BSOD after updating Nvidia drivers

[Britton30]

I don't think the CPU is bad if it passed IBT at 62C max. Running it at high or more can cause BSODs a lot.
Someone else will have to analyze your dumps for you.

 

[x BlueRobot]

[COLOR="Red"]BugCheck DE[/COLOR], {2, fffff8a002cbca50, fffff8a002cbcb51, 27a2b8c0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+2c8e1 )

Usual causes:  Device driver, Memory

This bugcheck indicates that a driver has corrupt the pool pages being paged out to the disk.

3: kd> [COLOR="SeaGreen"]lmvm savonaccess[/COLOR]
start             end                 module name
fffff880`06c32000 fffff880`06c62000   savonaccess T (no symbols)           
    Loaded symbol image file: savonaccess.sys
    Image path: \SystemRoot\system32\DRIVERS\savonaccess.sys
    Image name: savonaccess.sys
    Timestamp:        [COLOR="Red"]Fri Jan 27 11:08:07 2012[/COLOR] (4F228597)
    CheckSum:         0002DE2C
    ImageSize:        00030000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your Sophos Anti-Virus On-Access Driver seems to be causing problems, please remove the program completely and then install these free and proven alternatives which work best with the operating system due to their lightweight nature on system resources and compatibility.

Install and perform full scans with:

• Malwarebytes : Free anti-malware download
• Microsoft Security Essentials | Protect against viruses, spyware, and other malware

   Information

Remember to install the free version of Malwarebytes not the free trail; untick the free trial box during installation. MSE is the most lightweight and compatible with the Windows 7 operating system

You can also view this thread for a complete free and lightweight security protection combination:

• http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

 

[kelpto]

Ok, I've uninstalled Sophos and am installing malwarebytes and MSE.
I'll update again if I have anymore problems, thankyou for your help!

 

[x BlueRobot]

Welcome, will look forward for an update

 

[kelpto]

So after running full scans with both Malwarebytes and MSE, my computer was clean (apart from some registry files found by Malwarebytes, which I removed).
However, playing GW2 today I got another blue screen, this time memory_management 1a (minidump attached). This seems to be my most common one, however I can't seem to narrow down the problem.

-I've run memtest86+ twice and it has run both times no errors over 9-10 passes.
-I've ran FurMark once with no problems
-I've ran IBT three times, with only a blue screen occuring during the Very High test, Standard and High tests were passes.

 

[x BlueRobot]

[COLOR=Red]BugCheck 1A[/COLOR], {[COLOR="Blue"]403[/COLOR], fffff68000477f00, caa0000027a2b867, fffff68000477e00}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+3211c )

Usual causes:  Device driver, memory, kernel

This bugcheck indicates that the page table and PFNs are out of sync, parameters 3 and 4 differ quite sustainability, and therefore I believe at the moment it more of a software problem.

3: kd> [COLOR="SeaGreen"]!thread[/COLOR]
GetPointerFromAddress: unable to read from fffff8000dd00000
THREAD fffffa800a6d7060  Cid 03f4.1148  Teb: 00000000fff86000 Win32Thread: fffff900c219a5d0 RUNNING on processor 3
IRP List:
    [COLOR="Red"]Unable to read nt!_IRP @ fffffa800a692880[/COLOR]
Not impersonating
GetUlongFromAddress: unable to read from fffff8000dc3fba4
Owning Process            fffffa8006a89390       Image:         Gw2.exe
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      173647       
Context Switch Count      4751028        IdealProcessor: 0                 LargeStack
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x0000000000942433
Stack Init fffff8800c1d4c70 Current fffff8800c1d47c0
Base fffff8800c1d5000 Limit fffff8800c1cc000 Call 0
Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5

There also seems to be a pending IRP associated with the thread, since this is a Minidump, I'm not able to gather the IRP stack and any associated drivers.

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

 

[kelpto]

Well looks as though it's a driver problem. After setting up driver verifier as per the instructions you posted, I immediately got a blue screen straight after the 'starting windows' screen. Minidump attached, my desktop is filled with these things now haha.
Also, what would I do in regards to the IRP?

