New
#1
BSOD playing CS GO
Hi,
I received a BSOD while playing CS GO (just as I clicked to connect to a community server). Some help with determining the cause and fixing it would be much appreciated. Probable cause appears to be ntkrnlmp.exe, but I'm not sure where to go from there.
I've run full scans for both Malwarebytes and Microsoft Security Essentials and they came out clean.
Windbg output for associated minidump file:
Code:******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* ATTEMPTED_WRITE_TO_READONLY_MEMORY (be) An attempt was made to write to readonly memory. The guilty driver is on the stack trace (and is typically the current instruction pointer). When possible, the guilty driver's name (Unicode string) is printed on the bugcheck screen and saved in KiBugCheckDriver. Arguments: Arg1: fffff8a00a415778, Virtual address for the attempted write. Arg2: 80000003b7c07101, PTE contents. Arg3: fffff8800373f840, (reserved) Arg4: 000000000000000b, (reserved) Debugging Details: ------------------ CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT BUGCHECK_STR: 0xBE PROCESS_NAME: System CURRENT_IRQL: 1 ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre TRAP_FRAME: fffff8800373f840 -- (.trap 0xfffff8800373f840) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffff8a00a415778 rbx=0000000000000000 rcx=fffff8a00a4356e0 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff880016a91ef rsp=fffff8800373f9d0 rbp=fffff8000307a280 r8=fffffa801307c018 r9=0000000000000009 r10=0000000000000004 r11=fffff8a00279ddc0 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc Ntfs!NtfsCommonClose+0x26f: fffff880`016a91ef 488908 mov qword ptr [rax],rcx ds:fffff8a0`0a415778=ffffffffffffffff Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002f4b9bd to fffff80002ed08c0 STACK_TEXT: fffff880`0373f6d8 fffff800`02f4b9bd : 00000000`000000be fffff8a0`0a415778 80000003`b7c07101 fffff880`0373f840 : nt!KeBugCheckEx fffff880`0373f6e0 fffff800`02ece9ee : 00000000`00000001 fffff8a0`0a415778 fffff8a0`1cd26700 fffffa80`5fecd2c0 : nt! ?? ::FNODOBFM::`string'+0x4127e fffff880`0373f840 fffff880`016a91ef : fffffa80`5fecd2c0 fffff800`0307a280 fffff8a0`0a435430 00000000`00000009 : nt!KiPageFault+0x16e fffff880`0373f9d0 fffff880`016fbd32 : fffffa80`5fecd2c0 fffff8a0`0a435560 fffff8a0`0a435430 fffffa80`11d87180 : Ntfs!NtfsCommonClose+0x26f fffff880`0373faa0 fffff800`02eda4b5 : 00000000`00000000 fffff800`031c5c01 fffff800`030dc900 00000000`00000002 : Ntfs!NtfsFspCloseInternal+0x186 fffff880`0373fb70 fffff800`0316a456 : 00000000`00000000 fffffa80`0c7a8b50 00000000`00000080 fffffa80`0c74a040 : nt!ExpWorkerThread+0x111 fffff880`0373fc00 fffff800`02ec22c6 : fffff880`03574180 fffffa80`0c7a8b50 fffff880`0357f0c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`0373fc40 00000000`00000000 : fffff880`03740000 fffff880`0373a000 fffff880`0373f8a0 00000000`00000000 : nt!KxStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: nt! ?? ::FNODOBFM::`string'+4127e fffff800`02f4b9bd cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4127e FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 556356e8 IMAGE_VERSION: 6.1.7601.18869 FAILURE_BUCKET_ID: X64_0xBE_nt!_??_::FNODOBFM::_string_+4127e BUCKET_ID: X64_0xBE_nt!_??_::FNODOBFM::_string_+4127e ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:x64_0xbe_nt!_??_::fnodobfm::_string_+4127e FAILURE_ID_HASH: {0d4a267e-fbe7-b467-2091-5e701291181b} Followup: MachineOwner ---------