Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: BSOD ntoskrnl.exe, 0xFFFFFFFFC0000005, help to diagnose??

18 Jul 2015   #1
sallman

Win7 Pro 64 SP1
 
 
BSOD ntoskrnl.exe, 0xFFFFFFFFC0000005, help to diagnose??

I have merged the 3 threads into one as they are on the same Problem.

Thanks much. Ok - Worth noting the system is a new Dell Precision workstation; as such the drives should be fine, but you never know. (you probably know that from the zip)
  • The SSD is a Samsung SM84. I will update the driver; however seems to be working fine.
  • Will run Seagate
Will post anything new after these steps. Stay tuned...


My System SpecsSystem Spec
.
21 Jul 2015   #2
koolkat77

Microsoft Community Contributor Award Recipient

Windows 10 Home 64Bit
 
 

Code:
Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\KoolKat77\Downloads\MUSICSTUDIO-Sat_07_18_2015_120744_49\071715-16551-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18869.amd64fre.win7sp1_gdr.150525-0603
Machine Name:
Kernel base = 0xfffff800`02e12000 PsLoadedModuleList = 0xfffff800`03059730
Debug session time: Sat Jul 18 02:37:31.505 2015 (UTC + 6:00)
System Uptime: 0 days 0:22:00.268
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff8800d082600, 0, 0}

*** WARNING: Unable to verify timestamp for IDSvia64.sys
*** ERROR: Module load completed but symbols could not be loaded for IDSvia64.sys
Probably caused by : IDSvia64.sys ( IDSvia64+5ab6b )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8800d082600, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c3100
GetUlongFromAddress: unable to read from fffff800030c31c0
 ffffffffffffffff 

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+3f7d000
Unable to load image \SystemRoot\System32\Drivers\dump_iaStorA.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dump_iaStorA.sys
*** ERROR: Module load completed but symbols could not be loaded for dump_iaStorA.sys
fffff880`0d082600 2835080d80f8    sub     byte ptr [dump_iaStorA+0x26530e (fffff880`0588330e)],dh

EXCEPTION_PARAMETER2:  ffffffffffffffff

BUGCHECK_STR:  0x1E_c0000005_R

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

LAST_CONTROL_TRANSFER:  from fffff80002fbdd1e to fffff80002e7e7c5

CONTEXT:  fffff8800d082d80 -- (.cxr 0xfffff8800d082d80;r)
rax=000000034f050000 rbx=0000000000000008 rcx=fffff880009cfb20
rdx=4000000000000001 rsi=0000000000000004 rdi=0000000000000000
rip=fffff80002e7e7c5 rsp=fffff8800d083760 rbp=fffff880009cfb20
 r8=4000000000000000  r9=fffff80002e12000 r10=fffff880009cfb20
r11=fffff8800d083a20 r12=fffff8000301a580 r13=0000000000000000
r14=0000000000000002 r15=000000004d43444e
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
nt!ExpInterlockedPopEntrySListFault16:
fffff800`02e7e7c5 498b08          mov     rcx,qword ptr [r8] ds:002b:40000000`00000000=????????????????
Last set context:
rax=000000034f050000 rbx=0000000000000008 rcx=fffff880009cfb20
rdx=4000000000000001 rsi=0000000000000004 rdi=0000000000000000
rip=fffff80002e7e7c5 rsp=fffff8800d083760 rbp=fffff880009cfb20
 r8=4000000000000000  r9=fffff80002e12000 r10=fffff880009cfb20
r11=fffff8800d083a20 r12=fffff8000301a580 r13=0000000000000000
r14=0000000000000002 r15=000000004d43444e
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
nt!ExpInterlockedPopEntrySListFault16:
fffff800`02e7e7c5 498b08          mov     rcx,qword ptr [r8] ds:002b:40000000`00000000=????????????????
Resetting default scope

STACK_TEXT:  
fffff880`0d083760 fffff800`02fbdd1e : fffffa80`1a0200ff fffffa80`1b04ae38 00000000`00000000 fffffa80`1b04ae60 : nt!ExpInterlockedPopEntrySListFault16
fffff880`0d083770 fffff880`053adb6b : 00000000`00000000 00000000`00000008 00000000`00000000 00000000`00000001 : nt!ExAllocatePoolWithTag+0xfe
fffff880`0d083860 00000000`00000000 : 00000000`00000008 00000000`00000000 00000000`00000001 00000000`00000001 : IDSvia64+0x5ab6b


FOLLOWUP_IP: 
IDSvia64+5ab6b
fffff880`053adb6b ??              ???

