[GreshK]

I did run the McAfee removal tool. I apologize for not including that update. It did not seem to resolve the issue.

 

I have done what I can with Speccy to get a URL- I continually get the error "server name or address could not be resolved", as I posted before. However, I am providing the latest txt version again, but have removed the Windows product key from the file. 

Attached Files

•  FALCON-PC.txt   50.69KB   194 downloads

[Advertisements]

Any new crash dmps generated since you used the McAfee removal tool, if yes, please upload for us.

 

The problem with Speccy text is that it does not show us what Windows updates are installed or have failed to install, that said we can tell that Windows is out of date and that you have not installed Avast as suggested, not wise as you are open to malware attack  

 

 Operating System

Windows 7 Professional 64-bit SP1

Computer type: Desktop

Installation Date: 9/13/2013 9:50:56 PM

 

Windows Security Center

User Account Control (UAC) Disabled

Firewall Disabled

Antivirus Disabled

Windows Update

AutoUpdate Not configured

Windows Defender

Windows Defender Enabled

.NET Frameworks installed

v3.5 SP1

v3.0 SP2

v2.0 SP2

Internet Explorer

Version 8.0.7601.17514

PowerShell

Version 2.0

 

Other observations;

 

Motherboard

To be filled by O.E.M. To be filled by O.E.M. (CPU 1) Not helpful as we have no way of knowing what the correct Ethernet driver is.

 

Power Profile

Active power scheme High performance This should be set as Balanced in the power plan options, high performance is a form of overclocking that causes system instability.

 

Enabled

Intel® 82577LM Gigabit Network Connection

Connection Name Local Area Connection

DHCP enabled Yes

MAC Address 00-0B-AB-42-62-90

 

Intel® 82583V Gigabit Network Connection #3

Connection Name Local Area Connection 4 (SPARC Setup) You have two lots of Ethernet drivers installed, click on each one that I have highlighted in red as there is a link attached for info purposes.

NetBIOS over TCPIP Yes

DHCP enabled No

MAC Address 00-0B-AB-42-62-91

IP Address 192.168.1.11

Subnet mask 255.255.255.0

Gateway server 192.168.1.1

[phillpower2]

Any new crash dmps generated since you used the McAfee removal tool, if yes, please upload for us.

 

The problem with Speccy text is that it does not show us what Windows updates are installed or have failed to install, that said we can tell that Windows is out of date and that you have not installed Avast as suggested, not wise as you are open to malware attack  

 

 Operating System

Windows 7 Professional 64-bit SP1

Computer type: Desktop

Installation Date: 9/13/2013 9:50:56 PM

 

Windows Security Center

User Account Control (UAC) Disabled

Firewall Disabled

Antivirus Disabled

Windows Update

AutoUpdate Not configured

Windows Defender

Windows Defender Enabled

.NET Frameworks installed

v3.5 SP1

v3.0 SP2

v2.0 SP2

Internet Explorer

Version 8.0.7601.17514

PowerShell

Version 2.0

 

Other observations;

 

Motherboard

To be filled by O.E.M. To be filled by O.E.M. (CPU 1) Not helpful as we have no way of knowing what the correct Ethernet driver is.

 

Power Profile

Active power scheme High performance This should be set as Balanced in the power plan options, high performance is a form of overclocking that causes system instability.

 

Enabled

Intel® 82577LM Gigabit Network Connection

Connection Name Local Area Connection

DHCP enabled Yes

MAC Address 00-0B-AB-42-62-90

 

Intel® 82583V Gigabit Network Connection #3

Connection Name Local Area Connection 4 (SPARC Setup) You have two lots of Ethernet drivers installed, click on each one that I have highlighted in red as there is a link attached for info purposes.

NetBIOS over TCPIP Yes

DHCP enabled No

MAC Address 00-0B-AB-42-62-91

IP Address 192.168.1.11

Subnet mask 255.255.255.0

Gateway server 192.168.1.1

[phillpower2]

Not heard back from you GreshK, do you still require assistance or is the issue now resolved, an update would be appreciated.

 

Thanks FreeBooter, I should have emphasised that the UAC was also disabled and not just highlighted it.

[GreshK]

I realize we have unusual settings. It is due to the nature of the use of the system, it is not a typical home user deal.  We are not connected to the open internet in any way; therefore, some of the things you mention are not an issue. I think we have digressed from the purpose of this post. I am posting a dmp from after McAfee was removed. Let me know what you see there. 

