BSOD playing WoW, error 0x0000007e and error 0x000000D6

Smilemoar · 10 Feb 2013

Hello,

Over the last few months I have encountered repeated BSOD crashes on my desktop. The two error codes I got before my computer reset (like lighting fast) was error 0x0000007e and error 0x000000D6.

I have had previous crashes (BSOD) but not this frequently and I occasionally (as in like once/twice in a few months) get video driver crashes (yet apparently I am up to date driver-wise).

I have noticed a lot that these crashes seem to occur when I am running world of warcraft (haters gonna hate etc) or when I am using google chrome on multiple windows.

Attached is the requested zip file with all the logs and details etc as per the instructions at the top of this forum.

Any help you guys could give would be appreciated :)

koolkat77 · 11 Feb 2013

Did you ever check this thread?

https://www.sevenforums.com/crashes-d...ml#post2174612

And please disable driver verifier as it may create false BSOD-s

Driver Verifier - Enable and Disable

Smilemoar · 11 Feb 2013

Yes I did and I completed it all (as far as I know) and it worked for the issue I was getting :)

Daemon Tools was the specific cause in that case :/

But this doesn't seem to be giving me the same crash messages, for example it has actually given me crash logs this time where as before it hasn't. And as I mentioned I have it seems to be directly related to doing specific activities this time before was just at random times.

If this is somehow still related to the original issue then by all means enlighten me :) as I am only going off what I can see which (to me at least) appears different this time in cause.

Edit - Disabled verifier although it said "no changes were made" so not sure if that's meaningful or something.

koolkat77 · 11 Feb 2013

Smilemoar said:

Yes I did and I completed it all (as far as I know) and it worked for the issue I was getting :)

Daemon Tools was the specific cause in that case :/

But this doesn't seem to be giving me the same crash messages, for example it has actually given me crash logs this time where as before it hasn't. And as I mentioned I have it seems to be directly related to doing specific activities this time before was just at random times.

If this is somehow still related to the original issue then by all means enlighten me :) as I am only going off what I can see which (to me at least) appears different this time in cause.

It does not look like you have carried out all steps mentioned in that thread but anyway:
If you are overclocking any hardware, STOP. Reset any changed values back to default.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D6, {fffff980014fd000, 0, fffff88004bb3192, 0}

*** WARNING: Unable to verify timestamp for ATITool64.sys
*** ERROR: Module load completed but symbols could not be loaded for ATITool64.sys

Could not read faulting driver name
Probably caused by : ATITool64.sys ( ATITool64+6192 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION (d6)
N bytes of memory was allocated and more than N bytes are being referenced.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff980014fd000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: fffff88004bb3192, if non-zero, the address which referenced memory.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036c3100
GetUlongFromAddress: unable to read from fffff800036c31c0
 fffff980014fd000 

FAULTING_IP: 
ATITool64+6192
fffff880`04bb3192 66833800        cmp     word ptr [rax],0

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xD6

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800356fb30 -- (.trap 0xfffff8800356fb30)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff980014fd000 rbx=0000000000000000 rcx=fffff88004bb30fb
rdx=0000000000000046 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88004bb3192 rsp=fffff8800356fcc0 rbp=0000000000000010
 r8=0000000000000000  r9=fffff88003570250 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
ATITool64+0x6192:
fffff880`04bb3192 66833800        cmp     word ptr [rax],0 ds:fffff980`014fd000=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000343c9fc to fffff80003490c40

