Overclock.net › Forums › Software, Programming and Coding › Operating Systems › Windows › Crash Analysis and Debugging › Multiple BSOD Messages Help
New Posts  All Forums:Forum Nav:

Multiple BSOD Messages Help

post #1 of 7
Thread Starter 
Hi,

In the last couple of weeks I've had multiple BSOD with loads of different messages. I can't figure out what it is so I'm reaching out to you guys in hope that someone can tell me what is going on.

So far I've had:
MULTIPLE_IRP_COMPLETE_REQUESTS
PFN_LIST_CORRUPT
MEMORY_MANAGEMENT
PAGE_FAULT_IN_NON_PAGED_AREA
BAD_POOL_HEADER

The steps I've taken are:
Reading some of the forums it initially sounded like it could be RAM issues so I removed the 4 sticks of RAM and just had two. I ran the Memtest86 app on both for about 4 hours each and there were no problems identified.
I've updated all windows software.
I've updated my graphic card driver.
I've unistalled whatever I don't really need on my PC.
I've ran sfc /scannow a few times.
I've started the Driver Verifier and the last dump file should be for that one so hopefully that will have some clues.


I've noticed it when I've got Photoshop open and playing a video (streaming) but I don't think these have been the only times.

I've attached the relevant files asked for in another post, if you need anything more just let me know.

Thanks in advance,

Chris


Windows7_Vista_jcgriff2.zip 2539k .zip file
PERF REPORT (2).zip 158k .zip file
post #2 of 7
Hi,

First of all, in regards to the perfmon:
Quote:
High average interrupts / processor. This machine has 4 processors and 10 network cards. Total Interrupts/sec on the machine is 68235. The average interrupts per processor per sec is 17059.

Are these network cards virtualized? I would really disable them for troubleshooting purposes until then.

Onto the DMP files:

I am seeing many athurx.sys culprits.

For example, we have a BAD_POOL_HEADER (19)
Quote:
This indicates that a pool header is corrupt.

Usual cause is a device driver has a bug.

If we take a look at the call stack, we can see throughout are instances of athrux being called:
Code:
2: kd> kv
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`02344fe8 fffff800`02dbacae : 00000000`00000019 00000000`00000020 fffffa80`06e35800 fffffa80`06e35800 : nt!KeBugCheckEx
fffff880`02344ff0 fffff880`0511539e : fffffa80`054c4ba0 fffff880`04a04af4 fffffa80`42554855 fffffa80`05340060 : nt!ExDeferredFreePool+0x12da
fffff880`023450a0 fffff880`050e558f : 00000000`00000103 fffffa80`05340060 fffffa80`054c4ba0 fffffa80`047171a0 : usbhub!UsbhDecPdoIoCount+0xc6
fffff880`023450f0 fffff880`05115d8f : 00000000`00000000 00000000`00000000 fffffa80`05340060 0000057f`fac2fba8 : usbhub!UsbhFdoUrbPdoFilter+0x107
fffff880`02345120 fffff880`050e3fb7 : 00000000`00000005 fffff880`023451f0 fffffa80`053d0450 00000000`00000000 : usbhub!UsbhPdoInternalDeviceControl+0x373
fffff880`02345170 fffff880`00edff47 : fffff880`02412750 fffffa80`053da450 fffff880`023451f0 0000057f`fac25ba8 : usbhub!UsbhGenDispatch+0x57
fffff880`023451a0 fffff880`0241497f : fffffa80`051a2fc0 fffffa80`053da450 fffffa80`053d0450 fffffa80`0548fe28 : Wdf01000!imp_WdfRequestSend+0x4b3
fffff880`02345230 fffffa80`051a2fc0 : fffffa80`053da450 fffffa80`053d0450 fffffa80`0548fe28 fffffa80`0555fb50 : athurx+0x997f
fffff880`02345238 fffffa80`053da450 : fffffa80`053d0450 fffffa80`0548fe28 fffffa80`0555fb50 fffff880`0240da7a : 0xfffffa80`051a2fc0
fffff880`02345240 fffffa80`053d0450 : fffffa80`0548fe28 fffffa80`0555fb50 fffff880`0240da7a 0000057f`fac25ba8 : 0xfffffa80`053da450
fffff880`02345248 fffffa80`0548fe28 : fffffa80`0555fb50 fffff880`0240da7a 0000057f`fac25ba8 0000057f`fac2fba8 : 0xfffffa80`053d0450
fffff880`02345250 fffffa80`0555fb50 : fffff880`0240da7a 0000057f`fac25ba8 0000057f`fac2fba8 00000000`00000000 : 0xfffffa80`0548fe28
fffff880`02345258 fffff880`0240da7a : 0000057f`fac25ba8 0000057f`fac2fba8 00000000`00000000 fffff880`02345288 : 0xfffffa80`0555fb50
fffff880`02345260 0000057f`fac25ba8 : 0000057f`fac2fba8 00000000`00000000 fffff880`02345288 00000000`00000000 : athurx+0x2a7a
fffff880`02345268 0000057f`fac2fba8 : 00000000`00000000 fffff880`02345288 00000000`00000000 00000000`00000000 : 0x0000057f`fac25ba8
fffff880`02345270 00000000`00000000 : fffff880`02345288 00000000`00000000 00000000`00000000 00000000`00000010 : 0x0000057f`fac2fba8

