BSOD Win7

SirPorl · 11 May 2011

Been getting BSOD lately on a HP 6005pro

4gb ram
Win 7 Professional 32 bit , sp1 not applied
AMD Athlon II

zigzag3143 · 11 May 2011

SirPorl said:

Been getting BSOD lately on a HP 6005pro

4gb ram
Win 7 Professional 32 bit , sp1 not applied
AMD Athlon II

Several problems

These were both blamed on NETIO.SYS. Netio.sys is an OS file and usually when it is blamed it is caused by Zone Alarm. If so remove and replace with Microsoft Security essentials and the win 7 firewall.

http://download.zonealarm.com/bin/fr...cpes_clean.exe

http://www.microsoft.com/security_essentials/

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Dumps(!)\050611-19515-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82c06000 PsLoadedModuleList = 0x82d4e810
Debug session time: Fri May  6 23:09:06.544 2011 (GMT-4)
System Uptime: 1 days 1:20:15.965
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {d4, 2, 0, 8c6f0162}

*** WARNING: Unable to verify timestamp for tmtdi.sys
*** ERROR: Module load completed but symbols could not be loaded for tmtdi.sys
Probably caused by : NETIO.SYS ( NETIO!StreamGetCalloutContext+d4 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 000000d4, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8c6f0162, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82d6e718
Unable to read MiSystemVaType memory at 82d4e160
 000000d4 

CURRENT_IRQL:  2

FAULTING_IP: 
NETIO!StreamGetCalloutContext+d4
8c6f0162 833800          cmp     dword ptr [eax],0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  NTRtScan.exe

TRAP_FRAME:  9df3f1b4 -- (.trap 0xffffffff9df3f1b4)
ErrCode = 00000000
eax=000000d4 ebx=000000d0 ecx=9df3f234 edx=00000000 esi=00000240 edi=c0000017
eip=8c6f0162 esp=9df3f228 ebp=9df3f238 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
NETIO!StreamGetCalloutContext+0xd4:
8c6f0162 833800          cmp     dword ptr [eax],0    ds:0023:000000d4=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 8c6f0162 to 82c4c82b

STACK_TEXT:  
9df3f1b4 8c6f0162 badb0d00 00000000 00000049 nt!KiTrap0E+0x2cf
9df3f238 8c6f01f0 000042e4 00000000 00000118 NETIO!StreamGetCalloutContext+0xd4
9df3f270 8c6f1d58 000042e4 00000000 00000118 NETIO!StreamGetCalloutAndDataContexts+0x34
9df3f2ec 8c6dff56 9df30014 9da216f0 00000000 NETIO!StreamProcessCallout+0x63
9df3f350 8c6ca334 9df30014 9df3f5d4 9df3f5ec NETIO!ProcessCallout+0x120
9df3f3c4 8c6c925c 9df30014 9df3f5d4 9df3f5ec NETIO!ArbitrateAndEnforce+0xae
9df3f4d4 8c6ef332 9df30014 9df3f5d4 9df3f5ec NETIO!KfdClassify+0x1c7
9df3f568 8c6ef6fe 9df30014 9df3f5d4 9df3f5ec NETIO!StreamClassify+0xa0
9df3f748 8c6ef90f fe149dd0 9df30014 9df3f774 NETIO!StreamCommonInspect+0x252
9df3f77c 8c895f9a fe149dd0 9df30014 9df3f7e4 NETIO!WfpStreamInspectSend+0xcb
9df3f78c 8c85e24d fe149dd0 9df3f8e4 37c03000 tcpip!InetInspectSend+0x2b
9df3f7e4 8c8608e6 fe164008 9df3f8e4 00000000 tcpip!TcpEnqueueTcbSend+0x22e
9df3f800 82c95faa 9df3f890 b0d2cbf7 00000000 tcpip!TcpTlConnectionSendCalloutRoutine+0x17
9df3f868 8c85faab 8c8608cf 9df3f890 00000000 nt!KeExpandKernelStackAndCalloutEx+0x132
9df3f8a0 833d0d27 fe164001 9df3f800 8759a7e0 tcpip!TcpTlConnectionSend+0x73
9df3f904 833d62e3 00b62090 8759a7e0 8759a898 tdx!TdxSendConnection+0x1d7
9df3f920 82c424bc 8673dc88 8759a7e0 8759a7e0 tdx!TdxTdiDispatchInternalDeviceControl+0x115
9df3f938 9173b00c 9174047e 874976b8 10000000 nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
9df3f94c 9173ec72 867685a0 8759a7e0 8759a898 tmtdi+0xa00c
9df3fa2c 9173ed3d 8759a7e0 9d16e2e8 867685a0 tmtdi+0xdc72
9df3fa48 82c424bc 867685a0 86768658 8759a940 tmtdi+0xdd3d
9df3fa60 91643a0e 0c910aec 9df3fb20 00000001 nt!IofCallDriver+0x63
82c10aa9 08558bec 0a2335e8 04c25d00 90909000 afd!AfdFastConnectionSend+0x2a6
82c10abd 0478810c 00001000 08708b56 42680873 0x8558bec
82c10ac1 00000000 08708b56 42680873 504b4947 0x478810c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!StreamGetCalloutContext+d4
8c6f0162 833800          cmp     dword ptr [eax],0

