BSOD Please Help!!

TonyTiger2004 · 31 Dec 2010

System Specs
Windows 7 Ultimate x64
AMD Phenom X4 965
4gb Memory
MSI 790FX GD70
HD 4850
System is only 1 Year old, Has been well maintained and cleaned No new hardware Installed.

Currently getting random BSOD, wasnt even getting a blue screen unitl updating bios, it was just crashing showing a bunch of random colored lines through screen and rebooting. Once updated the bios it blue screens, last blue screen pointed to NETIO.sys but most are pointing to ntoskrnl,exe Did some research and thought it was my ATI Tool because most of my dumps give me DRIVER_BIN69 No longer have those dump files as they've been cleared. Please help seems to happen most often when im playing SC2 but does happen just browsing web or listening to music etc.

If i run driver Verifier on all drivers except Microsoft drivers it crashes everytime on startup. Will try that again and get new dumps.

Attached is a Runscanner Log and Dump files and resource & performance log

UPDATE NETIO.sys only happens when i attempt to download the WinDbg everytime i open it and it starts to download the files it BSOD and gives the NETIO.sys dump. It just happened again. SO NETIO may be a seperate issue im unsure. Its giving me a headache thinking about it.

CarlTR6 · 31 Dec 2010

Hi Tony. Welcome to the forum. I'm sorry you are having problems. Please read this thread, follow the instructions and post back. We will be glad to help you. https://www.sevenforums.com/crashes-d...tructions.html

Netio.sys is a Windows system driver and very unlikely to be the real cause. Likewise, ntoskrnl.exe is one of the Windows system core files. You have something else creating conflicts. Both dumps directly blame Zone Alarm, a known cause of BSOD's on many Win 7 systems. You can try this hotfix: Stop error message when you run an application that transfers data by using the UDP protocol in Windows Server 2008 R2 or in Windows 7: "STOP 0x0000007F" If that does not solve the problem, uninstall ZA using this tool: http://download.zonealarm.com/bin/fr...cpes_clean.exe. Make sure Windows Firewall is turned on.

Code:

Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0304a000 PsLoadedModuleList = 0xfffff800`03287e50
Debug session time: Fri Dec 31 07:26:06.080 2010 (GMT-5)
System Uptime: 0 days 2:51:32.796
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80050031, 6f8, fffff800030c01df}

Unable to load image vsdatant.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for vsdatant.sys
*** ERROR: Module load completed but symbols could not be loaded for vsdatant.sys
Probably caused by : NETIO.SYS ( NETIO!CompareSecurityContexts+6a )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff800030c01df

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800030b9ca9 to fffff800030ba740

