BSOD random 0x0000000a, 0x0000003b

[fsanyee]

Hi, I recently upgraded my pc and I have some probleme with the new one.
I got the first BSOD on 18th of december: 0x0000000a

After this, I updated the VGA driver (from AMD's page) and I did not have a problem for 3 days.
Today I got this: 0x0000003b


I have the latest drivers and updates installed. (W7 Ultimate x64 installed on 5th of dec.)
What else can I do?

 

[koolkat77]

Welcome

Please post all files following:
http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

 

[fsanyee]

Sorry, I updated the first post.

 

[koolkat77]

Are you overclocking any hardware?

Uninstall virtual box. It's contributing to the crashes.

 

[fsanyee]

Im not overclocking.
I need virtual machines, can you recommend me something instead of virtualbox?

 

[Arc]

It is VirtualBox network driver that crashed.

fffff880`080fc0d8  fffff880`03efdaa4Unable to load image VBoxNetFlt.sys, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for VBoxNetFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for VBoxNetFlt.sys
 VBoxNetFlt+0x4aa4[/COLOR]

Description here: Driver Reference Table - VBoxNetFlt.sys

And see here, how may network errors are there, and with what frequency.

fffff880`080fc158  fffff880`01584000 NETIO!PtpSwapWithSuccessor <PERF> (NETIO+0x0)
fffff880`080fc160  fffff880`015d3c78 NETIO!WPP_MAIN_CB <PERF> (NETIO+0x4fc78)
fffff880`080fc168  fffff880`016b4000 tcpip!OlmQuerySystemConnectionOffloadSupportCommon <PERF> (tcpip+0x0)
fffff880`080fc170  fffff880`01859ad8 tcpip!LowMemoryEvent <PERF> (tcpip+0x1a5ad8)
fffff880`080fc178  fffff880`016b4000 tcpip!OlmQuerySystemConnectionOffloadSupportCommon <PERF> (tcpip+0x0)
fffff880`080fc180  fffff880`0185ae94 tcpip!LowMemoryEvent <PERF> (tcpip+0x1a6e94)
fffff880`080fc188  fffff880`016b4000 tcpip!OlmQuerySystemConnectionOffloadSupportCommon <PERF> (tcpip+0x0)
fffff880`080fc190  fffff880`01859b44 tcpip!LowMemoryEvent <PERF> (tcpip+0x1a5b44)
fffff880`080fc198  fffff880`016b4000 tcpip!OlmQuerySystemConnectionOffloadSupportCommon <PERF> (tcpip+0x0)
fffff880`080fc1a0  fffff880`01859b14 tcpip!LowMemoryEvent <PERF> (tcpip+0x1a5b14)
fffff880`080fc1a8  fffff880`03c68000 afd!AFDETW_TRACEACCEPTEX <PERF> (afd+0x0)
fffff880`080fc1b0  fffff880`03c907fc afd!AfdGlobalData <PERF> (afd+0x287fc)
fffff880`080fc1b8  fffff880`03c68000 afd!AFDETW_TRACEACCEPTEX <PERF> (afd+0x0)
fffff880`080fc1c0  fffff880`03c8f548 afd!AfdGlobalData <PERF> (afd+0x27548)
fffff880`080fc1c8  fffff800`02a65000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`080fc1d0  fffff800`02cff68c nt!BBTBuffer <PERF> (nt+0x29a68c)
fffff880`080fc1d8  fffff800`02a65000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`080fc1e0  fffff800`02cff698 nt!BBTBuffer <PERF> (nt+0x29a698)
fffff880`080fc1e8  fffff800`02a65000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`080fc1f0  fffff800`02ce9e94 nt!BBTBuffer <PERF> (nt+0x284e94)
fffff880`080fc1f8  fffff800`0000000a
fffff880`080fc200  fffff880`0158da42 NETIO!RtlCopyMdlToMdlIndirect+0x32
fffff880`080fc208  fffff880`0158da44 NETIO!RtlCopyMdlToMdlIndirect+0x34
fffff880`080fc210  fffff880`080fc2a0
fffff880`080fc218  fffff880`080fca48
fffff880`080fc220  fffff880`0158da43 NETIO!RtlCopyMdlToMdlIndirect+0x33

So there must be something that is messing the network connection and activity overall. And that is Appex Network Accelerator ... have a look.

fffff880`080fc2b8  fffff880`07674170Unable to load image appexDrv.sys, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for appexDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for appexDrv.sys
 appexDrv+0xa170[/COLOR]

Uninstall the program. Then go to C:\Windows\system32\drivers; and C:\Windows\SysWoW64\Drivers, if appexDrv.sys is present there in those folders, delete it manually.

Free up the startup.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept the restart.

Update Realtek PCIe GBE Family Controller Driver.

lmvm rt64win7
start             end                 module name
fffff880`04471000 fffff880`04511000   Rt64win7   (deferred)             
    Image path: Rt64win7.sys
   [COLOR=Red] Image name: Rt64win7.sys
    Timestamp:        Tue Sep 27 20:20:33 2011[/COLOR] (4E81E2B9)
    CheckSum:         0009FB77
    ImageSize:        000A0000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Get it from Realtek.

From another dump .....

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {8, 9, 1, fffff80002a80266}

*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
[COLOR=Red]Probably caused by : atikmdag.sys [/COLOR]( atikmdag+339de )

Followup: MachineOwner
---------

The display driver is not the latest version.

lmvm atikmdag
start             end                 module name
fffff880`04a93000 fffff880`054b4000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: atikmdag.sys
[COLOR=Red]    Image name: atikmdag.sys
    Timestamp:        Sat Jul 28 07:18:09 2012 [/COLOR](501344D9)
    CheckSum:         009DA146
    ImageSize:        00A21000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update your ATI/AMD display driver.
You can get it from the link in our forum, http://www.sevenforums.com/graphic-...alyst-video-driver-windows-7-a.html#post17671, or you may go to AMD Graphics Driver and Software and opt for Automatically Detect and Install the appropriate driver for your card.

During installation, you may opt for advanced installation, and install the display driver only, not the Catalyst Control Center.

Let us know the results.

 

[fsanyee]

Thank you! I uninstalled that appex accelerator and updated the network driver. I hope it will be okay.
(I didnt mention that the network icon next to the clock had a red X on it and it said that there is no network connection however it worked. After I made this changes it looks right.)

 

[Arc]

Thank you! I uninstalled that appex accelerator and updated the network driver. I hope it will be okay.
(I didnt mention that the network icon next to the clock had a red X on it and it said that there is no network connection however it worked. After I made this changes it looks right.)

Now it is a waiting game.

Wait, observe how the system is working. Let us know the results. But dont forget to update the display driver.

 

[fsanyee]

Merry christmas!
Im back with a brand new dump. This time i got 0x0000000a.

 

[Arc]

It is still crashing on the network driver.

fffff880`0de739b8  fffff880`05b387b3Unable to load image Rt64win7.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Rt64win7.sys
[COLOR=Red]*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
 Rt64win7+0xa57b3[/COLOR]

Whereas the driver is very latest. The cause may be hidden elsewhere.

Are you use any other AV program other than Microsoft Security Essentials? Do you update the database of MSE regularly?

You have a lot of network related programs listed in Startup. Free up the startup.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept the restart.

And, for a safety reason, scan the system for possible virus infection.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

 

[fsanyee]

I only use MSE and it's database is updated.
Whats the difference when I start those programs in the startup manually or the system automatically?
Tdskiller found nothing and Windows Deffender Offline full scan is still running.

btw, where did you find that few line? I checked the dump with windbg, but I cant find those...

 

[Arc]

If you keep those programs automatically with windows, it will put a pressure on your network from the very beginning of windows start. And, there is a fair chance of a trouble there. For that, there is a special troubleshooting method: http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Actually, all those are unimportant there ... only the AV program is needed, coz it gives protection. So the best practice is to keep startup clear.

All the programs are installed there in your computer, you can use them anytime, whether they auto start or not.

About those lines .... I used some set of commands those generated those lines as fault.

 

[fsanyee]

The offline scan finished. Its look like my system is not infected.

 

[Arc]

Very good to know

After freeing up the startup, let us know about your further issues.

 

[fsanyee]

The red x on the network icon what I mentiond before (next to the clock). It cames back when a virtual machine in virtualbox starts using the network.
Is there any way that I can see whats going on the background with network?

 

[Arc]

Yes, you can. It is from VMWare ....
View attachment 247123
There must be some similar settings for VBox. Shift the network between Bridged and NAT .... it may make some changes there.

Or you may post the same screenshot from your computer for us, too.

 

[fsanyee]

Oh I just got another one...

 

[Arc]

Oh I just got another one...

It's a different one that we are dealing with .... caused by the display driver.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7E, {ffffffffc0000005, fffff88004b558b6, fffff880063e4a88, fffff880063e42e0}

*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
[COLOR=Red]Probably caused by : atikmdag.sys[/COLOR] ( atikmdag+fa8b6 )

Followup: MachineOwner
---------

Update your ATI/AMD display driver.
You can get it from the link in our forum, http://www.sevenforums.com/graphic-...alyst-video-driver-windows-7-a.html#post17671, or you may go to AMD Graphics Driver and Software and opt for Automatically Detect and Install the appropriate driver for your card.

During installation, you may opt for advanced installation, and install the display driver only, not the Catalyst Control Center.

But, the hint of network failure is also present there, too. You have both VMWare and Virtual Box installed. Any special reason for it? Change the VirtualBox's net settings from "host only" to "NAT" or "Bridged".

Use only one of those visualization program, as they install a few adapters there as extra, shares a lot of network resource. Both of them can do the same thing very well.

 

[fsanyee]

I have the latest amd driver. should i instal the beta?

I need host only settings for virtual machines.
I installed vmware between the last two bsod, because I want to change from virtualbox...

btw I got the last two while I was playing.

 

[fsanyee]

Here comes the next one: