gattaca Posted June 10, 2018 ID:1249244 Share Posted June 10, 2018 With this last Windows 10 update, I've been seeing multiple BSOD from the NetIO.SYS driver just as you have reported. I am / was running the latest versions. The only way I've been able to calm the system is to disable all of the real-time scanners in Malwarebytes first page. I also had Malwarebytes Pro in a VM and it started do the same thing.. BSOD, BSOD. It trapped that machine so many times I had to remove Malwarebytes. Then I used the clean-mb tool to remove, reboot etc.. after that the BSOD stopped...but now I cannot reinstall malwarebytes. Getting a "Class not registered" error and I am using "Run as Admin".. Go figure. There is something definitely up between even the latest Malwarebytes Pro and this last Windows 10 update which I applied recently. I also run SAV, and Webroot and never had a problem. I've disabled those and they don't seem to be the culprit.. Link to post Share on other sites More sharing options...
dcollins Posted June 10, 2018 ID:1249263 Share Posted June 10, 2018 Can you please provide the logs mentioned below: Download and run Malwarebytes Support Tool. Click "Reveal Hidden Contents" below for more details: Once the file is downloaded, open your Downloads folder/location of the downloaded file Double-click mb-support-X.X.X.XXXX.exe to run the program You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent. Place a checkmark next to Accept License Agreement and click Next You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!" Click the Advanced Options link Click the Gather Logs button A progress bar will appear and the program will proceed to gather troubleshooting information from your computer Upon completion, click OK A file named mbst-grab-results.zip will be saved to your Desktop Please attach the file in your next reply. Link to post Share on other sites More sharing options...
gattaca Posted June 10, 2018 Author ID:1249315 Share Posted June 10, 2018 OK here's the one from the setup I did last. Currently all the real time protections are disabled in malwarebytes and the BSOD have stopped. I left it installed b/c after removing it and using the clean tool in the VM, I cannot get it to reinstall at all. Later. TY! mbst-grab-results.zip Link to post Share on other sites More sharing options...
ColoradoGuy Posted June 10, 2018 ID:1249321 Share Posted June 10, 2018 38 minutes ago, gattaca said: OK here's the one from the setup I did last. Currently all the real time protections are disabled in malwarebytes and the BSOD have stopped. Gattaca, are you saying you turned off web, exploit, malware, and ransomware real time protection? If so, I will do the same, having multiple BSODs the last few days. Did you try turning off only 1 or 2 of the protection settings? FYI, I have Windows 10 updates and Malwarebytes 3.5.1 Premium, and having the same issues. DCollins, any time estimate/expectation for addressing this? Thx Link to post Share on other sites More sharing options...
dcollins Posted June 11, 2018 ID:1249341 Share Posted June 11, 2018 @gattaca thanks for the logs. If possible, can you also zip up the file at C:\Windows\memory.dmp and attach it here or, if it's too large, use wetransfer.com to generate a download link. This will help us see why we BSOD'd the system. I can tell you that this is most likely from Web Protection, so you should be able to enable everything but that and not getting anymore blue screens. @ColoradoGuy if you can provide the same logs requested above, and if you have a file at C:\Windows\memory.dmp please provide that as well. The more logs we have, the faster we can find a solution. Link to post Share on other sites More sharing options...
kimoh Posted June 11, 2018 ID:1249433 Share Posted June 11, 2018 same issue here too. I tried to provide the log but the file is too large 1.2gb Link to post Share on other sites More sharing options...
davace9090 Posted June 11, 2018 ID:1249436 Share Posted June 11, 2018 I can confirm i've got this BSOD at least 5 times, when can we expect an update? Link to post Share on other sites More sharing options...
Firefox Posted June 11, 2018 ID:1249442 Share Posted June 11, 2018 50 minutes ago, kimoh said: same issue here too. I tried to provide the log but the file is too large 1.2gb Make sure your zipping the file, then you can upload the log file to WeTransfer and provide the download link to the team so they can review it. Link to post Share on other sites More sharing options...
dcollins Posted June 11, 2018 ID:1249458 Share Posted June 11, 2018 If you are experiencing this issue, we could really benefit from two things on your machine: Please zip up the file C:\Windows\memory.dmp and use wetransfer.com to generate a download link Please also gather the logs mentioned below and attach them in your reply: Download and run Malwarebytes Support Tool. Click "Reveal Hidden Contents" below for more details: Once the file is downloaded, open your Downloads folder/location of the downloaded file Double-click mb-support-X.X.X.XXXX.exe to run the program You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent. Place a checkmark next to Accept License Agreement and click Next You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!" Click the Advanced Options link Click the Gather Logs button A progress bar will appear and the program will proceed to gather troubleshooting information from your computer Upon completion, click OK A file named mbst-grab-results.zip will be saved to your Desktop Please attach the file in your next reply. Link to post Share on other sites More sharing options...
