Solved Software- or Configuration-related Crashes

[toranaboy]

I have run WhoCrashed and it says that my BSODs are not hardware-related. I'd be grateful for any help with this as I cannot see any likely candidates by way of rogue programs installed over the last few months.

 

[Arc]

Apparently it is your network driver that is failing here.

BugCheck D1, {18, 2, 0, fffff88001596a88}

Probably caused by : NETIO.SYS ( NETIO!WeightCompare+8 )

Followup: MachineOwner
---------------------------------------------------------------------------------------------------------
BugCheck D1, {0, 2, 0, fffff88001405a9d}

Probably caused by : NETIO.SYS ( NETIO!WeightCompare+1d )

Followup: MachineOwner
----------------------------------------------------------------------------------------------------------
BugCheck 3B, {c0000005, fffff8800165ea88, fffff8800ae9a020, 0}

Probably caused by : NETIO.SYS ( NETIO!WeightCompare+8 )

Followup: MachineOwner
---------

It may fail due to a lot of reasons like an outdated adapter driver, a virus, or an ambitious antivirus. For more detailed analysis, upload your MSINFO32.nfo file.

1. Click on the start button
2. Type "msinfo32" (without quotes) in the search bar of the start menu, click the resulting link. It will open the System Information window.
3. File>Save. In the "File Name" filed, put "MSINFO32" (without Quote), give the save location to desktop, and click the "save" button.
4. Give the time for processing, it will save a .nfo file on your desktop.
5. Zip it, and upload it following the instruction.

 

[toranaboy]

MSINFO32.nfo

Hi Arc. (Not so) long time, no see I have uploaded the .nfo file for your delectation. Thanks for helping.

 

[Arc]

Lol ... not very happy to see you again, at the same place

Last time we updated the network drivers .... not seeing anything very interesting in your crash dumps or msinfo32. So let us go for some tests?

Scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

And then enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any. Post it following the Blue Screen of Death (BSOD) Posting Instructions.

 

[toranaboy]

Ran TDSSKiller, -ve; Microsoft Offline tool, -ve, but would only run a quick scan; enabled verifier last night and I attach the dump file.

 

[Arc]

The verifier enabled BSOD is caused by network driver ....

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 0, fffff880016718c9}

Probably caused by : NETIO.SYS ( NETIO!IndexListClassify+50 )

Followup: MachineOwner
---------

But it is not specifying which one was in use at that time, so I am checking the both.

Realtek PCIe GBE Family Controller

fffff880`04800000 fffff880`04884000   Rt64win7   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\Rt64win7.sys
[COLOR=Red]    Image name: Rt64win7.sys
    Timestamp:        Mon May 16 20:23:31 2011[/COLOR] (4DD13A6B)
    CheckSum:         000859EC
    ImageSize:        00084000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

So it is very old. Update it from Realtek, take the Win7 and WinServer 2008 R2 Auto Installation Program (SID:1581786), dated 2013/5/22.

D-Link DWA-125 Wireless N 150 USB Adapter(rev.A2) driver .....

fffff880`02a58000 fffff880`02beb000   Dnetr28ux   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\Dnetr28ux.sys
[COLOR=Red]    Image name: Dnetr28ux.sys
    Timestamp:        Thu Apr 28 11:48:18 2011 [/COLOR](4DB906AA)
    CheckSum:         00193FD2
    ImageSize:        00193000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

This is also old. In this link D-Link | DWA-125 Wireless N150 USB Adapter, take the driver and try. If it does not work, search for your hardware version.

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Let us know the results.

 

[toranaboy]

The Cure?

I have replaced the drivers and purged the startup list as you suggested. I have commenced Operation Vigilance which involves me leaving the computer on and undertaking no vigilance whatsoever. I expect if it's going to crash it will be within 48 hours. I will let you have my report in due course. Thank you for your guidance.

 

[Arc]

Its ok mate
Waiting for the belated report, but wish you all the best

 

[toranaboy]

48 Hours?

Well it took a good bit less than 48 hours for the system to fall over Here's the dump:

 

[Arc]

Another network relate issue, continuing.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff8800167caaa, fffff8800bd14540, 0}

Probably caused by : NETIO.SYS ( NETIO!IsFilterBypassAvailable+2a )

