[SOLVED] Several BSODs, PC problems - Windows 8.1 x64

Lucas · Jun 26, 2015

Hello,

At first I would like to apologize for my poor english, but I hope that you will understand me. Okay, so about 1 week ago, my power supply broken so I was forced to buy new one. Everything was great till today. I got several BSODs, some artifacts appeared on my screen, PC restarted like 3 or 4 times etc.

BSODs:

- KERNEL_SECURITY_CHECK_FAILURE
- BAD_POOL_HEADER
- SYSTEM_EXCEPTION_NOT_HANDLED cdd.dll
- SYSTEM_EXCEPTION_NOT_HANDLED dgmms1.sys
- KMODE_EXCEPTION_NOT_HANDLED

Information about my PC:

Read More:

What I did to check what's going on:

- ADWCleaner Scan (5 entries, nothing special)
- HD Tune Scan (Status: OK, Error Log: 0.0% errors)
- MalwareBytes Scan (clean)
- Windows Defender Scan (clean)

I'm attaching 2 files.

View attachment EPHIN_20150626-000004.rar
View attachment 13740

I have some screenshots from CPU-Z, Memory and SPD. I had to change voltages in Bios because my PC couldn't work with default ones.

CPU-Z "SPD" - screenSHU - The fastest screen capture ever.
CPU-Z "Memory" - screenSHU - The fastest screen capture ever.

Also now, while writing this post, I have some artifacts on this page. I want to perform the Memtest but I'm not sure if I will be able to enter the Windows again.
All started while playing game, just crashed once, then second one with BSOD, then again without it. I'm not sure what's going on.

One thing more: I have Nvidia Drivers from 4th of February, but I see that the latest one is from 24th of February (but it has the same signature and serial number).
I think I will try to install them IF my system will work.

Patrick · Jun 26, 2015

Your English is just fine.

Code:

1: kd> .bugcheck
Bugcheck code 00000019
Arguments 00000000`0000000e ffffc001`2d6e92d0 ff101010`ff101010 2f022958`1f88390c

Code:

1: kd> !poolval ffffc0012d6e92d0
Pool page ffffc0012d6e92d0 region is Unknown

Validating Pool headers for pool page: ffffc0012d6e92d0

Pool page [ ffffc0012d6e9000 ] is __inVALID.

Analyzing linked list...
[ ffffc0012d6e9610 ]: invalid previous size [ 0xc ] should be [ 0x10 ]


Scanning for single bit errors...
[ ffffc0012d6e9000 ]: previous size [ 0x10 ] should be [ 0x0 ]
[ ffffc0012d6e9550 ]: block size [ 0x10 ] should be [ 0xc ]

Code:

1: kd> knL
 # Child-SP          RetAddr           Call Site
00 ffffd001`0d44d768 fffff800`cf4a86b2 nt!KeBugCheckEx
01 ffffd001`0d44d770 fffff800`cf63015a nt!ExAllocatePoolWithTag+0x17c2
02 ffffd001`0d44d840 fffff800`cf622004 nt!SepCreateImpersonationTokenDacl+0xbe
03 ffffd001`0d44d8a0 fffff800`cf6218bd nt!NtOpenThreadTokenEx+0x734
04 ffffd001`0d44dbc0 fffff800`cf35f4b3 nt!NtOpenThreadToken+0x11
05 ffffd001`0d44dc00 00007ffe`55da140a nt!KiSystemServiceCopyEnd+0x13
06 0000004e`90cfe728 00000000`00000000 0x00007ffe`55da140a

Given we're experiencing pool corruption from NT system functions, I'm going to say you're on the right track with Memtest being a good step to take. Give eight passes a go.

Memtest86+:

Download Memtest86+ here:

Memtest86+ - Advanced Memory Diagnostic Tool

Which should I download?

You can either download the pre-compiled .ISO that you would burn to a CD and then boot from the CD, or you can download the auto-installer for the USB key. What this will do is format your USB drive, make it a bootable device, and then install the necessary files. Both do the same job, it's just up to you which you choose, or which you have available (whether it's CD or USB).

Do note that some older generation motherboards do not support USB-based booting, therefore your only option is CD (or Floppy if you really wanted to).

How Memtest works (you don't need to read, it's only for those interested in the specifics):

Memtest uses algorithms (specifically two), namely moving inversion & what is deemed Modulo-X. Essentially, the first algorithm fills the memory with a pattern. Starting at the low address, it checks to see if the pattern was changed (it should not have been), writes the patterns complement, increments the address, and repeats. Starting at the highest address (as opposed to the lowest), it follows the same checklist.

