BSOD - Network driver or utorrent?

[Maruchin]

Hi, I just got a BSOD This is what the memory dump looks like. I saw utorrent and figured it might be a utorrent or network driver bug.

Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64Copyright (c) Microsoft Corporation. All rights reserved.Loading Dump File [C:\Windows\Minidump\053015-8580-01.dmp]Mini Kernel Dump File: Only registers and stack trace are available************* Symbol Path validation summary **************Response                         Time (ms)     LocationDeferred                                       SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbolsSymbol search path is: SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbolsExecutable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64Product: WinNt, suite: TerminalServer SingleUserTS PersonalBuilt by: 7601.18839.amd64fre.win7sp1_gdr.150427-0707Machine Name:Kernel base = 0xfffff800`0345e000 PsLoadedModuleList = 0xfffff800`036a5730Debug session time: Sat May 30 07:11:38.548 2015 (UTC + 2:00)System Uptime: 0 days 0:32:16.719Loading Kernel Symbols.Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.Run !sym noisy before .reload to track down problems loading symbols...........................................................................................................................................................Loading User SymbolsLoading unloaded module list.........********************************************************************************                                                                             **                        Bugcheck Analysis                                    **                                                                             ********************************************************************************Use !analyze -v to get detailed debugging information.BugCheck D1, {fffff8800d89c050, 2, 1, fffff8800163b9bf}Probably caused by : tcpip.sys ( tcpip!UdpSendMessagesOnPathCreation+17f )Followup: MachineOwner---------2: kd> !analyze -v********************************************************************************                                                                             **                        Bugcheck Analysis                                    **                                                                             ********************************************************************************DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)An attempt was made to access a pageable (or completely invalid) address at aninterrupt request level (IRQL) that is too high.  This is usuallycaused by drivers using improper addresses.If kernel debugger is available get stack backtrace.Arguments:Arg1: fffff8800d89c050, memory referencedArg2: 0000000000000002, IRQLArg3: 0000000000000001, value 0 = read operation, 1 = write operationArg4: fffff8800163b9bf, address which referenced memoryDebugging Details:------------------WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff8000370f100GetUlongFromAddress: unable to read from fffff8000370f1c0 fffff8800d89c050 Nonpaged poolCURRENT_IRQL:  2FAULTING_IP: tcpip!UdpSendMessagesOnPathCreation+17ffffff880`0163b9bf 40883a          mov     byte ptr [rdx],dilCUSTOMER_CRASH_COUNT:  1DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULTBUGCHECK_STR:  0xD1PROCESS_NAME:  uTorrent.exeANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64freTRAP_FRAME:  fffff8800bf22930 -- (.trap 0xfffff8800bf22930)NOTE: The trap frame does not contain all registers.Some register values may be zeroed or incorrect.rax=fffff8800d89c000 rbx=0000000000000000 