random BSOD's/game freezes. certain hardware/graphic card related

[fezbombmatt]

Hi.

PC is 3/4 years old with new PSU and HDD in use.
PC was fine after new hardware install.

Had my graphics card OCed for a while (1 year) and had no problems with gaming until about 1 month ago
to which i started getting freezes playing World of warcraft.

I have stopped OCing but this hasnt effected anything.
These freezees still occur in game only but BSOD's happen randomly no matter what.

These BSOD's have only just started.

I haven't ran any tests yet as i wanted to ask for your opinion first with my crash result.

Updated my ATI drivers but had no effect.

Thanks in advance.

 

[fezbombmatt]

I have attached my report but i cannot see it in my post. should i be able to see it?

 

[fezbombmatt]

Never mind lol

 

[fezbombmatt]

Just happened again. this file should be better it is a complete dump.

Unsure why the size is alot smaller though..

 

[fezbombmatt]

bump

 

[fezbombmatt]

bump

 

[fezbombmatt]

I have ran Furmark up to 56C degrees which is hotter than its ever bin and i see no artifacts. Had a random fail to start today.

 

[fezbombmatt]

Just ran memtest86, did all 11 tests and no errors. Im not sure what else to test now.

 

[fezbombmatt]

Ive ran Prime95 for about 2 hours on blend test and it was fine. got to 45C max temp wouldnt go higher.

Could somebody help?

 

[fezbombmatt]

Bump

 

[fezbombmatt]

bump.. anyone?

 

[x BlueRobot]

Sorry no one has been able to reply to your thread, but please do not thread bump since it gives the false illusion that your receiving help. The post count will be increasing, so it looks like your already getting help.

 

[x BlueRobot]

[COLOR="Red"]BugCheck 24[/COLOR], {1904fb, [COLOR="Blue"]fffff880091d7948[/COLOR], [COLOR="Orange"]fffff880091d71a0[/COLOR], fffff880014de760}

Probably caused by : Ntfs.sys ( Ntfs!NtfsOpenAttributeInExistingFile+0 )

0: kd> [COLOR="SeaGreen"].cxr 0xfffff880091d71a0[/COLOR]
rax=0000000000000002 rbx=fffff8a00f86f948 rcx=fffffa8009cdae40
rdx=fffffa800adf4820 rsi=0000000000000000 rdi=fffff88006c9b4d0
rip=fffff880014de760 rsp=fffff880091d7b88 rbp=0000000000000000
 r8=fffff8a00f86f948  [COLOR="Red"]r9=00000000000000aa[/COLOR] r10=fffffa8009cdae40
r11=0000000000000000 r12=0000000000000080 r13=fffff880091d7ea0
r14=fffffa8009cdae40 r15=00000000000000aa
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
Ntfs!NtfsOpenAttributeInExistingFile:
fffff880`014de760 44894c2420      mov     dword ptr [rsp+20h],r9d ss:0018:fffff880`091d7ba8=d0b4c906

fffff880091d7948 -- ([COLOR="SeaGreen"].exr 0xfffff880091d7948[/COLOR])
ExceptionAddress: fffff880014de760 (Ntfs!NtfsOpenAttributeInExistingFile)
   ExceptionCode: [COLOR="Red"]c0000005 (Access violation)[/COLOR]
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001 <<< Write Operation
   Parameter[1]: 0000000000000020 <<< Non-Paged Pool
Attempt to write to address 0000000000000020

0: kd> knL
  *** Stack trace for last set context - .thread/.cxr resets it
 # Child-SP          RetAddr           Call Site
00 fffff880`091d7b88 fffff880`014e1f6f [COLOR="Red"]Ntfs!NtfsOpenAttributeInExistingFile[/COLOR] 
01 fffff880`091d7b90 fffff880`014f1f56 Ntfs!NtfsOpenExistingPrefixFcb+0x1ef
02 fffff880`091d7c80 fffff880`014ef701 Ntfs!NtfsFindStartingNode+0x5e6
03 fffff880`091d7d50 fffff880`0145940d Ntfs!NtfsCommonCreate+0x3e1
04 fffff880`091d7f30 fffff800`02c866b7 Ntfs!NtfsCommonCreateCallout+0x1d
05 fffff880`091d7f60 fffff800`02c86678 nt!KxSwitchKernelStackCallout+0x27
06 fffff880`06c9b310 00000000`00000000 nt!KiSwitchKernelStackContinue

Ntfs!NtfsOpenAttributeInExistingFile is not widely documented, however, I'm assuming it relates more to a Stream Type rather than a file attribute. I'm guessing it may be opening a another stream type for a already existing file stream.

Anyhow, it seems to have been using a null pointer.

