Random encounters of BSOD kind

Hello i have an annoying problem of blue screens at some random points in windows 7.
I have been trying to search the web but could not find any solid solution that actually helped.
I will post the debugger info in the end but first i will explain what i did so far:

I did windows update that downloaded new network files for realtek.

Independently downloaded some hotfix for NETIO.SYS that should update its version... which i think it did cuz now when i check its properties the file indicates the newer version but i still had a bsod after that and the debugger indicated the older version of NETIO.SYS causing the crash.

Then I dug somewhere that i need to check the memory and i got WMD ( windows memory diagnostic) which showed no errors in the extended options. So the memory should be ok.

Dont quite remember if i did anything else because this all was long and agonizing proses with the blue screens popping once in a while. It is also very hard to indicate when the crash is going to happen it would seem absolutely random and it could take 5min or sometimes more than an hour.

The debugger thing looks like this :


Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\040510-29953-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\windows\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82c56000 PsLoadedModuleList = 0x82d9e810
Debug session time: Mon Apr 5 15:02:31.766 2010 (UTC + 3:00)
System Uptime: 0 days 1:12:26.500
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {692daa57, 2, 0, 8b80f555}

Unable to load image \SystemRoot\system32\DRIVERS\Rt86win7.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Rt86win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt86win7.sys
Probably caused by : NETIO.SYS ( NETIO!MdpFree+32 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 692daa57, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8b80f555, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82dbe718
Unable to read MiSystemVaType memory at 82d9e160
692daa57

CURRENT_IRQL: 2

FAULTING_IP:
NETIO!MdpFree+32
8b80f555 3b4f14 cmp ecx,dword ptr [edi+14h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

TRAP_FRAME: a0947a68 -- (.trap 0xffffffffa0947a68)
ErrCode = 00000000
eax=82d83480 ebx=00000000 ecx=00000000 edx=00043ea0 esi=86d92000 edi=692daa43
eip=8b80f555 esp=a0947adc ebp=a0947af0 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
NETIO!MdpFree+0x32:
8b80f555 3b4f14 cmp ecx,dword ptr [edi+14h] ds:0023:692daa57=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8b80f555 to 82c9c7eb

STACK_TEXT:
a0947a68 8b80f555 badb0d00 00043ea0 a0947a8c nt!KiTrap0E+0x2cf
a0947af0 8b80f4ae 86d920a0 a0947b14 8b811354 NETIO!MdpFree+0x32
a0947afc 8b811354 86d920a0 86068ac8 85d93738 NETIO!NetioFreeMdl+0x24
a0947b14 8b80fb48 85d93738 00000001 00000001 NETIO!NetioCompleteCloneNetBufferListChain+0x45
a0947b34 8b81121c 85d93738 00000001 86cf50e0 NETIO!NetioDereferenceNetBufferList+0xa2
a0947b64 8b8d619f 00000000 00000001 00000000 NETIO!NetioDereferenceNetBufferListChain+0x3a
a0947b78 8b58e8a6 871a68c8 85d93738 00000001 tcpip!FlSendNetBufferListChainComplete+0x7b
a0947bc4 8b52a5e2 00000000 85d93738 00000001 ndis!ndisMSendCompleteNetBufferListsInternal+0x217
a0947bd8 8f8be848 871a4290 85d93738 00000001 ndis!NdisFSendNetBufferListsComplete+0x3a
a0947bfc 8b58ef0a 8716f5e0 85d93738 00000001 pacer!PcFilterSendNetBufferListsComplete+0xb4
a0947c20 96f04339 86cf50e0 85d93738 00000001 ndis!NdisMSendNetBufferListsComplete+0xa4
WARNING: Stack unwind information not available. Following frames may be wrong.
a0947c50 96ef5dcf 01f02000 00000000 86cf50e0 Rt86win7+0x11339
a0947c74 8b57c309 86f02001 00000000 01947ca0 Rt86win7+0x2dcf
a0947cb0 8b55d6b2 87119164 00119150 00000000 ndis!ndisMiniportDpc+0xe2
a0947d10 8b544976 87119224 00000000 85c0c1e0 ndis!ndisQueuedMiniportDpcWorkItem+0xd0
a0947d50 82e6466d 00000000 8691286d 00000000 ndis!ndisReceiveWorkerThread+0xeb
a0947d90 82d160d9 8b54488b 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND: kb