STACK_TEXT:  
fffff880`0356f9c8 fffff800`0343c9fc : 00000000`00000050 fffff980`014fd000 00000000`00000000 fffff880`0356fb30 : nt!KeBugCheckEx
fffff880`0356f9d0 fffff800`0348ed6e : 00000000`00000000 fffff980`014fd000 00000000`00000000 fffff980`014fcff0 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`0356fb30 fffff880`04bb3192 : 00000001`0000000b 00000170`00000000 ffff0001`0000000b 00000170`0000000d : nt!KiPageFault+0x16e
fffff880`0356fcc0 00000001`0000000b : 00000170`00000000 ffff0001`0000000b 00000170`0000000d fffff880`03571000 : ATITool64+0x6192
fffff880`0356fcc8 00000170`00000000 : ffff0001`0000000b 00000170`0000000d fffff880`03571000 fffff880`0356b000 : 0x00000001`0000000b
fffff880`0356fcd0 ffff0001`0000000b : 00000170`0000000d fffff880`03571000 fffff880`0356b000 00000007`00000010 : 0x00000170`00000000
fffff880`0356fcd8 00000170`0000000d : fffff880`03571000 fffff880`0356b000 00000007`00000010 ffffffff`00000000 : 0xffff0001`0000000b
fffff880`0356fce0 fffff880`03571000 : fffff880`0356b000 00000007`00000010 ffffffff`00000000 00000000`00000000 : 0x00000170`0000000d
fffff880`0356fce8 fffff880`0356b000 : 00000007`00000010 ffffffff`00000000 00000000`00000000 fffff880`03570250 : 0xfffff880`03571000
fffff880`0356fcf0 00000007`00000010 : ffffffff`00000000 00000000`00000000 fffff880`03570250 fffff880`00000001 : 0xfffff880`0356b000
fffff880`0356fcf8 ffffffff`00000000 : 00000000`00000000 fffff880`03570250 fffff880`00000001 fffff800`036ba300 : 0x00000007`00000010
fffff880`0356fd00 00000000`00000000 : fffff880`03570250 fffff880`00000001 fffff800`036ba300 00000000`00000000 : 0xffffffff`00000000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ATITool64+6192
fffff880`04bb3192 66833800        cmp     word ptr [rax],0

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  ATITool64+6192

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ATITool64

IMAGE_NAME:  ATITool64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  46b9f272

FAILURE_BUCKET_ID:  X64_0xD6_VRF_ATITool64+6192

BUCKET_ID:  X64_0xD6_VRF_ATITool64+6192

Followup: MachineOwner
---------

4: kd> lmvm ATITool64
start             end                 module name
fffff880`04bad000 fffff880`04bbb000   ATITool64 T (no symbols)           
    Loaded symbol image file: ATITool64.sys
    Image path: \SystemRoot\system32\DRIVERS\ATITool64.sys
    Image name: ATITool64.sys
    Timestamp:        Wed Aug 08 22:42:26 2007 (46B9F272)
    CheckSum:         0001540C
    ImageSize:        0000E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Code:

Start Menu\Programs\ATITool	Public:Start Menu\Programs\ATITool	Public

This is overclocking software and can lead to system instability and BSOD's. Please reset all components to their stock speeds and then remove the software.

Recommendations:

Code:

Start Menu\Programs\avast! Free Antivirus	Public:Start Menu\Programs\avast! Free Antivirus	Public
Start Menu\Programs\Spybot - Search & Destroy	Public:Start Menu\Programs\Spybot - Search & Destroy	Public

I'd suggest you to uninstall Avast! and use Microsoft security essentials at least to test.

avast! Uninstall Utility | Download aswClear for avast! Removal
Microsoft Security Essentials - Microsoft Windows

The rest of the BSOD-s (newest) were caused by Sierra Wireless NDIS Driver

Code:

*** WARNING: Unable to verify timestamp for swnc8ua3.sys
*** ERROR: Module load completed but symbols could not be loaded for swnc8ua3.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80003613617, fffff8800d989588, fffff8800d988de0}

Probably caused by : swnc8ua3.sys ( swnc8ua3+2c4ea )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80003613617, The address that the exception occurred at
Arg3: fffff8800d989588, Exception Record Address
Arg4: fffff8800d988de0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExAllocatePoolWithTag+537
fffff800`03613617 48895808        mov     qword ptr [rax+8],rbx

EXCEPTION_RECORD:  fffff8800d989588 -- (.exr 0xfffff8800d989588)
ExceptionAddress: fffff80003613617 (nt!ExAllocatePoolWithTag+0x0000000000000537)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8800d988de0 -- (.cxr 0xfffff8800d988de0)
rax=400000000fa74490 rbx=fffff8000366f500 rcx=fffffa800d9d8ab0
rdx=0000000000000000 rsi=0000000000000009 rdi=0000000000000000
rip=fffff80003613617 rsp=fffff8800d9897c0 rbp=0000000000001000
 r8=0000000000000000  r9=fffff8000366f500 r10=fffff8000366f348
r11=0000000000000006 r12=fffff8000366f340 r13=0000000000000000
r14=0000000000000000 r15=00000000454d7878
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!ExAllocatePoolWithTag+0x537:
fffff800`03613617 48895808        mov     qword ptr [rax+8],rbx ds:002b:40000000`0fa74498=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003717100
GetUlongFromAddress: unable to read from fffff800037171c0
 ffffffffffffffff 

FOLLOWUP_IP: 
swnc8ua3+2c4ea
fffff880`079c94ea ??              ???