mark5211 Posted June 11, 2018 ID:1249537 Share Posted June 11, 2018 I'm running Malwarebytes Premium 3.5.1.2522 on a up to date Windows 10 system and I've found I've been getting this netio.sys driver_irql_not_less_or_equal blue screen every time I go on the http://www.dailymail.co.uk/home/index.html website, I've quit Malwarebytes and it works absolutely fine but as soon as it re-stared the PC crashes with a blue screen on this site, it started on Saturday but it crashes every time I go to this particular site. Link to post Share on other sites More sharing options...
gattaca Posted June 11, 2018 Author ID:1249542 Share Posted June 11, 2018 (edited) 23 hours ago, ColoradoGuy said: Gattaca, are you saying you turned off web, exploit, malware, and ransomware real time protection? If so, I will do the same, having multiple BSODs the last few days. Did you try turning off only 1 or 2 of the protection settings? FYI, I have Windows 10 updates and Malwarebytes 3.5.1 Premium, and having the same issues. DCollins, any time estimate/expectation for addressing this? Thx Yes sir. Real Time Protections on the first page. MWB Premium 3.5.1 1) Web Protection OFF 2) Exploit Protection OFF 3) Malware Protection OFF 4) Ransomware Protection OFF I'm sorry, I did not try just 1 or 2, figured I'd start maxed out OFF. I'm afraid to let it keep BSOD b/c of what I say below for what happened to my VM. As soon as I turned these off, the BOSD (like is screen capped later on) stopped. I made no other changes. The resaon I noticed this sequence is b/c I usually update first a VM, then it stated the BSOD. And for some reason I cannot remember, something flagged MWAB as the cause, so I removed it from the system. Then it would not cleanly uninstall, so then I used the MB-CLEAN to remove it all. After that, the BSOD in the VM stopped. However, now I cannot reinstall MWAB Pro 3.5.1 b/c it complains on the install with a really werid error. I'd say fix the BSOD first and then we can see why my reinstall is failing. I have a feeling they are related. Thanks! Edited June 11, 2018 by gattaca clarify Link to post Share on other sites More sharing options...
gattaca Posted June 11, 2018 Author ID:1249544 Share Posted June 11, 2018 (edited) 18 hours ago, dcollins said: @gattaca thanks for the logs. If possible, can you also zip up the file at C:\Windows\memory.dmp and attach it here or, if it's too large, use wetransfer.com to generate a download link. This will help us see why we BSOD'd the system. I can tell you that this is most likely from Web Protection, so you should be able to enable everything but that and not getting anymore blue screens. @ColoradoGuy if you can provide the same logs requested above, and if you have a file at C:\Windows\memory.dmp please provide that as well. The more logs we have, the faster we can find a solution. I'm not seeing a memory.dmp file in c:\windows. could it be hiding somewhere else? Thanks! I also searched for on c:\ dir memory.dmp /s No files found. Edited June 11, 2018 by gattaca Link to post Share on other sites More sharing options...
dcollins Posted June 11, 2018 ID:1249545 Share Posted June 11, 2018 @mark5211 can you provide the logs asked for above? And also, what browser are you using when you notice the crash? Link to post Share on other sites More sharing options...
gattaca Posted June 11, 2018 Author ID:1249548 Share Posted June 11, 2018 10 minutes ago, dcollins said: @mark5211 can you provide the logs asked for above? And also, what browser are you using when you notice the crash? FWIW, I use FF 95% of the time. Always latest version, always up to date. Verified as Quantum 64 bit 60.0.2. Link to post Share on other sites More sharing options...
mark5211 Posted June 12, 2018 ID:1249558 Share Posted June 12, 2018 2 hours ago, dcollins said: @mark5211 can you provide the logs asked for above? And also, what browser are you using when you notice the crash? Will upload logs tomorrow when I'm back on PC, I've used Edge & Firefox and it's happened on both. Link to post Share on other sites More sharing options...
risey Posted June 12, 2018 ID:1249618 Share Posted June 12, 2018 (edited) Hi there, been googling over the last few days about this netio.sys bsod, thought it was a geforce or a firefox problem, I also updated all network drivers just in case but the problem persists. A user at geforce forum asked me if I were using malwarbytes as some similar problems have been reported, came here and bang... thank god, thought It was going to take me ages to find out what is causing it but u guys have the same exact bsod. I have followed the instructions above and also attached the files requested originally by the admin for analysis. I also attached the Windows dump file but it seems small so not sure if all the info is there or has dumped correctly... mbst-grab-results.zip dump.zip Edited June 12, 2018 by risey Link to post Share on other sites More sharing options...
