Hi My system (WinXP SP2) crashes whenever I use any type of communication device that requires a remote IP (i.e. dialup). This includes modems, USB based ADSL modems and mobile phones for data. I have traced the culprits to these two files (most likely): wanarp.sys and tcpip.sys (wanarp.sys is the "MS Remote Access and Routing ARP Driver") But.... now that I think I know what is causing the problem, I still am not sure what to do in order to fix it! Anyone with ideas? I noticed that there is only one version of wanarp.sys on my system but two versions of tcpip.sys. However, replacing the files did not solve the problem. This is an analysis from WinDbg: ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: 825b7930, The address that the exception occurred at Arg3: f235d3d8, Trap Frame Arg4: 00000000 Debugging Details: ------------------ ***** Kernel symbols are WRONG. Please fix symbols to do analysis. ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* Loading symbols for f326f000 tcpip.sys -> tcpip.sys *** WARNING: Unable to verify timestamp for tcpip.sys *** ERROR: Module load completed but symbols could not be loaded for tcpip.sys Loading symbols for f31a7000 vsdatant.sys -> vsdatant.sys *** WARNING: Unable to verify timestamp for vsdatant.sys *** ERROR: Module load completed but symbols could not be loaded for vsdatant.sys MODULE_NAME: wanarp FAULTING_MODULE: 804d7000 nt DEBUG_FLR_IMAGE_TIMESTAMP: 41107c89 EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s". FAULTING_IP: +ffffffff825b7930 825b7930 80797c82 cmp byte ptr [ecx+0x7c],0x82 TRAP_FRAME: f235d3d8 -- (.trap fffffffff235d3d8) ErrCode = 00000000 eax=824063b4 ebx=fd8be280 ecx=00000000 edx=81e1d000 esi=ff75ece0 edi=8244a8b8 eip=825b7930 esp=f235d44c ebp=f235d464 iopl=0 nv up ei ng nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282 825b7930 80797c82 cmp byte ptr [ecx+0x7c],0x82 ds:0023:0000007c=?? Resetting default scope CUSTOMER_CRASH_COUNT: 7 DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT BUGCHECK_STR: 0x8E LAST_CONTROL_TRANSFER: from f9b77404 to 825b7930 STACK_TEXT: WARNING: Frame IP not in any known module. Following frames may be wrong. f235d448 f9b77404 824063b4 f235d4e8 00000001 0x825b7930 f235d464 f9b77707 8244a8b8 fd8be280 ff75ece0 wanarp+0x5404 f235d4a8 f327270a 8244a8b8 f235d4e8 00000001 wanarp+0x5707 f235d4d8 f32724ad fd8e1d58 6591d9d9 8225fdf0 tcpip+0x370a f235d624 f32795d4 f32b04b8 00000000 81e1e0d0 tcpip+0x34ad f235d678 f3278c70 ff9905b4 00000000 82276e80 tcpip+0xa5d4 f235d6bc f3278226 0835d6e0 00000001 00000000 tcpip+0x9c70 f235d6f8 f328b95e 8240c008 8240c09c ff6f2f90 tcpip+0x9226 f235d714 f31d5621 82594620 8240c008 f31d340e tcpip+0x1c95e f235d718 82594620 8240c008 f31d340e 82594620 vsdatant+0x2e621 f235d71c 8240c008 f31d340e 82594620 8240c008 0x82594620 f235d720 f31d340e 82594620 8240c008 0000000f 0x8240c008 f235d724 82594620 8240c008 0000000f 8240c09c vsdatant+0x2c40e f235d728 8240c008 0000000f 8240c09c 82594620 0x82594620 f235d72c 00000000 8240c09c 82594620 f235da2c 0x8240c008 FOLLOWUP_IP: wanarp+5404 f9b77404 ?? ??? SYMBOL_STACK_INDEX: 1 FOLLOWUP_NAME: MachineOwner SYMBOL_NAME: wanarp+5404 IMAGE_NAME: wanarp.sys STACK_COMMAND: .trap fffffffff235d3d8 ; kb BUCKET_ID: WRONG_SYMBOLS Followup: MachineOwner
