Link to home
Start Free TrialLog in
Avatar of madcityguy
madcityguy

asked on

STOP 0x1000000d1 in ipnat.xyx

I've been having BSODs for quite a while now and I'm at the end of my (admittedly short) rope. They show up in ipnat.sys at various addresses but I think that's just a red herring. I deleted and recreated my Windows XP paging space, I ran verifier and found that I had a bluetooth audio driver that failed so I disabled it, I replaced both my RAM and hard drive and ran memtest for about 12 hours without any failure - HELP!!!

Would someone PLEASE help interpret my minidumps?  I zipped the last six of them and put them in www.geocities.com/minidiump (it's the file called minidump.zip in that directory).

Please help!
Avatar of baconyi
baconyi
Flag of Afghanistan image

best solution is do clean install, but if you dont want to do that, do a repair install...

boot up with the xp cd, hit enter to install like normal, f8 to agree, then it will search for previously installed windows...
if it finds it, great, hit R for repair install, you will need the product key again, but this doesnt delete any files/programs you have...

if it does NOT find a copy ofwindows and only option is to hit enter to install clean, then quit out of that and let us know.
Billy
Avatar of madcityguy
madcityguy

ASKER

Oh, yuck, this is a Dell 700m with preloaded WinXP. I see there's a program on the hard drive to create a recovery CD but I'm afraid it'll just be a full hard drive reload, and I'd rather not do that if I can help it.
well lets hope someone else has some solutions, but if not, and you want to, last resort do a format/clean install... but before doing so, download the drivers from dell first, esepcially the network card driver, brun it to a cd so you have them if you do decide you need to reload...
good luck
I'm going to increase the point value from its initial 250 points by 25 points each time I blue screen.  Guess what...
If you don't mind, go to C:\WINDOWS\system32\drivers and take a look at ipnat.sys by right-clicking on it and hitting properties.
I'd like to know the modified date, version number, and file size.
Some malicious programs, spyware, virii etc. have been known to modifiy or replace this file.
With that information I should be able to verify if is the correct Windows file.

Also to find out if it is a red herring, or the problem itself....
You can disable the Windows Firewall/Internet Connection.... service in services.msc and reboot.
Then see if the blue screen happens again.
 
Very interesting.  It's great to have someone question my assumptions.

ipnat.sys size is 134,912 bytes, size on disk is 135,168 bytes. Modified date is Wednesday, September 29, 2004 at 5:28:37 pm.  Version is 5.1.2600.2524 copyright Microsoft Corporation.  BTW, I forgot to mention that I'm running XP Pro SP2.

Also - you pointed out something interesting that I hadn't noticed.  I'm running McAfee and both McAfee and Windows Firewalls are running.  As you suggested I'm stopped the Windows Firewall/ICS service and changed the startup to manual.  With McAfee Firewall running do I need it on at all?

By the way, I'm headed out for the evening so I'll be shutting this PC down for the night soon so I won't have blue screens for a while!
No, there shouldn't be a need for Windows Firewall if you have Mcafee. Mcafee does everything the XP one does plus some.

The likelihood that they 2 firewalls are conflicting and causing the problem is small IMO, but before looking farther I like to try to rule things out.

Looks like the actual file is fine though.
I cani't download the minidump as the url is incorrect. Dump analysis is the proper procedure to diagnostic the problem.
Oops - my bad. It's www.geocities.com/gtung/minidump.  Oh, and today I'm running with the Windows firewall turned off (the service is off) but McAfee's firewall running, the way I THOUGHT I was running all along.  So far so good!
Your version of McAfee has known problem. Refer the following case
https://www.experts-exchange.com/questions/21695283/BSOD-on-accessing-local-aspx-pages.html
Your version of MpFirewall is the same as the above cases and it is at Nov 12 2005 (timestamp is 43751098)

MpFirewall.sys Sat Nov 12 05:43:52 2005 (43751098)

You also install ZoneAlarm at your windows and the version is at 2003. Why your windows have two firewalls?
When I upgraded to SP2 I didn't notice that the install activated the Windows firewall - I didn't mean to run two firewalls.  I have NEVER gotten any messages from the Windows firewall.

So far today my PC has been stable with McAfee firewall running and Windows firewall stopped.  I'm going to just let things run for a while as is before I turn off the McAfee firewall.  It could be that my problem is related to both firewalls being active at the same time.

Thank you for your reference to the problems that the other person had with MpFirewall.  I'm suspicious that my problems are related either to McAfee firewall or the combination of McAfee and Windows firewall being enabled at the same time.
ASKER CERTIFIED SOLUTION
Avatar of cpc2004
cpc2004
Flag of Hong Kong image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I never installed ZoneAlarm on this PC and it doesn't show up in either services or my Add/Remove programs list.  Is there something in the minidump that indicates that it's installed?
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Omigosh - I looked in the Device Manager Non-Plug and Play Drivers and see it there.  Status is stopped, startup type is demand.  With a bit of research I now believe that it got loaded on my system with my Cicso VPN client and only gets enabled when I enable the Cisco VPH client.  I was probably using the VPN client during the time that the first minidump was created.  I'm not sure I can get rid of it but I don't use the VPN client very often so it's probably not really a problem.
I wouldn't worry about it. It wasn't listed as being likely to have caused the problem, especially since it only gets loaded when needed.