Windows 7 Frequent BSOD, what is the cause? minidumps attached

Code:
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************


Use !analyze -v to get detailed debugging information.


BugCheck D1, {8, 2, 0, fffff88001ada5bb}


*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : NETIO.SYS ( NETIO!NetioAllocateAndReferenceCloneNetBufferList+32 )


Followup: MachineOwner
---------


2: kd> !analyze -v;r;kv;lmtsmn;.bugcheck;!peb;!sysinfo cpuinfo;!sysinfo machineid; !sysinfo cpuspeed; !sysinfo smbios!
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************


DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88001ada5bb, address which referenced memory


Debugging Details:
------------------




READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003112100
 0000000000000008 


CURRENT_IRQL:  2


FAULTING_IP: 
ndis!NdisAllocateCloneNetBufferList+1ab
fffff880`01ada5bb 498b5e08        mov     rbx,qword ptr [r14+8]


CUSTOMER_CRASH_COUNT:  1


DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT


BUGCHECK_STR:  0xD1


PROCESS_NAME:  System


TRAP_FRAME:  fffff88003594b20 -- (.trap 0xfffff88003594b20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800b2e09b0 rbx=0000000000000000 rcx=fffffa800b2e0a60
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001ada5bb rsp=fffff88003594cb0 rbp=fffffa800b2e0880
 r8=0000000000000000  r9=0000000000000000 r10=fffffa8007e15400
r11=00000000000017ac r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
ndis!NdisAllocateCloneNetBufferList+0x1ab:
fffff880`01ada5bb 498b5e08        mov     rbx,qword ptr [r14+8] ds:00000000`00000008=????????????????
Resetting default scope


LAST_CONTROL_TRANSFER:  from fffff80002ee2769 to fffff80002ee31c0


STACK_TEXT:  
fffff880`035949d8 fffff800`02ee2769 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`035949e0 fffff800`02ee13e0 : fffffa80`0b11ad30 00001f80`00280200 00000000`0003aa97 fffffa80`0b2e09b0 : nt!KiBugCheckDispatch+0x69
fffff880`03594b20 fffff880`01ada5bb : 00000000`0005bb00 00000000`00000000 00000000`00000000 00000000`000000ff : nt!KiPageFault+0x260
fffff880`03594cb0 fffff880`01a08b22 : 00000000`0000000f fffffa80`0e5fecf0 00000000`00000000 fffffa80`078a38e0 : ndis!NdisAllocateCloneNetBufferList+0x1ab
fffff880`03594dc0 fffff880`01a363df : fffffa80`078a38e0 fffffa80`078a38e0 00000000`00000000 00000000`00000000 : NETIO!NetioAllocateAndReferenceCloneNetBufferList+0x32
fffff880`03594df0 fffff880`01a39f40 : 00000000`00000000 00000000`00000000 00000000`000017ac fffffa80`0e5f9810 : NETIO!StreamDataTruncateAfterDataLength+0x4f
fffff880`03594e60 fffff880`01a3b6b4 : fffffa80`078a38e0 00000000`000004bc fffffa80`078a38e0 00000000`000004bc : NETIO!StreamPermitDataHelper+0x40
fffff880`03594e90 fffff800`02eed8ec : fffff880`03565180 fffffa80`0e65fe80 fffffa80`0e65fe80 00000000`00000000 : NETIO!StreamPermitRemoveDataDpc+0x84
fffff880`03594f00 fffff800`02ee6305 : 00000000`00000000 fffffa80`0b115b50 00000000`00000000 fffff880`01a3b630 : nt!KiRetireDpcList+0x1bc
fffff880`03594fb0 fffff800`02ee611c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxRetireDpcList+0x5
fffff880`03b2afc0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue




STACK_COMMAND:  kb


FOLLOWUP_IP: 
NETIO!NetioAllocateAndReferenceCloneNetBufferList+32
fffff880`01a08b22 488bd8          mov     rbx,rax


SYMBOL_STACK_INDEX:  4


SYMBOL_NAME:  NETIO!NetioAllocateAndReferenceCloneNetBufferList+32


FOLLOWUP_NAME:  MachineOwner


MODULE_NAME: NETIO


IMAGE_NAME:  NETIO.SYS


DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79381


FAILURE_BUCKET_ID:  X64_0xD1_NETIO!NetioAllocateAndReferenceCloneNetBufferList+32


BUCKET_ID:  X64_0xD1_NETIO!NetioAllocateAndReferenceCloneNetBufferList+32


Followup: MachineOwner

The DRIVER_IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x000000D1. This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

[h=3]Cause[/h]A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high.
This bug check is usually caused by drivers that have used improper addresses.
If the first parameter has the same value as the fourth parameter, and the third parameter indicates an execute operation, this bug check was likely caused by a driver that was trying to execute code when the code itself was paged out. Possible causes for the page fault include the following:

  • The function was marked as pageable and was running at an elevated IRQL (which includes obtaining a lock).
  • The function call was made to a function in another driver, and that driver was unloaded.
  • The function was called by using a function pointer that was an invalid pointer.

    *************************************************************************************************************

    I see your running Avira. Please un-install and use MSE . I also notice your running security protection from agnitum probably a firewall? Please un-install this as well as it's also known to cause issues. If you like a bit more protection run malwarebytes along side MSE as they do not conflict.

    Microsoft Security Essentials - Free Antivirus for Windows

    Malwarebytes









 
Thank you for the help! :)

I tried to follow the steps i found here:
Find out the cause of a Blue Screen of Death Error (BSOD) - UPDATED Nov 2011 - YouTube
and it kame out that NETIO.SYS was provoking the issue.

Can it be? I Googled it but didnt get anything out from it. Can the blue screens still be imputable to Avira antivirus and Agnitum firewall? I have a USB wireless mouse attached to the PC, could that be to?
I´m not sure, but i think the BSODs comes out when i´m using uTorrent or qBittorrent connected via PPTP to a server
I have Windows Home Premium on an HP pavilion dv7 6b76eo

Thank you again
 

Attachments

  • debuglog.txt
    26.1 KB · Views: 237
Well it's up to you, either follow my advice or don't :). When diagnosing your dmp files nothing lead me to believe it had anything to do with a usb mouse otherwise I'd have stated that fact.

When a Netio.sys bsod occurs it's usually down to a security app.
 
Back
Top