FOLLOWUP_IP:
NETIO!MdpFree+32
8b80f555 3b4f14 cmp ecx,dword ptr [edi+14h]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: NETIO!MdpFree+32

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME: NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bbf63

FAILURE_BUCKET_ID: 0xD1_NETIO!MdpFree+32

BUCKET_ID: 0xD1_NETIO!MdpFree+32

Followup: MachineOwner
---------

0: kd> lmvm NETIO
start end module name
8b80a000 8b848000 NETIO (pdb symbols) c:\windows\symbols\netio.pdb\7F1011FAA7384AA9A72A0165AC1B90962\netio.pdb
Loaded symbol image file: NETIO.SYS
Mapped memory image file: c:\windows\symbols\NETIO.SYS\4A5BBF633e000\NETIO.SYS
Image path: \SystemRoot\system32\drivers\NETIO.SYS
Image name: NETIO.SYS
Timestamp: Tue Jul 14 02:12:35 2009 (4A5BBF63)
CheckSum: 000420A0
ImageSize: 0003E000
File version: 6.1.7600.16385
Product version: 6.1.7600.16385
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.6 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: netio.sys
OriginalFilename: netio.sys
ProductVersion: 6.1.7600.16385
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
FileDescription: Network I/O Subsystem
LegalCopyright: © Microsoft Corporation. All rights reserved.
0: kd> .trap 0xffffffffa0947a68
ErrCode = 00000000
eax=82d83480 ebx=00000000 ecx=00000000 edx=00043ea0 esi=86d92000 edi=692daa43
eip=8b80f555 esp=a0947adc ebp=a0947af0 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
NETIO!MdpFree+0x32:
8b80f555 3b4f14 cmp ecx,dword ptr [edi+14h] ds:0023:692daa57=????????


I am really lost and dont know what to do here.
Everything hardware wise should be properly assembled and work right.

Maybe someone have a suggestion of what i can do or where to seek help ?

EvilSmurf,

Why oh why did you "Independently downloaded some hotfix for NETIO.SYS that should update its version." ?

Use SystemRestore to get back to a point before you did this.

Emm i did that so it would solve the blue screen problem that i was having every couple of minutes and i was looking for a solution.
So some forums suggested that this should fix the netio.sys crash. So thats why i did it. Also that was a pretty late stage in the things that i did that included reassembling the system couple of time and cleaning all the cables. I guess you can imagine how irritated i am having BSODs all the time since installing windows7.
Before i attempt the restore can you please explain to me what is the point in restoring system to a state when it was BSODing all the time and what i should do then to stop it?

The idea is to get the system back to a state where there are no self-inflicted problems. Which brings up the question--Have you been installing any drivers other than those supplied by Microsoft? If we have a system created by Microsoft then we have a known-starting point.

BSOD have many possible causes--some hardware and some software.
Most common hardware problem is the graphic card(s) and the
most common software problem is the graphic driver.

Those two are certainly not all sources of problems.

If this will rule all the problems out i an clean install windows7 from scratch.
Would you suggest that?

Its kinda hard to tell now when the BSOD started because i had a problem with the cpu overheating that i solved yesterday by applying a new thermal compound. Which is absolutely hardware thing and at the moment i was sure that it was the cause of bsods. But the whole story started when i tried to upgrade my old system a bit by getting new hdd a bit more of ram and getting windows7.

Is there a way to figure the exact source of the problem from the debugger crash file?
And i did install bunch of driver supplied by the hardware manufacturers but mostly the ones that were not recognized in the device manager.

EvilSmurf,
Ah ha! 2nd most common cause of BSOD hardware problems-Heat!

A good thermal paste does help, although my experience has been that the biggest help is a good fan and good air-circulation in the housing.

If you've been overclocking, then cease and desist for the time-being.

A fresh install would give us a solid starting point. The dump files are generally good indicators but they can be misleading.

I am pretty sure that i am past all the hardware related problems and the overheating too. Plus i have never done any overclocking or any drastic to the system. The only hardware related problem that can be but is the psu being too low but i dont know what would that cause.
I kinda want to avoid the clean install because even after that it will be really hard to figure out what causes the blue screens. From what i experienced now they are totally random.

