Re: BSOD Help
Hi,
We have multiple bugchecks throughout the attached DMP files:
IRQL_NOT_LESS_OR_EQUAL (a)
This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
MODULE_NAME:
NETIO
IMAGE_NAME:
NETIO.SYS
^^ NETIO.sys is the Network I/O Subsystem system driver, and is not the true cause. Usually when we have network related crashes like this it's caused by 3rd party antivirus or firewalls causing conflicts.
If we look at the call stack:
Code:
6: kd> kv
Child-SP RetAddr : Args to Child : Call Site
fffff880`035690e8 fffff800`028c4129 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`035690f0 fffff800`028c2da0 : 00000000`00000010 fffff880`03569420 00000000`00000003 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`03569230 fffff800`028cdc3f : 00000000`00000003 00000000`00000002 00000000`00000003 00000000`00000002 : nt!KiPageFault+0x260 (TrapFrame @ fffff880`03569230)
fffff880`035693c0 fffff880`017689a7 : fffffa80`0f72f080 fffff880`035696a0 00000000`00008900 fffff880`0164b43e : nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x4f
fffff880`03569410 fffff880`018e5ffd : fffffa80`0f2e0010 00000000`00000002 fffffa80`0f31f580 fffff880`035696a0 : NETIO!WfpExpireEntryLru+0x17
fffff880`03569460 fffff880`018ab347 : 00000000`00000004 00000000`00000030 00000000`00000000 fffff800`00000001 : tcpip!WfpAleCloseRemoteEndpointConnection+0x2d
fffff880`03569490 fffff880`01925dcb : fffffa80`0f2e0010 fffffa80`0f87953a 00000000`00000001 fffffa80`0f2e0010 : tcpip! ?? ::FNODOBFM::`string'+0x21f02
fffff880`035695e0 fffff880`01926152 : fffff880`03302180 fffffa80`0f879470 fffffa80`0e4c6bf0 00000000`00000001 : tcpip!WfpAleHandleSendCompletion+0xeb
fffff880`03569700 fffff880`01930622 : 00000000`00000000 00000000`00000001 00000000`00000000 fffffa80`0e0306f8 : tcpip!WfpAlepAuthorizeSendCompletion+0x32
fffff880`03569750 fffff880`01605af2 : 00000000`00000089 00000000`00000089 fffffa80`0e7b2a40 00000000`00000001 : tcpip!WfpAleCompleteOperation+0x162
fffff880`035697f0 fffff880`03f6d29b : 00000000`00000000 00000000`00000000 fffffa80`0e6c2a70 00000000`00000030 : fwpkclnt!FwpsCompleteOperation0+0x1e
fffff880`03569820 00000000`00000000 : 00000000`00000000 fffffa80`0e6c2a70 00000000`00000030 00000000`00000089 : [COLOR=Red][U][I][B]SYMNETS[/B][/I][/U][/COLOR]+0x1e29b
We can see a SYMNETS.sys call.
Unable to load image \SystemRoot\system32\drivers\N360x64\1500020.001\
SYMNETS.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for
SYMNETS.SYS
*** ERROR: Module load completed but symbols could not be loaded for
SYMNETS.SYS
^^
SYMNETS.sys is the Symantec/ Norton NIS/ N360 driver.
KMODE_EXCEPTION_NOT_HANDLED (1e)
This indicates that a kernel-mode program generated an exception which the error handler did not catch.
BugCheck 1E, {
ffffffffc0000005, fffff80002f9c7ae, 1, f}
^^ The 1st parameter is 0xc0000005 which indicates an access violation.
PROCESS_NAME: N360.exe
^^ Process name at the time of the crash was Norton 360.
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high. This bug check is usually caused by drivers that have used improper addresses.
MODULE_NAME:
ndis
IMAGE_NAME:
ndis.sys
^^ Microsoft Windows NDIS Network system driver.
--------------------------------------------------
Remove and replace Norton with Microsoft Security Essentials for temporary troubleshooting purposes:
Norton removal tool - https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us;jsessionid=841A6D40BA6872C47697C6C6B19C8E11.4?entsrc=redirect_pubweb&pvid=f-home
MSE - Microsoft Security Essentials - Microsoft Windows
Regards,
Patrick