Windows XPPost your Windows XP related questions here.
Mission Statement
WindowsBBS is an online community dedicated to easily accessible technical support for those using Microsoft operating systems and other Windows software.
Our goal is to become the leading resource for computer users that require assistance with their day-to-day computer usage, including full support for networking PC's, virus & malware removal, system upgrades and general support questions.
Recurring BSODs caused by afd.sys. Dump data included
Hi all,
For several months the BSODs were gone but now they're back. They all have the same message: 1000008E, 80000003, 8052a828 and then a changing frame. They have the same address 8052a828 and always the same probable cause suggested by Debugwiz: afd.sys. The crashes are clearly browser-related. I have tested the memory (memtest86 v. 3.4) without any problems.
Any ideas? TIA
Opened log file 'c:\debuglog.txt'
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini031708-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Mon Mar 17 20:06:27.194 2008 (GMT+1)
System Uptime: 0 days 0:59:30.568
Loading Kernel Symbols
........................................................................... ........................................................................... .................
Loading User Symbols
Loading unloaded module list
...........
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****
Use !analyze -v to get detailed debugging information.
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: 80000003, The exception code that was not handled
Arg2: 8052a828, The address that the exception occurred at
Arg3: a7230b4c, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Ett eller flera argument r ogiltiga
FAULTING_IP:
nt!DbgBreakPoint+0
8052a828 cc int 3
TRAP_FRAME: a7230b4c -- (.trap 0xffffffffa7230b4c)
.trap 0xffffffffa7230b4c
ErrCode = 00000000
eax=00000001 ebx=86ace008 ecx=8052a95c edx=00000031 esi=00000000 edi=00000000
eip=8052a829 esp=a7230bc0 ebp=a7230bec iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000282
nt!DbgBreakPoint+0x1:
8052a829 c3 ret
.trap
Resetting default scope
Thanks for the link. I have updated my vga driver and upgraded the bios too. That might help. If not, I guess repairing the Windows installation is the best option.
/RednulB
Unfortunately these logs require expert knowledge to analyze and there are only 2 members (who occasionally visit WindowsBBS.com) that have the depth of knowledge necessary. Other members can make observations and suggestions as to how you might proceed toward finding the cause ....
I found a post of yours in another forum related to this issue with a similar crash dump log (but different time-stamp) where you stated,
Quote:
Originally Posted by RednulB
My fw is Outpost 4.0.1025.7828 (700).
Is there a newer version of Outpost available? If so, then perhaps updating/upgrading Outpost will resolve your BSOD issue.
I'm guessing the modules listed above in ALL CAPS are related to Outpost Firewall. Since those are near the top of your module list, I wonder whether one or more of them might be related to your BSODs or not.
I'd be inclined to disconnect from the Internet, uninstall Outpost Firewall, and then enable another firewall (such as Windows XP's built-in firewall) before connecting to the Internet. I'd also be inclined to restart the computer after uninstalling Outpost and then restart again after installing and/or enabling another another firewall.
If your BSODs stop occurring after uninstalling Outpost, then perhaps we have narrowed down the culprit to an Outpost component.
If you want to try another reputable 3rd-party firewall, then I suggest you download COMODO Firewall Pro (free) ahead of time if possible (before disconnecting from the Internet and uninstalling Outpost). I recently started using COMODO Firewall Pro with my laptop and I like it so much, I will probably replace the ZoneAlarm Pro firewall I have in my desktop computer when my ZoneAlarm Pro subscription runs out in the next couple weeks or so.
Keep in Mind: One should have only ONE software firewall active at any time. Having more than one firewall active can produce conflicts.
Thanks Mailman for thoroughly cheking my case. The code is certainly difficult and I'm grateful for all the help I get. It's interesting, I think, that the address is the same for every crash.