risey Posted June 12, 2018 ID:1249619 Share Posted June 12, 2018 12 hours ago, mark5211 said: I'm running Malwarebytes Premium 3.5.1.2522 on a up to date Windows 10 system and I've found I've been getting this netio.sys driver_irql_not_less_or_equal blue screen every time I go on the http://www.dailymail.co.uk/home/index.html website, I've quit Malwarebytes and it works absolutely fine but as soon as it re-stared the PC crashes with a blue screen on this site, it started on Saturday but it crashes every time I go to this particular site. Yeah its certain sites that trigger it, thought it was originally a firefox problem, but my own website seems to trigger it if viewing a certain page that has a flash player on it... Link to post Share on other sites More sharing options...
dcollins Posted June 12, 2018 ID:1249682 Share Posted June 12, 2018 (edited) @risey can you let me know one of the sites you're seeing this with? And thanks for the logs! Can you upload the full dump at C:\Windows\memory.dmp by chance? The minidump unfortunately doesn't have the needed information. You will probably need to zip the file and use wetransfer.com to generate a download link Edited June 12, 2018 by dcollins Link to post Share on other sites More sharing options...
risey Posted June 12, 2018 ID:1249723 Share Posted June 12, 2018 (edited) 3 hours ago, dcollins said: @risey can you let me know one of the sites you're seeing this with? And thanks for the logs! Can you upload the full dump at C:\Windows\memory.dmp by chance? The minidump unfortunately doesn't have the needed information. You will probably need to zip the file and use wetransfer.com to generate a download link Hi there, cant seem to find the full memory dmp, maybe it did not complete as I remember it hanging at 100% at the time then I hard reset the PC, if it does it again i shall upload it to my server / website. The page that triggered it for me was a link to a page on my website, the particular page has a flash music player by Wimpy which is this one, the browser I mainly use is Firefox latest version. http://phatmonkey.me/#xl_xr_page_new project Edited June 12, 2018 by risey Link to post Share on other sites More sharing options...
FlySwatter Posted June 12, 2018 ID:1249731 Share Posted June 12, 2018 (edited) Just to chime in, I'm running Win 10 Pro version 1709 and since upgrading to Malwarebytes 3.5.1 I have been experiencing what appear to be similar BSODs referencing NETIO.SYS. They have only occurred when I run Oracle VirtualBox version 5.2.8 or 5.2.12 (the latest version) to host a Windows XP session. (To clarify, there is no Malwarebytes running under XP in the virtual session.) The Win 10 BSODs seem to be triggered by network activity from within the VirtualBox session. If I quit Malwarebytes then all is stable again. Thanks for your help! Edited June 12, 2018 by FlySwatter Link to post Share on other sites More sharing options...
dcollins Posted June 12, 2018 ID:1249734 Share Posted June 12, 2018 @FlySwatter is it any networking activity, or just some? @risey does it happen everytime you access that link, or just sometimes? Link to post Share on other sites More sharing options...
FlySwatter Posted June 12, 2018 ID:1249742 Share Posted June 12, 2018 The Win 10 PC is on a corporate Domain. The reason for the VirtualBox XP session is to run an (ancient) HVAC management application across the LAN. I don't believe this would involve any traffic gatewayed to the Internet. The Win 10 BSOD does not occur immediately. I have never had it occur during the Win XP boot sequence. It is generally after the start of the HVAC app, maybe a minute or two. I'm not in the same place in the app when it happens but it always seems to be just as I have clicked on something to interact across the LAN. The XP session is never used for anything else so the network traffic is fairly specific to HVAC management for the building. Link to post Share on other sites More sharing options...
dcollins Posted June 12, 2018 ID:1249743 Share Posted June 12, 2018 Thanks @FlySwatter. Does the XP VM have all updates installed, and if it does, is it using the XP POS2009 hack to continue getting updates? Link to post Share on other sites More sharing options...
risey Posted June 12, 2018 ID:1249746 Share Posted June 12, 2018 1 hour ago, dcollins said: @FlySwatter is it any networking activity, or just some? @risey does it happen everytime you access that link, or just sometimes? It is random when visiting that URL., I have tried to force it to get the memory dump but nothing yet Link to post Share on other sites More sharing options...
FlySwatter Posted June 13, 2018 ID:1249767 Share Posted June 13, 2018 2 hours ago, dcollins said: Thanks @FlySwatter. Does the XP VM have all updates installed, and if it does, is it using the XP POS2009 hack to continue getting updates? The VM is running XP SP3 with no further updates or hacks installed or allowed. Remember when we still had control over Windows Update?!! (Yes, I know the risk but the HVAC app is very adverse to change. That and the VM is usually only run a couple times a month for ~10 minutes.) Link to post Share on other sites More sharing options...
Recommended Posts