BSoD with wfplwfs.sys (DRIVER_IRQL_NOT_LESS_OR_EQUAL)[M2405]

Hello

So I have a Lenovo Yoga 2 Tablet with 32-bit Windows I’ve started to have BSOD’s again after installing the Comodo.
It did happened in the past many times and therefore I’ve formated tab and reinstall everything in hope of solving this problem, but it seems it didn’t changed. So I digged a little bit this time, and there is a software that analyzes windows dump file, and this program pointed to comodo firewall.

The details are:
BSOD: driver_irql_not_less_or_equal wfplwfs.sys

[i]On Fri 2018-08-03 05:25:28 your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\080318-11281-01.dmp
This was probably caused by the following module: inspect.sys (inspect+0x1134D) 
Bugcheck code: 0xD1 (0xFFFFFFFFE90BADFC, 0x2, 0x0, 0xFFFFFFFF867DC0C1)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\drivers\inspect.sys
product: COMODO Internet Security Firewall Driver
company: COMODO
description: COMODO Internet Security Firewall Driver
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high. 
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out. 
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: inspect.sys (COMODO Internet Security Firewall Driver, COMODO). 
Google query: inspect.sys COMODO DRIVER_IRQL_NOT_LESS_OR_EQUAL[/i]

The BSOD usually appears after I am switching off the tablet for a night charging. After turning on, login, after 5-60 seconds BSOD usually appears. Sometimes 2-3 times.
It won’t most of the times appear if I turn off the wifi/mobile connection before shutting down.

Hi Davis89,

Can you please share this dump file from the location C:\Windows\Minidump\080318-11281-01.dmp by uploading in any online storage and share us the download link.

Also please share the msinfo32.exe and Windows Event logs by following this guide.

Thanks in advance.

Kind Regards,
PremJK

If someone wants password, please PM me.

Hi Davis89,

Thanks for providing requested logs.

You are using CIS 10.2.0.6526.

Can you please update to latest CIS version and see if you still have issue.

Kind Regards,
PremJK

Ok, I will let you know in few days, however I think we can safely assume that it won’t help, because as I’ve mentioned this problem occurs already one year and during that time I did updated cis many times, and this time I did even reinstall the system…

Ok, so yes, just minute after update the BSOD occurred.

Now it came to the point where I can’t turn on my mobile connection in tablet, because now every time it connects to the net, the BSOD appears.
I’ve tried turning off antyvirus, firewall, hips, virusscope, everything. Making every app as trusted on a comodo app list or removing everything or refreshing the settings - nothing helps.
When I connect to the net it takes few seconds for BSOD to appear and in the comodo window in the firewall section it appears just immediately when there appears a program called WUDFhost.exe. Still maybe it can be some link there, maybe not…

Luckily enough I can use the net on this tab through wi-fi.

Can you change memory dump settings to kernel memory dump and then when you get a BSOD compress and share the dump. See this page on how to change the memory dump type.

Thanks for the concern. The settings was by default kernel one. Dump in a link. If someone needs password, please PM me.
https://drive.google.com/open?id=1N82BrHGomxtCvkUHk39gT-2E4Ez63Tj3

A. THE BUG/ISSUE (Varies from issue to issue)
Can you reproduce the problem & if so how reliably?: yes, 100%
If you can, exact steps to reproduce. If not, exactly what you did & what happened:
1: Install Windows 10 Pro on Dell Latitude E5570 notebook with internal “DW8511e Snapdragon X7 LTE” WWAN card
2: Install Comodo Firewall or CIS Pro
One or two sentences explaining what actually happened:
I experienced Blue Screen of Death if Comodo Firewall or CIS Pro is installed and Cellular network is enabled on Windows 10 Pro. It happens frequently.
One or two sentences explaining what you expected to happen: No BSOD.
If a software compatibility problem have you tried the advice to make programs work with CIS?: NA
Any software except CIS/OS involved? If so - name, & exact version: No
Any other information, eg your guess at the cause, how you tried to fix it etc:

  • If Comodo softwares aren’t installed, there are no problems.
  • I haven’t experienced the BSOD when cellular network adapter was disabled.
  • Experienced the same problem:
    • if all of the other Comodo components are disabled: Firewall, Auto-Containment, HIPS, VirusScope, Website Filtering
    • after clear Windows install, without any configuration and without other software installation
    • with or without installed Dell drivers
    • with or without installed SnapDragon drivers
    • with or without actual Windows updates
  • Error message:
    Your PC ran into a problem and needs to restart. We’re just collecting some error info, ant then we’ll restart for you.

