[SOLVED] BSOD while watching Netflix - Windows 8.1 x64

[basbleu]

Hello,

I hope someone could help me with this and I apologise in advance for my absolute ignorance of all this stuff..

Anyway, my laptop has crashed twice today while I was watching Netflix giving the system_service_exception error. It rebooted fine both times and seems to be working ok otherwise. This had happened once already, I think in May. On both occasions there were some Windows updates that had failed to update (not sure if it is connected).
I have disabled Windows updates for the moment and ran System File Checker - I saw it advised for a similar issue - and got this message that I am unsure what to do with:
Windows Resource Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log %WinDir%\Logs\CBS\CBS.log.

I don't know if that is relevant or not.


The laptop in less than five months old, it is a Dell Inspiron 3531 with Windows 8.1.

I am not sure if the laptop is safe to use until this is resolved so any advice will be much appreciated.

Here are the links for the files for analysis

DMP
https://onedrive.live.com/redir?resid=873F6F50C8F9D437!147&authkey=!AK9GgCKbAqLUwrQ&ithint=file,dmp
https://onedrive.live.com/redir?resid=873F6F50C8F9D437!146&authkey=!ACOzCtreLOdSwkQ&ithint=file,dmp


MSinfo32
https://onedrive.live.com/redir?resid=873F6F50C8F9D437!148&authkey=!AHxJCp0gdjEBzfw&ithint=file,nfo

sfcdetails
https://onedrive.live.com/redir?resid=873F6F50C8F9D437!149&authkey=!AFt7v7zaDsrcs6Q&ithint=file,txt

Thanks a million in advance!

 

[Patrick]

1: kd> .bugcheck
Bugcheck code 0000003B
Arguments 00000000`c0000005 fffff800`5a3bfeec ffffd000`2a005d40 00000000`00000000

1: kd> ln fffff8005a3bfeec
(fffff800`5a3bfe44)   NETIO!FwppCopyStreamDataToBuffer+0xa8   |  (fffff800`5a3bff24)   NETIO!FwppStreamContinue

The crash occurred due to an exception occurring in NETIO!FwppCopyStreamDataToBuffer+0xa8.

1: kd> kv
Child-SP          RetAddr           : Args to Child                                                           : Call Site
ffffd000`2a005488 fffff801`9d77a7e9 : 00000000`0000003b 00000000`c0000005 fffff800`5a3bfeec ffffd000`2a005d40 : nt!KeBugCheckEx
ffffd000`2a005490 fffff801`9d77a0fc : ffffd000`2a0056c0 fffff801`9d76b556 ffffd000`2a006c40 ffffd000`2a006538 : nt!KiBugCheckDispatch+0x69
ffffd000`2a0055d0 fffff801`9d7761ed : ffffd000`2a005d40 00000000`00000000 ffffd000`2a006538 ffffd000`2a005740 : nt!KiSystemServiceHandler+0x7c
ffffd000`2a005610 fffff801`9d6e70a5 : 00000000`00000001 fffff801`9d61e000 ffffd000`2a006501 fffff800`00000000 : nt!RtlpExecuteHandlerForException+0xd
ffffd000`2a005640 fffff801`9d6eb45e : ffffd000`2a006538 ffffd000`2a006240 ffffd000`2a006538 00000000`00000000 : nt!RtlDispatchException+0x1a5
ffffd000`2a005d10 fffff801`9d77a8c2 : ffffe000`1dbf6080 ffffd000`2a006480 00000000`00000000 fffff801`9d6713a7 : nt!KiDispatchException+0x646
ffffd000`2a006400 fffff801`9d779014 : 00000000`00000000 ffffd000`2a006860 00000354`86846b00 00000000`00000000 : nt!KiExceptionDispatch+0xc2
ffffd000`2a0065e0 fffff800`5a3bfeec : 00000000`00000000 00000000`00000000 00000000`00003de0 fffff801`9d6d5fe1 : nt!KiPageFault+0x214 (TrapFrame @ ffffd000`2a0065e0)
ffffd000`2a006770 fffff800`5a6ee9de : 00000000`00000000 00000000`00000000 ffffe000`1bd13b90 00000000`00000000 : NETIO!FwppCopyStreamDataToBuffer+0xa8
ffffd000`2a0067c0 fffff800`5a975b0a : ffffe000`1a4f29f0 fffff6fb`40084628 ffff4017`25bf32a9 fffff6fb`7dbed000 : fwpkclnt!FwpsCopyStreamDataToBuffer0+0x3e
ffffd000`2a0067f0 ffffe000`1a4f29f0 : fffff6fb`40084628 ffff4017`25bf32a9 fffff6fb`7dbed000 ffffe000`1e6c6760 : avgwfpa+0x8b0a

1: kd> .trap ffffd000`2a0065e0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd0002a0067c0 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8005a3bfeec rsp=ffffd0002a006770 rbp=0000000000003de0
 r8=ffffd0002255f8f0  r9=0000000000003de0 r10=ffffe0001ad0d010
r11=ffffd0002a0067b8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
NETIO!FwppCopyStreamDataToBuffer+0xa8:
fffff800`5a3bfeec 488b3f          mov     rdi,qword ptr [rdi] ds:00000000`00000000=????????????????

If we look at the trapframe regarding the unhandled exception in our NETIO function, we can see it was setting rdi to the value at rdi, maybe traversing a linked list.

1: kd> !pte rdi
                                           VA 0000000000000000
PXE at FFFFF6FB7DBED000    PPE at FFFFF6FB7DA00000    PDE at FFFFF6FB40000000    PTE at FFFFF68000000000
contains 01200001731F0867  contains 0000000000000000
GetUlongFromAddress: unable to read from fffff8019d98110c
pfn 1731f0    ---DA--UWEV  not valid

Invalid contents in rdi.

AVG's firewall driver called the FwpsCopyStreamDataToBuffer0 function to copy stream data to a buffer, but we go off the rails. Why? Probably because there's a bug in the AVG firewall driver, which isn't hard to believe given that they load crapware into their installers now (TuneUpUtilities), so why worry about good code?

Get rid of AVG.

 

[basbleu]

Hi Patrick,

Thanks so much for this. I did remove the AVG and watched Netflix for about 4 hrs yesterday and it worked fine.

Now, as I did not a single word of your post apart from "Get rid of AVG", I would have a couple of other questions if that is ok.

That System File Checker showed a number of corrupted files and I was wondering is that critical and can it be fixed?

And could you recommend any free antivirus instead of AVG. At the moment I only have Windows Defender.

Thank you so much again!

 

[Patrick]

That System File Checker showed a number of corrupted files and I was wondering is that critical and can it be fixed?

Critical? Probably not. Can it be fixed? Sure, go here. It may take awhile for a reply, be warned.

And could you recommend any free antivirus instead of AVG. At the moment I only have Windows Defender.

I wouldn't recommend any free av other than defender. I can name a major bug/vulnerability in just about all of the free ones. I tend to just use defender + malwarebytes free.

 

[basbleu]

thanks a million!