BSOD for NETIO.SYS

Question

Occasionally I get this BSOD for NETIO.sys.

Can anyone help me analyze the cause? The link to the dump file can be found @

https://onedrive.live.com/redir?resid=4FA9C5F51F8E5539!3051&authkey=!AMovNAjJq0rJ1Y4&ithint=file%2cTXT

Thank you.

Answer 1

If it still happens after the removal of Conncetify, another software is causing it. We'll see.

Regards,

Patrick

Answer 2

Ok. I'll uninstall Connectify but as I recall, I had this issue before installing Connectify. Anyways, I'll monitor for now and get back if the problem still persists.

Thanks again Patrick!

Answer 3

Thanks.

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

0: kd> .trap 0xffffd001a992cee0

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=0000000000002000 rbx=0000000000000000 rcx=fffff80171266b80

rdx=0000000000002006 rsi=0000000000000000 rdi=0000000000000000

rip=fffff80171213089 rsp=ffffd001a992d070 rbp=ffffe001276a2010

 r8=0000000000010cfa  r9=0000000000000000 r10=000000000000011a

r11=0000000000001001 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0         nv up ei pl nz na po nc

NETIO!StreamInvokeCalloutAndNormalizeAction+0x209:

fffff80171213089 4183795003      **cmp** dword ptr [**r9+50h**],**3** ds:0000000000000050=????????

Comparing 3 with r9+50. r9's contents were likely invalid, but we cannot check it due to being a volatile register.

0: kd> k

Child-SP          RetAddr           Call Site

ffffd001a992d070 fffff8017121298f NETIO!StreamInvokeCalloutAndNormalizeAction+0x209

ffffd001a992d140 fffff8017121d0c2 NETIO!StreamProcessCallout+0x76f

ffffd001a992d280 fffff80171203569 NETIO!ProcessCallout+0x972

ffffd001a992d3f0 fffff80171202270 NETIO!ArbitrateAndEnforce+0x2c9

ffffd001a992d5f0 fffff80171211710 NETIO!KfdClassify+0x831

ffffd001a992dab0 fffff80171211c3d NETIO!StreamClassify+0x220

ffffd001a992dc40 fffff8017121207e NETIO!StreamCommonInspect+0x25d

ffffd001a992dfe0 fffff801717302bc NETIO!WfpStreamInspectSend+0x27e

ffffd001a992e070 fffff80171730538 tcpip!TcpEnqueueTcbSend+0x4ec

ffffd001a992e170 fffff801a4ac2283 tcpip!TcpTlConnectionSendCalloutRoutine+0x28

ffffd001a992e1f0 fffff801717307f6 nt!KeExpandKernelStackAndCalloutInternal+0xf3

ffffd001a992e2e0 fffff80172296b97 tcpip!TcpTlConnectionSend+0x76

ffffd001a992e350 fffff8017227b450 afd!AfdFastConnectionSend+0x387

ffffd001a992e510 fffff801a4e62cec afd!AfdFastIoDeviceControl+0x440

ffffd001a992e880 fffff801a4e6278e nt!IopXxxControlFile+0x54c

ffffd001a992ea20 fffff801a4bde2b3 nt!NtDeviceIoControlFile+0x56

ffffd001a992ea90 0000000077c42352 nt!KiSystemServiceCopyEnd+0x13

00000000028befa8 0000000000000000 0x77c42352

Regardless, given the TCP/IP and Network I/O Subsystem calls, this is being caused by a 3rd party network software conflict.

---------------------------

Uninstall Connectify ASAP. Terribly buggy software that's likely causing the crashes.

Regards,

Patrick

Answer 4

Hi Patrick,

Thank you for your response. Here are the dump files as requested:

https://onedrive.live.com/redir?resid=4FA9C5F51F8E5539!3053&authkey=!AP3GPhFfvHuZXLg&ithint=file%2crar

https://onedrive.live.com/redir?resid=4FA9C5F51F8E5539!3054&authkey=!ANAyetcENebLIoc&ithint=file%2crar

Answer 5

Hi,

In order to assist you, we will need the .DMP files to analyze what exactly occurred at the time of the crash, etc.

If you don't know where .DMP files are located, here's how to get to them:

1. Navigate to the %systemroot%\Minidump folder.

-- %systemroot% is the environment variable for your Windows directory. For example, C:\Windows.

2. Copy any and all .DMP files in the Minidump folder to your Desktop, create a new folder on the Desktop to put these .DMP files in, and then zip the folder. You can then either use a 3rd party tool such as 7-Zip/Winrar, or you can use Windows' default method of zipping folders.

Compress and uncompress files (zip files).

Please note that any "cleaner" programs such as TuneUpUtilities, CCleaner, etc, by default will delete .DMP files upon use. With this said, if you've run such software, and your Minidump folder is empty, you will need to allow the system to crash once again to generate a crash dump.

3. Upload the .ZIP containing the .DMP files to Onedrive or a hosting site of your choice and paste in your reply.

Preferred sites: Onedrive, Mediafire, Dropbox, etc. Nothing with wait-timers, download managers, etc.

4 (optional): The type of .DMP files located in the Minidump folder are known as Small Memory Dumps. In %systemroot% there will be what is known as a Kernel Memory Dump (if your system is set to generate). It is labeled MEMORY.DMP. The difference between Small Memory Dumps and Kernel Memory Dumps in the simplest definition is a Kernel Memory Dump contains much more information at the time of the crash, therefore allowing further debugging of your issue. If your upload speed permits it, and you aren't going against any strict bandwidth and/or usage caps, etc, the Kernel Memory Dump is the best choice. Do note that Kernel Memory Dumps are much largerin size due to containing much more info, which is why I mentioned upload speed, etc.

If you are going to use Onedrive but don't know how to upload to it, please visit the following:

Upload photos and files to Onedrive.

After doing that, to learn how to share the link to the file if you are unaware, please visit the following link - Share files and folders and change permissions and view 'Get a link'.

If your computer is not generating .DMP files, please do the following:

1. Start > type %systemroot% which should show the Windows folder, click on it. Once inside that folder, ensure there is a Minidump folder created. If not, CTRL-SHIFT-N to make a New Folder and name it Minidump.

2. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Performance > Settings > Advanced > Ensure there's a check-mark for 'Automatically manage paging file size for all drives'.

3. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Startup and Recovery > Settings > System Failure > ensure there is a check mark next to 'Write an event to the system log'.

Ensure Small Memory Dump is selected and ensure the path is %systemroot%\Minidump.

4. Double check that the WERS is ENABLED:

Start > Search > type services.msc > Under the name tab, find Windows Error Reporting Service > If the status of the service is not Started then right click it and select Start. Also ensure that under Startup Type it is set to Automatic rather than Manual. You can do this by right clicking it, selecting properties, and under General selecting startup type to 'Automatic', and then click Apply.

If you cannot get into normal mode to do any of this, please do this via Safe Mode.

Regards,

Patrick