Random BSOD, shut down and freezing WHAT IS CAUSING THIS?

[FinDude]

Hi,

I've posted here before about the same issue. Last time it turned out to be a faulty CPU, which I replaced. Now it seems that the new CPU is damaged also. I can't make any sense of the dump files. I need a quick answer: Are the errors caused by hardware (CPU), or are they caused by a driver ect.?

- FinDude

 

[zigzag3143]

These were related to netio.sys and that usually means your malware application. In your case I would remove and replace Avast with Microsoft Security Essentials.

Avast can be a contributing cause of BSOD'S . Please remove and replace with Microsoft Security Essentials AT LEAST TO TEST


http://files.avast.com/files/eng/aswclear5.exe

Microsoft Security Essentials - Free Antivirus for Windows

 

[FinDude]

These were related to netio.sys and that usually means your malware application. In your case I would remove and replace Avast with Microsoft Security Essentials.

Avast can be a contributing cause of BSOD'S . Please remove and replace with Microsoft Security Essentials AT LEAST TO TEST


http://files.avast.com/files/eng/aswclear5.exe

Microsoft Security Essentials - Free Antivirus for Windows

I've done what you suggested and the problem seemed to go away, but this morning I got a new BSOD. What caused this one?

 

[writhziden]

System Security (this is just to check that you have it installed and it is working properly; nothing needs to be done with this information at this time):

msmpeng.exe	c:\program files\microsoft security client\antimalware\msmpeng.exe	560	8	200	1380	10.4.2012 8:08	3.0.8402.0	12,48 kt (12*784 tavua)	27.4.2011 17:21
nissrv.exe	c:\program files\microsoft security client\antimalware\nissrv.exe	2492	8	200	1380	10.4.2012 8:09	3.0.8402.0	281,52 kt (288*272 tavua)	27.4.2011 17:21
msseces.exe	c:\program files\microsoft security client\msseces.exe	1540	8	200	1380	10.4.2012 8:09	2.1.1116.0	1,37 Mt (1*436*736 tavua)	15.6.2011 14:35

[list=1][*]
Loading Dump File [D:\Kingston\BSODDmpFiles\FinDude\Windows_NT6_BSOD_jcgriff2\041012-15178-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02e14000 PsLoadedModuleList = 0xfffff800`03058650
Debug session time: Mon Apr  9 23:05:17.624 2012 (UTC - 6:00)
System Uptime: 0 days 0:01:41.810
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002e8532b, fffff88003716908, fffff88003716160}

Probably caused by : ntkrnlmp.exe ( nt!ExpScanGeneralLookasideList+a0 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002e8532b, The address that the exception occurred at
Arg3: fffff88003716908, Exception Record Address
Arg4: fffff88003716160, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExpScanGeneralLookasideList+a0
fffff800`02e8532b 418b40d8        mov     eax,dword ptr [r8-28h]

EXCEPTION_RECORD:  fffff88003716908 -- (.exr 0xfffff88003716908)
ExceptionAddress: fffff80002e8532b (nt!ExpScanGeneralLookasideList+0x00000000000000a0)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88003716160 -- (.cxr 0xfffff88003716160)
rax=0000000000000000 rbx=fffff80003030420 rcx=0000000000000000
rdx=000000000000001e rsi=fffffa8003974b30 rdi=000000000000ffff
rip=fffff80002e8532b rsp=fffff88003716b40 rbp=0000000000000001
 r8=41506e4902040000  r9=0000000000000004 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=fffff80003030410
r14=0000000000000000 r15=fffff88003367f40
iopl=0         nv up ei pl nz na pe cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010203
nt!ExpScanGeneralLookasideList+0xa0:
fffff800`02e8532b 418b40d8        mov     eax,dword ptr [r8-28h] ds:002b:41506e49`0203ffd8=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c2100
 ffffffffffffffff 

FOLLOWUP_IP: 
nt!ExpScanGeneralLookasideList+a0
fffff800`02e8532b 418b40d8        mov     eax,dword ptr [r8-28h]

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff80002e7ab50 to fffff80002e8532b

