BSOD differerent codes, unexpacted shutdown

[Britton30]

This is my wife's PC, specs are:
CPU AMD PhenomII X4 865BE
GPU NVidia GTX 460
RAM 8GB GSkill DDR3 1866
SSD for OS, HDD for Users

It has shut down and had BSODs when idling and while she has been using it, browsing, playing Bookworm, with no pattern being obvious.

Tests I have done:
memtest86+
chkdsk
Furmark

I had tried making this post from her machine but I had another BSOD. I ran the SF Diag tool again so there are two dmp files here.

View attachment 302188

Please use English and highlight problem in any dumps you quote.

 

[Arc]

Hi Britton30.

Is there any update available for your wife's TP-LINK 450Mbps Wireless N Adapter? Download - Welcome to TP-LINK

If so, get and install it by matching the model number.

Let us know the results.
____________________________________________________________________________________________

*** WARNING: Unable to verify timestamp for athrx.sys
*** ERROR: Module load completed but symbols could not be loaded for athrx.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff88005ad752a, fffff8800338c908, fffff8800338c160}

Probably caused by : athrx.sys ( athrx+8252a )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88005ad752a, The address that the exception occurred at
Arg3: fffff8800338c908, Exception Record Address
Arg4: fffff8800338c160, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
athrx+8252a
fffff880`05ad752a 668b402e        mov     ax,word ptr [rax+2Eh]

EXCEPTION_RECORD:  fffff8800338c908 -- (.exr 0xfffff8800338c908)
ExceptionAddress: fffff88005ad752a (athrx+0x000000000008252a)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000033
Attempt to read from address 0000000000000033

CONTEXT:  fffff8800338c160 -- (.cxr 0xfffff8800338c160)
rax=0000000000000005 rbx=fffffa8007bd0050 rcx=0000000000000005
rdx=0000000000000005 rsi=fffffa8006b42040 rdi=fffffa80086c1f80
rip=fffff88005ad752a rsp=fffff8800338cb48 rbp=fffff8000347e280
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=fffffa80086c1f80 r13=0000000000000001
r14=0000000000000000 r15=0000000000000001
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
athrx+0x8252a:
fffff880`05ad752a 668b402e        mov     ax,word ptr [rax+2Eh] ds:002b:00000000`00000033=????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000033

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003510100
 0000000000000033 

FOLLOWUP_IP: 
athrx+8252a
fffff880`05ad752a 668b402e        mov     ax,word ptr [rax+2Eh]

BUGCHECK_STR:  0x7E

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from fffff88005a7ba58 to fffff88005ad752a

STACK_TEXT:  
fffff880`0338cb48 fffff880`05a7ba58 : 00000000`00000005 fffff800`032ce5f2 fffffa80`086c1f80 fffff880`05bad4c4 : athrx+0x8252a
fffff880`0338cb50 00000000`00000005 : fffff800`032ce5f2 fffffa80`086c1f80 fffff880`05bad4c4 fffffa80`07bd0050 : athrx+0x26a58
fffff880`0338cb58 fffff800`032ce5f2 : fffffa80`086c1f80 fffff880`05bad4c4 fffffa80`07bd0050 fffffaff`0000000a : 0x5
fffff880`0338cb60 00000000`00000001 : fffffa80`086c1f80 fffffa80`086c1f80 fffffa80`00000000 fffffa80`08704e38 : nt!KiCommitThreadWait+0x1d2
fffff880`0338cbf0 fffffa80`086c1f80 : fffffa80`086c1f80 fffffa80`00000000 fffffa80`08704e38 fffffa80`07bd0050 : 0x1
fffff880`0338cbf8 fffffa80`086c1f80 : fffffa80`00000000 fffffa80`08704e38 fffffa80`07bd0050 fffff880`05a7ccb9 : 0xfffffa80`086c1f80
fffff880`0338cc00 fffffa80`00000000 : fffffa80`08704e38 fffffa80`07bd0050 fffff880`05a7ccb9 fffffa80`08704e38 : 0xfffffa80`086c1f80
fffff880`0338cc08 fffffa80`08704e38 : fffffa80`07bd0050 fffff880`05a7ccb9 fffffa80`08704e38 fffffa80`08704d40 : 0xfffffa80`00000000
fffff880`0338cc10 fffffa80`07bd0050 : fffff880`05a7ccb9 fffffa80`08704e38 fffffa80`08704d40 00000000`00000000 : 0xfffffa80`08704e38
fffff880`0338cc18 fffff880`05a7ccb9 : fffffa80`08704e38 fffffa80`08704d40 00000000`00000000 fffffa80`07e4d500 : 0xfffffa80`07bd0050
fffff880`0338cc20 fffffa80`08704e38 : fffffa80`08704d40 00000000`00000000 fffffa80`07e4d500 fffff880`03164180 : athrx+0x27cb9
fffff880`0338cc28 fffffa80`08704d40 : 00000000`00000000 fffffa80`07e4d500 fffff880`03164180 fffff880`045d15f2 : 0xfffffa80`08704e38
fffff880`0338cc30 00000000`00000000 : fffffa80`07e4d500 fffff880`03164180 fffff880`045d15f2 00000001`00000000 : 0xfffffa80`08704d40


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  athrx+8252a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: athrx

IMAGE_NAME:  athrx.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d6419db

STACK_COMMAND:  .cxr 0xfffff8800338c160 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_athrx+8252a

BUCKET_ID:  X64_0x7E_athrx+8252a

Followup: MachineOwner
---------

2: kd> lmvm athrx
start             end                 module name
fffff880`05a55000 fffff880`05cf7000   athrx    T (no symbols)           
    Loaded symbol image file: athrx.sys
    Image path: athrx.sys
    Image name: athrx.sys
    Timestamp:        Wed Feb 23 01:47:31 2011 (4D6419DB)
    CheckSum:         0029D477
    ImageSize:        002A2000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[Britton30]

There is a newer driver and I will update it. It is this adapter: TL-WDN4800 - Welcome to TP-LINK

However these issues also occured before we had the wireless adapter, I think.
Thanks for the help so far. Where in the dump does it point to the TP-Link?