Attached Files

•  101416-7144-01.zip   24.48KB   182 downloads

[phillpower2]

Forgive us for being security conscious GreshK, the concern for your online safety is genuine and well intended.

 

For some reason I cannot unzip your latest dmp file, would it be possible for you to upload it again for us. 

[GreshK]

SkyX is up to date. I downloaded the Intel driver update previously, but have not yet installed it. I have been gathering as much information as possible and changing only one thing at a time in order to determine the precise cause. I am attaching the dmp files from both 10/14 (sent previously, but failed) and one that I got today. 

 

 

 

Attached Files

•  New DMP Files.zip   48.49KB   209 downloads

[phillpower2]

Your latest dmp file only mentioned here, I will check the other one now and then edit if need be, In addition to what FreeBooter has advised and asked, the following information is particularly relevant as it reflects on what you stated in your reply #20, cross reference what I have highlighted in red below with the information at the link here and you will note that Windows updates are in fact causing you issues, the conflict possibly being between 

TheSkyX.exe and the Windows updates.

 

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high.  This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 0000000000000000, memory referenced

Arg2: 0000000000000002, IRQL

Arg3: 0000000000000000, value 0 = read operation, 1 = write operation

Arg4: fffff88001778f92, address which referenced memory

 

Debugging Details:

------------------

 

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

 

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800031120e8

GetUlongFromAddress: unable to read from fffff80003112198

 0000000000000000 Nonpaged pool

 

CURRENT_IRQL:  2

 

FAULTING_IP: 

tcpip! ?? ::FNODOBFM::`string'+5f94

fffff880`01778f92 488b01          mov     rax,qword ptr [rcx]

 

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

 

BUGCHECK_STR:  0xD1

 

PROCESS_NAME:  TheSkyX.exe

 

TRAP_FRAME:  fffff80000ba1780 -- (.trap 0xfffff80000ba1780)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=fffffa8007cf78f0 rbx=0000000000000000 rcx=0000000000000000

rdx=fffffa8007cf78f1 rsi=0000000000000000 rdi=0000000000000000

rip=fffff88001778f92 rsp=fffff80000ba1910 rbp=0000000000000000

 r8=fffffa8007cf78f0  r9=00000000000000d0 r10=fffff80003054b80

r11=fffffa800779f6d0 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0         nv up ei ng nz na po nc

tcpip! ?? ::FNODOBFM::`string'+0x5f94:

fffff880`01778f92 488b01          mov     rax,qword ptr [rcx] ds:00000000`00000000=????????????????

Resetting default scope

 

LAST_CONTROL_TRANSFER:  from fffff80002ee0be9 to fffff80002ee1640

 

STACK_TEXT:  

fffff800`00ba1638 fffff800`02ee0be9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx

fffff800`00ba1640 fffff800`02edf860 : fffff800`03053e80 00060000`0b000000 00000000`00000005 fffffa80`0779f4e0 : nt!KiBugCheckDispatch+0x69

fffff800`00ba1780 fffff880`01778f92 : fffffa80`0779f4e0 00000000`00000001 ffff0080`206c644d fffffa80`06f42d20 : nt!KiPageFault+0x260

fffff800`00ba1910 fffff880`01002892 : fffffa80`06fa3a60 00000000`00000002 00000000`00000002 fffffa80`06f94fa0 : tcpip! ?? ::FNODOBFM::`string'+0x5f94

fffff800`00ba1960 fffff880`0176c60f : fffffa80`070df000 00000000`00000001 fffff800`00ba1a00 00000000`077d4301 : NETIO!NetioDereferenceNetBufferListChain+0x132

fffff800`00ba1a30 fffff880`01747325 : fffffa80`0776b200 00000000`00000000 00000000`00000000 fffffa80`077e3000 : tcpip!TcpFlushDelay+0x13f

fffff800`00ba1b10 fffff880`0172acf3 : fffffa80`06fc0900 fffffa80`077db1c7 00000000`00003d0d fffff880`01843d0d : tcpip!TcpPreValidatedReceive+0x3e5

fffff800`00ba1be0 fffff880`01739a52 : fffffa80`077208f0 fffffa80`077d43c0 fffffa80`077d0006 00000000`00000006 : tcpip!IpFlcReceivePreValidatedPackets+0x5b3

fffff800`00ba1d40 fffff800`02eee078 : 00000000`00000000 00000000`00004800 fffffa80`083d4b60 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xa2

