Tech Support banner

Status
Not open for further replies.
21 - 29 of 29 Posts

·
Registered
Joined
·
16 Posts
Discussion Starter #21 (Edited)
Re: Random BSOD + Freezes - NETIO.sys cause?

The notebook still crashed without the Ex HD plugged in.

Iv ran seatools a few times over the past few days and let it run thru the night. And a few of the times iv came back in the morning to find that a BSOD had occurred. BUT it was stuck on the blue screen with the bottom message saying 'initializing disk for crash dump...' and nothing happening. So no mini dump gets created... (I currently have left the latest BSOD screen up for the past 13 hours hoping that it might actually write a.dmp file)
I can't upload the jpg from my phone. So I'll do it when I get home next.

That said, I AM planning to take it in to the asus centre in Melbourne Australia hopefully during the week (I'm in the process of recovering my receipt from my accountant).

Kris
 

·
Registered
Joined
·
16 Posts
Discussion Starter #22
Re: Random BSOD + Freezes - NETIO.sys cause?

As per previous post, 2x .jpg's of BSOD screen's that failed to initialize disk for crash dump & ultimately failed to create a minidump.
 

Attachments

·
Administrator, Manager, Microsoft Support, Acting
Joined
·
34,376 Posts
Re: Random BSOD + Freezes - NETIO.sys cause?

Hi -

The bugchecks on the 2 BSODs -

0xa = driver referenced invalid or bad memory

0xc4 = Driver Verifier, yet no 3rd party driver name appears on the screen

See if there are new dumps in \windows\minidump

If so, re-run the jcgriff2 app - BSOD Posting Instructions - NT6x

Regards. . .

jcgriff2

`
 

·
Registered
Joined
·
16 Posts
Discussion Starter #24
Re: Random BSOD + Freezes - NETIO.sys cause?

Sorry for not replying in awhile, I had sent my laptop into the Asus service center where they had looked at it for some time.


What they ended up doing,

HDD TEST - PASS
MEMORY TEST - PASS
WINDOWS REIMAGED
BIOS UPDATED
WINDOWS DRIVER & SECURITY UPDATES COMPLETED

which they then left it idol for ~24hours where their was no crash that occurred so they decided that their actions had fixed the problem.

Since then I have had the laptop running for 24 hours in total give or take (at various time - 2 hours here and 8 hours there etc.). I have since encountered three BSOD's.

Using bluescreenview just to have a quick look, it suspects that the causes were
1x - KMODE_EXCEPTION_NOT_HANDLED - athrx.sys+31023
2x - SYSTEM_SERVICE_EXCEPTION - ntoskrnl.exe+7cc40

All three happened whilst on charge & plugged into the tv via hdmi.
One ntoskrnl happened whilst putting the laptop to sleep.
The other two happened whilst watching .mkv files

Since recieving the laptop back from Asus, I have installed (prior to the BSOD's), avast anti virus (free), mozilla firefox, utorrent, a windows media player codec pack.

Ill run jcgriff2 app later on, but for now here is the 3 minidumps.

With regards,
Kristian G
 

Attachments

·
Administrator, Manager, Microsoft Support, Acting
Joined
·
34,376 Posts
Re: Random BSOD + Freezes - NETIO.sys cause?

...Using bluescreenview just to have a quick look, it suspects that the causes were
1x - KMODE_EXCEPTION_NOT_HANDLED - athrx.sys+31023
2x - SYSTEM_SERVICE_EXCEPTION - ntoskrnl.exe+7cc40
Hi Kristian -

ntoskrnl.exe = The Windows NT Kernel; it a default - not a cause

athrx.sys = Atheros wifi driver; yours appears updated to me -
Code:
[FONT=lucida console]athrx.sys       Tue Jun 21 04:03:39 2011 (4E00505B)[/FONT]
http://www.carrona.org/drivers/driver.php?id=athrx.sys

I didn't see athr.sys named in the latest dumps, but did notice references to netio.sys and tcpip.sys - both are Microsoft Windows OS Networking related drivers.

The dumps show loaded drivers for a 2010 version of Trend Micro Internet Security and I suspect it as an underlying cause.

It needs to be removed - http://kb.eset.com/esetkb/index?page=content&id=SOLN146

Reboot upon completion.

See if the BSODs persist.

