求助win7专业版NETIO.SYS蓝屏代码分析

jym1989

使用WinDBG分析minidump
Probably caused by : NETIO.SYS
点开Debugging Details, 没有找到具体的PROCESS_NAME
有大神帮忙分析下到底是哪个进程导致蓝屏重启的吗, 谢谢了

1. 
   
2. Microsoft (R) Windows Debugger Version 6.7.0005.1
   
3. Copyright (c) Microsoft Corporation. All rights reserved.
   
4. 
   
5. 
   
6. Loading Dump File [C:\012619-11824-01.dmp]
   
7. Mini Kernel Dump File: Only registers and stack trace are available
   
8. 
   
9. Symbol search path is: C:\WINDOWS\Symbols
   
10. Executable search path is:
    
11. Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
    
12. *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    
13. Windows Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
    
14. Product: WinNt, suite: TerminalServer SingleUserTS
    
15. Built by: 7601.17514.x86fre.win7sp1_rtm.101119-1850
    
16. Kernel base = 0x84040000 PsLoadedModuleList = 0x8418a850
    
17. Debug session time: Sat Jan 26 12:33:28.378 2019 (GMT+8)
    
18. System Uptime: 0 days 2:25:23.705
    
19. Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
    
20. *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    
21. Loading Kernel Symbols
    
22. ................................................................................................................................................
    
23. Loading User Symbols
    
24. Loading unloaded module list
    
25. ......
    
26. Unable to load image \SystemRoot\system32\drivers\NETIO.SYS, Win32 error 0n2
    
27. *** WARNING: Unable to verify timestamp for NETIO.SYS
    
28. *** ERROR: Module load completed but symbols could not be loaded for NETIO.SYS
    
29. *******************************************************************************
    
30. * *
    
31. * Bugcheck Analysis *
    
32. * *
    
33. *******************************************************************************
    
34. 
    
35. Use !analyze -v to get detailed debugging information.
    
36. 
    
37. BugCheck D1, {0, 2, 0, 847a031c}
    
38. 
    
39. *** WARNING: Unable to verify timestamp for ndis.sys
    
40. Unable to load image \SystemRoot\System32\drivers\tcpip.sys, Win32 error 0n2
    
41. *** WARNING: Unable to verify timestamp for tcpip.sys
    
42. Unable to load image \SystemRoot\system32\DRIVERS\e1d6232.sys, Win32 error 0n2
    
43. *** WARNING: Unable to verify timestamp for e1d6232.sys
    
44. *** ERROR: Module load completed but symbols could not be loaded for e1d6232.sys
    
45. Probably caused by : NETIO.SYS ( NETIO+731c )
    
46. 
    
47. Followup: MachineOwner
    
48. ---------
    
49. 
    
50. 0: kd> !analyze -v
    
51. *******************************************************************************
    
52. * *
    
53. * Bugcheck Analysis *
    
54. * *
    
55. *******************************************************************************
    
56. 
    
57. DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    
58. An attempt was made to access a pageable (or completely invalid) address at an
    
59. interrupt request level (IRQL) that is too high. This is usually
    
60. caused by drivers using improper addresses.
    
61. If kernel debugger is available get stack backtrace.
    
62. Arguments:
    
63. Arg1: 00000000, memory referenced
    
64. Arg2: 00000002, IRQL
    
65. Arg3: 00000000, value 0 = read operation, 1 = write operation
    
66. Arg4: 847a031c, address which referenced memory
    
67. 
    
68. Debugging Details:
    
69. ------------------
    
70. 
    
71. 
    
72. READ_ADDRESS: 00000000
    
73. 
    
74. CURRENT_IRQL: 2
    
75. 
    
76. FAULTING_IP:
    
77. NETIO+731c
    
78. 847a031c 8b38 mov edi,dword ptr [eax]
    
79. 
    
80. CUSTOMER_CRASH_COUNT: 1
    
81. 
    
82. DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
    
83. 
    
84. BUGCHECK_STR: 0xD1
    
85. 
    
86. LAST_CONTROL_TRANSFER: from 847a031c to 840815cb
    
87. 
    
88. STACK_TEXT:
    
89. 841683ec 847a031c badb0d00 8747001f 00000001 nt!MmCopyToCachedPage+0x2b
    
90. WARNING: Stack unwind information not available. Following frames may be wrong.
    
91. 8416847c 8479af60 87479740 00000002 884b9cb8 NETIO+0x731c
    
92. 84168494 847a0230 87479740 841684c8 884b9cb8 NETIO+0x1f60
    
93. 841684ac 847a0284 87479740 841684c8 0000001c NETIO+0x7230
    
94. 841684cc 8c72ad2c 841684e8 00000000 884b9cb8 NETIO+0x7284
    
95. 841684e0 8cabedd5 0000002a 0000001c 0000000e ndis!NdisMInitializeTimer+0x48
    
96. 84168504 8cabee4e 84168544 0000002a 0000000e tcpip!_NULL_IMPORT_DESCRIPTOR <PERF> (tcpip+0x89dd5)
    
97. 8416853c 8cacc894 884b9c18 8890f064 88884fa6 tcpip!_NULL_IMPORT_DESCRIPTOR <PERF> (tcpip+0x89e4e)
    
98. 8416855c 8cacc8e5 8416856c 88884fa6 8890aa90 tcpip!_NULL_IMPORT_DESCRIPTOR <PERF> (tcpip+0x97894)
    
99. 84168580 8cab6302 88901498 88884fa0 8cb1eb44 tcpip!_NULL_IMPORT_DESCRIPTOR <PERF> (tcpip+0x978e5)
    