fffff800`00ba1d90 fffff880`0173a152 : fffff880`017399b0 fffffa80`07f57940 fffff800`03053e02 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8

fffff800`00ba1e70 fffff880`0158f0eb : fffffa80`077d7560 00000000`00000000 fffffa80`074061a0 00000000`00000000 : tcpip!FlReceiveNetBufferListChain+0xb2

fffff800`00ba1ee0 fffff880`01558ad6 : fffffa80`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb

fffff800`00ba1f50 fffff880`014d1cc1 : fffffa80`074061a0 00000000`00000002 00000000`00000003 fffffa80`077abd50 : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6

fffff800`00ba23d0 fffff880`042eb219 : fffffa80`076dc000 fffffa80`0779f4e0 fffffa80`0779f450 00000000`00000003 : ndis!NdisMIndicateReceiveNetBufferLists+0xc1

fffff800`00ba2420 fffffa80`076dc000 : fffffa80`0779f4e0 fffffa80`0779f450 00000000`00000003 00000000`00000801 : e1q62x64+0x21219

fffff800`00ba2428 fffffa80`0779f4e0 : fffffa80`0779f450 00000000`00000003 00000000`00000801 00000000`00000003 : 0xfffffa80`076dc000

fffff800`00ba2430 fffffa80`0779f450 : 00000000`00000003 00000000`00000801 00000000`00000003 fffffa80`076e0500 : 0xfffffa80`0779f4e0

fffff800`00ba2438 00000000`00000003 : 00000000`00000801 00000000`00000003 fffffa80`076e0500 fffff880`042eb3b4 : 0xfffffa80`0779f450

fffff800`00ba2440 00000000`00000801 : 00000000`00000003 fffffa80`076e0500 fffff880`042eb3b4 00000000`00000001 : 0x3

fffff800`00ba2448 00000000`00000003 : fffffa80`076e0500 fffff880`042eb3b4 00000000`00000001 fffffa80`0779f4e0 : 0x801

fffff800`00ba2450 fffffa80`076e0500 : fffff880`042eb3b4 00000000`00000001 fffffa80`0779f4e0 fffffa80`077b9c30 : 0x3

fffff800`00ba2458 fffff880`042eb3b4 : 00000000`00000001 fffffa80`0779f4e0 fffffa80`077b9c30 00000000`00000003 : 0xfffffa80`076e0500

fffff800`00ba2460 00000000`00000001 : fffffa80`0779f4e0 fffffa80`077b9c30 00000000`00000003 0000000a`00000001 : e1q62x64+0x213b4

fffff800`00ba2468 fffffa80`0779f4e0 : fffffa80`077b9c30 00000000`00000003 0000000a`00000001 00000000`00000000 : 0x1

fffff800`00ba2470 fffffa80`077b9c30 : 00000000`00000003 0000000a`00000001 00000000`00000000 00000000`00000000 : 0xfffffa80`0779f4e0

fffff800`00ba2478 00000000`00000003 : 0000000a`00000001 00000000`00000000 00000000`00000000 fffff800`00ba26d8 : 0xfffffa80`077b9c30

fffff800`00ba2480 0000000a`00000001 : 00000000`00000000 00000000`00000000 fffff800`00ba26d8 00000000`00000000 : 0x3

fffff800`00ba2488 00000000`00000000 : 00000000`00000000 fffff800`00ba26d8 00000000`00000000 fffffa80`070c4820 : 0xa`00000001

 

 

STACK_COMMAND:  kb

 

FOLLOWUP_IP: 

NETIO!NetioDereferenceNetBufferListChain+132

fffff880`01002892 4c8bb42490000000 mov     r14,qword ptr [rsp+90h]

 

SYMBOL_STACK_INDEX:  4

 

SYMBOL_NAME:  NETIO!NetioDereferenceNetBufferListChain+132

 

FOLLOWUP_NAME:  MachineOwner

 

MODULE_NAME: NETIO

 

IMAGE_NAME:  NETIO.SYS

 

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79381

 

FAILURE_BUCKET_ID:  X64_0xD1_NETIO!NetioDereferenceNetBufferListChain+132

 

BUCKET_ID:  X64_0xD1_NETIO!NetioDereferenceNetBufferListChain+132

 

