BSOD ntoskrnl.exe, 0xFFFFFFFFC0000005, help to diagnose??

Page 1 of 2 12 LastLast

  1. Posts : 5
    Win7 Pro 64 SP1
       #1

    BSOD ntoskrnl.exe, 0xFFFFFFFFC0000005, help to diagnose??


    I have merged the 3 threads into one as they are on the same Problem.

    Thanks much. Ok - Worth noting the system is a new Dell Precision workstation; as such the drives should be fine, but you never know. (you probably know that from the zip)

    • The SSD is a Samsung SM84. I will update the driver; however seems to be working fine.
    • Will run Seagate

    Will post anything new after these steps. Stay tuned...
    Last edited by Barman58; 10 Aug 2015 at 01:22.
      My Computer


  2. Posts : 15,026
    Windows 10 Home 64Bit
       #2

    Code:
    Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\KoolKat77\Downloads\MUSICSTUDIO-Sat_07_18_2015_120744_49\071715-16551-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.18869.amd64fre.win7sp1_gdr.150525-0603
    Machine Name:
    Kernel base = 0xfffff800`02e12000 PsLoadedModuleList = 0xfffff800`03059730
    Debug session time: Sat Jul 18 02:37:31.505 2015 (UTC + 6:00)
    System Uptime: 0 days 0:22:00.268
    Loading Kernel Symbols
    .
    
    Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
    Run !sym noisy before .reload to track down problems loading symbols.
    
    ..............................................................
    ................................................................
    ................................................
    Loading User Symbols
    Loading unloaded module list
    .......
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1E, {ffffffffc0000005, fffff8800d082600, 0, 0}
    
    *** WARNING: Unable to verify timestamp for IDSvia64.sys
    *** ERROR: Module load completed but symbols could not be loaded for IDSvia64.sys
    Probably caused by : IDSvia64.sys ( IDSvia64+5ab6b )
    
    Followup: MachineOwner
    ---------
    
    4: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    KMODE_EXCEPTION_NOT_HANDLED (1e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff8800d082600, The address that the exception occurred at
    Arg3: 0000000000000000, Parameter 0 of the exception
    Arg4: 0000000000000000, Parameter 1 of the exception
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c3100
    GetUlongFromAddress: unable to read from fffff800030c31c0
     ffffffffffffffff 
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    FAULTING_IP: 
    +3f7d000
    Unable to load image \SystemRoot\System32\Drivers\dump_iaStorA.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for dump_iaStorA.sys
    *** ERROR: Module load completed but symbols could not be loaded for dump_iaStorA.sys
    fffff880`0d082600 2835080d80f8    sub     byte ptr [dump_iaStorA+0x26530e (fffff880`0588330e)],dh
    
    EXCEPTION_PARAMETER2:  ffffffffffffffff
    
    BUGCHECK_STR:  0x1E_c0000005_R
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  2
    
    ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff80002fbdd1e to fffff80002e7e7c5
    
    CONTEXT:  fffff8800d082d80 -- (.cxr 0xfffff8800d082d80;r)
    rax=000000034f050000 rbx=0000000000000008 rcx=fffff880009cfb20
    rdx=4000000000000001 rsi=0000000000000004 rdi=0000000000000000
    rip=fffff80002e7e7c5 rsp=fffff8800d083760 rbp=fffff880009cfb20
     r8=4000000000000000  r9=fffff80002e12000 r10=fffff880009cfb20
    r11=fffff8800d083a20 r12=fffff8000301a580 r13=0000000000000000
    r14=0000000000000002 r15=000000004d43444e
    iopl=0         nv up ei pl nz na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
    nt!ExpInterlockedPopEntrySListFault16:
    fffff800`02e7e7c5 498b08          mov     rcx,qword ptr [r8] ds:002b:40000000`00000000=????????????????
    Last set context:
    rax=000000034f050000 rbx=0000000000000008 rcx=fffff880009cfb20
    rdx=4000000000000001 rsi=0000000000000004 rdi=0000000000000000
    rip=fffff80002e7e7c5 rsp=fffff8800d083760 rbp=fffff880009cfb20
     r8=4000000000000000  r9=fffff80002e12000 r10=fffff880009cfb20
    r11=fffff8800d083a20 r12=fffff8000301a580 r13=0000000000000000
    r14=0000000000000002 r15=000000004d43444e
    iopl=0         nv up ei pl nz na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
    nt!ExpInterlockedPopEntrySListFault16:
    fffff800`02e7e7c5 498b08          mov     rcx,qword ptr [r8] ds:002b:40000000`00000000=????????????????
    Resetting default scope
    