Regards. . .

jcgriff2


`


BSOD SUMMARY
Code:
[FONT=lucida console]Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\112611-21465-01.dmp][/FONT]
[FONT=lucida console]Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506[/FONT]
[FONT=lucida console]Debug session time: Sat Nov 26 06:15:31.086 2011 (GMT-5)[/FONT]
[FONT=lucida console]System Uptime: 0 days 9:35:12.039[/FONT]
[FONT=lucida console]Probably caused by : tcpip.sys ( tcpip! ?? ::FNODOBFM::`string'+4652b )[/FONT]
[FONT=lucida console]DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT[/FONT]
[FONT=lucida console]BUGCHECK_STR:  0x1E[/FONT]
[FONT=lucida console]PROCESS_NAME:  System[/FONT]
[FONT=lucida console]FAILURE_BUCKET_ID:  X64_0x1E_tcpip!_??_::FNODOBFM::_string_+4652b[/FONT]
[FONT=lucida console]Bugcheck code 0000001E[/FONT]
[FONT=lucida console]Arguments 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000[/FONT]
[FONT=lucida console]BiosVersion = N53Jq.211[/FONT]
[FONT=lucida console]BiosReleaseDate = 01/25/2011[/FONT]
[FONT=lucida console]SystemManufacturer = ASUSTeK Computer Inc.[/FONT]
[FONT=lucida console]SystemProductName = N53Jq[/FONT]
[FONT=lucida console]MaxSpeed:     1730[/FONT]
[FONT=lucida console]CurrentSpeed: 1729[/FONT]
[FONT=lucida console]¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``[/FONT]
[FONT=lucida console]Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\112511-26832-01.dmp][/FONT]
[FONT=lucida console]Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506[/FONT]
[FONT=lucida console]Debug session time: Fri Nov 25 02:48:52.441 2011 (GMT-5)[/FONT]
[FONT=lucida console]System Uptime: 0 days 1:12:48.393[/FONT]
[FONT=lucida console]Probably caused by : ntkrnlmp.exe ( nt!RtlEnumerateEntryHashTable+bf )[/FONT]
[FONT=lucida console]DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT[/FONT]
[FONT=lucida console]BUGCHECK_STR:  0x3B[/FONT]
[FONT=lucida console]PROCESS_NAME:  LMS.exe[/FONT]
[FONT=lucida console]FAILURE_BUCKET_ID:  X64_0x3B_nt!RtlEnumerateEntryHashTable+bf[/FONT]
[FONT=lucida console]Bugcheck code 0000003B[/FONT]
[FONT=lucida console]Arguments 00000000`c0000005 fffff800`030c1c25 fffff880`07818ae0 00000000`00000000[/FONT]
[FONT=lucida console]BiosVersion = N53Jq.211[/FONT]
[FONT=lucida console]BiosReleaseDate = 01/25/2011[/FONT]
[FONT=lucida console]SystemManufacturer = ASUSTeK Computer Inc.[/FONT]
[FONT=lucida console]SystemProductName = N53Jq[/FONT]
[FONT=lucida console]MaxSpeed:     1730[/FONT]
[FONT=lucida console]CurrentSpeed: 1729[/FONT]
[FONT=lucida console]¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``[/FONT]
[FONT=lucida console]Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\112511-34913-01.dmp][/FONT]
[FONT=lucida console]Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506[/FONT]
[FONT=lucida console]Debug session time: Fri Nov 25 01:35:24.698 2011 (GMT-5)[/FONT]
[FONT=lucida console]System Uptime: 3 days 19:52:01.398[/FONT]
[FONT=lucida console]Probably caused by : NETIO.SYS ( NETIO!NsiEnumerateObjectsAllParametersEx+24f )[/FONT]
[FONT=lucida console]DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT[/FONT]
[FONT=lucida console]BUGCHECK_STR:  0xA[/FONT]
[FONT=lucida console]PROCESS_NAME:  LMS.exe[/FONT]
[FONT=lucida console]FAILURE_BUCKET_ID:  X64_0xA_NETIO!NsiEnumerateObjectsAllParametersEx+24f[/FONT]
[FONT=lucida console]Bugcheck code 0000000A[/FONT]
[FONT=lucida console]Arguments 00000000`00000008 00000000`00000002 00000000`00000001 fffff800`030c5c25[/FONT]
[FONT=lucida console]BiosVersion = N53Jq.211[/FONT]
[FONT=lucida console]BiosReleaseDate = 01/25/2011[/FONT]
[FONT=lucida console]SystemManufacturer = ASUSTeK Computer Inc.[/FONT]
[FONT=lucida console]SystemProductName = N53Jq[/FONT]
[FONT=lucida console]MaxSpeed:     1730[/FONT]
[FONT=lucida console]CurrentSpeed: 1729[/FONT]
[FONT=lucida console]¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``[/FONT]
 