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  IDSvia64+5ab6b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: IDSvia64

IMAGE_NAME:  IDSvia64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  555129e8

STACK_COMMAND:  .cxr 0xfffff8800d082d80 ; kb

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_R_IDSvia64+5ab6b

BUCKET_ID:  X64_0x1E_c0000005_R_IDSvia64+5ab6b

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x1e_c0000005_r_idsvia64+5ab6b

FAILURE_ID_HASH:  {3d8db2d7-1773-a753-bbe5-6df9ab2a91f8}

Followup: MachineOwner
---------

4: kd> lmvm IDSvia64
start             end                 module name
fffff880`05353000 fffff880`053fe000   IDSvia64 T (no symbols)           
    Loaded symbol image file: IDSvia64.sys
    Image path: \??\C:\Program Files\Symantec.cloud\EndpointProtectionAgent\NortonData\21.5.0.19\Definitions\IPSDefs\20150716.001\IDSvia64.sys
    Image name: IDSvia64.sys
    Timestamp:        Tue May 12 04:15:04 2015 (555129E8)
    CheckSum:         000B0FDA
    ImageSize:        000AB000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
Remove Norton for the time being. Install MSE.

Microsoft Security Essentials is recommended from a strict BSOD perspective, compatibility & stability compared to other internet security software. Malwarebytes is a great combo to MSE. They are free and lightweight.

Also uninstall your existing Antivirus software before you install MSE.

Good and Free system security combination.

warning   Warning
Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.



 Clean boot
Reduce items at start-up. No software except anti-virus is required plus doing this improves the time for logging into windows:Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:
  • Click on the
  • Type CMD on Search
  • Left click and Run as Administrator
  • Type SFC /scannow
Full tutorial here:Make scans with the following:

Kaspersky TDSSKillerESET online scanner: Run Disk Check on your Hard Drive for file system errors and bad sectors on it.

 Hard Drive Diagnostics

  • Double click and open my computer.
  • Right click on desired drive and hit properties.
  • Click on tools tab and Check now.

Read complete instructions on the tutorial: Disk Check

Other Tests:
 

My System SpecsSystem Spec
09 Aug 2015   #3
essenbe

Windows 7 Enterprise X64/Windows 10 Enterprise X64/Windows 10 Pro X64/Linux Mint
 
 

Hello, sallman. I'll see if I can help. You have 2 other threads on this same issue. I am going to merge the 3 threads into one thread. I have looked at your last dumps and this is what I find.

Code:
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff80002e817c5, fffff88003f9b5a8, fffff88003f9ae00}
Probably caused by : netbt.sys ( netbt!LmGetFullPath+100 )
Followup: MachineOwner
Code:
fffff880`03f9b3e8  fffff880`010910a8*** WARNING: Unable to verify timestamp for iaStorB.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStorB.sys
 iaStorB+0x6d0a8
This is the Intel Rapid Storage Technology which is Intel's Raid driver.