STACK_TEXT:  
fffff880`02d69ce8 fffff800`030b9ca9 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`02d69cf0 fffff800`030b8172 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`02d69e30 fffff800`030c01df : 00030030`454c4946 00000008`7c2c75c4 00010038`00020001 00000400`000001f8 : nt!KiDoubleFaultAbort+0xb2
fffff880`09c58000 fffff800`030bfc10 : fffff880`09c58270 00000000`00000000 fffff880`09c58270 fffff880`09c58290 : nt!SepAccessCheck+0x1cf
fffff880`09c58130 fffff800`03082f6a : fffffa80`0828b8a0 00000000`00000001 00000000`00000000 fffffa80`045d67c8 : nt!SeAccessCheckWithHint+0x180
fffff880`09c58210 fffff880`01595c5a : 00580054`002e0031 0072006f`00660054 00000098`00000030 00020000`00000000 : nt!SeAccessCheckFromState+0x102
fffff880`09c58900 fffff880`0159394f : 00740061`00000000 0049006e`00000000 0072006f`0066006e fffff880`015bc75e : NETIO!CompareSecurityContexts+0x6a
fffff880`09c58970 fffff880`015959b5 : 00000000`00000000 fffffa80`03c2f120 00000000`00000000 00000000`00000f2e : NETIO!MatchValues+0xef
fffff880`09c589c0 fffff880`01595845 : fffffa80`068b0c10 fffffa80`079a2d80 fffff880`09c58be8 fffff880`09c59320 : NETIO!FilterMatch+0x95
fffff880`09c58a10 fffff880`01596ccb : 00000000`00000000 00000000`00000000 fffff880`09c59320 fffff880`09c58bd0 : NETIO!IndexListClassify+0x69
fffff880`09c58a90 fffff880`0163d417 : fffff880`09c58f68 fffff880`09c58f68 fffff880`09c59ca0 fffffa80`083e4590 : NETIO!KfdClassify+0xa4e
fffff880`09c58e00 fffff880`0163683e : fffff880`01745690 00000000`00000000 fffffa80`069fa260 00000000`00000000 : tcpip!WfpAleClassify+0x57
fffff880`09c58e40 fffff880`01635cd5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!WfpAlepAuthorizeSend+0x94e
fffff880`09c59550 fffff880`01639886 : 00000000`00000000 00000000`00000000 00000000`00000011 00000000`00000000 : tcpip!WfpAleAuthorizeSend+0x325
fffff880`09c59820 fffff880`0163c5e4 : 00000000`00000000 fffff880`09c59c58 fffff880`09c59c60 00000000`00000000 : tcpip!WfpAleConnectAcceptIndicate+0x106
fffff880`09c59910 fffff880`01635019 : fffffa80`000200ff 00000000`00000000 00000000`00000001 00000000`00000008 : tcpip!ProcessALEForTransportPacket+0x664
fffff880`09c59b80 fffff880`01663ef6 : 00000000`00000000 00000000`00000002 fffffa80`078a8900 fffffa80`06a18900 : tcpip!WfpProcessOutTransportStackIndication+0x329
fffff880`09c59d50 fffff880`016691ee : fffffa80`078a4080 fffff880`01591804 fffff880`0176b9a0 fffffa80`069fa260 : tcpip!IppSendDatagramsCommon+0x526
fffff880`09c5a020 fffff880`01633db8 : fffffa80`069fa260 fffffa80`083e4590 fffffa80`083e4590 fffffa80`078a4080 : tcpip!IpNlpSendDatagrams+0x3e
fffff880`09c5a060 fffff880`0163432d : fffffa80`06c04a80 fffffa80`06ba3320 fffff880`09c5a9b0 00000000`00000000 : tcpip!UdpSendMessagesOnPathCreation+0x688
fffff880`09c5a3e0 fffff880`01633fb5 : fffff880`09c5a910 fffffa80`03bf8900 fffff880`00000001 fffffa80`06a1e080 : tcpip!UdpSendMessages+0x35d
fffff880`09c5a7d0 fffff800`030c9e5a : fffff880`09c5ab60 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!UdpTlProviderSendMessagesCalloutRoutine+0x15
fffff880`09c5a800 fffff880`01634578 : fffff880`01633fa0 fffff880`09c5a910 00000000`00000002 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xda
