BSOD (netio.sys) while running uTorrent on Win7x64

[RamRS]

Hi,

I have a Toshiba S855-S5254 laptop running Windows 7 Home Premium 64 bit.

For the past few days, I have been facing frequent BSODs. I did some trial and error, and this is what I figured out:

All BSODs have the following key-words in the error message: DRIVER_IRQL_NOT_LESS_OR_EQUAL and netio.sys
The BSOD happens with 5 minutes if I'm running uTorrent
No BSOD if uTorrent is not running
No BSOD if uTorrent is running but with stopped torrents
Not checked with other torrent clients
Updating drivers from Toshiba's website does not help
Checked IP v4/v6 usage difference between system setting and uTorrent settings - no apparent difference

I've attached the SF report. It would be really great if someone could help solve this issue please!

--
Ram

 

[koolkat77]

Welcome to the forum.

• Kaspersky is contributing to your BSOD's. Please remove it for testing purpose and use Microsoft Security Essentials & the Free version of Malwarebytes, update and make full scans separately:
  • Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase
  • Help protect your PC with Microsoft Security Essentials
  • Malwarebytes Free

   Note

:info: Do not start the trial version of MalwareBytes

• Also take a look at: Good & Free System Security Combination

• Virus Check:
  • Make scans with these tools below:
    • TDSSKiller Rootkit Removal Utility Free Download | Kaspersky Lab US
    • Online Virus Scanner Eset
• Application conflict:
  • Reduce the start-up items. This will help avoid software conflicts:
    • Remove Startup Programs in Windows 7
    • Clean Startup in Windows 7

• System File Checker
  • The SFC /SCANNOW Command - System File Checker scans the integrity of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible. If you have modified your system files as in theming explorer/system files, running sfc /scannow will revert the system files to it's default state.
    • Link to full tutorial: http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html
• Run Disk Check in Windows 7
  • Run this on your Hard Drive(s). This will show you how to run Check Disk or chkdsk in Windows 7 to check a selected hard disk for file system errors and bad sectors on it. With both boxes checked for all HDDs and with Automatically fix file system errors. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html
    • Link to full tutorial: http://www.sevenforums.com/tutorials/433-disk-check.html

• Use Crystal Disk Info to upload a screenshot of your Hard Drives (s).
  • Then test your Hard Drives (s) running a Hard Drive Diag.

• Check for heating issues using Speccy or HWmonitor
  • HWMonitor CPUID - System & hardware benchmark, monitoring, reporting
  • Speccy - System Information - Free Download
    • Please upload a summary tab using Speccy. http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\USER\Downloads\RamRS\SF_19-11-2013\111913-55083-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`03065000 PsLoadedModuleList = 0xfffff800`032a86d0
Debug session time: Tue Nov 19 11:50:03.379 2013 (UTC + 6:00)
System Uptime: 0 days 0:04:57.238
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {28, 2, 0, fffff8800212a6fd}

Probably caused by : NETIO.SYS ( NETIO!RtlCopyBufferToMdl+1d )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8800212a6fd, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003312100
GetUlongFromAddress: unable to read from fffff800033121c0
 0000000000000028 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
NETIO!RtlCopyBufferToMdl+1d
fffff880`0212a6fd 448b5228        mov     r10d,dword ptr [rdx+28h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff88003fc3790 -- (.trap 0xfffff88003fc3790)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88003fc39b0 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800212a6fd rsp=fffff88003fc3920 rbp=fffff88003fc3a48
 r8=00000000ffffffbc  r9=0000000000000044 r10=0000000000000000
r11=fffffa800df9d670 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
NETIO!RtlCopyBufferToMdl+0x1d:
fffff880`0212a6fd 448b5228        mov     r10d,dword ptr [rdx+28h] ds:00000000`00000028=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030da169 to fffff800030dabc0

