BSoD playing certain games, various error codes (usually 0x03b)

msgerbs · 12 Nov 2012

I built my computer almost a year ago, and I've had on and off BSOD problems while playing games. League of Legends and Civilizations IV in particular seem to go on BSOD sprees. I'll play for a week without a problem, then get 4 in one day to the point where trying to play is pointless. Usually I just straight BSOD from in the game, on rare occasion the program will give me a standard windows "Program stopped working" crash, then either when I try to close that message or almost immediately upon restarting the game, it will BSOD. I've tried unsuccessfully to figure it out myself with windbg and posted several other places that also couldn't help other than "reformat and install programs one at a time until you crash again" which seemed to me to be akin to "I don't know", and I consider formatting an absolute last resort. So hopefully you guys can help me out. Thanks!

Arc · 13 Nov 2012

Welcome aboard.

► Install Service pack 1.

Code:

Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.17118.amd64fre.win7_gdr.120830-0334

Learn how to install Windows 7 Service Pack 1 (SP1)
Service Pack Center - Microsoft Windows

► Use Microsoft Security Essentials.
Uninstall Avira.

Code:

fffff880`08ad57f0  fffff880`03f2d030Unable to load image \SystemRoot\system32\DRIVERS\avipbb.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for avipbb.sys
*** ERROR: Module load completed but symbols could not be loaded for avipbb.sys
 avipbb+0x1f030

Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.

Download and install those, and then run full system scans with both of them, one by one.

► Update display driver.

Code:

lmvm atikmpag
start             end                 module name
fffff880`03f81000 fffff880`03fe2000   atikmpag   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\atikmpag.sys
    Image name: atikmpag.sys
    Timestamp:        Sat Jul 28 06:44:47 2012 (50133D07)
    CheckSum:         00064351
    ImageSize:        00061000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Get it from AMD Graphics Drivers & Software.

► Update Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC

Code:

fffff880`08ad5718  fffff880`05605c87Unable to load image \SystemRoot\system32\DRIVERS\Rt64win7.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
 Rt64win7+0x5c87

Get it from Realtek

Let us know the results.

msgerbs · 13 Nov 2012

I haven't had a chance to try the rest of the solutions, but I can tell you that installing SP1 won't work, because I can't install it. The installation fails, every time, even after running the SP1 readiness checker thing, and downloading the standalone SP1 installer. If you tell me what I need to show you, maybe you can help with that as well?

And unless a virus was included with my installation of windows (downloaded from microsoft, so highly unlikely), I don't think a virus is what the problem is. Can you tell me what's wrong with my choice of antivirus before telling me I need to change it, please?

Arc · 13 Nov 2012

For updating windows, if it really fails there, try it: Windows Update - Reset

Avira is not any kind of good antivirus actually, but in your case it is contributing in the crashes.

Nobody said that a virus is a problem here, but the antivirus is.

msgerbs · 13 Nov 2012

What I did:
1) Install ATI software update
2) Install Realtek update
3) Uninstall Avira
4) Reboot
5) Install MSE
6) Reboot
7) Run quick scan, nothing found
8) Run SP1 standalone installer

What happened: SP1 installer got to about 80%, then failed with: ERROR_FILE_NOT_FOUND(0x80070002). The installer suggests running the system update readiness tool, but I ran that the first time I tried to install SP1 and it didn't help. Is there a log file somewhere that I/we/you can look at to determine what failed? I found the CheckSUR logs from the last time, and it reports no errors.

