Random BSOD's again, this time instantly when I started Skyrim.

[Jmvars]

I've had BSOD's before, they suddenly got fixed, but now I got one again.

I'm not gonna go into much detail as there really isn't much to tell, except that I recently installed the newest Nvidia driver (296.10) the CORRECT way, with safe mode and Driver Sweeper and all.

Minidump attached. I actually analysed it myself with Windows Debugging Tool and it told me it was ntoskrnl.exe that caused it.

EDIT: System specs...

Windows 7 HP 64bit SP1 OEM
MSI GF615M-P33
AMD Athlon II X4 640 @3.0Ghz
Gigabyte GeForce GTX460 768MB @860Mhz
WD Green 1TB HDD
4GB RAM, not sure of brand.
A bit over a year old system I believe.

 

[ePeen]

Hello.

The dump provided is a 1A bugcheck, the culprit is ntkrnlmp.exe which is more than unlikely the cause of the crash, Windows just could not find the faulting driver and pointed to this in return.

Enable Driver Verifier:

Driver Verifier:

Read the following to enable Driver Verifier. Use Driver Second if Memtest finds nothing, as it's likely a software / driver issue, we just aren't being told what it is, and hopefully Driver Verifier will than force a crash if it finds the violating driver.

Before enabling Driver Verifier, my recommendation is to set a backup / restore point as in severe cases Driver Verifier can break your Windows. If you have difficulty getting into Windows, boot into Safe Mode and disable Driver Verifier there.

Drivers that need to be updated:

jswpslwfx.sys - Thu May 15 06:28:50 2008 (Atheros Security NDIS 6.0 Filter Driver (likely a D-Link device). Update here.

Dump for reference:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Icarus\Downloads\032712-18891-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0300a000 PsLoadedModuleList = 0xfffff800`0324e650
Debug session time: Tue Mar 27 16:02:29.566 2012 (UTC - 4:00)
System Uptime: 0 days 1:25:37.800
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41287, 7a8004022a6a, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+45a35 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, The subtype of the bugcheck.
Arg2: 00007a8004022a6a
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41287

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88003516770 -- (.trap 0xfffff88003516770)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=f8a00df832700000
rdx=fffff6fcc0136870 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000318775c rsp=fffff88003516900 rbp=0000000000000000
 r8=0000000000000001  r9=fffff800032bbb00 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po cy
nt!MiLogPageAccess+0xdc:
fffff800`0318775c f6462a02        test    byte ptr [rsi+2Ah],2 ds:00000000`0000002a=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000301b0be to fffff80003086d40

STACK_TEXT:  
fffff880`03516608 fffff800`0301b0be : 00000000`0000001a 00000000`00041287 00007a80`04022a6a 00000000`00000000 : nt!KeBugCheckEx
fffff880`03516610 fffff800`03084e6e : 00000000`00000000 00007a80`04022a6a 00000000`00000000 fffffa80`04056000 : nt! ?? ::FNODOBFM::`string'+0x45a35
fffff880`03516770 fffff800`0318775c : 00000000`00000000 fffffa80`04056000 fffff780`c0000000 00000000`0000beb7 : nt!KiPageFault+0x16e
fffff880`03516900 fffff800`030eb24e : 00000003`00000000 0aa00000`90475921 00000000`00000000 00000000`000098aa : nt!MiLogPageAccess+0xdc
fffff880`03516950 fffff800`03101f85 : fffff800`032bbb00 fffff880`00000001 00000000`00000001 fffff880`03516bb0 : nt! ?? ::FNODOBFM::`string'+0x21e92
fffff880`03516b00 fffff800`03070bf6 : 00000000`00001412 00000000`00000000 fffffa80`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x4cd36
fffff880`03516b80 fffff800`030710ab : 00000000`00000008 fffff880`03516c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03516bd0 fffff800`03320f7a : fffffa80`03b72040 00000000`00000080 fffffa80`03b4d040 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`03516d40 fffff800`030779c6 : fffff880`03163180 fffffa80`03b72040 fffff880`0316dfc0 771d7fab`a9fc3efa : nt!PspSystemThreadStartup+0x5a
fffff880`03516d80 00000000`00000000 : fffff880`03517000 fffff880`03511000 fffff880`03516700 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+45a35
fffff800`0301b0be cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+45a35

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec79dd2

FAILURE_BUCKET_ID:  X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+45a35

BUCKET_ID:  X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+45a35

Followup: MachineOwner
---------

 

[Jmvars]

Hello.

The dump provided is a 1A bugcheck, the culprit is ntkrnlmp.exe which is more than unlikely the cause of the crash, Windows just could not find the faulting driver and pointed to this in return.

Enable Driver Verifier:

Driver Verifier:

Read the following to enable Driver Verifier. Use Driver Second if Memtest finds nothing, as it's likely a software / driver issue, we just aren't being told what it is, and hopefully Driver Verifier will than force a crash if it finds the violating driver.

Before enabling Driver Verifier, my recommendation is to set a backup / restore point as in severe cases Driver Verifier can break your Windows. If you have difficulty getting into Windows, boot into Safe Mode and disable Driver Verifier there.

