BSoD playing certain games, various error codes (usually 0x03b)

[msgerbs]

I built my computer almost a year ago, and I've had on and off BSOD problems while playing games. League of Legends and Civilizations IV in particular seem to go on BSOD sprees. I'll play for a week without a problem, then get 4 in one day to the point where trying to play is pointless. Usually I just straight BSOD from in the game, on rare occasion the program will give me a standard windows "Program stopped working" crash, then either when I try to close that message or almost immediately upon restarting the game, it will BSOD. I've tried unsuccessfully to figure it out myself with windbg and posted several other places that also couldn't help other than "reformat and install programs one at a time until you crash again" which seemed to me to be akin to "I don't know", and I consider formatting an absolute last resort. So hopefully you guys can help me out. Thanks!

 

[Arc]

Welcome aboard.

► Install Service pack 1.

[COLOR=Red]Windows 7 Kernel Version 7600 MP [/COLOR](4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.17118.amd64fre.win7_gdr.120830-0334

Learn how to install Windows 7 Service Pack 1 (SP1)
Service Pack Center - Microsoft Windows

► Use Microsoft Security Essentials.
Uninstall Avira.

fffff880`08ad57f0  fffff880`03f2d030Unable to load image \SystemRoot\system32\DRIVERS\avipbb.sys, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for avipbb.sys
*** ERROR: Module load completed but symbols could not be loaded for avipbb.sys
 avipbb+0x1f030[/COLOR]

Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.

Download and install those, and then run full system scans with both of them, one by one.

► Update display driver.

lmvm atikmpag
start             end                 module name
fffff880`03f81000 fffff880`03fe2000   atikmpag   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\atikmpag.sys
    [COLOR=Red]Image name: atikmpag.sys
    Timestamp:        Sat Jul 28 06:44:47 2012[/COLOR] (50133D07)
    CheckSum:         00064351
    ImageSize:        00061000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Get it from AMD Graphics Drivers & Software.

► Update Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC

fffff880`08ad5718  fffff880`05605c87Unable to load image \SystemRoot\system32\DRIVERS\Rt64win7.sys, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
 Rt64win7+0x5c87[/COLOR]

Get it from Realtek

Let us know the results.

 

[msgerbs]

I haven't had a chance to try the rest of the solutions, but I can tell you that installing SP1 won't work, because I can't install it. The installation fails, every time, even after running the SP1 readiness checker thing, and downloading the standalone SP1 installer. If you tell me what I need to show you, maybe you can help with that as well?

And unless a virus was included with my installation of windows (downloaded from microsoft, so highly unlikely), I don't think a virus is what the problem is. Can you tell me what's wrong with my choice of antivirus before telling me I need to change it, please?

 

[Arc]

For updating windows, if it really fails there, try it: http://www.sevenforums.com/tutorials/91738-windows-update-reset.html

Avira is not any kind of good antivirus actually, but in your case it is contributing in the crashes.

Nobody said that a virus is a problem here, but the antivirus is.

 

[msgerbs]

What I did:
1) Install ATI software update
2) Install Realtek update
3) Uninstall Avira
4) Reboot
5) Install MSE
6) Reboot
7) Run quick scan, nothing found
8) Run SP1 standalone installer

What happened: SP1 installer got to about 80%, then failed with: ERROR_FILE_NOT_FOUND(0x80070002). The installer suggests running the system update readiness tool, but I ran that the first time I tried to install SP1 and it didn't help. Is there a log file somewhere that I/we/you can look at to determine what failed? I found the CheckSUR logs from the last time, and it reports no errors.

EDIT: I did find what I believe is the relevant portion of CBS.log:

         CBS    Failed to find file: amd64_microsoft-windows-f..rcluster-powershell_31bf3856ad364e35_6.1.7601.17514_none_f273f11a257acc7b\FailoverClusters.psd1 [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2012-11-13 13:28:55, Info                  CBS    Failed to gather all required files. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2012-11-13 13:28:55, Info                  CBS    Failed to gather all missing files for package: Package_for_KB976932~31bf3856ad364e35~amd64~~6.1.1.17514 [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2012-11-13 13:28:55, Info                  CSI    0000000e@2012/11/13:19:28:55.294 CSI Transaction @0x5498f30 destroyed
2012-11-13 13:28:55, Error                 CBS    Failed to pre- stage package: Package_for_KB976932~31bf3856ad364e35~amd64~~6.1.1.17514 [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]

It seems to be related to some part of Server Manager, which I do have installed. I have attached the rest of the log file for your perusal.