EDIT: I did find what I believe is the relevant portion of CBS.log:

Code:

         CBS    Failed to find file: amd64_microsoft-windows-f..rcluster-powershell_31bf3856ad364e35_6.1.7601.17514_none_f273f11a257acc7b\FailoverClusters.psd1 [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2012-11-13 13:28:55, Info                  CBS    Failed to gather all required files. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2012-11-13 13:28:55, Info                  CBS    Failed to gather all missing files for package: Package_for_KB976932~31bf3856ad364e35~amd64~~6.1.1.17514 [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2012-11-13 13:28:55, Info                  CSI    0000000e@2012/11/13:19:28:55.294 CSI Transaction @0x5498f30 destroyed
2012-11-13 13:28:55, Error                 CBS    Failed to pre- stage package: Package_for_KB976932~31bf3856ad364e35~amd64~~6.1.1.17514 [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]

It seems to be related to some part of Server Manager, which I do have installed. I have attached the rest of the log file for your perusal.

NoelDP · 14 Nov 2012

Please also post your CheckSUR.log and CheckSUR.persist.log files
There is no sign of your having run an SFC in the past week - please do so, and also run CHKDSK.

Please run a full CHKDSK and SFC scan....
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type
CHKDSK C: /R
and hit the Enter key.

You will be told that the drive is locked,
and the CHKDSK will run at he next boot - hit the Y key, and then reboot.
The CHKDSK will take a few hours depending on the size of the drive, so be patient!
After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -

then run the SFC.

SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.
At the Command prompt, type
SFC /SCANNOW
and hit the Enter key

Wait for the scan to finish - make a note of any error messages - and then reboot.
Copy the CBS.log file created to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your SkyDrive (http://skydrive.live.com ) and post a link to it so that I can take a look.

Post a new MGADiag report with details of any error messages encountered.

msgerbs · 14 Nov 2012

I ran chkdsk and SFC. cbs.log and both CheckSUR logs are included in the attached zip (I didn't upload it to skydrive because it was small, I hope that's alright.) SFC reported that it found corrupted files that it was unable to fix. I'm not sure what the results of chkdsk were as I wasn't at the computer when it was running. Hopefully that's in CBS.log as well? Or do I need to post some other log?

I'm not sure what you mean by a new MGADiag report. Isn't that a tool for checking if windows is genuine? My copy is genuine, I installed from an iso downloaded from Dreamspark burned to a disk.

FAKE EDIT: Nevermind, I found MGADiag on Microsoft's site. I included the results in the attached zip as well, hopefully that's what you wanted.

NoelDP · 15 Nov 2012

From the CBS.log....

Code:

