hello,
I hade BSOD a few time ago. Checking memory with the tool recommende by egemen, I modified my settings and no more memory errors.
A few days laterI had a BSOD. So I uninstalled Comodo and had no problem for 10 days.
As the new version 2.3.6.81 came out, I installed it. One day later a BSOD with cmdmon involved as usual.
For now CPF is uninstalled. Here is the memory dump.
[attachment deleted by admin]
******************************************************************************* * * * Bugcheck Analysis * * * *******************************************************************************Use !analyze -v to get detailed debugging information.
BugCheck 100000D1, {0, 2, 0, 0}
Unable to load image inspect.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for inspect.sys
*** ERROR: Module load completed but symbols could not be loaded for inspect.sys
Unable to load image VMNetSrv.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for VMNetSrv.sys
*** ERROR: Module load completed but symbols could not be loaded for VMNetSrv.sys
Probably caused by : cmdmon.sys ( cmdmon+2828 )Followup: MachineOwner
0: kd> !analyze -v
*Bugcheck Analysis **
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 00000000, address which referenced memoryDebugging Details:
READ_ADDRESS: 00000000
CURRENT_IRQL: 2
FAULTING_IP:
+0
00000000 ??PROCESS_NAME: setiathome_5.15
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from f7a65828 to 00000000
FAILED_INSTRUCTION_ADDRESS:
+0
00000000 ??STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
f7c7e8cc f7a65828 00000000 00000016 f7c7e980 0x0
f7c7e900 ef0b786c 854ce004 00000016 f7c7e980 cmdmon+0x2828
f7c7e99c ef0c32f4 85e734e0 0111a8c0 00003500 tcpip!UDPDeliver+0x1be
f7c7e9f4 ef0b6ef5 861e17b8 8b11a8c0 0111a8c0 tcpip!UDPRcv+0x164
f7c7ea54 ef0b6b19 00000020 861e17b8 ef0b7592 tcpip!DeliverToUser+0x18e
f7c7ead0 ef0b6836 ef0f63f0 861e17b8 8676d656 tcpip!DeliverToUserEx+0x95e
f7c7eb88 ef0b5922 861e17b8 8676d66a 00000029 tcpip!IPRcvPacket+0x6cb
f7c7ebc8 ef0ba4ad 00000000 8548c710 8676d648 tcpip!ARPRcvIndicationNew+0x149
f7c7ebf8 f76a61ea 861bb008 8548c710 8676d648 tcpip!ARPRcv+0x42
f7c7ec5c f76a53f6 861bbec4 8676d648 0000004b inspect+0x81ea
f7c7ec8c f76a46b1 861bbec4 8676d620 f7c7ecc4 inspect+0x73f6
f7c7ecc8 f76a4ca4 861bb008 8548c058 00000000 inspect+0x66b1
f7c7ed20 f76d588f 861bb008 8625df30 862b83fa inspect+0x6ca4
f7c7ed88 f72cb01d 00591198 86324b50 00000001 NDIS!ethFilterDprIndicateReceivePacket+0x347
f7c7ed9c f72cb1b4 865762f8 86324b50 00000001 psched!PsFlushReceiveQueue+0x15
f7c7edc0 f72cb5f9 864c3228 00000000 865762f8 psched!PsEnqueueReceivePacket+0xda
f7c7edd8 f76d4d40 864c3220 86598990 857b9888 psched!ClReceiveComplete+0x13
f7c7ee28 f79b60e2 00591198 f7c7ee50 00000001 NDIS!ethFilterDprIndicateReceivePacket+0x5a4
f7c7ee6c f76d4c9f 86598900 862c1058 86325d8c VMNetSrv+0x30e2
f7c7ef1c f73c2458 f73c2400 8663a804 f73c26a2 NDIS!ethFilterDprIndicateReceivePacket+0x1c2
f7c7ef44 f73e6244 8663a6f0 00000000 000002f0 ks!KsRemoveIrpFromCancelableQueue+0x8f
f7c7ef58 f73e8a9f 85571398 00000000 f741230e portcls!CIrpStream::ReleaseUnmappingIrp+0xe2
f7c7ef78 f7c7efcc 00000000 862e104c 00000000 portcls!CIrpStream::Complete+0xa8
f7c7efa0 804e207d 3653a0d6 ffdff9c0 ffdff000 0xf7c7efcc
f7c7efcc 804dcd22 862e1060 862e104c 00000000 nt!KiTimerExpiration+0xb1
f7c7eff4 804dc88d ec891d44 00000000 00000000 nt!KiRetireDpcList+0x61
f7c7eff8 ec891d44 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2b
804dc88d 00000000 00000009 0081850f bb830000 0xec891d44STACK_COMMAND: kb
FOLLOWUP_IP:
cmdmon+2828
f7a65828 ??SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: cmdmon
IMAGE_NAME: cmdmon.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 451a13e2
SYMBOL_NAME: cmdmon+2828
FAILURE_BUCKET_ID: 0xD1_CODE_AV_NULL_IP_cmdmon+2828
BUCKET_ID: 0xD1_CODE_AV_NULL_IP_cmdmon+2828
Followup: MachineOwner
---------
I debug’d your dump file and the crash resulted from inspect.sys
Read more here on inspect.sys
Thanks,
rki.
I’m not a Windows specialist and I read the following in the analysis:
Probably caused by : cmdmon.sys ( cmdmon+2828 )
So for me it is cmdmon.sys causing the fault.
As stated on the inspect.sys topic, it seems old drivers lay cause problems.
My NIC is a 3C940 on an Asus P4P800 mobo. The drivers are the latest from the Asus site (1.0.0.46)
When Comodo is not running, there are no BSODs.
Now its is over a week I did not have a BSOD. Oh yes, it is also over a week Comodo is deinstalled from my PC (:AGY)
Sorry but I liked Comodo very much.
Good news; over 2 weeks I reinstalled COMODO and no BSOD.
Yes I’ve done something: switched from my integrated 3Com 3C940(on Asus P4P800) to an ordinary Realtek NIC.
So it was not Comodo’s fault. Thanks for your advice.
I’m glad it worked out for you. ;D
Can you change the subject line and put [resolved] after your subject?
Thanks.