 
[FONT=lucida console]by [COLOR=navy]jcgriff2     [/COLOR][/FONT]
 
[FONT=lucida console][COLOR=navy]        J. C. Griffith, Microsoft MVP[/COLOR]   [/FONT]
 
[FONT=lucida console]          [URL="https://mvp.support.microsoft.com/profile/Griffith"][COLOR=#000055][U]https://mvp.support.microsoft.com/profile/Griffith[/U][/COLOR][/URL]   [/FONT]
 
 
[FONT=lucida console]          [URL="http://www.sysnative.com"][COLOR=#000033][U]www.sysnative.com[/U][/COLOR][/URL][/FONT]
 
[FONT=lucida console]          [URL="http://www.jcgriff2.com"][COLOR=#000055][U]www.jcgriff2.com[/U][/COLOR][/URL] [/FONT]
 
 
[FONT=lucida console]¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨[/FONT]
 

·
Registered
Joined
·
16 Posts
Discussion Starter #26
Re: Random BSOD + Freezes - NETIO.sys cause?

I removed trend micro, it crashed twice more whilst transferring ~10GB about halfway through each time. I have returned It back to Asus service centre again and am waiting to hear back.

My apologies for not posting the latest mini dumps. I was just that angry it crashed again that I got in my car and went straight back to asus

I'll let you know how it goes.

Kristian.
 

·
Registered
Joined
·
2,210 Posts
Re: Random BSOD + Freezes - NETIO.sys cause?

I think they're merely dodging the issue. As reported before, this is a hardware problem, through and through, but they're doing whatever they can to skirt the issue and perhaps soak up your money and time. Make sure to be aggressive in enforcing a replacement under the condition the laptop is still under warranty.

As for the latest crashdumps you've provided, I detected an oddity in one of them that appears to be rather hardware related. Unfortunately without a kernel dump I don't have enough information to dive into it and get to the bottom of the cause.


Analysts:

Interesting scenario in crashdump 112511-26832-01.dmp. The following is shown:

Code:
2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800030c1c25, Address of the instruction which caused the bugcheck
Arg3: fffff88007818ae0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!RtlEnumerateEntryHashTable+bf
fffff800`030c1c25 48897908        mov     qword ptr [rcx+8],rdi

CONTEXT:  fffff88007818ae0 -- (.cxr 0xfffff88007818ae0)
rax=fffffa8007c872d1 rbx=fffffa8007c7a088 rcx=d0fffffa8007c872
rdx=fffffa8007c872d0 rsi=fffffa80079c1088 rdi=fffff88007819518
rip=fffff800030c1c25 rsp=fffff880078194c8 rbp=fffffa80079c20d8
 r8=000000000000002c  r9=fffffa8007c872d1 r10=fffffa8007b653a0
r11=0000000000000000 r12=fffffa80079c20d8 r13=fffff88007819738
r14=fffffa80079c1d38 r15=fffffa8007cc6980
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!RtlEnumerateEntryHashTable+0xbf:
fffff800`030c1c25 48897908        mov     qword ptr [rcx+8],rdi ds:002b:d0fffffa`8007c87a=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  LMS.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff800030c1c25

STACK_TEXT:  
fffff880`078194c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!RtlEnumerateEntryHashTable+0xbf


FOLLOWUP_IP: 
nt!RtlEnumerateEntryHashTable+bf
fffff800`030c1c25 48897908        mov     qword ptr [rcx+8],rdi

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!RtlEnumerateEntryHashTable+bf

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

STACK_COMMAND:  .cxr 0xfffff88007818ae0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!RtlEnumerateEntryHashTable+bf

BUCKET_ID:  X64_0x3B_nt!RtlEnumerateEntryHashTable+bf

Followup: MachineOwner
---------

As typical of any approach, first thing to do is to check the bugcheck, then the offending instruction, all of which is present in the !analyze -v output:

Code:
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: [B]00000000c0000005[/B], Exception code that caused the bugcheck
Arg2: fffff800030c1c25, Address of the instruction which caused the bugcheck
Arg3: fffff88007818ae0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.


