BSOD (Bluescreen) windows 10

Smilingjack · Feb 9, 2017

I'm having very regular BSOD and Although Im able to undestand to some extend the minidumps I cant quite fix it myself so I was wondering if you would help me I used driver verifier to find and crash the system to see the results and I will give you the dumpfile if you could help me
http://www.filedropper.com/020917-21078-01 the link to the minidump

and here is the report of windbg on the minidump for those that cant download
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 14393 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 14393.693.amd64fre.rs1_release.161220-1747
Machine Name:
Kernel base = 0xfffff801`d667e000 PsLoadedModuleList = 0xfffff801`d6983060
Debug session time: Thu Feb 9 18:01:29.349 2017 (UTC + 2:00)
System Uptime: 0 days 1:42:58.176
Loading Kernel Symbols
..

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

.............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {f6, 6b4, ffffe487a2b52800, fffff801d6b51f5e}

*** WARNING: Unable to verify timestamp for xhunter1.sys
*** ERROR: Module load completed but symbols could not be loaded for xhunter1.sys
Probably caused by : xhunter1.sys ( xhunter1+13f6 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 00000000000006b4, Handle value being referenced.
Arg3: ffffe487a2b52800, Address of the current process.
Arg4: fffff801d6b51f5e, Address inside the driver that is performing the incorrect reference.

Debugging Details:
------------------

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 10.0.14393.693 (rs1_release.161220-1747)

SYSTEM_PRODUCT_NAME: To Be Filled By O.E.M.

SYSTEM_SKU: To Be Filled By O.E.M.

SYSTEM_VERSION: To Be Filled By O.E.M.

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: P1.60

BIOS_DATE: 07/23/2015

BASEBOARD_MANUFACTURER: ASRock

BASEBOARD_PRODUCT: H81M-DGS R2.0

BASEBOARD_VERSION:

DUMP_TYPE: 2

DUMP_FILE_ATTRIBUTES: 0xc
Insufficient Dumpfile Size
Kernel Generated Triage Dump

BUGCHECK_P1: f6

BUGCHECK_P2: 6b4

BUGCHECK_P3: ffffe487a2b52800

BUGCHECK_P4: fffff801d6b51f5e

BUGCHECK_STR: 0xc4_f6

CPU_COUNT: 4

CPU_MHZ: dab

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3c

CPU_STEPPING: 3

CPU_MICROCODE: 6,3c,3,0 (F,M,S,R) SIG: 1E'00000000 (cache) 1E'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME: xcoronahost.xe

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: SECRETLYINSANE

ANALYSIS_SESSION_TIME: 02-09-2017 18:04:59.0400

ANALYSIS_VERSION: 10.0.14321.1024 amd64fre

LAST_CONTROL_TRANSFER: from fffff801d6d8a360 to fffff801d67c86f0

STACK_TEXT:
ffffb181`415df298 fffff801`d6d8a360 : 00000000`000000c4 00000000`000000f6 00000000`000006b4 ffffe487`a2b52800 : nt!KeBugCheckEx
ffffb181`415df2a0 fffff801`d6d8f955 : ffffe487`a2b52800 00000000`00000000 ffffe487`00000000 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0x48
ffffb181`415df2e0 fffff801`d6c59afb : 00000000`00000000 00000000`00000000 fffff801`d6b0ccd0 ffffe487`6f858800 : nt!VfCheckUserHandle+0x1ad
ffffb181`415df3c0 fffff801`d6b51f5e : fffff801`d69a2400 ffffb181`001fffff 00000000`00000000 fffff801`d67ce200 : nt! ?? ::NNGAKEGL::`string'+0x618bb
ffffb181`415df460 fffff805`7d6113f6 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000079 : nt!ObReferenceObjectByHandle+0x2e
ffffb181`415df4b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000079 ffffb181`415df4f0 : xhunter1+0x13f6

STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: 14901a8d5265138a3bbdc4cb65e883a7cb721603

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 3368ab3d4d1a7d5f0e3bc83345a9f5133bfbd369

THREAD_SHA1_HASH_MOD: 4f1c0c40351f3b579f4d5fae7f0d58204065436e

FOLLOWUP_IP:
xhunter1+13f6
fffff805`7d6113f6 ?? ???

