BSOD Issues - Worse whilst gaming/streaming, can crash on desktop.

ptERR · 15 Jun 2013

Hi guys,
Let me start off by giving filling you in on the history of the system. The PC was built roughly back in August 2012, using mainly brand new components. I used my old power supply and GPU.

The computer has run fine since the initial build, but has recently started to BSOD, and I can't seem to find a solution.

My problems first arose roughly two months ago, my computer reported a failing hard drive, luckily it was still under warranty so was promptly replaced. Soon after the replacement my computer started to randomly blue screen, and continued to become more frequent, to the stage that my PC could barely render or run photoshop.

Suspecting a RAM issue I tried removing a RAM stick, the issued ceased for roughly a month, with no hiccups. Roll forward a month and the issues started up again, and here I am.

Steps taken since BSOD issues started:

* Installed new RAM
* Installed new power supply
* Tried installing up to date GPU drivers, BIOS & chipset drivers.
* Performed a clean reformat.
* Tried running on separate hard drives.

I have run a prime95 test for a thirty minute duration, with no issues. You can find the temps below:

Image - TinyPic - Free Image Hosting, Photo Sharing & Video Hosting

I did however receive a few errors, not quite sure what they mean.

Image - TinyPic - Free Image Hosting, Photo Sharing & Video Hosting

I ran a furmark test on my GPU for twenty minutes without any screen tearing, it settled on 94 degrees with the fans running at 92%.

My computer specifications:

* RAM: 16GB DDR3 (brand new)
* PSU: 800w Corsair (brand new)
* MB: Z68x-UD5-B3 (Less than a year old)
* GPU: Nvidea GTX480 (Two-three years old)
* CPU: i7-2700k CPU @ 3.5gz (Less than a year old)

Nothing has ever been overclocked.

Mini dumps before reformat:
Download pccrashes.zip from Sendspace.com - send big files the easy way

DXDiag:
Zippyshare.com -

Another thing to note, alongside blue screening a lot of my programs keep failing to respond, including, but not limited to; firefox, teamspeak3, Firefall Beta and flash.

Hoping you guys can help me out, really not quite sure what to do next. Pretty sure it is a hard ware issue after the reformat, but not quite sure what to do next.

What I have done since creating this thread:

* Updated Realtek network driver (Realtek RTL8168D/8111D)
* Updated windows to SP1

Thanks,
Peter

x BlueRobot · 15 Jun 2013

Welcome to the forums ptERR and thanks for the information you have provided, let's begin with the analysis:

Code:

BugCheck D1, {e0000000, 2, 1, fffff88002c54a5b}

Probably caused by : hardware ( afd!AfdBFillPendingIrps+1b )

Stop 0xD1 is usually caused by drivers referencing invalid memory addresses and causing interrupts at IRQL levels which are too high. However, from the excellent information you have already provided, and the information from the Minidump, the first parameter tells us the memory address being referenced, and it appears to be within one of the CPU caches.

Code:

TRAP_FRAME:  fffff880043ef040 -- (.trap 0xfffff880043ef040)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000e0000000 rbx=0000000000000000 rcx=fffffa800fdc8530
rdx=fffffa800e59e520 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88002c54a5b rsp=fffff880043ef1d8 rbp=00000000000005a4
 r8=0000000000000000  r9=000000000000003e r10=fffffa800d5cef40
r11=000000000000afd0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
afd!AfdBFillPendingIrps+0x1b:
fffff880`02c54a5b 0000            add     byte ptr [rax],al ds:00000000`e0000000=??

The CPU register being read from, is the memory address which was referenced, therefore I believe it is most likely a CPU issue.

The driver referencing the address seems to be your Realtek network driver (Realtek RTL8168D/8111D), I suggest you update this driver from here: Realtek

Code:

6: kd> lmvm Rt64win7
start             end                 module name
fffff880`05335000 fffff880`053d5000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: \SystemRoot\system32\DRIVERS\Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:        Tue Sep 27 15:50:33 2011 (4E81E2B9)
    CheckSum:         0009FB77
    ImageSize:        000A0000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Install Service Pack 1:

Learn how to install Windows 7 Service Pack 1 (SP1)

Service Pack 1 has provided many security and stability updates for Windows 7, which would be highly beneficial for your system.

ptERR · 15 Jun 2013

Hi BlueRobot,
I have just reinstalled the Realtek driver and am currently in the process of updating my windows. My windows was fully updated prior to my reformat, so I do not believe that this is an issue. Will get back to you as soon as I experience a crash or instability.

Thanks for the feedback so far,
Peter

x BlueRobot · 15 Jun 2013

Thanks for the update Peter :)

ptERR · 16 Jun 2013

Since we last spoke I have updated the Realtek Driver and updated windows to SP1.

Today I experienced a blue screen alongside system instability.

My crash analyzer provided me with the following information:

On Sun 16/06/2013 15:37:45 GMT your computer crashed
crash dump file: C:\Windows\Minidump\061613-20592-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x19 (0x3, 0xFFFFF88002301350, 0xFFFFF88002301350, 0x36FFF88002301350)
Error: BAD_POOL_HEADER
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a pool header is corrupt.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

The bluescreen occurred whilst playing Guild Wars 2, the first crash in this program. Alongside this crash I have also had the following issues occur whilst using my computer TODAY:

* Sound both mic and headphone stopped working, was a jarred sound followed by silence. Sound worked again after reattaching the headset.
* Firefall has crashed twice whilst playing.
* GW2 has crashed once whilst playing.

The temperature of my hardware whilst using these applications appeared normal. The CPU was around 70 degrees with my GPU hovering around 80 degrees. Idle temperatures outside of these games have been 40-60 degrees.

I have uploaded the minidump file here: Download 061613-20592-01.dmp from Sendspace.com - send big files the easy way

When my firefall crashed I tried to re-launch, it came up with the following error: http://i43.tinypic.com/ossrkh.png - I tried 10 seconds later and it launched.

Thanks,
Peter

x BlueRobot · 16 Jun 2013

The TinyPic link is broken for some reason

You can upload files and folders to this thread using this tutorial - Screenshots and Files - Upload and Post in Seven Forums

70*C to 80*C is quite hot, have you checked the fans and heatsinks for accumulation of dust? There may be a possible overheating issue, which may explain the warnings used by Prime95 earlier in this thread. The CPU could be at fault here.

Code:

BugCheck 19, {3, fffff88002301350, fffff88002301350, 36fff88002301350}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+a53 )

Code:

Usual causes:  Device driver

A corrupted pool header indicates there are issues with the Windows memory allocation, from the first paratmer we can that the pool freelist has become corrupt, this is a data structure used by the operating system to allocate a continuous chunk of memory for a request.

The usual suspects for this BSOD are device drivers, RAM and the hard-drive.

I couldn't see any issues within the stack which were driver-related, I would suggest following this step to test for any possibility of buggy drivers:

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

Driver Verifier - Enable and Disable

Information

Additional Help - Using Driver Verifier to identify issues with Drivers

You have a new hard-drive and new RAM, although, new hardware doesn't seem it is necessarily working, I feel it is not likely to be the issue at the moment.

I noticed a random 36 within the blink freelist address, I'm not sure if it could potentially be flipped bit, which is often related to a failing CPU. The address in parameter 3 should be same as the address in parameter 2.

ptERR · 16 Jun 2013

Attached the file and am rebooting now to enable driver verifier.

Update: After enabling driver verifier I rebooted my PC and failed to boot, crashing on windows start up repeatedly. I had to roll back to a previous restore point to re-gain access to my desktop.

The BSOD error (unfortunately I can't remember it specifically) began with driver and refereed to memory. I cannot see any new mini dump files, but I re-ran the diagnostic tool to see if it can pick anything up.

You can find the file attached.

x BlueRobot · 16 Jun 2013

You have been lucky and the Minidump was saved

Code:

BugCheck D6, {fffff98001563000, 0, fffff88003c5b192, 0}

*** WARNING: Unable to verify timestamp for ATITool64.sys
*** ERROR: Module load completed but symbols could not be loaded for ATITool64.sys

Could not read faulting driver name
Probably caused by : ATITool64.sys ( ATITool64+6192 )

Code:

Usual causes:  Device driver

Okay, this bugcheck is nice and simple, the specified driver has attempted to read beyond it's pool operation, we can see from the first parameter that the driver attempted to read from the memory address stored in the rax CPU register, and from the second parameter we can see it was a read operation.

Remove:

Code:

3: kd> lmvm ATITool64
start             end                 module name
fffff880`03c55000 fffff880`03c63000   ATITool64 T (no symbols)           
    Loaded symbol image file: ATITool64.sys
    Image path: \SystemRoot\system32\DRIVERS\ATITool64.sys
    Image name: ATITool64.sys
    Timestamp:        Wed Aug 08 17:42:26 2007 (46B9F272)
    CheckSum:         0001540C
    ImageSize:        0000E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

The driver which seems to be causing the problem, is a overclocking utility for ATI/nVidia cards and is only compatible with Windows 2000/Windows XP and Windows Server 2003. Please remove the software completely using Revo Uninstaller Pro - Uninstall Software, Remove Programs easily, Forced Uninstall, Leftovers Uninstaller

Code:

TRAP_FRAME:  fffff8800336f9f0 -- (.trap 0xfffff8800336f9f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff98001563000 rbx=0000000000000000 rcx=fffff88003c5b0fb
rdx=0000000000000046 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88003c5b192 rsp=fffff8800336fb80 rbp=0000000000000010
 r8=0000000000000000  r9=fffff88003370110 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
ATITool64+0x6192:
fffff880`03c5b192 66833800        cmp     word ptr [rax],0 ds:fffff980`01563000=????

I suggest you stop overclocking your CPU and any other hardware during this debugging session, please reset the BIOS back to factory defaults - How To Clear CMOS - 3 Easy Ways To Clear Your Motherboard CMOS Memory

Code:

3: kd> !sysinfo cpuspeed
CPUID:        "Intel(R) Core(TM) i7-2700K CPU @ 3.50GHz"
MaxSpeed:     3500
CurrentSpeed: 3510

ptERR · 16 Jun 2013

Uninstalled the utility, I believe I used it to check my graphics card ram. I haven't overclocked any components, never changed any of my components throughout the time I have owned them, so weird, very weird.

I un-installed the software via the program you recommended, but I think it may still have been in the driver verifier software. After the uninstall I rebooted, then ran the verifier.

I went into the bios and set my bios to "Load fail-safe defaults".

My computer blue screened, I think it was a different error than before but I cannot be sure. I let it blue screen a few times so hopefully there will be a crash file for you to find.

Also included an image of programs I currently have installed that are recognized by your recommended installer.

Thanks again,
Peter

x BlueRobot · 16 Jun 2013

Code:

BugCheck D6, {fffff9800140b000, 0, fffff88004017192, 0}

*** WARNING: Unable to verify timestamp for ATITool64.sys
*** ERROR: Module load completed but symbols could not be loaded for ATITool64.sys

Could not read faulting driver name
Probably caused by : ATITool64.sys ( ATITool64+6192 )

It seems to be the exact same BSOD

and it's the most recent one:

Code:

7: kd> .time
Debug session time: Sun Jun 16 22:16:36.454 2013 (UTC + 1:00)
System Uptime: 0 days 0:00:10.297

Disable Driver Verifier, and then run Revo again to make sure the software and it's drivers are completely removed.