[SOLVED] [7UltSP1 x86] 1000007e c0000005 caused by NetIO.sys. Real cause: ZoneAlarm FW. FIX: Uninstall ZoneAlarm FW or update it.

[Docfxit]

I'm getting this BSOD. I received another one during the posting of this thread.

I tried following the BSOD instructions. When I tried to download SysnativeBSODCollectionApp.exe
with Firefox I received this web page:

After downloading the file with IE and running it I received this window:

I don't know why it doesn't recognize that I am running a version of Windows after Vista.
I have attached a few mini dumps.

This link shows all specs of the machine I am getting this error:
http://speccy.piriform.com/results/3dYzxB8d7hzBZzHmAEFk5DW

Thank you,
Docfxit

 

[Sysnative Windows Update]

Hello!

It looks like that ZoneAlarm is the root cause of your crashes. I would advise you to remove it from your system and monitor for crashes.

 

[Docfxit]

I didn't have ZoneAlarm running. I Uninstalled it anyways. Did you find ZoneAlarm in the mini dumps show that the cause was ZoneAlarm. I did find other people that reported Nvidia display driver file being the cause.

Thanks,
Docfxit

 

[Sysnative Windows Update]

Yes. Your Minidumps blamed ZoneAlarm, not nVidia.

 

[jcgriff2]

Hi. . .

I agree with softwaremaniac.

I processed all 4 of your dumps and the Zone Alarm driver vsdatant.sys was found on the stack in every dump.

Here is a listing of the kernel mode driver that was loaded into RAM - it is an old driver from 2017 too -

1: kd> lmDvm vsdatant
Browse full module list
start end module name
90ee0000 90f55000 vsdatant T (no symbols)
Loaded symbol image file: vsdatant.sys
Image path: vsdatant.sys
Image name: vsdatant.sys
Browse all global symbols functions data
Timestamp: Sat Mar 11 21:48:59 2017 (58C4B71B)
CheckSum: 0005F98E
ImageSize: 00075000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4

Driver Reference Table (DRT) | vsdatant.sys

Here is vsdatant.sys on the stack text -

1: kd> k
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be wrong.
00 8d4a8754 8b302648 NETIO!WfpStreamInspectRemoteDisconnect+0x155b
01 8d4a879c 8b3029fa NETIO!WfpStreamInspectRemoteDisconnect+0x1a28
02 8d4a87cc 8b302b15 NETIO!WfpStreamInspectRemoteDisconnect+0x1dda
03 8d4a880c 8b302f7b NETIO!WfpStreamInspectRemoteDisconnect+0x1ef5
04 8d4a8878 8b2f0f72 NETIO!WfpStreamInspectRemoteDisconnect+0x235b
05 8d4a88dc 8b2dbb3e NETIO!IoctlKfdDeleteIndex+0x339a
06 8d4a8950 8b2da21f NETIO!KfdAleInitializeFlowTable+0x15a
07 8d4a8a60 8b301baa NETIO!KfdClassify+0x129
08 8d4a8aec 8b3035e9 NETIO!WfpStreamInspectRemoteDisconnect+0xf8a
09 8d4a8b48 8b2fecdb NETIO!WfpStreamInspectRemoteDisconnect+0x29c9
0a 8d4a8b8c 8b55fc71 NETIO!FwppStreamInject+0xde
0b 8d4a8bc4 90eedf4d fwpkclnt!FwpsStreamInjectAsync0+0x93
0c 8d4a8c18 90eead9e vsdatant+0xdf4d
0d 8d4a8c30 90eeae94 vsdatant+0xad9e
0e 8d4a8c50 83a67639 vsdatant+0xae94
0f 8d4a8c90 8390b519 nt!PspSystemThreadStartup+0x9e
10 00000000 00000000 nt!KiThreadStartup+0x19

The stack is read from the bottom-->up, so you can see that netio.sys came after vsdatant.sys; hence the reason that netio.sys was listed on the actual blue screen and thus blamed for the BSOD. Since netio.sys is a Microsoft Windows driver, it is considered to be sacrosanct and is given a pass.

Try the Zone Alarm Removal Tool to rid your system of it - Download ZoneAlarm Uninstall Tool

Zone Alarm is notorious for causing BSODs. Likely what occurred here was that Zone Alarm was "phoning home" and interacted with the Microsoft Windows networking driver netio.sys and the BSOD ensued.

I wish all BSODs were this simple!

Regards. . .

jcgriff2

p.s. My apologies that you had problems with the jcgriff2/Sysnative BSOD app. We are aware of a problem with downloading it using Firefox and are working on correcting it.