2012-11-14 20:32:28, Info                  CSI    00000444 [SR] Repairing 2 components
2012-11-14 20:32:28, Info                  CSI    00000445 [SR] Beginning Verify and Repair transaction
2012-11-14 20:32:28, Info                  CSI    00000446 Hashes for file member \SystemRoot\WinSxS\amd64_prnca00x.inf_31bf3856ad364e35_6.1.7600.16385_none_e90677c70609283c\Amd64\CNBUR.DLL do not match actual file [l:30{15}]"Amd64\CNBUR.DLL" :
  Found: {l:32 b:Ev8byHjRWrDO8QED+ozGQ9YojVo20LF2WhbnZOWcrQ8=} Expected: {l:32 b:FWhGbLlRSwX3PugmXHUNss8TDg9lEQQ96uj/hLVV8wQ=}
2012-11-14 20:32:28, Info                  CSI    00000447 [SR] Cannot repair member file [l:30{15}]"Amd64\CNBUR.DLL" of prnca00x.inf, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type = [l:24{12}]"driverUpdate", TypeName neutral, PublicKey neutral in the store, hash mismatch
2012-11-14 20:32:28, Info                  CSI    00000448 Hashes for file member \??\C:\Windows\Help\mui\0409\diskmgt.CHM do not match actual file [l:22{11}]"diskmgt.CHM" :
  Found: {l:32 b:Q04+9HaiDEqXWqWfSz15C0O1lwvdzRKc8OPWAuf17T4=} Expected: {l:32 b:Nm0jwXDzPg7+0Wb/lPzZrxe6KthUAbkrG2QotxzpUV8=}
2012-11-14 20:32:28, Info                  CSI    00000449 [SR] Repairing corrupted file [ml:520{260},l:56{28}]"\??\C:\Windows\Help\mui\0409"\[l:22{11}]"diskmgt.CHM" from store
2012-11-14 20:32:28, Info                  CSI    0000044a WARNING: File [l:22{11}]"diskmgt.CHM" in [l:56{28}]"\??\C:\Windows\Help\mui\0409" switching ownership
    Old: Server-Help-CHM.diskmgt.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
    New: Server-Help-CHM.diskm_v.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
2012-11-14 20:32:28, Info                  CSI    0000044b Hashes for file member \SystemRoot\WinSxS\amd64_prnca00x.inf_31bf3856ad364e35_6.1.7600.16385_none_e90677c70609283c\Amd64\CNBUR.DLL do not match actual file [l:30{15}]"Amd64\CNBUR.DLL" :
  Found: {l:32 b:Ev8byHjRWrDO8QED+ozGQ9YojVo20LF2WhbnZOWcrQ8=} Expected: {l:32 b:FWhGbLlRSwX3PugmXHUNss8TDg9lEQQ96uj/hLVV8wQ=}
2012-11-14 20:32:28, Info                  CSI    0000044c [SR] Cannot repair member file [l:30{15}]"Amd64\CNBUR.DLL" of prnca00x.inf, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type = [l:24{12}]"driverUpdate", TypeName neutral, PublicKey neutral in the store, hash mismatch
2012-11-14 20:32:28, Info                  CSI    0000044d [SR] This component was referenced by [l:186{93}]"Microsoft-Windows-Printer-Drivers-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.INF_prnca00x"
2012-11-14 20:32:28, Info                  CSI    0000044e Repair results created:
POQ 132 starts:
     0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\cc34d474d9c2cd018b3d0000700bfc0e._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
    1: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\cc34d474d9c2cd018c3d0000700bfc0e.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps\$$.cdf-ms"
    2: Move File: Source = [l:224{112}]"\SystemRoot\WinSxS\Temp\PendingRenames\cc34d474d9c2cd018d3d0000700bfc0e.$$_help_mui_0409_c7942094fabea651.cdf-ms", Destination = [l:136{68}]"\SystemRoot\WinSxS\FileMaps\$$_help_mui_0409_c7942094fabea651.cdf-ms"
    3: Hard Link File: Source = [l:250{125}]"\SystemRoot\WinSxS\amd64_server-help-chm.diskm_v.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d76955a45e11858c\diskmgt.CHM", Destination = [l:80{40}]"\??\C:\Windows\Help\mui\0409\diskmgt.CHM"
POQ 132 ends.
2012-11-14 20:32:28, Info                  CSI    0000044f [SR] Repair complete

From the MGADiag...

Code:

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-*****-*****-JCJTP
Windows Product Key Hash: Jpof6yECiuuDKRYtaxHawmvrzIo=
Windows Product ID: 55041-147-6817625-86596
Windows Product ID Type: 6
Windows License Type: Volume MAK
Windows OS version: 6.1.7600.2.00010100.0.0.048

From where did you acquire your copy of Windows 7 Pro?
It's using a Volume MAK License - which is not generally available to the public.

Please run SFC /SCANNOW once more - there are indications that it may still have work to do.

Is there any reason why you hadn't installed Service Pack 1 long ago - as soon as you installed the OS itself?

msgerbs · 15 Nov 2012

What am I to be looking at from that log excerpt?

I obtained my key from Dreamspark (Actually from the MSDNAA, before it was migrated to Dreamspark). The program gives out unlimited-use(?), single-user license keys for academic/personal use with a whole bunch of "You may not do..." attached to it. It's all legal, if that's your concern.

No, no real reason to not have installed it. I just didn't get around to doing so. I'm not the greatest at keeping up with my updates. I will run SFC again in the morning, shall I upload all of that stuff again, or just the new CBS.log?

NoelDP · 15 Nov 2012

Just the new CBS log, thanks.

I'm aware of the limitations attached to MSDNAA/DreamSpark keys :)