Windows 7 64 bit Blue Screen

Abaf · 05 Jun 2011

Hello guys im having Blue screen problem(faced more than 5 times) in my pc . let me know how to fix it, i know you ppl are experts that's why im here,i have attached the Dump files (a/c to the instructions) ,pc specs and System Resource and performance report...

zigzag3143 · 05 Jun 2011

Abaf said:

Hello guys im having Blue screen problem(faced more than 5 times) in my pc . let me know how to fix it, i know you ppl are experts that's why im here,i have attached the Dump files (a/c to the instructions) ,pc specs and System Resource and performance report...

Blamed on NETIO.SYS. Usually caused by ZONE ALARM.

I would remove zone alarm and avg and replace with Microsoft security essentials and the win 7 firewall.

http://download.zonealarm.com/bin/fr...cpes_clean.exe

AVG - PC TuneUp 2011 | Registry Cleaner, File Recovery, Internet Accelerator

or

AVG Removal Tool

Virus, Spyware & Malware Protection | Microsoft Security Essentials

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\060611-15506-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02a5b000 PsLoadedModuleList = 0xfffff800`02c98e50
Debug session time: Sun Jun  5 15:39:42.236 2011 (GMT-4)
System Uptime: 0 days 2:03:32.376
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80050031, 6f8, fffff80002ad0d91}

Probably caused by : NETIO.SYS ( NETIO!CompareSecurityContexts+6a )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff80002ad0d91

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002acaca9 to fffff80002acb740

STACK_TEXT:  
fffff800`00ba4d28 fffff800`02acaca9 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff800`00ba4d30 fffff800`02ac9172 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`00ba4e70 fffff800`02ad0d91 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`06d46fd0 fffff800`02a93f5a : fffffa80`0474f8d0 00000000`00000001 00000000`00000000 fffffa80`026f27c8 : nt!SeAccessCheckWithHint+0x301
fffff880`06d470b0 fffff880`01705c5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SeAccessCheckFromState+0x102
fffff880`06d477a0 fffff880`0170394f : 00000000`c0000022 00000000`00000000 00000000`00000000 00000000`00000000 : NETIO!CompareSecurityContexts+0x6a
fffff880`06d47810 fffff880`017059b5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : NETIO!MatchValues+0xef
fffff880`06d47860 fffff880`01705845 : fffffa80`0304b310 fffffa80`04748750 fffff880`06d47a88 fffff880`06d481c0 : NETIO!FilterMatch+0x95
fffff880`06d478b0 fffff880`01706ccb : 00000000`00000000 00000000`00000000 fffff880`06d481c0 fffff880`06d47a70 : NETIO!IndexListClassify+0x69
fffff880`06d47930 fffff880`0183f417 : fffff880`06d47e08 fffff880`06d47e08 fffff880`06d48b40 fffffa80`023885e0 : NETIO!KfdClassify+0xa4e
fffff880`06d47ca0 fffff880`0183883e : fffff880`01947690 00000000`00000000 fffffa80`02c41a00 00000000`00000000 : tcpip!WfpAleClassify+0x57
fffff880`06d47ce0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!WfpAlepAuthorizeSend+0x94e


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!CompareSecurityContexts+6a
fffff880`01705c5a 448b442470      mov     r8d,dword ptr [rsp+70h]

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  NETIO!CompareSecurityContexts+6a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4bbe946f

FAILURE_BUCKET_ID:  X64_0x7f_8_NETIO!CompareSecurityContexts+6a

BUCKET_ID:  X64_0x7f_8_NETIO!CompareSecurityContexts+6a

Followup: MachineOwner
---------

Abaf · 06 Jun 2011

Thanx for the troubleshoot i really like ZoneALarm and im not using AVG instead im using Avira Free Av

"Microsoft security essentials and the win 7 firewall" would the work...

i will simply follow your suggestion b/c i wanna shoot the problem..

What about the high usage of memory resources ? which program is causing that ?

zigzag3143 · 06 Jun 2011

Abaf said:

Thanx for the troubleshoot i really like ZoneALarm and im not using AVG instead im using Avira Free Av

"Microsoft security essentials and the win 7 firewall" would the work...

i will simply follow your suggestion b/c i wanna shoot the problem..

What about the high usage of memory resources ? which program is causing that ?

You are of course correct. Avira uses this file which to all the world looks like AVG hence my confusion

avgntflt.sys 11/11/2010 11:59:48 AM fffff880`0578e000 fffff880`057ab000 0x0001d000 0x4cdc12f4

avgntfltavgntflt.sysRelated to Avira Security Suite.

In any case it should be removed.

Avira AntiVir Removal Tool - Download

Abaf · 07 Jun 2011

I removed ZoneAlarm ,im using Windows 7 built in Firewall
Now should i remove Avira Anti Virus ?

The link you gave for Avira Antivir removal is Worm Removal tool: below is the details
AntiVir Removal Tool 3.0 (c) 2009 Avira GmbH
Removal Tool for:
Sober.J/P/Y
TR/Agent.imh/its
TR/Drop.Agent.qna.2/Agent.qna.1
TR/PSW.Delf.AH/Kates.C.25
TR/Spy.Delf.tge/Banker.AATZ/Banker.AATZ.1/Banker.AATZ.2/Banker.AATZ.3
W32/Induc.A
W32/Stanit.A
Worm/NetSky.P

Shud i remove Avira and rely on "Microsoft Security Essentials" ??

zigzag3143 · 07 Jun 2011

Abaf said:

I removed ZoneAlarm ,im using Windows 7 built in Firewall
Now should i remove Avira Anti Virus ?

The link you gave for Avira Antivir removal is Worm Removal tool: below is the details
AntiVir Removal Tool 3.0 (c) 2009 Avira GmbH
Removal Tool for:
Sober.J/P/Y
TR/Agent.imh/its
TR/Drop.Agent.qna.2/Agent.qna.1
TR/PSW.Delf.AH/Kates.C.25
TR/Spy.Delf.tge/Banker.AATZ/Banker.AATZ.1/Banker.AATZ.2/Banker.AATZ.3
W32/Induc.A
W32/Stanit.A
Worm/NetSky.P

Shud i remove Avira and rely on "Microsoft Security Essentials" ??

At least to test to see if it stops the BSOD's

Abaf · 12 Jun 2011

I removed Avira But i installed "McAfee" and i faced BSOD recently(few minutes back) .

mfehidk.sys was causing problem i think its McAfee file ,what shud i do?

zigzag3143 · 12 Jun 2011

Abaf said:

I removed Avira But i installed "McAfee" and i faced BSOD recently(few minutes back) .

mfehidk.sys was causing problem i think its McAfee file ,what shud i do?

As I said previously. remove all malware and firewall aps. Replace with Microsoft Security essentials and use the win 7 firewall.

How to uninstall or reinstall supported McAfee consumer products using the McAfee Consumer Products Removal tool (MCPR.exe)

Virus, Spyware & Malware Protection | Microsoft Security Essentials

Abaf · 14 Jun 2011

okay i have removed McAfee and now im running Security Essentials ans Win7 Firewall