Windows 7: BSOD playing Battlefield 3.

sanchir0805 · 28 Nov 2012

Hello everyone. I have been a reader of this forum for a long time until my pc crashed on me just now. I couldn't take a screenshot because it just happened once and restarted real quick.

I had the pc for 3 months now and it never happened before. I attached the minidump so if anyone more experienced than me would bother to take a look and help me out?

I never had to deal with BSOD before so i have 0 knowledge on this.

Thanks

koolkat77 · 29 Nov 2012

Welcome to Sevenforums

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BugCheck 1A, {41790, fffffa8004976820, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35054 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
	contains the address of the PFN for the corrupted page table page.
	On a 32 bit OS, parameter 2 contains a pointer to the number of used
	PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa8004976820
Arg3: 000000000000ffff
Arg4: 0000000000000000

One BSOD dump with BugCheck 1A (Memory Management)

Suggest you to simply start with testing RAM.

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

RAM - Test with Memtest86+

Quote:

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

Errors are sometimes found after 8 passes

Do this test overnight, before going to bed

Post back with results

sanchir0805 · 10 Dec 2012

Hello. Sorry for the delay as i had to leave town for few days.

I started up my computer last night after i came back and got BSOD right after logging on and loading background programs. Attached a new minidump file in case there is something different going wrong. Will run the memtest tonight and report back tomorrow.

Sanchir,

EDIT,
Is BSOD related to overclocked CPU in someways? Mine is set at 4,5 GHz.

koolkat77 · 10 Dec 2012

Thanks. Will wait for the results from memtest.

You should uninstall these programs as they can often be a cause of BSOD-s, as well:

Code:

Start Menu\Programs\Norton Internet Security	Public:Start Menu\Programs\Norton Internet Security	Public
Start Menu\Programs\Norton PC Checkup	Public:Start Menu\Programs\Norton PC Checkup	Public

Uninstall with the Norton Removal Tool and replace with Microsoft Security Essentials at least to test.

Norton Removal Tool

MSE is recommended from a strict BSOD perspective, compatibility & stability compared to other antiviruses/internet security software:-

1. Microsoft Security Essentials - Free Antivirus for Windows
2. Malwarebytes - Free
3. Good and Free system security combination.

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

System Optimisers
Please remove the following software

Code:

Start Menu\Programs\TuneUp Utilities 2013	Public:Start Menu\Programs\TuneUp Utilities 2013	Public
Start Menu\Programs\TuneUp Utilities 2013\All functions	Public:Start Menu\Programs\TuneUp Utilities 2013\All functions	Public

Quote:

This software is a known cause of BSOD's. The windows 7 operating system does not require these registry cleaning software. They often tune-down rather than tune-up and can wreck the OS beyond repair. Microsoft have improved Windows 7 significantly and it is much better at organising and optimising itself than its predecessors. Check this, this and this thread for evidence.

If you feel the need to use a registry cleaning or optimisation software, most of us recommend the use of CCleaner but make sure you back up the registry before making letting ccleaner delete anything.

Daemon Tools

Quote:

Please uninstall DAEMON Tools. It uses a driver called sptd.sys which is known to cause BSODs in Windows 7. Uninstall the software using Add/Remove Programs. Reboot the system. Once the program is uninstalled, run sptd.sys uninstaller to remove the driver from your system.

As an alternative, many people recommend the use of Total Mounter or Magic ISO

Code:

DAEMON Tools Lite	"c:\program files (x86)\daemon tools lite\dtlite.exe" -autorun	Sanchir-PC\Sanchir	HKU\S-1-5-21-1723811372-1081543674-2250963735-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Run the System File Checker. It allows the user to scan for and restore corruptions in Windows system files.

1. Click on the
2. Type CMD on Search
3. Left click and Run as Administrator
4. Type SFC /scannow

Full tutorial here:

SFC /SCANNOW Command - System File Checker

Run Disk Check on your hard disk for file system errors and bad sectors on it:

Disk Check

Free up the start-up, nothing except the antivirus is usually needed.

BSOD BUGCHECK ANALYSIS:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8a00e4ce3b8, 1, fffff880018dc3f6, 2}


Could not read faulting driver name
Probably caused by : Ntfs.sys ( Ntfs!NtfsOpenAttribute+326 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a00e4ce3b8, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff880018dc3f6, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003311100
GetUlongFromAddress: unable to read from fffff800033111c0
 fffff8a00e4ce3b8 Paged pool

FAULTING_IP: 
Ntfs!NtfsOpenAttribute+326
fffff880`018dc3f6 4c8918          mov     qword ptr [rax],r11

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  CSISYNCCLIENT.

