BSOD (after uninstall of free Norton trial)

plandan · 18 Oct 2010

The uninstallation of my Norton Internet Security trial (pre-installed on laptop when purchased) is just a hunch I have as to why I have been encountering the BSOD, I realise i may be completely wrong in this assumption but will gladly accept any help and advice sent my way as i need this laptop for university and the BSOD seems to enjoy popping up when I'm doing work for my course.

Windows 7:
- 64bit OS
- an OEM
- Less than 2 months old

plandan · 18 Oct 2010

Since my last post the problem has re-occurred so i re-ran the BSOD Dump & System File Collection app.

wish · 19 Oct 2010

Hi,
Your dumps have error code: 0x7f with EXCEPTION_DOUBLE_FAULT (0000000000000008)
Probably cause by Netio.sys and ntkrnlmp.exe

EXCEPTION_DOUBLE_FAULT = the two exceptions are handled serially. However, there are several exceptions that cannot be handled serially.
Maybe your antivirus interference with netio(part of windows networking subsystem) and causing the problem.

Let's start by removing AVG and replace it with MSE. (aslo remove 3rd internet security such as zone alarm if any)
- AVG remover --> AVG - Download tools
- MSE --> http://www.microsoft.com/security_essentials/

Then update your Realtek NIC driver.

Code:

Rt64win7.sys Fri Nov 27 01:45:07 2009 (4B0F9FA3)

Logs

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80050033, 6f8, fffff80002c57b9f}

Probably caused by : NETIO.SYS ( NETIO!CompareSecurityContexts+6a )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050033
Arg3: 00000000000006f8
Arg4: fffff80002c57b9f

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002c7bca9 to fffff80002c7c740

STACK_TEXT:  
fffff800`00ba4d28 fffff800`02c7bca9 : 00000000`0000007f 00000000`00000008 00000000`80050033 00000000`000006f8 : nt!KeBugCheckEx
fffff800`00ba4d30 fffff800`02c7a172 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`00ba4e70 fffff800`02c57b9f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`0a393ff0 fffff800`02c44dc4 : fffff880`0a3940d0 fffffa80`04224068 00200073`00610070 00650072`007400ea : nt!RtlSidHashInitialize+0x2f
fffff880`0a394020 fffff800`02c44f07 : fffffa80`04224068 00000000`00000001 006f0070`006d0049 00620069`00730073 : nt!SepTokenFromAccessInformation+0xbc
fffff880`0a394050 fffff880`0152bc5a : 006e006f`00630020 006e0069`00610074 00660020`002c0073 00740065`00650072 : nt!SeAccessCheckFromState+0x9f
fffff880`0a394740 fffff880`0152994f : 0074006e`006f0063 0073006e`00690061 006c0062`00610074 00660020`002c0065 : NETIO!CompareSecurityContexts+0x6a
fffff880`0a3947b0 fffff880`0152b9b5 : 00200061`006c0020 006c0062`00610074 00690064`00200065 006e0061`00740073 : NETIO!MatchValues+0xef
fffff880`0a394800 fffff880`0152b845 : fffffa80`06371410 fffffa80`06b51090 fffff880`0a394a28 fffff880`0a395160 : NETIO!FilterMatch+0x95
fffff880`0a394850 fffff880`0152cccb : 00000000`00000000 00000000`00000000 fffff880`0a395160 fffff880`0a394a10 : NETIO!IndexListClassify+0x69
fffff880`0a3948d0 fffff880`0163e417 : fffff880`0a394da8 fffff880`0a394da8 fffff880`0a395ae0 fffffa80`04139920 : NETIO!KfdClassify+0xa4e
fffff880`0a394c40 fffff880`0163783e : fffff880`01746690 00000000`00000000 fffffa80`05c7a010 00000000`00000000 : tcpip!WfpAleClassify+0x57
fffff880`0a394c80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!WfpAlepAuthorizeSend+0x94e


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!CompareSecurityContexts+6a
fffff880`0152bc5a 448b442470      mov     r8d,dword ptr [rsp+70h]