 

[NoelDP]

Please also post your CheckSUR.log and CheckSUR.persist.log files
There is no sign of your having run an SFC in the past week - please do so, and also run CHKDSK.



Please run a full CHKDSK and SFC scan....
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type
CHKDSK C: /R
and hit the Enter key.

You will be told that the drive is locked,
and the CHKDSK will run at he next boot - hit the Y key, and then reboot.
The CHKDSK will take a few hours depending on the size of the drive, so be patient!
After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -

then run the SFC.

SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.
At the Command prompt, type
SFC /SCANNOW
and hit the Enter key

Wait for the scan to finish - make a note of any error messages - and then reboot.
Copy the CBS.log file created to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your SkyDrive (http://skydrive.live.com ) and post a link to it so that I can take a look.

Post a new MGADiag report with details of any error messages encountered.

 

[msgerbs]

I ran chkdsk and SFC. cbs.log and both CheckSUR logs are included in the attached zip (I didn't upload it to skydrive because it was small, I hope that's alright.) SFC reported that it found corrupted files that it was unable to fix. I'm not sure what the results of chkdsk were as I wasn't at the computer when it was running. Hopefully that's in CBS.log as well? Or do I need to post some other log?

I'm not sure what you mean by a new MGADiag report. Isn't that a tool for checking if windows is genuine? My copy is genuine, I installed from an iso downloaded from Dreamspark burned to a disk.

FAKE EDIT: Nevermind, I found MGADiag on Microsoft's site. I included the results in the attached zip as well, hopefully that's what you wanted.

 

[NoelDP]

From the CBS.log....

2012-11-14 20:32:28, Info                  CSI    00000444 [SR] Repairing 2 components
2012-11-14 20:32:28, Info                  CSI    00000445 [SR] Beginning Verify and Repair transaction
2012-11-14 20:32:28, Info                  CSI    00000446 Hashes for file member \SystemRoot\WinSxS\amd64_prnca00x.inf_31bf3856ad364e35_6.1.7600.16385_none_e90677c70609283c\Amd64\CNBUR.DLL do not match actual file [l:30{15}]"Amd64\CNBUR.DLL" :
  Found: {l:32 b:Ev8byHjRWrDO8QED+ozGQ9YojVo20LF2WhbnZOWcrQ8=} Expected: {l:32 b:FWhGbLlRSwX3PugmXHUNss8TDg9lEQQ96uj/hLVV8wQ=}
2012-11-14 20:32:28, Info                  CSI    00000447 [SR] Cannot repair member file [l:30{15}]"Amd64\CNBUR.DLL" of prnca00x.inf, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type = [l:24{12}]"driverUpdate", TypeName neutral, PublicKey neutral in the store, hash mismatch
2012-11-14 20:32:28, Info                  CSI    00000448 Hashes for file member \??\C:\Windows\Help\mui\0409\diskmgt.CHM do not match actual file [l:22{11}]"diskmgt.CHM" :
  Found: {l:32 b:Q04+9HaiDEqXWqWfSz15C0O1lwvdzRKc8OPWAuf17T4=} Expected: {l:32 b:Nm0jwXDzPg7+0Wb/lPzZrxe6KthUAbkrG2QotxzpUV8=}
2012-11-14 20:32:28, Info                  CSI    00000449 [SR] Repairing corrupted file [ml:520{260},l:56{28}]"\??\C:\Windows\Help\mui\0409"\[l:22{11}]"diskmgt.CHM" from store
2012-11-14 20:32:28, Info                  CSI    0000044a WARNING: File [l:22{11}]"diskmgt.CHM" in [l:56{28}]"\??\C:\Windows\Help\mui\0409" switching ownership
    Old: Server-Help-CHM.diskmgt.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
    New: Server-Help-CHM.diskm_v.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
2012-11-14 20:32:28, Info                  CSI    0000044b Hashes for file member \SystemRoot\WinSxS\amd64_prnca00x.inf_31bf3856ad364e35_6.1.7600.16385_none_e90677c70609283c\Amd64\CNBUR.DLL do not match actual file [l:30{15}]"Amd64\CNBUR.DLL" :
  Found: {l:32 b:Ev8byHjRWrDO8QED+ozGQ9YojVo20LF2WhbnZOWcrQ8=} Expected: {l:32 b:FWhGbLlRSwX3PugmXHUNss8TDg9lEQQ96uj/hLVV8wQ=}
2012-11-14 20:32:28, Info                  CSI    0000044c [SR] Cannot repair member file [l:30{15}]"Amd64\CNBUR.DLL" of prnca00x.inf, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type = [l:24{12}]"driverUpdate", TypeName neutral, PublicKey neutral in the store, hash mismatch
2012-11-14 20:32:28, Info                  CSI    0000044d [SR] This component was referenced by [l:186{93}]"Microsoft-Windows-Printer-Drivers-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.INF_prnca00x"
2012-11-14 20:32:28, Info                  CSI    0000044e Repair results created:
POQ 132 starts:
     0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\cc34d474d9c2cd018b3d0000700bfc0e._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
    1: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\cc34d474d9c2cd018c3d0000700bfc0e.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps\$$.cdf-ms"
    2: Move File: Source = [l:224{112}]"\SystemRoot\WinSxS\Temp\PendingRenames\cc34d474d9c2cd018d3d0000700bfc0e.$$_help_mui_0409_c7942094fabea651.cdf-ms", Destination = [l:136{68}]"\SystemRoot\WinSxS\FileMaps\$$_help_mui_0409_c7942094fabea651.cdf-ms"
    3: Hard Link File: Source = [l:250{125}]"\SystemRoot\WinSxS\amd64_server-help-chm.diskm_v.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d76955a45e11858c\diskmgt.CHM", Destination = [l:80{40}]"\??\C:\Windows\Help\mui\0409\diskmgt.CHM"
POQ 132 ends.
2012-11-14 20:32:28, Info                  CSI    0000044f [SR] Repair complete