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff880079c94ea to fffff80003613617

STACK_TEXT:  
fffff880`0d9897c0 fffff880`079c94ea : 00000000`00000000 fffffa80`0f015000 fffff880`03169040 fffff880`00000000 : nt!ExAllocatePoolWithTag+0x537
fffff880`0d9898b0 00000000`00000000 : fffffa80`0f015000 fffff880`03169040 fffff880`00000000 00000000`00000000 : swnc8ua3+0x2c4ea


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  swnc8ua3+2c4ea

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: swnc8ua3

IMAGE_NAME:  swnc8ua3.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d701941

STACK_COMMAND:  .cxr 0xfffff8800d988de0 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_swnc8ua3+2c4ea

BUCKET_ID:  X64_0x7E_swnc8ua3+2c4ea

Followup: MachineOwner
---------

0: kd> lmvm swnc8ua3
start             end                 module name
fffff880`0799d000 fffff880`079e2000   swnc8ua3 T (no symbols)           
    Loaded symbol image file: swnc8ua3.sys
    Image path: \SystemRoot\system32\DRIVERS\swnc8ua3.sys
    Image name: swnc8ua3.sys
    Timestamp:        Fri Mar 04 04:42:09 2011 (4D701941)
    CheckSum:         0004C71D
    ImageSize:        00045000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

I recommend updating its drivers and seeing if the BSOD-s stop. If not, unplug this device and/or remove all software related to it and let us know if the BSOD-s reoccur.

Sometimes drivers remain, not completely uninstalled. Follow this tutorial for complete removal of drivers of the particular program:

How to Clean Left Over Driver Files with Driver Sweeper

Driver Reference Table - swnc8ua3.sys

Good luck to you.

Smilemoar · 11 Feb 2013

koolkat77 said:

It does not look like you have carried out all steps mentioned in that thread but anyway:
If you are overclocking any hardware, STOP. Reset any changed values back to default.

Well I'll go through the list again along with these other steps :/ Not calling anyone liars or anything just saying I did go through the list before only thing I put back was Avast as it didn't seem to be causing it.

However I'll do all this and get back to you.

koolkat77 said:

This is overclocking software and can lead to system instability and BSOD's. Please reset all components to their stock speeds and then remove the software.

I am unaware of any overclocking besides an option called "overdrive" which was on. Besides that it seems the ATI tool has no settings applied that aren't listed as "default". Should I just uninstall it in this case?

koolkat77 · 11 Feb 2013

Sorry but I'm not calling no one a liar. As in my post #3 here

I posted a text in the code box like this:

Code:

fffff880`025fd8e8  fffff880`0446fe68Unable to load image \SystemRoot\System32\Drivers\aswSnx.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSnx.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswSnx.SYS
 aswSnx+0x7e68

The driver highlighted in red is from avast! Virtualization Driver, Peruse description here: Driver Reference Table - aswSnx.SYS.

All I do is analyze the reports you have submitted and post what I find from them.

The PC is yours so it's up to you what you do with it.

Sorry once again.

koolkat77 · 11 Feb 2013

Smilemoar said:

I am unaware of any overclocking besides an option called "overdrive" which was on. Besides that it seems the ATI tool has no settings applied that aren't listed as "default". Should I just uninstall it in this case?

Yes you should as it caused a BSOD with verifier enabled as shown on my post # 4

Smilemoar · 11 Feb 2013

Ok update.

I have completed all the steps again in the previous thread and the ones you have suggested here.

The only thing I couldn't do it find a driver update for the sierra wireless card but I did find a firmware update and downloaded the program again from the site to ensure it was as up to date as possible.

So far I have had no crashes, if I do have any then I will try removing the driver entirely and seeing if it still occurs. If I have any new crashes I'll load up the logs again and go from there.

Thank you for help :)

Arc · 11 Feb 2013

OK ... if any further issues occur, let us know.