BSOD...but I didn't do anything...

[Nick9090]

If fact, I really don't know what happened when Blue screen popped out.

I was using Notebook (Lenovo Y560) and reading blogs...

the attachment is dmp file.


thx for helping...

 

[Crispy]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88001732391, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800042c10e0
 0000000000000028 

CURRENT_IRQL:  2

FAULTING_IP: 
NETIO!RtlCopyMdlToMdlIndirect+81
fffff880`01732391 448b6928        mov     r13d,dword ptr [rcx+28h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff880047a0d30 -- (.trap 0xfffff880047a0d30)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000286 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff880047a1048 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001732391 rsp=fffff880047a0ec0 rbp=fffff880047a1000
 r8=fffff880047a1068  r9=fffff880047a1030 r10=fffff8800199f3c0
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
NETIO!RtlCopyMdlToMdlIndirect+0x81:
fffff880`01732391 448b6928        mov     r13d,dword ptr [rcx+28h] ds:00000000`00000028=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000408a469 to fffff8000408af00

STACK_TEXT:  
fffff880`047a0be8 fffff800`0408a469 : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`047a0bf0 fffff800`040890e0 : 00000000`00000001 fffff880`047a1030 00000000`00000002 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`047a0d30 fffff880`01732391 : fffffa80`041ee010 00000000`00000000 00000000`00000001 00000000`00000000 : nt!KiPageFault+0x260
fffff880`047a0ec0 fffff880`01845fe4 : fffff880`047a1078 fffff880`047a1048 fffff880`047a1068 fffff880`047a1030 : NETIO!RtlCopyMdlToMdlIndirect+0x81
fffff880`047a0f60 fffff880`0187c7e6 : 00000000`00000002 fffffa80`069cdcf0 00000000`00000000 fffff880`047a1250 : tcpip!TcpSatisfyReceiveRequests+0x1f4
fffff880`047a1240 fffff880`0187d2f9 : 00000000`00000000 fffffa80`06378c58 00000000`00000010 fffff880`01864e24 : tcpip!TcpDeliverDataToClient+0x106
fffff880`047a13c0 fffff880`01876af8 : 00000000`4b94275f fffffa80`03e79cf0 fffffa80`04a2ac80 fffff880`0186f64a : tcpip!TcpDeliverReceive+0xa9
fffff880`047a14c0 fffff880`018776f5 : 00000000`00000014 00000000`00000000 fffffa80`0972a6c0 fffffa80`046a05b0 : tcpip!TcpTcbFastDatagram+0x208
fffff880`047a1680 fffff880`0187c0ca : fffffa80`064b3380 00000000`00000000 fffffa80`063473d0 00000000`00000000 : tcpip!TcpTcbReceive+0x1f5
fffff880`047a1830 fffff880`0187bc17 : fffffa80`045d2d90 fffffa80`0972a6c0 00000000`00000000 fffff880`0185f400 : tcpip!TcpMatchReceive+0x1fa
fffff880`047a1980 fffff880`0185e3c7 : fffffa80`097230ac fffffa80`064a20d5 fffffa80`064b30ac 00000000`00000000 : tcpip!TcpPreValidatedReceive+0x177
fffff880`047a1a30 fffff880`0185e499 : fffff880`047a1bb0 fffff880`0196e9a0 fffff880`047a1bc0 00000000`00000001 : tcpip!IppDeliverListToProtocol+0x97
fffff880`047a1af0 fffff880`0185e990 : 00000000`00000000 fffff800`04092052 00000000`00000000 fffff880`047a1bb0 : tcpip!IppProcessDeliverList+0x59
fffff880`047a1b60 fffff880`01837702 : fffffa80`03b7ab60 fffff880`00e9e77d 00000000`00000000 fffffa80`04a2a7e0 : tcpip!IppReceiveHeaderBatch+0x231
fffff880`047a1c40 fffff800`04384527 : fffffa80`04a2a7e0 fffff800`0422e5f8 fffffa80`03b7ab60 fffffa80`06381c00 : tcpip!IppLoopbackTransmit+0x72
fffff880`047a1c80 fffff800`04098161 : fffff800`0422e500 fffff800`04384504 fffffa80`03b7ab60 00000000`00000000 : nt!IopProcessWorkItem+0x23
fffff880`047a1cb0 fffff800`0432e166 : 00000000`00000000 fffffa80`03b7ab60 00000000`00000080 fffffa80`03b59b30 : nt!ExpWorkerThread+0x111
fffff880`047a1d40 fffff800`04069486 : fffff880`045d3180 fffffa80`03b7ab60 fffff880`045ddfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`047a1d80 00000000`00000000 : fffff880`047a2000 fffff880`0479c000 fffff880`047a19f0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!RtlCopyMdlToMdlIndirect+81
fffff880`01732391 448b6928        mov     r13d,dword ptr [rcx+28h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  NETIO!RtlCopyMdlToMdlIndirect+81

