Afd.sys bluescreen. Dump inside thread

[smint]

im getting the same afd.sys bluescreen randomly about 2-3 times each week. Can anyone of you help me with the dumpfile?

 

[B00kWyrm]

You are running the latest service pack of XP (SP3), so this should not be happening.
File afd.sys is a trustworthy file from Microsoft.

The Stop 0xD1 messages indicates that the system attempted to access pageable memory using a kernel process IRQL that was too high.

Drivers that have used improper addresses typically cause this error.
• Stop 0xD1 messages can occur after installing faulty drivers or system services.

The most likely culprits at this point...
1. Drivers for your network card... Since these use afd.sys, make sure they are updated.
2. Firewall software... same...
3. MajorGeeks offers a way of repairing the WinSock... http://www.majorgeeks.com/download4372.html
4. Check for Malware... Start with the three stickies (below the announcement) by Julio here...
https://www.techspot.com/vb/menu28.html
If you decide to proceed with cleaning, follow the eight steps very carefully, here...
https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

If you want us to explore further, attach three or four more of your most recent minidumps to your next post.

Added note about Memtest...
It might not hurt to run Memtest before running through the other possible culprits... check this tutorial...
https://www.techspot.com/vb/topic62524.html

 

[smint]

Thank you alot for your help.

I have tried to update my network drivers but with no luck. I was thinking about trying a new firewall as the next step so I will try another one.

I am pretty sure its not the memory, because I can run Orthos while stressing both cores + memory for 15 mins easily. I can also game forever without any negative symptoms. I will load in my UBCD and start memtest before I go to sleep tonight to make sure its not the memory.

I have compressed the last 5 minidumps in one archive for you. The Dumpfile in my first post is the most recent. The five in this archive does not include the most recent dumpfile.

 

[B00kWyrm]

All but one of your errors was the same (0xD1 caused by afd.sys)
The remaining is 0x8E also caused by afd.sys.

0x8E points to faulty hardware or drivers. The hardware varies from modems, video cards, USB device to memory or sound cards. Sometimes it proves to be hardware that it is not compatible with Windows XP.

I have seen at least one report of file-sharing software associated with this problem.
I have also seen specific software (AV and Firewall) associated with this problem.

So...
1. Is this a new build, or have you recently upgraded any hardware or software?
Please tell us more about your system... Hardware: MB, CPU, Cards, Memory, PSU

2. You say that the system is stable with gaming: When does it crash?

Above recommendations remain; the new information is simply confirming the previous, with the addition of a single instance of a different bugcheck code caused by the same driver.


Check this thread for resolving NIC driver issues...
https://www.techspot.com/vb/topic128186.html
Raybay and Lookingaround give great guidance!

 

[smint]

The computer is a Acer Aspire 5720ZG with following specs.

Intel Pentium Dual-Core T2310 @ 1,46 GHz
15,4" widescreen (1280 x 800 piksler)
2 GB DDR2
250 GB harddisk (5400 rpm)
nVidia GeForce 8400M GS grafikk 256 MB
54 Mbps WLAN (b/g)
Gigabit LAN + modem
4 x USB, FireWire, IR
1 ExpressCard/54 kortplass
card reader SD, MMS, MS/PRO, xD
S-Video, VGA og DVI ut, lyd inn/ut
web camera and microphone

I have exchanged the CPU for a T7700 Core 2 Duo and installed a HD3650 256mb graphic card. I can game flawlessly for eternity it seems like.

If I were to guess when it crashes the most I would say while browsing in opera. It rarely happen when I am gaming.

The weird thing is that I think I have the exact same problem on my stationary and it uses the same AV and FW + uTorrent. So you might be correct about it having to do with an application.


EDIT: SiSoftware Sandra

System Chassis
Manufacturer : Acer
Can be locked : No
Version : V1.42
Power Cord(s) : 1
Serial Number : Chassis Serial Number
Boot-up State : Safe
Power State : Safe
Thermal State : Safe
Security State : External Interface Locked-out

Mainboard
Manufacturer : Acer
Multi-Processor (MP) Support : No
MPS Version : 1.40
Model : eMachine
Type : Mainboard
Version : V1.42
Serial Number : Base Board Serial Number
Asset Tag : Base Board Asset Tag
Location in Chassis : Base Board Chassis Location

