Random BSOD on new W7 installation: IRQL Error

[AnimalHungry]

Hi - I've recently upgraded my motherboard and CPU and did a fresh install of Windows 7 Ultimate x64. The installation went fine but the PC now dumps out to a BSOD a few times a day. Attached is the SF Diags zip file and here's a link to the most recent minidump file: FileSwap.com : 052013-13728-01.zip download free. I've also completed my System Specs listing my hardware.

The BSOD itself gives an IRQL error, so I'm thinking it is most likely a driver conflict, but I'm afraid I have no idea how to debug the issue and find out which driver is at fault. I've upgraded my chipset and other motherboard drivers, latest BIOS etc and drivers for my video card and webcam (Logitech Quickcam Pro 9000) but none of that made a difference to the BSOD issue.

The only other thing I can think of is that my memory is rather voltage sensitive and needs 1.85-1.95v to run at stock clocks, but this new Gigabyte motherboard discovered that and set the RAM voltage correctly on its own (my old Asus board failed to do that and would reboot until I manually set the RAM voltage).

Any ideas greatly appreciated!

Cheers
Simon

 

[Arc]

It appears that your Realtek network driver is failing there.

fffff880`03976d38  fffff880`05e1b9b0Unable to load image [URL="http://www.carrona.org/drivers/driver.php?id=Rt64win7.sys"]Rt64win7.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=Rt64win7.sys"]Rt64win7.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=Rt64win7.sys"]Rt64win7.sys[/URL]
 Rt64win7+0x1b9b0

And the driver is very old.

fffff880`05e00000 fffff880`05ea0000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: Rt64win7.sys
[COLOR=Red]    Image name: Rt64win7.sys
    Timestamp:        Tue Sep 27 20:20:33 2011[/COLOR] (4E81E2B9)
    CheckSum:         0009FB77
    ImageSize:        000A0000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it from Realtek

Let us know the results. If it continues to BSOD even after updating teh driver, upload your MSINFO32.nfo file next time, alongwith the other required files.

1. Click on the start button
2. Type "msinfo32" (without quotes) in the search bar of the start menu, click the resulting link. It will open the System Information window.
3. File>Save. In the "File Name" filed, put "MSINFO32" (without Quote), give the save location to desktop, and click the "save" button.
4. Give the time for processing, it will save a .nfo file on your desktop.
5. Zip it, and upload it following the instruction.

________________________________________________________________________________
BSOD ANALYSIS:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {28, 2, 0, fffff880019406fd}

Probably caused by : NETIO.SYS ( NETIO!RtlCopyBufferToMdl+1d )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff880019406fd, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003303100
GetUlongFromAddress: unable to read from fffff800033031c0
 0000000000000028 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
NETIO!RtlCopyBufferToMdl+1d
fffff880`019406fd 448b5228        mov     r10d,dword ptr [rdx+28h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff880039766f0 -- (.trap 0xfffff880039766f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88003976910 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880019406fd rsp=fffff88003976880 rbp=fffff880039769b0
 r8=00000000ffffffbc  r9=0000000000000044 r10=0000000000000000
r11=fffffa800e59d5b0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
NETIO!RtlCopyBufferToMdl+0x1d:
fffff880`019406fd 448b5228        mov     r10d,dword ptr [rdx+28h] ds:00000000`00000028=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030cb1a9 to fffff800030cbc00