EXCEPTION_CODE: (NTSTATUS) 0x[B]c0000005[/B] - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.


nt!RtlEnumerateEntryHashTable+0xbf:
fffff800`030c1c25 48897908        mov     qword ptr [rcx+8],rdi ds:002b:[b]d0fffffa`8007c87a[/b]=????????????????
Now to figure out where it got the bad memory address. It was reading from both rdi and rcx registers. Let's check both (again, in the !analyze -v output):

Code:
CONTEXT:  fffff88007818ae0 -- (.cxr 0xfffff88007818ae0)
rax=fffffa8007c872d1 rbx=fffffa8007c7a088 rcx=[B]d0fffffa8007c872[/B]
rdx=fffffa8007c872d0 rsi=fffffa80079c1088 rdi=fffff88007819518
rip=fffff800030c1c25 rsp=fffff880078194c8 rbp=fffffa80079c20d8
 r8=000000000000002c  r9=fffffa8007c872d1 r10=fffffa8007b653a0
r11=0000000000000000 r12=fffffa80079c20d8 r13=fffff88007819738
r14=fffffa80079c1d38 r15=fffffa8007cc6980
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b
So it's the rcx register that has the erroneous memory address. However, look at it. There's something peculiar about it. If you are perceptive, you'll notice that it's actually a legitimate address that had a "d0" value pushed at the front of it (or end, however you look at it). So it looks like whatever tried to save an address in the rcx register was off by 1 byte. Let's see where the value in rcx originated from by doing a disassembly, starting from the faulting instruction and walking back to whenever rcx got filled with a value. You can use the Disassembly window in Windbg and have the offset set to the faulting instruction's address. A snippet of the result:

Code:
...
fffff800`030c1c09 7527            jne     nt!RtlEnumerateEntryHashTable+0xcc (fffff800`030c1c32)
fffff800`030c1c0b 488b5c2408      mov     rbx,qword ptr [rsp+8]
fffff800`030c1c10 44894720        mov     dword ptr [rdi+20h],r8d
fffff800`030c1c14 48895718        mov     qword ptr [rdi+18h],rdx
fffff800`030c1c18 498b09          mov     rcx,qword ptr [r9] [I]< contents of what r9 points too moved into rcx register[/I]
fffff800`030c1c1b 4c894f08        mov     qword ptr [rdi+8],r9
fffff800`030c1c1f 498bc1          mov     rax,r9
fffff800`030c1c22 48890f          mov     qword ptr [rdi],rcx
fffff800`030c1c25 48897908        mov     qword ptr [rcx+8],rdi [I]< faulting instruction[/I]
Most instances having to trace back origins of register contents can be a royal pain, but fortunately for us this one happened soon before the fault, and its interpretation is rather simple: it's using the r9 register as a memory address to point too, and the memory at that address has the contents it needs to shove into the rcx register. So all we need to do is look at whatever that memory address has in it:

Code:
2: kd> dq @r9
fffffa80`07c872d1  ????????`???????? ????????`????????
fffffa80`07c872e1  ????????`???????? ????????`????????
fffffa80`07c872f1  ????????`???????? ????????`????????
fffffa80`07c87301  ????????`???????? ????????`????????
fffffa80`07c87311  ????????`???????? ????????`????????
fffffa80`07c87321  ????????`???????? ????????`????????
fffffa80`07c87331  ????????`???????? ????????`????????
fffffa80`07c87341  ????????`???????? ????????`????????
Interesting, there's nothing here at all. Let's verify if this is valid and available memory:

Code:
2: kd> !pte @r9
                                           VA fffffa8007c872d1
PXE at FFFFF6FB7DBEDFA8    PPE at FFFFF6FB7DBF5000    PDE at FFFFF6FB7EA001F0    PTE at FFFFF6FD4003E438
Unable to get PXE FFFFF6FB7DBEDFA8
This is where our journey ends. Evidently, the minidump (and typically all minidumps) don't save this information. We cannot verify if this really was illegitimate memory it was pointing too, because the minidump does not record this information (and most likely the contents of the memory don't exist either in the memory dump, hence all the question marks). We cannot progress from here. Was worth a try though.
 

·
Registered
Joined
·
16 Posts
Discussion Starter #28
Re: Random BSOD + Freezes - NETIO.sys cause?

Well I have news,

after the second time of sending my laptop to the asus repair center, and waiting another week. I have now received it back with the DC Board & Mainboard. Now im excited that something has been replaced this time, and very hopeful that this has fixed the issue. I plan on using the laptop frequently over the next few days and will let you both know if this has fixed the issue.

On a side note, I would like to thank you both for how helpful you have been over the past weeks/months (it feels like forever), you have been more helpful (to say the least) than both centrecom (the place of purchase) & Asus Service Cntr. And it makes me extremely happy to know that their are people out their that are willing to take time out of their day to help complete strangers!

I am extremely grateful. Thank You
Kristian G
 
21 - 29 of 29 Posts
Status
Not open for further replies.
Top