Solved BSOD Error code: 0x000000D1, driver_irql_not_less_or_equal

[conhaqu3]

Hello,

I'm running Windows7 on an ASUS K53S. I've been getting the blue screen of death regularly for the past week. It is severly affecting my productivity and I hope someone can help. It mentions the following error:
driver_irql_not_less_or_equal

The error code is:
0x000000D1

Technical Information:

***STOP: 0x000000D1 (0x0000000000000028, 0x0000000000000002, 0x0000000000000000, 0xFFFFF88001BA96FD)

*** NETIO.SYS - Address FFFFF88001BA96FD base at FFFFF88001B99000, DateStamp 5034f6a0

I think it may have to do with problems with my uninstalling McAfee Antivirus and Windows Update. I first got the first BSOD 3 weeks ago, a few days after uninstalling Mcafee. Meanwhile, I observed that some components of McAfee were still in my computer so i unistalled them. When I restarted, all my gadgets stopped working so I did a system restore. After that, I was able to get back my gadgets but those mcafee components stayed in the computer. Also, the restore point apparently uninstalled a few windows updates and after that, windows could not search for any new updates. Just to point out that these BSOD really became more often after I did the system restore which may have to do with WINDOWS UPDATE.

I've attached the mini dump that was created from the last crash as a zipped file. Could someone provide me with more information on how I can resolve this?

I also have the system event log for the crash if that helps?

Rgds,
conhaqu3

 

[Pauly]

Please have a read of this
http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

Use this mcafee removal tool to clean out the program

 

[conhaqu3]

Pauly,

Thanks for the quick response and my apologies to getting back to you so late.

I had a read in the link that you send me and in attach I send you the new .zip information as mentioned in the link.

As for the mcafee removal tool that you have advised, I have not used it yet as I want to know your feedback first about the new information that is in attachment.


Rgrds,
conhaqu3

 

[Pauly]

Dump file indicates error code 0xD1 BSOD Index which would indicate a problematic driver, blames netio.sys but that is probably a false positive as that is a MS windows driver, i would recommend you run a http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html to check system files, had a look through your drivers and dont see anything of concern but in your programs you have avast and daemon tools installed i would remove these as they can be problematic, install Microsoft Security Essentials - Microsoft Windows update and run full scans

If these are all ok and you get another bluescreen i would recommend running http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html to try to force out the offending driver but be aware before starting verifier ensure you create a restore point and have recovery options in place, make sure you read through the tutorial entirely before you start so you know what to do if computer will not boot when you enable it, if you get anymore blue screens please upload any news dumps

 

[conhaqu3]

Dump file indicates error code 0xD1 BSOD Index which would indicate a problematic driver, blames netio.sys but that is probably a false positive as that is a MS windows driver, i would recommend you run a http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html to check system files, had a look through your drivers and dont see anything of concern but in your programs you have avast and daemon tools installed i would remove these as they can be problematic, install Microsoft Security Essentials - Microsoft Windows update and run full scans

If these are all ok and you get another bluescreen i would recommend running http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html to try to force out the offending driver but be aware before starting verifier ensure you create a restore point and have recovery options in place, make sure you read through the tutorial entirely before you start so you know what to do if computer will not boot when you enable it, if you get anymore blue screens please upload any news dumps

What about the mcafee removal tool? Is it not problematic? I am pretty sure it is what caused the BSOD in the first place.

 

[Pauly]

If you think it is related run the tool to uninstall what you can

 

[conhaqu3]

Just finished the System File Checker. Once it finished, it appeared a message saying that "Windows found damaged files but could not repair all of them".


In attach is the CBS log .zip for you to see the results.

What should my next step be?

 

[conhaqu3]

Forgot to send you the "sfcdetails" information as well.

Here it is.