Code:
fffff880`03f9ae48  fffff880`064e3730*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
 nvlddmkm+0x21b730
This is your Graphics driver

Code:
fffff880`03f9aaa0  fffff880`073c69d0Unable to load image \SystemRoot\system32\DRIVERS\athrx.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for athrx.sys
*** ERROR: Module load completed but symbols could not be loaded for athrx.sys
 athrx+0x1689d0
This is your Atheros network adapter driver

Code:
NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88003fa8ef8
Arg3: fffff88003fa8750
Arg4: fffff80002ebf7c5
Code:
fffff880`03fa7040  fffff880`054dc008Unable to load image \SystemRoot\System32\Drivers\dump_iaStorA.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dump_iaStorA.sys
*** ERROR: Module load completed but symbols could not be loaded for dump_iaStorA.sys
 dump_iaStorA+0x87008

The first dump file has a code of 7E which is typically related to storage problems, but not always. But that dump file specifically lists your Storage driver, your Graphics driver and your Network adaptor. The next dump file blames the file system and your storage driver dump file. The iaStor_Dump is responsible for creating space on your hard drive for writing the dump files to it, but apparently could not do so.

This leads me to believe you have a problem with one of your hard drives. Would you please tell me the Manufacturer and Model of your SSD. Also, please make sure your SSD's Firmware is up to date and has the current. For your Mechanical hard drives, I would like you to run Seatools for DOS. SeaTools for DOS and Windows - How to Use, as well as check disk Disk Check. For your SSD does yours come with a tool box? If so, try to determine if it is working properly.
My System SpecsSystem Spec
.

10 Aug 2015   #4
essenbe

Windows 7 Enterprise X64/Windows 10 Enterprise X64/Windows 10 Pro X64/Linux Mint
 
 

The majority of what I saw in the dump files were storage related. The code I listed in the first one, 7E is typically related to hard drives or storage system. The second one says the file system. The 2 are pretty related. The errors were from iaStor which is your hard drive's controller. If the hard drive is having read errors, that could explain the other driver faults. I saw numerous references to the NTFS file system and some I/O errors which both directly relate to the hard drive. They were not blamed but just shown as events that were occurring leading up to the BSOD. Everything put together is a good indication of a bad hard drive or corruption in the file system on the hard drive. I hope I explained that right. I am not saying that is definitely the cause, but just that is what it seems to be pointing at. It is going to be difficult to test your SSD. Most of the hard drive or file system tests we have are for spinning drives. SSDs write data completely different.
My System SpecsSystem Spec
10 Aug 2015   #5
sallman

Win7 Pro 64 SP1
 
 

ok, great. thanks for looking into this.
my "take-away" is this:
1. based on the recent dump files, you DON'T think it's a third-party hardware driver (confirm?)
2. you DO think it's a hard drive issue
3. is there a way to isolate which drive is the prime suspect? (the OS is on the SSD, I have significant data on the 2nd WD spin drive which is often accessed when I'm working in Cubase)
4. worth noting the SSD is a Samsung (as noted in prior post) but I've since discovered that it's a Samsung that is an OEM for Dell, meaning you can't use Samsung firmware to update. Has to come from Dell, I believe.

I will run chkdsk and Seatools on all the drives, but device manager states all drives are healthy.
more later. thanks again.
My System SpecsSystem Spec
10 Aug 2015   #6
essenbe

Windows 7 Enterprise X64/Windows 10 Enterprise X64/Windows 10 Pro X64/Linux Mint
 
 

At this point, I do believe it is a Hard drive or problems with the file system. If all drives Check out, We will check other things. I think it fair to say, with computers, you can't rule out anything, but right now that's what it seems to me.
My System SpecsSystem Spec
10 Aug 2015   #7
sallman

Win7 Pro 64 SP1
 
 
update 8-10

BSOD again today, when launching Cubase. Prior to that, ran Seatools on all drives - clean scans.

Below is the dump text from the most recent episode. Standard zip also attached.
It has to be something, somewhere, associated with Cubase...not sure if it's a plug-in, a driver, or something else altogether.


Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\081015-17206-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*c:\localSymbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\localSymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18869.amd64fre.win7sp1_gdr.150525-0603
Machine Name:
Kernel base = 0xfffff800`02e1a000 PsLoadedModuleList = 0xfffff800`03061730
Debug session time: Mon Aug 10 16:39:21.632 2015 (UTC - 5:00)
System Uptime: 0 days 0:12:07.506
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff8800d9334a0, 0, 0}

*** WARNING: Unable to verify timestamp for athrx.sys
*** ERROR: Module load completed but symbols could not be loaded for athrx.sys
Probably caused by : nwifi.sys ( nwifi!Pt6Receive+296 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8800d9334a0, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030cb100
GetUlongFromAddress: unable to read from fffff800030cb1c0
ffffffffffffffff

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
+0
fffff880`0d9334a0 c843930d enter 9343h,0Dh

EXCEPTION_PARAMETER2: ffffffffffffffff

BUGCHECK_STR: 0x1E_c0000005_R

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 2

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

LAST_CONTROL_TRANSFER: from fffff80002fc5d1e to fffff80002e867c5

CONTEXT: fffff8800d933c20 -- (.cxr 0xfffff8800d933c20;r)
rax=000000000f530002 rbx=fffffa800e127820 rcx=fffff880009cfb20
rdx=400000001b354161 rsi=0000000000000004 rdi=0000000000000000
rip=fffff80002e867c5 rsp=fffff8800d934600 rbp=fffff880009cfb20
r8=400000001b354160 r9=fffff80002e1a000 r10=fffff880009cfb20
r11=fffff88003939030 r12=fffff80003022580 r13=0000000000000000
r14=0000000000000002 r15=0000000044416e49
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!ExpInterlockedPopEntrySListFault16:
fffff800`02e867c5 498b08 mov rcx,qword ptr [r8] ds:002b:40000000`1b354160=????????????????
Last set context:
rax=000000000f530002 rbx=fffffa800e127820 rcx=fffff880009cfb20
rdx=400000001b354161 rsi=0000000000000004 rdi=0000000000000000
rip=fffff80002e867c5 rsp=fffff8800d934600 rbp=fffff880009cfb20
r8=400000001b354160 r9=fffff80002e1a000 r10=fffff880009cfb20
r11=fffff88003939030 r12=fffff80003022580 r13=0000000000000000
r14=0000000000000002 r15=0000000044416e49
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!ExpInterlockedPopEntrySListFault16:
fffff800`02e867c5 498b08 mov rcx,qword ptr [r8] ds:002b:40000000`1b354160=????????????????
Resetting default scope