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: xhunter1+13f6

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: xhunter1

IMAGE_NAME: xhunter1.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 58006e6a

BUCKET_ID_FUNC_OFFSET: 13f6

FAILURE_BUCKET_ID: 0xc4_f6_VRFK_xhunter1!unknown_function

BUCKET_ID: 0xc4_f6_VRFK_xhunter1!unknown_function

PRIMARY_PROBLEM_CLASS: 0xc4_f6_VRFK_xhunter1!unknown_function

TARGET_TIME: 2017-02-09T16:01:29.000Z

OSBUILD: 14393

OSSERVICEPACK: 693

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2016-12-21 08:50:57

BUILDDATESTAMP_STR: 161220-1747

BUILDLAB_STR: rs1_release

BUILDOSVER_STR: 10.0.14393.693

ANALYSIS_SESSION_ELAPSED_TIME: 422

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0xc4_f6_vrfk_xhunter1!unknown_function

FAILURE_ID_HASH: {599d1c3e-6660-9452-9f5f-4cd786730e0b}

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 00000000000006b4, Handle value being referenced.
Arg3: ffffe487a2b52800, Address of the current process.
Arg4: fffff801d6b51f5e, Address inside the driver that is performing the incorrect reference.

Debugging Details:
------------------

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 10.0.14393.693 (rs1_release.161220-1747)

SYSTEM_PRODUCT_NAME: To Be Filled By O.E.M.

SYSTEM_SKU: To Be Filled By O.E.M.

SYSTEM_VERSION: To Be Filled By O.E.M.

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: P1.60

BIOS_DATE: 07/23/2015

BASEBOARD_MANUFACTURER: ASRock

BASEBOARD_PRODUCT: H81M-DGS R2.0

BASEBOARD_VERSION:

DUMP_TYPE: 2

DUMP_FILE_ATTRIBUTES: 0xc
Insufficient Dumpfile Size
Kernel Generated Triage Dump

BUGCHECK_P1: f6

BUGCHECK_P2: 6b4

BUGCHECK_P3: ffffe487a2b52800

BUGCHECK_P4: fffff801d6b51f5e

BUGCHECK_STR: 0xc4_f6

CPU_COUNT: 4

CPU_MHZ: dab

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3c

CPU_STEPPING: 3

CPU_MICROCODE: 6,3c,3,0 (F,M,S,R) SIG: 1E'00000000 (cache) 1E'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME: xcoronahost.xe

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: SECRETLYINSANE

ANALYSIS_SESSION_TIME: 02-09-2017 18:05:00.0462

ANALYSIS_VERSION: 10.0.14321.1024 amd64fre

LAST_CONTROL_TRANSFER: from fffff801d6d8a360 to fffff801d67c86f0

STACK_TEXT:
ffffb181`415df298 fffff801`d6d8a360 : 00000000`000000c4 00000000`000000f6 00000000`000006b4 ffffe487`a2b52800 : nt!KeBugCheckEx
ffffb181`415df2a0 fffff801`d6d8f955 : ffffe487`a2b52800 00000000`00000000 ffffe487`00000000 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0x48
ffffb181`415df2e0 fffff801`d6c59afb : 00000000`00000000 00000000`00000000 fffff801`d6b0ccd0 ffffe487`6f858800 : nt!VfCheckUserHandle+0x1ad
ffffb181`415df3c0 fffff801`d6b51f5e : fffff801`d69a2400 ffffb181`001fffff 00000000`00000000 fffff801`d67ce200 : nt! ?? ::NNGAKEGL::`string'+0x618bb
ffffb181`415df460 fffff805`7d6113f6 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000079 : nt!ObReferenceObjectByHandle+0x2e
ffffb181`415df4b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000079 ffffb181`415df4f0 : xhunter1+0x13f6

STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: 14901a8d5265138a3bbdc4cb65e883a7cb721603

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 3368ab3d4d1a7d5f0e3bc83345a9f5133bfbd369

THREAD_SHA1_HASH_MOD: 4f1c0c40351f3b579f4d5fae7f0d58204065436e

FOLLOWUP_IP:
xhunter1+13f6
fffff805`7d6113f6 ?? ???

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: xhunter1+13f6

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: xhunter1

IMAGE_NAME: xhunter1.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 58006e6a

BUCKET_ID_FUNC_OFFSET: 13f6

FAILURE_BUCKET_ID: 0xc4_f6_VRFK_xhunter1!unknown_function

BUCKET_ID: 0xc4_f6_VRFK_xhunter1!unknown_function

PRIMARY_PROBLEM_CLASS: 0xc4_f6_VRFK_xhunter1!unknown_function

TARGET_TIME: 2017-02-09T16:01:29.000Z

OSBUILD: 14393

OSSERVICEPACK: 693

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2016-12-21 08:50:57

BUILDDATESTAMP_STR: 161220-1747

BUILDLAB_STR: rs1_release

BUILDOSVER_STR: 10.0.14393.693

ANALYSIS_SESSION_ELAPSED_TIME: 434

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0xc4_f6_vrfk_xhunter1!unknown_function

FAILURE_ID_HASH: {599d1c3e-6660-9452-9f5f-4cd786730e0b}

Followup: MachineOwner

Colif · Feb 10, 2017

What is the "xhunter1.sys" ?
Our database contains 17 different files for filename xhunter1.sys . You can also check most distributed file variants with name xhunter1.sys. This files most often belongs to product XIGNCODE3. and were most often developed by company Wellbia.com Co., Ltd.. This files most often have description XIGNCODE3 System Guard.

xcoronahost.xe - not sure what this is but i wouldn't be surprised if they related to above

XIGNCODE3 is the next generation of gaming security solution mainly for online gaming service, currently patented and registered as a “one-time executable code structure”, which allows levels of various security policies according to company management measurements.

http://www.wellbia.com/home/en/pages/xigncode3/

do you play online games?

Smilingjack · Feb 10, 2017

I found that it is a sys file to the game Blackdesert online

Colif · Feb 10, 2017

I almost asked you if you were playing that game, I saw it mentioned in my search. Also saw people complaining about it to them.

Smilingjack · Feb 10, 2017

Yes I play that game this is the most recent bsod I've got other dumps one is like a week ago its not from that file though
http://www.filedropper.com/020417-16406-01
http://www.filedropper.com/020417-18046-01
http://www.filedropper.com/013017-32062-01
http://www.filedropper.com/012117-17234-01
http://www.filedropper.com/012017-19015-01
These are of the most commons bsod i get I know it might be bothersome but please take a look and help me out

Colif · Feb 10, 2017

i can't read dump files, but if you download and run who crashed it might show us the cause of the errors you still getting

copy/paste results in here and I see what I can do

Smilingjack · Feb 10, 2017

My version of who crashed isnt pro so it shows results for only 5 of 21 bsod and it seems to be random ones that arent that relevant (i suppose) since they are quite dated (not the bsod but the drivers that might be responsible since i believe i got rid of them )so IDK if I should trust it but anyway here is what I get
Computer name: SECRETLYINSANE
Windows version: Windows 10 , 10.0, build: 14393
Windows dir: C:\WINDOWS
Hardware: ASRock, H81M-DGS R2.0
CPU: GenuineIntel Intel(R) Core(TM) i5-4690K CPU @ 3.50GHz Intel586, level: 6
4 logical processors, active mask: 15
RAM: 17115930624 bytes total

--------------------------------------------------------------------------------
Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\WINDOWS\Minidump

Crash dumps are enabled on your computer.

On Thu 2/9/2017 6:01:29 PM your computer crashed
crash dump file: C:\WINDOWS\Minidump\020917-21078-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14A6F0)
Bugcheck code: 0xC4 (0xF6, 0x6B4, 0xFFFFE487A2B52800, 0xFFFFF801D6B51F5E)
Error: DRIVER_VERIFIER_DETECTED_VIOLATION
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This is the general bug check code for fatal errors found by Driver Verifier.
A driver references a user-mode handle as kernel mode. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Thu 2/9/2017 4:05:51 PM your computer crashed
crash dump file: C:\WINDOWS\Minidump\020917-15937-01.dmp
This was probably caused by the following module: tcpip.sys (0xFFFFF80F51F0566A)
Bugcheck code: 0xD1 (0xFFFFE6C16DA0765A, 0x2, 0x0, 0xFFFFF80F51F0566A)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\drivers\tcpip.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: TCP/IP Driver
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.