The reason for the second algorithm is due to a few limitations, with the first being that not all adjacent cells are being tested for interaction due to modern chips being 4 to 16 bits wide regarding data storage. With that said, patterns are used to go ahead and ensure that all adjacent cells have at least been written with all possible one and zero combinations.

The second is that caching, buffering and out of order execution will interfere with the moving inversions algorithm. However, the second algorithm used is not affected by this. For starting offsets of 0-20, the algorithm will write every 20th location with a pattern, write all other locations with the patterns complement, repeat the previous one (or more) times, and then check every 20th location for the previously mentioned pattern.

Now that you know how Memtest actually works, it's important to know that the tests it goes through all mean something different. It goes from Test 0 through Test 12, many of which use either one or the other algorithm discussed above, among many other things.

Any other questions, they can most likely be answered by reading this great guide here:

FAQ : please read before posting

Lucas · Jun 26, 2015

Thank you, Patrick!

I have Memtest on my DVD-RW already. I heard that Memtest scan is a long process, so I think I will perform it tomorrow (it's 11 pm here) and I will tell you the results.
I forgot to mention that I also sheduled the Windows Diagnostic Process and some Memory Diagnostic Process after restarting the PC. I think I will restart it now to check if I'll be able to access the Windows. In case of some critical error, I have smartphone so I will be able to read your posts here and write anyway.

Patrick · Jun 27, 2015

I have Memtest on my DVD-RW already. I heard that Memtest scan is a long process, so I think I will perform it tomorrow (it's 11 pm here) and I will tell you the results.

You can run it overnight, that's what a lot of people do. It's not a test you need to be there for. If there are errors, it'll just keep going.

Lucas · Jun 27, 2015

I ran Memtest+ today: 8 passes, 0 errors. Test last for about 11 hours. Then I have a huge problems with accessing to the Windows (it was loading, but then, before Windows Login page, it restarted my pc twice). I ran also Windows Memory Diagnostic Tool yesterday - everything seemed to be in order.

I decided to use Windows Refresh option (using Windows Installation Disc). It deleted a lot of applications and restored my NVIDIA Drivers to 340.52 Version from 2014-08-09. I'm not sure if it repaired anything because I'm still testing.

Should I run some other diagnostic application now?

Patrick · Jun 27, 2015

Verifier would be good:

Driver Verifier:

What is Driver Verifier?

Driver Verifier monitors Windows kernel-mode drivers, graphics drivers, and even 3rd party drivers to detect illegal function calls or actions that might corrupt the system. Driver Verifier can subject the Windows drivers to a variety of stresses and tests to find improper behavior.

Essentially, if there's a 3rd party driver believed to be causing the issues at hand, enabling Driver Verifier will help us see which specific driver is causing the problem.

Before enabling Driver Verifier, it is recommended to create a System Restore Point:

Vista - START | type rstrui - create a restore point
Windows 7 - START | type create | select "Create a Restore Point"
Windows 8/8.1 - Restore Point - Create in Windows 8

How to enable Driver Verifier:

Start > type "verifier" without the quotes > Select the following options -

1. Select - "Create custom settings (for code developers)"
2. Select - "Select individual settings from a full list"
3. Check the following boxes -
- Special Pool
- Pool Tracking
- Force IRQL Checking
- Deadlock Detection
- Security Checks (only on Windows 7 & 8/8.1)
- DDI compliance checking (only on Windows 8/8.1)
- Miscellaneous Checks
4. Select - "Select driver names from a list"
5. Click on the "Provider" tab. This will sort all of the drivers by the provider.
6. Check EVERY box that is NOT provided by Microsoft / Microsoft Corporation.
7. Click on Finish.
8. Restart.

Important information regarding Driver Verifier:

- Perhaps the most important which I will now clarify as this has been misunderstood often, enabling Driver Verifier by itself is not! a solution, but instead a diagnostic utility. It will tell us if a driver is causing your issues, but again it will not outright solve your issues.

- If Driver Verifier finds a violation, the system will BSOD. To expand on this a bit more for the interested, specifically what Driver Verifier actually does is it looks for any driver making illegal function calls, causing memory leaks, etc. When and/if this happens, system corruption occurs if allowed to continue. When Driver Verifier is enabled per my instructions above, it is monitoring all 3rd party drivers (as we have it set that way) and when it catches a driver attempting to do this, it will quickly flag that driver as being a troublemaker, and bring down the system safely before any corruption can occur.

