[SOLVED] Bluescreens Randomly Started Appearing? - Windows 8.1 x64

Jadhomer · Nov 14, 2014

Hi Everyone!

I recently built my first desktop computer and everything was going great until I got two random BSODs in a row today. I read the BSOD posting instructions and tried to follow them; however, I ran into some issues. I tried to run the BSOD Analysis program you guys provided, but it cannot seem to find my documents folder as I moved them off of my SSD to secondary HDD. I'm going to manually zip up the dump files and upload them here to get around this problem. I then tried to run the perfmon /report but it is returning a message saying:

	Error:
	An error occured while attempting to generate the report.
	The operator or administrator has refused the request.

Also, I ran sfc /scannow and it said nothing caused a violation.

Here are the specs:
OS : Windows 8.1
Type: 64-bit
Original OS: None, this was a new build
Type of OS: I purchased a copy from a retailer
Age of System: Five days old.
Age of OS: Same as the system age, five days. I have not reinstalled the OS.

CPU: i7-4790k (Stock)
Video Card: EVGA GTX 980 SC ACX 2.0
Motherboard: MSI Gaming 7
Powersupply: EVGA Supernova G2 1000W Gold

System Manufacturer: N/A
Model Number: N/A

Type of computer: This is a desktop.

Let me know if there is any more information I need to provide. I would be extremely grateful for any solutions. Thanks!

EDIT: Literally as soon as I posted this, my motherboard alerted me to a BIOS update and I installed it. Just wanted to throw this out there.

x BlueRobot · Nov 15, 2014

Code:

BugCheck 19, {e, ffffe001dc80bee0, caf55fc9d19464c1, caf55fc9d19474c1}

Probably caused by : bwcW8x64.sys ( bwcW8x64+101f9 )

The above paramaters are reserved for 0xe violation, however, I assume that the third and fourth parameter are related to the virtual address which was overrun. The second parameter is a pool page entry which has been freed.

I'm unlikely to be delve any deeper into this bugcheck to gather some more information, but a Stop 0x19 indicates that a pool page or structure has become corrupt. In this case, according to some Microsoft documentation, the pool header (POOL_HEADER) has become corrupt after the corresponding pool allocation was freed. I'm assuming that XENO is the pooltag for our freed block, and bwcW8x64.sys was the driver which caused the buffer overrun.

Code:

0: kd> !pool ffffe001dc80bee0
fffff80142d4ad80: Unable to get special pool info
fffff80142d4ad80: Unable to get special pool info
Pool page ffffe001dc80bee0 region is unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
Unknown
 ffffe001dc80b000 size:   d0 previous size:    0  (Allocated)  NDft
 ffffe001dc80b0d0 size:   40 previous size:   d0  (Allocated)  NDft
 ffffe001dc80b110 size:   50 previous size:   40  (Allocated)  NDft
 ffffe001dc80b160 size:   90 previous size:   50  (Allocated)  NDft
 ffffe001dc80b1f0 size:   b0 previous size:   90  (Allocated)  NVRM
 ffffe001dc80b2a0 size:   b0 previous size:   b0  (Allocated)  NVRM
 ffffe001dc80b350 size:   e0 previous size:   b0  (Allocated)  NVRM
 ffffe001dc80b430 size:   70 previous size:   e0  (Allocated)  NDft
 ffffe001dc80b4a0 size:   10 previous size:   70  (Free)       Free
 ffffe001dc80b4b0 size:   60 previous size:   10  (Allocated)  AwNd
 ffffe001dc80b510 size:   20 previous size:   60  (Free)       Free
 ffffe001dc80b530 size:   b0 previous size:   20  (Allocated)  NVRM
 ffffe001dc80b5e0 size:  110 previous size:   b0  (Allocated)  NVRM
 ffffe001dc80b6f0 size:  100 previous size:  110  (Allocated)  NVRM
 ffffe001dc80b7f0 size:   b0 previous size:  100  (Allocated)  NVRM
 ffffe001dc80b8a0 size:   40 previous size:   b0  (Allocated)  NDft
 ffffe001dc80b8e0 size:   f0 previous size:   40  (Allocated)  NVRM
 ffffe001dc80b9d0 size:  3a0 previous size:   f0  (Allocated)  NVRM
 ffffe001dc80bd70 size:   40 previous size:  3a0  (Allocated)  NDft
 ffffe001dc80bdb0 size:   90 previous size:   40  (Allocated)  NDft
 ffffe001dc80be40 size:   a0 previous size:   90  (Free )  AwNd
*ffffe001dc80bee0 size:   40 previous size:   a0  (Free ) *XENO
        Owning component : Unknown (update pooltag.txt)
 ffffe001dc80bf20 size:   e0 previous size:   40  (Allocated)  NVRM

The system seems to want to blame your bwcW8x64.sys driver which is a Killer Bandwidth Control Filter Driver. I would suggest looking for another update for your network adapter. The XENO pooltag possibly belongs to Bigfoot Networks Killer Xeno PCI-E Gaming Adapter (this card is from VisionTek); the driver Xeno7x64.sys.#

Code:

0: kd> lmvm bwcW8x64
start             end                 module name
fffff800`41626000 fffff800`41881000   bwcW8x64 T (no symbols)           
    Loaded symbol image file: bwcW8x64.sys
    Image path: bwcW8x64.sys
    Image name: bwcW8x64.sys
    Timestamp:        Thu Sep 11 20:43:49 2014 (5411FB75)
    CheckSum:         0001D2D2
    ImageSize:        0025B000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

The pool page should or is a non-paged pool page simply based upon the fact that the IRQL Level is 2.