On Thu 2/9/2017 4:05:51 PM your computer crashed
crash dump file: C:\WINDOWS\memory.dmp
This was probably caused by the following module: rt64.sys (rt640x64+0x1B275)
Bugcheck code: 0xD1 (0xFFFFE6C16DA0765A, 0x2, 0x0, 0xFFFFF80F51F0566A)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: rt64.sys .
Google query: rt64.sys DRIVER_IRQL_NOT_LESS_OR_EQUAL

On Sat 2/4/2017 5:06:26 PM your computer crashed
crash dump file: C:\WINDOWS\Minidump\020417-16406-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14A6F0)
Bugcheck code: 0xA (0xFFFFD584CD8EEDB8, 0x2, 0x0, 0xFFFFF8008CF091B0)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Sat 2/4/2017 2:43:49 PM your computer crashed
crash dump file: C:\WINDOWS\Minidump\020417-18046-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14A6F0)
Bugcheck code: 0x7F (0x8, 0xFFFFF80098754E70, 0xFFFFAB417C94A7F0, 0xFFFFF800965C6ABF)
Error: UNEXPECTED_KERNEL_MODE_TRAP
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check indicates that the Intel CPU generated a trap and the kernel failed to catch this trap.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

21 crash dumps have been found and analyzed. Only 5 are included in this report. 2 third party drivers have been identified to be causing system crashes on your computer. It is strongly suggested that you check for updates for these drivers on their company websites. Click on the links below to search with Google for updates for these drivers:

cfosspeed6.sys
rt64.sys

If no updates for these drivers are available, try searching with Google on the names of these drivers in combination with the errors that have been reported for these drivers. Include the brand and model name of your computer as well in the query. This often yields interesting results from discussions on the web by users who have been experiencing similar problems.

I just did a windows update so the version is 1607 ATM

Paul NZ · Feb 10, 2017

xhunter1.sys is causing one of them. Looks like this belongs to Themida protection driver. Is this an Asrock file?

Uninstall ASRock App Charger . This is a known cause of crashes.

I would uninstall DAEMON Tools . This is also a known cause of crashes. Depending on what you use it for, Win10 supports ISO's natively

Uninstall Asrock ramdisk. Uninstall Afterburner. Only thing this does is crash windows

Speedfan drivers are 5 yrs old

Why are you using Win7 drivers in Windows 10? vbaudio_vmauxvaio64_win7.sys and vbaudio_vmvaio64_win7.sys

Uninstall Asrock V driver

Smilingjack · Feb 10, 2017

Ok I uninstalled all but MSI afterburner and I dont know what is asrock v driver so dont know what to uninstall
vbaudio_vmauxvaio64_win7.sys and vbaudio_vmvaio64_win7.sys i dont know how to update those and didnt know they were so outdated

Paul NZ · Feb 10, 2017

Those 2 files arent old. They're dated 2014. The prob maybe they're not for Win10. Whatever they're for

Colif · Feb 11, 2017

vbaudio_vmauxvaio64_win7.sys & vbaudio_vmvaio64_win7.sys are both parts of the same thing.

The files most often have description VB Virtual Audio Device. Its a Win 8 driver, even though name would lead you to believe otherwise. The files most often belong to product Windows (R) Win 7 DDK driver. and were most often developed by company Windows (R) Win 7 DDK provider.

This tells me so much: http://www.windowsprocess.com/en/s/windows-r-win-7-ddk-driver/
Windows Driver Development Kit?

Knowing what it is doesn't get me any closer to understanding why its there or what its part of.

somehow tied to virtual audio cable maybe...

Do you happen to have a Sony Vaio? only ask as driver name is a clue (maybe). I wonder if updating sound drivers would fix it.

Smilingjack · Feb 11, 2017

Its part of my virtual audio cables yes and Its from voicemeeter program and it hasn't given me any problems so i dont think its the culprit

Smilingjack · Feb 12, 2017

So today I just started the pc and tried to launch the game Hearthstone and instantly I got bsod here is the report
Microsoft (R) Windows Debugger Version 10.0.14321.1024 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\021217-82171-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 14393 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 14393.693.amd64fre.rs1_release.161220-1747
Machine Name:
Kernel base = 0xfffff800`d080d000 PsLoadedModuleList = 0xfffff800`d0b12060
Debug session time: Sun Feb 12 12:07:27.543 2017 (UTC + 2:00)
System Uptime: 0 days 0:46:26.708
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {ffffc3807f8d3588, 2, 1, fffff805ad04cae3}

*** WARNING: Unable to verify timestamp for rt640x64.sys
*** ERROR: Module load completed but symbols could not be loaded for rt640x64.sys
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : rt640x64.sys ( rt640x64+1b275 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffffc3807f8d3588, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff805ad04cae3, address which referenced memory

Debugging Details:
------------------

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 10.0.14393.693 (rs1_release.161220-1747)

SYSTEM_PRODUCT_NAME: To Be Filled By O.E.M.

