BSOD issues - need help asap pls

simple541

Reputable
Apr 11, 2015
14
0
4,510
Working on a friend's computer, and it has a bsod after loading into Windows. I ran Windows memory test and it came back fine. The pc works ok in safe mode, as it should.. Malwarebytes came back clean. I need some help. What information do you need? Thanks everyone






Dump File : 041115-18267-01.dmp
Crash Time : 4/11/2015 7:43:11 PM
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x0000000a
Parameter 1 : 00000000`00000000
Parameter 2 : 00000000`00000002
Parameter 3 : 00000000`00000001
Parameter 4 : fffff800`0308ac3f
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+75bc0
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7601.18409 (win7sp1_gdr.140303-2144)
Processor : x64
Crash Address : ntoskrnl.exe+75bc0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\041115-18267-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 7601
Dump File Size : 285,717
==================================================

==================================================
Dump File : 041115-27003-01.dmp
Crash Time : 4/11/2015 11:27:40 AM
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x0000000a
Parameter 1 : 00000000`00000000
Parameter 2 : 00000000`00000002
Parameter 3 : 00000000`00000001
Parameter 4 : fffff800`030e0c3f
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+75bc0
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7601.18409 (win7sp1_gdr.140303-2144)
Processor : x64
Crash Address : ntoskrnl.exe+75bc0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\041115-27003-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 7601
Dump File Size : 270,829
==================================================

==================================================
Dump File : 041115-25880-01.dmp
Crash Time : 4/11/2015 10:18:08 AM
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x0000000a
Parameter 1 : 00000000`00000000
Parameter 2 : 00000000`00000002
Parameter 3 : 00000000`00000001
Parameter 4 : fffff800`03096c3f
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+75bc0
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7601.18409 (win7sp1_gdr.140303-2144)
Processor : x64
Crash Address : ntoskrnl.exe+75bc0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\041115-25880-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 7601
Dump File Size : 285,845
==================================================

==================================================
Dump File : 041015-18236-01.dmp
Crash Time : 4/10/2015 8:40:13 PM
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x0000000a
Parameter 1 : 00000000`00000000
Parameter 2 : 00000000`00000002
Parameter 3 : 00000000`00000001
Parameter 4 : fffff800`02e98c3f
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+75bc0
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7601.18409 (win7sp1_gdr.140303-2144)
Processor : x64
Crash Address : ntoskrnl.exe+75bc0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\041015-18236-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 7601
Dump File Size : 285,781
==================================================

==================================================
Dump File : 041015-22074-01.dmp
Crash Time : 4/10/2015 6:00:08 PM
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x0000000a
Parameter 1 : 00000000`00000000
Parameter 2 : 00000000`00000002
Parameter 3 : 00000000`00000001
Parameter 4 : fffff800`02eccc3f
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+75bc0
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7601.18409 (win7sp1_gdr.140303-2144)
Processor : x64
Crash Address : ntoskrnl.exe+75bc0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\041015-22074-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 7601
Dump File Size : 285,653
==================================================

==================================================
Dump File : 041015-27315-02.dmp
Crash Time : 4/10/2015 5:46:06 PM
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x0000000a
Parameter 1 : 00000000`00000000
Parameter 2 : 00000000`00000002
Parameter 3 : 00000000`00000001
Parameter 4 : fffff800`02eccc3f
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+75bc0
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7601.18409 (win7sp1_gdr.140303-2144)
Processor : x64
Crash Address : ntoskrnl.exe+75bc0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\041015-27315-02.dmp
Processors Count : 4
Major Version : 15
Minor Version : 7601
Dump File Size : 285,589
==================================================

==================================================
Dump File : 041015-27315-01.dmp
Crash Time : 4/10/2015 5:02:51 PM
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x0000000a
Parameter 1 : 00000000`00000000
Parameter 2 : 00000000`00000002
Parameter 3 : 00000000`00000001
Parameter 4 : fffff800`02e9ac3f
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+75bc0
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7601.18409 (win7sp1_gdr.140303-2144)
Processor : x64
Crash Address : ntoskrnl.exe+75bc0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\041015-27315-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 7601
Dump File Size : 285,589





 

simple541

Reputable
Apr 11, 2015
14
0
4,510
here is what i found using windbg - unsure of what i am reading thoufh




Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [G:\041115-27003-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`03062000 PsLoadedModuleList = 0xfffff800`032a5890
Debug session time: Sat Apr 11 11:26:43.804 2015 (UTC - 7:00)
System Uptime: 0 days 0:19:03.115
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 1, fffff800030e0c3f}

