TechSpot

Afd.sys bluescreen. Dump inside thread

By smint
Jun 22, 2009
Topic Status:
Not open for further replies.
  1. im getting the same afd.sys bluescreen randomly about 2-3 times each week. Can anyone of you help me with the dumpfile?
  2. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,550   +18

    You are running the latest service pack of XP (SP3), so this should not be happening.
    File afd.sys is a trustworthy file from Microsoft.

    The Stop 0xD1 messages indicates that the system attempted to access pageable memory using a kernel process IRQL that was too high.

    Drivers that have used improper addresses typically cause this error.
    • Stop 0xD1 messages can occur after installing faulty drivers or system services.

    The most likely culprits at this point...
    1. Drivers for your network card... Since these use afd.sys, make sure they are updated.
    2. Firewall software... same...
    3. MajorGeeks offers a way of repairing the WinSock... http://www.majorgeeks.com/download4372.html
    4. Check for Malware... Start with the three stickies (below the announcement) by Julio here...
    http://www.techspot.com/vb/menu28.html
    If you decide to proceed with cleaning, follow the eight steps very carefully, here...
    http://www.techspot.com/vb/topic58138.html

    If you want us to explore further, attach three or four more of your most recent minidumps to your next post.

    Added note about Memtest...
    It might not hurt to run Memtest before running through the other possible culprits... check this tutorial...
    http://www.techspot.com/vb/topic62524.html
  3. smint

    smint TS Rookie Topic Starter

    Thank you alot for your help.

    I have tried to update my network drivers but with no luck. I was thinking about trying a new firewall as the next step so I will try another one.

    I am pretty sure its not the memory, because I can run Orthos while stressing both cores + memory for 15 mins easily. I can also game forever without any negative symptoms. I will load in my UBCD and start memtest before I go to sleep tonight to make sure its not the memory.

    I have compressed the last 5 minidumps in one archive for you. The Dumpfile in my first post is the most recent. The five in this archive does not include the most recent dumpfile.
  4. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,550   +18

    All but one of your errors was the same (0xD1 caused by afd.sys)
    The remaining is 0x8E also caused by afd.sys.

    0x8E points to faulty hardware or drivers. The hardware varies from modems, video cards, USB device to memory or sound cards. Sometimes it proves to be hardware that it is not compatible with Windows XP.

    I have seen at least one report of file-sharing software associated with this problem.
    I have also seen specific software (AV and Firewall) associated with this problem.

    So...
    1. Is this a new build, or have you recently upgraded any hardware or software?
    Please tell us more about your system... Hardware: MB, CPU, Cards, Memory, PSU

    2. You say that the system is stable with gaming: When does it crash?

    Above recommendations remain; the new information is simply confirming the previous, with the addition of a single instance of a different bugcheck code caused by the same driver.


    Check this thread for resolving NIC driver issues...
    http://www.techspot.com/vb/topic128186.html
    Raybay and Lookingaround give great guidance!
  5. smint

    smint TS Rookie Topic Starter

    The computer is a Acer Aspire 5720ZG with following specs.

    Intel Pentium Dual-Core T2310 @ 1,46 GHz
    15,4" widescreen (1280 x 800 piksler)
    2 GB DDR2
    250 GB harddisk (5400 rpm)
    nVidia GeForce 8400M GS grafikk 256 MB
    54 Mbps WLAN (b/g)
    Gigabit LAN + modem
    4 x USB, FireWire, IR
    1 ExpressCard/54 kortplass
    card reader SD, MMS, MS/PRO, xD
    S-Video, VGA og DVI ut, lyd inn/ut
    web camera and microphone

    I have exchanged the CPU for a T7700 Core 2 Duo and installed a HD3650 256mb graphic card. I can game flawlessly for eternity it seems like.

    If I were to guess when it crashes the most I would say while browsing in opera. It rarely happen when I am gaming.

    The weird thing is that I think I have the exact same problem on my stationary and it uses the same AV and FW + uTorrent. So you might be correct about it having to do with an application.