fffff880`09c5a8e0 fffff880`02b2cf45 : fffffa80`0444e160 fffffa80`075163c0 fffffa80`06a27cd0 fffffa80`075e7e8e : tcpip!UdpTlProviderSendMessages+0x78
fffff880`09c5a960 fffff880`02b2cff2 : fffffa80`052b8402 fffffa80`07ddf010 fffffa80`057099e8 fffffa80`07ddf010 : tdx!TdxSendDatagramTransportAddress+0x2f5
fffff880`09c5aa40 fffff880`03c20542 : 00000000`00000000 fffffa80`069fb360 00000000`00000000 fffffa80`057098d0 : tdx!TdxTdiDispatchInternalDeviceControl+0x52
fffff880`09c5aa70 fffff880`03c20f61 : fffffa80`075e7e58 fffffa80`075e7e58 fffffa80`0576d900 fffff880`09c5ab70 : netbt!TdiSendDatagram+0x187
fffff880`09c5aae0 fffff880`03c2d329 : fffffa80`071f32b0 fffffa80`075e7ca0 00000000`00000021 00000000`00000044 : netbt!UdpSendDatagram+0x1b1
fffff880`09c5ab70 fffff880`03c2d0e6 : 00000000`00000000 00000000`00000000 00000000`00000032 fffff880`03c40089 : netbt!UdpSendResponse+0x4e0
fffff880`09c5abf0 fffff880`03c21be7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : netbt!QueryFromNet+0xb11
fffff880`09c5ad20 fffff880`03c1fb47 : 00000000`00000032 fffff880`05cf46aa 00000000`00000032 fffffa80`06a27c02 : netbt!NameSrvHndlrNotOs+0xca
fffff880`09c5ad60 fffff880`02b2b325 : fffffa80`06e16080 fffffa80`069f0002 fffff880`09c5b068 fffffa80`06e16080 : netbt!TdiRcvNameSrvHandler+0x367
fffff880`09c5ae00 fffff880`0163f395 : fffffa80`069fa010 00000000`00000000 fffffa80`069fa010 fffffa80`069fa010 : tdx!TdxEventReceiveMessagesTransportAddress+0x315
fffff880`09c5aff0 fffff880`0163f8a4 : fffffa80`00000000 fffffa80`069fa010 00000000`00000000 fffff880`05cf46a2 : tcpip!UdpDeliverDatagrams+0x155
fffff880`09c5b180 fffff880`0165d727 : fffffa80`0445a8f0 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!UdpReceiveDatagrams+0x324
fffff880`09c5b270 fffff880`0165d799 : fffff880`09c5b3f0 fffff880`0176b9a0 fffff880`09c5b400 fffffa80`04410a20 : tcpip!IppDeliverListToProtocol+0xf7
fffff880`09c5b330 fffff880`0165dc90 : fffff880`0176b9a0 fffffa80`03bfb790 00000000`00000011 fffff880`09c5b3f0 : tcpip!IppProcessDeliverList+0x59
fffff880`09c5b3a0 fffff880`0165cb21 : 00000000`ff89a8c0 fffffa80`045c7138 fffff880`0176b9a0 00000000`054a5d01 : tcpip!IppReceiveHeaderBatch+0x231
fffff880`09c5b480 fffff880`01734542 : fffffa80`06259970 00000000`00000000 fffffa80`054a5d01 fffffa80`00000001 : tcpip!IpFlcReceivePackets+0x651
fffff880`09c5b680 fffff880`01434afa : fffffa80`04861002 fffffa80`04861010 00000000`00000002 00000000`00000000 : tcpip!IppInspectInjectReceive+0xf2
fffff880`09c5b6c0 fffff880`03c7937f : fffffa80`06d450d0 fffffa80`054a5df0 00000000`00000000 00000000`00000000 : fwpkclnt!FwpsInjectTransportReceiveAsync0+0x256
fffff880`09c5b770 fffffa80`06d450d0 : fffffa80`054a5df0 00000000`00000000 00000000`00000000 00000000`00000002 : vsdatant+0x1637f
fffff880`09c5b778 fffffa80`054a5df0 : 00000000`00000000 00000000`00000000 00000000`00000002 00000000`00000001 : 0xfffffa80`06d450d0
fffff880`09c5b780 00000000`00000000 : 00000000`00000000 00000000`00000002 00000000`00000001 fffffa80`0000002e : 0xfffffa80`054a5df0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!CompareSecurityContexts+6a
fffff880`01595c5a 448b442470      mov     r8d,dword ptr [rsp+70h]

