Windows 7: BSOD when browsing through a normal legit web page

julio99 · 01 Aug 2013

I was browsing this morning through a normal regular old web page and all of a sudden I get this blue page. I came to the forum and researched a little here and I guess I'm supposed to get this thread started before I upload the SF zip file describing the problem. If this is right please post back and I'll get right on it. I'd like to find out if I'm in for more trouble with these.

julio99 · 01 Aug 2013

Quote: Originally Posted by julio99

i was browsing this morning through a normal regular old web page and all of a sudden i get this blue page. I came to the forum and researched a little here and i guess i'm supposed to get this thread started before i upload the sf zip file describing the problem. If this is right please post back and i'll get right on it. I'd like to find out if i'm in for more trouble with these.

Attachment 279191
This is the diagnostic file. Hope I did it right.

Arc · 01 Aug 2013

You uploaded the diag tool itself :) Post it following the Blue Screen of Death (BSOD) Posting Instructions.

julio99 · 01 Aug 2013

Quote: Originally Posted by Arc

You uploaded the diag tool itself :) Post it following the Blue Screen of Death (BSOD) Posting Instructions.

Attachment 279202
Here is the new one all renamed. I never even saw that folder. So sorry!

Arc · 01 Aug 2013

The crash dump is not providing much more info, but it shows some network related errors are there.

Code:

fffff880`07d17448  fffff880`01fcf38a NETIO!StreamPermitData+0x13a
fffff880`07d17478  fffff880`01fbcd00 NETIO!QospReferenceContext

NETIO.sys is Network I/O Subsystem driver.

I would suggest you to update ...

Atheros AR5B93 Wireless Network Adapter driver, from Drivers for Atheros AR5B93 and Windows 7
Atheros AR8151 PCI-E Gigabit Ethernet Controller, from Drivers for Atheros AR8151 and Windows 7

Follow Driver Install - Device Manager to install both the drivers.

Scan the system for possible virus infection with the following programs only, not with your installed Kaspersky.

And, Uninstall Kaspersky using Kaspersky Removal Tool, at least as a test. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.

Let us know the results.
______________________________________________________________________
BSOD ANALYSIS:

Code:

....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4A, {7791138a, 2, 0, fffff88007d17ca0}

Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_GT_ZERO_AT_SYSTEM_SERVICE (4a)
Returning to usermode from a system call at an IRQL > PASSIVE_LEVEL.
Arguments:
Arg1: 000000007791138a, Address of system function (system call routine)
Arg2: 0000000000000002, Current IRQL
Arg3: 0000000000000000, 0
Arg4: fffff88007d17ca0, 0

Debugging Details:
------------------


PROCESS_NAME:  explorer.exe

BUGCHECK_STR:  RAISED_IRQL_FAULT

FAULTING_IP: 
+0
00000000`7791138a ??              ???

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800032861a9 to fffff80003286c00

STACK_TEXT:  
fffff880`07d17a68 fffff800`032861a9 : 00000000`0000004a 00000000`7791138a 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`07d17a70 fffff800`032860e0 : fffffa80`0be42060 00000000`030df6e8 fffff880`07d17bc8 fffff800`0357f884 : nt!KiBugCheckDispatch+0x69
fffff880`07d17bb0 00000000`7791138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
00000000`030df758 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7791138a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiSystemServiceExit+245
fffff800`032860e0 4883ec50        sub     rsp,50h

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiSystemServiceExit+245

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5147d9c6

FAILURE_BUCKET_ID:  X64_RAISED_IRQL_FAULT_explorer.exe_nt!KiSystemServiceExit+245

BUCKET_ID:  X64_RAISED_IRQL_FAULT_explorer.exe_nt!KiSystemServiceExit+245

Followup: MachineOwner
---------

julio99 · 01 Aug 2013

I am in the middle f the offline scan with Defender Offline. I had to burn the .iso to disk and the run it. What is the difference between On and offline if you don't mind? The Defender offline almost looks identical to MSE GUI., which brings me to my next question: Why did you want me to take out KIS 2013? Aren't I trading down in Security doing this? I know you said as a test, but I like know why I'm doing something. I already run MBAM Pro with protection disabled. The benefit is I get the updates installed for me daily. Lazy I guess.

I ran the Rootkit scanner and came up clean and I also changed the adapter drivers. Did you find those problematic or just old. One of the things I have disliked most about computer maintenance is drivers and updating them. Let me know any answers you might have to my queries if you have any and thanks.
This was the first BSOD I have had in a long time. I know any of them aren't god, but do you look for a pattern in these or should you report them as you get them?
I am all done with the things you set out for me to do and I didn't hear back from you about the security questions so I'll go ahead with the uninstall and the install of MSE and you can fill me in later.

Arc · 02 Aug 2013

NETIO.sys casus s a BSOD, when it is interrupted. The things that may cause the interruption are mainly the backdated network drivers (so I suggested to update those) virus infection (so I suggested those scans) and the monitoring mechanism of an antivirus (so I suggested you to uninstall KIS ... all the third party AVs does it, more or less; rest is your luck).

If it is a stray instance of a BSOD, you may take it as just a hiccup of the NETIO.sys and forget it. But if it tends to continue, you need to take it seriously.

About security, MSE is not any less than KIS, moreover it never causes a BSOD.

Any more question, if there, will be appreciated and answered :)

julio99 · 02 Aug 2013

You have to be one of the best and most thorough tekkies I have ever dealt with. Don't lose that ability to help people when they may ask more than you think they should. Computers are hard for people to understand sometimes and when they go bad, lookout, frustration reigns. You helped me without making me feel stupid and I think that is why some people won't ask beyond the first call. I appreciate your help and hopefully if I ever need help on this matter again, I'll find you. Thanx.......

Golden · 02 Aug 2013

Great work Arc!

Arc · 02 Aug 2013

Quote: Originally Posted by julio99

You have to be one of the best and most thorough tekkies I have ever dealt with. Don't lose that ability to help people when they may ask more than you think they should. Computers are hard for people to understand sometimes and when they go bad, lookout, frustration reigns. You helped me without making me feel stupid and I think that is why some people won't ask beyond the first call. I appreciate your help and hopefully if I ever need help on this matter again, I'll find you. Thanx.......

You are welcome Julio :)
You should ask questions ... as I am asking to alter some things which in your believe are correct, and so the conflict of thought arises. It is my duty to guide you through the proper way ... and so I have to answer your questions, so that the conflict of thought may be resolved. Otherwise, you will not be able to understand why you are doing it.

Let us know how the system is running after doing those changes. If there are further issues, we have to check those again. So the feedback is necessary :)

And, questions are welcome, always :)

Quote: Originally Posted by Golden

Great work Arc!

Thanks a huge lot, my friend :) When a person like you appreciates me, it is a real honor.