BSOD, "ntoskrnl.exe"

[Erox]

so this is my story:

I had a thread on this forum before, but we were never able to find the reason for the bluescreens. My pc would no longer boot (at all), and therefore i had given up. i recently bought a new motherboard, and now im able to use my computer, but i keep getting these "random" BSOD frequently when playing games.
I'm not entirely sure, but im pretty certain that it's not my RAM nor motherboard that is the problem, i ran a memtest86 on my ram with 0 errors, and my motherboard is brand new.
here you can see the earlier/older thread
http://www.sevenforums.com/bsod-help-support/312713-several-bsod-related-ntoskrnl-exe.html

 

[Thedoctor44]

Versjon	6.1.7600 Build [COLOR="Red"]7600[/COLOR]

You do not have Service Pack 1 installed, you need to install it otherwise your system will remain vulnerable to threats.

Your Logitech GSeries headset driver is causing issues.

BugCheck [COLOR="red"]C2[/COLOR], {[COLOR="Blue"]99[/COLOR], [COLOR="Green"]fffffa8006aee903[/COLOR], 0, 0}

*** WARNING: Unable to verify timestamp for ladfGSCamd64.sys
*** ERROR: Module load completed but symbols could not be loaded for ladfGSCamd64.sys
Probably caused by : [COLOR="Red"]ladfGSCamd64.sys[/COLOR] ( ladfGSCamd64+397 )

2: kd> [COLOR="Green"]lmvm ladfGSCamd64[/COLOR]
start             end                 module name
fffff880`01e24000 fffff880`01e86880   ladfGSCamd64 T (no symbols)           
    Loaded symbol image file: ladfGSCamd64.sys
    Image path: \SystemRoot\system32\DRIVERS\ladfGSCamd64.sys
    Image name: ladfGSCamd64.sys
    Timestamp:        [COLOR="red"]Mon Apr 15 19:39:12 2013[/COLOR] (516C4950)
    CheckSum:         0006DEE3
    ImageSize:        00062880
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it here.
Logitech Support - Downloads, Manuals, FAQs & More

It looks like the Logitech driver is trying to free an invalid memory address.

 

[Erox]

here we go

I downloaded all available windows updates, and removed the troublemaking driver, because i could not find a newer version of it.
however, I still got two bluescreens recently while playing Dota 2

 

[Thedoctor44]

Another USB bugcheck.

Upload the list of all the third party drivers Using NirSoft DriverView:

• Download and execute Driverview
• View > Hide Microsoft Drivers
• Edit > Select all
• File > Save Selected Items
• In the Save dialog, Set the path to desktop, Put "Driverview" in the name field, and save.
• Zip the .txt file and upload it.

BugCheck [COLOR="Red"]50[/COLOR], {[COLOR="DarkOrange"]ffffffffffffff93[/COLOR], 1, fffff960000d415d, 0}


Could not read faulting driver name
Probably caused by : [COLOR="red"]hardware[/COLOR] ( win32k!PhaseShift+a1 )

This bugcheck indicates that invalid memory was referenced.

The 1st parameter is the address being referenced, it's clearly an invalid page, although the Page Table Entries haven't been saved.

X64_[COLOR="Red"]IP_MISALIGNED[/COLOR]

There has been an Instructions Pointer misalignment which can be caused by drivers or faulty RAM, in this case most likely faulty RAM.

Memtest86 will test your RAM

   Information

Run Memtest86 for at least 8 passes so we get enough information to confirm that your RAM isn't failing

 

[Erox]

I sent my RAM sticks to customer service a couple of months ago thinking they were the root of all these bluescreens, but they found 0 errors. they ran memtest overnight, 9 passes overall with 0 errors. i cannot run memtest on my own computer at the moment because i have no free cds, and memtest simply won't work together with my USB-stick (error message: "An error (1) occured while executing syslinux. Your USB won't be bootable")

however, I followed your instructions regarding the Driverview, I've added the zip file to this post.

 

[Thedoctor44]

I noticed you have this installed.

Driver Name       : [COLOR="Red"]GVTDrv64.sys[/COLOR]
Address           : 0x06BB6000
End Address       : 0x06BC0000
Size              : 0x0000a000
Load Count        : 1
Index             : 153
File Type         : Unknown
Description       : 
Version           : 
Company           : 
Product Name      : 
Modified Date     : 07.06.2014 00:23:46
Created Date      : 05.06.2014 02:50:29
Filename          : C:\Windows\GVTDrv64.sys
File Attributes   : A
Service Name      : GVTDrv64
Service Display Name: 
Digital Signature :

It's the Gigabyte Easy Tune 6 driver, it's known to cause issues including BSODs with Windows.

Remove it completely.

I can't seem to find a timestamp on your USB 3.0 driver.

Update it here if it's outdated.

https://downloadcenter.intel.com/Default.aspx?lang=eng

I would remove Norton as a test.
Use this removal tool.

https://support.norton.com/sp/en/uk/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us

Replace it with MSE and Malwarebytes.

Microsoft Security Essentials - Microsoft Windows

Malwarebytes | Free Anti-Malware & Internet Security Software

   Tip

Make sure you don't enable the free trial of malwarebytes pro, deselect the option when prompted.

 

[Erox]

I followed your steps, but the bluescreens keep coming.
I got a bluescreen while playing Civilization V just now, it seems like i only get bluescreens when playing games- I can surf around the internet for however long i want, but once I run a game (with moderate graphics, like Dota 2) I recieve BSODs... could that indicate that theres something wrong with my GPU?

 

[Thedoctor44]

Memory management isn't my strongest area of expertise but it is the most interesting.
Lets take another look.

BugCheck 1A, {[COLOR="blue"]5100[/COLOR], fffff6fc4005b2c0, 1, 1d}

The first parameter indicates that a bitmap allocation has been corrupted.
This will be an educated guess..

The bitmap allocation or free space bitmap is used to track sectors on a drive, what's happened is some bitmap allocations have been overwritten whilst they are in use by the memory manager.

2: kd> [COLOR="Green"]knL[/COLOR]
 # Child-SP          RetAddr           Call Site
00 fffff880`02f8d5e8 fffff800`02ed0ad7 nt!KeBugCheckEx
01 fffff880`02f8d5f0 fffff800`02e926d7 nt! ?? ::FNODOBFM::`string'+0xaed7
02 fffff880`02f8d700 fffff800`033eacac nt!MmMapLockedPagesSpecifyCache+0x50c
03 fffff880`02f8d7d0 fffff800`033ea69a hal!HalpDmaSyncMapBuffers+0x54 <-- dma buffer
04 fffff880`02f8d880 fffff800`033ed83f hal!HalpDmaFlushScatterTransfer+0xae <-- Hal routines
05 fffff880`02f8d8d0 fffff800`033ec7d5 hal!IoFlushAdapterBuffers+0xaf
06 fffff880`02f8d910 fffff880`00e49199 hal!HalPutScatterGatherList+0x85
07 fffff880`02f8d970 fffff880`010e3453 [COLOR="red"]PCIIDEX!BmFlush+0x25[/COLOR] <-- The PCI controller is being blamed
08 fffff880`02f8d9a0 fffff880`010e3104 ataport!IdeProcessCompletedRequests+0x123
09 fffff880`02f8dad0 fffff800`02e822fc ataport!IdePortCompletionDpc+0x1a8 <-- [URL="http://en.wikipedia.org/wiki/Deferred_Procedure_Call"]DPC[/URL] list has emptied
0a fffff880`02f8db90 fffff800`02e6f90a nt!KiRetireDpcList+0x1bc 
0b fffff880`02f8dc40 00000000`00000000 nt!KiIdleLoop+0x5a <-- Processor awaiting instruction

Lets look at your display driver.

2: kd> [COLOR="Green"]lmvm nvlddmkm[/COLOR]
start             end                 module name
fffff880`0f01a000 fffff880`0fc7e000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        [COLOR="Red"]Tue May 20 00:08:44 2014[/COLOR] (537A8EFC)
    CheckSum:         00C1EA41
    ImageSize:        00C64000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

These latest version have been causing a few issues lately.
I recommend rolling back to a version late last year.

These instructions are useful.

http://www.sevenforums.com/tutorials/327414-nvidia-drivers-avoid-problems.html?filter

We could try Furmark but I think it's still a display driver issue here.

Stress test your graphics card with Furmark

I recommend running it for around 30 minutes

   Warning

Furmark will increase the temperature of your GPU rapidly so keep and eye on your temperatures

 

[Erox]

Page_fault_in_nonpaged_area

I followed your instructions, and uninstalled my NVIDIA drivers like the 'NVIDIA Drivers - Avoid Problems' showed me to do, and installed some eariler drivers from November 2013. (version 331.82)

Right there and then everything seemed fine! i ran FurMark for 30 minutes without issues, and i could play Civilization V for more than 5 minutes without a BSOD (played it for about 90 minutes, no BSOD appeared), it felt like the problem was fixed

However when I shut down my PC that night my windows started installing a bunch of updates, I believe it was 96 updates in total before it would shutdown. So today I thought I'd play a litte more Civilization V, but bluescreened after 5 minutes of gameplay. My windows wouldn't boot normally, it just showed an empty blue screen.

I booted windows repair mode, and now im writing this post.

 

[Thedoctor44]

I'm on my mobile phone at the moment so I can't look at the attached files.
When you put memtest on a USB stick make sure you format it as Fat32.
We ought to run memtest, as page faults in non paged areas are mainly caused by bad ram.

I will take a look at your files later.

For the sake of debugging here's what I see.

