BSOD - Drive irq not or less equal - seconds after logon

[travalo]

BSOD - Drive irq not or less equal - Follow the dmp report

Gentlemans,
I wake up nicely then i turn on my computer and get two crashes refering to the same. just a few seconds after the logon

Bugcheck analasys doesnt seems quiet clear to me, im sure You can help me on that

ps_escuses for my bad english

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {4, 2, 0, 8b404a8a}

Probably caused by : NETIO.SYS ( NETIO!NetioAllocateAndReferenceCloneNetBufferListEx+21 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8b404a8a, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82f6b848
Unable to read MiSystemVaType memory at 82f4ae20
00000004

CURRENT_IRQL: 2

FAULTING_IP:
ndis!NdisAllocateCloneNetBufferList+98
8b404a8a 8b5b04 mov ebx,dword ptr [ebx+4]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: uTorrent.exe

TRAP_FRAME: 807e4db0 -- (.trap 0xffffffff807e4db0)
ErrCode = 00000000
eax=87a39f00 ebx=00000000 ecx=00000000 edx=00000000 esi=87a39fa0 edi=00000000
eip=8b404a8a esp=807e4e24 ebp=807e4e98 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
ndis!NdisAllocateCloneNetBufferList+0x98:
8b404a8a 8b5b04 mov ebx,dword ptr [ebx+4] ds:0023:00000004=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8b404a8a to 82e4366b

STACK_TEXT:
807e4db0 8b404a8a badb0d00 00000000 85d2da80 nt!KiTrap0E+0x2cf
807e4e98 8b4bde8f 00000000 85d2da80 85d2c580 ndis!NdisAllocateCloneNetBufferList+0x98
807e4ebc 8b4be841 00000000 8b4be78a 00000000 NETIO!NetioAllocateAndReferenceCloneNetBufferListEx+0x21
807e4ed4 8b4e2939 00000000 00000000 00000000 NETIO!NetioAllocateAndReferenceCloneNetBufferList+0x17
807e4efc 8b4deb29 00000000 00000000 8803a1f8 NETIO!StreamDataTruncateAfterDataLength+0x3b
807e4f18 8b4debd8 88053510 8806d708 8803a1f8 NETIO!StreamPermitDataHelper+0x2d
807e4f48 82e7a1b5 8803a1f8 88053510 8806d708 NETIO!StreamPermitRemoveDataDpc+0x61
807e4fa4 82e7a018 807c4120 87954030 00000000 nt!KiExecuteAllDpcs+0xf9
807e4ff4 82e797dc 94d3d8c0 00000000 00000000 nt!KiRetireDpcList+0xd5
807e4ff8 94d3d8c0 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2c
WARNING: Frame IP not in any known module. Following frames may be wrong.
82e797dc 00000000 0000001a 00d6850f bb830000 0x94d3d8c0


STACK_COMMAND: kb

FOLLOWUP_IP:
NETIO!NetioAllocateAndReferenceCloneNetBufferListEx+21
8b4bde8f 8bf0 mov esi,eax

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: NETIO!NetioAllocateAndReferenceCloneNetBufferListEx+21

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME: NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 4ce78963

FAILURE_BUCKET_ID: 0xD1_NETIO!NetioAllocateAndReferenceCloneNetBufferListEx+21

BUCKET_ID: 0xD1_NETIO!NetioAllocateAndReferenceCloneNetBufferListEx+21

Followup: MachineOwner
---------

1: kd> lmvm NETIO
start end module name
8b4b7000 8b4f5000 NETIO (pdb symbols) c:\symbols\netio.pdb\7A33726ABE884384BFDFB951F05D13AC2\netio.pdb
Loaded symbol image file: NETIO.SYS
Mapped memory image file: c:\symbols\NETIO.SYS\4CE789633e000\NETIO.SYS
Image path: \SystemRoot\system32\drivers\NETIO.SYS
Image name: NETIO.SYS
Timestamp: Sat Nov 20 08:40:03 2010 (4CE78963)
CheckSum: 0003F253
ImageSize: 0003E000
File version: 6.1.7601.17514
Product version: 6.1.7601.17514
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.6 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: netio.sys
OriginalFilename: netio.sys
ProductVersion: 6.1.7601.17514
FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
FileDescription: Network I/O Subsystem
LegalCopyright: © Microsoft Corporation. All rights reserved.

 

[zigzag3143]

We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

If you are overclocking STOP

You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.
*If the files are too large please upload them to a file sharing service like "Rapidshare" and put a link to them in your reply.

To ensure minidumps are enabled:

* Go to Start, in the Search Box type: sysdm.cpl, press Enter.
* Under the Advanced tab, click on the Startup and Recovery Settings... button.
* Ensure that Automatically restart is unchecked.
* Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
* Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
* OK your way out.
* Reboot if changes have been made.

 

[travalo]

Ok, escuses i didnt knew
minidump folder attached

 

[zigzag3143]

Ok, escuses i didnt knew
minidump folder attached

Related to ctgame.sys Creative Game Port Enumerator. Yours 2002 remove it


When Netio.sys crashes it is often the case of the malware app and in your case that is exactly true. Its Related to Afwcore.sys Agnitum Firewall Core Driver.

Remove and replace it with Microsoft Security Eseentials.

Microsoft Security Essentials - Free Antivirus for Windows

 

[travalo]

understood. valuable help cheers