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  NETIO!StreamGetCalloutContext+d4

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bbf63

FAILURE_BUCKET_ID:  0xD1_NETIO!StreamGetCalloutContext+d4

BUCKET_ID:  0xD1_NETIO!StreamGetCalloutContext+d4

Followup: MachineOwner
---------

1: kd> lmvm NETIO
start    end        module name
8c6c7000 8c705000   NETIO      (pdb symbols)          c:\symbols\netio.pdb\7F1011FAA7384AA9A72A0165AC1B90962\netio.pdb
    Loaded symbol image file: NETIO.SYS
    Mapped memory image file: C:\Symbols\NETIO.SYS\4A5BBF633e000\NETIO.SYS
    Image path: \SystemRoot\system32\drivers\NETIO.SYS
    Image name: NETIO.SYS
    Timestamp:        Mon Jul 13 19:12:35 2009 (4A5BBF63)
    CheckSum:         000420A0
    ImageSize:        0003E000
    File version:     6.1.7600.16385
    Product version:  6.1.7600.16385
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.6 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     netio.sys
    OriginalFilename: netio.sys
    ProductVersion:   6.1.7600.16385
    FileVersion:      6.1.7600.16385 (win7_rtm.090713-1255)
    FileDescription:  Network I/O Subsystem
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

Old drivers needing update from as far back as 2001

Code:

SENTINEL.SYS    6/19/2001 07:35:16 PM    0x925ee000    0x00012000    0x3b2fe1b4    0x925dc000                            
u2s2kxp.sys    5/4/2004 09:25:01 PM    0x97ee3b00    0x00005b00    0x4098426d    0x97ede000                            
USA19H2kp.SYS    5/29/2007 07:32:56 PM    0x97f97e80    0x00005e80    0x465cb828    0x97f92000                            
USA19H2k.sys    10/30/2007 03:41:44 PM    0x97f91e00    0x000abe00    0x472788f8    0x97ee6000                            
PxHelp20.sys    3/12/2008 09:57:44 PM    0x8c3b9200    0x00009200    0x47d88a18    0x8c3b0000                            
atikmdag.sys    4/24/2009 06:50:20 AM    0x92473000    0x00454000    0x49f1996c    0x9201f000                            
AtiPcie.sys    5/5/2009 11:00:16 AM    0x8c7b2000    0x00008000    0x4a005480    0x8c7aa000                            
spldr.sys    5/11/2009 12:13:47 PM    0x8c9cc000    0x00008000    0x4a084ebb    0x8c9c4000                            
amdxata.sys    5/19/2009 01:57:35 PM    0x8c36b000    0x00009000    0x4a12f30f    0x8c362000                            
b57nd60x.sys    5/28/2009 09:58:23 PM    0x925c3000    0x00041000    0x4a1f413f    0x92582000                            
RTKVHDA.sys    7/2/2009 05:28:49 AM    0x97ea0d80    0x00286d80    0x4a4c7dd1    0x97c1a000

How To Find Drivers:

- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

SirPorl · 11 May 2011

Interesting, there is no zone alarm on the system and there never was. Security program on there is Trend Micro OfficeScan 10.5

Yes the old drivers, I will have to look into those.

zigzag3143 · 11 May 2011

SirPorl said:

Interesting, there is no zone alarm on the system and there never was. Security program on there is Trend Micro OfficeScan 10.5

Yes the old drivers, I will have to look into those.

If no ZA then you can run a system file check to verify and repair the Netio.sys.

Run a system file check to verify and repair your system files.
To do this type cmd in search, then right click to run as administrator, then
SFC /SCANNOW

Read here for more information SFC /SCANNOW Command - System File Checker

Let us know the results from the report at the end.