EvilSmurf said:

Hello i have an annoying problem of blue screens at some random points in windows 7.
I have been trying to search the web but could not find any solid solution that actually helped.
I will post the debugger info in the end but first i will explain what i did so far:

I did windows update that downloaded new network files for realtek.

Independently downloaded some hotfix for NETIO.SYS that should update its version... which i think it did cuz now when i check its properties the file indicates the newer version but i still had a bsod after that and the debugger indicated the older version of NETIO.SYS causing the crash.

Then I dug somewhere that i need to check the memory and i got WMD ( windows memory diagnostic) which showed no errors in the extended options. So the memory should be ok.

Dont quite remember if i did anything else because this all was long and agonizing proses with the blue screens popping once in a while. It is also very hard to indicate when the crash is going to happen it would seem absolutely random and it could take 5min or sometimes more than an hour.

The debugger thing looks like this :


Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\040510-29953-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\windows\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82c56000 PsLoadedModuleList = 0x82d9e810
Debug session time: Mon Apr 5 15:02:31.766 2010 (UTC + 3:00)
System Uptime: 0 days 1:12:26.500
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {692daa57, 2, 0, 8b80f555}

Unable to load image \SystemRoot\system32\DRIVERS\cWin32 error 0n2
*** WARNING: Unable to verify timestamp for Rt86win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt86win7.sys
Probably caused by : NETIO.SYS ( NETIO!MdpFree+32 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 692daa57, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8b80f555, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82dbe718
Unable to read MiSystemVaType memory at 82d9e160
692daa57

CURRENT_IRQL: 2

FAULTING_IP:
NETIO!MdpFree+32
8b80f555 3b4f14 cmp ecx,dword ptr [edi+14h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

TRAP_FRAME: a0947a68 -- (.trap 0xffffffffa0947a68)
ErrCode = 00000000
eax=82d83480 ebx=00000000 ecx=00000000 edx=00043ea0 esi=86d92000 edi=692daa43
eip=8b80f555 esp=a0947adc ebp=a0947af0 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
NETIO!MdpFree+0x32:
8b80f555 3b4f14 cmp ecx,dword ptr [edi+14h] ds:0023:692daa57=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8b80f555 to 82c9c7eb

STACK_TEXT:
a0947a68 8b80f555 badb0d00 00043ea0 a0947a8c nt!KiTrap0E+0x2cf
a0947af0 8b80f4ae 86d920a0 a0947b14 8b811354 NETIO!MdpFree+0x32
a0947afc 8b811354 86d920a0 86068ac8 85d93738 NETIO!NetioFreeMdl+0x24
a0947b14 8b80fb48 85d93738 00000001 00000001 NETIO!NetioCompleteCloneNetBufferListChain+0x45
a0947b34 8b81121c 85d93738 00000001 86cf50e0 NETIO!NetioDereferenceNetBufferList+0xa2
a0947b64 8b8d619f 00000000 00000001 00000000 NETIO!NetioDereferenceNetBufferListChain+0x3a
a0947b78 8b58e8a6 871a68c8 85d93738 00000001 tcpip!FlSendNetBufferListChainComplete+0x7b
a0947bc4 8b52a5e2 00000000 85d93738 00000001 ndis!ndisMSendCompleteNetBufferListsInternal+0x217
a0947bd8 8f8be848 871a4290 85d93738 00000001 ndis!NdisFSendNetBufferListsComplete+0x3a
a0947bfc 8b58ef0a 8716f5e0 85d93738 00000001 pacer!PcFilterSendNetBufferListsComplete+0xb4
a0947c20 96f04339 86cf50e0 85d93738 00000001 ndis!NdisMSendNetBufferListsComplete+0xa4
WARNING: Stack unwind information not available. Following frames may be wrong.
a0947c50 96ef5dcf 01f02000 00000000 86cf50e0 Rt86win7+0x11339
a0947c74 8b57c309 86f02001 00000000 01947ca0 Rt86win7+0x2dcf
a0947cb0 8b55d6b2 87119164 00119150 00000000 ndis!ndisMiniportDpc+0xe2
a0947d10 8b544976 87119224 00000000 85c0c1e0 ndis!ndisQueuedMiniportDpcWorkItem+0xd0
a0947d50 82e6466d 00000000 8691286d 00000000 ndis!ndisReceiveWorkerThread+0xeb
a0947d90 82d160d9 8b54488b 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND: kb

