BSOD - ndis.sys

[SuperJ]

Hi,

I'm running Wingate 6.04 on the following PC;

- Celeron 333Mhz
- 256 MB RAM
- USB ASDL dial-up modem(great speed GS-U210G_Neo)
- 3Com EtherLink XL 10/100 PCI NIC (3C905-TX)
- Windows XP srv pk 2
- Bandwidth Controller v1.07

In the last 24hrs I've had 4 bluescreens. They all say it has to do with NDIS.sys. I've copied the ENS driver (qbikhkxp.sys) from ver 6.1.4 to c:\windows\system32\drivers of my v6.0.4 installation but the blue screens continue. I only use DNS and NAT from wingate. All other services are disable.

Here is an analysis of the last four minidumps;

----- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion 0000000f
MinorVersion 00000a28
DirectoryTableBase 00039000
PfnDataBase 8104a000
PsLoadedModuleList 8055ab20
PsActiveProcessHead 80560bd8
MachineImageType 0000014c
NumberProcessors 00000001
BugCheckCode 1000007e
BugCheckParameter1 c0000005
BugCheckParameter2 f982891b
BugCheckParameter3 f9e89b80
BugCheckParameter4 f9e8987c
PaeEnabled 00000000
KdDebuggerDataBlock 8054c760
MiniDumpFields 00000dff

TRIAGE_DUMP32:
ServicePackBuild 00000200
SizeOfDump 00010000
ValidOffset 0000fffc
ContextOffset 00000320
ExceptionOffset 000007d0
MmOffset 00001068
UnloadedDriversOffset 000010a0
PrcbOffset 00001878
ProcessOffset 000024c8
ThreadOffset 00002728
CallStackOffset 00002980
SizeOfCallStack 0000041c
DriverListOffset 00003030
DriverCount 00000090
StringPoolOffset 00005af0
StringPoolSize 000013b8
BrokenDriverOffset 00000000
TriageOptions 00000041
TopOfStack f9e89be4
DebuggerDataOffset 00002da0
DebuggerDataSize 00000290
DataBlocksOffset 00006ea8
DataBlocksCount 00000006


Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Tue Jul 25 06:38:06 2006
System Uptime: 2 days 15:34:59
start end module name
804d7000 806eb780 nt Checksum: 002160C9 Timestamp: Wed Aug 04 02:19:48 2004 (41108004)

Unloaded modules:
f9d6a000 f9d71000 gafwload.sys Timestamp: unavailable (00000000)
f9c72000 f9c7d000 imapi.sys Timestamp: unavailable (00000000)
f9c62000 f9c6b000 intelppm.sys Timestamp: unavailable (00000000)
f9e1a000 f9e1f000 Cdaudio.SYS Timestamp: unavailable (00000000)
f975d000 f9760000 Sfloppy.SYS Timestamp: unavailable (00000000)

Finished dump check
----- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion 0000000f
MinorVersion 00000a28
DirectoryTableBase 00039000
PfnDataBase 8104a000
PsLoadedModuleList 8055ab20
PsActiveProcessHead 80560bd8
MachineImageType 0000014c
NumberProcessors 00000001
BugCheckCode 1000007e
BugCheckParameter1 c0000005
BugCheckParameter2 f982891b
BugCheckParameter3 f9e89b90
BugCheckParameter4 f9e8988c
PaeEnabled 00000000
KdDebuggerDataBlock 8054c760
MiniDumpFields 00000dff

TRIAGE_DUMP32:
ServicePackBuild 00000200
SizeOfDump 00010000
ValidOffset 0000fffc
ContextOffset 00000320
ExceptionOffset 000007d0
MmOffset 00001068
UnloadedDriversOffset 000010a0
PrcbOffset 00001878
ProcessOffset 000024c8
ThreadOffset 00002728
CallStackOffset 00002980
SizeOfCallStack 0000040c
DriverListOffset 00003020
DriverCount 0000008c
StringPoolOffset 000059b0
StringPoolSize 00001320
BrokenDriverOffset 00000000
TriageOptions 00000041
TopOfStack f9e89bf4
DebuggerDataOffset 00002d90
DebuggerDataSize 00000290
DataBlocksOffset 00006cd0
DataBlocksCount 00000006


Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Thu Jul 27 20:36:48 2006
System Uptime: 0 days 15:09:01
start end module name
804d7000 806eb780 nt Checksum: 002160C9 Timestamp: Wed Aug 04 02:19:48 2004 (41108004)

Unloaded modules:
f9d4a000 f9d51000 gafwload.sys Timestamp: unavailable (00000000)
f9d4a000 f9d51000 gafwload.sys Timestamp: unavailable (00000000)
f9c72000 f9c7d000 imapi.sys Timestamp: unavailable (00000000)
f9c62000 f9c6b000 intelppm.sys Timestamp: unavailable (00000000)
f9c52000 f9c62000 serial.sys Timestamp: unavailable (00000000)
f9e12000 f9e17000 Cdaudio.SYS Timestamp: unavailable (00000000)
f9769000 f976c000 Sfloppy.SYS Timestamp: unavailable (00000000)

Finished dump check
----- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion 0000000f
MinorVersion 00000a28
DirectoryTableBase 00039000
PfnDataBase 8104a000
PsLoadedModuleList 8055ab20
PsActiveProcessHead 80560bd8
MachineImageType 0000014c
NumberProcessors 00000001
BugCheckCode 1000007e
BugCheckParameter1 c0000005
BugCheckParameter2 f982891b
BugCheckParameter3 f9e79b74
BugCheckParameter4 f9e79870
PaeEnabled 00000000
KdDebuggerDataBlock 8054c760
MiniDumpFields 00000dff

TRIAGE_DUMP32:
ServicePackBuild 00000200
SizeOfDump 00010000
ValidOffset 0000fffc
ContextOffset 00000320
ExceptionOffset 000007d0
MmOffset 00001068
UnloadedDriversOffset 000010a0
PrcbOffset 00001878
ProcessOffset 000024c8
ThreadOffset 00002728
CallStackOffset 00002980
SizeOfCallStack 00000428
DriverListOffset 00003038
DriverCount 0000008b
StringPoolOffset 00005980
StringPoolSize 00001310
BrokenDriverOffset 00000000
TriageOptions 00000041
TopOfStack f9e79bd8
DebuggerDataOffset 00002da8
DebuggerDataSize 00000290
DataBlocksOffset 00006c90
DataBlocksCount 00000006


Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Fri Jul 28 12:32:16 2006
System Uptime: 0 days 12:31:56
start end module name
804d7000 806eb780 nt Checksum: 002160C9 Timestamp: Wed Aug 04 02:19:48 2004 (41108004)

Unloaded modules:
f9d6a000 f9d71000 gafwload.sys Timestamp: unavailable (00000000)
f9c72000 f9c7d000 imapi.sys Timestamp: unavailable (00000000)
f9c62000 f9c6b000 intelppm.sys Timestamp: unavailable (00000000)
f9c52000 f9c62000 serial.sys Timestamp: unavailable (00000000)
f9e12000 f9e17000 Cdaudio.SYS Timestamp: unavailable (00000000)
f976d000 f9770000 Sfloppy.SYS Timestamp: unavailable (00000000)

Finished dump check
----- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion 0000000f
MinorVersion 00000a28
DirectoryTableBase 00039000
PfnDataBase 8104a000
PsLoadedModuleList 8055ab20
PsActiveProcessHead 80560bd8
MachineImageType 0000014c
NumberProcessors 00000001
BugCheckCode 1000007e
BugCheckParameter1 c0000005
BugCheckParameter2 f982891b
BugCheckParameter3 f9e79b64
BugCheckParameter4 f9e79860
PaeEnabled 00000000
KdDebuggerDataBlock 8054c760
MiniDumpFields 00000dff

TRIAGE_DUMP32:
ServicePackBuild 00000200
SizeOfDump 00010000
ValidOffset 0000fffc
ContextOffset 00000320
ExceptionOffset 000007d0
MmOffset 00001068
UnloadedDriversOffset 000010a0
PrcbOffset 00001878
ProcessOffset 000024c8
ThreadOffset 00002728
CallStackOffset 00002980
SizeOfCallStack 00000438
DriverListOffset 00003048
DriverCount 0000008a
StringPoolOffset 00005940
StringPoolSize 000012f0
BrokenDriverOffset 00000000
TriageOptions 00000041
TopOfStack f9e79bc8
DebuggerDataOffset 00002db8
DebuggerDataSize 00000290
DataBlocksOffset 00006c30
DataBlocksCount 00000006


Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Fri Jul 28 13:18:14 2006
System Uptime: 0 days 0:40:02
start end module name
804d7000 806eb780 nt Checksum: 002160C9 Timestamp: Wed Aug 04 02:19:48 2004 (41108004)

Unloaded modules:
f93e4000 f9405000 ipnat.sys Timestamp: unavailable (00000000)
f9d8a000 f9d91000 gafwload.sys Timestamp: unavailable (00000000)
f9d42000 f9d49000 gafwload.sys Timestamp: unavailable (00000000)
f9c72000 f9c7d000 imapi.sys Timestamp: unavailable (00000000)
f9c62000 f9c6b000 intelppm.sys Timestamp: unavailable (00000000)
f9c52000 f9c62000 serial.sys Timestamp: unavailable (00000000)
f9e12000 f9e17000 Cdaudio.SYS Timestamp: unavailable (00000000)
f976d000 f9770000 Sfloppy.SYS Timestamp: unavailable (00000000)

Finished dump check

Here is my ipconfig/all;

Windows IP Configuration

Host Name . . . . . . . . . . . . : EXPERIENCE
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : 3Com EtherLink XL 10/100 PCI TX NIC (3C905B-TX) #2
Physical Address. . . . . . . . . : 00-50-04-98-45-26
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 10.0.0.1
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :

PPP adapter GreatSpeed PPPoA Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
Physical Address. . . . . . . . . : 00-53-45-00-00-00
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 209.59.110.210
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . : 209.59.110.210
DNS Servers . . . . . . . . . . . : 69.57.239.200
205.160.233.2
NetBIOS over Tcpip. . . . . . . . : Disabled

Any help would be highly appreciated.

Regards,
supaJ.

[adrien]

Hi

We'll have to check into that minidump.

You aren't running bridging are you?

Also, you should upgrade fully to 6.1.4 if you're running the 6.1.4 driver, there were a couple of things changed with the interface between the driver and the engine.

Adrien

[SuperJ]

No, I'm not running bridging. I'm only using one network card as my internal interface. My second NIC is disable from device manager. My external interface is an ADSL USB modem. Why did you asked? Neither I'm I running support for multiple subnetworks from Wingate.

If you need any other information please don't hesitate to ask me. I find Wingate too good a solution to let go but I don't know how much longer I can keep up with the BSOD.

[genie]

I would recommend uninstalling Bandwidth controller and running the system without it - we had reports on various conflicts with this software.

[SuperJ]

Hi,

Uninstall bandwidth controller? Well... My internet connection is almost unusable without a traffic shaper/bandwidth limiter. I need traffic shaping both home and at school. Some users just hog the bandwidth with P2P software and make it impossible to surf the internet.

I used bandwidth controller(BC) v1.07 mainly for the following reasons;

1) prioritizing http(port 80,443) traffic. In that way downloading webpages is smooth for everyone.

2) prioritizing VOIP(e.g Skype) and audio streaming(e.g BBC news - real audio, port 554) traffic

3) limiting upload bandwidth for everyone(all ports).

4) limiting download for p2p traffic(ed2k-4661-4672, Gnutella-6346-6347), etc

Unfortunately there are few Windows solutions for traffic shaping and I've found BC to be one of the best. I've tried wingate for that but it did not work properly for me. I don't know if I was doing something wrong. If someone could elaborate an example, then I will try again.

The other issue I had with wingate is activating/de-activating filters on the fly. It would totally kill the traffic in concern when activating a filter unlike BC which does not stop your traffic.

Finally, could the staff at wingate use the 4 minidumps I send via email to determine whether the cause of the blue screen is really Winagte, BC or even my ADSL USB modem drivers? I don't know if this is possible. The experts would know.

Thanks a million, especially Adrien and Gene for responding to all my post and emails.

Regards,
SupaJ

[genie]

Working on the dumps - but having multiple hooks installed on one system is never a good idea - we'll see if we can make these two birds compatible.