Question
536 views

Windows 8 Blue Screen crash problem

Abrar Saudagar asked on

Whenever i start bitTorrent my windows 8 crashes and displays a blue screen showing error DRIVER_IRQL_NOT_LESS_OR_EQUAL (NETIO.SYS) and gets automatically restarted.

i had McAfee uninstalled and i also used the removal tool but still problem persists 

 help required !

Abrar_cool_dude
1 person had this question

Abuse history


The answered status icon Answer
Patrick Barker replied on

Great to hear!

Of course I can, very cool field to be in. You're going to love it!

Well, I've been a debugger for about 2 years or so, a bit more. Over time, I have seen a lot of various antiviruses cause a lot of crashes (AVG, avast!, Norton, ESET, Kaspersky, QuickHeal, etc...) you name it, I've seen it and solved it. Of all of the complexities to debugging I thankfully understand due to reading, and working a lot with crash dumps, the one thing I cannot confidently have an answer to is 'Why is (x) antivirus causing my blue screen?' because I simply do not know the 100% true answer, and it's not exactly easy to find it either. This may be due to the fact that there is not a single answer, but a combination of things.

Here are things I know are probably occurring from the problem antivirus that can possibly be causing the crashes:

- Invalid function calls.

- Attempts to access and/or reference invalid or pageable memory addresses.

- NETBIOS conflicts.

- Very specific user-based system conflicts. What do I mean? Well, think about it. If AVG, avast!, Norton, etc, caused crashes on every single system, they'd be in over their heads and out of business before they knew what hit them.

With this said, antivirus suites no matter the developer are always getting constant definition updates, and updates in general. If a certain user has a specific software installed that as of the latest definition or update is all of a sudden a conflict, corruption will occur, and you then have a crash.

Services also come into play as well.

- Most if not all modern antivirus software is allowed direct access to the kernel, and can do essentially whatever it pleases. It needs this access so it can intercept data like packets, files, and various critical data. You have to imagine with such access, as I said above, invalid calls and references can occur.

------------------

As far as QuickHeal goes? I couldn't really tell you, honestly. I just know it's causing corruption in your case, which is causing your crashes. In fact, every single QuickHeal case I've worked on removal and replacement was always the solution. I have never seen QuickHeal be fixed be a reinstall, or a newer version, etc. I think that's a question you'll need to direct to QuickHeal support, and hope you get a good answer.

If and when you are comfortable and feel your issue has been solved, I'd recommend marking any posts of mine that answered your question as answered so this thread no longer shows up as requiring an answer.

Regards,

Patrick

Debugger/Reverse Engineer.
1 person found this helpful

Abuse history


The answered status icon Answer
Patrick Barker replied on

Thanks!

All of the attached DMP files are of the DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) bug check.

This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high. This bug check is usually caused by drivers that have used improper addresses.

By default, the fault of the crashes is NETIO.sys which is the Network I/O Subsystem. This is not the true cause of the crash, and usually when we have network related crashes like this, it's caused by one of two things:

1. Network drivers themselves need to be updated.

2. 3rd party antivirus or firewall software causing NETBIOS conflicts.

-------------------

Please remove and replace QuickHeal with Windows 8's built-in Windows Defender as it's known to cause corruption and conflicts. I cannot count the amount of times in the last 1/2 months alone I've solved QuickHeal cases.

QuickHeal removal - http://www.quickheal.com/prod-rem

Windows Defender (enable after removing QuickHeal) - http://www.eightforums.com/tutorials/21962-windows-defender-turn-off-windows-8-a.html

Regards,

Patrick

Debugger/Reverse Engineer.
1 person found this helpful

Abuse history


progress