ANSWERED NETIO.SYS BSOD

[gattaca]

With this last Windows 10 update, I've been seeing multiple BSOD from the NetIO.SYS driver just as you have reported.  I am / was running the latest versions.

The only way I've been able to calm the system is to disable all of the real-time scanners in Malwarebytes first page.

I also had Malwarebytes Pro in a VM and it started do the same thing.. BSOD, BSOD.   It trapped that machine so many times I had to remove Malwarebytes. Then I used the clean-mb tool to remove, reboot etc.. after that the BSOD stopped...but now I cannot reinstall malwarebytes.  Getting a "Class not registered" error and I am using "Run as Admin".. Go figure.

There is something definitely up between even the latest Malwarebytes Pro and this last Windows 10 update which I applied recently. 

I also run SAV, and Webroot and never had a problem.  I've disabled those and they don't seem to be the culprit..

[dcollins]

Can you please provide the logs mentioned below:

1. Download and run Malwarebytes Support Tool. Click "Reveal Hidden Contents" below for more details:
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!"
6. Click the Advanced Options link
   
7. Click the Gather Logs button
   
8. A progress bar will appear and the program will proceed to gather troubleshooting information from your computer
9. Upon completion, click OK
10. A file named mbst-grab-results.zip will be saved to your Desktop
11. Please attach the file in your next reply.

[gattaca]

OK here's the one from the setup I did last.  Currently all the real time protections are disabled in malwarebytes and the BSOD have stopped.  I left it installed b/c after removing it and using the clean tool in the VM, I cannot get it to reinstall at all.   Later.  TY!

mbst-grab-results.zip

[ColoradoGuy]

38 minutes ago, gattaca said:

OK here's the one from the setup I did last.  Currently all the real time protections are disabled in malwarebytes and the BSOD have stopped. 

Gattaca, are you saying you turned off web, exploit, malware, and ransomware real time protection? If so, I will do the same, having multiple BSODs the last few days.  Did you try turning off only 1 or 2 of the protection settings?

FYI, I have Windows 10 updates and Malwarebytes 3.5.1 Premium, and having the same issues.

DCollins, any time estimate/expectation for addressing this?

Thx

[dcollins]

@gattaca thanks for the logs. If possible, can you also zip up the file at C:\Windows\memory.dmp and attach it here or, if it's too large, use wetransfer.com to generate a download link. This will help us see why we BSOD'd the system. I can tell you that this is most likely from Web Protection, so you should be able to enable everything but that and not getting anymore blue screens.

@ColoradoGuy if you can provide the same logs requested above, and if you have a file at C:\Windows\memory.dmp please provide that as well. The more logs we have, the faster we can find a solution.

[kimoh]

same issue here too.

I tried to provide the log but the file is too large 1.2gb

[davace9090]

I can confirm i've got this BSOD at least 5 times, when can we expect an update?

[Firefox]

50 minutes ago, kimoh said:

same issue here too.

I tried to provide the log but the file is too large 1.2gb

Make sure your zipping the file, then you can upload the log file to WeTransfer and provide the download link to the team so they can review it.

[dcollins]

If you are experiencing this issue, we could really benefit from two things on your machine:

1. Please zip up the file C:\Windows\memory.dmp and use wetransfer.com to generate a download link
2. Please also gather the logs mentioned below and attach them in your reply:

1. Download and run Malwarebytes Support Tool. Click "Reveal Hidden Contents" below for more details:
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!"
6. Click the Advanced Options link
   
7. Click the Gather Logs button
   
8. A progress bar will appear and the program will proceed to gather troubleshooting information from your computer
9. Upon completion, click OK
10. A file named mbst-grab-results.zip will be saved to your Desktop
11. Please attach the file in your next reply.

[mark5211]

I'm running Malwarebytes Premium 3.5.1.2522 on a up to date Windows 10 system and I've found I've been getting this  netio.sys driver_irql_not_less_or_equal  blue screen every time I go on the http://www.dailymail.co.uk/home/index.html website, I've quit Malwarebytes and it works absolutely fine but as soon as it re-stared the PC crashes with a blue screen on this site, it started on Saturday but it crashes every time I go to this particular site.

 

[gattaca]

23 hours ago, ColoradoGuy said:

Gattaca, are you saying you turned off web, exploit, malware, and ransomware real time protection? If so, I will do the same, having multiple BSODs the last few days.  Did you try turning off only 1 or 2 of the protection settings?

FYI, I have Windows 10 updates and Malwarebytes 3.5.1 Premium, and having the same issues.

DCollins, any time estimate/expectation for addressing this?

Thx

Yes sir.

Real Time Protections on the first page.  MWB Premium 3.5.1

1) Web Protection OFF

2) Exploit Protection OFF

3) Malware Protection OFF

4) Ransomware Protection OFF

I'm sorry, I did not try just 1 or 2, figured I'd start maxed out OFF.  I'm afraid to let it keep BSOD b/c of what I say below for what happened to my VM.

As soon as I turned these off, the BOSD (like is screen capped later on) stopped.  I made no other changes.   The resaon I noticed this sequence is b/c I usually update first a VM, then it stated the BSOD.  And for some reason I cannot remember, something flagged MWAB as the cause, so I removed it from the system.  Then it would not cleanly uninstall, so then I used the MB-CLEAN to remove it all.  After that, the BSOD in the VM stopped.   However, now I cannot reinstall MWAB Pro 3.5.1 b/c it complains on the install with a really werid error. 

I'd say fix the BSOD first and then we can see why my reinstall is failing.  I have a feeling they are related.   Thanks!

