Windows 7: BSOD while playing Black Ops

Hi there

i just started to get BSOD while playing Black Ops multiplayer, it happened twice so far, both after playing the game for about 2 hours (yesterday slightly less, today slightly over 2 hours), both times on loading the next multiplayer map (not during actual shooting)...

My specs are:

Gigabyte X58A UD7 rev 1.0
Core i7 980x @ 3913MHz (28x135 + turbo on, HT on, power saving stuff on, vcore set to normal 1,25625V)
6x2 GB Kingston DDR3 1333 CL9 RAM
Gainward GTX590 @ 669/1338/1800 MHz 270.61 drivers
2x Intel X25m gen2 80GB SSD not RAIDed
WD Caviar Green WD20EARS
Seasonic S12D 750W

I used to play the game since November and everything was fine, no BSODs...the things that changed since i last played the game is the GPU and display drivers (had gtx460 and some older drivers before) and i overclocked CPU one more speedbin (up until last week it was at 3,78GHz, same settings)... this would probably mean, the issue is with either the GPU (overclock) or CPU overclock, my system is otherwise absolutely stable though. The CPU passed 5 runs of Intel Burn Test and both cores of GPU could render with Octane Render for 3 hours straight and no hiccup...and no other issues as well... Just FYI, i played the game only with one GPU core on.

Tomorrow i will try downclocking GPU and then CPU to see if it helps, but anyway i would like to ask you to look into attached files, as the problem is not that easily replicable - had to play the game for more than 2 hours for it to happen - so you could perhaps give me a hint, whats going on, if its CPU or GPU the main culprit.

Thanks for your help


Almost forgot, here is the Debugging tool analysis:


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\051711-14227-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 7 Kernel Version 7600 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16792.amd64fre.win7_gdr.110408-1633
Machine Name:
Kernel base = 0xfffff800`0361c000 PsLoadedModuleList = 0xfffff800`03859e50
Debug session time: Tue May 17 22:34:05.232 2011 (UTC + 2:00)
System Uptime: 0 days 4:45:16.760
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
..................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff8000368b8b1, fffff8800c0d01e0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceGdiTebAccess+7a )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8000368b8b1, Address of the instruction which caused the bugcheck
Arg3: fffff8800c0d01e0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!KiSystemServiceGdiTebAccess+7a
fffff800`0368b8b1 480f433547872300 cmovae rsi,qword ptr [nt!MmUserProbeAddress (fffff800`038c4000)]

CONTEXT: fffff8800c0d01e0 -- (.cxr 0xfffff8800c0d01e0)
rax=0000000000000020 rbx=fffffa800a3cdb60 rcx=00000000000002b4
rdx=0000000000010000 rsi=00000000012df8c8 rdi=fffff8800c0d0bc8
rip=fffff8000368b8b1 rsp=fffff8800c0d0bb0 rbp=fffff8800c0d0ca0
r8=0000000001b41d90 r9=0000000000000000 r10=fffff8000398ca30
r11=00000000002ff730 r12=00000000004ed6a0 r13=000007fefeda0000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010283
nt!KiSystemServiceGdiTebAccess+0x7a:
fffff800`0368b8b1 480f433547872300 cmovae rsi,qword ptr [nt!MmUserProbeAddress (fffff800`038c4000)] ds:002b:fffff800`038c4000=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B



PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 0000000076d7ff0a to fffff8000368b8b1

STACK_TEXT:
fffff880`0c0d0bb0 00000000`76d7ff0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceGdiTebAccess+0x7a
00000000`012df8a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d7ff0a


FOLLOWUP_IP:
nt!KiSystemServiceGdiTebAccess+7a
fffff800`0368b8b1 480f433547872300 cmovae rsi,qword ptr [nt!MmUserProbeAddress (fffff800`038c4000)]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiSystemServiceGdiTebAccess+7a

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4d9fdd34

STACK_COMMAND: .cxr 0xfffff8800c0d01e0 ; kb

FAILURE_BUCKET_ID: X64_0x3B_nt!KiSystemServiceGdiTebAccess+7a

BUCKET_ID: X64_0x3B_nt!KiSystemServiceGdiTebAccess+7a

Followup: MachineOwner
---------

5: kd> lmvm nt
start end module name
fffff800`0361c000 fffff800`03bf8000 nt (pdb symbols) C:\Program Files\Debugging Tools for Windows (x64)\sym\ntkrnlmp.pdb\DE7B3DD8AC5343B3B4874BAB3F4599DD2\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: C:\Program Files\Debugging Tools for Windows (x64)\sym\ntoskrnl.exe\4D9FDD345dc000\ntoskrnl.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Timestamp: Sat Apr 09 06:14:44 2011 (4D9FDD34)
CheckSum: 00547734
ImageSize: 005DC000
File version: 6.1.7600.16792
Product version: 6.1.7600.16792
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 6.1.7600.16792
FileVersion: 6.1.7600.16792 (win7_gdr.110408-1633)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

Hi Timmaigh and welcome

This one was a memory exception Related to Livemouclass.sys NT Caps-lock Ctrl Swapper from Systems Internals.

I would remove it to test.

Also of note these drivers need updating
How To Find Drivers:- - The most common drivers are listed on this page: Driver Reference Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

Hi there again,

thank you very much for your prompt answer... i do have few more questions now....

-so this last BSOD, which is according to that Debugging tools caused by the ntkrnlmp.exe, was related to (caused by?) the Livemouclass.sys, right?

-has this livemouclass.sys related BSOD any connection to overclocked components, i mean could it happen as the result of unstable CPU/GPU overclock?

-you said i should remove it to test, does it mean i can just simply go to its location and delete it? Or is it some kind of registry thing?

Thanks

1- yes related to=probably caused by

2-It can. Overclocking is a bane to stability

3-I would re-name it and see what complains. Mouseclass may be a part of the OS so I would also run a system file check to verify your OS files and repair if necessary.


Run a system file check to verify and repair your system files.
To do this type cmd in search, then right click to run as administrator, then
SFC /SCANNOW

Read here for more information SFC /SCANNOW Command - System File Checker

Let us know the results from the report at the end.

Ok, will do as you said and post results then.

Many thanks for your help

So i just ran the SCANNOW command - in fact twice in a row, just to be sure - and it says:

Windows resource protection did not find any integrity violations

So i suppose no corrupted system files there,...

I am going to run now the Intel Burn Test again, this time 25 passes wit lower RAM amount, apparently my 5 initial testing runs with max amount of RAM was a wrong approach, so the possible instability due the overclock might not show up...
this time CPU should be stressed more, so we´ll see...
If it passes, i will try to rename the mouclass file and play CoD again to see, if it helps... will report back again then...


EDIT:

Ok, so i just ran the IBT with those new settings and it FAILED on the 5th run unlike on my previous test, when it passed. I downclocked the CPU back now to 3,778 GHz - the clock i used since last September, at which i never had any BSODs or any obvious stability issues - tested it with the same IBT settings and it passed succesfully.
So i suppose (although i cant be 100 percent sure until i play Blops again, it still can be GPU or PSU or something else) i found the culprit, the Black Ops is quite CPU intensive game, so after 2 hours of gameplay it might destabilize the CPU somehow and obviously for Linpack 5 minutes were enough to do the same - well not exactly BSOD, but the discrepancy in the results, which is the sign of instability.

I will play the game, probably tomorrow evening and hope it wont BSOD again :P For now, thank you again for your time, i do not know, if you guys work for Microsoft or this is some "fansite" only, but this is how i imagine customer service should look like.

Sounds like a plan