0: kd> [COLOR="SeaGreen"]u Ntfs!NtfsOpenAttributeInExistingFile[/COLOR]
Ntfs!NtfsOpenAttributeInExistingFile:
fffff880`014de760 44894c2420      mov     dword ptr [rsp+20h],r9d
fffff880`014de765 4c89442418      mov     qword ptr [rsp+18h],r8
fffff880`014de76a 4889542410      mov     qword ptr [rsp+10h],rdx
fffff880`014de76f 48894c2408      mov     qword ptr [rsp+8],rcx
fffff880`014de774 53              push    rbx
fffff880`014de775 56              push    rsi
fffff880`014de776 57              push    rdi
fffff880`014de777 4154            push    r12

0: kd> [COLOR="SeaGreen"]lmvm BHDrvx64[/COLOR]

start             end                 module name
fffff880`04269000 fffff880`043e1000   BHDrvx64 T (no symbols)           
    Loaded symbol image file: BHDrvx64.sys
    Image path: \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.0.36\Definitions\BASHDefs\20131114.001\BHDrvx64.sys
    Image name: BHDrvx64.sys
    Timestamp:        [COLOR="Red"]Thu Oct 17 09:36:38 2013[/COLOR] (525FA196)
    CheckSum:         0017B4A4
    ImageSize:        00178000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your Symantec Heuristics Driver seems to be causing problems, please remove Norton for at least troubleshooting purposes with the Norton Removal Tool, and use this free security combination.

 

[fezbombmatt]

Thanks for the reply, which free combination do you suggest?

 

[x BlueRobot]

Sorry I forgot to add it

Install:

• Malwarebytes : Free anti-malware download
• Microsoft Security Essentials | Protect against viruses, spyware, and other malware

   Information

Remember to install the free version of Malwarebytes not the free trail; untick the free trial box during installation. MSE is the most lightweight and compatible with the Windows 7 operating system

You can also view this thread for a complete free and lightweight security protection combination:

• http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

 

[fezbombmatt]

Thank you, i already had Malwarebytes. So i used Norton remover tool, restarted and installed MSE. Restarted and started using normally.

BSOD again while a MSE scan was in background and i was viewing webpages while it happened.

 

[x BlueRobot]

[COLOR="Red"]BugCheck A[/COLOR], {[COLOR="SeaGreen"]fffffa800cec0720[/COLOR], 2, 1, fffff80002c5bd4e}

Probably caused by : ntkrnlmp.exe ( nt!ExDeleteResourceLite+ce )

0: kd> [COLOR="SeaGreen"]knL[/COLOR]
 # Child-SP          RetAddr           Call Site
00 fffff880`02fb05f8 fffff800`02c7e169 nt!KeBugCheckEx
01 fffff880`02fb0600 fffff800`02c7cde0 nt!KiBugCheckDispatch+0x69
02 fffff880`02fb0740 fffff800`02c5bd4e nt!KiPageFault+0x260
03 fffff880`02fb08d0 fffff880`01252cdf [COLOR="Red"]nt!ExDeleteResourceLite[/COLOR]+0xce <<< Wrong IRQL Level
04 fffff880`02fb0930 fffff880`012d51ae Ntfs!NtfsFreeNonpagedDataFcb+0x13
05 fffff880`02fb0960 fffff880`012527a2 Ntfs!NtfsDeleteFcb+0x3be
06 fffff880`02fb09c0 fffff880`012d761c Ntfs!NtfsTeardownFromLcb+0x1e2
07 fffff880`02fb0a50 fffff880`01259ab2 Ntfs!NtfsTeardownStructures+0xcc
08 fffff880`02fb0ad0 fffff880`012e6f93 Ntfs!NtfsDecrementCloseCounts+0xa2
09 fffff880`02fb0b10 fffff880`012d632b Ntfs!NtfsCommonClose+0x353
0a fffff880`02fb0be0 fffff800`02c88261 Ntfs!NtfsFspClose+0x15f
0b fffff880`02fb0cb0 fffff800`02f1b2ea nt!ExpWorkerThread+0x111
0c fffff880`02fb0d40 fffff800`02c6f8e6 nt!PspSystemThreadStartup+0x5a
0d fffff880`02fb0d80 00000000`00000000 nt!KxStartSystemThread+0x16

The problem lies with the nt!ExDeleteResourceLite function, which deletes a resource from the system resource list. The function should only be called IRQL Level 1 or lower.

0: kd> [COLOR="SeaGreen"]!irql[/COLOR]
Debugger saved IRQL for processor 0x0 -- 2 (DISPATCH_LEVEL)

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

 

[fezbombmatt]

Had verifier on pretty much since your post, nothing has happened. However the PC has spend 80% of the time idle as ive been work, sleep etc.

Ive left it running still.

 

[x BlueRobot]

Leave it for another day, and try to use the computer. Sometimes it may take multiple runs to find a problematic driver.

 

[fezbombmatt]

Still running now, its still had to be idle but ive left it doing scans stc and still no error.

I was on my game last night and it was fine, game performance suffers a little while using this Verifier. But i havent had a freeze either.