Help Please

joker007 · 23 Jun 2010

Hi guys. I would be very grateful if you could help with attached mini dump of bsod. Ever since upgrading to HD 5850 and new PSU my system has turned from rock solid stable to a 2d nightmare. Having done a lot of reading regarding gddr 5 and changing 2d clocks I set the memory frequency to be the same whether it was 2d or 3d running. This stopped the flickering when running dual monitors. When Gaming the PC has always been fine, Never crashing. However, in 2d whether surfing the net or just idle I would get random crashing resulting in either a frozen system or corrupted screens. Horizontal lines, random colours. After running Driver Verifier I am receiving the message " a faulty driver on the kernel stack must be replaced with a working one" Also when running driver verifier I can no longer boot to windows unless I use safe mode. I have uninstalled all ATI drivers and used Driver sweeper to clear all traces but am still getting this message. Any Ideas? Please see inclosed mini dump.

Lordbob75 · 23 Jun 2010

Looks like AVG Free is causing your issue. Try removing it and see if you are stable again.

~Lordbob

Jonathan_King · 23 Jun 2010

Pretty straightforward, AVG is causing the issue. Please remove it with this tool: http://download.avg.com/filedir/util...removerx64.exe

Replace with MSE: http://www.microsoft.com/security_essentials

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Jonathan\AppData\Local\Temp\Temp1_062310-17562-01.zip\062310-17562-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a1b000 PsLoadedModuleList = 0xfffff800`02c58e50
Debug session time: Tue Jun 22 20:15:56.708 2010 (UTC - 4:00)
System Uptime: 0 days 0:01:52.490
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {0, 0, 0, 0}

Unable to load image \SystemRoot\System32\Drivers\avgtdia.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for avgtdia.sys
*** ERROR: Module load completed but symbols could not be loaded for avgtdia.sys
Probably caused by : avgtdia.sys ( avgtdia+7faf )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000000, caller is trying to allocate zero bytes
Arg2: 0000000000000000, current IRQL
Arg3: 0000000000000000, pool type
Arg4: 0000000000000000, number of bytes

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_0

CURRENT_IRQL:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  avgnsa.exe

LAST_CONTROL_TRANSFER:  from fffff80002f153dc to fffff80002a8b600

STACK_TEXT:  
fffff880`083be5b8 fffff800`02f153dc : 00000000`000000c4 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`083be5c0 fffff800`02f15e1b : fffffa80`073b2e80 fffff800`02f27057 fffffa80`073b2e80 fffff980`2baf0f90 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`083be600 fffff800`02f26df8 : 00000000`f24b5357 00000000`00000080 00000000`00000000 00000000`00000000 : nt!ExAllocatePoolSanityChecks+0xcb
fffff880`083be640 fffff800`02f2709d : fffff980`1d550ec0 fffff980`2bafefb8 00000000`f24b5357 00000000`00000000 : nt!VeAllocatePoolWithTagPriority+0x88
fffff880`083be6b0 fffff880`03b36707 : fffffa80`0395ba20 fffff880`00000008 fffff800`00000000 00000000`00000003 : nt!VerifierExAllocatePoolWithTag+0x1d
fffff880`083be6f0 fffff880`03a38faf : fffff980`2bafeea0 fffff980`2bafeea0 fffff980`00000020 fffff980`2bafefb8 : afd!WskTdiEHReceive+0xe7
fffff880`083be780 fffff980`2bafeea0 : fffff980`2bafeea0 fffff980`00000020 fffff980`2bafefb8 00000000`000002dd : avgtdia+0x7faf
fffff880`083be788 fffff980`2bafeea0 : fffff980`00000020 fffff980`2bafefb8 00000000`000002dd fffff880`083be810 : 0xfffff980`2bafeea0
fffff880`083be790 fffff980`00000020 : fffff980`2bafefb8 00000000`000002dd fffff880`083be810 00000000`00000000 : 0xfffff980`2bafeea0
fffff880`083be798 fffff980`2bafefb8 : 00000000`000002dd fffff880`083be810 00000000`00000000 fffff880`083be818 : 0xfffff980`00000020
fffff880`083be7a0 00000000`000002dd : fffff880`083be810 00000000`00000000 fffff880`083be818 00000000`00000003 : 0xfffff980`2bafefb8
fffff880`083be7a8 fffff880`083be810 : 00000000`00000000 fffff880`083be818 00000000`00000003 fffff880`03b36620 : 0x2dd
fffff880`083be7b0 00000000`00000000 : fffff880`083be818 00000000`00000003 fffff880`03b36620 fffff980`186fcec0 : 0xfffff880`083be810