Drivers that need to be updated:

jswpslwfx.sys - Thu May 15 06:28:50 2008 (Atheros Security NDIS 6.0 Filter Driver (likely a D-Link device). Update here.

Dump for reference:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Icarus\Downloads\032712-18891-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0300a000 PsLoadedModuleList = 0xfffff800`0324e650
Debug session time: Tue Mar 27 16:02:29.566 2012 (UTC - 4:00)
System Uptime: 0 days 1:25:37.800
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41287, 7a8004022a6a, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+45a35 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, The subtype of the bugcheck.
Arg2: 00007a8004022a6a
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41287

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88003516770 -- (.trap 0xfffff88003516770)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=f8a00df832700000
rdx=fffff6fcc0136870 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000318775c rsp=fffff88003516900 rbp=0000000000000000
 r8=0000000000000001  r9=fffff800032bbb00 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po cy
nt!MiLogPageAccess+0xdc:
fffff800`0318775c f6462a02        test    byte ptr [rsi+2Ah],2 ds:00000000`0000002a=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000301b0be to fffff80003086d40

STACK_TEXT:  
fffff880`03516608 fffff800`0301b0be : 00000000`0000001a 00000000`00041287 00007a80`04022a6a 00000000`00000000 : nt!KeBugCheckEx
fffff880`03516610 fffff800`03084e6e : 00000000`00000000 00007a80`04022a6a 00000000`00000000 fffffa80`04056000 : nt! ?? ::FNODOBFM::`string'+0x45a35
fffff880`03516770 fffff800`0318775c : 00000000`00000000 fffffa80`04056000 fffff780`c0000000 00000000`0000beb7 : nt!KiPageFault+0x16e
fffff880`03516900 fffff800`030eb24e : 00000003`00000000 0aa00000`90475921 00000000`00000000 00000000`000098aa : nt!MiLogPageAccess+0xdc
fffff880`03516950 fffff800`03101f85 : fffff800`032bbb00 fffff880`00000001 00000000`00000001 fffff880`03516bb0 : nt! ?? ::FNODOBFM::`string'+0x21e92
fffff880`03516b00 fffff800`03070bf6 : 00000000`00001412 00000000`00000000 fffffa80`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x4cd36
fffff880`03516b80 fffff800`030710ab : 00000000`00000008 fffff880`03516c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03516bd0 fffff800`03320f7a : fffffa80`03b72040 00000000`00000080 fffffa80`03b4d040 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`03516d40 fffff800`030779c6 : fffff880`03163180 fffffa80`03b72040 fffff880`0316dfc0 771d7fab`a9fc3efa : nt!PspSystemThreadStartup+0x5a
fffff880`03516d80 00000000`00000000 : fffff880`03517000 fffff880`03511000 fffff880`03516700 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+45a35
fffff800`0301b0be cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+45a35

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec79dd2

FAILURE_BUCKET_ID:  X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+45a35

BUCKET_ID:  X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+45a35

Followup: MachineOwner
---------

Thank you for a detailed reply. But about the D-Link device, the only D-Link device I have, (or had) is a Wireless LAN card that I removed mainly because I now have a cable and have no need for it, but also because it sucked, ALOT. Should I remove all D-Link drivers with Driver Sweeper?

 

[ePeen]

yes, go ahead

 

[Jmvars]

yes, go ahead

And about the Driver Verifier again. I don't have a possibility to backup my Windows, should I take the risk?

 

[ePeen]

It usually never corrupts Windows, but there are those very rare occasions when it does. I just include that as a precaution method for people who care about those things.

 

[Jmvars]

It usually never corrupts Windows, but there are those very rare occasions when it does. I just include that as a precaution method for people who care about those things.

But is it possible to easily restore Windows if I really am unlucky enough that it corrupts Windows?

 

[ePeen]

With every BSOD, there is a chance of data corruption, because your system is literally going "Nope, stop, look at this driver causing problems". Sometimes, it catches it when it can write to the memory, so you don't lose anything, but sometimes it will not and you will lose everything that wasn't saved.

I really wouldn't lose sleep over it, you will be fine with enabling it.

 

[Jmvars]

With every BSOD, there is a chance of data corruption, because your system is literally going "Nope, stop, look at this driver causing problems". Sometimes, it catches it when it can write to the memory, so you don't lose anything, but sometimes it will not and you will lose everything that wasn't saved.

I really wouldn't lose sleep over it, you will be fine with enabling it.

Cool I'll do it then! So I will have to expect more BSOD's because we are trying to provoke them, amirite?

Also, recently when I got home from school, I almost got a BSOD a few minutes after login. This has happened before, I just heard a small noise, like a loud electric shock, and everything just froze for half a second. After that PC was extremely slow, until I had enough and pressed the reset button.

 

[ePeen]

Was this BSOD experienced after enabling Driver Verifier? If it was, attach the dump file for that BSOD.

