Hello,

I'm getting a BSOD almost daily from this error.  I've read some of the other posts about this problem and consequently I've stored a couple of crash dumps and my PC info onto onedrive here:

https://onedrive.live.com/redir?resid=9C5617583AEDDDB!108&authkey=!AE3WEMq-7pTTseI&ithint=file%2czip

Running WinDbg (output below) points towards the NETIO.SYS driver - do I need to update this driver?  How do I do that?

I would be really grateful for any help or advice with this problem.

many thanks in advance

Mike

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*

Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Only kernel address space is available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: srv*
Windows 8 Kernel Version 9600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 9600.17630.amd64fre.winblue_r7.150109-2022
Machine Name:
Kernel base = 0xfffff800`93071000 PsLoadedModuleList = 0xfffff800`9334a250
Debug session time: Thu May 21 06:30:02.511 2015 (UTC + 1:00)
System Uptime: 0 days 16:01:39.798
Loading Kernel Symbols
...............................................................
................................................................
....Page 12079a not present in the dump file. Type ".hh dbgerr004" for details
..............................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00007ff6`84f4c018).  Type ".hh dbgerr001" for details
Loading unloaded module list
........................
ERROR: FindPlugIns 8007007b
ERROR: Some plugins may not be available [8007007b]
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {ffffcf807ada4fb8, 2, 0, fffff8000d07fde9}

Probably caused by : NETIO.SYS ( NETIO!NsiEnumerateObjectsAllParametersEx+20d )

Followup: MachineOwner
---------

2: kd> !analyze -v
ERROR: FindPlugIns 8007007b
ERROR: Some plugins may not be available [8007007b]
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffffcf807ada4fb8, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8000d07fde9, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
 ffffcf807ada4fb8 

CURRENT_IRQL:  2

FAULTING_IP: 
ndis!ndisNsiEnumerateAllInterfaceInformation+689
fffff800`0d07fde9 498b8f98050000  mov     rcx,qword ptr [r15+598h]

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  AV

PROCESS_NAME:  taskhost.exe

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

TRAP_FRAME:  ffffd00022225160 -- (.trap 0xffffd00022225160)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000005 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000005 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000d07fde9 rsp=ffffd000222252f0 rbp=ffffcf807ac58a20
 r8=0000000000000007  r9=fffff8000e303054 r10=0000000000000000
r11=ffffd000222257f0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
ndis!ndisNsiEnumerateAllInterfaceInformation+0x689:
fffff800`0d07fde9 498b8f98050000  mov     rcx,qword ptr [r15+598h] ds:00000000`00000598=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800931cd4e9 to fffff800931c19a0

STACK_TEXT:  
ffffd000`22225018 fffff800`931cd4e9 : 00000000`0000000a ffffcf80`7ada4fb8 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd000`22225020 fffff800`931cbd3a : 00000000`00000000 ffffcf80`7ad8ada8 ffffd000`22220000 ffffd000`22226000 : nt!KiBugCheckDispatch+0x69
ffffd000`22225160 fffff800`0d07fde9 : ffffcf80`7ad8ada8 ffffe001`cb238100 ffffcf80`75d90a20 ffffcf80`75d90ef0 : nt!KiPageFault+0x23a
ffffd000`222252f0 fffff800`0d29c308 : ffffd000`22225530 00000000`00000000 ffffe001`d0688002 00000000`00000008 : ndis!ndisNsiEnumerateAllInterfaceInformation+0x689
ffffd000`22225410 fffff800`0e2fcfc1 : ffffe001`d0688000 fffff800`00000070 00000098`aa3eda20 00000000`00001000 : NETIO!NsiEnumerateObjectsAllParametersEx+0x20d
ffffd000`22225600 fffff800`0e2fcbea : 00000000`00000000 ffffcf80`81108f70 ffffcf80`81108ea0 ffffe001`cc826e00 : nsiproxy!NsippEnumerateObjectsAllParameters+0x201
ffffd000`222257f0 fffff800`936ea911 : ffffcf80`81108ea0 00000000`00000002 ffffe001`c6890f20 fffff800`931c7d01 : nsiproxy!NsippDispatch+0x5a
ffffd000`22225830 fffff800`9341e38f : 00000000`00000000 ffffd000`22225b80 ffffcf80`81108ea0 ffffe001`cc826d60 : nt!IovCallDriver+0x3cd
ffffd000`22225880 fffff800`9341d92e : ffffd000`22225a38 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0xa4f
ffffd000`22225a20 fffff800`931cd1b3 : ffffe001`ce920080 00000000`001f0003 00000098`aa3ed898 00000000`00000001 : nt!NtDeviceIoControlFile+0x56
ffffd000`22225a90 00007ffc`fa150e4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000098`aa3ed918 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`fa150e4a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!NsiEnumerateObjectsAllParametersEx+20d
fffff800`0d29c308 8bd8            mov     ebx,eax

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  NETIO!NsiEnumerateObjectsAllParametersEx+20d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  546029c5

BUCKET_ID_FUNC_OFFSET:  20d

FAILURE_BUCKET_ID:  AV_VRF_NETIO!NsiEnumerateObjectsAllParametersEx

BUCKET_ID:  AV_VRF_NETIO!NsiEnumerateObjectsAllParametersEx

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:av_vrf_netio!nsienumerateobjectsallparametersex

FAILURE_ID_HASH:  {0f33bb26-6e72-1678-ce95-2af86427dd39}

Followup: MachineOwner
---------

Update your realtech and broadcom drivers (including bluetooth).