From the MGADiag...

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-*****-*****-JCJTP
Windows Product Key Hash: Jpof6yECiuuDKRYtaxHawmvrzIo=
Windows Product ID: 55041-147-6817625-86596
Windows Product ID Type: 6
Windows License Type: Volume MAK
Windows OS version: 6.1.7600.2.00010100.0.0.048

From where did you acquire your copy of Windows 7 Pro?
It's using a Volume MAK License - which is not generally available to the public.

Please run SFC /SCANNOW once more - there are indications that it may still have work to do.

Is there any reason why you hadn't installed Service Pack 1 long ago - as soon as you installed the OS itself?

 

[msgerbs]

What am I to be looking at from that log excerpt?

I obtained my key from Dreamspark (Actually from the MSDNAA, before it was migrated to Dreamspark). The program gives out unlimited-use(?), single-user license keys for academic/personal use with a whole bunch of "You may not do..." attached to it. It's all legal, if that's your concern.

No, no real reason to not have installed it. I just didn't get around to doing so. I'm not the greatest at keeping up with my updates. I will run SFC again in the morning, shall I upload all of that stuff again, or just the new CBS.log?

 

[NoelDP]

Just the new CBS log, thanks.

I'm aware of the limitations attached to MSDNAA/DreamSpark keys

 

[msgerbs]

I ran SFC 2 additional times, both logs are included in the attached zip, numbered in the order they were run. Both runs said it found corrupt files and was unable to fix some of them.

I'd prefer not to format, but I can try a repair install if you think that will help?

 

[NoelDP]

No-one's even thinking about a reformat yet

As I expected, the same 2 errors are there. I'll see if I can work up a fix for you.

 

[NoelDP]

I've uploaded a file - msgerbs.zip - to my SkyDrive at https://skydrive.live.com/#cid=936736BB8FCEB92F&id=936736BB8FCEB92F%21526
Please download and save it.
Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
This should create a folder C:\msgerbs
Close all windows (it would be a good idea to print these instructions!)
Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.
Pick the option to use a Command Prompt
At the prompt type
DIR C:\msgerbs
hit the enter key - if you get a 'Not Found' error try
DIR D:\msgerbs
or
DIR E:\msgerbs

The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...

XCOPY <drive>:\msgerbs <drive>:\windows\winsxs /y /i /s /v /h

run the command (it should take almost no time)and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.
Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your SkyDrive Public folder, and post a new link
Also run a new MGADiag report, and post the result.

 

[msgerbs]

I did as you instructed. I ran SFC, and the console output said that some corrupted files could not be repaired, but the CBS.log file seems to say otherwise. Either way, CBS.log and MGADiag.txt are attached. I am curious, though, what is so interesting about my MGADiag results? What do you see there that indicated a problem?

 

[NoelDP]

2012-11-16 13:36:05, Info                  CSI    00000332 [SR] Beginning Verify and Repair transaction
2012-11-16 13:36:05, Info                  CSI    00000333 Hashes for file member \??\C:\Windows\Help\mui\0409\diskmgt.CHM do not match actual file [l:22{11}]"diskmgt.CHM" :
  Found: {l:32 b:Nm0jwXDzPg7+0Wb/lPzZrxe6KthUAbkrG2QotxzpUV8=} Expected: {l:32 b:Q04+9HaiDEqXWqWfSz15C0O1lwvdzRKc8OPWAuf17T4=}
2012-11-16 13:36:05, Info                  CSI    00000334 [SR] Repairing corrupted file [ml:520{260},l:56{28}]"\??\C:\Windows\Help\mui\0409"\[l:22{11}]"diskmgt.CHM" from store
2012-11-16 13:36:05, Info                  CSI    00000335 WARNING: File [l:22{11}]"diskmgt.CHM" in [l:56{28}]"\??\C:\Windows\Help\mui\0409" switching ownership
    Old: Server-Help-CHM.diskm_v.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
    New: Server-Help-CHM.diskmgt.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
2012-11-16 13:36:05, Info                  CSI    00000336 Repair results created:
POQ 133 starts:
     0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\598dac9e31c4cd01233b000038101403._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
    1: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\598dac9e31c4cd01243b000038101403.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps\$$.cdf-ms"
    2: Move File: Source = [l:224{112}]"\SystemRoot\WinSxS\Temp\PendingRenames\baeeae9e31c4cd01253b000038101403.$$_help_mui_0409_c7942094fabea651.cdf-ms", Destination = [l:136{68}]"\SystemRoot\WinSxS\FileMaps\$$_help_mui_0409_c7942094fabea651.cdf-ms"
    3: Hard Link File: Source = [l:250{125}]"\SystemRoot\WinSxS\amd64_server-help-chm.diskmgt.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1921e36e58dca6e2\diskmgt.CHM", Destination = [l:80{40}]"\??\C:\Windows\Help\mui\0409\diskmgt.CHM"
POQ 133 ends.
2012-11-16 13:36:05, Info                  CSI    00000337 [SR] Repair complete

is the critical repair operation....
It says 'repairing 2 compnents' - but I can only see one effective repair there.

Please run another SFC /SCANNOW, and post the results, and we'll see if it did repair it or not.

 

[msgerbs]

Windows found corrupt files and successfully repaired them! Yay! Shall I attempt to install SP1 again?

 

[NoelDP]

Might as well

 

[msgerbs]

Aaaaand now we're back to "Windows resource protection found corrupt files but was unable to fix some of them". Dammit. Logs attached, as always. Looks like it's the same damn file even. How many times can one file be fixed and broken again? Why is a help file causing so much trouble? For an add-on feature, no less. That I haven't used in 2+ months. Hell, I thought CHM was outdated in favor in favor of online help anyway?

EDIT: I tried to uninstall the RSAT (Remote Server Administration Toolkit, the source of that annoying little help file) using Turn Windows Features On Or Off and was unsuccessful. I then proceeded to try another SFC (without rebooting during this whole process, probably not best practice...) and lo and behold it said it was successful (And also disabled windows Aero, for some reason...) (Or not. Aero just kicked back in about 3 minutes later). Logs attached as CBS2.zip

 

[NoelDP]

There's obviously something modifying that file every time.
What sort of system tweaking/optimisation tools do you have installed?
What AV are you using?

 

[msgerbs]

The only tweaking tool I have installed is is the AMD Control Center. The only AV I have installed is MSE. Well, I have CPUID HWMonitor, but I haven't run that in months.