Various constant BSOD crashes - Windows 8 x64

[sinyc]

I have had this problem for a week or so. I shut down the computer, reseated everything, reinstalled windows 8 and I still get the constant crashes...irql not less or equal, system service exception, memory management, page fault in a non paged area, kernel security check failure, ntfs file system, system thread exception...those are the ones I tracked just today.
I will also add that I cant seem to update my intel hardware (chipset etc..) and I cant update to 8.1 since the reinstall.
Thanks for your help.

 

[Patrick]

Hi,

IRQL_NOT_LESS_OR_EQUAL (a)

This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.

6: kd> .trap 0xfffff8800b541530
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800b541908 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff802b08e7436 rsp=fffff8800b5416c0 rbp=fffff8800b541791
 r8=0000000fffffffff  r9=fffffa00119b70b8 r10=0000000000000000
r11=fffff8800b541b00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
[COLOR=#ff0000]nt!MiResolveMappedFileFault+0x96[/COLOR]:
fffff802`b08e7436 4d8b01          [COLOR=#0000ff]mov     [/COLOR][COLOR=#008000]r8[/COLOR],qword ptr [[COLOR=#800080]r9[/COLOR]] ds:fffffa00`119b70b8=????????????????

On the faulting instruction, we were setting r8 to the value at address r9.

6: kd> !pte fffffa00119b70b8
                                           VA fffffa00119b70b8
PXE at FFFFF6FB7DBEDFA0    PPE at FFFFF6FB7DBF4000    PDE at FFFFF6FB7E800460    PTE at FFFFF6FD0008CDB8
contains 0000000000000000
[COLOR=#ff0000]not valid[/COLOR]

The contents stored in r9 weren't valid.

PAGE_FAULT_IN_NONPAGED_AREA (50)

This indicates that invalid system memory has been referenced.

6: kd> k
Child-SP          RetAddr           Call Site
fffff880`05af33b8 fffff800`5a1a41bc nt!KeBugCheckEx
fffff880`05af33c0 fffff800`5a11dc2b nt! ?? ::FNODOBFM::`string'+0x338a2
fffff880`05af3460 fffff800`5a0e0fee nt!MmAccessFault+0x55b
fffff880`05af35a0 fffff800`5a10f598 [COLOR=#800080]nt!KiPageFault+0x16e[/COLOR]
fffff880`05af3730 fffff800`5a16530e [COLOR=#ff0000]nt!MiLocateWsle+0x12c[/COLOR]
fffff880`05af3770 fffff800`5a1237cc nt!MiCopyOnWrite+0x1ce
fffff880`05af3970 fffff800`5a11dabd nt!MiValidFault+0x15c
fffff880`05af39c0 fffff800`5a0e0fee nt!MmAccessFault+0x3ed
fffff880`05af3b00 000007f7`1b752815 nt!KiPageFault+0x16e
00000000`1279f658 00000000`00000000 0x000007f7`1b752815

From the stack, it looks like we hit a pagefault that was labeled a valid fault, likely due to the fact that it was able to retreive the memory from the disk to resolve the fault. The problem was when the memory manager went to locate the working set list, we hit another pagefault.

6: kd> .trap 0xfffff88005af35a0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff70001080530 rbx=0000000000000000 rcx=00000000082d2e40
rdx=000000000082d2e4 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8005a10f598 rsp=fffff88005af3730 rbp=fffff88005af3870
 r8=fffff6fb7dc21000  r9=000000000082d2e4 r10=000000004e5ed001
r11=000000000002f76e r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
[COLOR=#ff0000]nt!MiLocateWsle+0x12c[/COLOR]:
fffff800`5a10f598 488b0408        [COLOR=#0000ff]mov     [/COLOR][COLOR=#008000]rax[/COLOR],qword ptr [[COLOR=#800080]rax+rcx[/COLOR]] ds:fffff700`09353370=????????????????

The immediate results of the pagefault when attempting to retreive the working set list was setting rax to the value at address rax+rcx. If I had to guess just by looking at addresses here, rcx is invalid:

rcx=00000000082d2e40

I say 'guess' because I can't get the memory to dump, as it's a minidump. It's not always a guarantee with only a minidump.

---

This looks to be a RAM problem, but there's two things I want to take care of software-wise that might be the culprits:

1.

6: kd> lmvm bios64
start             end                 module name
fffff880`03bf5000 fffff880`03bfd000   BIOS64     (deferred)             
    Image path: \??\C:\Windows\system32\drivers\BIOS64.sys
    Image name: BIOS64.sys
    Timestamp:        Sat Jun 07 20:12:00 [COLOR=#ff0000]2003[/COLOR]

The above is a driver from 2003 (....) in relation to Biostar I/O. I don't know if it's coupled with Biostar bloatware (software from Biostar), or if it was installed with Windows Update, but it needs to be removed immediately.

Uninstall any/all Biostar software, and if you don't have any, navigate to C:\Windows\system32\drivers\ and rename BIOS64.sys to BIOS64.old and then restart the computer.

2.

6: kd> lmvm BS_I2cIo
start             end                 module name
fffff880`0ac00000 fffff880`0ac08000   BS_I2cIo   (deferred)             
    Image path: \??\C:\Windows\system32\drivers\BS_I2cIo.sys
    Image name: BS_I2cIo.sys
    Timestamp:        Mon Jun 16 02:45:18 [COLOR=#ff0000]2008[/COLOR]

More outdated Biostar bloat, specifically the flash utility.

Follow same advice as #1.

If you crash after the above changes, let me know and we'll move on to RAM diagnostics.

Regards,

Patrick