STACK_TEXT:
fffff880`0d934600 fffff800`02fc5d1e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExpInterlockedPopEntrySListFault16
fffff880`0d934610 fffff880`0244701f : fffffa80`0e22be00 fffffa80`0e127820 fffffa80`0e24a000 fffffa80`0000000c : nt!ExAllocatePoolWithTag+0xfe
fffff880`0d934700 fffff880`02484c39 : fffffa80`0e127820 00000000`00000000 fffffa80`1a2d2500 00000000`00000000 : tcpip!InetAllocateAndQueryAncillaryDataAf+0x5f
fffff880`0d934750 fffff880`024847a5 : fffffa80`1a4546e0 fffffa80`1a2d2500 00000000`00000028 fffff880`0d9348e0 : tcpip!UdpBeginMessageIndication+0x209
fffff880`0d934870 fffff880`0247f152 : 00000000`00000028 fffffa80`1a4546e0 fffffa80`0e127820 fffff880`0d934ab0 : tcpip!UdpDeliverDatagrams+0xd5
fffff880`0d934a00 fffff880`0245af97 : fffffa80`1a070ba0 fffffa80`0e9e8100 62b22500`eb1478ed 00000000`00000000 : tcpip!UdpReceiveDatagrams+0x132
fffff880`0d934aa0 fffff880`0245aaaa : 00000000`00000000 fffff880`02568800 fffff880`0d934c60 fffffa80`00000000 : tcpip!IppDeliverListToProtocol+0xf7
fffff880`0d934b60 fffff880`0245a0a9 : 00000000`00000000 fffffa80`1bd127c0 00000000`00000002 fffff880`0d934c50 : tcpip!IppProcessDeliverList+0x5a
fffff880`0d934c00 fffff880`02457d4f : 00000000`00000000 00000000`19eb4201 fffff880`02568800 fffff880`02568800 : tcpip!IppReceiveHeaderBatch+0x23a
fffff880`0d934ce0 fffff880`02457322 : fffffa80`0ee9b570 00000000`00000000 fffffa80`19eb4201 00000000`00000001 : tcpip!IpFlcReceivePackets+0x64f
fffff880`0d934ee0 fffff880`0245674a : fffffa80`19eb4270 fffff880`0d935010 fffffa80`19eb4270 fffff880`073d0001 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
fffff880`0d934fc0 fffff800`02e9b1f8 : fffffa80`1bddad30 00000000`00004800 fffffa80`1b8d9640 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xda
fffff880`0d935010 fffff880`02456e42 : fffff880`02456670 fffffa80`0e798a94 00000000`00000002 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`0d9350f0 fffff880`0230c0eb : fffffa80`0ee9c8d0 00000000`00000000 fffffa80`0e9e81a0 fffffa80`0e9e81a0 : tcpip!FlReceiveNetBufferListChain+0xb2
fffff880`0d935160 fffff880`022d5ad6 : fffffa80`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb
fffff880`0d9351d0 fffff880`022585d4 : fffffa80`0e9e81a0 00000000`00000002 00000000`00000001 fffffa80`1bddad30 : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6
fffff880`0d935650 fffff880`02258549 : 00000000`00000000 00000000`00000000 fffffa80`1a06a810 00000000`00000001 : ndis!ndisMTopReceiveNetBufferLists+0x24
fffff880`0d935690 fffff880`022584e0 : fffff880`0b7325c0 fffffa80`1a053010 fffffa80`1a06a810 00000000`00000001 : ndis!ndisFilterIndicateReceiveNetBufferLists+0x29
fffff880`0d9356d0 fffff880`0b6fb7ee : fffffa80`1a053010 00000000`00000000 fffffa80`1bddad30 fffff880`0b7325c0 : ndis!NdisFIndicateReceiveNetBufferLists+0x50
fffff880`0d935710 fffff880`02258549 : fffffa80`0f13abd0 00000000`00000000 00000000`00000001 fffff880`07310f9d : nwifi!Pt6Receive+0x296
fffff880`0d935770 fffff880`022584e0 : 00000000`00000001 fffff880`04f490bc fffffa80`0f140028 fffff880`07855ff8 : ndis!ndisFilterIndicateReceiveNetBufferLists+0x29
fffff880`0d9357b0 fffff880`04f459c0 : fffff880`04f4c110 00000000`00000001 00000000`00000001 fffffa80`0f140a78 : ndis!NdisFIndicateReceiveNetBufferLists+0x50
fffff880`0d9357f0 fffff880`022710a7 : fffffa80`0e9e81a0 fffffa80`0f1383d0 fffffa80`0f1383d0 00000000`00000001 : vwififlt!FilterReceiveNetBufferLists+0x158
fffff880`0d935850 fffff880`0728ce76 : fffffa80`0e9e81a0 00000000`00000000 00000000`00000000 00000000`00000000 : ndis! ?? ::FNODOBFM::`string'+0xcd8f
fffff880`0d9358a0 fffffa80`0e9e81a0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000001 : athrx+0x19e76
fffff880`0d9358a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000001 ffff0000`0aae556c : 0xfffffa80`0e9e81a0


FOLLOWUP_IP:
nwifi!Pt6Receive+296
fffff880`0b6fb7ee 83a3e010000000 and dword ptr [rbx+10E0h],0

SYMBOL_STACK_INDEX: 13

SYMBOL_NAME: nwifi!Pt6Receive+296

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nwifi

IMAGE_NAME: nwifi.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bcc3b

IMAGE_VERSION: 6.1.7600.16385

STACK_COMMAND: .cxr 0xfffff8800d933c20 ; kb

FAILURE_BUCKET_ID: X64_0x1E_c0000005_R_nwifi!Pt6Receive+296

BUCKET_ID: X64_0x1E_c0000005_R_nwifi!Pt6Receive+296

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x1e_c0000005_r_nwifi!pt6receive+296

