wanarp.sys problem

[David Ellis]

Since installing Service Pack 3 to Windows 2000, I get frequent
bluescreen stops:

STOP: 0x000000D1
DRIVER_IRQL_NOT_LESS_OR_EQUAL
wanarp.sys

What exactly is the wanarp.sys driver? Is there an updated release
available? (The currently installed copy is version 5.0.2195.6601).

Sometimes the system reboots by itself, and sometimes it hangs on the
bluescreen and has to be powered off and on.

This never happened before installing SP3, and installing SP4 has not
helped. I have also installed a fresh TCP stack, every critical patch
on Windows Update, and all drivers that might be even remotely
relevant. No relief.

It was suggested that these errors might be caused by faulty RAM, so
I installed and ran RAM-scanning software, but there appear to be no
memory problems.

Would it be helpful to go back to the version of wanarp.sys that
existed before SP3 (5.0.2195.4874)? Or would that destabilize the
system even further?

My sysadmin says my only choices are to live with the crashes or wipe
the entire disk and reinstall the operating system, applications and
user data. Any better ideas?

 

[SteveC]

Since installing Service Pack 3 to Windows 2000, I get frequent
bluescreen stops:

STOP: 0x000000D1
DRIVER_IRQL_NOT_LESS_OR_EQUAL
wanarp.sys

If you perform a search in the Microsoft Knowledge base
(http://support.microsoft.com), for DRIVER_IRQL_NOT_LESS_OR_EQUAL,
you get some results. Maybe one of those applies in your case.

It was suggested that these errors might be caused by faulty RAM, so
I installed and ran RAM-scanning software, but there appear to be no
memory problems.

Have you tried replacing the RAM? I've never put much faith in RAM
scanning software.

Would it be helpful to go back to the version of wanarp.sys that
existed before SP3 (5.0.2195.4874)? Or would that destabilize the
system even further?

Probably not recommended to roll back part of a service pack.

My sysadmin says my only choices are to live with the crashes or wipe
the entire disk and reinstall the operating system, applications and
user data. Any better ideas?

Definitely make sure you have a valid backup of your data before
working on your problem some more. Make a second backup also. It
doesn't hurt to be too paranoid in a case like this.Sorry I wasn't much help, it seems that this would be a computer
specific problem.

regards,

SteveC
======
If at first you don't succeed, forget skydiving

 

[Steve Duff [MVP]]

You're not exactly the first to report this crash from
WANARP. For that reason I don't think I'd lay this
particular IRQL driver problem on hardware unless you are
experiencing other issues.

If you have any VPN client software, personal firewall,
network encryption software, etc. running, then try uninstalling that
first. These things swim in the same pool that WANARP lives in, and
can easily cause problems with it. IMHO this by far the most likely
cause of your issue.

If that doesn't do it, you also can try pulling in the
SP2 version of WANARP to see if that helps (since you
believe SP3 was the source of your woes). Always be ready with
a fallback plan when you do something like this in case the
system won't reboot correctly.

WANARP is a shim driver involved in updating the IP
route table to support remote access connections. If you're
relying on RAS, it may be a completely unessential driver. So if all
else fails, you can try disabling the driver completely.

Understand this: I have NO firm idea what effect this will
have -- other than WANARP won't be the source
of your crashes any longer. The functionality you lose may be
insignificant or IP-network-disabling. If nothing else you'll
find out for sure what WANARP does

To do that, you open the registry editor, scroll to HKLM...
CurrentControlSet...Services...WANARP, and set Start to 4.
If you have problems rebooting (I doubt you will), use F8 and
last-known-good. This will pull in the older registry control set
and services database. After you disable the driver you will
have to see just how much networking functionality you have.

And just to repeat, understand that these kinds of monkey-business
changes usher in the real possibility of an unbootable system. Always
have a backup plan. And a backup plan for that. But if you
are facing a complete reload anyway, you haven't got a lot
to lose.

Steve Duff, MCSE
Ergodic Systems, Inc.

 

[David Ellis]

WANARP is a shim driver involved in updating the IP
route table to support remote access connections. If you're
relying on RAS, it may be a completely unessential driver. So if all
else fails, you can try disabling the driver completely.

...you also can try pulling in the
SP2 version of WANARP to see if that helps (since you
believe SP3 was the source of your woes). Always be ready with
a fallback plan when you do something like this in case the
system won't reboot correctly.

I tried to replace my wanarp.sys in C:\winnt\system32\drivers with the
version that existed prior to SP3. But no sooner do I delete, rename
or overwrite the current version than another copy grows back in its
place. The same applies to the copy in the dllcache folder.

I even disconnected my Ethernet cable in an attempt to prevent
background plug&play processes from replacing the driver, but that
proved futile.

So how do I revert this driver to a previous version?

 

[dhaas]

You might have to try to replace the file in both
C:\winnt\system32\drivers
C:\WINDOWS\ServicePackFiles\i386

Windows has a nice feature that replaces some SYS files when It sees a change.

Might be an idea.