SYSTEM_SKU: To Be Filled By O.E.M.

SYSTEM_VERSION: To Be Filled By O.E.M.

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: P1.60

BIOS_DATE: 07/23/2015

BASEBOARD_MANUFACTURER: ASRock

BASEBOARD_PRODUCT: H81M-DGS R2.0

BASEBOARD_VERSION:

DUMP_TYPE: 2

BUGCHECK_P1: ffffc3807f8d3588

BUGCHECK_P2: 2

BUGCHECK_P3: 1

BUGCHECK_P4: fffff805ad04cae3

WRITE_ADDRESS: fffff800d0bb4338: Unable to get MiVisibleState
ffffc3807f8d3588 Paged pool

CURRENT_IRQL: 2

FAULTING_IP:
tcpip!TcpDequeueTcbSend+3a3
fffff805`ad04cae3 488901 mov qword ptr [rcx],rax

CPU_COUNT: 4

CPU_MHZ: dab

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3c

CPU_STEPPING: 3

CPU_MICROCODE: 6,3c,3,0 (F,M,S,R) SIG: 1E'00000000 (cache) 1E'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

PROCESS_NAME: System

ANALYSIS_SESSION_HOST: SECRETLYINSANE

ANALYSIS_SESSION_TIME: 02-12-2017 12:12:16.0358

ANALYSIS_VERSION: 10.0.14321.1024 amd64fre

TRAP_FRAME: ffffc3817f8d30e0 -- (.trap 0xffffc3817f8d30e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff8a88b2f0c9d0 rbx=0000000000000000 rcx=ffffc3807f8d3588
rdx=ffff8a88b2c0e550 rsi=0000000000000000 rdi=0000000000000000
rip=fffff805ad04cae3 rsp=ffffc3817f8d3270 rbp=ffffc3817f8d3370
r8=00000000002a85fd r9=0000000000005f04 r10=00000000000040c3
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
tcpip!TcpDequeueTcbSend+0x3a3:
fffff805`ad04cae3 488901 mov qword ptr [rcx],rax ds:ffffc380`7f8d3588=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800d0962829 to fffff800d09576f0

