BSOD - many times in recent months

[Simonpoo]

Hey guys, I was also having the same problem just today. I was watching youtube, fell asleep on my bed, wake up 20 minutes later and my computer was put to sleep. Not sure if the computer got hot during sleep time but it ended up with a blue screen of death.

An attempt was made to write to read only memory blue screen.

I've had bsod's a lot during these past few months and it just happened so suddenly. I don't know how to fix it Happens quite often, it's either a BSOD or my computer COMPLETELY freezes, I don't hear any sound AND I can't even move my mouse, make any keyboard gestures etc. It's just completely frozen, so I don't know what's wrong with my computer I've uninstalled recent programs, basically only have games installed as well as the normal microsoft programs and necessities. Help!

I've been using Ccleaner to remove my registry and clean my computer, so I don't know where the other dumps are, but the BSOD happened again and so I thought of looking it up and asking someone who knows what's going on so hopefully someone can help! Any help would be appreciated!

The computer has rebooted from a bugcheck. The bugcheck was: 0x000000be (0xfffff96000323ad8, 0x8f400001c8ebf021, 0xfffff88009d92610, 0x000000000000000b). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 020214-15490-01.

 

[Arc]

Hi Simonpoo.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

If it does not show any error, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.
_________________________________________________________________________________________

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck BE, {fffff96000323ad8, 8f400001c8ebf021, fffff88009d92610, b}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : win32k.sys ( win32k+18c55d )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory.  The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff96000323ad8, Virtual address for the attempted write.
Arg2: 8f400001c8ebf021, PTE contents.
Arg3: fffff88009d92610, (reserved)
Arg4: 000000000000000b, (reserved)

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xBE

PROCESS_NAME:  Skype.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

TRAP_FRAME:  fffff88009d92610 -- (.trap 0xfffff88009d92610)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff9008a028170 rbx=0000000000000000 rcx=fffff96000323a78
rdx=fffffa800bb176f0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030c3f96 rsp=fffff88009d927a0 rbp=fffffa800bb176f0
 r8=0000000000000000  r9=fffff96000323a78 r10=0000000000003f3c
r11=fffff88009d929f0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di pl zr na po nc
nt!ExpReleaseResourceForThreadLite+0x46:
fffff800`030c3f96 f0480fba696000  lock bts qword ptr [rcx+60h],0 ds:fffff960`00323ad8=0000000000000029
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000314c7c6 to fffff800030cebc0

STACK_TEXT:  
fffff880`09d924a8 fffff800`0314c7c6 : 00000000`000000be fffff960`00323ad8 8f400001`c8ebf021 fffff880`09d92610 : nt!KeBugCheckEx
fffff880`09d924b0 fffff800`030cccee : 00000000`00000001 fffff960`00323ad8 00000000`00000000 fffff960`00323a78 : nt! ?? ::FNODOBFM::`string'+0x44cde
fffff880`09d92610 fffff800`030c3f96 : 00000000`00000001 00000000`00000000 00000000`00003f3c 00000000`00001514 : nt!KiPageFault+0x16e
fffff880`09d927a0 fffff800`030d7d42 : 00000000`00001514 00000000`00000000 00000000`00000bbc 00000000`62051514 : nt!ExpReleaseResourceForThreadLite+0x46
fffff880`09d92800 fffff960`001fc55d : 00000000`00000000 fffffa80`0ad13d80 00000000`00000001 fffff800`030d7a8b : nt!ExReleaseResourceAndLeaveCriticalRegion+0x12
fffff880`09d92830 00000000`00000000 : fffffa80`0ad13d80 00000000`00000001 fffff800`030d7a8b 00000000`000de8b0 : win32k+0x18c55d


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k+18c55d
fffff960`001fc55d ??              ???

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  win32k+18c55d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  X64_0xBE_win32k+18c55d

BUCKET_ID:  X64_0xBE_win32k+18c55d

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xbe_win32k+18c55d

FAILURE_ID_HASH:  {84ecbf15-5a22-e55f-80de-ed301cea741a}

Followup: MachineOwner
---------

 

[Simonpoo]

I'll do this tonight! I'll hopefully get back to you soon, thank you for your reply Arc!


