BSOD at random intervals, mainly during gaming error 0x000000d1

Anfiniti · 17 Apr 2014

Hello

I have been having multiple issues with Bluescreens during gaming and randomly at other times.
The most recent was the following:
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0xfffff80099289a8a, 0x0000000000000002, 0x0000000000000008, 0xfffff80099289a8a). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 041714-8517-01.

All drivers appear to be up to date and the problem has persisted through multiple versions of graphics drivers.

Thanks for your help in advance.

koolkat77 · 18 Apr 2014

Welcome to the forum Anfiniti,

I'd suggest you start with memtest.

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

RAM - Test with Memtest86+

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

Information

Errors are sometimes found after 8 passes.

Tip

Do this test overnight, before going to bed.

Code:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Yusra\Downloads\REI-PC-Thu_04_17_2014_193444_01\040814-7784-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`0320c000 PsLoadedModuleList = 0xfffff800`0344f6d0
Debug session time: Wed Apr  9 00:51:28.379 2014 (UTC + 6:00)
System Uptime: 1 days 3:37:07.310
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 1a3686, 0, 297106}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000001a3686, page frame number
Arg3: 0000000000000000, current page state
Arg4: 0000000000297106, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80003310a4c to fffff80003281bc0

STACK_TEXT:  
fffff880`0a4c4e18 fffff800`03310a4c : 00000000`0000004e 00000000`00000099 00000000`001a3686 00000000`00000000 : nt!KeBugCheckEx
fffff880`0a4c4e20 fffff800`0322ded2 : 00000000`00000000 fffff680`000c30c0 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`0a4c4e60 fffff800`032517c3 : fffffa80`10507b30 fffff700`00008e1c 0000007f`fffffff8 fffff8a0`0f3d5138 : nt! ?? ::FNODOBFM::`string'+0x3242a
fffff880`0a4c4ef0 fffff800`03252892 : fffffa80`10507b30 fffffa80`00000000 fffff880`00006c56 fffff800`00000000 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`0a4c57a0 fffff800`0355615a : fffff8a0`0ebb7060 fffff880`0a4c5ae0 00000000`00000000 fffffa80`10e844b0 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0a4c57f0 fffff800`0353c2ed : 00000000`c0000005 00000000`c0000001 00000000`fff8f000 fffffa80`104b2240 : nt!PspExitThread+0x56a
fffff880`0a4c58f0 fffff800`032746fa : 00000000`00000100 fffffa80`10e84570 00000000`00000001 fffff800`032777fd : nt!PsExitSpecialApc+0x1d
fffff880`0a4c5920 fffff800`03274a40 : 00000000`00000246 fffff880`0a4c59a0 fffff800`0353c260 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`0a4c59a0 fffff800`03280ef7 : fffffa80`10e844b0 00000000`0000023c 00000000`00000000 fffffa80`0fc34e90 : nt!KiInitiateUserApc+0x70
fffff880`0a4c5ae0 00000000`748f2e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0466ea58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x748f2e09


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`03310a4c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

Code:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Yusra\Downloads\REI-PC-Thu_04_17_2014_193444_01\040914-8268-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`03214000 PsLoadedModuleList = 0xfffff800`034576d0
Debug session time: Wed Apr  9 13:45:40.496 2014 (UTC + 6:00)
System Uptime: 0 days 0:29:48.339
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8007db2540, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
	contains the address of the PFN for the corrupted page table page.
	On a 32 bit OS, parameter 2 contains a pointer to the number of used
	PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa8007db2540
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  MsMpEng.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800032fad50 to fffff80003289bc0

STACK_TEXT:  
fffff880`0ad8e6e8 fffff800`032fad50 : 00000000`0000001a 00000000`00041790 fffffa80`07db2540 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0ad8e6f0 fffff800`032bc7d9 : fffffa80`00000000 00000000`0c63ffff fffffa80`00000000 fffff800`0329a9cc : nt! ?? ::FNODOBFM::`string'+0x35084
fffff880`0ad8e8b0 fffff800`035a2631 : fffffa80`0f336f80 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`0ad8e9d0 fffff800`035a2a33 : 00000000`00000000 00000000`0b640000 fffffa80`00000001 00000000`00000801 : nt!MiUnmapViewOfSection+0x1b1
fffff880`0ad8ea90 fffff800`03288e53 : fffffa80`0ee22870 fffff880`0ad8eb60 fffffa80`0ea82620 00000000`00000000 : nt!NtUnmapViewOfSection+0x5f
fffff880`0ad8eae0 00000000`774c155a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0a63afa8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774c155a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+35084
fffff800`032fad50 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+35084

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+35084

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+35084

Followup: MachineOwner
---------

Code:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Yusra\Downloads\REI-PC-Thu_04_17_2014_193444_01\041714-8517-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`03211000 PsLoadedModuleList = 0xfffff800`034546d0
Debug session time: Fri Apr 18 04:02:33.669 2014 (UTC + 6:00)
System Uptime: 2 days 7:00:50.004
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffff80099289a8a, 2, 8, fffff80099289a8a}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff80099289a8a, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: fffff80099289a8a, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034be100
GetUlongFromAddress: unable to read from fffff800034be1c0
 fffff80099289a8a Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
+0
fffff800`99289a8a ??              ???

