M mbrdfld Member Joined Aug 11, 2014 Posts 6 Aug 12, 2014 #1 Typically I get the error message when disconnecting from a VPN (I use four or five different VPN Clients) or while using an Internet Browser (I use both IE and Chrome). Windows 8.1 x64 Original Installed OS was Windows 7, upgraded to 8, then to 8.1 The original OS was OEM, but the upgrades were purchased from the Windows Store. System was purchased in Jan 2012. The latest OS was upgraded shortly after it was released - perhaps November or December of 2013. i7-2770QM CPU NVIDIA GEFORCE GTX 560M ASUS G74SX Laptop 16GB RAM I was unable to produce a PERFMON report - I kept getting an error. I am an admin user and I enabled the ADMIN account, but I still got the error with both users. Any help would be appreciated!
Typically I get the error message when disconnecting from a VPN (I use four or five different VPN Clients) or while using an Internet Browser (I use both IE and Chrome). Windows 8.1 x64 Original Installed OS was Windows 7, upgraded to 8, then to 8.1 The original OS was OEM, but the upgrades were purchased from the Windows Store. System was purchased in Jan 2012. The latest OS was upgraded shortly after it was released - perhaps November or December of 2013. i7-2770QM CPU NVIDIA GEFORCE GTX 560M ASUS G74SX Laptop 16GB RAM I was unable to produce a PERFMON report - I kept getting an error. I am an admin user and I enabled the ADMIN account, but I still got the error with both users. Any help would be appreciated!
Jared Sysnative Staff, BSOD Kernel Dump Expert Joined Feb 3, 2014 Posts 1,591 Aug 12, 2014 #2 The cause is your ShrewSoft VPN Adapter IM Filter Driver. Code: BugCheck A, {0, 2, 0, fffff800474bacbb} The context probably isn't saved but it's referencing pageable or invalid memory at an IRQL too high (dispatch level or above) Code: 1: kd> .trap 0xffffd000b4d4b6a0 NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000001 rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000 rip=fffff800474bacbb rsp=ffffd000b4d4b830 rbp=ffffe000243b4d98 r8=0000000000000000 r9=0000000000000000 r10=0000000000000000 r11=ffffe00029c97df0 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz ac pe cy nt!KeSetEvent+0x40b: fffff800`474bacbb 488b00 mov rax,qword ptr [rax] ds:00000000`00000000=???????????????? It is trying to move a pointer from rax to rax which doesn't make sense and isn't possible. It's most likely using a bad instruction pointer. Code: ffffd000`b4d4b558 fffff800`47579ae9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx ffffd000`b4d4b560 fffff800`4757833a : 00000000`00000000 ffffe000`243b4d90 ffffe000`23e7f000 ffffd000`b4d4b6a0 : nt!KiBugCheckDispatch+0x69 ffffd000`b4d4b6a0 fffff800`474bacbb : ffffe000`243b3040 fffff801`2309f280 ffffe000`3374e5c0 fffff801`2309009b : nt!KiPageFault+0x23a ffffd000`b4d4b830 fffff801`23a949a6 : 00000000`00000000 ffffe000`00000000 ffffe000`20ba7600 ffffe000`00000000 : nt!KeSetEvent+0x40b ffffd000`b4d4b8e0 00000000`00000000 : ffffe000`00000000 ffffe000`20ba7600 ffffe000`00000000 00000000`00000000 : vfilter+0x29a6 We can confirm that this is the cause by looking at the callstack. Code: 1: kd> lmvm vfilter start end module name fffff801`23a92000 fffff801`23a9c000 vfilter T (no symbols) Loaded symbol image file: vfilter.sys Image path: vfilter.sys Image name: vfilter.sys Timestamp: Thu Nov 19 00:06:23 2009 (4B048BFF) CheckSum: 0001348B ImageSize: 0000A000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 It's outdated, updating this driver should resolve the issue. http://www.shrew.net/support