System Mainboard Properties
Removable : No
Replaceable : Yes
Hot Swap : No

On-board Devices
Intel Video Graphics Controller : Video Adapter (Enabled)
Broadcom Lan Controller : Ethernet Adapter (Enabled)

System Memory Controller
Location : Mainboard
Error Correction Capability : None
Number of Memory Slots : 2
Maximum Installable Memory : 4GB
BANK 0 - DIMM0 : Samsung 0x4D342037305432393533455A332D43453620 0x763104BA Unknown DIMM Synchronous DDR2 1GB/64 @ 667MHz
BANK 2 - DIMM2 : Samsung 0x4D342037305432393533455A332D43453620 0x76310491 Unknown DIMM Synchronous DDR2 1GB/64 @ 667MHz

Chipset
Model : Acer Mobile PM965/GM965/GL960 Express Processor to DRAM Controller
Revision : A4
Bus : Intel AGTL+
Front Side Bus Speed : 4x 200MHz (800MHz)
Maximum FSB Speed : 4x 200MHz (800MHz)
Width : 64-bit
I/O Queue Depth : 12 request(s)
Maximum Bus Bandwidth : 6.25GB/s

Chipset 1 Hub Interface
Type : DMI (Direct Media Interface)
Version : 1.00
Number of Ports : 4
In/Out Width : 4-bit / 4-bit
Multiplier : 3x
Speed : 1x 100MHz (100MHz)

Logical/Chipset Memory Banks
Bank 0 : 512MB DDR2 SO-DIMM 5-5-5-15 3-20-5-3 1T
Bank 1 : 512MB DDR2 SO-DIMM 5-5-5-15 3-20-5-3 1T
Bank 4 : 512MB DDR2 SO-DIMM 5-5-5-15 3-20-5-3 1T
Bank 5 : 512MB DDR2 SO-DIMM 5-5-5-15 3-20-5-3 1T
Maximum Installable Memory : 4GB
Supported Memory Types : DDR2 SO-DIMM
Channels : 2
Memory Bus Speed : 2x 333MHz (666MHz)
Maximum Memory Speed : 2x 333MHz (666MHz)
Multiplier : 5/3x
Width : 64-bit
Memory Controller in Processor : No
FMA - Fast Memory Access Support : No
Refresh Rate : 7.80µs
Power Save Mode : No
Fixed Hole Present : No
Maximum Memory Bus Bandwidth : 10.41GB/s

APIC 1
Version : 2.00
Multiplier : 1/2x
Maximum Interrupts : 24
IRQ Handler Engaged : Yes
Enhanced Support : Yes

Memory Module
Manufacturer : Samsung
Model : M4 70T2953EZ3-CE6
Serial Number : 763104BA
Type : 1GB DDR2 SO-DIMM
Technology : 16x(64Mx8)
Speed : PC2-5300U DDR2-666
Standard Timings : 5.0-5-5-15 3-20-5-3
Version : 1.02
Memory DC Line : 1.80V
Set Timing @ 333MHz : 5.0-5-5-15 3-20-5-3
Set Timing @ 267MHz : 4.0-4-4-12 2-16-4-2
Set Timing @ 200MHz : 3.0-3-3-9 2-12-3-2

Memory Module
Manufacturer : Samsung
Model : M4 70T2953EZ3-CE6
Serial Number : 76310491
Type : 1GB DDR2 SO-DIMM
Technology : 16x(64Mx8)
Speed : PC2-5300U DDR2-666
Standard Timings : 5.0-5-5-15 3-20-5-3
Version : 1.02
Memory DC Line : 1.80V
Set Timing @ 333MHz : 5.0-5-5-15 3-20-5-3
Set Timing @ 267MHz : 4.0-4-4-12 2-16-4-2
Set Timing @ 200MHz : 3.0-3-3-9 2-12-3-2

Environment Monitor 1
Model : Intel Core CPU [P1, C2, T100]
Version : 15.10
Mainboard Specific Support : No

Temperature Sensor(s)
CPU Temperature : 57.00°C td

System Bus(es) on Hub 1
Version : 2.30
System Bus 0 : PCI
System Bus 1 : PCIe 1.00 x16 2.5Gbps
System Bus 2 : PCIe 1.00 x1 2.5Gbps
System Bus 4 : PCIe 1.00 x1 2.5Gbps
System Bus 5 : PCIe 1.00 x1 2.5Gbps
System Bus 6 : PCIe 1.00 x1 2.5Gbps
System Bus 7 : PCI66