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  NETIO!CompareSecurityContexts+6a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4bbe946f

FAILURE_BUCKET_ID:  X64_0x7f_8_NETIO!CompareSecurityContexts+6a

BUCKET_ID:  X64_0x7f_8_NETIO!CompareSecurityContexts+6a

Followup: MachineOwner
---------

Debug session time: Fri Dec 31 08:59:12.738 2010 (GMT-5)
System Uptime: 0 days 0:18:05.096
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff8800153a58d, fffff88005292140, 0}

Unable to load image vsdatant.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for vsdatant.sys
*** ERROR: Module load completed but symbols could not be loaded for vsdatant.sys
Probably caused by : NETIO.SYS ( NETIO!CalloutStreamDataInit+1d )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8800153a58d, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88005292140, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
NETIO!CalloutStreamDataInit+1d
fffff880`0153a58d 488b5808        mov     rbx,qword ptr [rax+8]

CONTEXT:  fffff88005292140 -- (.cxr 0xfffff88005292140)
rax=0000000000000000 rbx=fffff88005292d30 rcx=fffffa80088ca540
rdx=fffffa8007d26d00 rsi=fffff88005292b90 rdi=00000000000005b4
rip=fffff8800153a58d rsp=fffff88005292b10 rbp=fffffa8007d26cd0
 r8=fffff88005292b90  r9=0000000000000000 r10=0000000000000000
r11=fffffffffffffa4c r12=fffffa8007d26cd0 r13=fffff88005292d00
r14=fffffa8007d26cd0 r15=fffffa8007d26cd0
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
NETIO!CalloutStreamDataInit+0x1d:
fffff880`0153a58d 488b5808        mov     rbx,qword ptr [rax+8] ds:002b:00000000`00000008=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  vsmon.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff88001543c94 to fffff8800153a58d

STACK_TEXT:  
fffff880`05292b10 fffff880`01543c94 : fffff880`05292d30 fffff880`05292d30 fffff880`05292f30 fffff800`03060e62 : NETIO!CalloutStreamDataInit+0x1d
fffff880`05292b50 fffff880`0154fa68 : 00000000`00000000 fffff880`05292f30 fffff880`05292ce0 fffff880`05292d68 : NETIO!StreamInvokeCalloutAndNormalizeAction+0x54
fffff880`05292bf0 fffff880`01550a61 : fffffa80`07d26cd0 fffff880`05292f30 fffff880`05292d30 fffff880`05293380 : NETIO!StreamCalloutProcessData+0x48
fffff880`05292c40 fffff880`01551ab8 : fffff880`05292d30 fffff880`05293380 fffff880`05292f01 fffffa80`07d26cd0 : NETIO!StreamCalloutProcessingLoop+0xa1
fffff880`05292cd0 fffff880`015324fa : fffff880`05292f30 fffff880`073ec8e8 fffffa80`00000000 fffffa80`07f90014 : NETIO!StreamProcessCallout+0x1e8
fffff880`05292dc0 fffff880`0151b619 : 00000000`00000014 fffffa80`07d876d0 fffffa80`08528068 fffff880`05293380 : NETIO! ?? ::FNODOBFM::`string'+0x71e2
fffff880`05292ee0 fffff880`0151cbb1 : fffff880`05290014 fffffa80`07d876d0 fffffa80`07f9ee40 fffff880`00000000 : NETIO!ArbitrateAndEnforce+0x2a9
fffff880`05292fb0 fffff880`01553f83 : fffff880`05293454 fffffa80`07d876d0 00000000`00000001 fffff880`05293380 : NETIO!KfdClassify+0x934
fffff880`05293320 fffff880`0155456a : 00000000`00000000 00000000`00000001 00000000`0000d249 fffffa80`07f9ecd0 : NETIO!StreamInternalClassify+0xf3
fffff880`052933f0 fffff880`0155495e : 00000000`00000014 00000000`00000100 00000000`00000000 fffffa80`08035f90 : NETIO!StreamInject+0x1ca
fffff880`052934c0 fffff880`015a9dd7 : fffffa80`07f9ecd0 00000000`00000100 fffff980`5637ce20 fffff880`03d19900 : NETIO!FwppStreamInject+0x12e
fffff880`05293550 fffff880`03d0f593 : 00000000`00000000 fffff980`5637ce20 fffffa80`0625b440 00000000`00000000 : fwpkclnt!FwpsStreamInjectAsync0+0xcf
fffff880`052935b0 00000000`00000000 : fffff980`5637ce20 fffffa80`0625b440 00000000`00000000 00000000`00000100 : vsdatant+0xd593


