uninstall it. its that a way to remove that completely?

     

    Thanks

    Wednesday, March 30, 2011 1:10 PM
  • look if you find this driver on your PC: mfenlfk.sys. if yes, rename it.

    "A programmer is just a tool which converts caffeine into code"

    I'm going to leave the forum on 31th March 2011 if I don't get a Feedback about the SPAM of 2 MVPs. So if you want an answer, be fast so that I can help you before I leave the Technet forum.
    Wednesday, March 30, 2011 1:29 PM
  • ok, i will try to do that. i will report the results later.

     

    thanks again for your help!

    Wednesday, March 30, 2011 2:17 PM

  • I'm going to leave the forum on 31th March 2011 if I don't get a Feedback about the SPAM of 2 MVPs. So if you want an answer, be fast so that I can help you before I leave the Technet forum.

    Hello Andre,

    Which SPAM are you talking about and who are those two MVPs?

    I see that you are doing a good job on Technet Forums so what is the problem exactly?

    Regards.

    Wednesday, March 30, 2011 2:46 PM
  • On Wed, 30 Mar 2011 11:02:26 +0000, chopssuey wrote:

    Is there any freeware software that i can use to see what drivers are out of date? I will try to update the drivers and see if it works and then i will report here.

    There is very seldom an issue with drivers being out of date. A more
    typical problem is that you don't have the correct driver installed.
    A driver needs to be correct with respect to the particular hardware
    device, with respect to the version of Windows you are running, and
    with respect to the "bitness" (32-bit or 64-bit) of the Windows
    version you are running.


    Ken Blake, Microsoft MVP
    Wednesday, March 30, 2011 3:05 PM
  • Hello Blake

    About the windows i have install is the 32-bit version.

    For the file, i found 2 locations on my hard drive:

    C:\Windows\System32\DriverStore\FileRepository\mfenlfk.inf_x86_neutral_f5eed0c05aed03bf

    C:\Windows\System32\drivers

    Can i rename all of this files or delete them?

    thanks

    Nuno Freire


    Wednesday, March 30, 2011 6:56 PM
  • Run pnputil -e to detect all 3rd party drivers. Look if the mfenlfk driver is installed by an OEM.inf.

    if yes, run pnputil.exe -d oem(replace the number with your).inf to remove the driver.


    if this doesn't work, rename the driver in the C:\Windows\System32\drivers folder.



    [Offtopic]
    @Mr X<abbr class="affil"></abbr>

    I don't tell names, 1 MVP posts in every topic (if there are already enough information posted or not) and posts 2-3 replies in a row with useless links, the other MVP replies useless nonsense, proposes this as answers even if it's completely useless. This causes a huge amount of emails I get each day because all replies and proposal cause me to get a email. So my email is flooded with 60-70 emails each day. I look at your topics and don't need to post the same again, if I think it's ok, I propose it as answer and reply a short message ifI think you overlooked something. This is how MVPs should reply, not posting nonsense all the time. Next the signatue of the 2nd MVP contains advertisements. Both things should not be allowed. because I got no official answer of MS, I'm going to draw the obvious conclusion and leave the forum.
    [/Offtopic]



    "A programmer is just a tool which converts caffeine into code"

    I'm going to leave the forum on 31th March 2011 if I don't get a Feedback about the SPAM of 2 MVPs. So if you want an answer, be fast so that I can help you before I leave the Technet forum.
    • Marked as answer by Leo Huang Thursday, April 7, 2011 7:39 AM
    Wednesday, March 30, 2011 8:50 PM
  • i didn't found the driver using pnputil -e, so i rename as you said. Hope the problem is solved. I will see now if it happens again. if so i will report it in this thread.

     

    Thanks all

    Nuno Freire

    Wednesday, March 30, 2011 9:55 PM