    STACK_TEXT:  
    fffff880`0d083760 fffff800`02fbdd1e : fffffa80`1a0200ff fffffa80`1b04ae38 00000000`00000000 fffffa80`1b04ae60 : nt!ExpInterlockedPopEntrySListFault16
    fffff880`0d083770 fffff880`053adb6b : 00000000`00000000 00000000`00000008 00000000`00000000 00000000`00000001 : nt!ExAllocatePoolWithTag+0xfe
    fffff880`0d083860 00000000`00000000 : 00000000`00000008 00000000`00000000 00000000`00000001 00000000`00000001 : IDSvia64+0x5ab6b
    
    
    FOLLOWUP_IP: 
    IDSvia64+5ab6b
    fffff880`053adb6b ??              ???
    
    SYMBOL_STACK_INDEX:  2
    
    SYMBOL_NAME:  IDSvia64+5ab6b
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: IDSvia64
    
    IMAGE_NAME:  IDSvia64.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  555129e8
    
    STACK_COMMAND:  .cxr 0xfffff8800d082d80 ; kb
    
    FAILURE_BUCKET_ID:  X64_0x1E_c0000005_R_IDSvia64+5ab6b
    
    BUCKET_ID:  X64_0x1E_c0000005_R_IDSvia64+5ab6b
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0x1e_c0000005_r_idsvia64+5ab6b
    
    FAILURE_ID_HASH:  {3d8db2d7-1773-a753-bbe5-6df9ab2a91f8}
    
    Followup: MachineOwner
    ---------
    
    4: kd> lmvm IDSvia64
    start             end                 module name
    fffff880`05353000 fffff880`053fe000   IDSvia64 T (no symbols)           
        Loaded symbol image file: IDSvia64.sys
        Image path: \??\C:\Program Files\Symantec.cloud\EndpointProtectionAgent\NortonData\21.5.0.19\Definitions\IPSDefs\20150716.001\IDSvia64.sys
        Image name: IDSvia64.sys
        Timestamp:        Tue May 12 04:15:04 2015 (555129E8)
        CheckSum:         000B0FDA
        ImageSize:        000AB000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Remove Norton for the time being. Install MSE.

    Microsoft Security Essentials is recommended from a strict BSOD perspective, compatibility & stability compared to other internet security software. Malwarebytes is a great combo to MSE. They are free and lightweight.

    Also uninstall your existing Antivirus software before you install MSE.

    Good and Free system security combination.

       Warning
    Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.



     Clean boot


    Reduce items at start-up. No software except anti-virus is required plus doing this improves the time for logging into windows:

    Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:
    • Click on the
    • Type CMD on Search
    • Left click and Run as Administrator
    • Type SFC /scannow

    Full tutorial here:

    Make scans with the following:

    Kaspersky TDSSKiller

    ESET online scanner:

    Run Disk Check on your Hard Drive for file system errors and bad sectors on it.

     Hard Drive Diagnostics


    • Double click and open my computer.
    • Right click on desired drive and hit properties.
    • Click on tools tab and Check now.


    Read complete instructions on the tutorial: Disk Check

    Other Tests:
     



      My Computer


  3. Posts : 26,863
    Windows 11 Pro
       #3

    Hello, sallman. I'll see if I can help. You have 2 other threads on this same issue. I am going to merge the 3 threads into one thread. I have looked at your last dumps and this is what I find.

