Getting BlueScreen error code D1

Question

Original title: Problem Event Name: BlueScreen

Hello,

My PC has been shutting automatically and there appears a blue screens.

Here are the details:

Problem signature:

Problem Event Name: BlueScreen

OS Version: 6.1.7601.2.1.0.256.1

Locale ID: 1033

Additional information about the problem:

BCCode: d1

BCP1: FFFFF880065EF168

BCP2: 0000000000000002

BCP3: 0000000000000000

BCP4: FFFFF88004B51861

OS Version: 6_1_7601

Service Pack: 1_0

Product: 256_1

Files that help describe the problem:

C:\Windows\Minidump\073113-57829-01.dmp

C:\Users\admin\AppData\Local\Temp\WER-83569-0.sysdata.xml

Read our privacy statement online:

http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:

C:\Windows\system32\en-US\erofflps.txt

Thanks in advance.

Answer 1

The  "ANOD Network Security Filter Driver" is not a component of Windows and appears to be installed with some D-Link software and may be used for network management.

It would not be necessary software.

Hopefully uninstalling the  "ANOD Network Security Filter Driver" will prevent the problematic anodlwfx.sys from loading and therefore stop the blue screen errors.

Answer 2

 

 

For local area connection its <Realtek PCIe GBE Family Controller>.

For Wireless connection it is <D-Link DWA-525 Wireless N 150 Desktop Adapter(rev.A2)>

Can you right-click local area connection and select "Properties"

What is listed under "This connection uses the following items" - see screenshot - what is in the red rectangle is what I am looking for.

I am thing thinking may be a protocol there related to the anodlwfx.sys.

Answer 3

Same cause...

OUTPUT:

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffff880061ef022, 2, 0, fffff88004991861}

*** WARNING: Unable to verify timestamp for anodlwfx.sys

*** ERROR: Module load completed but symbols could not be loaded for anodlwfx.sys

Probably caused by : anodlwfx.sys ( anodlwfx+2861 )

Followup: MachineOwner

---

2: kd> !analyze -v

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high.  This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: fffff880061ef022, memory referenced

Arg2: 0000000000000002, IRQL

Arg3: 0000000000000000, value 0 = read operation, 1 = write operation

Arg4: fffff88004991861, address which referenced memory

Debugging Details:

---

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030f7100

GetUlongFromAddress: unable to read from fffff800030f71c0

fffff880061ef022 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP:

anodlwfx+2861

fffff880`04991861 668b040a        mov     ax,word ptr [rdx+rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  dwm.exe

TAG_NOT_DEFINED_c000000f:  FFFFF88003794FB0

TRAP_FRAME:  fffff880037948d0 -- (.trap 0xfffff880037948d0)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=fffffa800890015e rbx=0000000000000000 rcx=fffffa8008900700

rdx=fffffdfffd8ee922 rsi=0000000000000000 rdi=0000000000000000

rip=fffff88004991861 rsp=fffff88003794a68 rbp=fffff880061eea80

r8=00000000000005a4  r9=0000000000000000 r10=fffff880049909d8

r11=fffffa800890015e r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0         nv up ei ng nz na po nc

anodlwfx+0x2861:

fffff88004991861 668b040a        mov     ax,word ptr [rdx+rcx] ds:fffff880061ef022=????

Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ebf1a9 to fffff80002ebfc00

STACK_TEXT:

fffff88003794788 fffff80002ebf1a9 : 000000000000000a fffff880061ef022 0000000000000002 0000000000000000 : nt!KeBugCheckEx

fffff88003794790 fffff80002ebde20 : fffffa80080271a0 0000000000000002 0000000000000001 fffffa80080a3728 : nt!KiBugCheckDispatch+0x69

fffff880037948d0 fffff88004991861 : fffff88004991490 0000000000000000 00000000a0000003 fffffa80087a8300 : nt!KiPageFault+0x260

fffff88003794a68 fffff88004991490 : 0000000000000000 00000000a0000003 fffffa80087a8300 fffffa80087a8300 : anodlwfx+0x2861

fffff88003794a70 0000000000000000 : 00000000a0000003 fffffa80087a8300 fffffa80087a8300 fffffa80080a3620 : anodlwfx+0x2490

STACK_COMMAND:  kb

FOLLOWUP_IP:

anodlwfx+2861

fffff880`04991861 668b040a        mov     ax,word ptr [rdx+rcx]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  anodlwfx+2861

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: anodlwfx

IMAGE_NAME:  anodlwfx.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49b0f680

FAILURE_BUCKET_ID:  X64_0xD1_anodlwfx+2861

BUCKET_ID:  X64_0xD1_anodlwfx+2861

Followup: MachineOwner

---

2: kd> lmvm anodlwfx

start             end                 module name

fffff8800498f000 fffff88004998000   anodlwfx T (no symbols)

Loaded symbol image file: anodlwfx.sys

Image path: \SystemRoot\system32\DRIVERS\anodlwfx.sys

Image name: anodlwfx.sys

Timestamp:        Fri Mar 06 16:10:08 2009 (49B0F680)

CheckSum:         0000A8C3

ImageSize:        00009000

Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Thanks, but I am still looking for drivers/software that causing it.It is unresolved.

Answer 4

I have uninstalled D-Link wireless drives now to see whether it causes the issue.

Hi B_Bond_007,

 

Which D-Link wireless adapter were you using?

 

Also, can you check here:

 

Open the Network and Sharing Center of the Taskbar > Change adapter settings > right-click Local Area Connection > Properties

 

Under "This connection uses the following items" what is listed?

 

 

For local area connection its <Realtek PCIe GBE Family Controller>.

For Wireless connection it is <D-Link DWA-525 Wireless N 150 Desktop Adapter(rev.A2)>

Answer 5

I have uninstalled D-Link wireless drives now to see whether it causes the issue.

Hi B_Bond_007,

Which D-Link wireless adapter were you using?

Also, can you check here:

Open the Network and Sharing Center of the Taskbar > Change adapter settings > right-click Local Area Connection > Properties

Under "This connection uses the following items" what is listed?