Edited June 11, 2018 by gattaca
clarify

[gattaca]

18 hours ago, dcollins said:

@gattaca thanks for the logs. If possible, can you also zip up the file at C:\Windows\memory.dmp and attach it here or, if it's too large, use wetransfer.com to generate a download link. This will help us see why we BSOD'd the system. I can tell you that this is most likely from Web Protection, so you should be able to enable everything but that and not getting anymore blue screens.

@ColoradoGuy if you can provide the same logs requested above, and if you have a file at C:\Windows\memory.dmp please provide that as well. The more logs we have, the faster we can find a solution.

I'm not seeing a memory.dmp file in c:\windows.  could it be hiding somewhere else?  Thanks!   I also searched for on c:\  dir memory.dmp /s   No files found.

Edited June 11, 2018 by gattaca

[dcollins]

@mark5211 can you provide the logs asked for above? And also, what browser are you using when you notice the crash?

[gattaca]

10 minutes ago, dcollins said:

@mark5211 can you provide the logs asked for above? And also, what browser are you using when you notice the crash?

FWIW, I use FF 95% of the time.  Always latest version, always up to date.  Verified as Quantum 64 bit 60.0.2. 

[mark5211]

2 hours ago, dcollins said:

@mark5211 can you provide the logs asked for above? And also, what browser are you using when you notice the crash?

Will upload logs tomorrow when I'm back on PC, I've used Edge & Firefox and it's happened on both.

[risey]

Hi there, been googling over the last few days about this netio.sys bsod,  thought it was a geforce or a firefox problem, I also updated all network drivers just in case but the problem persists. A user at geforce forum asked me if I were using malwarbytes as some similar problems have been reported, came here and bang... thank god, thought It was going to take me ages to find out what is causing it but u guys have the same exact bsod. I have followed the instructions above and also attached the files requested originally by the admin for analysis. I also attached the Windows dump file but it seems small so not sure if all the info is there or has dumped correctly...

mbst-grab-results.zip

dump.zip

Edited June 12, 2018 by risey

[risey]

12 hours ago, mark5211 said:

I'm running Malwarebytes Premium 3.5.1.2522 on a up to date Windows 10 system and I've found I've been getting this  netio.sys driver_irql_not_less_or_equal  blue screen every time I go on the http://www.dailymail.co.uk/home/index.html website, I've quit Malwarebytes and it works absolutely fine but as soon as it re-stared the PC crashes with a blue screen on this site, it started on Saturday but it crashes every time I go to this particular site.

 

Yeah its certain sites that trigger it, thought it was originally a firefox problem, but my own website seems to trigger it if viewing a certain page that has a flash player on it... 

[dcollins]

@risey can you let me know one of the sites you're seeing this with? And thanks for the logs! Can you upload the full dump at C:\Windows\memory.dmp by chance? The minidump unfortunately doesn't have the needed information. You will probably need to zip the file and use wetransfer.com to generate a download link

Edited June 12, 2018 by dcollins

[risey]

3 hours ago, dcollins said:

@risey can you let me know one of the sites you're seeing this with? And thanks for the logs! Can you upload the full dump at C:\Windows\memory.dmp by chance? The minidump unfortunately doesn't have the needed information. You will probably need to zip the file and use wetransfer.com to generate a download link

Hi there, cant seem to find the full memory dmp, maybe it did not complete as I remember it hanging at 100% at the time then I hard reset the PC, if it does it again i shall upload it to my server / website. The page that triggered it for me was a link to a page on my website, the particular page has a flash music player by Wimpy which is this one, the browser I mainly use is Firefox latest version. http://phatmonkey.me/#xl_xr_page_new project

 

Edited June 12, 2018 by risey

[FlySwatter]

Just to chime in, I'm running Win 10 Pro version 1709 and since upgrading to Malwarebytes 3.5.1 I have been experiencing what appear to be similar BSODs referencing NETIO.SYS.

They have only occurred when I run Oracle VirtualBox version 5.2.8 or 5.2.12 (the latest version) to host a Windows XP session.

(To clarify, there is no Malwarebytes running under XP in the virtual session.)

The Win 10 BSODs seem to be triggered by network activity from within the VirtualBox session.

If I quit Malwarebytes then all is stable again.

Thanks for your help!

 

Edited June 12, 2018 by FlySwatter

[dcollins]

@FlySwatter is it any networking activity, or just some?

@risey does it happen everytime you access that link, or just sometimes?

[FlySwatter]

The Win 10 PC is on a corporate Domain. The reason for the VirtualBox XP session is to run an (ancient) HVAC management application across the LAN. I don't believe this would involve any traffic gatewayed to the Internet. The Win 10 BSOD  does not occur immediately. I have never had it occur during the Win XP boot sequence. It is generally after the start of the HVAC app, maybe a minute or two. I'm not in the same place in the app when it happens but it always seems to be just as I have clicked on something to interact across the LAN. The XP session is never used for anything else so the network traffic is fairly specific to HVAC management for the building.

[dcollins]

Thanks @FlySwatter. Does the XP VM have all updates installed, and if it does, is it using the XP POS2009 hack  to continue getting updates?

[risey]

1 hour ago, dcollins said:

@FlySwatter is it any networking activity, or just some?

@risey does it happen everytime you access that link, or just sometimes?

It is random when visiting that URL., I have tried to force it to get the memory dump but nothing yet

[FlySwatter]

2 hours ago, dcollins said:

Thanks @FlySwatter. Does the XP VM have all updates installed, and if it does, is it using the XP POS2009 hack  to continue getting updates?

The VM is running XP SP3 with no further updates or hacks installed or allowed. Remember when we still had control over Windows Update?!! (Yes, I know the risk but the HVAC app is very adverse to change. That and the VM is usually only run a couple times a month for ~10 minutes.)