 

[x BlueRobot]

A IRP isn't an error, it's a completely normal procedure (IRP = I/O Request Packet), if you mean what would you in a debugging sense, then you would use !irp with the address of that IRP.

[COLOR=Red]BugCheck C9[/COLOR], {[COLOR=Blue]23e[/COLOR], fffff88004401324, fffff98009706ee0, 0}

*** WARNING: Unable to verify timestamp for GEARAspiWDM.sys
*** ERROR: Module load completed but symbols could not be loaded for GEARAspiWDM.sys
Unable to load image \SystemRoot\system32\DRIVERS\dtsoftbus01.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dtsoftbus01.sys
*** ERROR: Module load completed but symbols could not be loaded for dtsoftbus01.sys
Probably caused by : [COLOR=Red]dtsoftbus01.sys[/COLOR] ( dtsoftbus01+1324 )

This bugcheck is caused when Driver Verifier finding a I/O violation, the error can be seen with the first parameter. A driver marked a IRP pending but didn't return the STATUS_PENDING flag.

Remove:

Start Menu\Programs\DAEMON Tools Lite

2: kd> [COLOR=SeaGreen]lmvm dtsoftbus01[/COLOR]
start             end                 module name
fffff880`04400000 fffff880`04449000   dtsoftbus01 T (no symbols)           
    Loaded symbol image file: dtsoftbus01.sys
    Image path: \SystemRoot\system32\DRIVERS\dtsoftbus01.sys
    Image name: dtsoftbus01.sys
    Timestamp:       [COLOR=Red] Fri Jan 13 13:45:46 2012[/COLOR] (4F10358A)
    CheckSum:         00046D1E
    ImageSize:        00049000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

2: kd>[COLOR=SeaGreen] lmvm GEARAspiWDM[/COLOR]
start             end                 module name
fffff880`079be000 fffff880`079cb000   GEARAspiWDM T (no symbols)           
    Loaded symbol image file: GEARAspiWDM.sys
    Image path: \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
    Image name: GEARAspiWDM.sys
    Timestamp:        [COLOR=Red]Mon May 18 13:17:04 2009[/COLOR] (4A1151C0)
    CheckSum:         000159B4
    ImageSize:        0000D000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

This driver is usually either used by iTunes or GEAR software programs, please update any associated programs or remove them completely.

 

[kelpto]

Phew, I uninstalled Daemon tools and iTunes (and other leftover Apple programs) and got rid of that GEAR driver.
I am currently running Driver verifier again and it's looking good as I've actually managed to log on! I'll keep it running all day and post back if I get anything else.

 

[x BlueRobot]

Thanks

 

[kelpto]

Ok, I ran verifier all day yesterday and had no crashes, however today I got another memory_management crash whilst playing GW2 (verifier was DISABLED).
Minidump attached. I might run verifier again and leave it on for longer.

 

[x BlueRobot]

[COLOR="Red"]BugCheck 1A[/COLOR], {[COLOR="Blue"]403[/COLOR], fffff68000503998, 9720000027a2b867, fffff68000503898}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+3211c )

2: kd> [COLOR="SeaGreen"]!thread[/COLOR]
GetPointerFromAddress: unable to read from fffff8000dcb8000
THREAD fffffa8006aa7060  Cid 1120.05dc  Teb: 00000000fff86000 Win32Thread: fffff900c2027ab0 RUNNING on processor 2
IRP List:
   [COLOR="Red"] Unable to read nt!_IRP @ fffffa800af1b7b0[/COLOR]
Not impersonating
GetUlongFromAddress: unable to read from fffff8000dbf7ba4
Owning Process            fffffa800b36f060       Image:         Gw2.exe
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      851285       
Context Switch Count      5961553        IdealProcessor: 0                 LargeStack
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x0000000000941823
Stack Init fffff88003dc5c70 Current fffff88003dc57c0
Base fffff88003dc6000 Limit fffff88003dbd000 Call 0
Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5

Report back on the findings of Driver Verifier, we may need a Kernel Memory dump.

