BSODs- tcpip.sys and netio.sys the most common culprits

adg1034 · 20 Jan 2010

Over the last week or so, I've had 22 BSODs, out of which most signified errors with tcpip.sys and netio.sys. I followed the advice of a user with a similar problem and set up a static IP through the IPv4 properties of my network adapter, which was a potential solution for fixing the netio.sys problem. This seems to have worked, for the most part, as I haven't had any netio.sys-related errors since I made the change, but tcpip.sys has remained an issue.

Attached are the minidumps from the last two days. I've tried parsing them myself, but my WinDbg skills are only a couple days old, and as such are considerably lacking. Even so, I couldn't find any common link between the errors (driver, program, or otherwise) except for the fact that my computer was performing some sort of network activity when it occurred.

(To try and head off the most common initial questions, I know that tcpip.sys and netio.sys errors routinely come from problems with security/firewall products. The only such application I'm running is Microsoft Security Essentials. Nothing else. Also, I've changed out my RAM twice since this system was built (about 10 days ago), and while I haven't run a thorough MemTest on these modules, the 0 errors I got on my one pass compared to the 34 I got on my one pass with the last set are certainly heartening. That's not to say that this couldn't be a hardware problem, as I'm planning to test each module in each slot over the next couple days, but I figured I'd start by taking my BSODs at face value and asking here.)

I'd appreciate any help you all could provide.

usasma · 20 Jan 2010

You've done most everything already. It's a networking error - so now it's just a matter of determining where the error exists. It can be security/firewall related, but it can also be the drivers, cabling, other components of the networking stack (such as WinSock issues), etc, etc, etc.

Also, with the MemTest, run it for a minimum of 3 passes - but overnight is better.
A more detailed explanation is here: Memory Diagnostics

One of the errors is a STOP 0x109 (BSOD Index)
Please note (at the above link) the probably causes for this error - device drivers or memory are most likely.

Also, Please update or remove these older drivers that were loaded at the time of the crash. Don't use Windows Update or the Update drivers function of Device Manager. Please use the following instructions to locate the most current drivers:

How To Find Updated Drivers:
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest WIN7 drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- some driver links are on this page: http://www.carrona.org/drvrdown.html

Here's the older drivers (please note that one is a NETWORK driver):

Code:

000.fcl      Fri Sep 26 09:11:22 2008 - Cyberlink DVD program
WN111v2x.sys Thu Sep 25 04:27:48 2008 - NetGear or DLink USB Network Adapter

Once this is done, please monitor for further BSOD's.

Here's a summary of the BSOD's:

Code:

BugCheck A, {c0000, 2, 1, fffff80002d0cc22}
Probably caused by : NETIO.SYS ( NETIO!WfppIncrementIndexAndPurgeEntries+47 )
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
BugCheck 1A, {41287, 65e0000, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+42c75 )
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
BugCheck 50, {ffffffffffffffc8, 1, fffff880013abcf4, 0}
Probably caused by : memory_corruption
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
BugCheck 3B, {c0000005, 1b941000001, fffff88005f76a10, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceHandler+7c )
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
BugCheck D1, {6bff, 2, 0, fffff8800185d1ec}
Probably caused by : memory_corruption
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
BugCheck 3B, {c0000005, fffff8800184a1ed, fffff880078aa9e0, 0}
Probably caused by : memory_corruption
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
BugCheck 109, {a3a039d895f4d60c, b3b7465ee872b502, fffff880017a6110, 1}
Probably caused by : memory_corruption
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
BugCheck 50, {fffff88007cb65e8, 0, fffff88000c2e13e, 2}
Probably caused by : memory_corruption
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
BugCheck D1, {fffff5000e51366f, 2, 1, fffff880017af382}
Probably caused by : memory_corruption
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
BugCheck 1000007E, {ffffffffc000001d, fffff88001743ece, fffff880035ca618, fffff880035c9e70}
Probably caused by : memory_corruption
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
BugCheck D1, {fffff80001767620, 2, 8, fffff80001767620}
Probably caused by : tcpip.sys ( tcpip!UdpDeliverDatagrams+173 )

zigzag3143 · 20 Jan 2010

adg1034 said:

Over the last week or so, I've had 22 BSODs, out of which most signified errors with tcpip.sys and netio.sys. I followed the advice of a user with a similar problem and set up a static IP through the IPv4 properties of my network adapter, which was a potential solution for fixing the netio.sys problem. This seems to have worked, for the most part, as I haven't had any netio.sys-related errors since I made the change, but tcpip.sys has remained an issue.

Attached are the minidumps from the last two days. I've tried parsing them myself, but my WinDbg skills are only a couple days old, and as such are considerably lacking. Even so, I couldn't find any common link between the errors (driver, program, or otherwise) except for the fact that my computer was performing some sort of network activity when it occurred.

(To try and head off the most common initial questions, I know that tcpip.sys and netio.sys errors routinely come from problems with security/firewall products. The only such application I'm running is Microsoft Security Essentials. Nothing else. Also, I've changed out my RAM twice since this system was built (about 10 days ago), and while I haven't run a thorough MemTest on these modules, the 0 errors I got on my one pass compared to the 34 I got on my one pass with the last set are certainly heartening. That's not to say that this couldn't be a hardware problem, as I'm planning to test each module in each slot over the next couple days, but I figured I'd start by taking my BSODs at face value and asking here.)

I'd appreciate any help you all could provide.

Hi and welcome

well the causes of these dumps are so widely varied I have to think something systemic is going on. You have crashes form you video driver, tcpip, and others. I think you need to take out the big guns and resiolve this.