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  services.exe

TRAP_FRAME:  fffff8800a121530 -- (.trap 0xfffff8800a121530)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000007fffffa2000 rbx=0000000000000000 rcx=00000000c0000102
rdx=00000000000007ff rsi=0000000000000000 rdi=0000000000000000
rip=fffff80099289a8a rsp=fffff8800a1216c0 rbp=fffffa800d3916f0
 r8=fffffa800d391790  r9=0000000000000009 r10=0000000000000000
r11=fffff880009ec180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
fffff800`99289a8a ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003286169 to fffff80003286bc0

FAILED_INSTRUCTION_ADDRESS: 
+0
fffff800`99289a8a ??              ???

STACK_TEXT:  
fffff880`0a1213e8 fffff800`03286169 : 00000000`0000000a fffff800`99289a8a 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff880`0a1213f0 fffff800`03284de0 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`009ec180 : nt!KiBugCheckDispatch+0x69
fffff880`0a121530 fffff800`99289a8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
fffff880`0a1216c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff800`99289a8a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`03284de0 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035

FAILURE_BUCKET_ID:  X64_0xD1_CODE_AV_BAD_IP_nt!KiPageFault+260

BUCKET_ID:  X64_0xD1_CODE_AV_BAD_IP_nt!KiPageFault+260

Followup: MachineOwner
---------

Anfiniti · 19 Apr 2014

In the past I've done multiple memcheck tests on each individual stick as well as them together. I did one again at your suggestion and they all passed. Any other advice would be greatly appreciated as I would like to resolve this issue.

koolkat77 · 19 Apr 2014

Please upload latest dump files.

Anfiniti · 19 Apr 2014

The files I uploaded were from the latest crash (4/17/14) as well as some prior crashes earlier in the month, as soon as another one happens I will recompile and upload, but those are the newest ones.

Thanks again

Anfiniti · 21 Apr 2014

Just had another crash, here is the new dump file, bluescreened while web browsing/reading a forum

koolkat77 · 21 Apr 2014

Please update these older drivers. Links are included to assist in looking up the source of the drivers. If unable to find an update, please remove (un-install) the program responsible for that driver. DO NOT manually delete/rename the driver as it may make the system unbootable!:-

PxHlpa64.sys Tue Dec 11 05:49:01 2007 (475DD06D)
Sonic CD/DVD driver (used by many different CD/DVD programs)
Driver Reference Table - PxHlpa64.sys

adfs.SYS Fri Jun 27 02:52:37 2008 (48640195)
Adobe File System Driver
Driver Reference Table - adfs.SYS

e1c62x64.sys Wed Jul 20 22:37:53 2011 (4E270461)
Intel(R) 82579V Gigabit Network Connection driver
Driver Reference Table - e1c62x64.sys

asmtxhci.sys Thu Nov 3 09:00:22 2011 (4EB203C6)
Asmedia USB 3.0 driver
Driver Reference Table - asmtxhci.sys

asmthub3.sys Thu Nov 3 09:00:32 2011 (4EB203D0)
ASMedia USB 3.0 Hub driver
Driver Reference Table - asmthub3.sys

To perform a clean install of a driver, follow this tutorial:

How to Clean Left Over Driver Files with Driver Sweeper

Use Revo Uninstaller to uninstall stubborn software. Opt for Advance Mode while uninstalling which allows you to remove leftover registry:-

Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

Reduce items at start-up:

Startup Programs - Change

Perform a clean boot:

Troubleshoot Application Conflicts by Performing a Clean Startup

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

SFC /SCANNOW Command - System File Checker

Run Disk Check on your hard disk for file system errors and bad sectors on it:

Disk Check

Scan with Kaspersky TDSSKiller:

Anti-rootkit utility TDSSKiller

ESET online scanner:

Free Online Virus Scanner | ESET

Code:

Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Debug session time: Tue Apr 22 02:11:06.471 2014 (UTC + 6:00)
System Uptime: 0 days 3:22:03.720
BugCheck DE, {2, fffff8a010f9c0b8, fffff8a0027f66d9, 2874a88c0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+2c8e1 )
BUGCHECK_STR:  0xDE
PROCESS_NAME:  chrome.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Debug session time: Fri Apr 18 04:02:33.669 2014 (UTC + 6:00)
System Uptime: 2 days 7:00:50.004
BugCheck D1, {fffff80099289a8a, 2, 8, fffff80099289a8a}
Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )
BUGCHECK_STR:  0xD1
PROCESS_NAME:  services.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``