Jump to content

NETIO.SYS BSOD

gattaca
 Share
Go to solution Solved by dcollins,

Recommended Posts

gattaca

gattaca

Posted
Posted

With this last Windows 10 update, I've been seeing multiple BSOD from the NetIO.SYS driver just as you have reported.  I am / was running the latest versions.

The only way I've been able to calm the system is to disable all of the real-time scanners in Malwarebytes first page.

I also had Malwarebytes Pro in a VM and it started do the same thing.. BSOD, BSOD.   It trapped that machine so many times I had to remove Malwarebytes. Then I used the clean-mb tool to remove, reboot etc.. after that the BSOD stopped...but now I cannot reinstall malwarebytes.  Getting a "Class not registered" error and I am using "Run as Admin".. Go figure.

There is something definitely up between even the latest Malwarebytes Pro and this last Windows 10 update which I applied recently. 

I also run SAV, and Webroot and never had a problem.  I've disabled those and they don't seem to be the culprit..

Link to post
Share on other sites
  • Replies 308
  • Created
  • Last Reply

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Posted Images

  • Staff
dcollins

dcollins

Posted
  • Staff
Posted

Can you please provide the logs mentioned below:

  1. Download and run Malwarebytes Support Tool. Click "Reveal Hidden Contents" below for more details:
  2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
  3. Double-click mb-support-X.X.X.XXXX.exe to run the program
    • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
  4. Place a checkmark next to Accept License Agreement and click Next
  5. You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!"
  6. Click the Advanced Options link
    welcome mbst.png
  7. Click the Gather Logs button
    gatherlogs.png
  8. A progress bar will appear and the program will proceed to gather troubleshooting information from your computer
  9. Upon completion, click OK
  10. A file named mbst-grab-results.zip will be saved to your Desktop
  11. Please attach the file in your next reply.
Link to post
Share on other sites
ColoradoGuy

ColoradoGuy

Posted
Posted
38 minutes ago, gattaca said:

OK here's the one from the setup I did last.  Currently all the real time protections are disabled in malwarebytes and the BSOD have stopped. 

Gattaca, are you saying you turned off web, exploit, malware, and ransomware real time protection? If so, I will do the same, having multiple BSODs the last few days.  Did you try turning off only 1 or 2 of the protection settings?

FYI, I have Windows 10 updates and Malwarebytes 3.5.1 Premium, and having the same issues.

DCollins, any time estimate/expectation for addressing this?

Thx

Link to post
Share on other sites
  • Staff
dcollins

dcollins

Posted
  • Staff
Posted

@gattaca thanks for the logs. If possible, can you also zip up the file at C:\Windows\memory.dmp and attach it here or, if it's too large, use wetransfer.com to generate a download link. This will help us see why we BSOD'd the system. I can tell you that this is most likely from Web Protection, so you should be able to enable everything but that and not getting anymore blue screens.

@ColoradoGuy if you can provide the same logs requested above, and if you have a file at C:\Windows\memory.dmp please provide that as well. The more logs we have, the faster we can find a solution.

Link to post
Share on other sites
  • Staff
dcollins

dcollins

Posted
  • Staff
Posted

If you are experiencing this issue, we could really benefit from two things on your machine:

  1. Please zip up the file C:\Windows\memory.dmp and use wetransfer.com to generate a download link
  2. Please also gather the logs mentioned below and attach them in your reply:
  1. Download and run Malwarebytes Support Tool. Click "Reveal Hidden Contents" below for more details:
  2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
  3. Double-click mb-support-X.X.X.XXXX.exe to run the program
    • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
  4. Place a checkmark next to Accept License Agreement and click Next
  5. You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!"
  6. Click the Advanced Options link
    welcome mbst.png
  7. Click the Gather Logs button
    gatherlogs.png
  8. A progress bar will appear and the program will proceed to gather troubleshooting information from your computer
  9. Upon completion, click OK
  10. A file named mbst-grab-results.zip will be saved to your Desktop
  11. Please attach the file in your next reply.
Link to post
Share on other sites
mark5211

mark5211

Posted
Posted

I'm running Malwarebytes Premium 3.5.1.2522 on a up to date Windows 10 system and I've found I've been getting this  netio.sys driver_irql_not_less_or_equal  blue screen every time I go on the http://www.dailymail.co.uk/home/index.html website, I've quit Malwarebytes and it works absolutely fine but as soon as it re-stared the PC crashes with a blue screen on this site, it started on Saturday but it crashes every time I go to this particular site.

 

MWB.JPG

Link to post
Share on other sites
gattaca

gattaca

Posted
  • Author
Posted (edited)
23 hours ago, ColoradoGuy said:

Gattaca, are you saying you turned off web, exploit, malware, and ransomware real time protection? If so, I will do the same, having multiple BSODs the last few days.  Did you try turning off only 1 or 2 of the protection settings?

FYI, I have Windows 10 updates and Malwarebytes 3.5.1 Premium, and having the same issues.

DCollins, any time estimate/expectation for addressing this?

Thx

Yes sir.

Real Time Protections on the first page.  MWB Premium 3.5.1

1) Web Protection OFF

2) Exploit Protection OFF

3) Malware Protection OFF

4) Ransomware Protection OFF

I'm sorry, I did not try just 1 or 2, figured I'd start maxed out OFF.  I'm afraid to let it keep BSOD b/c of what I say below for what happened to my VM.

As soon as I turned these off, the BOSD (like is screen capped later on) stopped.  I made no other changes.   The resaon I noticed this sequence is b/c I usually update first a VM, then it stated the BSOD.  And for some reason I cannot remember, something flagged MWAB as the cause, so I removed it from the system.  Then it would not cleanly uninstall, so then I used the MB-CLEAN to remove it all.  After that, the BSOD in the VM stopped.   However, now I cannot reinstall MWAB Pro 3.5.1 b/c it complains on the install with a really werid error. 