Unable to load image SYMNETS.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SYMNETS.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
Probably caused by : NETIO.SYS ( NETIO!WfpExpireEntryLru+17 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800030e0c3f, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff8000330f100
0000000000000000

CURRENT_IRQL: 2

FAULTING_IP:
nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+4f
fffff800`030e0c3f 488713 xchg rdx,qword ptr [rbx]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

TRAP_FRAME: fffff880033cb370 -- (.trap 0xfffff880033cb370)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800670eb50 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff880033cb570 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030e0c3f rsp=fffff880033cb500 rbp=0000000000000004
r8=fffff880033cb570 r9=fffff8800198aca0 r10=0000000000000000
r11=0000000000000040 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x4f:
fffff800`030e0c3f 488713 xchg rdx,qword ptr [rbx] ds:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800030d7169 to fffff800030d7bc0

STACK_TEXT:
fffff880`033cb228 fffff800`030d7169 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`033cb230 fffff800`030d5de0 : 00000000`00000010 fffff880`033cb560 00000000`00000003 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`033cb370 fffff800`030e0c3f : 00000000`00000003 00000000`00000001 00000000`00000003 00000000`00000001 : nt!KiPageFault+0x260
fffff880`033cb500 fffff880`017719c7 : 00000000`00000004 fffff880`033cb7e0 00000000`00008900 fffffa80`076d07c8 : nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x4f
fffff880`033cb550 fffff880`018e608d : fffffa80`074315f0 fffffa80`0a29c1e0 fffff880`033cb7e0 00000000`00008900 : NETIO!WfpExpireEntryLru+0x17
fffff880`033cb5a0 fffff880`018ad7b7 : 00000000`00000004 fffff880`00000030 fffffa80`0aaa4520 00000000`00000001 : tcpip!WfpAleCloseRemoteEndpointConnection+0x2d
fffff880`033cb5d0 fffff880`01925e5b : fffffa80`074315f0 fffffa80`0a1cd8ea 00000000`00000001 fffffa80`074315f0 : tcpip! ?? ::FNODOBFM::`string'+0x20f72
fffff880`033cb720 fffff880`019261e2 : 00000089`00000000 fffffa80`0a1cd820 fffffa80`07629b30 00000000`00000001 : tcpip!WfpAleHandleSendCompletion+0xeb
fffff880`033cb840 fffff880`019306b2 : 00000000`00000000 00000000`00000001 00000000`00000000 fffffa80`080f87a8 : tcpip!WfpAlepAuthorizeSendCompletion+0x32
fffff880`033cb890 fffff880`01605af2 : fffffa80`00000089 fffff800`00000089 fffffa80`0a770f50 00000000`00000001 : tcpip!WfpAleCompleteOperation+0x162
fffff880`033cb930 fffff880`0441e7bb : 00000000`00000000 00000000`00000000 fffffa80`076ecf70 00000000`00000030 : fwpkclnt!FwpsCompleteOperation0+0x1e
fffff880`033cb960 00000000`00000000 : 00000000`00000000 fffffa80`076ecf70 00000000`00000030 00000000`00000089 : SYMNETS+0x1e7bb


STACK_COMMAND: kb

FOLLOWUP_IP:
NETIO!WfpExpireEntryLru+17
fffff880`017719c7 488b4310 mov rax,qword ptr [rbx+10h]

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: NETIO!WfpExpireEntryLru+17

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME: NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 5294760d

FAILURE_BUCKET_ID: X64_0xA_NETIO!WfpExpireEntryLru+17

BUCKET_ID: X64_0xA_NETIO!WfpExpireEntryLru+17

Followup: MachineOwner
---------

1: kd> lmvm NETIO
start end module name
fffff880`01746000 fffff880`017a6000 NETIO (pdb symbols) C:\Program Files\Debugging Tools for Windows (x64)\sym\netio.pdb\1A3624EA66AA400882BAF5885EE923E52\netio.pdb
Loaded symbol image file: NETIO.SYS
Mapped memory image file: C:\Program Files\Debugging Tools for Windows (x64)\sym\NETIO.SYS\5294760D60000\NETIO.SYS
Image path: NETIO.SYS
Image name: NETIO.SYS
Timestamp: Tue Nov 26 02:21:01 2013 (5294760D)
CheckSum: 0006433E
ImageSize: 00060000
File version: 6.1.7601.18327
Product version: 6.1.7601.18327
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.6 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: netio.sys
OriginalFilename: netio.sys
ProductVersion: 6.1.7601.18327
FileVersion: 6.1.7601.18327 (win7sp1_gdr.131125-2337)
FileDescription: Network I/O Subsystem
LegalCopyright: © Microsoft Corporation. All rights reserved.
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800030e0c3f, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 0000000000000000