I would first
run a system file check
type cmd in search>right click and run as admin>sfc /scannow

then I would DL memtestx86 and run overnight (for at least 5 in depth runs)

If you are overclocking stop

If these dont fis it there is one other tool we can use. Before we do you must have a backup and a win 7 dvd

Let us know the results

Ken J+

Code:

011910-50825-01.dmp    1/19/2010 9:59:06 PM    PAGE_FAULT_IN_NONPAGED_AREA    0x00000050    ffffffff`ffffffc8    00000000`00000001    fffff880`013abcf4    00000000`00000000    ataport.SYS    ataport.SYS+107b3                    x64        C:\Users\K\Desktop\New folder\011910-50825-01.dmp    4    15    7600    
011910-58079-01.dmp    1/19/2010 5:22:48 PM    MEMORY_MANAGEMENT    0x0000001a    00000000`00041287    00000000`065e0000    00000000`00000000    00000000`00000000    dxgmms1.sys    dxgmms1.sys+8600                    x64        C:\Users\K\Desktop\New folder\011910-58079-01.dmp    4    15    7600    
012010-47424-01.dmp    1/20/2010 9:00:24 AM        0x00000109    a3a039d8`95f4d60c    b3b7465e`e872b502    fffff880`017a6110    00000000`00000001    ndis.sys    ndis.sys+ca110                    x64        C:\Users\K\Desktop\New folder\012010-47424-01.dmp    4    15    7600    
012010-63804-01.dmp    1/20/2010 4:23:34 PM    DRIVER_IRQL_NOT_LESS_OR_EQUAL    0x000000d1    fffff500`0e51366f    00000000`00000002    00000000`00000001    fffff880`017af382    NETIO.SYS    NETIO.SYS+13382                    x64        C:\Users\K\Desktop\New folder\012010-63804-01.dmp    4    15    7600    
011910-54584-01.dmp    1/19/2010 10:03:14 PM    SYSTEM_SERVICE_EXCEPTION    0x0000003b    00000000`c0000005    000001b9`41000001    fffff880`05f76a10    00000000`00000000    Ntfs.sys    Ntfs.sys+47a00                    x64        C:\Users\K\Desktop\New folder\011910-54584-01.dmp    4    15    7600    
012010-38641-01.dmp    1/20/2010 6:45:22 PM    DRIVER_IRQL_NOT_LESS_OR_EQUAL    0x000000d1    fffff800`01767620    00000000`00000002    00000000`00000008    fffff800`01767620    ntoskrnl.exe    ntoskrnl.exe+71f00                    x64        C:\Users\K\Desktop\New folder\012010-38641-01.dmp    4    15    7600    
011910-73102-01.dmp    1/19/2010 4:32:54 PM    IRQL_NOT_LESS_OR_EQUAL    0x0000000a    00000000`000c0000    00000000`00000002    00000000`00000001    fffff800`02d0cc22    ntoskrnl.exe    ntoskrnl.exe+71f00                    x64        C:\Users\K\Desktop\New folder\011910-73102-01.dmp    4    15    7600    
012010-52213-01.dmp    1/20/2010 12:25:32 PM    PAGE_FAULT_IN_NONPAGED_AREA    0x00000050    fffff880`07cb65e8    00000000`00000000    fffff880`00c2e13e    00000000`00000002    ntoskrnl.exe    ntoskrnl.exe+71f00                    x64        C:\Users\K\Desktop\New folder\012010-52213-01.dmp    4    15    7600    
011910-47954-01.dmp    1/19/2010 11:26:38 PM    DRIVER_IRQL_NOT_LESS_OR_EQUAL    0x000000d1    00000000`00006bff    00000000`00000002    00000000`00000000    fffff880`0185d1ec    tcpip.sys    tcpip.sys+5d1ec                    x64        C:\Users\K\Desktop\New folder\011910-47954-01.dmp    4    15    7600    
012010-107749-01.dmp    1/20/2010 8:47:36 AM    SYSTEM_SERVICE_EXCEPTION    0x0000003b    00000000`c0000005    fffff880`0184a1ed    fffff880`078aa9e0    00000000`00000000    tcpip.sys    tcpip.sys+491ed                    x64        C:\Users\K\Desktop\New folder\012010-107749-01.dmp    4    15    7600    
012010-39717-01.dmp    1/20/2010 4:31:50 PM    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED    0x1000007e    ffffffff`c000001d    fffff880`01743ece    fffff880`035ca618    fffff880`035c9e70    tcpip.sys    tcpip.sys+6d667                    x64        C:\Users\K\Desktop\New folder\012010-39717-01.dmp    4    15    7600

adg1034 · 20 Jan 2010

To be fair, I only replaced my memory last night, so while I'm not sure how many of the minidumps in the zip file are memory-related, I know at least a majority of the ones that are came when I had the sticks that couldn't even go through one pass of memtest.

I will update the networking driver; the version I had was actually cobbled together to give my USB 802.11n adapter Windows 7 support, so I'll be glad to install the official version. In fact, I'd wonder if that would solve everything right now. I've used my wireless adapter on Windows 7 for a couple months with no problems, but I can see how installing it on a brand new build could add in some... incompatibilities.

Memtest has been running for close to 3 hours now (both sticks), passing twice, and I'll leave it going for as long as I can.

No overclocking. Yet. That comes when I have an already-stable system.

I'll report back tomorrow. I plan to stop Memtest right now, install the new wireless drivers, use my system for the rest of the night, then start Memtest again and leave it running until the morning. I genuinely do appreciate the help.