The cause is your ShrewSoft VPN Adapter IM Filter Driver. Code: BugCheck A, {0, 2, 0, fffff800474bacbb} The context probably isn't saved but it's referencing pageable or invalid memory at an IRQL too high (dispatch level or above) Code: 1: kd> .trap 0xffffd000b4d4b6a0 NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000001 rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000 rip=fffff800474bacbb rsp=ffffd000b4d4b830 rbp=ffffe000243b4d98 r8=0000000000000000 r9=0000000000000000 r10=0000000000000000 r11=ffffe00029c97df0 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz ac pe cy nt!KeSetEvent+0x40b: fffff800`474bacbb 488b00 mov rax,qword ptr [rax] ds:00000000`00000000=???????????????? It is trying to move a pointer from rax to rax which doesn't make sense and isn't possible. It's most likely using a bad instruction pointer. Code: ffffd000`b4d4b558 fffff800`47579ae9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx ffffd000`b4d4b560 fffff800`4757833a : 00000000`00000000 ffffe000`243b4d90 ffffe000`23e7f000 ffffd000`b4d4b6a0 : nt!KiBugCheckDispatch+0x69 ffffd000`b4d4b6a0 fffff800`474bacbb : ffffe000`243b3040 fffff801`2309f280 ffffe000`3374e5c0 fffff801`2309009b : nt!KiPageFault+0x23a ffffd000`b4d4b830 fffff801`23a949a6 : 00000000`00000000 ffffe000`00000000 ffffe000`20ba7600 ffffe000`00000000 : nt!KeSetEvent+0x40b ffffd000`b4d4b8e0 00000000`00000000 : ffffe000`00000000 ffffe000`20ba7600 ffffe000`00000000 00000000`00000000 : vfilter+0x29a6 We can confirm that this is the cause by looking at the callstack. Code: 1: kd> lmvm vfilter start end module name fffff801`23a92000 fffff801`23a9c000 vfilter T (no symbols) Loaded symbol image file: vfilter.sys Image path: vfilter.sys Image name: vfilter.sys Timestamp: Thu Nov 19 00:06:23 2009 (4B048BFF) CheckSum: 0001348B ImageSize: 0000A000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 It's outdated, updating this driver should resolve the issue. http://www.shrew.net/support
x BlueRobot Administrator Staff member Joined May 7, 2013 Posts 10,171 Location %systemroot% Aug 12, 2014 #3 If you do still have problems with the software, then it may be worth filing a bug report to the company - https://www.shrew.net/support/VPN_Bug_Report_Windows
If you do still have problems with the software, then it may be worth filing a bug report to the company - https://www.shrew.net/support/VPN_Bug_Report_Windows
M mbrdfld Member Joined Aug 11, 2014 Posts 6 Aug 12, 2014 #4 Thank you for such a quick reply - I no longer use the ShrewSoft Client and hadn't even thought about it in months. I'll uninstall and see if it clears up the issue. Thank you!
Thank you for such a quick reply - I no longer use the ShrewSoft Client and hadn't even thought about it in months. I'll uninstall and see if it clears up the issue. Thank you!
P Patrick Sysnative Staff Joined Jun 7, 2012 Posts 4,618 Aug 12, 2014 #6 It is trying to move a pointer from rax to rax Click to expand... :lolg:
Jared Sysnative Staff, BSOD Kernel Dump Expert Joined Feb 3, 2014 Posts 1,591 Aug 12, 2014 #7 Makes sense... :lol:
x BlueRobot Administrator Staff member Joined May 7, 2013 Posts 10,171 Location %systemroot% Aug 13, 2014 #8 I thought a mov instruction on the same register would clear that register?
Jared Sysnative Staff, BSOD Kernel Dump Expert Joined Feb 3, 2014 Posts 1,591 Aug 13, 2014 #9 I'm not entirely sure to be honest...