 

[Pauly]

Those log files are not really my area, i will see if i can get some assistance

 

[Arc]

conhaqu3, what Paul suggest you is right, McAfee was one of your problrm. See it:

fffff880`035bcd98  fffff880`01d20080Unable to load image \SystemRoot\system32\drivers\mfewfpk.sys, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for mfewfpk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfewfpk.sys
 mfewfpk+0x7080[/COLOR]

Description here: Driver Reference Table - mfewfpk.sys

But, it is not only McAfee, but also another problematic antivirus which two were installed at the same time. McAfee is removed now, but Avast is still contributing to your crashes.

fffff880`035bd268  fffff880`046792abUnable to load image \SystemRoot\System32\Drivers\aswFW.SYS, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for aswFW.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswFW.SYS[/COLOR]

Description here: Driver Reference Table - aswFW.SYS

fffff880`035bd4d8  fffff880`0469a06aUnable to load image \SystemRoot\System32\Drivers\aswTdi.SYS, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for aswTdi.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswTdi.SYS
 aswTdi+0x106a[/COLOR]

Description here: Driver Reference Table - aswTdi.SYS

Uninstall Avast using Avast Uninstall Utility. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Daemon Tools, Alcohol 120% and Power Archiver Pro uses SCSI Pass Through Direct (SPTD), which is a well known BSOD causer. Uninstall Daemon Tools at first. Then download SPTD standalone installer from Disk-Tools.com, and execute the downloaded file as guided below :

• Double click to open it.
• Click this button only:
• 
• If it is grayed out, as in the picture, there is no more SPTD in your system, and you just close the window.

The Atheros NIC (AR8151) driver is very old.

start             end                 module name
fffff880`0a934000 fffff880`0a950000   L1C62x64   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\L1C62x64.sys
 [COLOR=Red]   Image name: L1C62x64.sys
    Timestamp:        Mon Sep 19 13:12:11 2011 [/COLOR](4E76F253)
    CheckSum:         0001D371
    ImageSize:        0001C000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it from ATHEROS Network drivers for Windows.

Intel(R) Wireless WiFi Link 5000 Series Adapter Driver is also very old.

fffff880`0a03d000 fffff880`0a8c3000   NETwNs64   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\NETwNs64.sys
    Image name: NETwNs64.sys
    Timestamp:        Thu Aug 04 05:58:26 2011 (4E39E7AA)
    CheckSum:         0083C028
    ImageSize:        00886000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it from Intel Download Center

Let us know the results.

 

[NoelDP]

The SFC scan shows the following problems....

 Line 9105: 2013-01-22 11:58:58, Info                  CSI    0000032f [SR] Cannot repair member file [l:14{7}]"fde.dll" of Microsoft-Windows-fde, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 9108: 2013-01-22 11:58:58, Info                  CSI    00000331 [SR] Cannot repair member file [l:22{11}]"fdeploy.dll" of Microsoft-Windows-fdeploy, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 9111: 2013-01-22 11:58:58, Info                  CSI    00000333 [SR] Cannot repair member file [l:20{10}]"gptext.dll" of Microsoft-Windows-GroupPolicy-Gptext, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 9114: 2013-01-22 11:58:58, Info                  CSI    00000335 [SR] Cannot repair member file [l:20{10}]"gpedit.dll" of Microsoft-Windows-GroupPolicy-Admin-Gpedit, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

I'll post back in a bit with a fix protocol for you.

 

[NoelDP]

I've uploaded a file - conaa.zip - to my SkyDrive at https://skydrive.live.com/#cid=936736BB8FCEB92F&id=936736BB8FCEB92F%21526
Please download and save it.
Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
This should create a folder C:\conaa
Close all windows (it would be a good idea to print these instructions!)
Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.
Pick the option to use a Command Prompt
At the prompt type
DIR C:\conaa
hit the enter key - if you get a 'Not Found' error try
DIR D:\conaa
or
DIR E:\conaa

The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...

XCOPY <drive>:\conaa <drive>:\windows\winsxs /y /i /s /v /h

run the command (it should take almost no time)and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.
Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your SkyDrive Public folder, and post a new link

Also, please run a CheckSUR scan....

Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Method 2)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and attach it to a reply.