rcx=000000000000096brdx=fffff8800d89c050 rsi=0000000000000000 rdi=0000000000000000rip=fffff8800163b9bf rsp=fffff8800bf22ac0 rbp=fffffa8008ed1190 r8=ffffffffffffffff  r9=0000000000000000 r10=0000000000000000r11=0000fffffffff000 r12=0000000000000000 r13=0000000000000000r14=0000000000000000 r15=0000000000000000iopl=0         nv up ei pl zr na po nctcpip!UdpSendMessagesOnPathCreation+0x17f:fffff880`0163b9bf 40883a          mov     byte ptr [rdx],dil ds:fffff880`0d89c050=??Resetting default scopeLAST_CONTROL_TRANSFER:  from fffff800034d1e69 to fffff800034d28c0STACK_TEXT:  fffff880`0bf227e8 fffff800`034d1e69 : 00000000`0000000a fffff880`0d89c050 00000000`00000002 00000000`00000001 : nt!KeBugCheckExfffff880`0bf227f0 fffff800`034d0ae0 : fffffa80`08eca140 00000000`00000001 00000000`00000000 fffff880`0bf233e0 : nt!KiBugCheckDispatch+0x69fffff880`0bf22930 fffff880`0163b9bf : fffffa80`0aa23be0 fffffa80`00000000 fffffa80`00000001 fffffa80`08ed1190 : nt!KiPageFault+0x260fffff880`0bf22ac0 fffff880`0163c16e : fffffa80`0691ad80 fffff880`0172f4b0 fffff880`0bf23400 00000000`00000000 : tcpip!UdpSendMessagesOnPathCreation+0x17ffffff880`0bf22e40 fffff880`0163c6b5 : fffff880`0bf23370 00000000`000090e0 00000000`00000001 00000000`00000000 : tcpip!UdpSendMessages+0x1eefffff880`0bf23230 fffff800`034df1f8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!UdpTlProviderSendMessagesCalloutRoutine+0x15fffff880`0bf23260 fffff880`0163c748 : fffff880`0163c6a0 fffff800`037c7abd fffff880`0bf23b00 fffff880`0bf23501 : nt!KeExpandKernelStackAndCalloutEx+0xd8fffff880`0bf23340 fffff880`02c63e9e : fffffa80`07627840 fffffa80`09593e50 00000000`00000000 fffffa80`0b0aaf80 : tcpip!UdpTlProviderSendMessages+0x78fffff880`0bf233c0 fffff880`02c63ad3 : 00000000`00000014 fffff880`0bf23b60 fffff880`0bf23690 00000000`00000014 : afd!AfdTLFastDgramSend+0xbefffff880`0bf23460 fffff880`02c4704c : fffffa80`09593e50 fffff880`0bf23690 fffffa80`00000014 fffffa80`098c9be0 : afd!AfdFastDatagramSend+0x2e3fffff880`0bf23560 fffff800`037edbb3 : 00000000`00000000 fffffa80`098647e0 00000000`033cfa64 00000000`00000201 : afd!AfdFastIoDeviceControl+0x103cfffff880`0bf238d0 fffff800`037ee6a6 : fffff880`0bf23ab8 00000000`000005c4 00000000`00000001 00000000`00000000 : nt!IopXxxControlFile+0x373fffff880`0bf23a00 fffff800`034d1b53 : fffff880`0bf23b60 fffffa80`098bd490 fffff880`0bf23ab8 00000000`00000000 : nt!NtDeviceIoControlFile+0x56fffff880`0bf23a70 00000000`74032e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x1300000000`02f7f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74032e09STACK_COMMAND:  kbFOLLOWUP_IP: tcpip!UdpSendMessagesOnPathCreation+17ffffff880`0163b9bf 40883a          mov     byte ptr [rdx],dilSYMBOL_STACK_INDEX:  3SYMBOL_NAME:  tcpip!UdpSendMessagesOnPathCreation+17fFOLLOWUP_NAME:  MachineOwnerMODULE_NAME: tcpipIMAGE_NAME:  tcpip.sysDEBUG_FLR_IMAGE_TIMESTAMP:  533f5bd4IMAGE_VERSION:  6.1.7601.18438FAILURE_BUCKET_ID:  X64_0xD1_tcpip!UdpSendMessagesOnPathCreation+17fBUCKET_ID:  X64_0xD1_tcpip!UdpSendMessagesOnPathCreation+17fANALYSIS_SOURCE:  KMFAILURE_ID_HASH_STRING:  km:x64_0xd1_tcpip!udpsendmessagesonpathcreation+17fFAILURE_ID_HASH:  {f4a3a832-3eb1-6b8f-ac20-e0e493d5a4e4}Followup: MachineOwner---------

Cheers.

[DreadWingKnight]

Network driver or internet security software bug.

[rado84]

I know it's a bit late to reply to this topic but my suggestion could help someone else with this problem, so I'm gonna write it anyway: use a program named WhoCrashed. Simply run it and click the button "Analyze" then scroll down to see the results and it will tell you what caused the BSOD. I've been using WhoCrashed for a few months already and it was never wrong.