CURRENT_IRQL: 2

FAULTING_IP:
nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+4f
fffff800`030e0c3f 488713 xchg rdx,qword ptr [rbx]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

TRAP_FRAME: fffff880033cb370 -- (.trap 0xfffff880033cb370)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800670eb50 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff880033cb570 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030e0c3f rsp=fffff880033cb500 rbp=0000000000000004
r8=fffff880033cb570 r9=fffff8800198aca0 r10=0000000000000000
r11=0000000000000040 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x4f:
fffff800`030e0c3f 488713 xchg rdx,qword ptr [rbx] ds:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800030d7169 to fffff800030d7bc0

STACK_TEXT:
fffff880`033cb228 fffff800`030d7169 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`033cb230 fffff800`030d5de0 : 00000000`00000010 fffff880`033cb560 00000000`00000003 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`033cb370 fffff800`030e0c3f : 00000000`00000003 00000000`00000001 00000000`00000003 00000000`00000001 : nt!KiPageFault+0x260
fffff880`033cb500 fffff880`017719c7 : 00000000`00000004 fffff880`033cb7e0 00000000`00008900 fffffa80`076d07c8 : nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x4f
fffff880`033cb550 fffff880`018e608d : fffffa80`074315f0 fffffa80`0a29c1e0 fffff880`033cb7e0 00000000`00008900 : NETIO!WfpExpireEntryLru+0x17
fffff880`033cb5a0 fffff880`018ad7b7 : 00000000`00000004 fffff880`00000030 fffffa80`0aaa4520 00000000`00000001 : tcpip!WfpAleCloseRemoteEndpointConnection+0x2d
fffff880`033cb5d0 fffff880`01925e5b : fffffa80`074315f0 fffffa80`0a1cd8ea 00000000`00000001 fffffa80`074315f0 : tcpip! ?? ::FNODOBFM::`string'+0x20f72
fffff880`033cb720 fffff880`019261e2 : 00000089`00000000 fffffa80`0a1cd820 fffffa80`07629b30 00000000`00000001 : tcpip!WfpAleHandleSendCompletion+0xeb
fffff880`033cb840 fffff880`019306b2 : 00000000`00000000 00000000`00000001 00000000`00000000 fffffa80`080f87a8 : tcpip!WfpAlepAuthorizeSendCompletion+0x32
fffff880`033cb890 fffff880`01605af2 : fffffa80`00000089 fffff800`00000089 fffffa80`0a770f50 00000000`00000001 : tcpip!WfpAleCompleteOperation+0x162
fffff880`033cb930 fffff880`0441e7bb : 00000000`00000000 00000000`00000000 fffffa80`076ecf70 00000000`00000030 : fwpkclnt!FwpsCompleteOperation0+0x1e
fffff880`033cb960 00000000`00000000 : 00000000`00000000 fffffa80`076ecf70 00000000`00000030 00000000`00000089 : SYMNETS+0x1e7bb


STACK_COMMAND: kb

FOLLOWUP_IP:
NETIO!WfpExpireEntryLru+17
fffff880`017719c7 488b4310 mov rax,qword ptr [rbx+10h]

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: NETIO!WfpExpireEntryLru+17

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME: NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 5294760d

FAILURE_BUCKET_ID: X64_0xA_NETIO!WfpExpireEntryLru+17

BUCKET_ID: X64_0xA_NETIO!WfpExpireEntryLru+17

Followup: MachineOwner
---------

 

simple541

Reputable
Apr 11, 2015
14
0
4,510
okay, so I see this :

BugCheck A, {0, 2, 1, fffff800030e0c3f}

Unable to load image SYMNETS.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SYMNETS.SYS"


this leads me to believe that nortonn may be the issue - removing now in safe mode via revo uninstaller - fingers crossed
 

simple541

Reputable
Apr 11, 2015
14
0
4,510
okay, bsod after reboot. back in safe mode now, running system file checke. r. really could use some help. I have changed settings to get a kernal dump vs a mini dump, and after sfc is done - will reboot and if bsod occurs, will have kernal dump to attempt and debug