EDIT: New driver installed, time will see if it was the problem.
I first went through Device Manager/Update Driver and pointed it to the folder with the new driver, it said I had the latest driver. I used the setup.exe within the folder and it installed.

 

[Arc]

The dump says: Probably caused by: athrx.sys.

Timestamp of athrx.sys is Wed Feb 23 01:47:31 2011; that means it needs update.

Nothing more is said in the dump.

The rest is on you. You have to go over the dump. Find what is the device that is using the athrx.sys. Then it is found to be TP-LINK 450Mbps Wireless N Adapter.

A crash dump is a ready reference. Very hand, most important to debug, but not an almighty. It provides information upto a certain level only; and the interpretation of that information is on you. The closer your interpretation is, the better your suggestions are.

And to interpret it, the fact that you have to keep in mind is "causal relation".
Say, if the situation is the same even after updating the driver, then we have to search for other things that may affect networking.

NetWorx, as an example. Most frequent network blocker; but not very frequently present in the dumps. It is a classic example of stepping out of the dump data.

Let us know how the computer is running after updating the driver?

 

[Britton30]

Thanks for the info Archie, that was easy to understand.

I'll let her go as normal and see what happens. I don't know why it sometimes just reboots, I don't know where to look in event logs. What I have found just says, Event Blue Screen, which doesn't help much.

 

[Arc]

If you look at the eventsys.txt: Edit > Find

level: error

Proceed with find next, till the end of the log.

Most of them are noise, but a few are real and necessary info, for sure.

 

[Britton30]

There are dozens of these two:

An SSL 3.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.

The following fatal alert was generated: 40. The internal error state is 107.

A few of these:

The computer has rebooted from a bugcheck.  The bugcheck was: 0x000000f4 (0x0000000000000003, 0xfffffa80088e5920, 0xfffffa80088e5c00, 0xfffff80002fdf460). A dump was saved in: C:\Windows\Minidump\120412-22183-01.dmp. Report Id: 120412-22183-01.

The Internet Connection Sharing (ICS) service depends on the Remote Access Connection Manager service which failed to start because of the following error: 
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Some of these, usually 3-4 in a row. It only has 2 disks installed.

Event[1971]:
  Log Name: System
  Source: Disk
  Date: 2012-12-18T11:01:30.046
  Event ID: 11
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Klattu51
  Description: 
The driver detected a controller error on \Device\Harddisk6\DR6.

This is a Warning:

The time service has not synchronized the system time for 86400 seconds because none of the time service providers provided a usable time stamp. The time service will not update the local system time until it is able to synchronize with a time source. If the local system is configured to act as a time server for clients, it will stop advertising as a time source to clients. The time service will continue to retry and sync time with its time sources. Check system event log for other W32time events for more details. Run 'w32tm /resync' to force an instant time synchronization.

 

[Arc]

The computer has rebooted from a bugcheck. The bugcheck was: 0x000000f4 (0x0000000000000003, 0xfffffa80088e5920, 0xfffffa80088e5c00, 0xfffff80002fdf460). A dump was saved in: C:\Windows\Minidump\120412-22183-01.dmp. Report Id: 120412-22183-01.

Some of these, usually 3-4 in a row. It only has 2 disks installed.

Event[1971]:
  Log Name: System
  Source: Disk
  Date: 2012-12-18T11:01:30.046
  Event ID: 11
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Klattu51
  Description: 
The driver detected a controller error on \Device\Harddisk6\DR6.

These two are material information, and interrelated, too. How old these events are? One is of 18/12/2012; that means old enough to infer anything about the concurrent time based on it.

Well, I checked The Stop 0xF4 error is not very old, but not very recent, too. I hope you have installed the Firmware Update 070H already?

 

[Britton30]

Both were near the same date. Yes I have the 070H firmware installed.
I quit searching the event log after about 4800 of them, there's a total of 34,999. :shock:

 

[Arc]

Dont worry All of them does not need attention

Update Renesas Electronics USB 3.0 Host Controller (c:\windows\system32\drivers\nusb3xhc.sys) too; from a source that you like. Gigabyte does not have any update, but Station Drivers has.

fffff880`05d04000 fffff880`05d35000   nusb3xhc   (deferred)             
    Image path: nusb3xhc.sys
[COLOR=Red]    Image name: nusb3xhc.sys
    Timestamp:        Fri Nov 19 07:04:25 2010[/COLOR] (4CE5D421)
    CheckSum:         0002D1D4
    ImageSize:        00031000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[Britton30]

Gigabyte has one for NEC USB dated 12.21.2010. That other site is horrible, I clicked trying to find English and got ads for "games for males only".

Renesas used to be NEC.

 

[Arc]

Yes, there are ads. But we know how to minimize those

For the drivers, if needed, you may scan the content. Drivers are reliable.