Update:

I've completed the memtest and didn't get an error which is a good sign I assume. I will now try the Driver Verifier! Once I've done this, what does it mean if nothing happens? Is there something wrong with my programs or hardware or something?

 

[Arc]

Let the Driver Verifier go ... then we will decide the further courses of action seeing the results.

 

[Simonpoo]

Hey Arc,

I played LoL and Csgo last night after the me test with driver verifier on. Computer was slow at loading which was normal, DIDNT get any bsod.

I just go home turned on my computer an it worked fine for like 5 minutes, then all of a sudden my computer screen went all black. I wasn't paying attention to it when it happened as I hd left my room but I then restarted it because it was black for like 3 minutes. After restarting it it took me to some black screen that said windows couldn't load properly or something. So two options came up. It saidstartup repair or something like that and run windows normally.

It wouldn't let me startup repair for some reason my keyboard stopped working and mouse too when I pressed enter onto stattup repair. Sou started windows up normally. Everything loade up, Skype etc and it blue screens so I was like ok.. So I restarted it and same thing happened.
I don't exactly remember what the blues screen said but it said something like a faulty driver is trying to corrupt your system or something. Something about replacing some kernel stash or get a new one or something. HELP do I have to go to safe mode or something? Imnot that computer savvy so you light need to give me step by step instructions :/ thanks arc!

 

[Simonpoo]

I turned of verifier as quick as possible when my computer re booted up. It told me to restart to have the changes made and it bsod straight away so I take that as a restart..? My computer still seems VERY slow so idk if the verifier is still on or not :s

 

[Simonpoo]

A device driver attempting to corrupt the system has even caught.

 

[Arc]

The Driver Verifier makes the system slow and laggy on purpose. And "A device driver attempting to corrupt the system has even caught." --- that is what we need.

Upload the crash dump. Statements will not help you.

 

[Simonpoo]

Hey Arc, how do I find the crash dump?

 

[Simonpoo]

Oh I just found 3 of them in Windows > Minidump, they're in .dmp though, how do I change it? do I use the same program as before and "Grab All"?

 

[Simonpoo]

This is the current data:

 

[Arc]

Edit: Post slowly. And keep a cool head.

 

[Simonpoo]

Done! - Sorry quite nervous :s Never had a screwed up computer.

 

[Arc]

All the verifier enabled crash dumps are pointing to the display driver, the latest version. It fails.

Disable Driver Verifier for the time being.

Install the latest NVIDIA DRIVERS 314.22WHQL.

• Uninstall All nvidia items in Control Panel > Programs and features
  • 3D Vision Control Driver
  • 3D Vision Driver
  • Graphics Driver
  • HD Audio Driver
  • PhysX
  • nvidia Update
  (Are you using nvidia chipset drivers? If so, dont uninstall anything other than those are listed).
• Now follow Drivers - Clean Left over Files after Uninstalling
• Download 314.22 WHQL. While installing, Select Custom (Advanced) install. In the next page, follow this settings:
  
  

Let us know the results.

_________________________________________________________________________________________

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {f6, 188, fffffa800caa5060, fffff8800f4df0a1}

*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : nvlddmkm.sys ( nvlddmkm+9b0a1 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 0000000000000188, Handle value being referenced.
Arg3: fffffa800caa5060, Address of the current process.
Arg4: fffff8800f4df0a1, Address inside the driver that is performing the incorrect reference.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_f6

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  nvspcaps64.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