You also have a very old Macrovison driver (secdrv.sys from 2006) which was known to have a vulnerability patched with a security bulletin in 2007, so most likely new versions of Windows don't agree much with it.

 

DI

Since Netio.sys is part of the OS I would run a system file check (&DISM if nec) to find the state of the OS

Please run a system file check (SFC) & DISM if you are on win 8 or higher
All instructions are in our Wiki article below...
Should you have any questions please ask us.

System file check (SFC) Scan and Repair System Files

Thanks for your reply.  How do I update these drivers?  The Device Manager says all my drivers are up to date when I try update from there.

Yes I should have mentioned - I did that a few days ago when this first started happening, but it didn't solve the problem.

Go on the vendor website:

Realtek

Broadcom

If it's a laptop you might go on the vendor website to update the drivers.

Macrovision driver comes with games or ROVI/Macrovision products. i wouldn't know how to update it

So I've updated the drivers from the Sony website and I removed the Macrovision driver because I don't have any ROVI or Macrovision products, but I got another crash last night.  Any other ideas?

https://onedrive.live.com/redir?resid=9C5617583AEDDDB!109&authkey=!AOyZeZkvVU_tkqk&ithint=file%2czip

many thanks

DI

The most recent DMP was still related to netio.sys  What were the results from SFC & DISM?

No problems with sfc and dism, results below

I've noticed that every time I come back to the PC after a crash it says that there are Windows Updates available, which is usually the latest Windows Defender definition.  This is leading me to thinking that perhaps the update check finding an update is causing the crash, because otherwise why would the crash happen when there is nothing else going on?

Any other ideas?

C:\Users\Mike>sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\Users\Mike> dism /Online /Cleanup-Image /RestoreHealth

Deployment Image Servicing and Management tool
Version: 6.3.9600.17031

Image Version: 6.3.9600.17031

[==========================100.0%==========================]
The restore operation completed successfully. The component store corruption was repaired.
The operation completed successfully.

• Edited by Dilignt 20 hours 55 minutes ago

DI

If you are still crashing after DISM

The component store corruption was repaired.

I would start by re-installing the network drivers and if that does not help networking itself.  It may simply be faster to do a system refresh

No problems with sfc and dism, results below

I've noticed that every time I come back to the PC after a crash it says that there are Windows Updates available, which is usually the latest Windows Defender definition.  This is leading me to thinking that perhaps the update check finding an update is causing the crash, because otherwise why would the crash happen when there is nothing else going on?

Any other ideas?

C:\Users\Mike>sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\Users\Mike> dism /Online /Cleanup-Image /RestoreHealth

Deployment Image Servicing and Management tool
Version: 6.3.9600.17031

Image Version: 6.3.9600.17031

[==========================100.0%==========================]
The restore operation completed successfully. The component store corruption was repaired.
The operation completed successfully.

• Edited by Dilignt Saturday, May 23, 2015 10:27 AM

No problems with sfc and dism, results below

I've noticed that every time I come back to the PC after a crash it says that there are Windows Updates available, which is usually the latest Windows Defender definition.  This is leading me to thinking that perhaps the update check finding an update is causing the crash, because otherwise why would the crash happen when there is nothing else going on?

Any other ideas?

C:\Users\Mike>sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\Users\Mike> dism /Online /Cleanup-Image /RestoreHealth

Deployment Image Servicing and Management tool
Version: 6.3.9600.17031

Image Version: 6.3.9600.17031

[==========================100.0%==========================]
The restore operation completed successfully. The component store corruption was repaired.
The operation completed successfully.

• Edited by Dilignt Saturday, May 23, 2015 10:27 AM

When I run DISM it always says 'The component store corruption was repaired', even if I run it again straight away, so either the store corruption isn't being properly repaired or there isn't a corruption but it thinks there is.

There are Wireless LAN drivers on the Sony website - are these the network drivers I should reinstall?  If not, where do I get them from?

System refresh is not really an option as I'll have to re-upgrade to Windows 8.1 pro, and I don't have license keys for some of my apps any more.

DI

Always best to install from the computer makers site as they sometimes tweak drivers.  Guess it is a case of which is less painfull, living with the crashes or refreshing and going through that pain

When I run DISM it always says 'The component store corruption was repaired', even if I run it again straight away, so either the store corruption isn't being properly repaired or there isn't a corruption but it thinks there is.

There are Wireless LAN drivers on the Sony website - are these the network drivers I should reinstall?  If not, where do I get them from?

System refresh is not really an option as I'll have to re-upgrade to Windows 8.1 pro, and I don't have license keys for some of my apps any more.

You can contact the Sony support to get the right driver update according to your computer module.

In addition, since this issue can also be caused by malware, please do a completely scan to check the issue.