[SOLVED] BSOD caused by driver ntoskrnl.exe and address ntoskrnl.exe+3f78a0

MFDOOM123

Prominent
Jan 6, 2022
19
0
510
I have been getting random BSOD's with these errors for the last few days.

My system :

Processor Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz 3.40 GHz
Installed RAM 16.0 GB (15.9 GB usable)
SSD x1 HDDx2
NVIDIA GeForce GTX 650



Edition Windows 10 Pro
Version 21H2
Installed on ‎08-‎01-‎2022
OS build 19044.1645
Experience Windows Feature Experience Pack 120.2212.4170.0




https://drive.google.com/drive/folders/1X1v-YuOBsk9FR1BRRT932c9IgjOjD0lt?usp=sharing
- The DMP files ( these are the latest DMP files) ( Please refer to the reply for more actions I have done )


Please help me find which driver is causing this issue ?

***
  • *
  • Bugcheck Analysis *
  • *
***

CRITICAL_PROCESS_DIED (ef)
A critical system process died
Arguments:
Arg1: ffff800d86c8d080, Process object or thread object
Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.
Arg3: 0000000000000000, The process object that initiated the termination.
Arg4: 0000000000000000

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 4936

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 12616

Key : Analysis.Init.CPU.mSec
Value: 828

Key : Analysis.Init.Elapsed.mSec
Value: 6054

Key : Analysis.Memory.CommitPeak.Mb
Value: 108

Key : Bugcheck.Code.DumpHeader
Value: 0xef

Key : Bugcheck.Code.KiBugCheckData
Value: 0xef

Key : Bugcheck.Code.Register
Value: 0xef

Key : CriticalProcessDied.ExceptionCode
Value: 900c0080

Key : CriticalProcessDied.Process
Value: svchost.exe

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


FILE_IN_CAB: MEMORY.DMP

BUGCHECK_CODE: ef

BUGCHECK_P1: ffff800d86c8d080

BUGCHECK_P2: 0

BUGCHECK_P3: 0

BUGCHECK_P4: 0

PROCESS_NAME: svchost.exe

CRITICAL_PROCESS: svchost.exe

EXCEPTION_RECORD: ffff800d86c8d7c0 -- (.exr 0xffff800d86c8d7c0)
ExceptionAddress: 0000000000000000
ExceptionCode: 00000000
ExceptionFlags: 00000000
NumberParameters: 0

ERROR_CODE: (NTSTATUS) 0x900c0080 - <Unable to get error code text>

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

EXCEPTION_STR: 0x0

SYMBOL_NAME: ntdll!RtlpxVirtualUnwind+b4

MODULE_NAME: ntdll

IMAGE_NAME: ntdll.dll

STACK_COMMAND: .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET: b4

FAILURE_BUCKET_ID: 0xEF_svchost.exe_DcomLaunch_BUGCHECK_CRITICAL_PROCESS_900c0080_ntdll!RtlpxVirtualUnwind

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {3fbbaf2c-5978-6c6d-3cc9-d4c96180500c}

Followup: MachineOwner
---------
 
Last edited:
Solution
What a coincidence that they both use same drivers

https://www.herdprotect.com/netr28ux.sys-f8fe2ce20fbf554dc6e2d228ca3ed0e3c76d4340.aspx shows mediatek
https://www.freefixer.com/library/file/netr28ux.sys-192609/ shows Ralink

no coincidence really

On 5 May 2011, Ralink was acquired by MediaTek.
https://en.wikipedia.org/wiki/Ralink

I would get an Intel one, they don't use that driver.

get one labelled one of these
  • WIFI6
  • AX
  • AC2100
its newest standard, might cost more but will last longer too.

Colif

Win 11 Master
Moderator
Sorry I missed your post until now.

your 2nd link doesn't work, 404 on google

I will ask a friend to convert the 1st link and he will do 2nd if its fixed by then. He is asleep now so I can't tell you when he will answer.
 