CURRENT_IRQL:  1

TRAP_FRAME:  fffff8800bf85810 -- (.trap 0xfffff8800bf85810)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a00e4ce3b8 rbx=0000000000000000 rcx=fffff8a00a4ce2c0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880018dc3f6 rsp=fffff8800bf859a0 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=fffff8800188d400
r11=fffff8a00465f988 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
Ntfs!NtfsOpenAttribute+0x326:
fffff880`018dc3f6 4c8918          mov     qword ptr [rax],r11 ds:fffff8a0`0e4ce3b8=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030888e0 to fffff800030e1fc0

STACK_TEXT:  
fffff880`0bf856a8 fffff800`030888e0 : 00000000`00000050 fffff8a0`0e4ce3b8 00000000`00000001 fffff880`0bf85810 : nt!KeBugCheckEx
fffff880`0bf856b0 fffff800`030e00ee : 00000000`00000001 fffff8a0`0e4ce3b8 fffffa80`0c5af700 fffffa80`0cc042d0 : nt! ?? ::FNODOBFM::`string'+0x437f6
fffff880`0bf85810 fffff880`018dc3f6 : fffffa80`0cc042d0 fffff880`0bf86200 00000000`00000000 fffff8a0`0a4ce450 : nt!KiPageFault+0x16e
fffff880`0bf859a0 fffff880`018cb065 : fffffa80`0cc88900 fffffa80`0c5c7e20 fffffa80`0729f180 fffff8a0`0a4ce450 : Ntfs!NtfsOpenAttribute+0x326
fffff880`0bf85ab0 fffff880`018c6e1f : fffff880`0bf86270 00000000`00000001 fffffa80`0cc88900 00000000`00000058 : Ntfs!NtfsOpenExistingAttr+0x145
fffff880`0bf85b70 fffff880`018ca11f : fffffa80`0cc88900 fffffa80`0c5c7b10 fffff8a0`0a4ce450 fffff880`00000058 : Ntfs!NtfsOpenAttributeInExistingFile+0x50f
fffff880`0bf85d00 fffff880`018da1f6 : fffffa80`0cc88900 fffffa80`0c5c7b10 fffff8a0`0a4ce450 00000000`00000701 : Ntfs!NtfsOpenExistingPrefixFcb+0x1ef
fffff880`0bf85df0 fffff880`018d79a1 : fffffa80`0cc88900 fffffa80`0c5c7b10 fffff880`0bf85fc0 fffff880`0bf86010 : Ntfs!NtfsFindStartingNode+0x5e6
fffff880`0bf85ec0 fffff880`01840a0d : fffffa80`0cc88900 fffffa80`0c5c7b10 fffff880`0bf86270 00000000`00000000 : Ntfs!NtfsCommonCreate+0x3e1
fffff880`0bf860a0 fffff800`030edc48 : fffff880`0bf861e0 fffff880`072162ce fffff8a0`032af998 fffff880`0bf86290 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0bf860d0 fffff880`0184118f : fffff880`018409f0 fffff880`01840020 00000000`00000000 fffff880`018e2000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`0bf861b0 fffff880`018daa2c : 00000000`00000000 00000000`00000000 fffff880`0bf86400 fffffa80`0c5c7b10 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`0bf86210 fffff880`010e4bcf : fffffa80`0729f030 fffffa80`0c5c7b10 00000000`00000000 fffffa80`071b6de0 : Ntfs!NtfsFsdCreate+0x1ac
fffff880`0bf863c0 fffff880`011042b9 : fffffa80`0c5c7b10 fffffa80`0729d010 fffffa80`0c5c7b00 fffffa80`071b6de0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0bf86450 fffff800`033dbb35 : 00000000`00000045 fffffa80`0c5af8b8 fffff880`0bf868a0 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`0bf86500 fffff800`033d83d8 : fffffa80`07189ad0 fffff800`00000000 fffffa80`0c5af700 00000000`00000000 : nt!IopParseDevice+0x5a5
fffff880`0bf86690 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObpLookupObjectName+0x588


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsOpenAttribute+326
fffff880`018dc3f6 4c8918          mov     qword ptr [rax],r11

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  Ntfs!NtfsOpenAttribute+326

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5040d4c6

FAILURE_BUCKET_ID:  X64_0x50_Ntfs!NtfsOpenAttribute+326

BUCKET_ID:  X64_0x50_Ntfs!NtfsOpenAttribute+326

Followup: MachineOwner
---------

koolkat77 · 10 Dec 2012

Regarding OC,

Quote:

If you are overclocking your system, please return all overclocked components to their stock speeds. If the BSOD's are found not to be caused by the overclock, you can re-overclock the components once we have finished the diagnostics

koolkat77 · 26 Dec 2012

Were the blue screen issues resolved?

Windows 7: BSOD playing Battlefield 3.

BSOD playing Battlefield 3. problems?