BSOD randomly started happening, no hardware changes

Snipzors · 25 Mar 2012

recently within the last 4 days or so i have been getting BSOD errors occuring about twice a day at random intervals. I have not recently changed any hardware this just started occuring out of the blue (no pun intended).
It appears it is probably a driver conflict or irq, but could use some help.
i have included the dump files and relevant data

writhziden · 25 Mar 2012

Security Software (this is just to check that you have security software installed and it is working properly; nothing needs to be done about this at this time):

Code:

mcagent.exe	c:\program files\mcafee.com\agent\mcagent.exe	2796	8	200	1380	3/25/2012 7:20 AM	11.0.644.0	1.60 MB (1,675,160 bytes)	12/22/2011 7:37 AM

Possible out of date drivers:

Code:

PROCEXP113	fffff880`0c749000	fffff880`0c751000	Mon Nov 03 14:19:45 2008 (490f6af1)	00008fd1		PROCEXP113.SYS
Rt64win7	fffff880`06fcd000	fffff880`06fff000	Thu Feb 26 02:04:13 2009 (49a65b0d)	000361a5		Rt64win7.sys
RTKVHD64	fffff880`09204000	fffff880`093b0900	Fri May 22 12:04:20 2009 (4a16e924)	001b57b6		RTKVHD64.sys

PROCEXP113.SYS
Rt64win7.sys under Download -> Windows 7 64-Bit -> LAN
RTKVHD64.sys under Download -> Windows 7 64-Bit -> AUDIO

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\Snipzors\Windows_NT6_BSOD_jcgriff2\031812-69139-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0365d000 PsLoadedModuleList = 0xfffff800`038a2670
Debug session time: Sun Mar 18 13:37:40.616 2012 (UTC - 6:00)
System Uptime: 0 days 0:18:07.520
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {28, 2, 0, fffff88001411b2d}

Probably caused by : NETIO.SYS ( NETIO!RtlCopyBufferToMdl+1d )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88001411b2d, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000390c100
 0000000000000028 

CURRENT_IRQL:  2

FAULTING_IP: 
NETIO!RtlCopyBufferToMdl+1d
fffff880`01411b2d 448b5228        mov     r10d,dword ptr [rdx+28h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff8800c5ce660 -- (.trap 0xfffff8800c5ce660)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800c5ce880 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001411b2d rsp=fffff8800c5ce7f0 rbp=fffff8800c5ce920
 r8=00000000ffffffbc  r9=0000000000000044 r10=0000000000000000
r11=fffffa8008fb4a10 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
NETIO!RtlCopyBufferToMdl+0x1d:
fffff880`01411b2d 448b5228        mov     r10d,dword ptr [rdx+28h] ds:4180:00000000`00000028=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800036d91e9 to fffff800036d9c40