    Code:
    Use !analyze -v to get detailed debugging information.
    BugCheck 1000007E, {ffffffffc0000005, fffff80002e817c5, fffff88003f9b5a8, fffff88003f9ae00}
    Probably caused by : netbt.sys ( netbt!LmGetFullPath+100 )
    Followup: MachineOwner
    Code:
    fffff880`03f9b3e8  fffff880`010910a8*** WARNING: Unable to verify timestamp for iaStorB.sys
    *** ERROR: Module load completed but symbols could not be loaded for iaStorB.sys
     iaStorB+0x6d0a8
    This is the Intel Rapid Storage Technology which is Intel's Raid driver.

    Code:
    fffff880`03f9ae48  fffff880`064e3730*** WARNING: Unable to verify timestamp for nvlddmkm.sys
    *** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
     nvlddmkm+0x21b730
    This is your Graphics driver

    Code:
    fffff880`03f9aaa0  fffff880`073c69d0Unable to load image \SystemRoot\system32\DRIVERS\athrx.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for athrx.sys
    *** ERROR: Module load completed but symbols could not be loaded for athrx.sys
     athrx+0x1689d0
    This is your Atheros network adapter driver

    Code:
    NTFS_FILE_SYSTEM (24)
        If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
        parameters are the exception record and context record. Do a .cxr
        on the 3rd parameter and then kb to obtain a more informative stack
        trace.
    Arguments:
    Arg1: 00000000001904fb
    Arg2: fffff88003fa8ef8
    Arg3: fffff88003fa8750
    Arg4: fffff80002ebf7c5
    Code:
    fffff880`03fa7040  fffff880`054dc008Unable to load image \SystemRoot\System32\Drivers\dump_iaStorA.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for dump_iaStorA.sys
    *** ERROR: Module load completed but symbols could not be loaded for dump_iaStorA.sys
     dump_iaStorA+0x87008

    The first dump file has a code of 7E which is typically related to storage problems, but not always. But that dump file specifically lists your Storage driver, your Graphics driver and your Network adaptor. The next dump file blames the file system and your storage driver dump file. The iaStor_Dump is responsible for creating space on your hard drive for writing the dump files to it, but apparently could not do so.

    This leads me to believe you have a problem with one of your hard drives. Would you please tell me the Manufacturer and Model of your SSD. Also, please make sure your SSD's Firmware is up to date and has the current. For your Mechanical hard drives, I would like you to run Seatools for DOS. SeaTools for DOS and Windows - How to Use, as well as check disk Disk Check. For your SSD does yours come with a tool box? If so, try to determine if it is working properly.
      My Computer


  4. Posts : 26,863
    Windows 11 Pro
       #4

    The majority of what I saw in the dump files were storage related. The code I listed in the first one, 7E is typically related to hard drives or storage system. The second one says the file system. The 2 are pretty related. The errors were from iaStor which is your hard drive's controller. If the hard drive is having read errors, that could explain the other driver faults. I saw numerous references to the NTFS file system and some I/O errors which both directly relate to the hard drive. They were not blamed but just shown as events that were occurring leading up to the BSOD. Everything put together is a good indication of a bad hard drive or corruption in the file system on the hard drive. I hope I explained that right. I am not saying that is definitely the cause, but just that is what it seems to be pointing at. It is going to be difficult to test your SSD. Most of the hard drive or file system tests we have are for spinning drives. SSDs write data completely different.
      My Computer


  5. Posts : 5
    Win7 Pro 64 SP1
    Thread Starter
       #5

    ok, great. thanks for looking into this.
    my "take-away" is this:
    1. based on the recent dump files, you DON'T think it's a third-party hardware driver (confirm?)
    2. you DO think it's a hard drive issue
    3. is there a way to isolate which drive is the prime suspect? (the OS is on the SSD, I have significant data on the 2nd WD spin drive which is often accessed when I'm working in Cubase)
    4. worth noting the SSD is a Samsung (as noted in prior post) but I've since discovered that it's a Samsung that is an OEM for Dell, meaning you can't use Samsung firmware to update. Has to come from Dell, I believe.