- After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will detect it in violation almost straight away, and as stated above, that will cause / force a BSOD.

If this happens, do not panic, do the following:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > Search > type "cmd" without the quotes.

- To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.

- Restart and boot into normal Windows.

If your OS became corrupt or you cannot boot into Windows after disabling verifier via Safe Mode:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > type "system restore" without the quotes.

- Choose the restore point you created earlier.

-- Note that Safe Mode for Windows 8/8.1 is a bit different, and you may need to try different methods: 5 Ways to Boot into Safe Mode in Windows 8 & Windows 8.1

How long should I keep Driver Verifier enabled for?

I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier. I will usually say whether or not I'd like for you to keep it enabled any longer.

My system BSOD'd with Driver Verifier enabled, where can I find the crash dumps?

- If you have the system set to generate Small Memory Dumps, they will be located in %systemroot%\Minidump.

- If you have the system set to generate Kernel Memory Dumps, it will be located in %systemroot% and labeled MEMORY.DMP.

Any other questions can most likely be answered by this article:

Using Driver Verifier to identify issues with Windows drivers for advanced users

Lucas · Jun 27, 2015

I just enabled the Driver Verifier, restarted the pc. When I tried to login here, my screen started "crashing", and after that (2-3 seconds) PC restarted itself.
I'm very afraid that is a mechanical problem with graphics card..

There aren't any Dump files at systemroot, I can't even see the Minidump folder.

// I also would like to add that about one week ago I had to buy new Power Supply, because my old one caused electrical short circuit.
I had OCZ ModXStream 600W, now I have Thermaltake Smart SE 540w

Patrick · Jun 27, 2015

1. Start > type %systemroot% which should show the Windows folder, click on it. Once inside that folder, ensure there is a Minidump folder created. If not, CTRL-SHIFT-N to make a New Folder and name it Minidump.

2. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Performance > Settings > Advanced > Ensure there's a check-mark for 'Automatically manage paging file size for all drives'.

3. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Startup and Recovery > Settings > System Failure > ensure there is a check mark next to 'Write an event to the system log'.

Ensure Small Memory Dump is selected and ensure the path is %systemroot%\Minidump.

4. Double check that the WERS is ENABLED:

Start > Search > type services.msc > Under the name tab, find Windows Error Reporting Service > If the status of the service is not Started then right click it and select Start. Also ensure that under Startup Type it is set to Automatic rather than Manual. You can do this by right clicking it, selecting properties, and under General selecting startup type to 'Automatic', and then click Apply.

Are all those set properly?

Lucas · Jun 27, 2015

1. I've created a Minidump folder
2. It's already checked.
3. I had to change this because there was Automatic option (it was creating Dump file at %systemroot%, but I searched for it and there aren't any DMP files)
4. It was off, I started it and set to Automatic.

Patrick · Jun 27, 2015

Let me know now since #4 if a crash dump is generated next time you crash. Since verifier was triggering a crash on boot, just restart and see if it crashes.

Lucas · Jun 27, 2015

Okay, I think I triggered the crash by opening new tab, entering the site with flash games and playing one of them.
It worked for like 15-20 seconds, then BSOD: PAGE_FAULT_IN_NONPAGED_AREA

I'm attaching also Minidump (ZIP) file:
View attachment 062815-24437-01.zip

Patrick · Jun 27, 2015

Nice, I'll check the dump in a few mins.

Brb.

Patrick · Jun 27, 2015

Code:

0: kd> .bugcheck
Bugcheck code 00000050
Arguments ffffffff`ffffffff 00000000`00000008 ffffffff`ffffffff 00000000`00000000

Okay, so right away we see why we bug checked - 1st and 3rd argument, i.e. ffffffff`ffffffff was written to by the instruction at address ffffffff`ffffffff. Just zero/zero.

Code:

0: kd> !pte ffffffffffffffff
                                           VA ffffffffffffffff
PXE at FFFFF6FB7DBEDFF8    PPE at FFFFF6FB7DBFFFF8    PDE at FFFFF6FB7FFFFFF8    PTE at FFFFF6FFFFFFFFF8
contains 00000000005DD063  contains 00000000005DE063  contains 00000000005E0063  contains 0000000000000000
GetUlongFromAddress: unable to read from fffff8035d3580f4
pfn 5dd       ---DA--KWEV  pfn 5de       ---DA--KWEV  pfn 5e0       ---DA--KWEV  not valid

Of course it isn't valid.

