BSOD with uTorrent, ntoskrnl.exe

Martyrize · Oct 1, 2014

Well, few days ago I noticed that I got some wifi issues so I download some network drivers.. Im using a external card tho, sooo I got my problems solved but then.. When I started uTorrent days later appears the BSOD.
I used the BlueScreen viewer and it says its because ntoskrnl.exe, but I dont have any idea what to do.
Also, in the BSOD appears this: Driver irql not less or equal (netio.sys)

I use Windows 8 Pro x64 in a HP Pavillion, and heres the dmp file.

Thanks in advance

Martyrize · Oct 2, 2014

Can someone help me? please..

Martyrize · Oct 2, 2014

HELLO? Can anyone help me¿

Martyrize · Oct 4, 2014

Ok, this forum sucks

blueelvis · Oct 5, 2014

Hi Martyrize & Welcome to the forums ^_^,

I am extremely sorry for the delay caused in responding to you. It is not that we are ignoring you but there are not many people who do BSOD Analysis. I just returned today as I was out of town for few days and Usasma is very busy with the launch of Windows 10 and add to the fact that he is also having issues with his system. I once again deeply apologize for the delay caused.

I have analysed your dump files and below has been provided an analysis of the dump file for informative purposes :-

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {28, 2, 0, fffff8800196ffd2}
Probably caused by : NETIO.SYS ( NETIO!RtlCopyBufferToMdl+22 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8800196ffd2, address which referenced memory
Debugging Details:
------------------

