1

I have problem with windows 10.

There is some information about my crash.

  1. The error code is 0x000000d1
  2. I have update nvdia's newest drive.
  3. The computer has told me it caused by NETIO.SYS.

Crash dump: https://onedrive.live.com/redir?resid=DAED235CC8E19991!832&authkey=!AAbcN5ylhURHPWY&ithint=file%2cdmp

  • 1
    msdn.microsoft.com/en-us/library/windows/hardware/…—can you pull up the error logs to see where the error occurred? Also, try posting the most recent file in C:\Windows\Minidump so that we can analyze it. – bwDraco Aug 11 '15 at 14:28
  • @DragonLord I got a message "Can't open file xxx" when I try to open the *.dump file – WhiteWater Aug 11 '15 at 14:34
  • Try elevating to administrator permissions first. – bwDraco Aug 11 '15 at 14:34
  • @DragonLord How can I open it. I only get some messy code. – WhiteWater Aug 11 '15 at 14:37
  • Just post the file online using a service such as OneDrive (built into Windows 10), and put up the sharing link so that we can download the file. – bwDraco Aug 11 '15 at 14:38
2

The crash seams to be caused by epfwwfp.sys which is part of ESET Smart security or the driver netactmonitor.sys

               rsp : 0xffffd00025f04de8 : 0xfffff80151965ba9 : nt!KiBugCheckDispatch+0x69
0xffffd00025f04de8 : 0xfffff80151965ba9 : nt!KiBugCheckDispatch+0x69
0xffffd00025f04e10 : 0xfffff801d57ddfb8 : NETIO!StreamInvokeCalloutAndNormalizeAction+0x60
Unable to load image epfwwfp.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for epfwwfp.sys
*** ERROR: Module load completed but symbols could not be loaded for epfwwfp.sys
0xffffd00025f04f28 : 0xfffff801519643c8 : nt!KiPageFault+0x248
0xffffd00025f04f30 : 0x0000000000000000 :  Trap @ ffffd00025f04f30
0xffffd00025f04f50 : 0xfffff801d5831000 : NETIO!WPP_GLOBAL_Control
Unable to load image netactmonitor.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for netactmonitor.sys
*** ERROR: Module load completed but symbols could not be loaded for netactmonitor.sys
0xffffd00025f05050 : 0xfffff801d5831000 : NETIO!WPP_GLOBAL_Control
0xffffd00025f05098 : 0xfffff801d57ddfb8 : NETIO!StreamInvokeCalloutAndNormalizeAction+0x60
0xffffd00025f05110 : 0xfffff801d5831002 : NETIO!WPP_GLOBAL_Control+0x2
0xffffd00025f05118 : 0xfffff801d57de60f : NETIO!StreamHandleDataClassify+0x133

Both are 1 year old and should be updated to a Win10 compatible version:

Image name: epfwwfp.sys
Timestamp:        Thu Sep 11 18:06:07 2014 (5411C86F)

Image path: netactmonitor.sys
Timestamp:        Fri Oct 10 09:17:23 2014 
  • You might BOLD the error line in your bugcheck output. I believe your debugging analysis is correct, not caused by lantern. – Moab Aug 11 '15 at 22:27
  • @Moab afaik, I can't bold text in Code formatting. – magicandre1981 Aug 12 '15 at 4:11
  • How did you arrive at this conclusion? I'm not great with WinDbg and I must have missed something between some of the function calls in the stack trace. – bwDraco Aug 12 '15 at 11:40
  • @DragonLord I dumped some other data with dds/dqs similar to what Mark did here: blogs.technet.com/b/markrussinovich/archive/2010/06/01/… – magicandre1981 Aug 12 '15 at 14:54
  • The ESET Smart security has a win10 compatible version? – WhiteWater Aug 14 '15 at 5:10
1

Note: This answer is incorrect and is retained for reference. Please see the answer by magicandre1981.


The system crashed in NETIO.SYS while running Lantern, an Internet proxy tool.

  • It appears that the networking subsystem malfunctioned while performing some network operation. The application running at the time was Lantern (flashlight.exe). There may be a bug in the application or in the networking driver; you may want to update Lantern when a new version becomes available.

  • The bugcheck analysis is as follows:

    Microsoft (R) Windows Debugger Version 10.0.10240.9 X86
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [E:\081115-9609-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*E:\sysdebug\debug-symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*E:\sysdebug\debug-symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    No .natvis files found at C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers.
    Windows 10 Kernel Version 10240 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 10240.16412.amd64fre.th1.150729-1800
    Machine Name:
    Kernel base = 0xfffff801`5180e000 PsLoadedModuleList = 0xfffff801`51b33030
    Debug session time: Mon Aug 10 12:08:09.241 2015 (UTC - 4:00)
    System Uptime: 0 days 10:20:19.004
    Loading Kernel Symbols
    .
    
    Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
    Run !sym noisy before .reload to track down problems loading symbols.
    
    ..............................................................
    ................................................................
    .........................................................
    Loading User Symbols
    Loading unloaded module list
    ....................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck D1, {8, 2, 0, fffff801d57ddfb8}
    
    Probably caused by : NETIO.SYS ( NETIO!StreamInvokeCalloutAndNormalizeAction+60 )
    
    Followup:     MachineOwner
    ---------
    
    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 0000000000000008, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
    Arg4: fffff801d57ddfb8, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    SYSTEM_SKU:  All
    
    SYSTEM_VERSION:  System Version
    
    BIOS_DATE:  08/19/2014
    
    BASEBOARD_PRODUCT:  B85-PRO GAMER
    
    BASEBOARD_VERSION:  Rev 1.xx
    
    DUMP_FILE_ATTRIBUTES: 0x8
      Kernel Generated Triage Dump
    
    BUGCHECK_P1: 8
    
    BUGCHECK_P2: 2
    
    BUGCHECK_P3: 0
    
    BUGCHECK_P4: fffff801d57ddfb8
    
    READ_ADDRESS: fffff80151bd2500: Unable to get MiVisibleState
     0000000000000008 
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    NETIO!StreamInvokeCalloutAndNormalizeAction+60
    fffff801`d57ddfb8 488b7008        mov     rsi,qword ptr [rax+8]
    
    CPU_COUNT: 4
    
    CPU_MHZ: ce4
    
    CPU_VENDOR:  GenuineIntel
    
    CPU_FAMILY: 6
    
    CPU_MODEL: 3c
    
    CPU_STEPPING: 3
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    
    BUGCHECK_STR:  AV
    
    PROCESS_NAME:  flashlight.exe
    
    ANALYSIS_VERSION: 10.0.10240.9 x86fre
    
    TRAP_FRAME:  ffffd00025f04f30 -- (.trap 0xffffd00025f04f30)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=ffffd00025f05120
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff801d57ddfb8 rsp=ffffd00025f050c0 rbp=ffffd00025f05149
     r8=0000000000000040  r9=0000000000000000 r10=0000000000000006
    r11=ffffe000afbdc9d0 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    NETIO!StreamInvokeCalloutAndNormalizeAction+0x60:
    fffff801`d57ddfb8 488b7008        mov     rsi,qword ptr [rax+8] ds:00000000`00000008=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80151965ba9 to fffff8015195b220
    
