1

I have problem with windows 10.

There is some information about my crash.

  1. The error code is 0x000000d1
  2. I have update nvdia's newest drive.
  3. The computer has told me it caused by NETIO.SYS.

Crash dump: https://onedrive.live.com/redir?resid=DAED235CC8E19991!832&authkey=!AAbcN5ylhURHPWY&ithint=file%2cdmp

Improve this question
10
  • 1
    msdn.microsoft.com/en-us/library/windows/hardware/…—can you pull up the error logs to see where the error occurred? Also, try posting the most recent file in C:\Windows\Minidump so that we can analyze it.
    – bwDraco
    Aug 11, 2015 at 14:28
  • @DragonLord I got a message "Can't open file xxx" when I try to open the *.dump file
    – WhatAKitty
    Aug 11, 2015 at 14:34
  • Try elevating to administrator permissions first.
    – bwDraco
    Aug 11, 2015 at 14:34
  • @DragonLord How can I open it. I only get some messy code.
    – WhatAKitty
    Aug 11, 2015 at 14:37
  • Just post the file online using a service such as OneDrive (built into Windows 10), and put up the sharing link so that we can download the file.
    – bwDraco
    Aug 11, 2015 at 14:38

3 Answers 3

Reset to default
2

The crash seams to be caused by epfwwfp.sys which is part of ESET Smart security or the driver netactmonitor.sys

               rsp : 0xffffd00025f04de8 : 0xfffff80151965ba9 : nt!KiBugCheckDispatch+0x69
0xffffd00025f04de8 : 0xfffff80151965ba9 : nt!KiBugCheckDispatch+0x69
0xffffd00025f04e10 : 0xfffff801d57ddfb8 : NETIO!StreamInvokeCalloutAndNormalizeAction+0x60
Unable to load image epfwwfp.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for epfwwfp.sys
*** ERROR: Module load completed but symbols could not be loaded for epfwwfp.sys
0xffffd00025f04f28 : 0xfffff801519643c8 : nt!KiPageFault+0x248
0xffffd00025f04f30 : 0x0000000000000000 :  Trap @ ffffd00025f04f30
0xffffd00025f04f50 : 0xfffff801d5831000 : NETIO!WPP_GLOBAL_Control
Unable to load image netactmonitor.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for netactmonitor.sys
*** ERROR: Module load completed but symbols could not be loaded for netactmonitor.sys
0xffffd00025f05050 : 0xfffff801d5831000 : NETIO!WPP_GLOBAL_Control
0xffffd00025f05098 : 0xfffff801d57ddfb8 : NETIO!StreamInvokeCalloutAndNormalizeAction+0x60
0xffffd00025f05110 : 0xfffff801d5831002 : NETIO!WPP_GLOBAL_Control+0x2
0xffffd00025f05118 : 0xfffff801d57de60f : NETIO!StreamHandleDataClassify+0x133

Both are 1 year old and should be updated to a Win10 compatible version:

Image name: epfwwfp.sys
Timestamp:        Thu Sep 11 18:06:07 2014 (5411C86F)

Image path: netactmonitor.sys
Timestamp:        Fri Oct 10 09:17:23 2014
Improve this answer
6
  • You might BOLD the error line in your bugcheck output. I believe your debugging analysis is correct, not caused by lantern.
    – Moab
    Aug 11, 2015 at 22:27
  • @Moab afaik, I can't bold text in Code formatting.
    – magicandre1981
    Aug 12, 2015 at 4:11
  • How did you arrive at this conclusion? I'm not great with WinDbg and I must have missed something between some of the function calls in the stack trace.
    – bwDraco
    Aug 12, 2015 at 11:40
  • @DragonLord I dumped some other data with dds/dqs similar to what Mark did here: blogs.technet.com/b/markrussinovich/archive/2010/06/01/…
    – magicandre1981
    Aug 12, 2015 at 14:54
  • The ESET Smart security has a win10 compatible version?
    – WhatAKitty
    Aug 14, 2015 at 5:10
1

Note: This answer is incorrect and is retained for reference. Please see the answer by magicandre1981.

The system crashed in NETIO.SYS while running Lantern, an Internet proxy tool.

  • It appears that the networking subsystem malfunctioned while performing some network operation. The application running at the time was Lantern (flashlight.exe). There may be a bug in the application or in the networking driver; you may want to update Lantern when a new version becomes available.