Unloaded modules:

fffff880`06493000 fffff880`06504000   spsys.sys

fffff880`01680000 fffff880`0168e000   crashdmp.sys

fffff880`016b6000 fffff880`016e0000   cdrom.sys

 

Edit by phillpower2; your earlier dmp file details;

 

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high.  This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 0000000000000068, memory referenced

Arg2: 0000000000000002, IRQL

Arg3: 0000000000000001, value 0 = read operation, 1 = write operation

Arg4: fffff88004511e60, address which referenced memory

 

Debugging Details:

------------------

 

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

 

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800031050e8

GetUlongFromAddress: unable to read from fffff80003105198

 0000000000000068 Nonpaged pool

 

CURRENT_IRQL:  2

 

FAULTING_IP: 

e1q62x64+18e60

fffff880`04511e60 f00fc14168      lock xadd dword ptr [rcx+68h],eax

 

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

 

BUGCHECK_STR:  0xD1

 

PROCESS_NAME:  TheSkyX.exe

 

TRAP_FRAME:  fffff88002f222a0 -- (.trap 0xfffff88002f222a0)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=00000000ffffffff rbx=0000000000000000 rcx=0000000000000000

rdx=fffffa8006bf7571 rsi=0000000000000000 rdi=0000000000000000

rip=fffff88004511e60 rsp=fffff88002f22430 rbp=0000000000000025

 r8=fffffa8006bf7570  r9=0000000000000000 r10=fffffa80075cc550

r11=000000000000fffb r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0         nv up ei ng nz na po nc

e1q62x64+0x18e60:

fffff880`04511e60 f00fc14168      lock xadd dword ptr [rcx+68h],eax ds:00000000`00000068=????????

Resetting default scope

 

LAST_CONTROL_TRANSFER:  from fffff80002ed3be9 to fffff80002ed4640

 

STACK_TEXT:  

fffff880`02f22158 fffff800`02ed3be9 : 00000000`0000000a 00000000`00000068 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx

fffff880`02f22160 fffff800`02ed2860 : fffffa80`06caed30 fffff880`017693c0 00000000`00001770 00000000`00000000 : nt!KiBugCheckDispatch+0x69

fffff880`02f222a0 fffff880`04511e60 : fffffa80`07023890 fffffa80`077340e0 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260

fffff880`02f22430 fffffa80`07023890 : fffffa80`077340e0 00000000`00000000 00000000`00000000 00000000`00000000 : e1q62x64+0x18e60

fffff880`02f22438 fffffa80`077340e0 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`0451a305 : 0xfffffa80`07023890

fffff880`02f22440 00000000`00000000 : 00000000`00000000 00000000`00000000 fffff880`0451a305 fffffa80`00000000 : 0xfffffa80`077340e0

 

 

STACK_COMMAND:  kb

 

FOLLOWUP_IP: 

e1q62x64+18e60

fffff880`04511e60 f00fc14168      lock xadd dword ptr [rcx+68h],eax

 

SYMBOL_STACK_INDEX:  3

 

SYMBOL_NAME:  e1q62x64+18e60

 

FOLLOWUP_NAME:  MachineOwner

 

MODULE_NAME: e1q62x64

 

IMAGE_NAME:  e1q62x64.sys

 

DEBUG_FLR_IMAGE_TIMESTAMP:  4af31807

 

FAILURE_BUCKET_ID:  X64_0xD1_e1q62x64+18e60

 

BUCKET_ID:  X64_0xD1_e1q62x64+18e60

 

Unloaded modules:

fffff880`06493000 fffff880`06504000   spsys.sys

fffff880`01680000 fffff880`0168e000   crashdmp.sys

fffff880`016b6000 fffff880`016e0000   cdrom.sys

 

The root causes are the same and you will not resolve this without first fully updating Windows and the appropriate Ethernet driver for your device, see driver info here

[GreshK]

Ok, thanks, I will start working on those updates and let you know the outcome. 

 

Unfortunately I cannot remove TheSkyX as it is the primary software used on this machine. 

[phillpower2]

Would recommend updating the Ethernet drivers first, just in case you lose internet connection while installing any update/s, if you know which Ethernet drivers you need save them to the desktop or a thumb drive, after creating a new restore point, uninstall the present Intel® 82577LM and Intel® 82583V drivers, restart the computer, let Windows detect new hardware then install the new Ethernet device drivers.

[phillpower2]

Not heard back from you GreshK, do you still require assistance or is the issue now resolved, an update would be appreciated.