BSOD Playing Skyrim - And During Other Random Events

[Mouzi]

Hi, Have recently had a few issues with BSOD's, The most recent one playing Skyrim. Other times from simple things as exiting Windows Media Player, Or just browsing the internet, I've tried following instructions for posting here, Hopefully I've got them correct.

Hopefully someone here could shed some light on why this is happening ,I've done a fair bit of reading and can't seem to find anything.

Thanks in advance, Mouzi.

Is Windows 7 . . .
- x86 (32-bit) or x64 ? 64 Bit
- the original installed OS on the system? Yes
- an OEM or full retail version? OEM

- What is the age of system (hardware)? Under 3 months.
- What is the age of OS installation (have you re-installed the OS?) 3 days, Recently re-installed BSOD before and after install.


View attachment 200882

 

[Mouzi]

Shameless self bump out of desperation
Can anyone look at the logs and tell me which driver is causing this?

 

[Mouzi]

If there is any more information you need just ask!

 

[zigzag3143]

No DMP included in upload

We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

If you are overclocking STOP

You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.
*If the files are too large please upload them to a file sharing service like "Rapidshare" and put a link to them in your reply.

To ensure minidumps are enabled:

* Go to Start, in the Search Box type: sysdm.cpl, press Enter.
* Under the Advanced tab, click on the Startup and Recovery Settings... button.
* Ensure that Automatically restart is unchecked.
* Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
* Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
* OK your way out.
* Reboot if changes have been made.

 

[Mouzi]

Sorry I thought i had all the files attatched.
The .dmp file gives me an error when i attempt to zip it.
"File not found or no read permission"

What should I do?

 

[Mouzi]

View attachment 200910

I hope this works, I made a copy of the dmp file, then zipped that.

Thanks.

 

[zigzag3143]

Sorry I thought i had all the files attatched.
The .dmp file gives me an error when i attempt to zip it.
"File not found or no read permission"

What should I do?

Did you drag it to the desktop and zip it there?

 

[Mouzi]

No I made a copy and zipped that one in my documents

It's attatched to a post above

Thanks

 

[zigzag3143]

Sorry but no DMP files included in the upload. Try it again

 

[Mouzi]

View attachment 200911

Dragged the DMP to desktop, zipped it.

Work this time?

 

[Mouzi]

Any luck ;/ ?

 

[writhziden]

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\Mouzi\030212-9157-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e4c000 PsLoadedModuleList = 0xfffff800`03091670
Debug session time: Thu Mar  1 08:58:41.348 2012 (UTC - 7:00)
System Uptime: 0 days 1:40:19.581
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa80194097e8, 0, fffff80002e9942b, 2}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiDeleteAddressesInWorkingSet+27f )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80194097e8, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002e9942b, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030fb100
 fffffa80194097e8 

FAULTING_IP: 
nt!MiDeleteAddressesInWorkingSet+27f
fffff800`02e9942b 488b4128        mov     rax,qword ptr [rcx+28h]

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  TESV.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88009039d60 -- (.trap 0xfffff88009039d60)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000058000000000 rbx=0000000000000000 rcx=fffffa80194097c0
rdx=0000000049b31009 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e9942b rsp=fffff88009039ef0 rbp=fffff700011403a0
 r8=fffffa80072b4d78  r9=0000000000000000 r10=0000000000014a1f
r11=fffff70001080000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!MiDeleteAddressesInWorkingSet+0x27f:
fffff800`02e9942b 488b4128        mov     rax,qword ptr [rcx+28h] ds:7180:fffffa80`194097e8=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e733f0 to fffff80002ec8c40

STACK_TEXT:  
fffff880`09039bf8 fffff800`02e733f0 : 00000000`00000050 fffffa80`194097e8 00000000`00000000 fffff880`09039d60 : nt!KeBugCheckEx
fffff880`09039c00 fffff800`02ec6d6e : 00000000`00000000 fffffa80`194097e8 00000000`49b02000 7e300008`6add4867 : nt! ?? ::FNODOBFM::`string'+0x447c6
fffff880`09039d60 fffff800`02e9942b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`09039ef0 fffff800`02e9a596 : fffffa80`072b49e0 fffffa80`00000006 fffff880`00014a1f fffff800`00000006 : nt!MiDeleteAddressesInWorkingSet+0x27f
fffff880`0903a7a0 fffff800`0319eb1a : fffff8a0`07a00060 fffff880`0903aae0 00000000`00000000 fffffa80`08e5d7c0 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0903a7f0 fffff800`0318209d : 00000000`c0000005 00000000`c0000001 00000000`fff86000 fffffa80`07286b60 : nt!PspExitThread+0x56a
fffff880`0903a8f0 fffff800`02ebc3fa : 00000000`00000100 fffffa80`08e5d880 00000000`00000001 fffff800`02ece13d : nt!PsExitSpecialApc+0x1d
fffff880`0903a920 fffff800`02ebc740 : 00000000`00000246 fffff880`0903a9a0 fffff800`03182010 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`0903a9a0 fffff800`02ec7f77 : fffffa80`08e5d7c0 00000000`00000410 00000000`00000000 fffffa80`076974f0 : nt!KiInitiateUserApc+0x70
fffff880`0903aae0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiDeleteAddressesInWorkingSet+27f
fffff800`02e9942b 488b4128        mov     rax,qword ptr [rcx+28h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiDeleteAddressesInWorkingSet+27f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x50_nt!MiDeleteAddressesInWorkingSet+27f

BUCKET_ID:  X64_0x50_nt!MiDeleteAddressesInWorkingSet+27f

Followup: MachineOwner
---------

Happened while playing Skyrim. Possible causes are Memory problems... Graphics card memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Missing Windows Updates... Drivers...
Thanks to Dave76 for help understanding possible causes.



Run through the following steps:

• If you are overclocking any hardware, please stop.
  
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
  If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
  Once these steps have been followed, it is safe to remove and replace components within your computer.
  
  
  
• An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
  
  a. Backup your system and user files
  b. Create a system restore point
  c. If you do not have a Windows 7 DVD, Create a system repair disc
  d. Run Driver Verifier
  
  If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using http://www.sevenforums.com/tutorials/700-system-restore.html OPTION TWO.
  
  Thanks to zigzag3143 for contributing to the Verifier steps.
  If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.​
  The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.

 

[Mouzi]

So it could be faulty HDD? or Faulty Ram?

 

[writhziden]

Nothing points to a hard drive. That is just one of the possibilities of that type of crash. The main two likely culprits of the memory corruption being blamed as the probable cause are faulty RAM or a driver that is accessing RAM in a way it should not. That is why the two steps were outlined in my post for you to follow.

Disabling any overclocking is requested to remove that as a possible cause of instability.

 

[Mouzi]

Yeah I don't overclock at all, I'll be really sad if it's my ram, I bought really nice Corsair ram

I'll give memtest a go and suss it out, if its a driver accessing it in a way it should not be whats the best way to determine which driver?

 

[writhziden]

The steps to run Verifier will root out which driver. By turning Verifier for all non-Microsoft drivers, your system will be forced into a state that causes driver conflicts to become apparent through blue screen crashes. That way, any crash reports generated will point to driver conflicts, and we can analyze them to determine which drivers are conflicting.

 

[Mouzi]

Yeah i have that on atm for all non windows related drivers. so next BSOD hopefully can narrow it down i'll run memtest and get back to you.

thanks so much for your help.

 

[zigzag3143]

Might also want to check with Skyrim's developers as it appears there are a lot of issues with it in win 7

 

[writhziden]

Any luck with Verifier? Did you have any more crashes to analyze?