STACK_TEXT:  
fffff880`039765a8 fffff800`030cb1a9 : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`039765b0 fffff800`030c9e20 : 00000000`00004cef fffff880`0397f2e6 00000000`00000000 00000000`00000044 : nt!KiBugCheckDispatch+0x69
fffff880`039766f0 fffff880`019406fd : 00000000`00000000 00000000`000033f1 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
fffff880`03976880 fffff880`01aa591c : fffffa80`108c2710 fffff880`01a73f06 00000000`00000000 fffffa80`108c2710 : NETIO!RtlCopyBufferToMdl+0x1d
fffff880`039768e0 fffff880`01a71a23 : fffffa80`0e59d5b0 00000000`00000000 fffffa80`108c2710 00000000`da25985e : tcpip! ?? ::FNODOBFM::`string'+0x1ceef
fffff880`03976950 fffff880`01a62b44 : fffffa80`00000006 00000000`00000017 00000000`00004cef 00000000`0000f2e6 : tcpip!TcpTcbCarefulDatagram+0x1aa3
fffff880`03976b00 fffff880`01a61fda : fffffa80`085ca930 fffff880`01a5aeb4 fffffa80`0858ad30 00000000`00000000 : tcpip!TcpTcbReceive+0x694
fffff880`03976cb0 fffff880`01a6357b : fffff880`083458d2 fffffa80`086fc000 00000000`00000000 fffff880`03977000 : tcpip!TcpMatchReceive+0x1fa
fffff880`03976e00 fffff880`01a5b547 : fffffa80`085ca930 fffffa80`085df2e6 fffffa80`00004cef 00000000`00004cef : tcpip!TcpPreValidatedReceive+0x36b
fffff880`03976ed0 fffff880`01a5b0ba : 00000000`00000000 fffff880`01b69800 fffff880`03977090 00000000`00000000 : tcpip!IppDeliverListToProtocol+0x97
fffff880`03976f90 fffff880`01a5a6b9 : 00000000`00000000 00000000`00000002 fffffa80`0a635140 fffff880`03977080 : tcpip!IppProcessDeliverList+0x5a
fffff880`03977030 fffff880`01a5835f : 00000000`00000000 00000000`09358b00 fffff880`01b69800 fffff880`01b69800 : tcpip!IppReceiveHeaderBatch+0x23a
fffff880`03977110 fffff880`01a57952 : fffffa80`0935b400 00000000`00000000 fffffa80`09358b00 00000000`00000001 : tcpip!IpFlcReceivePackets+0x64f
fffff880`03977310 fffff880`01acad8a : fffffa80`00000000 fffffa80`0a635140 fffffa80`09358ba0 fffff880`03977400 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
fffff880`039773f0 fffff800`030d7878 : fffffa80`0a635140 fffffa80`00000000 fffffa80`06e0f040 00000000`00000001 : tcpip! ?? ::FNODOBFM::`string'+0x4f472
fffff880`03977440 fffff880`01a574b2 : fffff880`01a56d10 00000000`00000014 00000000`00000000 fffffa80`09acb301 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`03977520 fffff880`018fc0eb : fffffa80`0935a6c0 00000000`00000000 fffffa80`090aa1a0 fffffa80`085b9858 : tcpip!FlReceiveNetBufferListChain+0xb2
fffff880`03977590 fffff880`018c5ad6 : fffffa80`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb
fffff880`03977600 fffff880`0183fac1 : fffffa80`090aa1a0 fffff800`032712d8 00000000`00000001 00000000`00000000 : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6
fffff880`03977a80 fffff880`058c366c : 00000000`00000001 fffff800`032712d8 fffffa80`06e0f040 fffffa80`0c5c96b0 : ndis!NdisMIndicateReceiveNetBufferLists+0xc1
fffff880`03977ad0 fffff880`058bdc17 : fffff880`058d40f0 fffffa80`06e0f040 fffff880`20206f49 00000000`00000000 : tunnel!TeredoWfpIndicationWorker+0xb4
fffff880`03977b10 fffff800`033c3d73 : fffffa80`09349cb0 00000000`00000001 fffffa80`0c5c96b0 fffffa80`06e0f040 : tunnel!LwWorker+0x1b
fffff880`03977b40 fffff800`030d5251 : fffff800`03271200 fffff800`033c3d01 fffffa80`06e0f000 00000000`00000000 : nt!IopProcessWorkItem+0x23
fffff880`03977b70 fffff800`03369ede : 00000000`00000000 fffffa80`06e0f040 00000000`00000080 fffffa80`06c7a9e0 : nt!ExpWorkerThread+0x111
fffff880`03977c00 fffff800`030bc906 : fffff880`0376d180 fffffa80`06e0f040 fffff880`037780c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03977c40 00000000`00000000 : fffff880`03978000 fffff880`03972000 fffff880`039778a0 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!RtlCopyBufferToMdl+1d
fffff880`019406fd 448b5228        mov     r10d,dword ptr [rdx+28h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  NETIO!RtlCopyBufferToMdl+1d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  5034f6a0

FAILURE_BUCKET_ID:  X64_0xD1_NETIO!RtlCopyBufferToMdl+1d

BUCKET_ID:  X64_0xD1_NETIO!RtlCopyBufferToMdl+1d

Followup: MachineOwner
---------

 

[AnimalHungry]

Thanks Arc! I've updated the Realtek driver using the "Win7 and WinServer 2008 R2 Auto Installation Program (SID:1568649)" from the Realtek link you gave me. Attached is the SF Diags zip file which should now show the new Realtek driver being installed, but I haven't had a BSOD yet since upgrading the driver.

I usually get two to three BSOD per day, so I'll let you know if this has fixed the issue.

Thanks again!

Cheers
Simon

 

[Arc]

Hi Simon, if you haven't got a BSOD since updating the driver, its good.

Observe the situation over a time and let us know how it works.

 

[AnimalHungry]

Will do. Thanks again!

 

[AnimalHungry]

BSOD again

I'm afraid I got another BSOD again last night. Attached is the SF Diag's zip file. I wasn't at the computer to see the BSOD error message, I just saw the recovery and reboot.

Any ideas what it could be?

Cheers
Simon

 

[Arc]

No new crash dump is there in the zip, so it is not sure that it was a BSOD.

The last entries in the event log are about the realtek driver installation, so eventlog is not saying what happened that time that you are stating

Continuing observing. If it crashes again, let us know.

