Serious Error

[Jonno 92]

Hi all,
I'm new to this forum.

About 9months ago I put windows xp home edition on my new machine. 2 months after that, when uninstalling a program, it deleted some boot files, and the next time I turned my computer on, it wouldn't even load windows. So I had to boot from a windows xp prof. disc, and replace some files.. Thsi meant that my system was 1/2 home edition, 1/2 professional edition.
So last week i did a "update installation" usng a windows xp professional cd.

For about 3 months now, I've been randomly getting BSoD's and it's been saying IRQL_NOT_LESS_OR_EQUAL (I have all the technical info. written down if anyone wants me to type it up for an interpretation.)

In the past 2 weeks, however, i've been getting some "serious errors" Here is a picture of what I get when I turn my computer back on.

When I opened the minidump with Windbg and read it, I got this... It says something about false memory reference and IRQL_NOT_LESS_OR_EQUAL, so I think it looks reasonable easy to fix.. Just a minor little error with a referencing file..

Here is the bugcheck analysis. (I also have another 3 minidumps, but I'm guessing they'd all be about the exact same issue)

All help is appreciated

Thank you

-=({ ĴøŃñŎ™ })=-

 

[kimsland]

Hi Jonno 92
Looks as though you know the basics

In regards to the minidumps, do any of them point to an exact file, that's causing it. Please check.

Also to be certain it's not Windows corruption (highly likely)
It may be better for you to backup, and install Windows clean.
You can then make an image once all Drivers; Windows updates and software is installed.

Have you tried the simple checkdisk command

Manual steps to run Chkdsk from My Computer or Windows Explorer

• Open My Computer, and then right-click the hard disk that you want to check.
• Click Properties, and then click Tools.
• Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed

Use one of the following procedures:

• • To run Chkdsk in read-only mode, click Start.
• • To repair errors without scanning the volume for bad sectors, select the Automatically fix file system errors check box, and then click Start. (tick)
• • To repair errors, locate bad sectors, and recover readable information, select the Scan for and attempt recovery of bad sectors check box.

Note If one or more of the files on the hard disk are open, you will receive the following message:

The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?

Click Yes to schedule the disk check, and then restart your computer to start the disk check.

Wait until Chkdsk finishes Checking / Repairing any faults
Windows will then either restart your computer or continue loading Normally.

 

[Jonno 92]

this is one of the other dumps.. something about iexplore.exe
I installed IE7 yesterday.. could that have anything to do with it? Maybe uninstall IE7 and reinstall?...

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 000006a8, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804e7b50, address which referenced memory

Debugging Details:
------------------

ANALYSIS: Kernel with unknown size. Will force reload symbols with known size.
ANALYSIS: Force reload command: .reload /f ntoskrnl.exe=FFFFFFFF804D7000,214600,41108004
*** WARNING: Unable to verify timestamp for bcmwl5.sys
*** ERROR: Module load completed but symbols could not be loaded for bcmwl5.sys
ANALYSIS: kernel symbols have been forced reloaded due to unknown size.



READ_ADDRESS: 000006a8

CURRENT_IRQL: 2

FAULTING_IP:
nt!wcslen+8
804e7b50 668b08 mov cx,word ptr [eax]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: iexplore.exe

