Thread Info
  • State Not Answered
  • +11 person also asked this people also asked this
  • Locked Locked
  • Replies 119 replies
  • Subscribers 44 subscribers
  • Views 35314 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Multiple computers getting netio.sys BSOD after 2022.2.1.9 update

BBallLAL

We're having an outbreak of DRIVER_IRQL_NOT_LESS_OR_EQUAL BSOD's in driver NETIO.SYS. Netio.sys caused BSOD's are usually tied to network drivers but that doesn't make sense because this started happening all of a sudden on multiple computers. These are fully patched/updated Windows 10 Pro computers. The common thing we're seeing is Sophos was updated to version 2022.2.1.9 around 7/20/22 on all of them. Any insight from Sophos on if the blue screen of death crashes are being caused by the latest version of Sophos? 



This thread was automatically locked due to age.
  • 0

    Hi BBallLAL,

    Thanks for reaching out to us. 

    I strongly suggest opening a support case with our team so that this can be looked into further. Please let me know if it's possible to replicate this issue when performing specific actions on the device or if this happens sporadically. 

    I also recommend gathering a full memory dump on a device where this issue is present so that it can be provided when opening a case. If you only have a minidump file, this will allow us to gather some initial information to start out.

    I am not seeing any support cases opened about this issue currently.

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0

    Please post if you notice this on specific Device Models and / or network interfaces.

  • 0

    I am seeing identical behavior with my laptop since updating to 2022.2.1.9 on 7/25/2022.  It is a Dell Latitude 7400 running Windows 10 Enterprise with all updates installed.

  • 0

    Our computers are also Dell's....OptiPlex 9020 desktops. The NIC's are Intel I217-LM. We're also using the Cisco AnyConnect client for VPN, are you guys using that as well?

  • 0 in reply to BBallLAL

    Yep, Cisco AnyConnect Client version 4.6.04056.  My Network Adapter is Intel Wireless-AC 9560.

  • 0 in reply to rwebb

    Well I think we've found a common theme. We're updating to the latest version of Cisco AnyConnect (4.10.05111) to see if that helps. 

  • 0 in reply to rwebb

    Updating to the latest version of Cisco AnyConnect didn't help. By chance are your users using RingCentral?

  • 0 in reply to BBallLAL

    No, not using RingCentral.  Sorry to hear that updating AnyConnect didn't help -- I'm still running the 4.6 version.  Curiously, my machines hasn't crashed today (yet).

  • 0

    If you are experiencing this issue, please check the following:

    If your system is joined to the EAP, please turn off IPS in the Threat Protection policy and save, OR remove the system from the EAP and then test.

    We have seen some network drivers cause a conflict with IPS when running at a lower level (For modern standby support), which was part of the 2022.1 and higher releases. This can then cascade into a problem with core windows drivers. These appear to be heavily network adapter chipset and driver specific.

    James Magnan
    Technical Team Lead, Global Escalations

  • 0 in reply to JamesM-Sophos

    We have not joined any early access programs. I've created a custom Threat Protection policy that disables the following:

    Real-time Scanning - Local Files and Network Shares

    Real-time Scanning - Internet

    Protect critical functions in web browsers (Safe Browsing)

    Protect web browsers

    Protect web browser plugins

    Protect network traffic

    AMSI Protection

    We still continue to experience random crashes. Sophos Support hasn't replied since I provided SDU logs yesterday. This has become a big problem. 

Unfiltered HTML