LPC Hub Controller 1
Model : Acer ICH8M-E (ICH8) LPC Interface Controller
Revision : A4
ACPI Power Management Enabled : Yes
Advanced TCO Mode Support : Yes
Advanced TCO Mode Enabled : No
High Precision Timer Enabled : Yes
Number of Precision Timers : 3
System Timer : 14.32MHz
Delayed Transaction Enabled : Yes

Disk Controller
Model : Acer 82801H (ICH8) Ultra ATA Storage Controllers
Interface : ATA
Revision : A4
Maximum UDMA Mode : UltraDMA-5 / ATA100
Mobile : Yes
Channels : 4
In Use Channels : 2
Port : UltraDMA-2 / ATA33
Port : UltraDMA-2 / ATA33

Disk Controller
Model : Acer ICH8M (ICH8) 3 port SATA Controller
Interface : SATA
Revision : A4
Maximum SATA Mode : G2 / SATA300
Mobile : Yes
Channels : 3
In Use Channels : 1
Port : G1 / SATA150

Audio Device
Model : Acer 82801H (ICH8) HD Audio Controller
Revision : A4
Type : HD (High-Definition) Audio
Version : 1.00
Number of In / Out / Bi-Directional Streams : 4 / 4 / 0
Number of Serial Data Streams : 1

Audio Codec
Model : Realtek Semiconductor 0268h
Revision : A4
Version : 1.00
Audio Channels : 6

Audio Codec
Model : Conexant Systems 2C06h
Revision : A1
Version : 1.00

Audio Device
Model : Acer RV635 Audio device [Radeon HD 3600 Series]
Revision : A1
Type : HD (High-Definition) Audio
Version : 1.00
Number of In / Out / Bi-Directional Streams : 0 / 1 / 0
Number of Serial Data Streams : 1

Audio Codec
Model : AMD (ATI) AA01h
Revision : A1
Version : 1.00
Audio Channels : 2

USB Controller 1
Model : Acer 82801H (ICH8) USB UHCI #4
Revision : A4
Version : 1.10
Interface : UHCI
Channels : 2
Speed : 48MHz
Supported Speed(s) : Low (1.5Mbps) Full (12Mbps)
Legacy Emulation Enabled : No

USB Controller 2
Model : Acer 82801H (ICH8) USB UHCI #5
Revision : A4
Version : 1.10
Interface : UHCI
Channels : 2
Speed : 48MHz
Supported Speed(s) : Low (1.5Mbps) Full (12Mbps)
Legacy Emulation Enabled : No

USB Controller 3
Model : Acer 82801H (ICH8) USB2 EHCI #2
Revision : A4
Version : 2.00
Specification : 1.00
Interface : EHCI
Channels : 4
Companion Controllers : 2
Supported Speed(s) : Low (1.5Mbps) Full (12Mbps) High (480Mbps)
Addressing Support : 64-bit
Legacy Emulation Enabled : No

USB Controller 4
Model : Acer 82801H (ICH8) USB UHCI #1
Revision : A4
Version : 1.10
Interface : UHCI
Channels : 2
Speed : 48MHz
Supported Speed(s) : Low (1.5Mbps) Full (12Mbps)
Legacy Emulation Enabled : No

USB Controller 5
Model : Acer 82801H (ICH8) USB UHCI #2
Revision : A4
Version : 1.10
Interface : UHCI
Channels : 2
Speed : 48MHz
Supported Speed(s) : Low (1.5Mbps) Full (12Mbps)
Legacy Emulation Enabled : No

USB Controller 6
Model : Acer 82801H (ICH8) USB UHCI #3
Revision : A4
Version : 1.10
Interface : UHCI
Channels : 2
Speed : 48MHz
Supported Speed(s) : Low (1.5Mbps) Full (12Mbps)
Legacy Emulation Enabled : No

USB Controller 7
Model : Acer 82801H (ICH8) USB2 EHCI #1
Revision : A4
Version : 2.00
Specification : 1.00
Interface : EHCI
Channels : 6
Companion Controllers : 3
Supported Speed(s) : Low (1.5Mbps) Full (12Mbps) High (480Mbps)
Addressing Support : 64-bit
Legacy Emulation Enabled : No

FireWire/1394 Controller 1
Model : Acer R5C832 IEEE-1394 Controller
Revision : A6
Version : 1.10
Interface : OHCI
Enhanced Support : Yes
Channels : 64
Speed : 400MHz