Code:

0: kd> !irql
Debugger saved IRQL for processor 0x0 -- 2 (DISPATCH_LEVEL)

------------------------------------------------------------------------------------------------------------

Code:

BugCheck 1000007E, {ffffffffc0000005, fffff8015f4b7302, ffffd000306993b8, ffffd00030698bc0}

Probably caused by : hardware ( SamsungRapidDiskFltr+2f302 )

Code:

2: kd> .exr 0xffffd000306993b8
ExceptionAddress: fffff8015f4b7302 (SamsungRapidDiskFltr+0x000000000002f302)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001 <---- Write operation?
   Parameter[1]: 0000000000000039 <---- Address which we attempted to write to
Attempt to write to address 0000000000000039

The exception record indicates that the driver has attempted to perform a write operation on an invalid address location.

Code:

2: kd> .cxr 0xffffd00030698bc0; u
rax=000000000000009e rbx=ffffe000665400e0 rcx=000000000000002a
rdx=00000000665400e0 rsi=000000ffffffffff rdi=0000000000000000
rip=fffff8015f4b7302 rsp=ffffd000306995f8 rbp=0000000048000018
 r8=0000000000000008  r9=0000ffffffffffff r10=ffffe00024df6ad8
r11=fffff8015f488000 r12=0000000003560698 r13=0000000000000008
r14=ffffe00066fab000 r15=0000000000000001
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
SamsungRapidDiskFltr+0x2f302:
fffff801`5f4b7302 01410f          add     dword ptr [rcx+0Fh],eax ds:002b:00000000`00000039=????????
SamsungRapidDiskFltr+0x2f302:
fffff801`5f4b7302 01410f          add     dword ptr [rcx+0Fh],eax
fffff801`5f4b7305 b640            mov     dh,40h
fffff801`5f4b7307 0d88410141      or      eax,41014188h
fffff801`5f4b730c 0fb6400e        movzx   eax,byte ptr [rax+0Eh]
fffff801`5f4b7310 884102          mov     byte ptr [rcx+2],al
fffff801`5f4b7313 498b00          mov     rax,qword ptr [r8]
fffff801`5f4b7316 498902          mov     qword ptr [r10],rax
fffff801`5f4b7319 48b80100000000000000 mov rax,1

Code:

2: kd> lmvm SamsungRapidDiskFltr

start             end                 module name
fffff801`5f488000 fffff801`5f4cc000   SamsungRapidDiskFltr T (no symbols)           
    Loaded symbol image file: SamsungRapidDiskFltr.sys
    Image path: SamsungRapidDiskFltr.sys
    Image name: SamsungRapidDiskFltr.sys
    Timestamp:        Mon May 19 15:24:16 2014 (537A1410)
    CheckSum:         00046A34
    ImageSize:        00044000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

I wonder if these bugcheck is related to the Stop 0x19? I wonder if the previous bugcheck somehow caused a page fault onto an invalid address?

Code:

2: kd> !dpx
Start memory scan  : 0xffffd000306995f8 ($csp)
End memory scan    : 0xffffd0003069a000 (Stack Base)

*** WARNING: Unable to verify timestamp for SamsungRapidDiskFltr.sys
*** ERROR: Module load completed but symbols could not be loaded for SamsungRapidDiskFltr.sys
0xffffd00030699608 : 0xfffff8015ea14afe : volsnap!VspWriteContextCompletionRoutine+0x12e
0xffffd00030699648 : 0xfffff8015f04fe01 : Ntfs!NtfsHandlePagingFile+0x65
0xffffd00030699658 : 0xfffff803d19e1036 : nt!KiSwapContext+0x76
0xffffd000306998e8 : 0xfffff803d18fdcec : nt!KeAbEntryFree+0x48
0xffffd00030699990 : 0xffffd00030699a58 : 0xfffff803d190f339 : nt!KiCommitThreadWait+0x129
0xffffd00030699a58 : 0xfffff803d190f339 : nt!KiCommitThreadWait+0x129
0xffffd00030699ac8 : 0xfffff803d188f000 : "nt!_guard_check_icall_fptr <PERF> (nt+0x0)"
0xffffd00030699bf8 : 0xfffff803d198de70 : nt!PspSystemThreadStartup+0x58
0xffffd00030699c18 : 0xfffff803d19e157d : nt!SwapContext_PatchLdMxCsr+0x110
0xffffd00030699c58 : 0xfffff803d19e47c6 : nt!KiStartSystemThread+0x16

Jadhomer · Nov 19, 2014

Thanks for your help

and I apologize for my delayed response. I found updated drivers directly from the Qualcomm Killer Networking website and I have disabled another driver that was causing a blue screen. Everything appears to be working quite well!

x BlueRobot · Nov 20, 2014

Thanks for the update, and glad to be able to help.

Search

Search

[SOLVED] Bluescreens Randomly Started Appearing? - Windows 8.1 x64

Jadhomer

New member

Attachments

x BlueRobot

Administrator

Jadhomer

New member

x BlueRobot

Administrator