 

[conhaqu3]

conhaqu3, what Paul suggest you is right, McAfee was one of your problrm. See it:

fffff880`035bcd98  fffff880`01d20080Unable to load image \SystemRoot\system32\drivers\mfewfpk.sys, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for mfewfpk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfewfpk.sys
 mfewfpk+0x7080[/COLOR]

Description here: Driver Reference Table - mfewfpk.sys

But, it is not only McAfee, but also another problematic antivirus which two were installed at the same time. McAfee is removed now, but Avast is still contributing to your crashes.

fffff880`035bd268  fffff880`046792abUnable to load image \SystemRoot\System32\Drivers\aswFW.SYS, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for aswFW.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswFW.SYS[/COLOR]

Description here: Driver Reference Table - aswFW.SYS

fffff880`035bd4d8  fffff880`0469a06aUnable to load image \SystemRoot\System32\Drivers\aswTdi.SYS, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for aswTdi.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswTdi.SYS
 aswTdi+0x106a[/COLOR]

Description here: Driver Reference Table - aswTdi.SYS

Uninstall Avast using Avast Uninstall Utility. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Daemon Tools, Alcohol 120% and Power Archiver Pro uses SCSI Pass Through Direct (SPTD), which is a well known BSOD causer. Uninstall Daemon Tools at first. Then download SPTD standalone installer from Disk-Tools.com, and execute the downloaded file as guided below :

• Double click to open it.
• Click this button only:
• 
• If it is grayed out, as in the picture, there is no more SPTD in your system, and you just close the window.

The Atheros NIC (AR8151) driver is very old.

start             end                 module name
fffff880`0a934000 fffff880`0a950000   L1C62x64   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\L1C62x64.sys
 [COLOR=Red]   Image name: L1C62x64.sys
    Timestamp:        Mon Sep 19 13:12:11 2011 [/COLOR](4E76F253)
    CheckSum:         0001D371
    ImageSize:        0001C000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it from ATHEROS Network drivers for Windows.

Intel(R) Wireless WiFi Link 5000 Series Adapter Driver is also very old.

fffff880`0a03d000 fffff880`0a8c3000   NETwNs64   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\NETwNs64.sys
    Image name: NETwNs64.sys
    Timestamp:        Thu Aug 04 05:58:26 2011 (4E39E7AA)
    CheckSum:         0083C028
    ImageSize:        00886000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it from Intel Download Center

Let us know the results.

Arc,

Thanks for the clean and well-detailed response.

I removed McAfee using mcafee removal tool and successfully removed Daemon tools lite as well.

I am currently still using Avast just to see if I will get another BSOD.

As far as the updates of the drivers that you mentioned are concerned, the Atheros link only shows a driver dated of 2010 so there's no point in installing. The Intel Wireless Wi-Fi link, I click on "Automatically check computer for updates" but it appears some kind of message saying that the firewall is blocking. Nonetheless, I don't think it is a problem of the drivers as my ASUS PC is just 4 Months-old.

I will know try to search for updates in Windows Updates and use uTorrent to see if windows crashes again (I forgot to mention in the description that I got 2 BSOD, separately, while searching for updates and while using uTorrent).

By the way, any chance the "C" disk had enlarged it size because of the BSOD? Yesterday, I had like 4 trewout the day and the disk passed from 138 GB free space available to 124 GB...and I didn't even installed any new software or anything else....

Please fill me in on this last subject.

Many thanks,
conhaqu3

 

[Pauly]

Follow Noels excellent help to repair your system files then upload the logs etc

 

[conhaqu3]

Well, 2 days have passed and no signs of any annoying BSOD

I think it may had to do with a conflict between the two anti-viruses.

Nevertheless, I will wait until it has passed a week to fully close this thread.

Thanks to all who dedicated time to help me solve this problem.

Rgrds,
conhaqu3

 

[NoelDP]

Please post your CBS log as requested

 

[conhaqu3]

SkyDrive link is broken Noel.

"This item is no longer available"

 

[NoelDP]

Sorry - technical hitch (I accidentally deleted the entire folder, which broke the link)

Noel's SkyDrive

 

[conhaqu3]

Sorry - technical hitch (I accidentally deleted the entire folder, which broke the link)

Noel's SkyDrive

Just did as you asked and when finishing typing the command "XCOPY <drive>:\conaa <drive>:\windows\winsxs /y /i /s /v /h" I got this message: "The system cannot find the file system"

I did the procedure again and double-check the command spelling and still got the same message.

 

[NoelDP]

Did you use the correct drive letter?

your final command should look something like

XCOPY Q:\conaa Q:\windows\winsxs /y /i /s /v /h

(note that it will NOT be a Q!!)