LAST_CONTROL_TRANSFER: from f790ad5a to 804e7b50

STACK_TEXT:
f79f1774 f790ad5a 000006a8 8608ca7c 860a9ba0 nt!wcslen+0x8
WARNING: Stack unwind information not available. Following frames may be wrong.
f79f17ac f79070e1 00000e58 f79f17e4 f6a68e87 DrvFltIp+0x4d5a
f79f17cc f79073a8 f79f1808 f79f1807 00000e58 DrvFltIp+0x10e1
f79f1818 f79080b9 00000e58 00000000 41365779 DrvFltIp+0x13a8
f79f186c f79091b5 85f1d8c8 00000e58 86077b18 DrvFltIp+0x20b9
f79f18d8 804e3d77 85f1d8c8 86077a60 8617c198 DrvFltIp+0x31b5
f79f18e8 ee21a82c 85f92210 86243370 00000000 nt!IopfCallDriver+0x31
f79f1924 f7908b44 8608c9f8 8617c198 00000a20 afd!AfdBChainedReceiveEventHandler+0x209
f79f1960 ee26312e 8619ea30 8617c198 00000a20 DrvFltIp+0x2b44
f79f19c0 ee2582f0 8617c198 00001080 85f92210 tcpip!IndicateData+0x98
f79f1a48 ee255ef9 85e60a38 8901010a 79573641 tcpip!TCPRcv+0xb5b
f79f1aa8 ee255b19 00000020 85e60a38 ee258076 tcpip!DeliverToUser+0x18e
f79f1b24 ee255836 ee295210 85e60a38 85d25844 tcpip!DeliverToUserEx+0x95f
f79f1bdc ee254922 85e60a38 85d25858 00000564 tcpip!IPRcvPacket+0x6cb
f79f1c1c ee25484d 00000000 85d1db48 85d25836 tcpip!ARPRcvIndicationNew+0x149
f79f1c58 f7439f45 85fcbbe0 00000000 f643ab40 tcpip!ARPRcvPacket+0x68
f79f1cac f643501d 00b63668 860bdd20 00000001 NDIS!ethFilterDprIndicateReceivePacket+0x307
f79f1cc0 f64351b4 85ed1ad0 860bdd20 00000001 psched!PsFlushReceiveQueue+0x15
f79f1ce4 f64355f9 8602f010 00000000 85ed1ad0 psched!PsEnqueueReceivePacket+0xda
f79f1cfc f7439d40 8602f008 c000009a 85e6aa48 psched!ClReceiveComplete+0x13
f79f1d4c f6a65bba 00b63668 f79f1d7c 00000001 NDIS!ethFilterDprIndicateReceivePacket+0x5a4
f79f1d74 f6a736e2 85d1db48 00000000 85d25800 bcmwl5+0xbba
f79f1ee4 f6a68d36 85b63668 000000a7 13410c00 bcmwl5+0xe6e2
f79f1ef8 f6a69160 85e6aa48 49250600 05d2cfb1 bcmwl5+0x3d36
f79f1fb8 f742ff09 85e6aa01 860dd738 860dd99c bcmwl5+0x4160
f79f1fd0 804dc179 85e6aad8 85e6aac4 00000000 NDIS!ndisMDpcX+0x21
f79f1ff4 804dbe2d ecea1e0c 00000000 00000000 nt!KiRetireDpcList+0x46
f79f1ff8 ecea1e0c 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a
804dbe2d 00000000 00000009 bb835675 00000128 0xecea1e0c


STACK_COMMAND: kb

FOLLOWUP_IP:
DrvFltIp+4d5a
f790ad5a ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: DrvFltIp+4d5a

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: DrvFltIp

IMAGE_NAME: DrvFltIp

DEBUG_FLR_IMAGE_TIMESTAMP: 4589e4bb

FAILURE_BUCKET_ID: 0xA_DrvFltIp+4d5a

BUCKET_ID: 0xA_DrvFltIp+4d5a

Followup: MachineOwner
---------

 

[Jonno 92]

Here is another... This one has a problem with notepad.exe

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000694, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804e7b50, address which referenced memory

Debugging Details:
------------------

ANALYSIS: Kernel with unknown size. Will force reload symbols with known size.
ANALYSIS: Force reload command: .reload /f ntoskrnl.exe=FFFFFFFF804D7000,214600,41108004
Map win32k.sys:
Image region 380:18a280 does not fit in mapping
*** WARNING: Unable to verify timestamp for bcmwl5.sys
*** ERROR: Module load completed but symbols could not be loaded for bcmwl5.sys
ANALYSIS: kernel symbols have been forced reloaded due to unknown size.



