BSOD Weekly. BugcheckCode 209. New to all this :/

[Wecareben]

This happens at least once a week. I have no idea where to start or stop. I managed to get the attached screen shots from the event viewer. Any help is great. Thank you so much!

 

[axe0]

Hi Wecareben,

Welcome to the 7forums.

The cause of the crashes is the Realtek PCIe GBE Family Controller.
Please check here for driver updates

1: kd> lmvm Rt64win7
start             end                 module name
fffff880`04e00000 fffff880`04ed2000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: \SystemRoot\system32\DRIVERS\Rt64win7.sys
    Image name: [U]Rt64win7.sys[/U]
    Timestamp:        [COLOR="Red"][U]Wed Apr 10 05:00:34 2013[/U][/COLOR] (5164D5D2)
    CheckSum:         000DB44C
    ImageSize:        000D2000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[Wecareben]

Thank you very much! I am unable to work on that PC for a few more days, but will mark this as resolved once I do. Thanks again!

 

[axe0]

You're welcome

Let me know how it goes

 

[Wecareben]

Still not working

Everything was ok from last Monday (September 21st) but today the PC crashed again unexpectedly. I have the details pasted below. Any help?

Problem signature:



Problem Event Name: BlueScreen

OS Version: 6.1.7601.2.1.0.256.48

Locale ID: 1033

Additional information about the problem:



BCCode: d1

BCP1: 0000000004DE004B

BCP2: 0000000000000002

BCP3: 0000000000000000

BCP4: FFFFF88003D88857

OS Version: 6_1_7601

Service Pack: 1_0

Product: 256_1

Files that help describe the problem:



C:\Windows\Minidump\093015-36285-01.dmp

C:\Windows\Temp\WER-43742-0.sysdata.xml

Read our privacy statement online:




Windows 7 Privacy Statement - Microsoft Windows


If the online privacy statement is not available, please read our privacy statement offline:


C:\Windows\system32\en-US\erofflps.txt

 

[axe0]

Please use the tool again and upload the zip file.

 

[Laith]

Please post the new logs.

 

[Wecareben]

Here you go...

 

[Laith]

It was axe0 who responded to you first so i'll analyze the dumps for him and he can help you with this issue.

BugCheck D1, {4de004b, 2, 0, fffff88003d88857}

Probably caused by : mpsdrv.sys(FYI this is the Microsoft Protection Service Driver) ( mpsdrv!WPP_SF_DHDHDs+bb7 )

BugCheck AB, {1, 210, 0, 2}

Probably caused by : memory_corruption ( nt!MiCheckSessionPoolAllocations+13f )

 

[Wecareben]

Thanks Laith...

 

[Laith]

No problem.

 

[axe0]

Thank you @laith for your help

Looking at the stack, there is a lot of Network In/Output System activity.
This usually means the network drivers are causing the problem, but it could of course also be something else.

fffff880`09072488 fffff800`03077b69 : 00000000`0000000a 00000000`04de004b 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`09072490 fffff800`030767e0 : fffff800`031f8e80 fffff780`00000320 00000000`006a28df 00000000`04de0040 : nt!KiBugCheckDispatch+0x69
fffff880`090725d0 fffff880`03d88857 : fffffa80`08909a20 fffffa80`08909a00 00000000`00000ae0 00000000`00000000 : nt!KiPageFault+0x260 (TrapFrame @ fffff880`090725d0)
fffff880`09072760 fffff880`03d85990 : fffffa80`096f2f40 fffff800`035f5472 fffffa80`08e38640 fffffa80`09ec79b0 : mpsdrv!WPP_SF_DHDHDs+0xbb7
fffff880`09072830 fffff880`03d8340b : 00000000`0000000d 00000000`00000001 00000000`00000000 fffffa80`0397e240 : mpsdrv!DfwAnalyzeIpFlowData+0xc0
fffff880`09072890 fffff880`019751c2 : fffffa80`06d5d470 fffff880`09072b18 fffff880`09072b18 fffff880`09072ae0 : mpsdrv!MpsGetFwpAuthData+0x15fb
fffff880`09072900 fffff880`01980e98 : 00000000`00000000 fffff880`090730c0 fffff880`09072a90 fffff880`09072b18 : [COLOR="red"]NETIO[/COLOR]!StreamInvokeCalloutAndNormalizeAction+0x142
fffff880`090729a0 fffff880`01981e91 : fffffa80`06d5d470 fffff880`090730c0 fffff880`09072ae0 fffff880`09073070 : [COLOR="red"]NETIO[/COLOR]!StreamCalloutProcessData+0x48
fffff880`090729f0 fffff880`01982ee8 : fffff880`09072ae0 fffff880`09073070 fffff880`09073001 fffffa80`06d5d470 : [COLOR="red"]NETIO[/COLOR]!StreamCalloutProcessingLoop+0xa1
fffff880`09072a80 fffff880`01963a2a : fffff880`090730c0 fffff880`03d83150 00000000`00000001 fffff880`09070014 : [COLOR="red"]NETIO[/COLOR]!StreamProcessCallout+0x1e8
fffff880`09072b70 fffff880`0194befc : fffffa80`047c0014 fffff880`09073170 fffffa80`097ae3d8 fffff880`09073070 : [COLOR="Red"]NETIO[/COLOR]! ?? ::FNODOBFM::`string'+0x71f2
fffff880`09072c90 fffff880`01985f09 : fffff880`09073440 fffff880`09073170 fffffa80`03e64520 fffff880`09073070 : [COLOR="red"]NETIO[/COLOR]!KfdClassify+0x24c
fffff880`09073000 fffff880`019863c9 : fffffa80`097ae380 00000000`00000014 00000000`00000000 00000000`00000000 : [COLOR="red"]NETIO[/COLOR]!StreamClassify+0x109
fffff880`09073120 fffff880`01986b0c : fffffa80`03cd4a80 fffffa80`070b2180 fffffa80`08813400 fffffa80`088b5620 : [COLOR="red"]NETIO[/COLOR]!StreamCommonInspect+0x249
fffff880`09073400 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : [COLOR="Red"]NETIO[/COLOR]!WfpStreamInspectSend+0x11c

Looking a little further, the Realtek PCIe GBE Family Controller driver is again flagged.
But because the Microsoft Protection Service Driver is also mentioned I would think that AVG is causing this.
Please uninstall AVG using the uninstall instructions as a test.

*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys

0: kd> lmvm Rt64win7
start             end                 module name
fffff880`0c846000 fffff880`0c938000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: \SystemRoot\system32\DRIVERS\Rt64win7.sys
    Image name: [U]Rt64win7.sys[/U]
    Timestamp:        [COLOR="red"][U]Thu Jan 15 07:06:44 2015[/U][/COLOR] (54B758F4)
    CheckSum:         000FD73D
    ImageSize:        000F2000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[Laith]

No problem, also kudos for that analyzing! You have already beaten me! I want to give rep to you but i can't. I'm sorry.