 

[AnimalHungry]

That's odd because the Event Viewer is saying that I got a kernel power failure (Event 41) about the same time as I saw the reboot. Is that not a BSOD error then? Attached is a screencap of the Event Viewer showing that error.

Cheers
Simon

 

[Arc]

Event ID 41, Kernel-Power

In absence of a crash dump, it ie difficult to determine that it is a BSOD for real, but that particular thing is very common. Experienced the same a lot of times in debugging.

Disable hibernate/sleep. Follow http://www.sevenforums.com/tutorials/819-hibernate-enable-disable.html

Check if the Power Supply Unit (PSU) supplying adequate power to the computer or not.
eXtreme Power Supply Calculator
At least 30% extra is safe.

Is the computer hot? Report us the heat of the computer after a couple of hours of your normal usage. Upload a screenshot of the summery tab of Speccy.

 

[AnimalHungry]

Thanks for that. I already had it set to never hibernate but I did the elevated CMD to remove the hybrid sleep.

The power calculator thinks I need a minimum of 410W with a recommended of 460W. I have a Corsair 1000W PSU, so I'm OK there.

Attached is a Speccy summary screenshot after running for over 12 hours with 5 hours of my (fairly low power) normal use. Doesn't look too hot to me.

I'll keep using it of course and will see if I get any more BSOD or resetting and will post again with an updated crash dump zip.

Thanks again!

Simon

 

[Arc]

You are welcome mate. If still it crashes and no dump is recorded, we may need to reconfigure minidump recording.

 

[AnimalHungry]

UPDATE: A whole day of work and no BSOD or reboot, which is a result in itself! Have to keep watching it though because it has been known to run stable for a few days and then crap out without notice.

Cheers
Simon

 

[AnimalHungry]

So it went a few days with no BSOD and restart and then last night it rebooted on its own (I wasn't around to see if it was also a BSOD) and then just now while I was working it gave me a BSOD. Attached is the SF Diags zip file. Bummer, because I thought it was all good now

Cheers
Simon

 

[AnimalHungry]

I got another BSOD immediately after I posted that SF Diags zip. Attached is the new SF Diags zip.

EDIT: it just did it again (3rd time in 20 mins) and it was when I was converting a GoPro video from mp4 to avi using Cineform Studio (which is what I was also doing the 2 other times it BSOD'd this morning), so presumably now it's a codec error or something? However, I wasn't converting video last night when it rebooted, so that could be another issue?

Any ideas greatly appreciated.

Thanks
Simon

 

[Arc]

Now it is a bit specific. It is still a network failure, but it is clear that your antivirus is causing the blockage.

fffff880`0395ac48  fffff880`044e59d5Unable to load image [URL="http://www.carrona.org/drivers/driver.php?id=aswSnx.SYS"]aswSnx.SYS[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=aswSnx.SYS"]aswSnx.SYS[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=aswSnx.SYS"]aswSnx.SYS[/URL]
 aswSnx+0x4d9d5

Description here : Driver Reference Table - aswSnx.SYS

Uninstall Avast using Avast Uninstall Utility. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Let us know the results.

 

[AnimalHungry]

Thanks Arc. So the uninstall of Avast in safe mode went fine with no errors. I installed MBAM and MS Essentials. MS Essentials did a full scan with nothing detected and then MBAM found 4 threats, 3 of which are my mining apps and one is a music file (see attached MBAM scan log).

Is there anything I should do/try next?

Cheers
Simon

 

[AnimalHungry]

I just tried running a video conversion in Cineform Studio and I haven't had another BSOD yet, which is great because it would BSOD as soon as I started a conversion before.

 

[Arc]

Apparently it is good.

Now observe the situation over a time, let us know how it is running.

 

[AnimalHungry]

So I just got a BSOD. Attached is the new SF Diags zip. Any ideas what to try next? This time I wasn't processing any video, FWIW.
Cheers
Simon

EDIT: BTW, I just checked my UPS/battery backup which powers my PC, and it says my whole PC, including printer, 3 monitors, router, modem and NAS which are powered separately, only draws 480W and I have a 1000W Corsair PSU.

 

[Arc]

It is a network related issue.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {28, 2, 0, fffff880019a06fd}

Probably caused by : NETIO.SYS ( NETIO!RtlCopyBufferToMdl+1d )

Followup: MachineOwner
---------

The realtek network driver is failing here.

fffff880`03976f38  fffff880`05f4f964Unable to load image Rt64win7.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
 Rt64win7+0x1f964

Despite of being the latest version.

fffff880`05f30000 fffff880`05fff000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:        Mon Mar 04 12:55:55 2013 (51344C83)
    CheckSum:         000D1FB8
    ImageSize:        000CF000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

So I think we need to search for the reasons in somewhere else. Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Uninstall this program:

• Start Menu\Programs\PC Tools Security

Let us know about the situation when done.