STACK_TEXT:  
fffff880`03fc3648 fffff800`030da169 : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`03fc3650 fffff800`030d8de0 : fffffa80`0e5d4010 00000000`00000006 fffffa80`0e5d4010 00000000`00000044 : nt!KiBugCheckDispatch+0x69
fffff880`03fc3790 fffff880`0212a6fd : fffffa80`0d216030 fffff880`02127941 fffff880`030200ff fffffa80`0dd03788 : nt!KiPageFault+0x260
fffff880`03fc3920 fffff880`022a84eb : 00000000`00000000 fffff880`02276802 00000000`00000000 fffff880`0224a825 : NETIO!RtlCopyBufferToMdl+0x1d
fffff880`03fc3980 fffff880`022740f6 : fffffa80`0df9d670 00000000`00000000 fffffa80`0e586c10 00000000`4d3149e6 : tcpip! ?? ::FNODOBFM::`string'+0x1bb3f
fffff880`03fc39f0 fffff880`022636b8 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`020e617b : tcpip!TcpTcbCarefulDatagram+0x1a46
fffff880`03fc3ba0 fffff880`0226297a : fffffa80`0e586c10 fffff880`0225b800 fffffa80`07ec8300 fffff880`02271672 : tcpip!TcpTcbReceive+0x37c
fffff880`03fc3cb0 fffff880`02263aeb : fffff880`0542308e fffffa80`08039000 00000000`00000000 fffff880`03fc4000 : tcpip!TcpMatchReceive+0x1fa
fffff880`03fc3e00 fffff880`0225bf17 : fffffa80`07f07f00 fffffa80`07f0d5d7 fffffa80`0000d1be 00000000`0000d1be : tcpip!TcpPreValidatedReceive+0x36b
fffff880`03fc3ed0 fffff880`0225ba8a : 00000000`00000000 fffff880`02369800 fffff880`03fc4090 fffffa80`07a7d860 : tcpip!IppDeliverListToProtocol+0x97
fffff880`03fc3f90 fffff880`0225b089 : fffff880`03fc4158 00000000`00000000 00000000`000000a4 fffff880`03fc4080 : tcpip!IppProcessDeliverList+0x5a
fffff880`03fc4030 fffff880`02258d2f : 00000000`00000000 00000000`0adb6b00 fffff880`02369800 fffff880`02369800 : tcpip!IppReceiveHeaderBatch+0x23a
fffff880`03fc4110 fffff880`02258302 : fffffa80`0adb9b60 00000000`00000000 fffffa80`0adb6b00 00000000`00000001 : tcpip!IpFlcReceivePackets+0x64f
fffff880`03fc4310 fffff880`022cabca : fffffa80`00000000 fffffa80`070b85a0 fffffa80`0adb6ba0 fffff880`03fc4400 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
fffff880`03fc43f0 fffff800`030e6878 : fffffa80`070b85a0 fffffa80`00000000 fffffa80`0701cb50 00000000`00000001 : tcpip! ?? ::FNODOBFM::`string'+0x49ca2
fffff880`03fc4440 fffff880`02257e22 : fffff880`02257650 00000000`00000014 00000000`00000000 fffffa80`0e403f01 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`03fc4520 fffff880`020e60eb : fffffa80`0adb8010 00000000`00000000 fffffa80`0a8ac1a0 fffffa80`07ef8858 : tcpip!FlReceiveNetBufferListChain+0xb2
fffff880`03fc4590 fffff880`020afad6 : fffffa80`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb
fffff880`03fc4600 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!RtlCopyBufferToMdl+1d
fffff880`0212a6fd 448b5228        mov     r10d,dword ptr [rdx+28h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  NETIO!RtlCopyBufferToMdl+1d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  5034f6a0

FAILURE_BUCKET_ID:  X64_0xD1_NETIO!RtlCopyBufferToMdl+1d

BUCKET_ID:  X64_0xD1_NETIO!RtlCopyBufferToMdl+1d

Followup: MachineOwner
---------