  • The bugcheck analysis is as follows:

    Microsoft (R) Windows Debugger Version 10.0.10240.9 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\081115-9609-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*E:\sysdebug\debug-symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*E:\sysdebug\debug-symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
No .natvis files found at C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers.
Windows 10 Kernel Version 10240 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 10240.16412.amd64fre.th1.150729-1800
Machine Name:
Kernel base = 0xfffff801`5180e000 PsLoadedModuleList = 0xfffff801`51b33030
Debug session time: Mon Aug 10 12:08:09.241 2015 (UTC - 4:00)
System Uptime: 0 days 10:20:19.004
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
.........................................................
Loading User Symbols
Loading unloaded module list
....................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {8, 2, 0, fffff801d57ddfb8}

Probably caused by : NETIO.SYS ( NETIO!StreamInvokeCalloutAndNormalizeAction+60 )

Followup:     MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff801d57ddfb8, address which referenced memory

Debugging Details:
------------------


SYSTEM_SKU:  All

SYSTEM_VERSION:  System Version

BIOS_DATE:  08/19/2014

BASEBOARD_PRODUCT:  B85-PRO GAMER

BASEBOARD_VERSION:  Rev 1.xx

DUMP_FILE_ATTRIBUTES: 0x8
  Kernel Generated Triage Dump

BUGCHECK_P1: 8

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff801d57ddfb8

READ_ADDRESS: fffff80151bd2500: Unable to get MiVisibleState
 0000000000000008 

CURRENT_IRQL:  2

FAULTING_IP: 
NETIO!StreamInvokeCalloutAndNormalizeAction+60
fffff801`d57ddfb8 488b7008        mov     rsi,qword ptr [rax+8]

CPU_COUNT: 4

CPU_MHZ: ce4

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3c

CPU_STEPPING: 3

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  AV

PROCESS_NAME:  flashlight.exe

ANALYSIS_VERSION: 10.0.10240.9 x86fre

TRAP_FRAME:  ffffd00025f04f30 -- (.trap 0xffffd00025f04f30)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffd00025f05120
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff801d57ddfb8 rsp=ffffd00025f050c0 rbp=ffffd00025f05149
 r8=0000000000000040  r9=0000000000000000 r10=0000000000000006
r11=ffffe000afbdc9d0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
NETIO!StreamInvokeCalloutAndNormalizeAction+0x60:
fffff801`d57ddfb8 488b7008        mov     rsi,qword ptr [rax+8] ds:00000000`00000008=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80151965ba9 to fffff8015195b220