FAILURE_ID_HASH: {503698b3-635e-efa2-ef24-9328f5ad0519}

Followup: MachineOwner
---------

4: kd> lmvm nwifi
start end module name
fffff880`0b6f2000 fffff880`0b745000 nwifi (pdb symbols) c:\localsymbols\nwifi.pdb\019E6C79A43F4BF687EB4758B35DBD8E1\nwifi.pdb
Loaded symbol image file: nwifi.sys
Mapped memory image file: c:\localsymbols\nwifi.sys\4A5BCC3B53000\nwifi.sys
Image path: \SystemRoot\system32\DRIVERS\nwifi.sys
Image name: nwifi.sys
Timestamp: Mon Jul 13 19:07:23 2009 (4A5BCC3B)
CheckSum: 00057B55
ImageSize: 00053000
File version: 6.1.7600.16385
Product version: 6.1.7600.16385
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.6 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: NWiFi.SYS
OriginalFilename: NWiFi.SYS
ProductVersion: 6.1.7600.16385
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
FileDescription: NativeWiFi Miniport Driver
LegalCopyright: © Microsoft Corporation. All rights reserved.
My System SpecsSystem Spec
10 Aug 2015   #8
essenbe

Windows 7 Enterprise X64/Windows 10 Enterprise X64/Windows 10 Pro X64/Linux Mint
 
 

Sallman, As I am sure you know. This is all network related

Code:
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff8800d9334a0, 0, 0}
*** WARNING: Unable to verify timestamp for athrx.sys
*** ERROR: Module load completed but symbols could not be loaded for athrx.sys
Probably caused by : nwifi.sys ( nwifi!Pt6Receive+296 )
Followup: MachineOwner
athrx is your Atheros network adapter driver nwifi is provided by windows Update and is the Native WiFi Miniport Driver.

Almost everything you posted there is tcpip, vwififlt (virtual wi fi filter driver) are all network related. Is it possible that your Cubase program is connecting to the internet, downloading or something like that or is there a compatibility problem with the network drivers? Did you uninstall Symantec?
My System SpecsSystem Spec
10 Aug 2015   #9
sallman

Win7 Pro 64 SP1
 
 

First, thanks again for the assistance.
Second, fascinating. Seems like each bsod comes with new circumstances, making it even harder to diagnose.
To your questions:
1. yes, I uninstalled Symantec. Using MS for now.
2. yes, Cubase would try to connect to the internet on launch by default. That said, this episode is the first time that it has crashed during launch. All other times have been when the program is running and I have a file session open. I'm suspicious of other things simply because there are so many drivers and other interactions going on simultaneously within Cubase (midi data transfer, audio playback, timecode, plug-ins, etc) that I can't help but think there's something else going on. BUT, I know all we have to go from is what we see in the reports.\

Questions:
  • How would I troubleshoot any potential conflicts with the network drivers?
  • what does this say, if anything, about prior bsod reports pointing to the drives as suspects? by all measures the drives have checked out okay.
My System SpecsSystem Spec
10 Aug 2015   #10
essenbe

Windows 7 Enterprise X64/Windows 10 Enterprise X64/Windows 10 Pro X64/Linux Mint
 
 

Without going back and looking, this is about the third dump that network drivers have been named in dump reports. The last time when all indications were the hard drives, athrx was mentioned. But, since everything else was storage related, I assumed that it was probably a read error when the driver was requested from the hard drive. It was the only error which was not storage/hard drive related. Under any other circumstance, I would think this was a memory problem. When ram errors occur, whatever driver is most in use gets the blame. So, you end up getting different error codes and different drivers named each time. What that means, at least from my perspective, is a memory error is the worst thing that you can have. Because of what I just explained, the dump files cannot be relied upon. What we are seeing is typical of ram problems. The only exception is that yours all seem to be when Cubase is being used.