READ_ADDRESS: 00000694

CURRENT_IRQL: 2

FAULTING_IP:
nt!wcslen+8
804e7b50 668b08 mov cx,word ptr [eax]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: notepad.exe

LAST_CONTROL_TRANSFER: from f7912d5a to 804e7b50

STACK_TEXT:
f79f1774 f7912d5a 00000694 862a4d0c 85fe18f8 nt!wcslen+0x8
WARNING: Stack unwind information not available. Following frames may be wrong.
f79f17ac f790f0e1 00000908 f79f17e4 f6bd5e87 DrvFltIp+0x4d5a
f79f17cc f790f3a8 f79f1808 f79f1807 00000908 DrvFltIp+0x10e1
f79f1818 f79100b9 00000908 00000000 cf2ed47a DrvFltIp+0x13a8
f79f186c f79111b5 85fe87d0 00000908 86068e50 DrvFltIp+0x20b9
f79f18d8 804e3d77 85fe87d0 86068d98 859c6378 DrvFltIp+0x31b5
f79f18e8 ee35782c 85f49be0 86158be0 00000020 nt!IopfCallDriver+0x31
f79f1924 f7910b44 862a4c88 859c6378 00000a20 afd!AfdBChainedReceiveEventHandler+0x209
f79f1960 ee3a012e 8486bde8 859c6378 00000a20 DrvFltIp+0x2b44
f79f19c0 ee3952f0 859c6378 00001080 85f49be0 tcpip!IndicateData+0x98
f79f1a48 ee392ef9 85d92830 8901010a 7ad42ecf tcpip!TCPRcv+0xb5b
f79f1aa8 ee392b19 00000020 85d92830 ee395076 tcpip!DeliverToUser+0x18e
f79f1b24 ee392836 ee3d2210 85d92830 85d23844 tcpip!DeliverToUserEx+0x95f
f79f1bdc ee391922 85d92830 85d23858 00000564 tcpip!IPRcvPacket+0x6cb
f79f1c1c ee39184d 00000000 85d11b48 85d23836 tcpip!ARPRcvIndicationNew+0x149
f79f1c58 f7439f45 860a5818 00000000 f6577b40 tcpip!ARPRcvPacket+0x68
f79f1cac f657201d 009b5de8 860f5860 00000001 NDIS!ethFilterDprIndicateReceivePacket+0x307
f79f1cc0 f65721b4 860e5ad0 860f5860 00000001 psched!PsFlushReceiveQueue+0x15
f79f1ce4 f65725f9 8604c010 00000000 860e5ad0 psched!PsEnqueueReceivePacket+0xda
f79f1cfc f7439d40 8604c008 c000009a 85e4da48 psched!ClReceiveComplete+0x13
f79f1d4c f6bd2bba 009b5de8 f79f1d7c 00000001 NDIS!ethFilterDprIndicateReceivePacket+0x5a4
f79f1d74 f6be06e2 85d11b48 00000000 85d23800 bcmwl5+0xbba
f79f1ee4 f6bd5d36 859b5de8 000000bf 13410c00 bcmwl5+0xe6e2
f79f1ef8 f6bd6160 85e4da48 49250600 05d2cfb1 bcmwl5+0x3d36
f79f1fb8 f742ff09 85e4da01 85e5c008 85e5c26c bcmwl5+0x4160
f79f1fd0 804dc179 85e4dad8 85e4dac4 00000000 NDIS!ndisMDpcX+0x21
f79f1ff4 804dbe2d ed5879b4 00000000 00000000 nt!KiRetireDpcList+0x46
f79f1ff8 ed5879b4 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a
804dbe2d 00000000 00000009 bb835675 00000128 0xed5879b4


STACK_COMMAND: kb

FOLLOWUP_IP:
DrvFltIp+4d5a
f7912d5a ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: DrvFltIp+4d5a

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: DrvFltIp

IMAGE_NAME: DrvFltIp

DEBUG_FLR_IMAGE_TIMESTAMP: 4589e4bb

FAILURE_BUCKET_ID: 0xA_DrvFltIp+4d5a

BUCKET_ID: 0xA_DrvFltIp+4d5a

Followup: MachineOwner
---------

 

[Jonno 92]

They all mention a file named:
DrvFltIp

I searched my computer, and this file is in Local Settings\Application Data\Temp
and also Program files\Ashampoo Firewall

Should I delete the file in temp folder?

 

[kimsland]

Hmm one report DrvFltIp.sys possible Spyware

I think you may be better to run:
Viruses/Spyware/Malware, preliminary removal instructions

And then come back, with a Hijackthis log
Also to contine with Spyware/Malware checks, you may need to post a new thread on Security and the Web