Followup: MachineOwner
------------------------------------------------------------------------------------------------------
fffff880`0bd143f8  fffff880`01672000 NETIO!PtpSwapWithSuccessor <PERF> (NETIO+0x0)
fffff880`0bd14400  fffff880`016c1e7c NETIO!WPP_MAIN_CB <PERF> (NETIO+0x4fe7c)
fffff880`0bd14408  fffff880`01672000 NETIO!PtpSwapWithSuccessor <PERF> (NETIO+0x0)
fffff880`0bd14410  fffff880`016c1ef4 NETIO!WPP_MAIN_CB <PERF> (NETIO+0x4fef4)
fffff880`0bd14418  fffff880`01672000 NETIO!PtpSwapWithSuccessor <PERF> (NETIO+0x0)
fffff880`0bd14420  fffff880`016c1fa8 NETIO!WPP_MAIN_CB <PERF> (NETIO+0x4ffa8)
fffff880`0bd14428  fffff880`01800000 tcpip!OlmQuerySystemConnectionOffloadSupportCommon <PERF> (tcpip+0x0)
fffff880`0bd14430  fffff880`019a7d04 tcpip!LowMemoryEvent <PERF> (tcpip+0x1a7d04)
fffff880`0bd14438  fffff880`01800000 tcpip!OlmQuerySystemConnectionOffloadSupportCommon <PERF> (tcpip+0x0)
fffff880`0bd14440  fffff880`019a7d4c tcpip!LowMemoryEvent <PERF> (tcpip+0x1a7d4c)
fffff880`0bd14448  fffff880`01800000 tcpip!OlmQuerySystemConnectionOffloadSupportCommon <PERF> (tcpip+0x0)
fffff880`0bd14450  fffff880`019a7d1c tcpip!LowMemoryEvent <PERF> (tcpip+0x1a7d1c)
fffff880`0bd14458  fffff880`01800000 tcpip!OlmQuerySystemConnectionOffloadSupportCommon <PERF> (tcpip+0x0)
fffff880`0bd14460  fffff880`019a7ec0 tcpip!LowMemoryEvent <PERF> (tcpip+0x1a7ec0)
fffff880`0bd14468  fffff880`01800000 tcpip!OlmQuerySystemConnectionOffloadSupportCommon <PERF> (tcpip+0x0)
fffff880`0bd14470  fffff880`019a7e78 tcpip!LowMemoryEvent <PERF> (tcpip+0x1a7e78)
fffff880`0bd14478  fffff880`01800000 tcpip!OlmQuerySystemConnectionOffloadSupportCommon <PERF> (tcpip+0x0)

Nothing showing more as problem. Only thing I can find that the D-Link DWA-125 Wireless N 150 USB Adapter driver is not updated yet.

fffff880`0c23a000 fffff880`0c3cd000   Dnetr28ux   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\Dnetr28ux.sys
[COLOR=Red]    Image name: Dnetr28ux.sys
    Timestamp:        Thu Apr 28 11:48:18 2011[/COLOR] (4DB906AA)
    CheckSum:         00193FD2
    ImageSize:        00193000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

A dongle with a backdated driver is always problematic. Is not there any update available?

 

[toranaboy]

D-Link driver

No, 2011 is the latest it turns out. It didn't occur to me to check the date when I installed it. I imagine the attached minidump tells a similar story. I will have to shell out for a new wireless adapter and see what happens. I am over D-Link stuff. The last dongle which caused all the bother was a D-Link. I will give you an update when the hardware is switched.

 

[Arc]

The same BSOD continues.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 0, fffff8800156e8c9}

Probably caused by : NETIO.SYS ( NETIO!IndexListClassify+50 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8800156e8c9, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000390d100
GetUlongFromAddress: unable to read from fffff8000390d1c0
 0000000000000000 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
NETIO!IndexListClassify+50
fffff880`0156e8c9 488b1f          mov     rbx,qword ptr [rdi]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  wmpnetwk.exe

TRAP_FRAME:  fffff8800378c810 -- (.trap 0xfffff8800378c810)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff880015b7bc0
rdx=fffff8800378ce38 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800156e8c9 rsp=fffff8800378c9a0 rbp=0000000000000000
 r8=fffff8800378d120  r9=fffff8800378ca20 r10=fffffa8011b30ba0
r11=fffff8800378cf80 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe cy
NETIO!IndexListClassify+0x50:
fffff880`0156e8c9 488b1f          mov     rbx,qword ptr [rdi] ds:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800036d51a9 to fffff800036d5c00

STACK_TEXT:  
fffff880`0378c6c8 fffff800`036d51a9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0378c6d0 fffff800`036d3e20 : 00000000`0000001c 00000000`00000001 00000000`00000002 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0378c810 fffff880`0156e8c9 : 00000000`00000000 fffffa80`11d93110 00000000`00000000 fffff880`0378d120 : nt!KiPageFault+0x260
fffff880`0378c9a0 fffff880`0156f6ec : 00000000`00000000 00000000`00000010 fffff880`0378d120 fffff880`0378cb60 : NETIO!IndexListClassify+0x50
fffff880`0378ca20 fffff880`0167e689 : fffff880`0378d120 fffff880`0378ce38 fffff880`0378ce60 fffffa80`0f211c30 : NETIO!KfdClassify+0xa4e
fffff880`0378cd90 fffff880`01628cf0 : fffffa80`12a606b0 00000000`00000000 00000000`00000000 fffff880`01747980 : tcpip!WfpAleClassify+0x49
fffff880`0378cde0 fffff880`0164c4a4 : fffffa80`12a606b0 fffffa80`000001cb fffffa80`12a606b0 fffffa80`0f211c30 : tcpip!WfpAlepAuthorizeAccept+0x760
fffff880`0378d380 fffff880`0164c9de : 00000000`00000000 00000000`00000000 00000000`0000e8c6 fffffa80`10732138 : tcpip!WfpAleAuthorizeAccept+0x544
fffff880`0378d630 fffff880`0164de34 : fffffa80`12a606b0 fffffa80`0f211ec8 fffff880`0378d928 00000000`00000000 : tcpip!InetInspectAccept+0x6e
fffff880`0378d6b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!TcpInspectListenerReceive+0x144