FOLLOWUP_IP: 
NETIO!CalloutStreamDataInit+1d
fffff880`0153a58d 488b5808        mov     rbx,qword ptr [rax+8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  NETIO!CalloutStreamDataInit+1d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4bbe946f

STACK_COMMAND:  .cxr 0xfffff88005292140 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_NETIO!CalloutStreamDataInit+1d

BUCKET_ID:  X64_0x3B_NETIO!CalloutStreamDataInit+1d

Followup: MachineOwner
---------

TonyTiger2004 · 31 Dec 2010

Thank you Carl will give that a shot, Ive heard alot about Zone Alarm causing the issue, ive been shutting it down but i don't guess that completely stops the drivers from being used.

CarlTR6 · 31 Dec 2010

You are welcome, Tony. No, shutting it down does not stop vsdatant.sys from loading. Do follow the instructions in the turotial and upload the files. We will look to see if anything else is amiss.

TonyTiger2004 · 31 Dec 2010

I think ive uploaded everything requested, i just edited it added everything to the zip.. so far the hotfix is working but it may takes days to crash if its going to. so far so good.

TonyTiger2004 · 31 Dec 2010

Ok nevermind, im running that application now and will re upload everything sorry :)

TonyTiger2004 · 31 Dec 2010

Here ya go

Windows 7 x64
This is a Custom built pc with windows 7 x64 Retail Installed

Hardware is almost a year old
Operating system is almost a year old also

HD 48050
4gb Memory
Phenom X4 965 Black Edition
2 Seagate drives striped

TonyTiger2004 · 01 Jan 2011

So far the hot fix i installed as you recommended has done the job *knock on wood* Once you get a chance to look over the new files please let me know if there is anything else i need to do to help out my system. Thanks Carl :)

CarlTR6 · 01 Jan 2011

Thanks for uploading the files, Tony; good job. Glad to hear you have not had another BSOD. I hope that hotfix works for you.

I did find some other things from the files. You have some out of date drivers loaded on your system. The ones in red font are quite obsolete. Two of them were involved in your Zone Alarm crashes. Outdated drivers can and do cause conflicts, memory corruption and BSOD's. Update these drivers through the links provided or uninstall the hardware/software they are associated with.

AODDriver.sys 5/5/2009 - AMD Overdrive; also in EasyTune6 for Gigabyte motherboard. Drivers & Support | GAME.AMD.COM. Update this driver.

CamDrL64.sys Sat Feb 03 13:17:27 2007 - Logitech QuickCam Pro 3000. Downloads. Update this driver. If there is no update, the camera is obsolete. Uninstall the camera and upgrade to a new camera compatible with Win 7.

LVUSBS64.sys Sat Feb 03 13:05:16 2007 - - Logitech USB Monitor Filter. It may be associated with the camera. Downloads. Update this driver.

vcsvad.sys Sun Nov 16 04:51:18 2008 - Avnex Ltd. Virtual Audio Device. Download free audio video software at Audio4fun!. Update this driver or uninstall the MP3 player.

After updating these drivers, if you get another BSOD, upload it to us and uninstall Eset using this removal tool: Tool. As with many third party antivirus, firewall, and security suite programs, your version of Eset is known to cause BSOD's on some Win 7 systems. If you have to uninstall it, install Microsoft Security Essentials in its place. After you know your system is stable, you can install the latest version of Eset if you like.

TonyTiger2004 · 01 Jan 2011

Thanks for the quick response, i did as suggested cam i haven't used in awhile and i know it isn't compatible with Win 7 removed it and the Avnex. When you get time you could check my other post In regards to my media player, Ive been dealing with it for awhile just put it off now its getting on my nerves.