BugCheck [COLOR="Red"]50[/COLOR], {[COLOR="orange"]fffff900e5c46483[/COLOR], 0, [COLOR="Blue"]fffff960000f827d[/COLOR], 2}

This is the address being referenced by this address.

2: kd> [COLOR="Green"]r cr2[/COLOR]
Last set context:
[COLOR="DarkOrange"]cr2=fffff900e5c46483[/COLOR]

The address being referenced was store in the 2nd control register before the page fault handler was called.

Unfortunately most of the time the Page Table Entries aren't save din minidumps so there isn't much analysis I can do.

2: kd> [COLOR="green"]!pte fffff900e5c46483[/COLOR]
                                           VA fffff900e5c46483
PXE at FFFFF6FB7DBEDF90    PPE at FFFFF6FB7DBF2018    PDE at FFFFF6FB7E403970    PTE at FFFFF6FC8072E230
Unable to get PXE FFFFF6FB7DBEDF90

In this case Memtest86 would be the best course of action.

 

[Erox]

OK, seems like we got a breakthrough here- did 1-2 passes of memtest, it detected more than 300 000 errors and it keeps detecting more as im writing this post from my laptop. (wow...)

This is really, really. Reason why is because i sent my RAM stick to support a couple of months ago, I recieved them a a few of weeks later with a picture of a successful 9-pass memtest and a letter telling me there was nothing wrong with my RAM. But obviously there is (?)

What do i do now? do i send them back to support and hope they detect the errors this time and give me a refund?

Thank you so much for your help by the way, I really appreciete your time and effort!

The screen just went grey while running memtest, >400 000 errors detected overall.. i think ill power off the computer now and wait for your reply before i proceed with anything

 

[Thedoctor44]

Because you've had errors then you'll need to swap your RAM sticks around to determine whether or not it's the RAM sticks or motherboard DIMM slots.

If the output is like this then you have bad RAM so the stick(s) need replacing.

Test|Slot 1|Slot 2
RAM 1| Error | Error
RAM 2|Good|Good

If the output is like this then you should replace the motherboard, however you can leave that DIMM slot empty although it's not advised to use a system with a faulty motherboard.

Test|Slot 1|Slot 2
RAM 1| Error |Good
RAM 2| Error |Good

 

[Erox]

Test Slot 1 Slot 2
RAM 1 Good Good
RAM 2 Good Good

Those were my overall test results, and this seems weird to me. The only time memtest would detect errors was when I tested both sticks simultaneously (my previous post). When I tested the sticks individually, they would pass the test no matter which slot they were plugged in. (tested slots 1 and 2, my motherboards recommended slots).

May this mean the sticks are not compatible with each other? And if so- may removing one stick solve the problem temporarily?

 

[Thedoctor44]

I know just the man for this situation, I've seen this before but I've forgot how to determine the fault.

 

[essenbe]

Erox, it could mean the sticks are not compatible or it could mean the memory controller on the CPU is weak, or it could mean the board will not run correctly with 2 slots occupied. I had a board like that once. You state slots 1 and 2, were both slots the same color. Look at your manual again. Most boards have 4 slots, 2 of one color and 2 of another color. Both sticks should go in slots of the same color, and it is normally slots 1 and 3 or slots 2 and 4.

 

[essenbe]

It could also mean the ram is not compatible with the board, but your board has 4 slots, for dual channel mode the ram should be in slots 2 and 4 (or the white slots). Did you check the board's QVL list? I believe you can find out the correct slots on page 16 of your manual.

 

[Erox]

Hello Essenbe

(I apologise in advance for my amateur explanation, i hope this is not confusing)

My motherboard's RAM slots are set up in this order
DDR3_4 ===========
DDR3_2 ===========
DDR3_3 ===========
DDR3_1 ===========

The slots I've marked as red in this post (slot 1 & 2) are marked white on my motherboard, and is the preferred slots according to the User's Manual:

For optimum performance, when enabling Dual Channel mode with two memory modules, we recommend that you install them in the DDR3_1 and DDR3_2 sockets

The slots 3 and 4 are marked blue.

 

[essenbe]

No problem, that looks right, to me.

 

[essenbe]

Erox, if I may make a suggestion, put the ram in the other 2 slots and run the test again. You can do that with memtest without any problem. The worse thing that could happen is you may have to move it back to get the computer to boot after the test, but I don't really think that would happen. But the reason you have 2 colored dim slots is because you have 2 channels for memory and 2 memory controllers on the CPU. You have tried one and have errors on it. Try the other one and see if both channels give you errors. Do you have any spare DDR3 memory around or another computer with DDR3 memory you could try? If not, perhaps you have a friend with spare memory or a computer he would swap memory with you for a day or so, just to see if it makes a difference. Just make sure it is DDR3 memory and you know the correct frequency, timings and voltage for the new ram. Also, make sure you run the memtest86+ from http://www.memtest.org/ You can use either version 5.01 or 4.20, it won't matter.