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!IndexListClassify+50
fffff880`0156e8c9 488b1f          mov     rbx,qword ptr [rdi]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  NETIO!IndexListClassify+50

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  5034f6a0

FAILURE_BUCKET_ID:  X64_0xD1_NETIO!IndexListClassify+50

BUCKET_ID:  X64_0xD1_NETIO!IndexListClassify+50

Followup: MachineOwner
---------

If you plan to switch the adapter, plan to get one who make their driver themselves and update it regularly. Qualcomm Atheros is a good choice IMO. They have a wide range to choose from.

 

[toranaboy]

More Problems

Thing crashed a minute ago while I was posting about the previous crash :shock:. Why so many crashes? I don't get it. I attach both dumps in the one .zip archive. Help!

 

[Arc]

I would suggest you to update two driver at once.

Realtek RTL8192SU Wireless LAN 802.11n Network Adapter Driver

fffff880`072e5000 fffff880`073a8000   RTL8192su T (no symbols)           
    Loaded symbol image file: RTL8192su.sys
    Image path: \SystemRoot\system32\DRIVERS\[URL="http://www.carrona.org/drivers/driver.php?id=RTL8192su.sys"]RTL8192su.sys[/URL]
    Image name: RTL8192su.sys
[COLOR=Red]    Timestamp:        Thu Aug 11 08:06:33 2011 [/COLOR](4E434031)
    CheckSum:         000B620E
    ImageSize:        000C3000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Get it from Realtek

Etron USB 3.0 Extensible Hub Driver

fffff880`061df000 fffff880`061ebd80   EtronHub3   (deferred)             
    Image path: \SystemRoot\System32\Drivers\EtronHub3.sys
[COLOR=Red]    Image name: EtronHub3.sys
    Timestamp:        Sat May 21 06:50:28 2011 [/COLOR](4DD7135C)
    CheckSum:         00019A7D
    ImageSize:        0000CD80
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Search for OEM drivers, in your motherboard manufacturer's site.

 

[toranaboy]

Copy that

Have installed the two drivers you suggested. I had meant to tell you that I'd settled for a Belkin wireless dongle as the range available in the country is limited. And I couldn't be stuffed waiting for the item to come by post. Thanks for the tip about the Qualcomm product; I'll try to remember it.

That USB 3.0 driver is interesting as I had bought a 1TB backup disc (an HP) which gave me no end of trouble at the time I was switching to 64 bit (for my sins). I gave up on it in the end, but I'm nursing a suspicion that it was my box that was the problem. Hmmm.

Thanks for the advice to date. Will let you know how I go with the renovated rig

 

[toranaboy]

Linux Lookin' Good Again

I have experienced this phenomenon before: the more you fiddle with things trying to fix them, the worse the problem gets . I attach the latest dump for your delectation.

 

[Arc]

I have experienced this phenomenon before: the more you fiddle with things trying to fix them, the worse the problem gets . I attach the latest dump for your delectation.

I have requested my guru Vir Granus to look at your issue. Please wait for his invaluable suggestions.

The last dump you uploaded is a storage related issue, occurring for the first time there. As there are network and storage, both operations are failing, scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

 

[toranaboy]

Virus/Rootkit check

I ran TDSSKiller and Windows Defender Offline thingie at the outset as you had suggested. Nothing turned up. I noted then that the Windows Defender would only do a quick scan, complaining that its service was not running or some such. I have MalwareBytes running and MSE. I have started a full scan with MalwareBytes. I did another scan with TDSSKiller: nothing.

Your guru must be a fellow of very considerable engineering wisdom. I don't know whether I am worthy

 

[toranaboy]

It occurs to me that I should tell you that I have a number of USB devices: a printer, a scanner, a microphone, a webcam, and a portable HDD. Some of the devices are connected through a powered hub. None are very new.

 

[Vir Gnarus]

Have we ran Driver Verifier on this yet? Best to set it up, restart PC, then provide us the crashdumps from any crashes it may produce. Make sure to read the article entirely.

EDIT: It did, earlier. I'll check em out.