STACK_COMMAND:  kb

FOLLOWUP_IP: 
avgtdia+7faf
fffff880`03a38faf ??              ???

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  avgtdia+7faf

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: avgtdia

IMAGE_NAME:  avgtdia.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4bd4af8f

FAILURE_BUCKET_ID:  X64_0xc4_0_VRF_avgtdia+7faf

BUCKET_ID:  X64_0xc4_0_VRF_avgtdia+7faf

Followup: MachineOwner
---------

EDIT: I see LB beat me to it. Good job, LB.

Lordbob75 · 23 Jun 2010

Jonathan_King said:

EDIT: I see LB beat me to it. Good job, LB.

Thanks! Glad I am on the right track here. Trying to work my way to understanding of BSoDs.

~Lordbob

joker007 · 23 Jun 2010

Thnk you both for your quick and helpful replies. I am in the process of uninstalling AVG free and putting the Microsoft anti-virus on. I wonder why I never had this problem when I was using an Nvidia 8800 GTS 512MB and AVG together? I have only had problems since I upgraded. I have attched a mini dump of problems I had before I ran driver verifier. If you wouldn't mind having a quick look I would be very grateful. I found changing RAM timings helped.

joker007 · 23 Jun 2010

Sorry Guys, forgot to attach mini dump. All there now. Must have been the shock of England beating Slovenia!

Jonathan_King · 23 Jun 2010

That dump doesn't point to anything at all. If I had seen if before the Verifier enabled one, I would have advised enabling Verifier.

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Jonathan\AppData\Local\Temp\Temp1_061410-22296-01.zip\061410-22296-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a06000 PsLoadedModuleList = 0xfffff800`02c43e50
Debug session time: Mon Jun 14 07:33:25.011 2010 (UTC - 4:00)
System Uptime: 0 days 0:15:36.652
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5003, fffff70001080000, 5f1, 8b600000be0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29f97 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005003, The subtype of the bugcheck.
Arg2: fffff70001080000
Arg3: 00000000000005f1
Arg4: 000008b600000be0

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_5003

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  avgcsrva.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002ae5d98 to fffff80002a76600

STACK_TEXT:  
fffff880`037ac9c8 fffff800`02ae5d98 : 00000000`0000001a 00000000`00005003 fffff700`01080000 00000000`000005f1 : nt!KeBugCheckEx
fffff880`037ac9d0 fffff800`02a908a6 : 00000000`00000001 00000000`0900c000 fffff880`037acc20 fffff680`00048060 : nt! ?? ::FNODOBFM::`string'+0x29f97
fffff880`037acac0 fffff800`02a746ee : 00000000`00000001 00000000`0900bfb8 00000000`00000001 fffffa80`06021240 : nt!MmAccessFault+0x5c6
fffff880`037acc20 0000000a`0093c4d6 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`07b7b9c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xa`0093c4d6


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+29f97
fffff800`02ae5d98 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+29f97

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+29f97

BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+29f97

Followup: MachineOwner
---------

joker007 · 23 Jun 2010

After uninstalling AVG I have just had another BSOD with a similar message. I would be grateful if you could have a look. Thanks in advance.

Lordbob75 · 23 Jun 2010

This one is caused by your EVGA Precision tools. I would remove it, or update it.