    EDIT: SiSoftware Sandra

    System Chassis
    Manufacturer : Acer
    Can be locked : No
    Version : V1.42
    Power Cord(s) : 1
    Serial Number : Chassis Serial Number
    Boot-up State : Safe
    Power State : Safe
    Thermal State : Safe
    Security State : External Interface Locked-out

    Mainboard
    Manufacturer : Acer
    Multi-Processor (MP) Support : No
    MPS Version : 1.40
    Model : eMachine
    Type : Mainboard
    Version : V1.42
    Serial Number : Base Board Serial Number
    Asset Tag : Base Board Asset Tag
    Location in Chassis : Base Board Chassis Location

    System Mainboard Properties
    Removable : No
    Replaceable : Yes
    Hot Swap : No

    On-board Devices
    Intel Video Graphics Controller : Video Adapter (Enabled)
    Broadcom Lan Controller : Ethernet Adapter (Enabled)

    System Memory Controller
    Location : Mainboard
    Error Correction Capability : None
    Number of Memory Slots : 2
    Maximum Installable Memory : 4GB
    BANK 0 - DIMM0 : Samsung 0x4D342037305432393533455A332D43453620 0x763104BA Unknown DIMM Synchronous DDR2 1GB/64 @ 667MHz
    BANK 2 - DIMM2 : Samsung 0x4D342037305432393533455A332D43453620 0x76310491 Unknown DIMM Synchronous DDR2 1GB/64 @ 667MHz

    Chipset
    Model : Acer Mobile PM965/GM965/GL960 Express Processor to DRAM Controller
    Revision : A4
    Bus : Intel AGTL+
    Front Side Bus Speed : 4x 200MHz (800MHz)
    Maximum FSB Speed : 4x 200MHz (800MHz)
    Width : 64-bit
    I/O Queue Depth : 12 request(s)
    Maximum Bus Bandwidth : 6.25GB/s

    Chipset 1 Hub Interface
    Type : DMI (Direct Media Interface)
    Version : 1.00
    Number of Ports : 4
    In/Out Width : 4-bit / 4-bit
    Multiplier : 3x
    Speed : 1x 100MHz (100MHz)

    Logical/Chipset Memory Banks
    Bank 0 : 512MB DDR2 SO-DIMM 5-5-5-15 3-20-5-3 1T
    Bank 1 : 512MB DDR2 SO-DIMM 5-5-5-15 3-20-5-3 1T
    Bank 4 : 512MB DDR2 SO-DIMM 5-5-5-15 3-20-5-3 1T
    Bank 5 : 512MB DDR2 SO-DIMM 5-5-5-15 3-20-5-3 1T
    Maximum Installable Memory : 4GB
    Supported Memory Types : DDR2 SO-DIMM
    Channels : 2
    Memory Bus Speed : 2x 333MHz (666MHz)
    Maximum Memory Speed : 2x 333MHz (666MHz)
    Multiplier : 5/3x
    Width : 64-bit
    Memory Controller in Processor : No
    FMA - Fast Memory Access Support : No
    Refresh Rate : 7.80µs
    Power Save Mode : No
    Fixed Hole Present : No
    Maximum Memory Bus Bandwidth : 10.41GB/s

    APIC 1
    Version : 2.00
    Multiplier : 1/2x
    Maximum Interrupts : 24
    IRQ Handler Engaged : Yes
    Enhanced Support : Yes

    Memory Module
    Manufacturer : Samsung
    Model : M4 70T2953EZ3-CE6
    Serial Number : 763104BA
    Type : 1GB DDR2 SO-DIMM
    Technology : 16x(64Mx8)
    Speed : PC2-5300U DDR2-666
    Standard Timings : 5.0-5-5-15 3-20-5-3
    Version : 1.02
    Memory DC Line : 1.80V
    Set Timing @ 333MHz : 5.0-5-5-15 3-20-5-3
    Set Timing @ 267MHz : 4.0-4-4-12 2-16-4-2
    Set Timing @ 200MHz : 3.0-3-3-9 2-12-3-2

    Memory Module
    Manufacturer : Samsung
    Model : M4 70T2953EZ3-CE6
    Serial Number : 76310491
    Type : 1GB DDR2 SO-DIMM
    Technology : 16x(64Mx8)
    Speed : PC2-5300U DDR2-666
    Standard Timings : 5.0-5-5-15 3-20-5-3
    Version : 1.02
    Memory DC Line : 1.80V
    Set Timing @ 333MHz : 5.0-5-5-15 3-20-5-3
    Set Timing @ 267MHz : 4.0-4-4-12 2-16-4-2
    Set Timing @ 200MHz : 3.0-3-3-9 2-12-3-2

    Environment Monitor 1
    Model : Intel Core CPU [P1, C2, T100]
    Version : 15.10
    Mainboard Specific Support : No

    Temperature Sensor(s)
    CPU Temperature : 57.00°C td

    System Bus(es) on Hub 1
    Version : 2.30
    System Bus 0 : PCI
    System Bus 1 : PCIe 1.00 x16 2.5Gbps
    System Bus 2 : PCIe 1.00 x1 2.5Gbps
    System Bus 4 : PCIe 1.00 x1 2.5Gbps
    System Bus 5 : PCIe 1.00 x1 2.5Gbps
    System Bus 6 : PCIe 1.00 x1 2.5Gbps
    System Bus 7 : PCI66

    LPC Hub Controller 1
    Model : Acer ICH8M-E (ICH8) LPC Interface Controller
    Revision : A4
    ACPI Power Management Enabled : Yes
    Advanced TCO Mode Support : Yes
    Advanced TCO Mode Enabled : No
    High Precision Timer Enabled : Yes
    Number of Precision Timers : 3
    System Timer : 14.32MHz
    Delayed Transaction Enabled : Yes

    Disk Controller
    Model : Acer 82801H (ICH8) Ultra ATA Storage Controllers
    Interface : ATA
    Revision : A4
    Maximum UDMA Mode : UltraDMA-5 / ATA100
    Mobile : Yes
    Channels : 4
    In Use Channels : 2
    Port : UltraDMA-2 / ATA33
    Port : UltraDMA-2 / ATA33

    Disk Controller
    Model : Acer ICH8M (ICH8) 3 port SATA Controller
    Interface : SATA
    Revision : A4
    Maximum SATA Mode : G2 / SATA300
    Mobile : Yes
    Channels : 3
    In Use Channels : 1
    Port : G1 / SATA150

    Audio Device
    Model : Acer 82801H (ICH8) HD Audio Controller
    Revision : A4
    Type : HD (High-Definition) Audio
    Version : 1.00
    Number of In / Out / Bi-Directional Streams : 4 / 4 / 0
    Number of Serial Data Streams : 1

    Audio Codec
    Model : Realtek Semiconductor 0268h
    Revision : A4
    Version : 1.00
    Audio Channels : 6

    Audio Codec
    Model : Conexant Systems 2C06h
    Revision : A1
    Version : 1.00

    Audio Device
    Model : Acer RV635 Audio device [Radeon HD 3600 Series]
    Revision : A1
    Type : HD (High-Definition) Audio
    Version : 1.00
    Number of In / Out / Bi-Directional Streams : 0 / 1 / 0
    Number of Serial Data Streams : 1

    Audio Codec
    Model : AMD (ATI) AA01h
    Revision : A1
    Version : 1.00
    Audio Channels : 2

    USB Controller 1
    Model : Acer 82801H (ICH8) USB UHCI #4
    Revision : A4
    Version : 1.10
    Interface : UHCI
    Channels : 2
    Speed : 48MHz
    Supported Speed(s) : Low (1.5Mbps) Full (12Mbps)
    Legacy Emulation Enabled : No

    USB Controller 2
    Model : Acer 82801H (ICH8) USB UHCI #5
    Revision : A4
    Version : 1.10
    Interface : UHCI
    Channels : 2
    Speed : 48MHz
    Supported Speed(s) : Low (1.5Mbps) Full (12Mbps)
    Legacy Emulation Enabled : No

    USB Controller 3
    Model : Acer 82801H (ICH8) USB2 EHCI #2
    Revision : A4
    Version : 2.00
    Specification : 1.00
    Interface : EHCI
    Channels : 4
    Companion Controllers : 2
    Supported Speed(s) : Low (1.5Mbps) Full (12Mbps) High (480Mbps)
    Addressing Support : 64-bit
    Legacy Emulation Enabled : No

    USB Controller 4
    Model : Acer 82801H (ICH8) USB UHCI #1
    Revision : A4
    Version : 1.10
    Interface : UHCI
    Channels : 2
    Speed : 48MHz
    Supported Speed(s) : Low (1.5Mbps) Full (12Mbps)
    Legacy Emulation Enabled : No

    USB Controller 5
    Model : Acer 82801H (ICH8) USB UHCI #2
    Revision : A4
    Version : 1.10
    Interface : UHCI
    Channels : 2
    Speed : 48MHz
    Supported Speed(s) : Low (1.5Mbps) Full (12Mbps)
    Legacy Emulation Enabled : No

    USB Controller 6
    Model : Acer 82801H (ICH8) USB UHCI #3
    Revision : A4
    Version : 1.10
    Interface : UHCI
    Channels : 2
    Speed : 48MHz
    Supported Speed(s) : Low (1.5Mbps) Full (12Mbps)
    Legacy Emulation Enabled : No

    USB Controller 7
    Model : Acer 82801H (ICH8) USB2 EHCI #1
    Revision : A4
    Version : 2.00
    Specification : 1.00
    Interface : EHCI
    Channels : 6
    Companion Controllers : 3
    Supported Speed(s) : Low (1.5Mbps) Full (12Mbps) High (480Mbps)
    Addressing Support : 64-bit
    Legacy Emulation Enabled : No

    FireWire/1394 Controller 1
    Model : Acer R5C832 IEEE-1394 Controller
    Revision : A6
    Version : 1.10
    Interface : OHCI
    Enhanced Support : Yes
    Channels : 64
    Speed : 400MHz

    System SMBus Controller 1
    Model : Intel 801xx/63xx SMBus
    Version : 0.03
    Specification : 2.00
    Advanced TCO Mode Enabled : Yes
    Slave Device Enabled : Yes
    PEC Support : Yes
    Speed : 100kHz

    Expansion Slot(s)
    J6C1 : PCIe x16 PME Hot-Plug Available
    J8C1 : PCIe x1 PME Hot-Plug Available
    J7C1 (1h) : PCIe x1 PME Hot-Plug Available
    J8D1 (2h) : PCIe x1 PME Hot-Plug Available
    J8B1 (3h) : PCI 32-bit +5V +3.3V CardBus ModemRing PME i2c/SMBus Full-Length Available
    J9B1 (4h) : PCI 32-bit +5V +3.3V CardBus ModemRing PME i2c/SMBus Full-Length Available

    Port Connector(s)
    PS/2 - Keyboard : Keyboard / PS/2
    PS/2 - Mouse : Mouse / PS/2
    USB - USB 1 : USB / USB
    USB - USB 2 : USB / USB
    USB - USB 3 : USB / USB
    LAN - Network : Network / RJ-45
    J2H2 - OnBoard Primary IDE : ATA
    J2H1 - OnBoard Secondary IDE : ATA

    Performance Tips
    Notice 224 : SMBIOS/DMI information may be inaccurate.
    Warning 2507 : Mainboard has too few memory slots. Upgrading the memory may be difficult or expensive.
    Warning 2508 : All memory slots are full. Upgrading the memory may be difficult or expensive.
    Tip 2 : Double-click tip or press Enter while a tip is selected for more information about the tip.
  6. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,550   +18

    Filesharing programs open a hole through your firewall, thus your security has been compromised, allowing whatever nasties are running on the computers of those with whom you are filesharing to have direct access to your computer.

    Filesharing programs present a constant threat to your security and stability.
    Please read this thread http://www.techspot.com/vb/topic124748.html
    and follow the link Kritius provides to Guidelines for P2P Programs.

    Based upon the fact that you are running uTorrent, (or any other Filesharing program) I again would strongly recommend turning to the 8 Steps.
    Honestly, on this I hope I am wrong, for your sake, but I strongly suspect that this is the issue.

    You will need to uninstall and not reinstall or use filesharing programs while in the process of getting checked up and/or cleaned up.
    I would strongly recommend that if you absolutely must use them afterward, that you do so from inside a "virtual machine" such as Sandboxie!
    You can learn more about Sandboxie by using the search function here, or checking this download link...
    http://www.techspot.com/downloads/3362-sandboxie.html
  7. smint

    smint TS Rookie Topic Starter

    I have aquired a new AV and FW so time will tell if it works or not. I will update this thread if still get these bluescreens.
  8. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,550   +18

    A couple of cautions...
    You should only have one av installed on your machine.
    You should only have one firewall installed...

    The reason is the same ...
    Two or more packages will conflict with each other, leaving you less secure, not more.
    The issue was not your av or firewall per se...
    but the way you opened your computer up to the possibility of infection.

    Again... I am not saying you are infected.
    I am saying that the nature of your errors,
    and the fact that you use a filesharing program (uTorrent) are pointers to the possibility,
    and it was for your safety /security that I made the above recommendations.

    Again... I hope that I am wrong in thinking this is a possibility.
    But I believe that, if you follow the 8 steps, and then work with a malware expert if you are infected, then the afd.sys bluescreens may also resolve.
  9. smint

    smint TS Rookie Topic Starter

    but what do the dumpfiles tell you?
  10. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,550   +18

    The dump files are a very important part of the diagnostic process...
    But the information is partial.
    You have provided added information.
    My initial comments stand and have been reinforced by that additional information...
    I would add
    Because malware can generate these kinds of error, causing other drivers to misbehave,
    Because filesharing (Torrent software) is a major source of malware,
    and because you acknowledge using uTorrent,
    and because AFD.SYS should not be giving you this kind of problem...
    I am urging you to do the eight steps per above. (my 4th point in the initial reply)

    After you have completed the steps, and you have been given a clean bill of health by the malware experts, if you still have issues we can look for something else... I would suggest starting a new thread at that time...

    Without the 8-steps crucial issues cannot be ruled out, and we could just be chasing our tails. (Both of us wasting our time!)
    So, until then, I am going to unsubscribe from this thread.

    Good Luck.
  11. smint

    smint TS Rookie Topic Starter

    Thank you for a good answer. I will try those eight steps if changing AV and FW doesnt help. If it helps I will tell here so others can learn.
     
  12. smint

    smint TS Rookie Topic Starter

  13. smint

    smint TS Rookie Topic Starter

    according to http://www.file.net/process/afd.sys.html both of my afd.sys files are genuine windows xp.

    the link you gave me earlier report that uTorrent is safe.

    By the way. Where is the eight steps you are talking about? Thanks.
  14. smint

    smint TS Rookie Topic Starter

    I* think I know the problem!!! the AFD.SYS located in system32/drivers is dated 2004!!!!
  15. snowchick7669

    snowchick7669 TS Maniac Posts: 698

    B00kwyrm is on the right track :)

    Just a side note - you say that this only happens when you are using Opera for web use. Have you tried using another web browser, Mozilla Firefox for example?
  16. snowchick7669

    snowchick7669 TS Maniac Posts: 698

    smint,

    I would suggest running this 8 step guide (click on the blue writing), as B00kwyrm suggested.

    It sounds like your issue is the NIC which is why B00kwyrm asked you to update your drivers, but this can happen if you have been hijacked by malware as they will be playing silly buggers in the backround
  17. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,550   +18

    @ Snowchick... thanks for the input!

    @ Smint...
    1. the created date on afd.sys should be 2004. The date you see in the "date modified" column of Windows explorer would be the date you updated to SP3.
    2. the file uTorrent may be "safe" to have on your computer, but only if you do not use it online. It is the process of filesharing that is the issue! The first time you use it to download a file, you will have configured your system to allow uTorrent to bypass your firewall's protections. You will have opened up your files for sharing (see articles in many places on why File and Print Sharing should not be enabled while on the internet), and you will be exposing yourself to whatever nasties are on the computers of those with whom you are sharing files.

    Re: filesharing - This is the last I will have to say on this subject. The vast majority of what may be obtained with Torrent sites is in one way or another in violation of copyright. Using the software, as explained above, opens you to the high likelihood of having problems with malware. If you wish to use such software, there are safeguards, and I have seen some here willing to use it, but I am not, and I will only recommend its discontinuance and uninstallation.

    3. In note two I gave you some specific steps to take... including links to those tools.
    4. In note four I offered an additional tool (link to a thread on resolving NIC issues).

    It seems to me that you really do not want my help, so I am going to sit back now and deal with other things. I am busy from now through the weekend anyway... so I'll check back in next week.
  18. fundutzi

    fundutzi TS Rookie

    This issue (afd.sys blue screen) occurred on my Win 7 x86 and Win 7 x64 install. Asus P5KC MB, 4GB Ram, Intel CPU E6750 Duo.

    I tried many different options here.

    The fix,
    Disable my onboard NIC (Atheros).
    Used Broadcom PCI-E NIC. Solved it for me.

    Hope it helps someone.
  19. smint

    smint TS Rookie Topic Starter

    Well. I can now rule out the memory because it passed memtest for the whole night.
  20. snowchick7669

    snowchick7669 TS Maniac Posts: 698

    Have you done anything with your NIC at all?
  21. smint

    smint TS Rookie Topic Starter

    well. Actually yes. A long time ago I did some research and I ended up updating my wired network card but I still got those bluescreens.

    When I got answer on this thread I tried to disable my wireless network card and change firewall and I didnt get any bluescreens after that but I only got a couple each week anyway so I dont know if that did the trick. I then deleted afd.sys to see if it would change to a newer version but then my internet stopped working so I ended up doing a fresh windows xp install and new anti virus + firewall, I havent had any bluescreens yet so I still dont know if it has done the trick. I will have to use my laptop like usual and leave it on always like normal and see if we have eliminated the problem. If not I will do all of the above mentioned.
  22. snowchick7669

    snowchick7669 TS Maniac Posts: 698

    Well if it was virus/malware related then a fresh XP install may have got rid of this issue. But still, persistent malware can also find ways around this, its never a 100% sure fix.

    Let us know if you see any more problems
  23. smint

    smint TS Rookie Topic Starter

    Yea, I will. Thanks alot.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.