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc18a

FAILURE_BUCKET_ID:  X64_0xD1_NETIO!RtlCopyMdlToMdlIndirect+81

BUCKET_ID:  X64_0xD1_NETIO!RtlCopyMdlToMdlIndirect+81

Followup: MachineOwner
---------

There is a Hotfix for this, however its for Windows Vista but give it a go anyway: Some applications and services appear to stop responding for 15 seconds after you install a Windows Filtering Platform driver on a Windows Vista-based computer

 

[Nick9090]

oh thx for quick reply !

I'll give it a shot.

 

[Crispy]

No problem, let us know how it went.

 

[Nick9090]

I just tried to install it, but however it says that it can't be installed in my computer.

I am using win7, so...maybe it needs another solution now

Is it because of the driver or something else?

any help would be appreciated.

ps. I got new Blue screen, attaching it.

 

[Crispy]

Try these three links they are all related to 0xD1 blue screens tell me how you go: Stop error when you resume a computer that is running Windows 7 or Windows Server 2008 R2 from sleep or from hibernation: "STOP: 0x000000D1"
Stop error on a blue screen when you remove an SD card from a Windows 7-based or Windows Server 2008 R2-based computer: "0x000000D1"
You receive a stop error after you enable the RequireinClearout mode on an IPv6 network on Windows Server 2008 R2 or in Windows 7

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff880050cb5fa, Address of the instruction which caused the bugcheck
Arg3: fffff88006b33a60, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
afd!AfdTLReleaseIndications+1a
fffff880`050cb5fa 488b4108        mov     rax,qword ptr [rcx+8]

CONTEXT:  fffff88006b33a60 -- (.cxr 0xfffff88006b33a60)
rax=fffff880050cc870 rbx=00000000ffffffff rcx=0000000000000000
rdx=fffff88006b34450 rsi=fffffa8004563780 rdi=fffffa80092378f0
rip=fffff880050cb5fa rsp=fffff88006b34430 rbp=fffff88006b34ca0
 r8=0000000000000000  r9=0000000000000000 r10=1d778522b6c13390
r11=00000000027224ac r12=0000000000000000 r13=fffffa800426c4b0
r14=fffff88006b34a88 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
afd!AfdTLReleaseIndications+0x1a:
fffff880`050cb5fa 488b4108        mov     rax,qword ptr [rcx+8] ds:002b:00000000`00000008=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  avwebgrd.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff880050cb5fa

STACK_TEXT:  
fffff880`06b34430 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : afd!AfdTLReleaseIndications+0x1a


FOLLOWUP_IP: 
afd!AfdTLReleaseIndications+1a
fffff880`050cb5fa 488b4108        mov     rax,qword ptr [rcx+8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  afd!AfdTLReleaseIndications+1a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: afd

IMAGE_NAME:  afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc184

STACK_COMMAND:  .cxr 0xfffff88006b33a60 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_afd!AfdTLReleaseIndications+1a

BUCKET_ID:  X64_0x3B_afd!AfdTLReleaseIndications+1a

Followup: MachineOwner
---------

For this one uninstall Avira and install MSE: http://www.microsoft.com/security_essentials/

 

[Nick9090]

Thx, those problems, I will try it one by one..

And btw, Avira causes the BSOD? Do others have that problem too?
I ask this because I used the Avira for very long time, and Avira 10 about half an year,
same notebook and nothing happened until now :/

or do u recommand MSE strongly? In fact I wanna use it also, it starts fast..

 

[Crispy]

Just uninstall Avira, you dont have to install MSE you can install whatever antivirus you want but if the blue screen goes away after uninstalling Avira then you know that was the faulting application.

 

[Nick9090]

thx for reply

I uninstall Avira v10, after one day, the notebook looks fine. (instead I installed MSE)

Hope that no more BSOD and thx for help

 

[Crispy]

No problem glad to hear everything is fine now, get back to me via this thread if you get any other blue screens.