Windows 7 BSOD when connecting to internet

MC10

Extraordinary Member
Hello, I'm getting BSODs every time I connect to the internet now. I noticed some random BSODs occurring maybe a few weeks ago. I ran scans and nothing came up so I didn't think much about them. They didn't occur that often.

Ever since about two days ago, every time I started Windows normally and logged in, my computer BSODed. When I start in Safe Mode, nothing bad happens, but Safe Mode with Networking causes a BSOD. A friend of mine suggested rolling back the driver for my Ethernet card or updating it. I checked and I had the most recent version. I rolled it back, but the BSODs still occur. I switched out my Ethernet card with this other one I have, still BSODing. Even when I use a LAN cable it BSODs. I googled a bit on this subject and I've tried suggestions like uninstalling my AVG and I have yet to install Microsoft Security Essentials to replace it.

One thing I noticed was that the BSODs are occurring after I installed a torrent for Replay Media Catcher 4.3.2. It had me edit the hosts file for Windows 7 in Notepad. I have since changed the file back, but it's still BSODing. MalwareBytes scans come up clean, so I don't think anything else is wrong. Do I need to uninstall Replay Media Catcher? Perhaps a System Restore may fix things.

I will include my Minidump in a .zip file. Thanks in advance.
View attachment Minidump.zip

EDIT: I just found this post. I have Replay Media Catcher by Applian and VirtualBox. I will temporarily take out my Ethernet card and disable one when I'm not using it.
https://www.virtualbox.org/ticket/10029
If this solves my problem, I'll update you guys.

EDIT 2: Uninstalling Replay Media Catcher fixed it. I think the NDIS 5 driver installed with Replay Media Catcher was causing problems. NDIS 6.20 is the version for Windows 7. Just disabling VirtualBox did not help. I'm not sure why NDIS 5 is required for Replay Media Catcher or if it even is required.
 
Last edited:
Hello and welcome to the forum.
Good job, sorting out the problem on your own and thanks for updating your post with the information you discovered.
I opened four random dump files from your attachment and found them all to be identical.
DUMP:
Code:
BugCheck C5, {4dee, 2, 0, fffff800031bfdd3}
Unable to load image \SystemRoot\system32\DRIVERS\VBoxNetFlt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for VBoxNetFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for VBoxNetFlt.sys
Probably caused by : VBoxNetFlt.sys ( VBoxNetFlt+3aca )

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0000000000004dee, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff800031bfdd3, address which referenced memory

BUGCHECK_STR:  0xC5_2

CURRENT_IRQL:  2

FAULTING_IP: 
nt!ExFreePoolWithTag+43
fffff800`031bfdd3 418b45f0        mov     eax,dword ptr [r13-10h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b9c4e0 -- (.trap 0xfffff80000b9c4e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000004dfe
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800031bfdd3 rsp=fffff80000b9c670 rbp=fffffa80070a3e70
 r8=0000000000000000  r9=0000000000000000 r10=fffffa8007ded020
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!ExFreePoolWithTag+0x43:
fffff800`031bfdd3 418b45f0        mov     eax,dword ptr [r13-10h] ds:ffffffff`fffffff0=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030901e9 to fffff80003090c40

STACK_TEXT:  
fffff800`00b9c398 fffff800`030901e9 : 00000000`0000000a 00000000`00004dee 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9c3a0 fffff800`0308ee60 : 00000000`00000000 fffffa80`070acc28 ffff0080`049a2c02 fffffa80`07dd2b30 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c4e0 fffff800`031bfdd3 : 00000000`00000000 fffff880`046693bc fffffa80`06fd99f0 fffffa80`070c4778 : nt!KiPageFault+0x260
fffff800`00b9c670 fffff880`016ca195 : fffffa80`07ded0b0 fffffa80`08992d90 00000000`00000000 00000000`00004dfe : nt!ExFreePoolWithTag+0x43
fffff800`00b9c720 fffff880`04a77aca : fffffa80`070a3e70 fffffa80`070a3e70 fffffa80`07ded0b0 fffffa80`06dee1a0 : ndis!NdisFreeMemory+0x15
fffff800`00b9c750 fffffa80`070a3e70 : fffffa80`070a3e70 fffffa80`07ded0b0 fffffa80`06dee1a0 fffffa80`0894a730 : VBoxNetFlt+0x3aca
fffff800`00b9c758 fffffa80`070a3e70 : fffffa80`07ded0b0 fffffa80`06dee1a0 fffffa80`0894a730 fffffa80`06dee1a0 : 0xfffffa80`070a3e70
fffff800`00b9c760 fffffa80`07ded0b0 : fffffa80`06dee1a0 fffffa80`0894a730 fffffa80`06dee1a0 00000000`00000000 : 0xfffffa80`070a3e70
fffff800`00b9c768 fffffa80`06dee1a0 : fffffa80`0894a730 fffffa80`06dee1a0 00000000`00000000 fffff880`0178564e : 0xfffffa80`07ded0b0
fffff800`00b9c770 fffffa80`0894a730 : fffffa80`06dee1a0 00000000`00000000 fffff880`0178564e fffffa80`0894a700 : 0xfffffa80`06dee1a0
fffff800`00b9c778 fffffa80`06dee1a0 : 00000000`00000000 fffff880`0178564e fffffa80`0894a700 fffffa80`070a3e70 : 0xfffffa80`0894a730
fffff800`00b9c780 00000000`00000000 : fffff880`0178564e fffffa80`0894a700 fffffa80`070a3e70 fffffa80`07de58d0 : 0xfffffa80`06dee1a0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
VBoxNetFlt+3aca
fffff880`04a77aca ??              ???

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  VBoxNetFlt+3aca

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: VBoxNetFlt

IMAGE_NAME:  VBoxNetFlt.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4eef3187

FAILURE_BUCKET_ID:  X64_0xC5_2_VBoxNetFlt+3aca

BUCKET_ID:  X64_0xC5_2_VBoxNetFlt+3aca
As you can see and have already determined, VBoxNetFlt.sys is getting blamed
Thanks for joining our community and we hope to continue to see you around.
Regards
Randy
 
Last edited:
Thanks for your reply. I guess I can install Replay Media Catcher and be sure to always uninstall it before shutting down my computer. I'm not sure why it would interfere with VirtualBox. I guess because the NDIS messes up the network or something, I'm not that knowledgeable about all of this.
 
Back
Top