    I will run chkdsk and Seatools on all the drives, but device manager states all drives are healthy.
    more later. thanks again.
      My Computer


  6. Posts : 26,863
    Windows 11 Pro
       #6

    At this point, I do believe it is a Hard drive or problems with the file system. If all drives Check out, We will check other things. I think it fair to say, with computers, you can't rule out anything, but right now that's what it seems to me.
      My Computer


  7. Posts : 5
    Win7 Pro 64 SP1
    Thread Starter
       #7

    update 8-10


    BSOD again today, when launching Cubase. Prior to that, ran Seatools on all drives - clean scans.

    Below is the dump text from the most recent episode. Standard zip also attached.
    It has to be something, somewhere, associated with Cubase...not sure if it's a plug-in, a driver, or something else altogether.


    Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\Windows\Minidump\081015-17206-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    ************* Symbol Path validation summary **************
    Response Time (ms) Location
    Deferred srv*c:\localSymbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: srv*c:\localSymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.18869.amd64fre.win7sp1_gdr.150525-0603
    Machine Name:
    Kernel base = 0xfffff800`02e1a000 PsLoadedModuleList = 0xfffff800`03061730
    Debug session time: Mon Aug 10 16:39:21.632 2015 (UTC - 5:00)
    System Uptime: 0 days 0:12:07.506
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................
    Loading User Symbols
    Loading unloaded module list
    ........
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1E, {ffffffffc0000005, fffff8800d9334a0, 0, 0}

    *** WARNING: Unable to verify timestamp for athrx.sys
    *** ERROR: Module load completed but symbols could not be loaded for athrx.sys
    Probably caused by : nwifi.sys ( nwifi!Pt6Receive+296 )

    Followup: MachineOwner
    ---------

    4: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KMODE_EXCEPTION_NOT_HANDLED (1e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff8800d9334a0, The address that the exception occurred at
    Arg3: 0000000000000000, Parameter 0 of the exception
    Arg4: 0000000000000000, Parameter 1 of the exception

    Debugging Details:
    ------------------


    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030cb100
    GetUlongFromAddress: unable to read from fffff800030cb1c0
    ffffffffffffffff

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    FAULTING_IP:
    +0
    fffff880`0d9334a0 c843930d enter 9343h,0Dh

    EXCEPTION_PARAMETER2: ffffffffffffffff

    BUGCHECK_STR: 0x1E_c0000005_R

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

    PROCESS_NAME: System

    CURRENT_IRQL: 2

    ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

    LAST_CONTROL_TRANSFER: from fffff80002fc5d1e to fffff80002e867c5

    CONTEXT: fffff8800d933c20 -- (.cxr 0xfffff8800d933c20;r)
    rax=000000000f530002 rbx=fffffa800e127820 rcx=fffff880009cfb20
    rdx=400000001b354161 rsi=0000000000000004 rdi=0000000000000000
    rip=fffff80002e867c5 rsp=fffff8800d934600 rbp=fffff880009cfb20
    r8=400000001b354160 r9=fffff80002e1a000 r10=fffff880009cfb20
    r11=fffff88003939030 r12=fffff80003022580 r13=0000000000000000
    r14=0000000000000002 r15=0000000044416e49
    iopl=0 nv up ei pl nz na po nc
    cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
    nt!ExpInterlockedPopEntrySListFault16:
    fffff800`02e867c5 498b08 mov rcx,qword ptr [r8] ds:002b:40000000`1b354160=????????????????
    Last set context:
    rax=000000000f530002 rbx=fffffa800e127820 rcx=fffff880009cfb20
    rdx=400000001b354161 rsi=0000000000000004 rdi=0000000000000000
    rip=fffff80002e867c5 rsp=fffff8800d934600 rbp=fffff880009cfb20
    r8=400000001b354160 r9=fffff80002e1a000 r10=fffff880009cfb20
    r11=fffff88003939030 r12=fffff80003022580 r13=0000000000000000
    r14=0000000000000002 r15=0000000044416e49
    iopl=0 nv up ei pl nz na po nc
    cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
    nt!ExpInterlockedPopEntrySListFault16:
    fffff800`02e867c5 498b08 mov rcx,qword ptr [r8] ds:002b:40000000`1b354160=????????????????
    Resetting default scope