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80197970168
GetUlongFromAddress: unable to read from fffff801979701f8
 0000000000000028 Nonpaged pool
CURRENT_IRQL:  2
FAULTING_IP: 
NETIO!RtlCopyBufferToMdl+22
fffff880`0196ffd2 8b5228          mov     edx,dword ptr [rdx+28h]
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
BUGCHECK_STR:  AV
PROCESS_NAME:  System
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
TRAP_FRAME:  fffff88033416760 -- (.trap 0xfffff88033416760)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000100000000 rbx=0000000000000000 rcx=fffffa800abf4110
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800196ffd2 rsp=fffff880334168f0 rbp=fffff88033416a10
 r8=00000000ffffffbc  r9=0000000000000044 r10=0000000000000000
r11=fffff88033416920 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
NETIO!RtlCopyBufferToMdl+0x22:
fffff880`0196ffd2 8b5228          mov     edx,dword ptr [rdx+28h] ds:00000000`00000028=????????
Resetting default scope
LAST_CONTROL_TRANSFER:  from fffff80197671869 to fffff80197672540
STACK_TEXT:  
fffff880`33416618 fffff801`97671869 : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`33416620 fffff801`976700e0 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`33416760 : nt!KiBugCheckDispatch+0x69
fffff880`33416760 fffff880`0196ffd2 : fffffa80`0842c090 fffff880`01aee36e fffffa80`07dd9d00 fffffa80`07dd9dc0 : nt!KiPageFault+0x260
fffff880`334168f0 fffff880`01ac8406 : fffffa80`06a40f30 00000000`7f6e6ef2 fffffa80`0c885480 fffff880`33416c70 : NETIO!RtlCopyBufferToMdl+0x22
fffff880`33416950 fffff880`01ac2626 : 00000000`00000000 00000000`00000000 fffff880`33416a38 fffff880`7f6e6ef2 : tcpip!TcpTcbReassemblyRetrieveSegments+0x1d6
fffff880`334169c0 fffff880`01aed934 : 00000000`00000000 fffff880`0a03e3e8 00000000`00000000 00000000`00000000 : tcpip!TcpTcbCarefulDatagram+0x726
fffff880`33416bf0 fffff880`01aec750 : fffff880`33417168 fffff880`33417158 fffff880`3300ff00 00000000`00000000 : tcpip!TcpTcbReceive+0x474
fffff880`33416d50 fffff880`01aede41 : fffffa80`0e0ec202 fffffa80`0842d000 00000000`00000000 fffffa80`0842d000 : tcpip!TcpMatchReceive+0x1f0
fffff880`33416ec0 fffff880`01affd43 : fffffa80`0810cd80 00000000`000072b2 fffffa80`084219c0 fffffa80`0810cd80 : tcpip!TcpPreValidatedReceive+0x381
fffff880`33416fa0 fffff880`01b00058 : fffff880`334171c9 00000000`00000000 00000000`00000000 fffffa80`0a7ffc30 : tcpip!IppDeliverListToProtocol+0x93
fffff880`33417050 fffff880`01b040eb : fffff880`01c17f30 00000000`00000001 00000000`00000000 fffff880`33417168 : tcpip!IppProcessDeliverList+0x68
fffff880`33417100 fffff880`01b01b31 : fffffa80`07f25610 fffff880`33417330 00000000`00000000 00000000`00000000 : tcpip!IppReceiveHeaderBatch+0x21b
fffff880`33417230 fffff880`01b03473 : fffffa80`08b9daa0 00000000`00000000 00000000`00000000 fffff880`01c12b00 : tcpip!IpFlcReceivePackets+0x641
fffff880`33417460 fffff880`01b0e04d : 00000000`00000000 00000000`00000000 fffff880`01b01400 00000000`00000000 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2ce
fffff880`33417530 fffff801`976c7ae6 : fffffa80`0b81ab70 fffffa80`0b81ab70 00000000`00000000 00000000`00000002 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x12c
fffff880`33417630 fffff801`976ca545 : fffff880`01b0df20 fffff880`334177a0 00000000`00000000 fffffa80`0ae6ca10 : nt!KeExpandKernelStackAndCalloutInternal+0xe6
fffff880`33417730 fffff880`01b0e12e : fffff880`08097170 fffffa80`0b81ab70 00000000`00000000 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0x25
fffff880`33417770 fffff880`0185ab06 : 00000000`00000000 fffffa80`06f17210 fffffa80`08026010 00000000`00000801 : tcpip!FlReceiveNetBufferListChain+0xae
fffff880`334177f0 fffff880`0185a16d : 00000000`00000702 fffffa80`06f10000 fffffa80`09401d40 00000000`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0x126
fffff880`334178a0 fffff880`0185a843 : 00000000`00000020 00000000`00000100 00000000`00000001 fffff801`976b5970 : ndis!ndisInvokeNextReceiveHandler+0x25d
fffff880`33417970 fffff880`07e7dcec : fffff880`07e8f800 00000000`00000001 00000000`00000000 fffff880`07e7a0d0 : ndis!NdisMIndicateReceiveNetBufferLists+0xd3
fffff880`33417a20 fffff880`07e7a0ee : fffff880`07e8f858 fffff880`07e7a0d0 fffff801`9789e080 fffffa80`080db8c0 : tunnel!TeredoWfpIndicationWorker+0x70
fffff880`33417a60 fffff801`976c0cd7 : fffffa80`097674b0 fffff880`07e7a0d0 fffff880`01ab20c8 fffff8a0`26fbb010 : tunnel!LwWorker+0x1e
fffff880`33417a90 fffff801`976b0411 : fffff801`9789e190 fffffa80`09e30640 fffff801`976c0c78 fffff801`9767bd00 : nt!IopProcessWorkItem+0x5f
fffff880`33417b00 fffff801`97645075 : ffffa357`97c46ba6 00000000`00000080 fffff801`976b02d0 fffffa80`09e30640 : nt!ExpWorkerThread+0x142
fffff880`33417b90 fffff801`976f93b6 : fffff880`0128a180 fffffa80`09e30640 fffff880`01295e40 fffffa80`069fe940 : nt!PspSystemThreadStartup+0x59
fffff880`33417be0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

STACK_COMMAND:  kb
FOLLOWUP_IP: 
NETIO!RtlCopyBufferToMdl+22
fffff880`0196ffd2 8b5228          mov     edx,dword ptr [rdx+28h]
SYMBOL_STACK_INDEX:  3
SYMBOL_NAME:  NETIO!RtlCopyBufferToMdl+22
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: NETIO
IMAGE_NAME:  NETIO.SYS
DEBUG_FLR_IMAGE_TIMESTAMP:  50765624
IMAGE_VERSION:  6.2.9200.16433
BUCKET_ID_FUNC_OFFSET:  22
FAILURE_BUCKET_ID:  AV_NETIO!RtlCopyBufferToMdl
BUCKET_ID:  AV_NETIO!RtlCopyBufferToMdl
ANALYSIS_SOURCE:  KM
FAILURE_ID_HASH_STRING:  km:av_netio!rtlcopybuffertomdl
FAILURE_ID_HASH:  {d1f0b36b-846d-6c9d-08f6-8457013ed970}
Followup: MachineOwner
---------