STACK_TEXT:  
fffff880`03716b40 fffff800`02e7ab50 : 00000000`00000001 00000000`00000008 00000000`00000001 fffff800`030c2c40 : nt!ExpScanGeneralLookasideList+0xa0
fffff880`03716ba0 fffff800`02e7b0a6 : 00000000`00000008 fffff880`03716c10 00000000`00000001 fffffa80`00000000 : nt!ExAdjustLookasideDepth+0x40
fffff880`03716bd0 fffff800`0312af7a : fffffa80`03aa9040 00000000`00000080 fffffa80`03974b30 00000000`00000001 : nt!KeBalanceSetManager+0x1be
fffff880`03716d40 fffff800`02e819c6 : fffff880`03363180 fffffa80`03aa9040 fffff880`0336dfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03716d80 00000000`00000000 : fffff880`03717000 fffff880`03711000 fffff880`03716700 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExpScanGeneralLookasideList+a0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec79dd2

STACK_COMMAND:  .cxr 0xfffff88003716160 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_nt!ExpScanGeneralLookasideList+a0

BUCKET_ID:  X64_0x7E_nt!ExpScanGeneralLookasideList+a0

Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\FinDude\Windows_NT6_BSOD_jcgriff2\033012-14586-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02e66000 PsLoadedModuleList = 0xfffff800`030aa650
Debug session time: Fri Mar 30 04:42:15.998 2012 (UTC - 6:00)
System Uptime: 0 days 0:01:11.559
Loading Kernel Symbols
...............................................................
................................................................
...............................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

Probably caused by : NETIO.SYS ( NETIO!RtlReturnTimerWheelEntry+95 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.

FAULTING_IP: 
+3062383639373262
00000000`00000000 ??              ???

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

ERROR_CODE: (NTSTATUS) 0 - STATUS_WAIT_0

BUGCHECK_STR:  0x1E_0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff8000460f138 -- (.exr 0xfffff8000460f138)
ExceptionAddress: fffff88001790955 (NETIO!RtlReturnTimerWheelEntry+0x0000000000000095)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff8000460f1e0 -- (.trap 0xfffff8000460f1e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=03b02210fffffa80 rbx=0000000000000000 rcx=03b0224400000000
rdx=0000000003b02220 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001790955 rsp=fffff8000460f370 rbp=0000000000000000
 r8=0000000000000005  r9=00000000fffffa80 r10=00000000fffffa80
r11=0000000000000004 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
NETIO!RtlReturnTimerWheelEntry+0x95:
fffff880`01790955 488908          mov     qword ptr [rax],rcx ds:6178:03b02210`fffffa80=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002eda6fe to fffff80002ee2d10

STACK_TEXT:  
fffff800`0460e218 fffff800`02eda6fe : fffffa80`0762fc10 fffff880`01a019a0 fffff800`0460e990 fffff800`02f0dda0 : nt!KeBugCheck
fffff800`0460e220 fffff800`02f0da6d : fffff800`030eb71c fffff800`03028078 fffff800`02e66000 fffff800`0460f138 : nt!KiKernelCalloutExceptionHandler+0xe
fffff800`0460e250 fffff800`02f0c845 : fffff800`0302bfac fffff800`0460e2c8 fffff800`0460f138 fffff800`02e66000 : nt!RtlpExecuteHandlerForException+0xd
fffff800`0460e280 fffff800`02f1d7c1 : fffff800`0460f138 fffff800`0460e990 fffff800`00000000 fffffa80`03b02244 : nt!RtlDispatchException+0x415
fffff800`0460e960 fffff800`02ee23c2 : fffff800`0460f138 fffffa80`03b02000 fffff800`0460f1e0 fffffa80`03ad7a70 : nt!KiDispatchException+0x135
fffff800`0460f000 fffff800`02ee0cca : fffffa80`00000000 d00a8a0d`00009924 fffffa80`075bc578 fffff880`04916b46 : nt!KiExceptionDispatch+0xc2
fffff800`0460f1e0 fffff880`01790955 : ffffffff`fff0bdc0 fffff800`03057e80 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a
fffff800`0460f370 fffff880`0190c479 : fffffa80`03b01f5c fffffa80`03ad7a70 fffffa80`03ad41f0 00000000`00001c24 : NETIO!RtlReturnTimerWheelEntry+0x95
fffff800`0460f3a0 fffff880`0190c8a7 : 00000000`00000004 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!TcpProcessExpiredTcbTimers+0x1b9
fffff800`0460f470 fffff800`02eeda6c : fffff800`03057e80 00000000`00000000 fffff800`0460f600 00000000`00000000 : tcpip!TcpPeriodicTimeoutHandler+0x297
fffff800`0460f570 fffff800`02eed906 : fffff800`0307ef50 00000000`000011eb 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
fffff800`0460f5e0 fffff800`02eed7ee : 00000000`2aa71de3 fffff800`0460fc58 00000000`000011eb fffff800`0305bfe8 : nt!KiProcessExpiredTimerList+0xc6
fffff800`0460fc30 fffff800`02eed5d7 : 00000000`0f24e1c2 00000000`000011eb 00000000`0f24e178 00000000`000000eb : nt!KiTimerExpiration+0x1be
fffff800`0460fcd0 fffff800`02edaa6a : fffff800`03057e80 fffff800`03065cc0 00000000`00000000 fffff880`00c054c0 : nt!KiRetireDpcList+0x277
fffff800`0460fd80 00000000`00000000 : fffff800`04610000 fffff800`0460a000 fffff800`0460fd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!RtlReturnTimerWheelEntry+95
fffff880`01790955 488908          mov     qword ptr [rax],rcx