    STACK_TEXT:
    fffff880`0d934600 fffff800`02fc5d1e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExpInterlockedPopEntrySListFault16
    fffff880`0d934610 fffff880`0244701f : fffffa80`0e22be00 fffffa80`0e127820 fffffa80`0e24a000 fffffa80`0000000c : nt!ExAllocatePoolWithTag+0xfe
    fffff880`0d934700 fffff880`02484c39 : fffffa80`0e127820 00000000`00000000 fffffa80`1a2d2500 00000000`00000000 : tcpip!InetAllocateAndQueryAncillaryDataAf+0x5f
    fffff880`0d934750 fffff880`024847a5 : fffffa80`1a4546e0 fffffa80`1a2d2500 00000000`00000028 fffff880`0d9348e0 : tcpip!UdpBeginMessageIndication+0x209
    fffff880`0d934870 fffff880`0247f152 : 00000000`00000028 fffffa80`1a4546e0 fffffa80`0e127820 fffff880`0d934ab0 : tcpip!UdpDeliverDatagrams+0xd5
    fffff880`0d934a00 fffff880`0245af97 : fffffa80`1a070ba0 fffffa80`0e9e8100 62b22500`eb1478ed 00000000`00000000 : tcpip!UdpReceiveDatagrams+0x132
    fffff880`0d934aa0 fffff880`0245aaaa : 00000000`00000000 fffff880`02568800 fffff880`0d934c60 fffffa80`00000000 : tcpip!IppDeliverListToProtocol+0xf7
    fffff880`0d934b60 fffff880`0245a0a9 : 00000000`00000000 fffffa80`1bd127c0 00000000`00000002 fffff880`0d934c50 : tcpip!IppProcessDeliverList+0x5a
    fffff880`0d934c00 fffff880`02457d4f : 00000000`00000000 00000000`19eb4201 fffff880`02568800 fffff880`02568800 : tcpip!IppReceiveHeaderBatch+0x23a
    fffff880`0d934ce0 fffff880`02457322 : fffffa80`0ee9b570 00000000`00000000 fffffa80`19eb4201 00000000`00000001 : tcpip!IpFlcReceivePackets+0x64f
    fffff880`0d934ee0 fffff880`0245674a : fffffa80`19eb4270 fffff880`0d935010 fffffa80`19eb4270 fffff880`073d0001 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
    fffff880`0d934fc0 fffff800`02e9b1f8 : fffffa80`1bddad30 00000000`00004800 fffffa80`1b8d9640 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xda
    fffff880`0d935010 fffff880`02456e42 : fffff880`02456670 fffffa80`0e798a94 00000000`00000002 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
    fffff880`0d9350f0 fffff880`0230c0eb : fffffa80`0ee9c8d0 00000000`00000000 fffffa80`0e9e81a0 fffffa80`0e9e81a0 : tcpip!FlReceiveNetBufferListChain+0xb2
    fffff880`0d935160 fffff880`022d5ad6 : fffffa80`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb
    fffff880`0d9351d0 fffff880`022585d4 : fffffa80`0e9e81a0 00000000`00000002 00000000`00000001 fffffa80`1bddad30 : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6
    fffff880`0d935650 fffff880`02258549 : 00000000`00000000 00000000`00000000 fffffa80`1a06a810 00000000`00000001 : ndis!ndisMTopReceiveNetBufferLists+0x24
    fffff880`0d935690 fffff880`022584e0 : fffff880`0b7325c0 fffffa80`1a053010 fffffa80`1a06a810 00000000`00000001 : ndis!ndisFilterIndicateReceiveNetBufferLists+0x29
    fffff880`0d9356d0 fffff880`0b6fb7ee : fffffa80`1a053010 00000000`00000000 fffffa80`1bddad30 fffff880`0b7325c0 : ndis!NdisFIndicateReceiveNetBufferLists+0x50
    fffff880`0d935710 fffff880`02258549 : fffffa80`0f13abd0 00000000`00000000 00000000`00000001 fffff880`07310f9d : nwifi!Pt6Receive+0x296
    fffff880`0d935770 fffff880`022584e0 : 00000000`00000001 fffff880`04f490bc fffffa80`0f140028 fffff880`07855ff8 : ndis!ndisFilterIndicateReceiveNetBufferLists+0x29
    fffff880`0d9357b0 fffff880`04f459c0 : fffff880`04f4c110 00000000`00000001 00000000`00000001 fffffa80`0f140a78 : ndis!NdisFIndicateReceiveNetBufferLists+0x50
    fffff880`0d9357f0 fffff880`022710a7 : fffffa80`0e9e81a0 fffffa80`0f1383d0 fffffa80`0f1383d0 00000000`00000001 : vwififlt!FilterReceiveNetBufferLists+0x158
    fffff880`0d935850 fffff880`0728ce76 : fffffa80`0e9e81a0 00000000`00000000 00000000`00000000 00000000`00000000 : ndis! ?? ::FNODOBFM::`string'+0xcd8f
    fffff880`0d9358a0 fffffa80`0e9e81a0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000001 : athrx+0x19e76
    fffff880`0d9358a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000001 ffff0000`0aae556c : 0xfffffa80`0e9e81a0