athurx = Atheros AR9271 Wireless Network Adapter.

We usually have network / ethernet faults when the following occurs:

1. 3rd party antivirus / firewall software is conflicting.

2. Network drivers need to be updated.

Here is what I am going to recommend for now -

Remove and replace !avast with Microsoft Security Essentials:

!avast removal tool - http://www.avast.com/uninstall-utility

MSE - http://windows.microsoft.com/en-us/windows/security-essentials-download
Quote:
nvm62x64 fffff880`0586d000 fffff880`058d0d80 Fri Oct 17 17:01:06 2008 (48f8fd12) 0006f977 nvm62x64.sys

^^ nVidia Ethernet Networking Driver (nForce chipset driver). See if there's an update - http://www.nvidia.com/Download/index.aspx
Quote:
athurx fffff880`01e11000 fffff880`01fef000 Wed Apr 20 06:07:45 2011 (4daeb071) 001e1c78 athurx.sys

^^ Atheros AR9271 Wireless Network Adapter. See if there's an update - http://www.atheros.cz/

Regards,

Patrick
post #3 of 7
Thread Starter 
Hi Patrick, thanks so much for your quick reply.

I have uninstalled avast and installed MSE. I have updated the Nvidia drivers chipset drivers.

There are a couple of things I am unsure of. My wireless network adapter (TP-Link WN822N) shows up as Wireless Connection #10 however I can't see wireless connections 1-9 in order to disable them, is this possible? Also I used to have an Edimax wireless adapter which I think is where the Atheros driver comes from but I can't see this installed and don't know how to uninstall it and remove this athurx file.

Thanks

Chris
post #4 of 7
Hi,

Good work!
Quote:
My wireless network adapter (TP-Link WN822N) shows up as Wireless Connection #10 however I can't see wireless connections 1-9 in order to disable them, is this possible?

I will look into this for you, I'll redirect it to fellow networking experts.
Quote:
? Also I used to have an Edimax wireless adapter which I think is where the Atheros driver comes from but I can't see this installed and don't know how to uninstall it and remove this athurx file.

If it's not in add/remove programs, you can create a system restore point - http://windows.microsoft.com/en-us/windows7/products/features/system-restore

and then navigate to C:\Windows\System32\Drivers and rename athurx.sys to athurx.old

That will break the driver and cause it to no longer load. Since it's not affecting a device anymore, there should be no problems. I am only recommending creating a system restore point just in case.

Regards,

Patrick
post #5 of 7
Okay, in regards to the 10 NIC's, can you enable hidden devices in Device Manager, please?

View > Show hidden devices

and then take a screenshot of your DevMan window.

Regards,

Patrick
post #6 of 7
Thread Starter 
Hi Patrick,

I've got rid of Avast and bought a new wireless adapter as it turned out my TP-Link adapter used that Atheros chipset. It all seems to be working now (cross fingers) which is a huge relief.

I've attached a picture of the device manager with the hidden devices showing. Not sure if this is normal or not but there seems to be loads of devices in the networks section.

Chris
20130804_Device-Manager-Screenshot.jpg 143k .jpg file
post #7 of 7
Hi,

Glad to hear everything's okay so far! Please keep me updated.

In regards to your network situation, have you at any point created a wireless ad-hoc network or perhaps joined a homegroup? That would be the explanation for the virtual wifi miniports. If your wifi connector is a USB device, and the computer itself presents it differently during different boot cycles, Windows has to create a new miniport device to bind to the wireless NIC. The reason for this is because the "old" one has disappeared, and the "new" one is such because the GUID changed due to it being presented differently than the last time to the OS.

1 wireless NIC, 2x physical NICs, and 7 virtual miniport adapters. Add them all up and we get 10.

Regards,

Patrick
New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: Crash Analysis and Debugging
Overclock.net › Forums › Software, Programming and Coding › Operating Systems › Windows › Crash Analysis and Debugging › Multiple BSOD Messages Help