Windows 7: BSOD bother

jbreiman · 06 Nov 2010

Not exactly sure whats up. Its a custom build and was always fine til a bit ago so Im not sure what changed. Thanks ahead of time!

Is Windows 7 . . .
- x64 ?
- the original installed OS on the system
- full retail version?
- What is the age of system (hardware)? 6 months
- What is the age of OS installation 2 weeks

wish · 06 Nov 2010

Hi,
Your dumps blame on Netio.sys as the cause so I would recommend to uninstall Zone Alarm completely. Then turn on your windows built-in firewall.
Use this tools if you have problem to uninstall ZA:
http://download.zonealarm.com/bin/fr...cpes_clean.exe

And in the perform report : "A logical disk has the dirty bit set"
So run checkdisk : Command prompt (as admin) --> chkdsk /r /f

Then for troubleshooting purpose, it's better to uninstall Kaspersky and replace it with MSE.
http://www.microsoft.com/security_essentials/

Log

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80050031, 6f8, fffff80002a88d91}

Probably caused by : NETIO.SYS ( NETIO!CompareSecurityContexts+6a )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff80002a88d91

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002a82ca9 to fffff80002a83740

STACK_TEXT:  
fffff800`03fb4d28 fffff800`02a82ca9 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff800`03fb4d30 fffff800`02a81172 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`03fb4e70 fffff800`02a88d91 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`097cdfc0 fffff800`02a4bf6a : fffffa80`062a58f0 00000000`00000001 00000000`00000000 fffffa80`048a17c8 : nt!SeAccessCheckWithHint+0x301
fffff880`097ce0a0 fffff880`01592c5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SeAccessCheckFromState+0x102
fffff880`097ce790 fffff880`0159094f : 00000000`c0000022 00000000`00000000 00000000`00000000 00000000`00000000 : NETIO!CompareSecurityContexts+0x6a
fffff880`097ce800 fffff880`015929b5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : NETIO!MatchValues+0xef
fffff880`097ce850 fffff880`01592845 : fffffa80`04fa5260 fffffa80`062a2690 fffff880`097cea78 fffff880`097cf1b0 : NETIO!FilterMatch+0x95
fffff880`097ce8a0 fffff880`01593ccb : 00000000`00000000 00000000`00000000 fffff880`097cf1b0 fffff880`097cea60 : NETIO!IndexListClassify+0x69
fffff880`097ce920 fffff880`0163f417 : fffff880`097cedf8 fffff880`097cedf8 fffff880`097cfb30 fffffa80`076a0ac0 : NETIO!KfdClassify+0xa4e
fffff880`097cec90 fffff880`0163883e : fffff880`01747690 00000000`00000000 fffffa80`05d38c60 00000000`00000000 : tcpip!WfpAleClassify+0x57
fffff880`097cecd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!WfpAlepAuthorizeSend+0x94e


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!CompareSecurityContexts+6a
fffff880`01592c5a 448b442470      mov     r8d,dword ptr [rsp+70h]

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  NETIO!CompareSecurityContexts+6a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4bbe946f

FAILURE_BUCKET_ID:  X64_0x7f_8_NETIO!CompareSecurityContexts+6a

BUCKET_ID:  X64_0x7f_8_NETIO!CompareSecurityContexts+6a

Followup: MachineOwner
---------

richc46 · 06 Nov 2010

Reviewing your mini dmp, it does appear that Zone Alarm has a high potential of being the cause. In lieu of removing you can try this hot fix
hotfix
Stop error message when you run an application that transfers data by using the UDP protocol in Windows Server 2008 R2 or in Windows 7: "STOP 0x0000007F"

The choice is yours, there are many firewalls out there, Windows FireWall to name just one.

Windows 7: BSOD bother

BSOD bother problems?