Windows 7: BSOD while Patching ArcheAge, caused by driver ntoskrl.exe

NoelDP · 14 Apr 2015

I've uploaded a file - hcoaa.zip - to my OneDrive at Noel's OneDrive
Please download and save it.
Right-click on the downloaded file, and select Extract all…
Extract to the default location - which will create a new folder hcoaa in the same place.
Open this folder - there should be one folder inside it (Manifests)

Copy the content of the manifests folder (.manifest files - only one at this point) into this folder:

C:\Windows\Temp\CheckSur\Winsxs\Manifests

Now run the CheckSUR tool again (it may take a while)

Post the new CheckSUR.log file, and the CheckSUR.persist.log file.

NoelDP · 14 Apr 2015

...there's also the SFC scan results which we'll deal with after CheckSUR...

Code:

 Line 4266: 2015-04-13 10:37:39, Info                  CSI    000002fb [SR] Repairing 2 components
 Line 4267: 2015-04-13 10:37:39, Info                  CSI    000002fc [SR] Beginning Verify and Repair transaction
 Line 4268: 2015-04-13 10:37:39, Info                  CSI    000002fd [SR] Cannot repair member file [l:20{10}]"jnwdui.dll" of Microsoft-Windows-TabletPC-JournalNoteWriter, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
 Line 4269: 2015-04-13 10:37:39, Info                  CSI    000002fe [SR] Cannot repair member file [l:20{10}]"jnwppr.dll" of Microsoft-Windows-TabletPC-JournalNoteWriter, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
 Line 4270: 2015-04-13 10:37:39, Info                  CSI    000002ff [SR] Cannot repair member file [l:20{10}]"jnwmon.dll" of Microsoft-Windows-TabletPC-JournalNoteWriter, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
 Line 4271: 2015-04-13 10:37:39, Info                  CSI    00000300 [SR] Cannot repair member file [l:20{10}]"jnwdui.dll" of Microsoft-Windows-TabletPC-JournalNoteWriterQFE, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
 Line 4272: 2015-04-13 10:37:39, Info                  CSI    00000301 [SR] Cannot repair member file [l:20{10}]"jnwppr.dll" of Microsoft-Windows-TabletPC-JournalNoteWriterQFE, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
 Line 4273: 2015-04-13 10:37:39, Info                  CSI    00000302 [SR] Cannot repair member file [l:20{10}]"jnwmon.dll" of Microsoft-Windows-TabletPC-JournalNoteWriterQFE, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing

They - and the other CheckSUR errors (Missing Payload files) - will require different treatment.

HikariChino · 14 Apr 2015

CheckSUR...are you refering to this? What is the System Update Readiness Tool? - Windows Help

NoelDP · 14 Apr 2015

That's the beastie - you ran it to produce the logs in the first place.

HikariChino · 14 Apr 2015

I ran sfc /scannow. That's what I thought produced those logs. Or was it my attempts to update?

HikariChino · 14 Apr 2015

Hope this is it. These were dated 4/14 @6:13P, so there.

NoelDP · 15 Apr 2015

What on earth has been going on?
Here's the latest CheckSUR result...

Code:

Summary:
Seconds executed: 1087
 Found 482 errors
 Fixed 158 errors
  CSI Manifest All Zeros Total count: 302
  CSI Catalog Corrupt Total count: 7
  Fixed: CSI Catalog Corrupt.  Total count: 7
  CSI Payload File Missing Total count: 18
  CBS MUM Corrupt Total count: 2
  CBS Catalog Corrupt Total count: 2
  CSI Catalog Thumbprint Invalid Total count: 151
  Fixed: CSI Catalog Thumbprint Invalid.  Total count: 151

I think we'd better have fresh SFC and CheckSUR data - the massive increase in errors is worrying me.
Please run both SFC and CheckSUR again, and post the new logs.

HikariChino · 15 Apr 2015

I ran sfc but I don't see any CBS dated today. I'll try again after work.

As for CheckSUR, it bsoded when I ran it. Here's the dump.

Also, When I started up my comp for the day, it ran chkdsk and a LOT of stuff happened too quickly, but I could make out a lot of deleting. I dunno how to log/report that, but thought I'd let you know.

HikariChino · 15 Apr 2015

Never mind, log just pooped out. Hope this is the one; I'm heading to work, be back in 5 hours.

essenbe · 15 Apr 2015

As for the dump file

Code:

Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41287, ab4000, 0, 0}
Probably caused by : hardware ( nt! ?? ::FNODOBFM::`string'+454f5 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, An illegal page fault occurred while holding working set synchronization.
 Parameter 2 contains the referenced virtual address.
Arg2: 0000000000ab4000
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------

BUGCHECK_STR:  0x1a_41287
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME:  mscorsvw.exe

Code:

fffff880`0898e588  fffff880`05c7d08bUnable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
 nvlddmkm+0x20308b