STACK_TEXT:  
fffff880`0c5ce518 fffff800`036d91e9 : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0c5ce520 fffff800`036d7e60 : 00000000`00000000 fffff880`0165edd2 00000000`00000000 00000000`00000044 : nt!KiBugCheckDispatch+0x69
fffff880`0c5ce660 fffff880`01411b2d : fffffa80`08e44270 00000000`00000058 00000000`0000000a fffffa80`0916e1b8 : nt!KiPageFault+0x260
fffff880`0c5ce7f0 fffff880`0169dbac : 00000000`00000000 fffff880`0166c906 00000000`00000001 fffffa80`08e9e680 : NETIO!RtlCopyBufferToMdl+0x1d
fffff880`0c5ce850 fffff880`01669ef3 : fffffa80`08fb4a10 00000000`00000001 fffffa80`08e44270 00000000`00000000 : tcpip! ?? ::FNODOBFM::`string'+0x1d5cf
fffff880`0c5ce8c0 fffff880`0165cd54 : fffff880`0c5ced78 00000000`00000029 fffffa80`08e44270 00000000`00000000 : tcpip!TcpTcbCarefulDatagram+0x543
fffff880`0c5cea70 fffff880`0165b67a : fffffa80`06434910 fffff880`01653b34 fffffa80`063f3cb8 00000000`00000000 : tcpip!TcpTcbReceive+0x694
fffff880`0c5cec20 fffff880`0165d2ab : fffff880`08694952 fffffa80`0656f000 00000000`00000000 fffff880`0c5cef00 : tcpip!TcpMatchReceive+0x1fa
fffff880`0c5ced70 fffff880`016541c7 : fffffa80`06434910 fffffa80`06543ee1 fffffa80`0000c0a8 00000000`0000c0a8 : tcpip!TcpPreValidatedReceive+0x36b
fffff880`0c5cee40 fffff880`01653d3a : 00000000`00000000 fffff880`0176e800 fffff880`0c5cf000 fffffa80`06beb000 : tcpip!IppDeliverListToProtocol+0x97
fffff880`0c5cef00 fffff880`01653339 : 00000000`00000000 fffff880`0953e210 00000000`00000000 fffff880`0c5ceff0 : tcpip!IppProcessDeliverList+0x5a
fffff880`0c5cefa0 fffff880`016510af : 00000000`00000000 00000000`06ad3b00 fffff880`0176e800 fffff880`0176e800 : tcpip!IppReceiveHeaderBatch+0x23a
fffff880`0c5cf080 fffff880`016506a2 : fffffa80`06ad6520 00000000`00000000 fffffa80`06ad3b00 fffffa80`00000001 : tcpip!IpFlcReceivePackets+0x64f
fffff880`0c5cf280 fffff880`016cf34a : 00000000`00000000 fffffa80`08f012f0 fffffa80`06ad3ba0 00000000`00000001 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
fffff880`0c5cf360 fffff800`036e6618 : 00000000`00000000 00000000`0000000e fffffa80`08748040 00000000`00000001 : tcpip! ?? ::FNODOBFM::`string'+0x55122
fffff880`0c5cf3b0 fffff880`01650202 : fffff880`0164fa60 fffffa80`07d5f190 fffff880`01773900 fffff880`01655401 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`0c5cf490 fffff880`015bd0eb : fffffa80`06ad5010 00000000`00000000 fffffa80`069301a0 00000000`00000000 : tcpip!FlReceiveNetBufferListChain+0xb2
fffff880`0c5cf500 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!RtlCopyBufferToMdl+1d
fffff880`01411b2d 448b5228        mov     r10d,dword ptr [rdx+28h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  NETIO!RtlCopyBufferToMdl+1d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79381

FAILURE_BUCKET_ID:  X64_0xD1_NETIO!RtlCopyBufferToMdl+1d

BUCKET_ID:  X64_0xD1_NETIO!RtlCopyBufferToMdl+1d

Followup: MachineOwner
---------

Most likely due to your LAN driver being out of date. See possible out of date drivers above.

Re-install with the following method:

First, download the latest driver. Then do the next steps.
Click Start Menu
Right Click My Computer/Computer
Click Manage
Click Device Manager from the list on the left
Find the device you are trying to uninstall by expanding the appropriate set of devices
Right click the device
Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
Restart your computer only if Windows asks you to.
Install the latest driver for the device.

Alternatively:

Login as an adminstrative user.
First, download the latest driver. Then do the next steps.
Click Start Menu
Click Control Panel
Click Hardware and Sound
Click Device Manager (the last link under Devices and Printers)
Find the device you are trying to uninstall by expanding the appropriate set of devices
Right click the device
Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
Restart your computer only if Windows asks you to.
Install the latest driver for the device.

Snipzors · 26 Mar 2012

thank you so much it apparently worked!!
just want to know for my own curiosity, how can a comp running for 2 years on an outdated driver all of a sudden start BSOD ing ?

Snipzors · 26 Mar 2012

ok so apparently i lied lol, still BSOD netio.sys after update but it takes quite a bit longer to do so now... so what could the next step be

writhziden · 26 Mar 2012

Did you update both the LAN and Audio drivers? They use similar resources, so it is a good idea to update both. If you already updated those, uninstall McAfee, then install the latest version of McAfee.

Snipzors · 26 Mar 2012

yes i had updated both drivers, and i just fully uninstalled AV and have reinstalled, now i will test it to see if it will crash out on me.

Snipzors · 28 Mar 2012

well so far so good apparently removing and reinstalling mcafee did the trick ( or so it appears so far) even though it was the same version .. weird issues thats for sure

thanks for all the help

writhziden · 28 Mar 2012

Antivirus software can become corrupted over time just like system software and drivers. It is likely that is why the re-install worked. Monitor the system during your normal use over the next few days and let us know how it responds. If you can go a few days without any problems, you are welcome to mark the thread solved.