STACK_TEXT:
ffffc381`7f8d2f98 fffff800`d0962829 : 00000000`0000000a ffffc380`7f8d3588 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
ffffc381`7f8d2fa0 fffff800`d0960e07 : ffffc381`7f8d3181 00000000`00000001 ffff9d83`50ff871d ffff54a4`7dfb34f0 : nt!KiBugCheckDispatch+0x69
ffffc381`7f8d30e0 fffff805`ad04cae3 : ffffc381`7f8d3370 00000000`000002b2 00000000`00020000 ffff8a88`b55f5550 : nt!KiPageFault+0x247
ffffc381`7f8d3270 fffff805`ad04f739 : 00000000`0000004e ffff8a88`b09682d0 ffff8a88`b55e9010 ffff8a88`af7b4000 : tcpip!TcpDequeueTcbSend+0x3a3
ffffc381`7f8d34e0 fffff805`ad04f20a : c1d0ef50`b2b6bf00 00000000`00000000 ffff8a88`b0a1b3da ffff8a88`b1b00a20 : tcpip!TcpTcbFastDatagram+0x189
ffffc381`7f8d3740 fffff805`ad04e840 : ffff8a88`af7b4140 ffff8a88`b0a0a222 ffff8a88`af63abf0 00000000`00000000 : tcpip!TcpTcbReceive+0x16a
ffffc381`7f8d3990 fffff805`ad04e241 : 00000000`00000000 00000000`00342397 ffff8a88`b0a1b3e2 ffff8a88`af64e9a0 : tcpip!TcpMatchReceive+0x1f0
ffffc381`7f8d3c40 fffff805`ad0573c3 : ffff8a88`af63abf0 ffff8a88`af7b4000 ffff8a88`af63abf0 00000000`00000000 : tcpip!TcpPreValidatedReceive+0x3a1
ffffc381`7f8d3d30 fffff805`ad056fa2 : ffffc381`7f8d3ec0 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!IppDeliverListToProtocol+0x93
ffffc381`7f8d3df0 fffff805`ad056324 : ffffc381`7f8d3ef9 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!IppProcessDeliverList+0x62
ffffc381`7f8d3e60 fffff805`ad058325 : fffff805`ad1ef000 ffff8a88`af6f1940 00000000`00000001 00000000`00000000 : tcpip!IppReceiveHeaderBatch+0x214
ffffc381`7f8d3f60 fffff805`ad05c6a1 : ffff8a88`b035bc80 ffff8a88`b09682d0 ffffc381`7f8d4101 00000000`00000000 : tcpip!IppFlcReceivePacketsCore+0x315
ffffc381`7f8d4080 fffff805`ad05c382 : ffff8a88`b0960002 ffffc381`00000001 fffff805`ad091200 00000000`b0968201 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x271
ffffc381`7f8d4160 fffff800`d089b505 : 00000000`00000002 ffff8a88`af62f800 fffff805`ad05c2c0 ffffc381`7f8d4310 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xc2
ffffc381`7f8d4290 fffff805`ad091956 : ffff8a88`ac5d78a0 00000000`00000000 ffff8a88`ac5d75c0 ffff8a88`b0968200 : nt!KeExpandKernelStackAndCalloutInternal+0x85
ffffc381`7f8d42e0 fffff805`ade3392e : 00000000`00000000 ffffc381`7f8d43e0 00000000`00000001 ffff8a88`b1b10010 : tcpip!FlReceiveNetBufferListChain+0xb6
ffffc381`7f8d4360 fffff805`ade333c4 : 00000000`00000001 fffff805`00000000 ffff8a88`00000000 00000000`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0x11e
ffffc381`7f8d4420 fffff805`ade33e97 : ffff8a88`b01dc1a0 ffff8a88`00000000 ffff8a88`b01dc1a0 fffff805`ad1f9420 : ndis!ndisMTopReceiveNetBufferLists+0x224
ffffc381`7f8d4530 fffff805`ade32ce5 : ffff8a88`b01dc1a0 ffffc381`7f8d4680 00000000`00000000 ffff8a88`abef5c30 : ndis!ndisCallReceiveHandler+0x47
ffffc381`7f8d4580 fffff805`b0f9b275 : ffff8a88`099ccbe0 ffff8a88`b08ec000 00000000`00000000 ffff8a88`00000001 : ndis!NdisMIndicateReceiveNetBufferLists+0x735
ffffc381`7f8d4770 ffff8a88`099ccbe0 : ffff8a88`b08ec000 00000000`00000000 ffff8a88`00000001 ffff8a88`00000001 : rt640x64+0x1b275
ffffc381`7f8d4778 ffff8a88`b08ec000 : 00000000`00000000 ffff8a88`00000001 ffff8a88`00000001 ffff8a88`b1b0cc10 : 0xffff8a88`099ccbe0
ffffc381`7f8d4780 00000000`00000000 : ffff8a88`00000001 ffff8a88`00000001 ffff8a88`b1b0cc10 00000001`00000000 : 0xffff8a88`b08ec000

STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: 76a33cc8c5727825fe380987da8f60b01d705bcb

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: bd0beb36db3b6c3a912f4ec5b462984a157ab539

THREAD_SHA1_HASH_MOD: 18f1663c9022c8d188cb5339a71a6f879d99bcc7

FOLLOWUP_IP:
rt640x64+1b275
fffff805`b0f9b275 ?? ???