    STACK_TEXT:  
    ffffd000`25f04de8 fffff801`51965ba9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
    ffffd000`25f04df0 fffff801`519643c8 : 00000000`00000000 00000000`00000004 00222d29`88000012 ae840200`00000000 : nt!KiBugCheckDispatch+0x69
    ffffd000`25f04f30 fffff801`d57ddfb8 : ffffe000`afbdcaa0 ffffd000`25f05149 ffffd000`25f05220 ffffe000`afbdcaa0 : nt!KiPageFault+0x248
    ffffd000`25f050c0 fffff801`d57dde91 : ffffe000`ad50dd40 ffffe000`afbdc9d0 ffffd000`25f055b8 ffffd000`25f055b8 : NETIO!StreamInvokeCalloutAndNormalizeAction+0x60
    ffffd000`25f051a0 fffff801`d57db555 : ffffe000`a6b00014 fffff801`d7792528 ffffe000`00000001 ffffd000`25f05ca8 : NETIO!StreamProcessCallout+0x711
    ffffd000`25f052e0 fffff801`d57da434 : 00000000`00000014 ffffd000`25f05ca8 ffffe000`abfcd5a0 ffffd000`25f05b60 : NETIO!ProcessCallout+0x685
    ffffd000`25f05450 fffff801`d57d8f5e : 1bff4aa0`cc49f9c1 ffffd000`25f05740 00000000`00000000 ffffe000`aab26440 : NETIO!ArbitrateAndEnforce+0x494
    ffffd000`25f05640 fffff801`d57d8890 : ffffe000`ac675dc0 ffffd000`25f05bb0 ffffd000`25f05bb0 ffffe000`b13898d0 : NETIO!KfdClassify+0x32e
    ffffd000`25f05ab0 fffff801`d57d8528 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : NETIO!StreamClassify+0x268
    ffffd000`25f05c50 fffff801`d57d69f4 : 00000000`00000000 ffffe000`b0002e10 00000000`00000000 00000000`00000000 : NETIO!StreamCommonInspect+0x244
    ffffd000`25f05ff0 fffff801`d5899fd5 : ffffe000`b13898d0 ffffd000`25f06360 ffffd000`25f060e1 00000000`00000000 : NETIO!WfpStreamInspectSend+0x264
    ffffd000`25f06080 fffff801`d589992b : 00000000`00000000 00000000`00000000 ffffd000`25f06b01 fffff801`5188a331 : tcpip!TcpEnqueueTcbSend+0x4f5
    ffffd000`25f06180 fffff801`5188a2b5 : ffffd000`25f06b01 ffffd000`25f06280 ffffd000`25f066c0 fffff801`d5899900 : tcpip!TcpTlConnectionSendCalloutRoutine+0x2b
    ffffd000`25f06200 fffff801`d58e4022 : ffffe000`addc5e20 00000000`00000000 00000000`00000000 ffffe000`a6b3b450 : nt!KeExpandKernelStackAndCalloutInternal+0x85
    ffffd000`25f06250 fffff801`d51ee1c7 : ffffe000`addc5e20 ffffd000`25f06b80 00000000`0000002d 00000000`0000002d : tcpip!TcpTlConnectionSend+0x72
    ffffd000`25f062c0 fffff801`d51d07b3 : ffffe000`ab82f010 00000000`00000000 00000000`3296fd38 fffff801`51a80297 : afd!AfdFastConnectionSend+0x387
    ffffd000`25f06480 fffff801`51c3be83 : 00000000`00000000 00000000`00000000 00000000`00000001 fffff801`51857012 : afd!AfdFastIoDeviceControl+0x863
    ffffd000`25f06800 fffff801`51c3ba56 : ffffe000`acc78fe0 ffffe000`acc78fe0 00000000`00000001 00000000`1374a324 : nt!IopXxxControlFile+0x423
    ffffd000`25f06a20 fffff801`51965863 : 00000000`7fe91000 00000000`00000000 00000000`00000000 fffff801`51c394ac : nt!NtDeviceIoControlFile+0x56
    ffffd000`25f06a90 00000000`545a1e52 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`3294f3c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x545a1e52
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    NETIO!StreamInvokeCalloutAndNormalizeAction+60
    fffff801`d57ddfb8 488b7008        mov     rsi,qword ptr [rax+8]
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  NETIO!StreamInvokeCalloutAndNormalizeAction+60
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: NETIO
    
    IMAGE_NAME:  NETIO.SYS
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  559f3890
    
    IMAGE_VERSION:  10.0.10240.16384
    
    BUCKET_ID_FUNC_OFFSET:  60
    
    FAILURE_BUCKET_ID:  AV_NETIO!StreamInvokeCalloutAndNormalizeAction
    
    BUCKET_ID:  AV_NETIO!StreamInvokeCalloutAndNormalizeAction
    
    PRIMARY_PROBLEM_CLASS:  AV_NETIO!StreamInvokeCalloutAndNormalizeAction
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:av_netio!streaminvokecalloutandnormalizeaction
    
    FAILURE_ID_HASH:  {c2ca2d1f-cfdc-88d5-c7bc-7693b8f0de04}
    
    Followup:     MachineOwner
    ---------
    
  • I see. Can I fix it by updading lantern? – WhiteWater Aug 11 '15 at 15:23
  • I'd give it a shot. A newer version might have fixed a relevant bug. If that doesn't help, the problem may be a bug in the OS itself. – bwDraco Aug 11 '15 at 15:24
  • Lantern fixed it ? – WhiteWater Aug 11 '15 at 15:26
  • I don't know. Try installing the most recent version. – bwDraco Aug 11 '15 at 15:28
-1

This BSOD is caused by a corrupted or unstable driver or program. Try rolling back the newest driver you installed.

EDIT: The program appears to be Lantern, which is a proxy. It had a error while performing. A network operation.

  • Can you tell me which driver is unstable? – WhiteWater Aug 11 '15 at 15:07
  • I would need the .sys filename – geek1011 Aug 11 '15 at 15:08
  • onedrive.live.com/… – WhiteWater Aug 11 '15 at 15:09
  • I mean the .sys file that you saw in the bsod @WhiteWater – geek1011 Aug 11 '15 at 15:11
  • @WhiteWater if you cannot find it, ill try to analyze the MiniDump file – geek1011 Aug 11 '15 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.