TechSpot

Windows XP Stop Errors 0x1000000a

By jstaley
Nov 14, 2006
  1. All,

    Having an issue at a PC that has been getting the following.

    The computer has rebooted from a bugcheck. The bugcheck was: 0x1000000a (0x00000016, 0x0000001c, 0x00000000, 0x804fa04e).

    This has happened 4 times so far. I am attachign the associated mini-dumps. Any ideas?

    Also, what tools do you guys use to inspect the dump files? Just interested.

    Josh
     

    Attached Files:

  2. xxdanielxx

    xxdanielxx TS Rookie Posts: 1,069

    all of your minidumps point to

    COMPANY NAME: Panda Software
    FILE ATTRIBUTES: Archive
    FILE DESCRIPTION: Panda TDI Filter
    FILE FOLDER: %SYSTEM%\drivers
    FILE NAME: netfltdi.sys
    FILE SIZE: 36,224 KB
    FILE VERSION: 0.06.4.1
    INTERNAL NAME: netfltdi.sys
    MD5 SIGNATURE: 09cf68e96e64d2bcd8fb4f7c96272eed
    ORIGINAL FILE NAME: netfltdi.sys
    PRODUCT VERSION: 0.06.4.1
    SPECIAL FOLDER: SYSTEM

    try to remove it and then post back if it fixes your problem
     
  3. smore9648

    smore9648 TS Rookie Posts: 697

    If I remember correctly panda is a firewall or AV program
     
  4. xxdanielxx

    xxdanielxx TS Rookie Posts: 1,069

    i think your are right

    oh yes i remember AV
     
  5. jstaley

    jstaley TS Rookie Topic Starter

    What software or program do you guys use to read minidump files?

    Yes, They have Panda Anti-virus installed. Going to call their tech support and see what they say. It is happening on several pc's (about 4) that all have Panda AV. One of them recently started getting a new BSoD, but it will not restart from that one, it just keeps going back to the blue screen and will not boot into Windows. Thanks for all your help!

    Josh
     
  6. xxdanielxx

    xxdanielxx TS Rookie Posts: 1,069

    the program is called windbg
     
  7. jstaley

    jstaley TS Rookie Topic Starter

    Ah, I got it now from the MSDN site. Thanks Daniel. Now I know what to look to get a rough idea of what might be happening. I see in a lot of cpc2004's post that he puts memory issues, power supply issues and stuff like that in there. Is there a way to have the debug tool show that or is it something you just have to know to look for? I am interested in learning more, so if there is a good tutorial or book out there, can you post that here. You guys have been a huge help and I greatly appreciate the help with my problem. I am waiting on a reply from Panda, since this is happening on 4 machines, it seems to me that it must be an update or bug in the program and not just an isolated issue.

    Since this is happening on several machines, could it be related to a Windows Update from around October 3rd? I will check and see what changed around that date and post back just for general knowledge. Hopefully I will find a trend or pattern to the madness. Let you know what I find!
     
  8. xxdanielxx

    xxdanielxx TS Rookie Posts: 1,069

  9. cpc2004

    cpc2004 TS Evangelist Posts: 1,994

    Same problem is occurred at another forum. I post the debug report of this problem to confirm that both problem is identical. The timestamp of the failing module and stack trace are identical. The culprit is Panda Firewall.

    BugCheck 1000000A, {16, 1c, 0, 804fa04e}

    *** WARNING: Unable to verify timestamp for NETFLTDI.SYS
    *** ERROR: Module load completed but symbols could not be loaded for NETFLTDI.SYS
    Probably caused by : NETFLTDI.SYS ( NETFLTDI+25e1 )

    Followup: MachineOwner

    *******************************************************************************
    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 00000016, memory referenced
    Arg2: 0000001c, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: 804fa04e, address which referenced memory

    Debugging Details:
    ------------------
    READ_ADDRESS: 00000016
    CURRENT_IRQL: 1c

    FAULTING_IP:
    nt!KeSetEvent+32
    804fa04e 66394616 cmp word ptr [esi+16h],ax

    CUSTOMER_CRASH_COUNT: 1
    DEFAULT_BUCKET_ID: DRIVER_FAULT
    BUGCHECK_STR: 0xA
    PROCESS_NAME: System
    LAST_CONTROL_TRANSFER: from aa696f89 to 804fa04e

    STACK_TEXT:
    f8910bd0 aa696f89 81a0b74c 00000000 00000000 nt!KeSetEvent+0x32
    f8910bf4 aa6970bd 8146a008 c000023a 00000000 tcpip!TCPDataRequestComplete+0x93
    f8910c24 aa67323d 8146a008 81a0b764 8146a0b8 tcpip!TCPSendData+0xa6
    f8910c40 804eef95 81c65320 8146a008 8146a0dc tcpip!TCPDispatchInternalDeviceControl+0x51
    f8910c50 f86775e1 81e972e0 81a77e90 8146a0c0 nt!IopfCallDriver+0x31
    WARNING: Stack unwind information not available. Following frames may be wrong.
    f8910c64 f8678398 8146a008 81c109a8 f867811a NETFLTDI+0x25e1
    f8910c88 f867c15b 8146a008 8146a0c0 81c109a8 NETFLTDI+0x3398
    f8910ca8 804eef95 81c108f0 8146a008 81e73c70 NETFLTDI+0x715b
    f8910cb8 aa649859 818ecd18 81e73c70 806e4900 nt!IopfCallDriver+0x31
    f8910cd4 aa64aa7e 8146a008 00000000 00000048 netbt!TdiSend+0x135
    f8910d24 aa647c10 81e73c50 00000000 00000000 netbt!SessionStartupContinue+0x342
    f8910d44 804f14c6 818fcb98 81a37a08 ffa5a008 netbt!TcpConnectComplete+0x1f
    f8910d74 f86771e3 00000000 821cdd18 00000000 nt!IopfCompleteRequest+0xa2
    f8910dac 805ce7ce 00000000 00000000 00000000 NETFLTDI+0x21e3
    f8910ddc 8054524e f8676904 00000000 00000000 nt!PspSystemThreadStartup+0x34
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

    STACK_COMMAND: kb

    FOLLOWUP_IP:
    NETFLTDI+25e1
    f86775e1 ?? ???

    SYMBOL_STACK_INDEX: 5
    SYMBOL_NAME: NETFLTDI+25e1
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: NETFLTDI
    IMAGE_NAME: NETFLTDI.SYS
    DEBUG_FLR_IMAGE_TIMESTAMP: 43ec46d4
    FAILURE_BUCKET_ID: 0xA_NETFLTDI+25e1
    BUCKET_ID: 0xA_NETFLTDI+25e1

    Followup: MachineOwner
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...