SYMBOL_STACK_INDEX: 14

SYMBOL_NAME: rt640x64+1b275

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: rt640x64

IMAGE_NAME: rt640x64.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 57f769c3

BUCKET_ID_FUNC_OFFSET: 1b275

FAILURE_BUCKET_ID: AV_rt640x64!unknown_function

BUCKET_ID: AV_rt640x64!unknown_function

PRIMARY_PROBLEM_CLASS: AV_rt640x64!unknown_function

TARGET_TIME: 2017-02-12T10:07:27.000Z

OSBUILD: 14393

OSSERVICEPACK: 693

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2016-12-21 08:50:57

BUILDDATESTAMP_STR: 161220-1747

BUILDLAB_STR: rs1_release

BUILDOSVER_STR: 10.0.14393.693

ANALYSIS_SESSION_ELAPSED_TIME: 972

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:av_rt640x64!unknown_function

FAILURE_ID_HASH: {2e96e72d-48ac-dceb-22bd-11e71513e43e}

Followup: MachineOwner

Smilingjack · Feb 12, 2017

btw I never really shared with you my specs here they are straight out of DXDIAG http://www.filedropper.com/dxdiag_17

Colif · Feb 12, 2017

Realtek NICDRV 8169 PCIe GBE Family Controller driver

Name: Realtek PCIe GBE Family Controller
Device ID: PCI\VEN_10EC&DEV_8168&SUBSYS_81681849&REV_0C\4&2AF7FC6&0&00E3
Driver: C:\WINDOWS\system32\DRIVERS\rt640x64.sys, 10.12.1007.2016 (English), 12/20/2016 03:49:57, 955424 bytes
Driver: C:\WINDOWS\system32\RtNicProp64.dll, 1.02.0000.0006 (English), 12/20/2016 03:49:57, 91272 bytes

You should download latest Realtek Drivers

Smilingjack · Feb 12, 2017

Colif :

Alright will do after I finish memtest currently running im from the phone now
About Realtek ive always tried to update them but for some reason their site never loads ive hanged for hours on end will try again using the link if you can put a specific one I'd be very glad

Colif · Feb 12, 2017

What motherboard do you have? Its one of things not mentioned in DXDiag. I would use the drivers found on your motherboard site for your lan

the top link appears to match your drivers, as its 10.13 & you have 10.12 now

Smilingjack · Feb 12, 2017

Colif :

My motherboard is http://www.asrock.com/MB/Intel/H81M-DGS%20R2.0/index.us.asp

Colif · Feb 12, 2017

Looking at what is listed it seems you have a newer version than they have on their site anyway

Yes, this is version from Oct 2015 - Windows 10 64bit ver:10.3.723.2015 which is last Asrock show against PC

Try downloading them from here: http://www.techspot.com/downloads/drivers/essentials/realtek-pcie-lan/

Smilingjack · Feb 12, 2017

Colif :

After I finish the test I will, currently im ending pass 2/4 at test 7 of pass 2 I got 3 errors for expected and actual adresses

Smilingjack · Feb 12, 2017

This is my ram cmz16gx3m2a1600c9 corsair

Colif · Feb 12, 2017

You are testing it one stick at a time. You don't want any errors in memtest so the fact you have some could mean problem is your ram, and you need a new stick (or set of sticks)

IRQ errors can be ram, its not common but it can happen - i have seen it happen during fresh installs for example

Smilingjack · Feb 12, 2017

Colif :

Im almost dones with pass 3/4 and I started the test with both sticks should I do it for each independently again? Also idk if I might get a return cuz im not from USA so idk how that works prob gonna stick with these for now cuz I dont have the money for brand new 16g

Colif · Feb 12, 2017

Yes, test 1 stick at a time as if you test both you don't really know which one is to blame then.

I would google corsair warranty in your country, they seem to have locations in many countries outside USA, and the warranty is life time so if you have a location close by, I would look into an rma and get new sticks rather than use 8gb if the other sitick causes errorrs.

Smilingjack · Feb 13, 2017

So I found the stick that is faulty and have asked for RMA and now im waiting for a response I really hope it works out cuz I really dont have the money to buy new ram and well Im from Bulgaria and hope there is a way cuz exchange rates sucks

BSOD (Bluescreen) windows 10

Commendable

Win 11 Master

Commendable

Win 11 Master

Commendable

Win 11 Master

Commendable

Polypheme

Commendable

Polypheme

Win 11 Master

Commendable

Commendable

Commendable

Win 11 Master

Commendable

Win 11 Master

Commendable

Win 11 Master

Commendable

Commendable

Win 11 Master

Commendable

Win 11 Master

Commendable

Share this page