FOLLOWUP_IP:
NETIO!MdpFree+32
8b80f555 3b4f14 cmp ecx,dword ptr [edi+14h]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: NETIO!MdpFree+32

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME: NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bbf63

FAILURE_BUCKET_ID: 0xD1_NETIO!MdpFree+32

BUCKET_ID: 0xD1_NETIO!MdpFree+32

Followup: MachineOwner
---------

0: kd> lmvm NETIO
start end module name
8b80a000 8b848000 NETIO (pdb symbols) c:\windows\symbols\netio.pdb\7F1011FAA7384AA9A72A0165AC1B90962\netio.pdb
Loaded symbol image file: NETIO.SYS
Mapped memory image file: c:\windows\symbols\NETIO.SYS\4A5BBF633e000\NETIO.SYS
Image path: \SystemRoot\system32\drivers\NETIO.SYS
Image name: NETIO.SYS
Timestamp: Tue Jul 14 02:12:35 2009 (4A5BBF63)
CheckSum: 000420A0
ImageSize: 0003E000
File version: 6.1.7600.16385
Product version: 6.1.7600.16385
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.6 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: netio.sys
OriginalFilename: netio.sys
ProductVersion: 6.1.7600.16385
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
FileDescription: Network I/O Subsystem
LegalCopyright: © Microsoft Corporation. All rights reserved.
0: kd> .trap 0xffffffffa0947a68
ErrCode = 00000000
eax=82d83480 ebx=00000000 ecx=00000000 edx=00043ea0 esi=86d92000 edi=692daa43
eip=8b80f555 esp=a0947adc ebp=a0947af0 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
NETIO!MdpFree+0x32:
8b80f555 3b4f14 cmp ecx,dword ptr [edi+14h] ds:0023:692daa57=????????


I am really lost and dont know what to do here.
Everything hardware wise should be properly assembled and work right.

Maybe someone have a suggestion of what i can do or where to seek help ?

We do appreciate the work you have done to examine your problem. this (and jsut this) crash was caused by Rt86win7.sys which is part of your realtek NDIS.

I would suggest removing it to test and re-installing either it or better still a different product.

Let us know if yo9u need help with that

Ken

Tanks!
It seems that i am getting only this crash all the time! (that is if the lines DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) and all the ones referring to NETIO.SYS mean that it is the same crash... i am not sure about the exact small numbers)
The Network adapter is built into my MB. I didnt quite understand if you were suggesting on removing drivers or purchasing a whole new network card?

About the network card drivers there are the ones that were in the update which are the ones i currently have, there are the ones that come as default win7 installation and there are also ones that come with the motherboard from the original manufacturer. I assume they are pretty old by now. The last ones i did not try because first time i installed win7 (had to do a clean install after that) they produced various warning messages of compatibility so this time i did not try to install them. They are the ones i used before and they worked fine in winxp and never caused any problems.

What would you suggest me do?
Should i clean install the the win7 on formatted drive again as suggested by karlsnooks? Or should i try older pre win7 drivers? If you were suggesting removing only the Rt86win7.sys and not the whole hardware card what is the right way to do that?

EvilSmurf said:

Tanks!
It seems that i am getting only this crash all the time! (that is if the lines DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) and all the ones referring to NETIO.SYS mean that it is the same crash... i am not sure about the exact small numbers)
The Network adapter is built into my MB. I didnt quite understand if you were suggesting on removing drivers or purchasing a whole new network card?

About the network card drivers there are the ones that were in the update which are the ones i currently have, there are the ones that come as default win7 installation and there are also ones that come with the motherboard from the original manufacturer. I assume they are pretty old by now. The last ones i did not try because first time i installed win7 (had to do a clean install after that) they produced various warning messages of compatibility so this time i did not try to install them. They are the ones i used before and they worked fine in winxp and never caused any problems.

What would you suggest me do?
Should i clean install the the win7 on formatted drive again as suggested by karlsnooks? Or should i try older pre win7 drivers? If you were suggesting removing only the Rt86win7.sys and not the whole hardware card what is the right way to do that?

The situation isnt bad enough to clean install (unless you want to)

We could do a lot more with the actual DMP file. FAiling that I would re-install the realtek driver. If you are overclocking I would stop.

Other than that

Run a system file check
(type cmd in search>right click and run as admin>sfc /scannow

Let us know the results

Ken