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  NETIO!CompareSecurityContexts+6a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4bbe946f

FAILURE_BUCKET_ID:  X64_0x7f_8_NETIO!CompareSecurityContexts+6a

BUCKET_ID:  X64_0x7f_8_NETIO!CompareSecurityContexts+6a

Followup: MachineOwner
---------

plandan · 19 Oct 2010

Thanks Wish for the reply i tried what you suggested and it seemed to work, but i have just ran into the problem again. I hadn't removed zonealarm as instructed which i'll do now. I've uploaded another of the dump files, hopefully you could help clarify my problem further before it starts to get really annoying!

On a side note my xbox RROD'd at the same time, not my night is it?

wish · 19 Oct 2010

Hi again,
I think ZA that causing problem so It's better to uninstall it completely then see if the problem persist.
http://server.iad.liveperson.net/hc/s-28464961/cmd/kbresource/kb-1459969611656329714/view_question!PAGETYPE?sq=uninstall&sf=101113&sg=2&st=846489&documentid=344897&action=view

This driver need to remove:

Code:

C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80050033, 6f8, fffff80002c90d91}

Probably caused by : NETIO.SYS ( NETIO!CompareSecurityContexts+6a )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050033
Arg3: 00000000000006f8
Arg4: fffff80002c90d91

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002c8aca9 to fffff80002c8b740

STACK_TEXT:  
fffff880`009eec68 fffff800`02c8aca9 : 00000000`0000007f 00000000`00000008 00000000`80050033 00000000`000006f8 : nt!KeBugCheckEx
fffff880`009eec70 fffff800`02c89172 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`009eedb0 fffff800`02c90d91 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`02f15fb0 fffff800`02c53f6a : fffffa80`04c6f080 00000000`00000001 00000000`00000000 fffffa80`04202068 : nt!SeAccessCheckWithHint+0x301
fffff880`02f16090 fffff880`015a1c5a : 8b48e814`034ace8b cc14034a`c5ff41c6 0348fd8b`48d70348 c8c14827`c9c148da : nt!SeAccessCheckFromState+0x102
fffff880`02f16780 fffff880`0159f94f : 8b48d18b`c0000022 e1834106`00000000 c8c1483d`cac1480f 48c08b49`d0334813 : NETIO!CompareSecurityContexts+0x6a
fffff880`02f167f0 fffff880`015a19b5 : 48d38b48`ce2349cc 4812c8c1`4829cac1 c8c148c3`8b48d033 48c38b49`d033480e : NETIO!MatchValues+0xef
fffff880`02f16840 fffff880`015a1845 : fffffa80`0603f150 fffffa80`062c0880 fffff880`02f16a68 fffff880`02f171a0 : NETIO!FilterMatch+0x95
fffff880`02f16890 fffff880`015a2ccb : 00000000`00000000 00000000`00000000 fffff880`02f171a0 fffff880`02f16a50 : NETIO!IndexListClassify+0x69
fffff880`02f16910 fffff880`0163d417 : fffff880`02f16de8 fffff880`02f16de8 fffff880`02f17b20 fffffa80`06c4c660 : NETIO!KfdClassify+0xa4e
fffff880`02f16c80 fffff880`0163683e : fffff880`01745690 00000000`00000000 fffffa80`05966db0 00000000`00000000 : tcpip!WfpAleClassify+0x57
fffff880`02f16cc0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!WfpAlepAuthorizeSend+0x94e


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!CompareSecurityContexts+6a
fffff880`015a1c5a 448b442470      mov     r8d,dword ptr [rsp+70h]

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  NETIO!CompareSecurityContexts+6a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4bbe946f

FAILURE_BUCKET_ID:  X64_0x7f_8_NETIO!CompareSecurityContexts+6a

BUCKET_ID:  X64_0x7f_8_NETIO!CompareSecurityContexts+6a

Followup: MachineOwner
---------

plandan · 20 Oct 2010

Thanks for the help! so far no blue screens! hopefully I won't have to put up with them again any time soon! thanks again!