As we can see from the Dump files, that the driver blamed for the BSOD is the NETIO.sys which is the driver which handles the Network in Windows. Now, since it is a Windows component, chance of it being corrupt is extremely less which means that some other component drove it to fault which deals with Networking.
Below is a list of 3rd party drivers present on the system :-

Code:

**************************Wed Oct  1 05:55:53.534 2014 (UTC + 5:30)**************************
CLVirtualDrive.sys           Mon Dec 26 18:56:47 2011 (4EF87617)
vmci.sys                     Tue May  1 06:44:27 2012 (4F9F38F3)
GEARAspiWDM.sys              Fri May  4 01:26:17 2012 (4FA2E2E1)
BtAudioBus.sys               Fri Jun 15 08:47:09 2012 (4FDAA935)
VMNET.SYS                    Sun Jul  8 13:28:34 2012 (4FF93DAA)
vmnetbridge.sys              Sun Jul  8 13:29:19 2012 (4FF93DD7)
stwrt64.sys                  Mon Aug 20 08:21:39 2012 (5031A63B)
vsock.sys                    Wed Aug 22 02:40:15 2012 (5033F937)
AtihdW86.sys                 Wed Aug 22 07:56:37 2012 (5034435D)
usbfilter.sys                Wed Aug 29 06:57:12 2012 (503D6FF0)
[B][U]WirelessButtonDriver64.sys   Thu Aug 30 08:41:29 2012 (503ED9E1)
[/U][/B]amdkmpfd.sys                 Fri Sep 14 04:32:55 2012 (5052661F)
atikmpag.sys                 Tue Sep 18 11:42:40 2012 (505810D8)
atikmdag.sys                 Tue Sep 18 12:48:26 2012 (50582042)
hpdskflt.sys                 Mon Sep 24 21:01:14 2012 (50607CC2)
Accelerometer.sys            Mon Sep 24 21:01:45 2012 (50607CE1)
hcmon.sys                    Fri Oct 12 05:45:27 2012 (5077611F)
[B][U]RimSerial_AMD64.sys          Tue Oct 23 02:21:51 2012 (5085B1E7)
[/U][/B]vmnetuserif.sys              Tue Feb 26 14:26:15 2013 (512C78AF)
VMkbd.sys                    Tue Feb 26 14:58:37 2013 (512C8045)
vmx86.sys                    Tue Feb 26 15:48:21 2013 (512C8BED)
SynTP.sys                    Wed Apr 24 06:04:23 2013 (5177288F)
dtsoftbus01.sys              Tue Jun 11 13:25:52 2013 (51B6D808)
netr28ux.sys                 Fri Sep  6 18:17:06 2013 (5229CECA)
mbam.sys                     Wed Oct 30 21:41:45 2013 (52712FC1)
VBoxUSBMon.sys               Wed Dec 18 21:43:29 2013 (52B1C9A9)
VBoxNetFlt.sys               Wed Dec 18 21:43:29 2013 (52B1C9A9)
VBoxDrv.sys                  Wed Dec 18 21:49:08 2013 (52B1CAFC)
RtsP2Stor.sys                Fri Jan  3 13:36:41 2014 (52C66F91)
amd_sata.sys                 Wed Jan 22 12:40:49 2014 (52DF6EF9)
amd_xata.sys                 Wed Jan 22 12:40:52 2014 (52DF6EFC)
rtbth.sys                    Mon Apr 28 11:03:01 2014 (535DE80D)

Martyrize · Oct 5, 2014

Wow thx

Problem solved since I disabled the Blackberry Software!
Np mate, I understand you got a lot of work here! Thanks again, and have a nice day

blueelvis · Oct 9, 2014

Martyrize said:
Wow thx Problem solved since I disabled the Blackberry Software!
Np mate, I understand you got a lot of work here! Thanks again, and have a nice day

Glad to hear that the issue has been solved ^_^.

Would you kindly mark this thread as Solved?

BSOD with uTorrent, ntoskrnl.exe

Martyrize

New Member

My Computer

System One

Martyrize

New Member

My Computer

System One

Martyrize

New Member

My Computer

System One

Martyrize

New Member

My Computer

System One

blueelvis

OMG Debugger!

My Computer

System One

Martyrize

New Member

My Computer

System One

blueelvis

OMG Debugger!

My Computer

System One