locked
BSOD - EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" RRS feed

  • Question

  • This is part of the Dump.  Let me know any other parts you guys may need.  I already ran Malwarebytes/Combofix on this machine months ago.  I'm thinking faulty ram but I'm hoping just a driver issue.

    KMODE_EXCEPTION_NOT_HANDLED (1e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff80002a5b26b, The address that the exception occurred at
    Arg3: 0000000000000000, Parameter 0 of the exception
    Arg4: 000000007efa0000, Parameter 1 of the exception

    Debugging Details:
    ------------------

    TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    FAULTING_IP:
    nt!RtlImageNtHeaderEx+3f
    fffff800`02a5b26b 66390a          cmp     word ptr [rdx],cx

    EXCEPTION_PARAMETER1:  0000000000000000

    EXCEPTION_PARAMETER2:  000000007efa0000

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cb3100
    GetUlongFromAddress: unable to read from fffff80002cb31c0
     000000007efa0000 Nonpaged pool

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    BUGCHECK_STR:  0x1e_c0000005

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

    PROCESS_NAME:  dllhost.exe

    CURRENT_IRQL:  0

    TRAP_FRAME:  fffff880031e77b0 -- (.trap 0xfffff880031e77b0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000005a4d
    rdx=000000007efa0000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002a5b26b rsp=fffff880031e7948 rbp=fffff880031e7a80
     r8=0000000000000000  r9=fffff880031e7988 r10=0000000000000000
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe nc
    nt!RtlImageNtHeaderEx+0x3f:
    fffff800`02a5b26b 66390a          cmp     word ptr [rdx],cx ds:00000000`7efa0000=????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from fffff80002ac57e8 to fffff80002a7ac40

    CONTEXT:  8d4a3e75c23a413c -- (.cxr 0x8d4a3e75c23a413c)
    Unable to read context, Win32 error 0n30

    Wednesday, April 2, 2014 2:02 PM

Answers

  • Hi Petrinoda,

    Could you please upload the dump file to OneDrive, then paste the link here for analyzing?


    Yolanda Zhu
    TechNet Community Support

    • Proposed as answer by ZigZag3143x Saturday, May 3, 2014 6:11 AM
    • Marked as answer by ZigZag3143x Saturday, May 3, 2014 7:47 PM
    Thursday, April 3, 2014 5:46 AM
  • These crashes were related to memory corruption (probably caused by a driver). 

    Please run this test to find which driver is causing the problem.  

    If you are overclocking (pushing the components beyond their design) you should revert to default at least until the crashing is solved. If you don't know what it is you probably are not overclocking.


    Driver verifier (for complete directions see our wiki here)
    Co-Authored by  JMH3143

    Wanikiya and Dyami--Team Zigzag

    • Proposed as answer by ZigZag3143x Saturday, May 3, 2014 6:11 AM
    • Marked as answer by ZigZag3143x Saturday, May 3, 2014 7:48 PM
    Tuesday, April 8, 2014 7:28 PM

All replies

  • Hi Petrinoda,

    Could you please upload the dump file to OneDrive, then paste the link here for analyzing?


    Yolanda Zhu
    TechNet Community Support

    • Proposed as answer by ZigZag3143x Saturday, May 3, 2014 6:11 AM
    • Marked as answer by ZigZag3143x Saturday, May 3, 2014 7:47 PM
    Thursday, April 3, 2014 5:46 AM
  • As requested here is the onedrive link to the newest dump file

    http://1drv.ms/1fG1S9T

    After updating all the drivers I would say it's most likely a RAM issue.

    Friday, April 4, 2014 1:55 PM
  • BUMP
    Tuesday, April 8, 2014 6:30 PM
  • These crashes were related to memory corruption (probably caused by a driver). 

    Please run this test to find which driver is causing the problem.  

    If you are overclocking (pushing the components beyond their design) you should revert to default at least until the crashing is solved. If you don't know what it is you probably are not overclocking.


    Driver verifier (for complete directions see our wiki here)
    Co-Authored by  JMH3143

    Wanikiya and Dyami--Team Zigzag

    • Proposed as answer by ZigZag3143x Saturday, May 3, 2014 6:11 AM
    • Marked as answer by ZigZag3143x Saturday, May 3, 2014 7:48 PM
    Tuesday, April 8, 2014 7:28 PM