MFDOOM123

Prominent
Jan 6, 2022
19
0
510
Sorry I missed your post until now.

your 2nd link doesn't work, 404 on google

I will ask a friend to convert the 1st link and he will do 2nd if its fixed by then. He is asleep now so I can't tell you when he will answer.


Hey Colif ,

Thanks for seeing my post !!

I have posted this same issue on the Microsoft Community page and have an ongoing thread where Dave has been helping me with various solutions. I have reached wits end with this issue. Its happening every 15-30 minutes now.

https://answers.microsoft.com/en-us...d=9942a9be-9744-424a-be64-528ee9533335&page=1

It would be really helpful if you could go through the thread

Some things I have tried which are mentioned on the thread :

  1. Passed the MemTest86 4 times as well. Took 3 hours and no errors.
  2. I went to my manufacturers website and and can see that I have the latest chipsets and BIOS (2015 seems to be the last update)
  3. Used Driver Verifier to crash Windows 3 times to check out any errors
  4. Updated my AC600 Wireless Dual Band USB Adapter TP link ARCHER T2U V1
  5. Removed my old D-Link DWA-525 Wireless N 150 Desktop Adapter(rev.A2) wifi card

Its still happening

These are the latest Dmp files




https://drive.google.com/drive/folders/1X1v-YuOBsk9FR1BRRT932c9IgjOjD0lt?usp=sharing


Please see if you can help. I have spent a full day trying to diagnose this issue to no avail.
 

Colif

Win 11 Master
Moderator
The TP link Archer uses mediatek chipset - http://en.techinfodepot.shoutwiki.com/wiki/TP-LINK_Archer_T2U so unlikely to be using that driver

netr28ux.sys appears to be Ralink 802.11n wireless drivers
so thats for the card you removed. As its full name is:
Ralink D-Link DWA-525 Wireless N 150 Desktop Adapter(rev.A2)

so in theory they shouldn't be active now...

Microsoft are still answering you, I don't want to get in the way. If he stops replying, sure.
 

MFDOOM123

Prominent
Jan 6, 2022
19
0
510
The TP link Archer uses mediatek chipset - http://en.techinfodepot.shoutwiki.com/wiki/TP-LINK_Archer_T2U so unlikely to be using that driver

netr28ux.sys appears to be Ralink 802.11n wireless drivers
so thats for the card you removed. As its full name is:
Ralink D-Link DWA-525 Wireless N 150 Desktop Adapter(rev.A2)

so in theory they shouldn't be active now...

Microsoft are still answering you, I don't want to get in the way. If he stops replying, sure.


Thanks for the reply Colf

Ran Driver Verifier again and got the this dump file : https://1drv.ms/u/s!Ajeq8HTk0F-Bmy7CYeKtfeZdWYUA?e=pmMTwr

Still showing that netr28ux.sys is the issue even though I removed the card

I really don't know what to do.

Will reply here if Dave from Microsoft stops replying

Thanks for taking the time for checking this out
 

Colif

Win 11 Master
Moderator
try running this and look on driver tab and disable that driver from running with windows at startup.
https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns (might need to run as admin)
if you untick it, it won't run at startup. If any program needs it, it can be opened
you could check with Dave and see if he suggests using it to remove driver... as it can do that.

if hardware is gone, it shouldn't be loading.
 

MFDOOM123

Prominent
Jan 6, 2022
19
0
510
The TP link Archer uses mediatek chipset - http://en.techinfodepot.shoutwiki.com/wiki/TP-LINK_Archer_T2U so unlikely to be using that driver

netr28ux.sys appears to be Ralink 802.11n wireless drivers
so thats for the card you removed. As its full name is:
Ralink D-Link DWA-525 Wireless N 150 Desktop Adapter(rev.A2)

so in theory they shouldn't be active now...

Microsoft are still answering you, I don't want to get in the way. If he stops replying, sure.



It does seem like the netr28ux.sys file is associated with the new dongle.



http://en.techinfodepot.shoutwiki.com/wiki/TP-LINK_Archer_T2U - The TP link Archer uses mediatek chipset


Went to the properties of the file netr28ux.sys on System32 and saw this : View: https://imgur.com/usgJZj0




Am i getting this right ?



I am ordering a new dongle just in case to see if this is the issue
 

Colif

Win 11 Master
Moderator
What a coincidence that they both use same drivers

https://www.herdprotect.com/netr28ux.sys-f8fe2ce20fbf554dc6e2d228ca3ed0e3c76d4340.aspx shows mediatek
https://www.freefixer.com/library/file/netr28ux.sys-192609/ shows Ralink

no coincidence really

On 5 May 2011, Ralink was acquired by MediaTek.
https://en.wikipedia.org/wiki/Ralink

I would get an Intel one, they don't use that driver.

get one labelled one of these
  • WIFI6
  • AX
  • AC2100
its newest standard, might cost more but will last longer too.
 
Last edited:
Solution

MFDOOM123

Prominent
Jan 6, 2022
19
0
510
What a coincidence that they both use same drivers

https://www.herdprotect.com/netr28ux.sys-f8fe2ce20fbf554dc6e2d228ca3ed0e3c76d4340.aspx shows mediatek
https://www.freefixer.com/library/file/netr28ux.sys-192609/ shows Ralink

no coincidence really


https://en.wikipedia.org/wiki/Ralink

I would get an Intel one, they don't use that driver.

get one labelled one of these
  • WIFI6
  • AX
  • AC2100
its newest standard, might cost more but will last longer too.


So I just ordered a TP-LINK AC1300 Archer T3U Plus High Gain USB 3.0 Wi-Fi Dongle ? Should I cancel it because it would cause the same issues ?
 

Colif

Win 11 Master
Moderator

MFDOOM123

Prominent
Jan 6, 2022
19
0
510
http://en.techinfodepot.shoutwiki.com/wiki/TP-LINK_Archer_T3U_Plus is based on a realtek chipset
its drivers are from 2018 - https://www.realtek.com/en/component/zoo/category/rtl8812bu-software
it might be okay but I have seen a lot of realtek dongles stop working too.

what motherboard do you have?
i would get something like this if you have a spare pcie slot. = https://www.tp-link.com/au/home-networking/pci-adapter/archer-tx3000e/ if you can.

My setup is nine years old . I have a Gigabyte B85M-D3H Motherboard. Anything you would recommend for that ?

Thanks for taking out the time out to answer my questions.

Btw it seems like its the TP-Link Archer Dongle. Since I have removed it not a single BSOD crash.
 

Colif

Win 11 Master
Moderator

gardenman

Splendid
Moderator
Hi, I ran the dump files through the debugger and got the following information: https://jsfiddle.net/L9htn4vg/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.
File information:081222-17046-01.dmp (Aug 12 2022 - 06:52:49)
Bugcheck:CRITICAL_PROCESS_DIED (EF)
Probably caused by:memory_corruption (Process running at time of crash: svchost.exe)
Uptime:0 Day(s), 0 Hour(s), 00 Min(s), and 50 Sec(s)

File information:081222-16734-01.dmp (Aug 12 2022 - 07:00:10)
Bugcheck:CRITICAL_PROCESS_DIED (EF)
Probably caused by:memory_corruption (Process running at time of crash: svchost.exe)
Uptime:0 Day(s), 0 Hour(s), 03 Min(s), and 41 Sec(s)

File information:081222-16656-01.dmp (Aug 12 2022 - 06:55:21)
Bugcheck:CRITICAL_PROCESS_DIED (EF)
Probably caused by:memory_corruption (Process running at time of crash: services.exe)
Uptime:0 Day(s), 0 Hour(s), 01 Min(s), and 49 Sec(s)
Comment: 2 or more types of RAM are installed.

Comment: The overclocking driver "XtuAcpiDriver.sys" was found on your system. (Intel Extreme Tuning Utility)

Motherboard: Gigabyte B85M-D3H (Not sure which Revision so unable to check for BIOS update).

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.
 
  • Like
Reactions: Colif