Help! Bsod

NEW BSoD...HELP?

this is what i got today

Hi

Could you use this update tool ...because you have uploaded the except for the dump that is dated today... alll other files are 4 days old... ans the msinfo file is corrupted ... which you uploaded...
Just the above again and post...

i will do that and i have to say that the bsod appeared when i closed an online game ,Rohan Blood Feud.

sorry for delay ,i had work this days i couldnt open my pc . This is what i got on 31.08.

MasterZhen said:

sorry for delay ,i had work this days i couldnt open my pc . This is what i got on 31.08.

What did you get ??

a little network problem...here they are :P

sorry for my internet problems....it's dial-up

sorry couldn't reply earlier....

the last BSOD is related to CDD.DLL which is Canonical Display Driver (Microsoft) caused by rhclient.exe (Rohan Games).... there is a known vulnerability of causing a buffer overflow..

If you see below the "c0000005" is a n access violation which explains the above.....

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 83297061, 82174a94, 0}

Probably caused by : cdd.dll ( cdd+1721 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 83297061, The address that the exception occurred at
Arg3: 82174a94, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!ExEnterCriticalRegionAndAcquireFastMutexUnsafe+1a
83297061 f00fba3000 lock btr dword ptr [eax],0

TRAP_FRAME: 82174a94 -- (.trap 0xffffffff82174a94)
ErrCode = 00000002
eax=00000000 ebx=8e35007e ecx=00000000 edx=00000001 esi=00000000 edi=85373d48
eip=83297061 esp=82174b08 ebp=82174b28 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!ExEnterCriticalRegionAndAcquireFastMutexUnsafe+0x1a:
83297061 f00fba3000 lock btr dword ptr [eax],0 ds:0023:00000000=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: rhclient.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 973c1721 to 83297061

STACK_TEXT:
82174b0c 973c1721 fe369240 973ca8d4 fe369240 nt!ExEnterCriticalRegionAndAcquireFastMutexUnsafe+0x1a
WARNING: Stack unwind information not available. Following frames may be wrong.
82174b28 973cb7c7 0043bfef fe369240 fe37b4d0 cdd+0x1721
82174b5c 973c1769 fe369240 82174bfc 971fea0c cdd+0xb7c7
82174b68 971fea0c fe369240 00000002 82174c20 cdd+0x1769
82174bfc 971ffe20 00000001 00000000 050511d9 win32k!SURFACE::bDeleteSurface+0x235
82174c10 9720235d 00000001 00000001 fe37b4d0 win32k!SURFREF::bDeleteSurface+0x14
82174c24 97201afd 00000d64 00000001 00000d64 win32k!vCleanupSurfaces+0x43
82174c44 971fd75a fe711920 00000000 00000000 win32k!NtGdiCloseProcess+0xc5
82174c64 9720003f fe711920 00000000 8751b510 win32k!GdiProcessCallout+0x151
82174c80 83455138 8556f520 00000000 a30672ed win32k!W32pProcessCallout+0x5d
82174cfc 8346e3af 00000000 ffffffff 0012ee20 nt!PspExitThread+0x46d
82174d24 8324f44a ffffffff 00000000 0012ee2c nt!NtTerminateProcess+0x1fa
82174d24 77626194 ffffffff 00000000 0012ee2c nt!KiFastCallEntry+0x12a
0012ee2c 00000000 00000000 00000000 00000000 0x77626194


STACK_COMMAND: kb

FOLLOWUP_IP:
cdd+1721
973c1721 ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: cdd+1721

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: cdd

IMAGE_NAME: cdd.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: 0x8E_cdd+1721

BUCKET_ID: 0x8E_cdd+1721

Followup: MachineOwner
---------

one thing I have noticed is that your windows version is not upgraded to SP1..... please do this asap... as SP1 has lots of fixes.....

Do this first and then we will move on to the next step......

After you have done this.... do a memtest to confirm that the RAM is not at fault.... Please do the test for atleast 6-8 passes 1 stick in 1 slot at a time.....

Let me know your feedback

i updated the windows to sp1 yesterday and i tested the ram with memtest long time ago....before i opened the thread