BSOD suddenly occurred while torrenting

Hello wierdo54.

You are having some network blockage. NETIO.sys is the OS element, a networking driver and it is failing here. Such a network blockage may be caused by various reasons. Some of these are:

• Backdated Network adapter driver.
• Network blockage caused by antivirus programs.
• Network blockage caused by a virus.

Moreover, some physical problem in the network adapters may also cause the same, but the chance is comparatively rare.

So let us see these, one by one. At first, we are seeing that you have Multiple Real Time protection programs installed. AVG and McAfee.

Code:

fffff880`011c8000 fffff880`011fc000   avgtdia    (deferred)                       
fffff880`012df000 fffff880`0137a600   mfehidk    (deferred)

First of all, using multiple antivirus is worst. It makes you unsecured, and at the same time it causes some other problems, like network blocking. Moreover, McAfee is directly involved in this event.

Code:

fffff880`03562220  fffff880`02e50110Unable to load image \SystemRoot\system32\DRIVERS\mfenlfk.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfenlfk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfenlfk.sys
 mfenlfk+0xb110

Uninstall McAfee Using McAfee Removal Tool. Uninstall AVG using AVG Remover. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Next, let us check the network adapter drivers.
Intel(R) Centrino(R) Ultimate-N 6300 AGN, it is directly failing here.

Code:

fffff880`0355a648  fffff880`0585dc62Unable to load image \SystemRoot\system32\DRIVERS\NETwNs64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NETwNs64.sys
*** ERROR: Module load completed but symbols could not be loaded for NETwNs64.sys
 NETwNs64+0x2c62

And it is very old.

Code:

fffff880`0581d000 fffff880`06088000   NETwNs64 T (no symbols)           
    Loaded symbol image file: NETwNs64.sys
    Image path: \SystemRoot\system32\DRIVERS\NETwNs64.sys
    Image name: NETwNs64.sys
    Timestamp:        Tue Nov 09 16:46:31 2010 (4CD92D8F)
    CheckSum:         0082008A
    ImageSize:        0086B000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it from Intel Download Center

Broadcom NetLink (TM) Gigabit Ethernet. It is also very old.

Code:

fffff880`06095000 fffff880`060fb000   k57nd60a   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\k57nd60a.sys
    Image name: k57nd60a.sys
    Timestamp:        Tue Jun 08 17:10:13 2010 (4C0E2C1D)
    CheckSum:         00067682
    ImageSize:        00066000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it from Ethernet NIC Driver Downloads | Broadcom.

As a precaution, scan the system for possible virus infection.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Free up the startup.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus and the touchpad driver, SynTPEnh.
5. Apply > OK
6. Accept then restart.

Let us know the results.

__________________________
CRASH DUMP ANALYSIS:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {28, 2, 0, fffff8800174b6fd}

Probably caused by : NETIO.SYS ( NETIO!RtlCopyBufferToMdl+1d )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8800174b6fd, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800038b2100
GetUlongFromAddress: unable to read from fffff800038b21c0
 0000000000000028 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
NETIO!RtlCopyBufferToMdl+1d
fffff880`0174b6fd 448b5228        mov     r10d,dword ptr [rdx+28h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff8800355a520 -- (.trap 0xfffff8800355a520)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800355a740 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800174b6fd rsp=fffff8800355a6b0 rbp=fffff8800355a7e0
 r8=00000000ffffffbc  r9=0000000000000044 r10=0000000000000000
r11=fffffa8008c3ed40 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
NETIO!RtlCopyBufferToMdl+0x1d:
fffff880`0174b6fd 448b5228        mov     r10d,dword ptr [rdx+28h] ds:00000000`00000028=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800036791e9 to fffff80003679c40

STACK_TEXT:  
fffff880`0355a3d8 fffff800`036791e9 : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0355a3e0 fffff800`03677e60 : 00000000`00000001 fffff880`018652f2 fffffa80`04051bf0 00000000`00000044 : nt!KiBugCheckDispatch+0x69
fffff880`0355a520 fffff880`0174b6fd : 00000000`00000017 fffff880`01816e7c 00000000`0000000e fffffa80`049b6ac8 : nt!KiPageFault+0x260
fffff880`0355a6b0 fffff880`018a591c : 00000000`00000000 fffff880`01873f06 00000000`00000000 fffff880`07e7000f : NETIO!RtlCopyBufferToMdl+0x1d
fffff880`0355a710 fffff880`01871a23 : fffffa80`08c3ed40 00000000`00000000 fffffa80`07e578d0 00000000`8827eefd : tcpip! ?? ::FNODOBFM::`string'+0x1ceef
fffff880`0355a780 fffff880`01862b44 : fffff880`0355ac38 fffffa80`00000029 fffffa80`07e578d0 00000000`00000001 : tcpip!TcpTcbCarefulDatagram+0x1aa3
fffff880`0355a930 fffff880`01861fda : fffffa80`0475cde0 fffff880`0185aeb4 fffffa80`04736100 00000000`00000000 : tcpip!TcpTcbReceive+0x694
fffff880`0355aae0 fffff880`0186357b : fffff880`0633d0f8 fffffa80`04c35000 00000000`00000000 fffff880`0355ae00 : tcpip!TcpMatchReceive+0x1fa
fffff880`0355ac30 fffff880`0185b547 : fffffa80`0475cde0 fffffa80`047658f9 fffffa80`0000b2a5 00000000`0000b2a5 : tcpip!TcpPreValidatedReceive+0x36b
fffff880`0355ad00 fffff880`0185b0ba : 00000000`00000000 fffff880`01969800 fffff880`0355aec0 fffffa80`04051bf0 : tcpip!IppDeliverListToProtocol+0x97
fffff880`0355adc0 fffff880`0185a6b9 : fffffa80`094b5b20 00000000`00000000 fffff880`0355ae20 fffff880`0355aeb0 : tcpip!IppProcessDeliverList+0x5a
fffff880`0355ae60 fffff880`0185835f : 00000000`00000000 00000000`06a15b00 fffff880`01969800 fffff880`01969800 : tcpip!IppReceiveHeaderBatch+0x23a
fffff880`0355af40 fffff880`01857952 : fffffa80`06a1cec0 00000000`00000000 fffffa80`06a15b00 00000000`00000001 : tcpip!IpFlcReceivePackets+0x64f
fffff880`0355b140 fffff880`018cad8a : 00000000`00000000 fffffa80`04b74890 fffffa80`06a15b00 fffffa80`04767d18 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
fffff880`0355b220 fffff800`03685968 : fffff880`0355b4e0 00000000`00000000 fffffa80`03bd1b50 00000000`00000001 : tcpip! ?? ::FNODOBFM::`string'+0x4f472
fffff880`0355b270 fffff880`018574b2 : fffff880`01856d10 fffffa80`04051bf0 fffff880`0355b300 00000000`00000001 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`0355b350 fffff880`017070eb : fffffa80`06a17010 00000000`00000000 fffffa80`068331a0 00000000`00000000 : tcpip!FlReceiveNetBufferListChain+0xb2
fffff880`0355b3c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!RtlCopyBufferToMdl+1d
fffff880`0174b6fd 448b5228        mov     r10d,dword ptr [rdx+28h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  NETIO!RtlCopyBufferToMdl+1d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  5034f6a0

FAILURE_BUCKET_ID:  X64_0xD1_NETIO!RtlCopyBufferToMdl+1d

BUCKET_ID:  X64_0xD1_NETIO!RtlCopyBufferToMdl+1d

Followup: MachineOwner
---------

Now give it a time. Observe the situation, let us know how it goes.

How it is working now?