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  NETIO!RtlReturnTimerWheelEntry+95

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79381

FAILURE_BUCKET_ID:  X64_0x1E_0_NETIO!RtlReturnTimerWheelEntry+95

BUCKET_ID:  X64_0x1E_0_NETIO!RtlReturnTimerWheelEntry+95

Followup: MachineOwner
---------


[/list]

1. Possible causes are Memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers... Graphics Card...
2. Indicates a network related crash. Could be corrupted/outdated antivirus software, corrupted/outdated network drivers, or corrupted/outdated audio drivers. None of the drivers seem out of date, so it is probably corruption.

It appears that you resolved the second crash by removing avast! which probably helped. However, there may have been an underlying problem that was not addressed. I would recommend re-installing your network drivers. If you need help doing so, provide us with your wireless adapter information and your motherboard model.

• To fully re-install a driver, use the following steps.
  1. First, download the latest driver. Then do the next steps.
  2. Click Start Menu
  3. Right Click My Computer/Computer
  4. Click Manage
  5. Click Device Manager from the list on the left
  6. Find the device you are trying to uninstall by expanding the appropriate set of devices
  7. Right click the device
  8. Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
  9. Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
  10. Restart your computer only if Windows asks you to.
  11. Install the latest driver for the device.
  
  Alternatively:
  1. Login as an adminstrative user.
  2. First, download the latest driver. Then do the next steps.
  3. Click Start Menu
  4. Click Control Panel
  5. Click Hardware and Sound
  6. Click Device Manager (the last link under Devices and Printers)
  7. Find the device you are trying to uninstall by expanding the appropriate set of devices
  8. Right click the device
  9. Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
  10. Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
  11. Restart your computer only if Windows asks you to.
  12. Install the latest driver for the device.

Check your memory and your graphics card:

• Monitor temperatures during the following tests.
  
  Use the following programs to monitor the temperatures.​
  • Real Temp is a good CPU temperature monitor.
  • Speccy - System Information - Free Download will monitor all hardware temperatures.
  • HWiNFO, HWiNFO32 & HWiNFO64 - Hardware Information and Analysis Tools can be inaccurate for CPU temperatures, but is a good program for GPU temperature monitoring.
  • Use FurMark: VGA Stress Test, Graphics Card and GPU Stability Test, Burn-in Test, OpenGL Benchmark and GPU Temperature | oZone3D.Net to test the graphics card GPU. Let it run until the GPU temperatures even out or until the GPU temperatures reach a dangerous level (you can find the max temperature for your card on either the nVidia or AMD sites; if you are not sure, ask us). The goal is to get a steady temperature, find out if the GPU is overheating, or to see if there are any artifacts present in the test itself: look for strange pixelated patterns on the screen or colors that do not look like they belong. Then use the |MG| Video Memory Stress Test 1.7.116 Download to test your graphics card memory. Let the memory test run for at least seven passes; the more the better.
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
  If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
  Once these steps have been followed, it is safe to remove and replace components within your computer.