System SMBus Controller 1
Model : Intel 801xx/63xx SMBus
Version : 0.03
Specification : 2.00
Advanced TCO Mode Enabled : Yes
Slave Device Enabled : Yes
PEC Support : Yes
Speed : 100kHz

Expansion Slot(s)
J6C1 : PCIe x16 PME Hot-Plug Available
J8C1 : PCIe x1 PME Hot-Plug Available
J7C1 (1h) : PCIe x1 PME Hot-Plug Available
J8D1 (2h) : PCIe x1 PME Hot-Plug Available
J8B1 (3h) : PCI 32-bit +5V +3.3V CardBus ModemRing PME i2c/SMBus Full-Length Available
J9B1 (4h) : PCI 32-bit +5V +3.3V CardBus ModemRing PME i2c/SMBus Full-Length Available

Port Connector(s)
PS/2 - Keyboard : Keyboard / PS/2
PS/2 - Mouse : Mouse / PS/2
USB - USB 1 : USB / USB
USB - USB 2 : USB / USB
USB - USB 3 : USB / USB
LAN - Network : Network / RJ-45
J2H2 - OnBoard Primary IDE : ATA
J2H1 - OnBoard Secondary IDE : ATA

Performance Tips
Notice 224 : SMBIOS/DMI information may be inaccurate.
Warning 2507 : Mainboard has too few memory slots. Upgrading the memory may be difficult or expensive.
Warning 2508 : All memory slots are full. Upgrading the memory may be difficult or expensive.
Tip 2 : Double-click tip or press Enter while a tip is selected for more information about the tip.

 

[B00kWyrm]

If I were to guess when it crashes the most I would say while browsing in opera. It rarely happen when I am gaming.

The weird thing is that I think I have the exact same problem on my stationary and it uses the same AV and FW + uTorrent. So you might be correct about it having to do with an application.

Filesharing programs open a hole through your firewall, thus your security has been compromised, allowing whatever nasties are running on the computers of those with whom you are filesharing to have direct access to your computer.

Filesharing programs present a constant threat to your security and stability.
Please read this thread https://www.techspot.com/vb/topic124748.html
and follow the link Kritius provides to Guidelines for P2P Programs.

Based upon the fact that you are running uTorrent, (or any other Filesharing program) I again would strongly recommend turning to the 8 Steps.
Honestly, on this I hope I am wrong, for your sake, but I strongly suspect that this is the issue.

You will need to uninstall and not reinstall or use filesharing programs while in the process of getting checked up and/or cleaned up.
I would strongly recommend that if you absolutely must use them afterward, that you do so from inside a "virtual machine" such as Sandboxie!
You can learn more about Sandboxie by using the search function here, or checking this download link...
https://www.techspot.com/downloads/3362-sandboxie.html

 

[smint]

I have aquired a new AV and FW so time will tell if it works or not. I will update this thread if still get these bluescreens.

 

[B00kWyrm]

A couple of cautions...
You should only have one av installed on your machine.
You should only have one firewall installed...

The reason is the same ...
Two or more packages will conflict with each other, leaving you less secure, not more.
The issue was not your av or firewall per se...
but the way you opened your computer up to the possibility of infection.

Again... I am not saying you are infected.
I am saying that the nature of your errors,
and the fact that you use a filesharing program (uTorrent) are pointers to the possibility,
and it was for your safety /security that I made the above recommendations.

Again... I hope that I am wrong in thinking this is a possibility.
But I believe that, if you follow the 8 steps, and then work with a malware expert if you are infected, then the afd.sys bluescreens may also resolve.

 

[smint]

but what do the dumpfiles tell you?

 

[B00kWyrm]

The dump files are a very important part of the diagnostic process...
But the information is partial.
You have provided added information.
My initial comments stand and have been reinforced by that additional information...

All but one of your errors was the same (0xD1 caused by afd.sys)
The remaining is 0x8E also caused by afd.sys.

0x8E points to faulty hardware or drivers. The hardware varies from modems, video cards, USB device to memory or sound cards. Sometimes it proves to be hardware that it is not compatible with Windows XP.

I have seen at least one report of file-sharing software associated with this problem.
I have also seen specific software (AV and Firewall) associated with this problem.

I would add

0xD1 messages indicates that the system attempted to access pageable memory using a kernel process IRQL that was too high. Drivers that have used improper addresses typically cause this error.