STACK_TEXT:  
ffffd000`25f04de8 fffff801`51965ba9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd000`25f04df0 fffff801`519643c8 : 00000000`00000000 00000000`00000004 00222d29`88000012 ae840200`00000000 : nt!KiBugCheckDispatch+0x69
ffffd000`25f04f30 fffff801`d57ddfb8 : ffffe000`afbdcaa0 ffffd000`25f05149 ffffd000`25f05220 ffffe000`afbdcaa0 : nt!KiPageFault+0x248
ffffd000`25f050c0 fffff801`d57dde91 : ffffe000`ad50dd40 ffffe000`afbdc9d0 ffffd000`25f055b8 ffffd000`25f055b8 : NETIO!StreamInvokeCalloutAndNormalizeAction+0x60
ffffd000`25f051a0 fffff801`d57db555 : ffffe000`a6b00014 fffff801`d7792528 ffffe000`00000001 ffffd000`25f05ca8 : NETIO!StreamProcessCallout+0x711
ffffd000`25f052e0 fffff801`d57da434 : 00000000`00000014 ffffd000`25f05ca8 ffffe000`abfcd5a0 ffffd000`25f05b60 : NETIO!ProcessCallout+0x685
ffffd000`25f05450 fffff801`d57d8f5e : 1bff4aa0`cc49f9c1 ffffd000`25f05740 00000000`00000000 ffffe000`aab26440 : NETIO!ArbitrateAndEnforce+0x494
ffffd000`25f05640 fffff801`d57d8890 : ffffe000`ac675dc0 ffffd000`25f05bb0 ffffd000`25f05bb0 ffffe000`b13898d0 : NETIO!KfdClassify+0x32e
ffffd000`25f05ab0 fffff801`d57d8528 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : NETIO!StreamClassify+0x268
ffffd000`25f05c50 fffff801`d57d69f4 : 00000000`00000000 ffffe000`b0002e10 00000000`00000000 00000000`00000000 : NETIO!StreamCommonInspect+0x244
ffffd000`25f05ff0 fffff801`d5899fd5 : ffffe000`b13898d0 ffffd000`25f06360 ffffd000`25f060e1 00000000`00000000 : NETIO!WfpStreamInspectSend+0x264
ffffd000`25f06080 fffff801`d589992b : 00000000`00000000 00000000`00000000 ffffd000`25f06b01 fffff801`5188a331 : tcpip!TcpEnqueueTcbSend+0x4f5
ffffd000`25f06180 fffff801`5188a2b5 : ffffd000`25f06b01 ffffd000`25f06280 ffffd000`25f066c0 fffff801`d5899900 : tcpip!TcpTlConnectionSendCalloutRoutine+0x2b
ffffd000`25f06200 fffff801`d58e4022 : ffffe000`addc5e20 00000000`00000000 00000000`00000000 ffffe000`a6b3b450 : nt!KeExpandKernelStackAndCalloutInternal+0x85
ffffd000`25f06250 fffff801`d51ee1c7 : ffffe000`addc5e20 ffffd000`25f06b80 00000000`0000002d 00000000`0000002d : tcpip!TcpTlConnectionSend+0x72
ffffd000`25f062c0 fffff801`d51d07b3 : ffffe000`ab82f010 00000000`00000000 00000000`3296fd38 fffff801`51a80297 : afd!AfdFastConnectionSend+0x387
ffffd000`25f06480 fffff801`51c3be83 : 00000000`00000000 00000000`00000000 00000000`00000001 fffff801`51857012 : afd!AfdFastIoDeviceControl+0x863
ffffd000`25f06800 fffff801`51c3ba56 : ffffe000`acc78fe0 ffffe000`acc78fe0 00000000`00000001 00000000`1374a324 : nt!IopXxxControlFile+0x423
ffffd000`25f06a20 fffff801`51965863 : 00000000`7fe91000 00000000`00000000 00000000`00000000 fffff801`51c394ac : nt!NtDeviceIoControlFile+0x56
ffffd000`25f06a90 00000000`545a1e52 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`3294f3c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x545a1e52


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!StreamInvokeCalloutAndNormalizeAction+60
fffff801`d57ddfb8 488b7008        mov     rsi,qword ptr [rax+8]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  NETIO!StreamInvokeCalloutAndNormalizeAction+60

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  559f3890

IMAGE_VERSION:  10.0.10240.16384

BUCKET_ID_FUNC_OFFSET:  60

FAILURE_BUCKET_ID:  AV_NETIO!StreamInvokeCalloutAndNormalizeAction

BUCKET_ID:  AV_NETIO!StreamInvokeCalloutAndNormalizeAction

PRIMARY_PROBLEM_CLASS:  AV_NETIO!StreamInvokeCalloutAndNormalizeAction

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:av_netio!streaminvokecalloutandnormalizeaction

FAILURE_ID_HASH:  {c2ca2d1f-cfdc-88d5-c7bc-7693b8f0de04}

Followup:     MachineOwner
---------
Improve this answer
4
  • I see. Can I fix it by updading lantern?
    – WhatAKitty
    Aug 11, 2015 at 15:23
  • I'd give it a shot. A newer version might have fixed a relevant bug. If that doesn't help, the problem may be a bug in the OS itself.
    – bwDraco
    Aug 11, 2015 at 15:24
  • Lantern fixed it ?
    – WhatAKitty
    Aug 11, 2015 at 15:26
  • I don't know. Try installing the most recent version.
    – bwDraco
    Aug 11, 2015 at 15:28
-1

This BSOD is caused by a corrupted or unstable driver or program. Try rolling back the newest driver you installed.

EDIT: The program appears to be Lantern, which is a proxy. It had a error while performing. A network operation.

Improve this answer
20
  • Can you tell me which driver is unstable?
    – WhatAKitty
    Aug 11, 2015 at 15:07
  • I would need the .sys filename
    – geek1011
    Aug 11, 2015 at 15:08
  • onedrive.live.com/…
    – WhatAKitty
    Aug 11, 2015 at 15:09
  • I mean the .sys file that you saw in the bsod @WhiteWater
    – geek1011
    Aug 11, 2015 at 15:11
  • @WhiteWater if you cannot find it, ill try to analyze the MiniDump file
    – geek1011
    Aug 11, 2015 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .