Random BSOD on start-up, normal usage and playing games

I would suggest you to uninstall MagicISO /MagicDisc, as the SCSI Adapter installed by it causes startup time BSODs.

No code has to be inserted here.

The nature of the BSODs caused by it that it takes place before you get into the desktop. So the crash dumps are not completely recorded. All of your Last day's BSOD dumps are incomplete.

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Got one crash dump readable. It indicates to a driver bug.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
    the operating system. The only supported way to extend a kernel
    mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000002
Arg3: fffff80003416cc0
Arg4: 0000000000000000

And the buggy driver is the display driver.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {91, 2, fffff80003416cc0, 0}

*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : nvlddmkm.sys ( nvlddmkm+1b775d )

Followup: MachineOwner
---------

The driver version is .....

Code:

fffff880`04821000 fffff880`052c8000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        Fri Jan 18 18:52:15 2013 (50F94C87)
    CheckSum:         00A92B69
    ImageSize:        00AA7000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

We know that the particular version is buggy, we have noticed it to behave in the same way many a times. Install the 314.22 WHQL only.

• Uninstall All nvidia items in Control Panel > Programs and features
  
  • 3D Vision Control Driver
  • 3D Vision Driver
  • Graphics Driver
  • HD Audio Driver
  • PhysX
  • nvidia Update
  
  (Are you using nvidia chipset drivers? If so, dont uninstall anything other than those are listed).
• Now follow Drivers - Clean Left over Files after Uninstalling
• Boot normally now. Go to Drivers - Download NVIDIA Drivers, Download 314.22 WHQL. While installing, Select Custom (Advanced) install. In the next page, follow this settings:
  
  

Let us know the results.
________________________________________________________________________________
BSOD ANALYSIS:

Code:

.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {91, 2, fffff80003416cc0, 0}

*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : nvlddmkm.sys ( nvlddmkm+1b775d )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
    the operating system. The only supported way to extend a kernel
    mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000002
Arg3: fffff80003416cc0
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_91

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

TAG_NOT_DEFINED_c000000f:  FFFFF80000BA2FB0

LAST_CONTROL_TRANSFER:  from fffff800032e44ea to fffff8000328dc00

STACK_TEXT:  
fffff800`00b97008 fffff800`032e44ea : 00000000`000000c4 00000000`00000091 00000000`00000002 fffff800`03416cc0 : nt!KeBugCheckEx
fffff800`00b97010 fffff800`03332605 : fffffa80`05d10000 00000000`00040120 fffff800`00000003 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4884
fffff800`00b97050 fffff800`0335071d : fffff800`00b97000 fffff800`00b9d000 00000000`00000000 fffff800`00b9c9a0 : nt!RtlEnoughStackSpaceForStackCapture+0x15
fffff800`00b97080 fffff800`033515bb : 00000000`00000001 fffff800`00b97100 00000000`00000000 fffff800`00b9c9a0 : nt!RtlWalkFrameChain+0x4d
fffff800`00b970b0 fffff880`049d875d : 00000000`00000000 fffff800`00b97140 fffffa80`04835000 00000000`00040120 : nt!RtlCaptureStackBackTrace+0x4b
fffff800`00b970e0 00000000`00000000 : fffff800`00b97140 fffffa80`04835000 00000000`00040120 fffff800`00b97160 : nvlddmkm+0x1b775d


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nvlddmkm+1b775d
fffff880`049d875d ??              ???

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  nvlddmkm+1b775d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nvlddmkm

IMAGE_NAME:  nvlddmkm.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  50f94c87

FAILURE_BUCKET_ID:  X64_0xc4_91_nvlddmkm+1b775d

BUCKET_ID:  X64_0xc4_91_nvlddmkm+1b775d

Followup: MachineOwner
---------

0: kd> lmvm nvlddmkm
start             end                 module name
fffff880`04821000 fffff880`052c8000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        Fri Jan 18 18:52:15 2013 (50F94C87)
    CheckSum:         00A92B69
    ImageSize:        00AA7000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
0: kd> !verifier
fffff8000345bac0: Unable to get verifier list.

extrakun said:

Hi Arc,

Thanks a lot of your help and clear instructions. MagicDisc is uninstalled.

While using Driver Sweeper to remove the nVidia drivers, Avast reported finding it a rootkit - unfortunately I didn't have the presence of mind to grab its name before deleting it. After a clean installation of the 314.22 WHQL driver, and re-booting, it has no BSOD (...yet).

OMG! Is it? Scan the system for possible virus infection with Anti-rootkit utility TDSSKiller

extrakun said:

Just a clarification - before this I tried installing the latest driver (320.49), though I didn't use Drive Sweeper beforehand - I keep getting "Display driver WHQL 320.49 has crashed and recovered." even for mundane tasks (launching Chrome, for one) Is it because that driver is buggy too?

Once more, thanks!

You should have mentioned this point earlier :)
It happens for a few of reasons, and a buggy driver is one of those. Observe densely if it is happening the same with the 314.22 driver too. If it happens, report us back. We will take some more steps to determine the reasons behind it.

320.49 WHQL has a mixed response. It runs too buggy for somebody, but runs very smooth for some of them. In my computer it runs nice, but in my friends computer it locks the mouse pointer every now and then.

You are welcome mate :)
Waiting for your further response about how your computer is running :) But give it s time.

I guess you are running 314.22 WHQL? At first, make it sure.

If so, try another driver version. 320.18 WHQL (well, that's not a good one, but it is to do to confirm that the error is coming out of multiple versions of display driver or not).

Let us know the result.