blackscell
New Member
- Joined
- Aug 17, 2012
- Messages
- 40
Do me a favor. Grab a blank CD and this program What is Windows Defender Offline? (get the correct version for your architecture).
The program will create a bootable CD from which you can boot your computer and run an offline scan for malicious software. Be sure to run a FULL scan, I believe the program defaults to quick scan so you'll need to change that, you can stop the quick scan make the adjustment and start the full scan, or simply wait till the quick scan concludes and then run it again using full scan option.
Additionally see if you can update this driver viahduaa.sys 5/7/2009 for your VIA High Definition Audio Card from here Link Removed
Post back with the results and include any new dump files.
Regards
Randy
Be nice if we could actually make some progress. Your last four BSODs have been
0x000000d1 DRIVER_IRQL_NOT_LESS_OR_EQUAL blaming tcpip.sys which is not likely the actual cause but would suggest that something has a stranglehold on your Network Stack but I'm not seeing any third party drivers in the stack trace unless I'm blindly missing something right in front of my face, which is not impossible.
So if that driver update doesn't fix it and the offline scanner doesn't find a piece of malware, then we may have to resort to driver verifier and see what comes out of that.
John (Link Removed) has a very good instructional page here Link Removed read it carefully and make sure you under stand what to expect when you use it.
Fingers crossed here and a big thanks to Randy for helping out!
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 000000000000000a, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88001903080, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b7100
000000000000000a
CURRENT_IRQL: 2
FAULTING_IP:
tcpip!IppChecksumDatagram+60
fffff880`01903080 f6470a05 test byte ptr [rdi+0Ah],5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: fffff88009466440 -- (.trap 0xfffff88009466440)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000007a1a rbx=0000000000000000 rcx=0000000058c3c1b6
rdx=0000000000000005 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001903080 rsp=fffff880094665d0 rbp=0000000000000001
r8=0000000000000000 r9=fffff88001918a6e r10=fffffa80091957b6
r11=fffffa8009195751 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
tcpip!IppChecksumDatagram+0x60:
fffff880`01903080 f6470a05 test byte ptr [rdi+0Ah],5 ds:00000000`0000000a=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002e87769 to fffff80002e881c0
STACK_TEXT:
fffff880`094662f8 fffff800`02e87769 : 00000000`0000000a 00000000`0000000a 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`09466300 fffff800`02e863e0 : fffffa80`07956790 fffff880`01900c1e fffffa80`07956790 00000000`00000065 : nt!KiBugCheckDispatch+0x69
fffff880`09466440 fffff880`01903080 : fffffa80`045a7200 fffffa80`0456a938 fffffa80`0456a90c 00000000`00000006 : nt!KiPageFault+0x260
fffff880`094665d0 fffff880`01947226 : fffffa80`045a7200 fffffa80`08ee1760 00000000`00000010 fffffa80`05994cb0 : tcpip!IppChecksumDatagram+0x60
fffff880`09466630 fffff880`01947182 : fffffa80`08ee1630 fffff880`01a319a0 fffffa80`06bb3080 fffff880`01a319a0 : tcpip!IppChecksumNetBufferList+0x86
fffff880`094666b0 fffff880`0191a856 : fffffa80`0456a90c fffff880`09466b20 00000000`00000000 fffffa80`0456a858 : tcpip!IppPreparePacketChecksum+0x182
fffff880`094666f0 fffff880`0191ec01 : fffffa80`03865b80 fffffa80`08ee1807 00000000`00000000 fffffa80`07956790 : tcpip!IppSendDatagramsCommon+0x876
fffff880`09466890 fffff880`01925b15 : ffff0000`00000000 00000000`00000001 fffffa80`0449db50 00000000`0000001e : tcpip!IpNlpFastSendDatagram+0x7d1
fffff880`09466c40 fffff880`01942746 : 00000000`00000000 fffffa80`077a7c01 fffff880`01a2b128 fffff880`01939572 : tcpip!TcpTcbSend+0x495
fffff880`09466ec0 fffff880`01921055 : fffffa80`091ee800 00000000`00000000 00000000`00000000 fffff880`09467200 : tcpip!TcpFlushDelay+0x316
fffff880`09466fa0 fffff880`01918927 : fffffa80`0458c6f0 fffffa80`04565000 fffffa80`0000e2ca 00000000`0000e2ca : tcpip!TcpPreValidatedReceive+0x3e5
fffff880`09467070 fffff880`0191849a : 00000000`00000000 fffff880`01a319a0 fffff880`09467230 fffffa80`0861d9f0 : tcpip!IppDeliverListToProtocol+0x97
fffff880`09467130 fffff880`01917a99 : fffff880`01a319a0 fffffa80`09458800 fffff880`094671a0 fffff880`09467220 : tcpip!IppProcessDeliverList+0x5a
fffff880`094671d0 fffff880`019157ff : 00000000`00000000 fffffa80`045833c0 fffff880`01a319a0 00000000`069bd001 : tcpip!IppReceiveHeaderBatch+0x23a
fffff880`094672b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!IpFlcReceivePackets+0x64f
STACK_COMMAND: kb
FOLLOWUP_IP:
tcpip!IppChecksumDatagram+60
fffff880`01903080 f6470a05 test byte ptr [rdi+0Ah],5
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: tcpip!IppChecksumDatagram+60
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: tcpip
IMAGE_NAME: tcpip.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4f757012
FAILURE_BUCKET_ID: X64_0xD1_tcpip!IppChecksumDatagram+60
BUCKET_ID: X64_0xD1_tcpip!IppChecksumDatagram+60
Followup: MachineOwner
Do not install any drivers from the Windows Update Utility / Microsoft Update Catalog, except as an absolute last resort, If you cannot get something to work.
My recommendation is to only use drivers from your computer manufacturer, motherboard manufacturer, or individual hardware device manufacturer and then double check and see who has the most current for the particular device.
You should turn off the hardware update feature portion of the Windows Update Utility. If you don't know how, post back and we'll step you through it.
No problem with Windows Update in general. You should allow it to take care of the OS files as normal, although some people like to set it so that they can review the files (updates) that are going to be installed in advance. I'll leave that up to you.
What I was talking about is the hardware updates.
Right click computer and choose properties.
Select Advanced system settings from the left column and then select the Hardware tab and click the Device Installation Settings button.
Select No let me choose and then
Never install driver software from Windows Update.
And save changes.