To be quite honest, I am not familiar with how Cubase works. I know what it is, but not how it works. For example, in a gaming situation, there are a lot of drivers in use. But there are constant read/write operations going on to write data to and read from the hard drive. Much of that data is stored in ram until it is needed. If drivers are not involved in the crash, I tend to look at ram and hard drive, if I explained it right. My guess would be that Cubase is similar when in operation.

We can run memtest86+ to test the ram and see if it is that and we can run Driver Verifier to check the drivers. With Driver Verifier, there is a small chance that we can get caught in a situation to where there is no option other than a clean install. We take every precaution to see to it that an install does not happen. It has never happened to me, but I feel obligated to explain that. What it does is put extra stress on the drivers in hopes that the offending driver will cause the computer to crash and catch the offending driver. It is probably the only time you will ever want the computer to BSOD. I would request that you do not do either of those tests until I give you instructions on exactly how to do them. The downside to the memory test is that with your 16 GB of ram, the test will take around 20 hours to run and the computer cannot be used during the test because the test is actually run out of ram and the OS is not even loaded. For my purposes, I would prefer to run the memory test first, for reasons that are obvious. From what I gather based on the questions you have been asking, I think you would prefer to run Driver Verifier. I will leave that up to you which we do. But in my opinion we need to do something that will narrow down what is going on. As it stands right now, you are correct. Every time it is something different. As a practical matter, we don't even know whether it is a driver problem, hardware problem or a driver conflict. Your third option is very time consuming but can be really telling. You can perform a clean startup or a diagnostic startup. Almost all programs and services are shut down on startup. You start enabling programs a couple at a time until you start having BSODs again. You will then know which programs are suspect and with a little work can determine which one it is. This is how, but it takes a lot of time. When you enable a program or service, you have to use the computer that way until you determine it is or is not causing a problem, then enable a few more. This explains it in step by step instructions. Troubleshoot Application Conflicts by Performing a Clean Startup

I will leave it up to you, which route you would like to take. If you have any questions, please let me know.
My System SpecsSystem Spec
Reply

 BSOD ntoskrnl.exe, 0xFFFFFFFFC0000005, help to diagnose??




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
BSOD on Lenovo laptop-0xFFFFFFFFC0000005
Hi Team, I am getting this error 0xFFFFFFFFC0000005 in BSOD. Please find attached the logs from DM log collector. Could you please assist/suggest me on the same on what could be wrong.
BSOD Help and Support
WIndows 7 64bit BSOD 0x0000007e (0xffffffffc0000005,
Happens at night after I've left the computer on, and turned my monitors off. My power settings are all "high performance" so there is no sleep, suspend usb, etc etc. Seems to happen after a few to several hours of idle time. It's the same error code always, but does not cite the faulty driver....
BSOD Help and Support
BSOD shortly after start up, Bugcheck code: 0x1E (0xFFFFFFFFC0000005,
Hello, I have a Toshiba laptop that started with the BSOD right after a virus that was removed, not sure if related. Here is my who crashed copied and pasted. Not sure how to do a zip file of my minidump. :o System Information (local) </B> computer name: OD-PC windows version: Windows 7...
BSOD Help and Support
BSOD 0x1E (0xFFFFFFFFC0000005) NT KERNEL & SYSTEM error
I am having a problem with my computer, crashes at random times when i run AutoCAD or many tabs. I have tried to fix it but no luck. It shows a BSOD 0x1e. I am attaching the dumpfiles. any help would be greatly appreciated.
BSOD Help and Support
BSOD, 0x0000007e (0xffffffffc0000005, 0xfffff800035fb9bc, 0xfffff88003
this is a new computer, but had BSOD problems, so I reinstalled Windows 3 days ago. Today I was using graphic card based rendering engine, photoshop, Indesign, Itunes, etc, and I had my task management window open, but it had low memory and CPU usage. However it crashed saying: 0x0000007e...
BSOD Help and Support
BSOD diagnose, thanks
This is my windows 7 HP dm1z laptop. Thanks
BSOD Help and Support


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 13:25.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App