    Stop Code: DRIVER_IRQL_NOT_LESS_OR_EQUAL
    What failed: wfplwfs.sys

B. YOUR SETUP
Exact CIS version & configuration:
Firewall 11.0.0.6710, or CIS Pro
default configuration
Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV: it doesn’t matter (same problem with default config or if all modules are disabled)
Have you made any other changes to the default config? (egs here.): No
Have you updated (without uninstall) from CIS 5, 6 or 7?: No. It was clear install
if so, have you tried a a a clean reinstall - if not please do?: NA
Have you imported a config from a previous version of CIS: No
if so, have you tried a standard config - if not please do: NA
OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
Windows 10 Pro 1803, clear install, default configuration, it doesn’t matter Windows updates are installed or not
wfplwfs.sys version: 10.0.17134.112 (06.19.2018.)
Other security/s’box software a) currently installed b) installed since OS, including initial trial security software included with system:
a=None b=None

C. ATTACH REQUIRED FILES
Attached file (Comodo-BSOD.zip) includes: KillSwitch Process List, diagnostics file, screenshots (BSOD, EventViewer), Windows dump files (MiniDump, etc). I have also Windows MEMORY.DMP file (compressed size is 70MB). I can upload it, if it’s necessary.

Thanks

Hi Geoffrey,

Thank you so much for reporting the issue in required format with all information.

I have also Windows MEMORY.DMP file (compressed size is 70MB). I can upload it, if it's necessary.
Yes, we need the dump file for investigation. Please share us by uploading in any online storage and provide us the download link. Thanks in advance.

Kind Regards,
PremJK

Hello,

Password protected MEM dump is here:
https://drive.google.com/file/d/1fi0c_NcYihWPTdJM-ucfR4q7MpZYqLF2/view?usp=sharing

I am sending the password to you by PM.

Thanks

Hi Geoffrey,

Thanks for providing the dump. We will get back you if we need more details.

Kind Regards,
PremJK

Thank you. Please feel free to contact me if you need anything else.

So I got this notebook. And I have a problem. I always used Your Firewall, but now i cannot… Why? It seems to be blocking the modem (internal one) and cos of that I’m getting BSODs (more like GSODs right now) when trying to connect to network while COMODO Firewall is running.

Without it everything works fine. Is it known problem?

My device is Dell Latitude E5440 with i5-4300U and no dedicated GPU. The modem is Dell Wireless DW5570.

Here are minidumps and memory dump: https://drive.google.com/open?id=18e5B2pZiOYY6S6Qwt-vcsiMGQRDmXTNG
Here are minidumps alone: https://drive.google.com/file/d/1u_5DcwDThrj0_dDx-Rmpbsjj4CJv2YcR/view?usp=sharing

The problem is with ntoskrnl.exe & wfplwfs.sys and more exactly here:

2: kd> lmvm inspect
Browse full module list
start             end                 module name
fffff801`34480000 fffff801`344a0000   inspect    (no symbols)           
    Loaded symbol image file: inspect.sys
    Image path: \SystemRoot\system32\DRIVERS\inspect.sys
    Image name: inspect.sys
    Browse all global symbols  functions  data
    Timestamp:        Fri Mar 15 06:31:55 2019 (5C8BB75B)
    CheckSum:         000228C6
    ImageSize:        00020000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

Could You help me? I would like to continue using Your Firewall on all my devices, but… I cannot…

Looks like this bug is still not fixed, I have merged all other topics that describe this issue, and I have notified comodo staff members. They will most likely PM you for more information.

Hi ch3mn3y,

Thank you for reporting, our developers are working on it.

Hello! I’ve got the same issue…

Can you share the memory dump? Should be C:\WINDOWS|Memory.dmp

Any progress? I’m trying Firewall once for a while to see if it is fixed, but till now no luck. I’ll try to install it again on my Dell later today.
However it feels that no answers here means that there is no change and I’ll still and with the BSODs…