    FOLLOWUP_IP:
    nwifi!Pt6Receive+296
    fffff880`0b6fb7ee 83a3e010000000 and dword ptr [rbx+10E0h],0

    SYMBOL_STACK_INDEX: 13

    SYMBOL_NAME: nwifi!Pt6Receive+296

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nwifi

    IMAGE_NAME: nwifi.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bcc3b

    IMAGE_VERSION: 6.1.7600.16385

    STACK_COMMAND: .cxr 0xfffff8800d933c20 ; kb

    FAILURE_BUCKET_ID: X64_0x1E_c0000005_R_nwifi!Pt6Receive+296

    BUCKET_ID: X64_0x1E_c0000005_R_nwifi!Pt6Receive+296

    ANALYSIS_SOURCE: KM

    FAILURE_ID_HASH_STRING: km:x64_0x1e_c0000005_r_nwifi!pt6receive+296

    FAILURE_ID_HASH: {503698b3-635e-efa2-ef24-9328f5ad0519}

    Followup: MachineOwner
    ---------

    4: kd> lmvm nwifi
    start end module name
    fffff880`0b6f2000 fffff880`0b745000 nwifi (pdb symbols) c:\localsymbols\nwifi.pdb\019E6C79A43F4BF687EB4758B35DBD8E1\nwifi.pdb
    Loaded symbol image file: nwifi.sys
    Mapped memory image file: c:\localsymbols\nwifi.sys\4A5BCC3B53000\nwifi.sys
    Image path: \SystemRoot\system32\DRIVERS\nwifi.sys
    Image name: nwifi.sys
    Timestamp: Mon Jul 13 19:07:23 2009 (4A5BCC3B)
    CheckSum: 00057B55
    ImageSize: 00053000
    File version: 6.1.7600.16385
    Product version: 6.1.7600.16385
    File flags: 0 (Mask 3F)
    File OS: 40004 NT Win32
    File type: 3.6 Driver
    File date: 00000000.00000000
    Translations: 0409.04b0
    CompanyName: Microsoft Corporation
    ProductName: Microsoft® Windows® Operating System
    InternalName: NWiFi.SYS
    OriginalFilename: NWiFi.SYS
    ProductVersion: 6.1.7600.16385
    FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
    FileDescription: NativeWiFi Miniport Driver
    LegalCopyright: © Microsoft Corporation. All rights reserved.
      My Computer


  8. Posts : 26,863
    Windows 11 Pro
       #8

    Sallman, As I am sure you know. This is all network related

    Code:
    Use !analyze -v to get detailed debugging information.
    BugCheck 1E, {ffffffffc0000005, fffff8800d9334a0, 0, 0}
    *** WARNING: Unable to verify timestamp for athrx.sys
    *** ERROR: Module load completed but symbols could not be loaded for athrx.sys
    Probably caused by : nwifi.sys ( nwifi!Pt6Receive+296 )
    Followup: MachineOwner
    athrx is your Atheros network adapter driver nwifi is provided by windows Update and is the Native WiFi Miniport Driver.

