Daily BSOD

Jonathan_King said:

First problem: you have both ZoneAlarm and AVG installed. Out of all the anti-virus programs that cause BSODs, they are #1 and #2, respectively. Not a good thing.

Uninstall them both using Programs and Features, then run their respective removal tools.

For AVG:

32 bit: http://download.avg.com/filedir/util...avgremover.exe
64-bit: http://download.avg.com/filedir/util...removerx64.exe

For ZoneAlarm: http://download.zonealarm.com/bin/fr...cpes_clean.exe

Then download and install Microsoft Security Essentials.

Second: how long did you let memtest run? For 4GB of RAM, let it run for at least 5 passes.

I concur. What do you use Zone Alarm for? You can set the firewall built into the Windows 7 stack to alert you of the same behaviors. AVG is ok but there are better including Microsoft Security Essentials.

npolite said:

I ran a Memtest for 7 passes and it came out clean so I'm guessing that's not the issue. If I get it one more time I'm going to uninstall AVG and see if that helps.

What "memtest"? Some third party thing or the one built into Windows 7?

zigzag3143 said:

npolite said:

Here is the latest minidump. This is before the uninstall of AVG.

This one was caused by your tcpip stack.

If if were you I would

Re-install your wifi/lan driver.
run a system file check. ( type sfc /scannow)

If you are overclocking stop
if you are running a raid update your driver

Let us know your results


Ken

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\042510-25225-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*F:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16481.x86fre.win7_gdr.091207-1941
Machine Name:
Kernel base = 0x82c48000 PsLoadedModuleList = 0x82d90810
Debug session time: Sun Apr 25 22:10:26.508 2010 (GMT-4)
System Uptime: 0 days 6:16:14.050
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {3000a1e8, 2, 1, 8c02c1e2}

*** WARNING: Unable to verify timestamp for cmdhlp.sys
*** ERROR: Module load completed but symbols could not be loaded for cmdhlp.sys
Probably caused by : NETIO.SYS ( NETIO!KfdClassify+ed )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 3000a1e8, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8c02c1e2, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82db0718
Unable to read MiSystemVaType memory at 82d90160
 3000a1e8 

CURRENT_IRQL:  2

FAULTING_IP: 
NETIO!KfdClassify+ed
8c02c1e2 f00fc108        lock xadd dword ptr [eax],ecx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from 8c0f4d7c to 8c02c1e2

STACK_TEXT:  
8fbdf4fc 8c0f4d7c 00000004 8fbdf598 8fbdf5ac NETIO!KfdClassify+0xed
8fbdf708 8c0fdbc3 86756020 87735444 86755dc0 tcpip!ShimIpPacketOutV4+0x1bd
8fbdf73c 8c0cf560 00000000 86756020 87735444 tcpip!IppInspectLocalPacketsOut+0x5c
8fbdf790 8c0f3363 8fbdf7bc 8c173d98 00000001 tcpip!IppLoopbackEnqueue+0xa6
8fbdf7d0 8c0fb273 8c173d98 8673a5f4 8673a690 tcpip!IppDispatchSendPacketHelper+0xf6
8fbdf870 8c10130e 0073a5f4 00000000 88e9f658 tcpip!IppPacketizeDatagrams+0x8d6
8fbdf8f0 8c101595 00000000 00000004 8c173d98 tcpip!IppSendDatagramsCommon+0x652
8fbdf910 8c0fcdfa 86738098 8fbdf99c 00000000 tcpip!IpNlpSendDatagrams+0x4b
8fbdfaec 8c0feb31 00000000 00000001 875ef488 tcpip!UdpSendMessagesOnPathCreation+0x7c0
8fbdfbf0 8c0fe37a 86738008 00bdfcc8 00000000 tcpip!UdpSendMessages+0x595
8fbdfc04 82cd808a 8fbdfc94 bedc8de6 00000000 tcpip!UdpTlProviderSendMessagesCalloutRoutine+0x13
8fbdfc6c 8c0fe170 8c0fe367 8fbdfc94 00000000 nt!KeExpandKernelStackAndCalloutEx+0x132
8fbdfcac 90cf1f56 875ef488 8fbdfcc8 876f47f0 tcpip!UdpTlProviderSendMessages+0x67
8fbdfcf0 90cfa237 875ecde0 876f47f0 876f48a8 tdx!TdxSendTransportAddress+0x148
8fbdfd0c 82c844ac 86904f00 876f47f0 90d16178 tdx!TdxTdiDispatchInternalDeviceControl+0x69
8fbdfd24 90d134fa 8fbdfd50 90d13759 861ca480 nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
8fbdfd2c 90d13759 861ca480 00000000 8690c020 cmdhlp+0x34fa
8fbdfd50 82e5666d 00000000 bedc8c1a 00000000 cmdhlp+0x3759
8fbdfd90 82d081d9 90d136b6 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!KfdClassify+ed
8c02c1e2 f00fc108        lock xadd dword ptr [eax],ecx

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  NETIO!KfdClassify+ed

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bbf63

FAILURE_BUCKET_ID:  0xD1_NETIO!KfdClassify+ed

BUCKET_ID:  0xD1_NETIO!KfdClassify+ed

Followup: MachineOwner
---------

That's the same stack crawl profile as the Alureon rootkit variant I saw last week. Try the latest Malwarebytes for a free scan. This thing is incredibly polymorphic and has stopped showing outward signs as of late.

npolite said:

The test was using memtest86+. I checked Gigabyte's website (N650SLI_DS4) and didn't find any network driver updates for Win 7. The latest dirvers from Nvidia's website are 15.51 and haven't been updated since Oct 2009. I'll try going down the upgrade route for MS Security Essentials but I must have a driver conflict in Win 7.

I really like Zone Alarm over the MS firewall because it tells me when any request goes outbound, I get notified. Sometimes this doesn't happen with the MS one.

May I recommend the free firewall Comodo for that?

Jonathan_King said:

npolite said:

The test was using memtest86+. I checked Gigabyte's website (N650SLI_DS4) and didn't find any network driver updates for Win 7. The latest dirvers from Nvidia's website are 15.51 and haven't been updated since Oct 2009. I'll try going down the upgrade route for MS Security Essentials but I must have a driver conflict in Win 7.

I really like Zone Alarm over the MS firewall because it tells me when any request goes outbound, I get notified. Sometimes this doesn't happen with the MS one.

May I recommend the free firewall Comodo for that?

I will second Comodo free firewall or PCTools free firewall for that reason. Both of these work well for me. I currently have Comodo running. ZA does not seem to play nice with Win7.

BTW PCTools does not play well with Windows 7 either. Many BSODs caused by it.

Jonathan_King said:

BTW PCTools does not play well with Windows 7 either. Many BSODs caused by it.

Interesting. I had no problems with it on my 32 bit system. It runs smoothly and uses less RAM than Comodo. I prefer Comodo's interface.