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\David\AppData\Local\Temp\7zOCACE.tmp\062410-52609-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a0d000 PsLoadedModuleList = 0xfffff800`02c4ae50
Debug session time: Wed Jun 23 15:58:29.930 2010 (UTC - 7:00)
System Uptime: 0 days 0:25:26.727
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {f6, fc, fffffa800454c060, fffff88007928522}

Unable to load image \??\C:\Program Files (x86)\MSI Afterburner\RTCore64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for RTCore64.sys
*** ERROR: Module load completed but symbols could not be loaded for RTCore64.sys
Probably caused by : RTCore64.sys ( RTCore64+1522 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 00000000000000fc, Handle value being referenced.
Arg3: fffffa800454c060, Address of the current process.
Arg4: fffff88007928522, Address inside the driver that is performing the incorrect reference.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_f6

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  MSIAfterburner

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002f073dc to fffff80002a7d600

STACK_TEXT:  
fffff880`07d955a8 fffff800`02f073dc : 00000000`000000c4 00000000`000000f6 00000000`000000fc fffffa80`0454c060 : nt!KeBugCheckEx
fffff880`07d955b0 fffff800`02f1cae4 : 00000000`000000fc fffffa80`0454c060 00000000`00000002 00000000`00000001 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`07d955f0 fffff800`02cd9580 : 00000000`00000000 fffff880`07d95820 00000000`00000000 00000000`00000000 : nt!VfCheckUserHandle+0x1b4
fffff880`07d956d0 fffff800`02d55425 : 00000000`00000000 00000000`000f001f 00000000`00000000 fffff800`02d55400 : nt! ?? ::NNGAKEGL::`string'+0x20e1e
fffff880`07d957a0 fffff800`02f1c878 : 00000000`00000004 00000000`00000002 fffff880`07d95890 fffff800`02a78df0 : nt!ObReferenceObjectByHandle+0x25
fffff880`07d957f0 fffff880`07928522 : 00000000`fdac0000 00000000`00000002 00000000`00000004 fffff800`00000000 : nt!VerifierObReferenceObjectByHandle+0x48
fffff880`07d95840 00000000`fdac0000 : 00000000`00000002 00000000`00000004 fffff800`00000000 fffff880`07d958c8 : RTCore64+0x1522
fffff880`07d95848 00000000`00000002 : 00000000`00000004 fffff800`00000000 fffff880`07d958c8 00000000`00000000 : 0xfdac0000
fffff880`07d95850 00000000`00000004 : fffff800`00000000 fffff880`07d958c8 00000000`00000000 fffff800`02d996b7 : 0x2
fffff880`07d95858 fffff800`00000000 : fffff880`07d958c8 00000000`00000000 fffff800`02d996b7 fffff800`02d996b7 : 0x4
fffff880`07d95860 fffff880`07d958c8 : 00000000`00000000 fffff800`02d996b7 fffff800`02d996b7 fffffa80`060acf40 : 0xfffff800`00000000
fffff880`07d95868 00000000`00000000 : fffff800`02d996b7 fffff800`02d996b7 fffffa80`060acf40 fffff800`02d996b7 : 0xfffff880`07d958c8


STACK_COMMAND:  kb

FOLLOWUP_IP: 
RTCore64+1522
fffff880`07928522 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  RTCore64+1522

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: RTCore64

IMAGE_NAME:  RTCore64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  42941d90

FAILURE_BUCKET_ID:  X64_0xc4_f6_VRF_RTCore64+1522

BUCKET_ID:  X64_0xc4_f6_VRF_RTCore64+1522

Followup: MachineOwner
---------

~Lordbob

joker007 · 23 Jun 2010

Thanks Lordbob. As soon as I clicked on the exe of Msi afterburner the BSOD happened so un-installed straight away. Hopefully now I will see some stability return to my system thanks to you guys. I will let you know how things go as I have a funny feeling my HD 5850 is still very temperamental especially in 2d but hopefully fingers crossed thats it. A big thank you to all that have helped me and to this site. Will let you know how it goes.