    Almost everything you posted there is tcpip, vwififlt (virtual wi fi filter driver) are all network related. Is it possible that your Cubase program is connecting to the internet, downloading or something like that or is there a compatibility problem with the network drivers? Did you uninstall Symantec?
      My Computer


  9. Posts : 5
    Win7 Pro 64 SP1
    Thread Starter
       #9

    First, thanks again for the assistance.
    Second, fascinating. Seems like each bsod comes with new circumstances, making it even harder to diagnose.
    To your questions:
    1. yes, I uninstalled Symantec. Using MS for now.
    2. yes, Cubase would try to connect to the internet on launch by default. That said, this episode is the first time that it has crashed during launch. All other times have been when the program is running and I have a file session open. I'm suspicious of other things simply because there are so many drivers and other interactions going on simultaneously within Cubase (midi data transfer, audio playback, timecode, plug-ins, etc) that I can't help but think there's something else going on. BUT, I know all we have to go from is what we see in the reports.\

    Questions:

    • How would I troubleshoot any potential conflicts with the network drivers?
    • what does this say, if anything, about prior bsod reports pointing to the drives as suspects? by all measures the drives have checked out okay.
      My Computer


  10. Posts : 26,863
    Windows 11 Pro
       #10

    Without going back and looking, this is about the third dump that network drivers have been named in dump reports. The last time when all indications were the hard drives, athrx was mentioned. But, since everything else was storage related, I assumed that it was probably a read error when the driver was requested from the hard drive. It was the only error which was not storage/hard drive related. Under any other circumstance, I would think this was a memory problem. When ram errors occur, whatever driver is most in use gets the blame. So, you end up getting different error codes and different drivers named each time. What that means, at least from my perspective, is a memory error is the worst thing that you can have. Because of what I just explained, the dump files cannot be relied upon. What we are seeing is typical of ram problems. The only exception is that yours all seem to be when Cubase is being used.

    To be quite honest, I am not familiar with how Cubase works. I know what it is, but not how it works. For example, in a gaming situation, there are a lot of drivers in use. But there are constant read/write operations going on to write data to and read from the hard drive. Much of that data is stored in ram until it is needed. If drivers are not involved in the crash, I tend to look at ram and hard drive, if I explained it right. My guess would be that Cubase is similar when in operation.

    We can run memtest86+ to test the ram and see if it is that and we can run Driver Verifier to check the drivers. With Driver Verifier, there is a small chance that we can get caught in a situation to where there is no option other than a clean install. We take every precaution to see to it that an install does not happen. It has never happened to me, but I feel obligated to explain that. What it does is put extra stress on the drivers in hopes that the offending driver will cause the computer to crash and catch the offending driver. It is probably the only time you will ever want the computer to BSOD. I would request that you do not do either of those tests until I give you instructions on exactly how to do them. The downside to the memory test is that with your 16 GB of ram, the test will take around 20 hours to run and the computer cannot be used during the test because the test is actually run out of ram and the OS is not even loaded. For my purposes, I would prefer to run the memory test first, for reasons that are obvious. From what I gather based on the questions you have been asking, I think you would prefer to run Driver Verifier. I will leave that up to you which we do. But in my opinion we need to do something that will narrow down what is going on. As it stands right now, you are correct. Every time it is something different. As a practical matter, we don't even know whether it is a driver problem, hardware problem or a driver conflict. Your third option is very time consuming but can be really telling. You can perform a clean startup or a diagnostic startup. Almost all programs and services are shut down on startup. You start enabling programs a couple at a time until you start having BSODs again. You will then know which programs are suspect and with a little work can determine which one it is. This is how, but it takes a lot of time. When you enable a program or service, you have to use the computer that way until you determine it is or is not causing a problem, then enable a few more. This explains it in step by step instructions. Troubleshoot Application Conflicts by Performing a Clean Startup

    I will leave it up to you, which route you would like to take. If you have any questions, please let me know.
      My Computer


 
Page 1 of 2 12 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 11:04.
Find Us