I'd say fix the BSOD first and then we can see why my reinstall is failing.  I have a feeling they are related.   Thanks!

Edited by gattaca
clarify
Link to post
Share on other sites
gattaca

gattaca

Posted
  • Author
Posted (edited)
18 hours ago, dcollins said:

@gattaca thanks for the logs. If possible, can you also zip up the file at C:\Windows\memory.dmp and attach it here or, if it's too large, use wetransfer.com to generate a download link. This will help us see why we BSOD'd the system. I can tell you that this is most likely from Web Protection, so you should be able to enable everything but that and not getting anymore blue screens.

@ColoradoGuy if you can provide the same logs requested above, and if you have a file at C:\Windows\memory.dmp please provide that as well. The more logs we have, the faster we can find a solution.

I'm not seeing a memory.dmp file in c:\windows.  could it be hiding somewhere else?  Thanks!   I also searched for on c:\  dir memory.dmp /s   No files found.

Edited by gattaca
Link to post
Share on other sites
risey

risey

Posted
Posted (edited)

Hi there, been googling over the last few days about this netio.sys bsod,  thought it was a geforce or a firefox problem, I also updated all network drivers just in case but the problem persists. A user at geforce forum asked me if I were using malwarbytes as some similar problems have been reported, came here and bang... thank god, thought It was going to take me ages to find out what is causing it but u guys have the same exact bsod. I have followed the instructions above and also attached the files requested originally by the admin for analysis. I also attached the Windows dump file but it seems small so not sure if all the info is there or has dumped correctly...

mbst-grab-results.zip

dump.zip

Edited by risey
Link to post
Share on other sites
risey

risey

Posted
Posted
12 hours ago, mark5211 said:

I'm running Malwarebytes Premium 3.5.1.2522 on a up to date Windows 10 system and I've found I've been getting this  netio.sys driver_irql_not_less_or_equal  blue screen every time I go on the http://www.dailymail.co.uk/home/index.html website, I've quit Malwarebytes and it works absolutely fine but as soon as it re-stared the PC crashes with a blue screen on this site, it started on Saturday but it crashes every time I go to this particular site.

 

MWB.JPG

Yeah its certain sites that trigger it, thought it was originally a firefox problem, but my own website seems to trigger it if viewing a certain page that has a flash player on it... 

Link to post
Share on other sites
  • Staff
dcollins

dcollins

Posted
  • Staff
Posted (edited)

@risey can you let me know one of the sites you're seeing this with? And thanks for the logs! Can you upload the full dump at C:\Windows\memory.dmp by chance? The minidump unfortunately doesn't have the needed information. You will probably need to zip the file and use wetransfer.com to generate a download link

Edited by dcollins
Link to post
Share on other sites
risey

risey

Posted
Posted (edited)
3 hours ago, dcollins said:

@risey can you let me know one of the sites you're seeing this with? And thanks for the logs! Can you upload the full dump at C:\Windows\memory.dmp by chance? The minidump unfortunately doesn't have the needed information. You will probably need to zip the file and use wetransfer.com to generate a download link

Hi there, cant seem to find the full memory dmp, maybe it did not complete as I remember it hanging at 100% at the time then I hard reset the PC, if it does it again i shall upload it to my server / website. The page that triggered it for me was a link to a page on my website, the particular page has a flash music player by Wimpy which is this one, the browser I mainly use is Firefox latest version. http://phatmonkey.me/#xl_xr_page_new project

 

Edited by risey
Link to post
Share on other sites
FlySwatter

FlySwatter

Posted
Posted (edited)

Just to chime in, I'm running Win 10 Pro version 1709 and since upgrading to Malwarebytes 3.5.1 I have been experiencing what appear to be similar BSODs referencing NETIO.SYS.

They have only occurred when I run Oracle VirtualBox version 5.2.8 or 5.2.12 (the latest version) to host a Windows XP session.

(To clarify, there is no Malwarebytes running under XP in the virtual session.)

The Win 10 BSODs seem to be triggered by network activity from within the VirtualBox session.

If I quit Malwarebytes then all is stable again.

Thanks for your help!

 

Edited by FlySwatter
Link to post
Share on other sites
FlySwatter

FlySwatter

Posted
Posted

The Win 10 PC is on a corporate Domain. The reason for the VirtualBox XP session is to run an (ancient) HVAC management application across the LAN. I don't believe this would involve any traffic gatewayed to the Internet. The Win 10 BSOD  does not occur immediately. I have never had it occur during the Win XP boot sequence. It is generally after the start of the HVAC app, maybe a minute or two. I'm not in the same place in the app when it happens but it always seems to be just as I have clicked on something to interact across the LAN. The XP session is never used for anything else so the network traffic is fairly specific to HVAC management for the building.

Link to post
Share on other sites
risey

risey

Posted
Posted
1 hour ago, dcollins said:

@FlySwatter is it any networking activity, or just some?

@risey does it happen everytime you access that link, or just sometimes?

It is random when visiting that URL., I have tried to force it to get the memory dump but nothing yet

Link to post
Share on other sites
FlySwatter

FlySwatter

Posted
Posted
2 hours ago, dcollins said:

Thanks @FlySwatter. Does the XP VM have all updates installed, and if it does, is it using the XP POS2009 hack  to continue getting updates?

The VM is running XP SP3 with no further updates or hacks installed or allowed. Remember when we still had control over Windows Update?!! (Yes, I know the risk but the HVAC app is very adverse to change. That and the VM is usually only run a couple times a month for ~10 minutes.)

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

  I accept