Solving the Blue Screen of Death

Something has been causing my work notebook to BSOD. It had happened several times, but I had no idea what the root cause was. On my blog feed, the following showed up: Mark’s Blog: The Case of the Crashed Phone Call from Mark Russinovich at Microsoft.

I thought I’d try to diagnose the crash this way, so I downloaded Debugging Tools for Windows from Microsoft, started WinDbg, set symbol paths and opened the crash dump…

Use !analyze -v to get detailed debugging information.
BugCheck 1000007F, {8, 803d3130, 0, 0}
Unable to load image \SystemRoot\system32\DRIVERS\dne2000.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dne2000.sys
*** ERROR: Module load completed but symbols could not be loaded for dne2000.sys
*** WARNING: Unable to verify timestamp for CVPNDRVA.sys
*** ERROR: Module load completed but symbols could not be loaded for CVPNDRVA.sys
Unable to load image \SystemRoot\system32\DRIVERS\NETw5v32.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NETw5v32.sys
*** ERROR: Module load completed but symbols could not be loaded for NETw5v32.sys
Probably caused by : dne2000.sys ( dne2000+14ced )

Looks interesting; clicking the analyse link yields:

… some stuff cut for brevity …

MODULE_NAME: dne2000
IMAGE_NAME:  dne2000.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  47ed8d72
FAILURE_BUCKET_ID:  0x7f_8_dne2000+14ced
BUCKET_ID:  0x7f_8_dne2000+14ced

What is dne2000.sys (it is clickable to get more information)?

1: kd> lmvm dne2000
start    end        module name
807ce000 807eb480   dne2000  T (no symbols)
Loaded symbol image file: dne2000.sys
Image path: \SystemRoot\system32\DRIVERS\dne2000.sys
Image name: dne2000.sys
Timestamp:        Sat Mar 29 11:29:38 2008 (47ED8D72)
CheckSum:         00028B49
ImageSize:        0001D480
Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Navigating to c:\windows\system32\Drivers, I find dne2000.sys and look at version info to see a company called ‘Deterministic Networks’.

Searching for this company on google, I find out that this is installed by Cisco VPN which I use to login remotely to the work LAN. I also find the URL: http://www.deterministicnetworks.com/support/dnesupport.asp

This redirects to http://www.citrix.com/lang/English/lp/lp_1680845.asp (it turns out Cytrix have bought Deterministic Networks).

Downloading dneupdate.msi and running the installation, the version of this driver goes from 3.21.11.17845 to 3.22.4.17992 and I have had no crashes since.

Advertisement