LAST_CONTROL_TRANSFER:  from fffff8000351c4ec to fffff8000308fbc0

STACK_TEXT:  
fffff880`0b1ef878 fffff800`0351c4ec : 00000000`000000c4 00000000`000000f6 00000000`00000188 fffffa80`0caa5060 : nt!KeBugCheckEx
fffff880`0b1ef880 fffff800`03531bf4 : 00000000`00000188 fffffa80`0caa5060 00000000`00000004 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`0b1ef8c0 fffff800`032e9890 : fffff8a0`00000003 fffff880`0b1efb10 fffff880`0b1efc00 fffff880`0b1efea0 : nt!VfCheckUserHandle+0x1b4
fffff880`0b1ef9a0 fffff800`0335f6b5 : fffff8a0`049ec700 fffff8a0`00000001 fffffa80`067493b0 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x2027e
fffff880`0b1efa70 fffff800`0308ee53 : fffffa80`07e9cb50 fffff880`0b1efe28 00000000`00000002 00000000`00000000 : nt!NtQueryValueKey+0x115
fffff880`0b1efc00 fffff800`0308b410 : fffff800`03520d96 fffff880`0f4df0a1 fffff880`0b1efea0 fffff880`0b1efe98 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0b1efe08 fffff800`03520d96 : fffff880`0f4df0a1 fffff880`0b1efea0 fffff880`0b1efe98 fffff800`0308b410 : nt!KiServiceLinkage
fffff880`0b1efe10 fffff880`0f4df0a1 : fffff880`0b1f08ca fffff880`0b1efee0 fffff880`0b1f08b8 fffffa80`07049818 : nt!VfZwQueryValueKey+0x76
fffff880`0b1efe60 fffff880`0b1f08ca : fffff880`0b1efee0 fffff880`0b1f08b8 fffffa80`07049818 00000000`00000000 : nvlddmkm+0x9b0a1
fffff880`0b1efe68 fffff880`0b1efee0 : fffff880`0b1f08b8 fffffa80`07049818 00000000`00000000 fffff880`0b1efe90 : 0xfffff880`0b1f08ca
fffff880`0b1efe70 fffff880`0b1f08b8 : fffffa80`07049818 00000000`00000000 fffff880`0b1efe90 fffff980`00000000 : 0xfffff880`0b1efee0
fffff880`0b1efe78 fffffa80`07049818 : 00000000`00000000 fffff880`0b1efe90 fffff980`00000000 00000000`00000188 : 0xfffff880`0b1f08b8
fffff880`0b1efe80 00000000`00000000 : fffff880`0b1efe90 fffff980`00000000 00000000`00000188 fffffa80`00320030 : 0xfffffa80`07049818


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nvlddmkm+9b0a1
fffff880`0f4df0a1 3d340000c0      cmp     eax,0C0000034h

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  nvlddmkm+9b0a1

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nvlddmkm

IMAGE_NAME:  nvlddmkm.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  52b326bc

FAILURE_BUCKET_ID:  X64_0xc4_f6_VRF_nvlddmkm+9b0a1

BUCKET_ID:  X64_0xc4_f6_VRF_nvlddmkm+9b0a1

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xc4_f6_vrf_nvlddmkm+9b0a1

FAILURE_ID_HASH:  {664220af-a0dd-a654-8c01-c50d5efba20d}

Followup: MachineOwner
---------

2: kd> lmvm nvlddmkm
start             end                 module name
fffff880`0f444000 fffff880`1008d000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        Thu Dec 19 22:32:52 2013 (52B326BC)
    CheckSum:         00C19112
    ImageSize:        00C49000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[Simonpoo]

Doing it now! Having a little trouble because I unsisntalled two of them because it wouldn't let me uninstall all of them at once? and then it said I had to restart, so I did and it installed itself again somehow?!

 

[Arc]

You cannot uninstall all at once.

Accept all offered restarts.

 

[Simonpoo]

Hey Arc, just wondering - your reply earlier didn't say anything about uninstalling Geforce Experience, I've got Geforce Experience 1.8.2 still, and when I uninstalled Virtual Audio 1.2.20, it told me to restart, I restarted and it reinstalled itself on reboot, I did that two more times and it did the same thing so I couldn't uninstall it.

Right now I've got:
Geforce Experience 1.8.2
Graphics Driver 332.21
PhysX System Software 9.13.0725
Virtual Audio 1.2.20

What do I do now?

Edit: Sorry - doing the DDU thing, skipped a step, will be done soon!

Edit: Just completed it - I now don't have Geforce Experience? :s Is that supposed to happen?

 

[Arc]

Yes, you pointed a good thing there .... the GeForce experience is also to be uninstalled.

 

[Simonpoo]

What's left is the Graphics Driver and PhysX System Software. Is there a next step?

By the way, thank you for helping me for everything, I really appreciate it!

 

[Arc]

Yes, uninstall them two.

Then install the suggested one, the graphics driver and PhysX only.