 

[kelpto]

I've run driver verifier all day and have had no problems. Is there a way to tell if it is running?

When opening it again and checking "Display information about currently verified drivers", all of them are loaded apart from nvbridge.kmd which is "Never Loaded".

This has the description "NVIDIA Compatible Windows Vista ..." (can't see the rest), when I go into "Display existing settings".

Hope this information can be of some use.

 

[x BlueRobot]

To see if Driver Verifier is running, then open a elevated command prompt, and then type this command:

verifier /query

Also, we may now need a Kernel Memory dump instead, we will retain all the Kernel Mode address space at the time of the crash. Upload the file to a file sharing service such as Skydrive and Dropbox (both which provide free space), and then ensure you upload the file to the Public folder of your account. Once completed, then post the URL of the file in your next post.

 

[kelpto]

Ok, it looks as though I already have it set up by default to produce a kernal memory dump. I assume I should just wait until I blue screen again and then grab the file?

 

[x BlueRobot]

Yes, when a another BSOD happens, then follow the above procedure, by default, it should be saved here:

C:\Windows\MEMORY.DMP

Is there any at the moment?

 

[kelpto]

Ok, just got another blue screen then, this time it was a new error PFN_LIST_CORRUPT I think. I've attached the minidump and I am uploading the MEMORY.DMP now, I didn't realise it was so large!

Edit: Finished uploading, here is the link:
https://dl.dropboxusercontent.com/u/27400316/Kelpto%20-%20MEMORY.DMP

 

[x BlueRobot]

[COLOR=Red]BugCheck 4E[/COLOR], {[COLOR=Blue]99[/COLOR], [COLOR=SeaGreen]27a2b[/COLOR], 2, 2af02}

Probably caused by : [COLOR=Red]memory_corruption[/COLOR] ( nt!MiBadShareCount+4c )

Usual causes:  Device driver, memory

2: kd> [COLOR=SeaGreen]!pfn 27a2b[/COLOR]
    PFN 00027A2B at address[COLOR=Red] FFFFFA800076E810[/COLOR]
    flink       00177F05  blink / share count 0002AF02  pteaddress[COLOR=Red] FFFFF8A011053569[/COLOR]
    [COLOR=Red]reference count 0000[/COLOR]    used entry count  0000      Cached    color 0   Priority 5
    restore pte FA800B46C1B004C0  containing page        1C4EDD  Standby     P      
      Shared

The reference count is not below zero, therefore I believe the problem is not a result of incorrect MDL handling. The physical page, seems can be shared between multiple processes if I'm correct, and is currently located on the Standby list which is allowed. The reason for the crash, could be drivers referencing memory addresses which they do not own.

2: kd> [COLOR=SeaGreen]!pte FFFFF8A011053569[/COLOR]
                                           VA fffff8a011053569
PXE at FFFFF6FB7DBEDF88    PPE at FFFFF6FB7DBF1400    PDE at FFFFF6FB7E280440    PTE at FFFFF6FC50088298
contains 000000020FD84863  contains 000000000EDEF863  contains 00000001C2C04863  contains ADA00001C4EDD963
pfn 20fd84    ---DA--KWEV  pfn edef      ---DA--KWEV  pfn 1c2c04    ---DA--KWEV  pfn 1c4edd   -G-DA--KW-V

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

I understand we have ran Driver Verifier before, but this time enable the previous settings with the addition of the Special Pool setting. This is important, because it changes how Windows allocates pages to processes and drivers, each driver is given it's own page of memory instead of having a page shared among different drivers. This setting will be more memory intensive.

2: kd> [COLOR=SeaGreen]!poolval FFFFFA800076E810[/COLOR]
Pool page fffffa800076e810 region is Unknown

Validating Pool headers for pool page: fffffa800076e810

Pool page [ fffffa800076e000 ] is __inVALID.

Analyzing linked list...
[ fffffa800076e000 ]: invalid previous size [ 0x2a ] should be [ 0x0 ]
[ fffffa800076e000 --> fffffa800076e500 (size = 0x500 bytes)]: Corrupt region


Scanning for single bit errors...

None found