100. 841685a4 8cab1032 88901498 88884fa0 8cb1eb44 tcpip!_NULL_IMPORT_DESCRIPTOR <PERF> (tcpip+0x81302)
     
101. 84168634 8cab5ce6 8890aa90 888dd2e0 00000001 tcpip!_NULL_IMPORT_DESCRIPTOR <PERF> (tcpip+0x7c032)
     
102. 841686b0 8cab02fe 8890aa90 888dd2e0 00000000 tcpip!_NULL_IMPORT_DESCRIPTOR <PERF> (tcpip+0x80ce6)
     
103. 841686e4 840c9654 888dd2e0 acdccc54 8822a728 tcpip!_NULL_IMPORT_DESCRIPTOR <PERF> (tcpip+0x7b2fe)
     
104. 8416874c 8cab046c 8cab01e0 84168774 00000000 nt!FsRtlFindInTunnelCache+0x6a
     
105. 84168788 8c79118d 8890aa02 888dd200 00000000 tcpip!_NULL_IMPORT_DESCRIPTOR <PERF> (tcpip+0x7b46c)
     
106. 841687c0 8c77f5be 88908aa8 888dd2e0 00000000 ndis!_NULL_IMPORT_DESCRIPTOR <PERF> (ndis+0x6818d)
     
107. 841687e8 8c77f4b2 00000000 888dd2e0 874f30e0 ndis!_NULL_IMPORT_DESCRIPTOR <PERF> (ndis+0x565be)
     
108. 84168964 8c72ac1d 874f30e0 00000000 00000000 ndis!_NULL_IMPORT_DESCRIPTOR <PERF> (ndis+0x564b2)
     
109. 84168980 8c77f553 874f30e0 888dd2e0 00000000 ndis!NdisWriteErrorLogEntry+0x12
     
110. 841689a8 8c72ac78 874f30e0 888dd2e0 00000000 ndis!_NULL_IMPORT_DESCRIPTOR <PERF> (ndis+0x56553)
     
111. 841689d0 93f11782 874f30e0 888dd2e0 00000000 ndis!NdisWriteErrorLogEntry+0x7e
     
112. 841689f0 93f118e1 886d9000 888dd2e0 00000001 e1d6232+0x1f782
     
113. 84168a30 93f058ae 016d9000 886d9cc0 00000000 e1d6232+0x1f8e1
     
114. 84168ab4 93f0544f 886d9000 00000000 84168b40 e1d6232+0x138ae
     
115. 84168af4 93f05aa4 886d9000 00000000 00000000 e1d6232+0x1344f
     
116. 84168b10 8c77f892 886d9000 00000000 00000000 e1d6232+0x13aa4
     
117. 84168b50 8c72aa0f 8882d2e4 0082d1d0 00000000 ndis!_NULL_IMPORT_DESCRIPTOR <PERF> (ndis+0x56892)
     
118. 84168b78 840b81b5 8882d2e4 8882d1d0 00000000 ndis!NdisAllocatePacketPoolEx+0x49
     
119. 84168bd4 840b8018 8416bd20 84175380 00000000 nt!ExpSmallNPagedPoolLookasideLists+0x6b5
     
120. 84168c20 840b7e38 00000000 0000000e 00000000 nt!ExpSmallNPagedPoolLookasideLists+0x518
     
121. 84168c24 00000000 0000000e 00000000 00000000 nt!ExpSmallNPagedPoolLookasideLists+0x338
     
122. 
     
123. 
     
124. STACK_COMMAND: kb
     
125. 
     
126. FOLLOWUP_IP:
     
127. NETIO+731c
     
128. 847a031c 8b38 mov edi,dword ptr [eax]
     
129. 
     
130. SYMBOL_STACK_INDEX: 1
     
131. 
     
132. FOLLOWUP_NAME: MachineOwner
     
133. 
     
134. MODULE_NAME: NETIO
     
135. 
     
136. IMAGE_NAME: NETIO.SYS
     
137. 
     
138. DEBUG_FLR_IMAGE_TIMESTAMP: 4ce78963
     
139. 
     
140. SYMBOL_NAME: NETIO+731c
     
141. 
     
142. FAILURE_BUCKET_ID: 0xD1_NETIO+731c
     
143. 
     
144. BUCKET_ID: 0xD1_NETIO+731c
     
145. 
     
146. Followup: MachineOwner
     
147. ---------
     
148. 
     
149. 0: kd> lmvm NETIO
     
150. start end module name
     
151. 84799000 847d7000 NETIO T (no symbols)
     
152. Loaded symbol image file: NETIO.SYS
     
153. Image path: \SystemRoot\system32\drivers\NETIO.SYS
     
154. Image name: NETIO.SYS
     
155. Timestamp: Sat Nov 20 16:40:03 2010 (4CE78963)
     
156. CheckSum: 0003F253
     
157. ImageSize: 0003E000
     
158. Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
     

复制代码

15852701396

NETIO.SYS  貌似这个驱动的问题？卸载你最新安装的软件呢

jym1989

15852701396 发表于 2019-1-27 10:06
NETIO.SYS  貌似这个驱动的问题？卸载你最新安装的软件呢

谢谢你的回答. 因为没有头绪所以重装系统了

风之咩~

是不是弄了什么优化加速   我记得破解TCP半开连接数有几率会导致驱动蓝屏

jym1989

风之咩~ 发表于 2019-1-27 21:01
是不是弄了什么优化加速   我记得破解TCP半开连接数有几率会导致驱动蓝屏

应该没有, 是客户那的一台工作电脑
装了
金山毒霸企业版
中联lis
oracle数据库
radmin等
连入了内网, 没有禁用U盘, 所以也可能是中毒了