Code:

0: kd> .trap ffffd000`26e29870
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffe00002bb23c0
rdx=0000000000007ff7 rsi=0000000000000000 rdi=0000000000000000
rip=ffffffffffffffff rsp=ffffd00026e29a08 rbp=ffffd00026e29b39
 r8=fffff8035ea6ac10  r9=0000000000000000 r10=fffff8035d2fbf80
r11=fffff8035ea6ad30 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
ffffffff`ffffffff ??              ???

Looks like a bad instruction pointer from win32k!EnterCritAvoidingDitHitTestHazard.

Code:

0: kd> kC
Call Site
nt!KeBugCheckEx
nt! ?? ::FNODOBFM::`string'
nt!MmAccessFault
nt!KiPageFault
win32k!EnterCritAvoidingDitHitTestHazard
win32k!EnterLeaveCrit::EnterLeaveCrit
win32k!RawInputThread
win32k!xxxCreateSystemThreads
win32k!NtUserCallNoParam
nt!KiSystemServiceCopyEnd

For example, looking at the stack, you can see we're just doing a lot of kernel OS sided stuff regarding the GUI infastructure for Windows, then we go off the rails. It's tough to say what caused this other than hardware. I'd say memory, but since memtest passed, it may be worth looking at your video card/power supply (especially since you've mentioned problems with the latter).

Lucas · Jun 28, 2015

Thank you for checking this. I was just testing RAM again, changed slots etc. but without any positive results. Also, I noticed that I have Timings 5/6/6/15 when on the memory it says 5/5/5/15. I'm not sure if it can be a reason anyway. Please check these minidumps also if you can:

View attachment 062815-18531-01.zip

// If it's hardware problem, then is it possible that my Graphics Card is broken and I have to buy a new one?

Lucas · Jun 28, 2015

I can't edit my post, so I have to add new one. I think it's important:

When I was trying to update NVIDIA drivers, it crashed. I think that it's the worst option: broken graphics card...

Minidumps:
View attachment 062815-27718-01.zip

I've changed cables from Power Supply to Graphics Card - nothing.

Patrick · Jun 28, 2015

Does your motherboard have integrated graphics? If so, remove the graphics card and uninstall your drivers and see if it crashes. If it doesn't have integrated graphics, do you have a secondary video card to test?

Lucas · Jun 28, 2015

As far as I know, Asus P5B Premium doesn't have any integrated graphics. I don't have also a secondary video card to test. However, actual situation is really weird. I tried to install 341.44-desktop-win8-win7-winvista-64bit-international-whql drivers. I performed a clean install, so old drivers were deleted. It crashed while installing new drivers, then PC restarted itself.

Check this out:
View attachment 13787

GPU-Z says that I'm still using my Graphics Card. Also, I suppose that if it would be an integrated graphics, then I would need to change my monitor slot to another, but it is still plugged in to my GTX260. Check also this:
https://www.asus.com/Motherboards/P5B_Premium/

Onboard Video Chipset: None

Although when I enter dxdiag and Screen tab, there is:

Name: Microsoft Basic Display Driver
Producer, microchip etc: n/a
Memory size: 256 MB
Drivers: n/a (Only model: WDDM 1.3)

The max screen resolution is 1280x1024 (with drivers I had 1920x1080).
I was testing all day - flash games, opening more tabs etc. - no crashes.

So... I'm not sure what's going on. I didn't try to install new drivers yet.

Patrick · Jun 28, 2015

You don't have an integrated GPU, but the drivers it's reporting you have installed are just MSFT's basic video drivers.

Lucas · Jun 28, 2015

Okay, I get it. But even if I have Basic Video Drivers installed, I'm still using my GPU. With these drivers, I did not get any crashes yet. I know that it can be outside your knowledge (because you are BSOD Kernel Dump Expert, not GPU expert etc.), but ain't it proving that graphics card is not in a bad condition? Even if, I think I have to get another one, but it might be hard.

Patrick · Jun 28, 2015

but ain't it proving that graphics card is not in a bad condition?

That's actually exactly what it proves, yes. It's a little too early to tell, though. If you don't get crashes for a day or so, then I'd say it proves the issue is not the video card itself, but nVidia's drivers (nVidia drivers having problems, what a surprise).

[SOLVED] Several BSODs, PC problems - Windows 8.1 x64

Member

Sysnative Staff

Member

Sysnative Staff

Member

Sysnative Staff

Member

Sysnative Staff

Member

Sysnative Staff

Member

Sysnative Staff

Sysnative Staff

Member

Member

Sysnative Staff

Member

Sysnative Staff

Member

Sysnative Staff