Yes, my fw might be involved since the afd.sys is part of the winsock kernel and controls connections/open channels -- or something like that. The problems actually started when I installed a new version of Spybot S&D which didn't work at all with my fw Outpost. I have removed every trace of Spybot 1.52 but... There's a newer version of Outpost available, but that's a complete security suite with fewer user otions so Comodo or Online Armour are probably better options. If the BSODs continue, I will certainly move on from OP to another fw or try to repair the Windows installation. But my computer's has been BSOD-free since the yesterday...
Thanks for the good advice/RednulB
Since the BSODs started only yesterday, perhaps you can use System Restore to revert your computer to a stable state it was in prior to the BSODs.
Click Start > All Programs > Accessories > System Tools > System Restore
Also, from your dump log,
Quote:
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: 80000003, The exception code that was not handled
Arg2: 8052a828, The address that the exception occurred at
Arg3: a7230b4c, Trap Frame
Arg4: 00000000
Perhaps you should consider starting Windows with the /DEBUG switch to see if that identifies a potential culprit. I'm not familiar with its use though.
The "debugger" referred to might be the Debugging Tools for Windows which I suspect you have already installed.
...If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. ...
I did a little research about the /DEBUG switch. If I understand correctly, "make sure a debugger gets connected" means one would need to connect another Windows XP computer (that has a kernel debugger) via a COM port, null modem cable, or FireWire (IEEE 1394 port).
Thanks Mailman for the updates.
I thought about the debug switch mentioned in the log file but never knew what it meant. Now I do, and I'm sure that option is way too advanced for me. A System Restore might do it, but the crashes have been occuring for a few weeks now so it might be too late. Right now, everything works fine with zero new BSODs to report.
Happy easter/RednulB
Glad to know you haven't had any recent BSODs. Perhaps Windows XP did its own repairs with its journaling file system (if you're using Windows XP's NTFS instead of FAT32 as your file system).
BSOD issues have cleared themselves up for me in the past. (At least I don't know whether anything I did solved some of those issues or not.)
BTW, I mis-read your post when I stated your BSODs started "yesterday". I'm sorry about that. My attention to detail apparently lacks in the early morning.
EDIT:
Quote:
A System Restore might do it, but the crashes have been occuring for a few weeks now so it might be too late.
You might be surprised. You can check it out without following through with a restore. If you open System Restore and select "Restore my computer to an earlier time" and then click "Next >", you can see what dates are available (shown as bold dates on the calendar). You can look at previous months on the calendar as well.
If you ever do decide to perform a System Restore, then you will likely have to reinstall applications and updates that were applied since that date.
Glad to know you haven't had any recent BSODs. Perhaps Windows XP did its own repairs with its journaling file system (if you're using Windows XP's NTFS instead of FAT32 as your file system).
Uninstalled my old fw last evening after two BSODs of the familiar kind in a row just after booting -- both afd-reladed with the same magic numbers 1000008E, {80000003, 8052a828, XXXXXXXX} involved. I skipped the system restore you recommended and settled for Comodo FW instead of Outpost 4. No crashes since then (8 hours ago). Now I hope that my system stays stable until XP SP3 arrives...
Thanks for all your useful replies Mailman. The help was appreciated.
Please let us know after a week or two if you don't have any crashes. That information would help others who run into similar issues and discover this thread.
Recurring BSODs caused by afd.sys. Dump data included
Hi all,
This an update to the thread "Recurring BSODs caused by afd.sys. Dump data included" started by myself on March 18 and now too old for new replies. Mailman's last post on March 24 requested an update after a week or two... Well, several weeks have now passed and the BSODs are gone. So, if you have Outpost fw installed and experience frequent BSODs with the error code 1000008E, 80000003, 8052a828 and then a changing frame, then it's pretty likely that they have something to do with Outpost. I removed OP completely and installed Comodo FW instead, et voila, no BSODs (yet...)
cheers/RB
Hi all,
This an update to the thread "Recurring BSODs caused by afd.sys. Dump data included" started by myself on March 18 and now too old for new replies. Mailman's last post on March 24 requested an update after a week or two.
Recurring BSODs caused by afd.sys. Dump data included