Because malware can generate these kinds of error, causing other drivers to misbehave,
Because filesharing (Torrent software) is a major source of malware,
and because you acknowledge using uTorrent,
and because AFD.SYS should not be giving you this kind of problem...
I am urging you to do the eight steps per above. (my 4th point in the initial reply)

After you have completed the steps, and you have been given a clean bill of health by the malware experts, if you still have issues we can look for something else... I would suggest starting a new thread at that time...

Without the 8-steps crucial issues cannot be ruled out, and we could just be chasing our tails. (Both of us wasting our time!)
So, until then, I am going to unsubscribe from this thread.

Good Luck.

 

[smint]

Thank you for a good answer. I will try those eight steps if changing AV and FW doesnt help. If it helps I will tell here so others can learn.

 

[smint]

well, according to http://www.file.net/process/afd.sys.html my afd.sys files are genuine windows xp.

 

[smint]

according to http://www.file.net/process/afd.sys.html both of my afd.sys files are genuine windows xp.

the link you gave me earlier report that uTorrent is safe.

By the way. Where is the eight steps you are talking about? Thanks.

 

[smint]

I* think I know the problem!!! the AFD.SYS located in system32/drivers is dated 2004!!!!

 

[snowchick7669]

B00kwyrm is on the right track

Just a side note - you say that this only happens when you are using Opera for web use. Have you tried using another web browser, Mozilla Firefox for example?

 

[snowchick7669]

smint,

I would suggest running this 8 step guide (click on the blue writing), as B00kwyrm suggested.

It sounds like your issue is the NIC which is why B00kwyrm asked you to update your drivers, but this can happen if you have been hijacked by malware as they will be playing silly buggers in the backround

 

[B00kWyrm]

@ Snowchick... thanks for the input!

@ Smint...
1. the created date on afd.sys should be 2004. The date you see in the "date modified" column of Windows explorer would be the date you updated to SP3.
2. the file uTorrent may be "safe" to have on your computer, but only if you do not use it online. It is the process of filesharing that is the issue! The first time you use it to download a file, you will have configured your system to allow uTorrent to bypass your firewall's protections. You will have opened up your files for sharing (see articles in many places on why File and Print Sharing should not be enabled while on the internet), and you will be exposing yourself to whatever nasties are on the computers of those with whom you are sharing files.

Re: filesharing - This is the last I will have to say on this subject. The vast majority of what may be obtained with Torrent sites is in one way or another in violation of copyright. Using the software, as explained above, opens you to the high likelihood of having problems with malware. If you wish to use such software, there are safeguards, and I have seen some here willing to use it, but I am not, and I will only recommend its discontinuance and uninstallation.

3. In note two I gave you some specific steps to take... including links to those tools.
4. In note four I offered an additional tool (link to a thread on resolving NIC issues).

It seems to me that you really do not want my help, so I am going to sit back now and deal with other things. I am busy from now through the weekend anyway... so I'll check back in next week.

 

[fundutzi]

This issue (afd.sys blue screen) occurred on my Win 7 x86 and Win 7 x64 install. Asus P5KC MB, 4GB Ram, Intel CPU E6750 Duo.

I tried many different options here.

The fix,
Disable my onboard NIC (Atheros).
Used Broadcom PCI-E NIC. Solved it for me.

Hope it helps someone.

 

[smint]

Well. I can now rule out the memory because it passed memtest for the whole night.

 

[snowchick7669]

Have you done anything with your NIC at all?

 

[smint]

well. Actually yes. A long time ago I did some research and I ended up updating my wired network card but I still got those bluescreens.

When I got answer on this thread I tried to disable my wireless network card and change firewall and I didnt get any bluescreens after that but I only got a couple each week anyway so I dont know if that did the trick. I then deleted afd.sys to see if it would change to a newer version but then my internet stopped working so I ended up doing a fresh windows xp install and new anti virus + firewall, I havent had any bluescreens yet so I still dont know if it has done the trick. I will have to use my laptop like usual and leave it on always like normal and see if we have eliminated the problem. If not I will do all of the above mentioned.

 

[snowchick7669]

Well if it was virus/malware related then a fresh XP install may have got rid of this issue. But still, persistent malware can also find ways around this, its never a 100% sure fix.

Let us know if you see any more problems

 

[smint]

Yea, I will. Thanks alot.