To answer your question, in theory Driver Verifier should cause a system to BSOD much more frequently than it regularly would because regularly the faulting driver is not being stressed or accessed at the time, it's a very random process. For example, if your culprit happens to be a program that runs off of start up on the system tray, like a mounting program, or a mouse driver control panel, etc... when Windows loads, it should in theory right there force the BSOD and show the culprit, which it has done for me and others I have helped diagnose in the past plenty of times.

However, some can go a day or so without Driver Verifier forcing a BSOD as it depends on the driver fault itself.

 

[Jmvars]

Was this BSOD experienced after enabling Driver Verifier? If it was, attach the dump file for that BSOD.

To answer your question, in theory Driver Verifier should cause a system to BSOD much more frequently than it regularly would because regularly the faulting driver is not being stressed or accessed at the time, it's a very random process. For example, if your culprit happens to be a program that runs off of start up on the system tray, like a mounting program, or a mouse driver control panel, etc... when Windows loads, it should in theory right there force the BSOD and show the culprit, which it has done for me and others I have helped diagnose in the past plenty of times.

However, some can go a day or so without Driver Verifier forcing a BSOD as it depends on the driver fault itself.

No it wasn't when Driver Verifier was enabled. After my next reboot however, it will be enabled. We will see then.

 

[ePeen]

Alrighty

 

[Jmvars]

Alrighty

My computer got a BSOD while I were in school, and it did not write a minidump. However it did say in the bluescreen that the cause was "SmartDefragDriver.sys"

It's a defrag program I have installed. So I guess this is the cause then?

 

[ePeen]

Could possibly be, yes. Uninstall it and see.

 

[Jmvars]

I don't know anymore. It happened again but it wasn't a BSOD, the screen turned pink (PSOD lol). I immediately suspected hardware failure this time. I checked, and it did write a dump, so I analysed it. The dump also said hardware but I'm not sure anymore. Can a driver cause hardware to crash?

I had played FSX, but it crashed. Then I just watched a youtube video and within seconds, BOOM, pink screen.

 

[ePeen]

May I see the latest dump?

 

[Jmvars]

May I see the latest dump?

Here you go.

 

[ePeen]

Latest dump is a 124 hardware bugcheck.

**Stop all overclocking and return to stock clocks if you're overclocking.

Memtest:

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Read the following to test your memory for errors.

Dump for reference:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Icarus\Downloads\040712-37830-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`03063000 PsLoadedModuleList = 0xfffff800`032a7650
Debug session time: Fri Apr  6 23:54:48.672 2012 (UTC - 4:00)
System Uptime: 0 days 0:00:10.296
Loading Kernel Symbols
..................................................
Loading User Symbols
Mini Kernel Dump does not contain unloaded driver list
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 124, {0, fffffa800544b8f8, 0, 0}

Probably caused by : hardware

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 0000000000000000, Machine Check Exception
Arg2: fffffa800544b8f8, Address of the WHEA_ERROR_RECORD structure.
Arg3: 0000000000000000, High order 32-bits of the MCi_STATUS value.
Arg4: 0000000000000000, Low order 32-bits of the MCi_STATUS value.

Debugging Details:
------------------


BUGCHECK_STR:  0x124_AuthenticAMD

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`031a86f0 fffff800`03324cb9 : fffffa80`0544b8d0 fffffa80`03b7ab60 00000000`00000010 00000000`00000000 : nt!WheapCreateLiveTriageDump+0x6c
fffff880`031a8c10 fffff800`03205687 : fffffa80`0544b8d0 fffff800`0327f2b8 fffffa80`03b7ab60 00000000`00000000 : nt!WheapCreateTriageDumpFromPreviousSession+0x49
fffff880`031a8c40 fffff800`0316ca35 : fffff800`032e0ac0 00000000`00000001 fffffa80`054d01e0 fffffa80`03b7ab60 : nt!WheapProcessWorkQueueItem+0x57
fffff880`031a8c80 fffff800`030e9471 : fffff880`011bbe00 fffff800`0316ca10 fffffa80`03b7ab00 00000000`00000000 : nt!WheapWorkQueueWorkerRoutine+0x25
fffff880`031a8cb0 fffff800`03379f7a : 00000000`00000000 fffffa80`03b7ab60 00000000`00000080 fffffa80`03b67040 : nt!ExpWorkerThread+0x111
fffff880`031a8d40 fffff800`030d09c6 : fffff880`02f63180 fffffa80`03b7ab60 fffff880`02f6dfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`031a8d80 00000000`00000000 : fffff880`031a9000 fffff880`031a3000 fffff880`02e97410 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: hardware

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  X64_0x124_AuthenticAMD_PROCESSOR_BUS_PRV

BUCKET_ID:  X64_0x124_AuthenticAMD_PROCESSOR_BUS_PRV

Followup: MachineOwner
---------

 

[Jmvars]

I am currently overclocking, and will return to standard clocks then... Thank you.

Will the memtest take long?

EDIT: I'm confused... I installed the Memtest on my 256MB USB stick I had lying around. An error came up saying it won't be able to boot but everything else says it WILL boot...

 

[ePeen]

Don't know. They provide a USB key installer that does everything for you, so there shouldn't be an issue.