BSOD's involving my third monitor and youtube.

lime517

New Member
Messages
7
Seemingly random BSODS

Hello Eightforums,
So - I've been getting bluescreens over the past few months, on and off, pretty rarely. Recently it's gotten just a bit worse so I've decided to ask for some help. The bluescreens are seem to happen most often either when my computer has just been booted up (Within 20 minutes) or just woken up from sleep. It also seems to happen when I'm watching a youtube video on my third monitor, which is driven by my integrated GPU. I have a GTX 970 to drive my other two monitors (I could drive all three from the 970 - but I don't want to go out and buy an adapter.)

Attached is the ZIP from the DM Log Collector Tool.

View attachment 57737

Any ideas? Guesses? Thoughts? Thank you to all who help out here. I've lurked the windows forums for a long time ;D
 
Last edited:

My Computer

System One

  • OS
    Windows 8.1
Hi lime517 & Welcome to the forums ^_^,

I have analysed your dump files and below has been provided an analysis of the same for informative purposes :-

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request. This may or may not be due to the caller. The internal pool links must be talked to figure out a possible cause of the problem, and then special pool applied to the suspect tags or the driver verifier to a suspect driver.
Arguments:
Arg1: 000000000000000e,
Arg2: ffffd000339d42b0
Arg3: 000000022ddfa5fa
Arg4: aa9ded666b977742
Code:
0: kd> knL
 # Child-SP          RetAddr           Call Site
00 ffffd000`3356bac8 fffff801`9ad1761c nt!KeBugCheckEx
01 ffffd000`3356bad0 fffff801`9ae3b238 nt!ExDeferredFreePool+0xdac
02 ffffd000`3356bba0 fffff801`9aeb3126 nt!ObpAllocateObject+0x128
03 ffffd000`3356bc20 fffff801`9aeb1a67 nt!IopAllocRealFileObject+0xea
04 ffffd000`3356bcd0 fffff801`9ae5dc39 nt!IopParseDevice+0x597
05 ffffd000`3356bef0 fffff801`9ae5ba63 nt!ObpLookupObjectName+0x6b9
06 ffffd000`3356c070 fffff801`9aed47ab nt!ObOpenObjectByName+0x1e3
07 ffffd000`3356c1a0 fffff801`9aed4343 nt!IopCreateFile+0x36b
08 ffffd000`3356c240 fffff800`033a4e1b nt!IoCreateFileEx+0x107
09 ffffd000`3356c2d0 fffff800`033a2487 afd!AfdTdiCreateAO+0x71b
0a ffffd000`3356c770 fffff800`033b2216 afd!AfdBind+0x49f7
0b ffffd000`3356c850 fffff801`9ae5cc0f afd!AfdDispatchDeviceControl+0x66
0c ffffd000`3356c880 fffff801`9ae5c1ae nt!IopXxxControlFile+0xa4f
0d ffffd000`3356ca20 fffff801`9abce1b3 nt!NtDeviceIoControlFile+0x56
0e ffffd000`3356ca90 00000000`77212352 nt!KiSystemServiceCopyEnd+0x13
0f 00000000`05deeb38 00000000`00000000 0x77212352
There is no documentation which is available publicly on this bugcheck with it's first parameter 0xE. In the stack, we see the Windows WinSOCK driver performing a Bind operation and then the system creates a file. When the system tries allocating an object it sees that the pool is corrupt and crashing the system :(


DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Code:
0: kd> knL
 # Child-SP          RetAddr           Call Site
00 ffffd001`5bd0cfa8 fffff803`d4a8d6b0 nt!KeBugCheckEx
01 ffffd001`5bd0cfb0 fffff803`d4a90171 nt!VerifierBugCheckIfAppropriate+0x3c
02 ffffd001`5bd0cff0 fffff803`d4a9866c nt!ViErrorFinishReport+0x10d
03 ffffd001`5bd0d050 fffff803`d4a8fc6b nt!VfPnpVerifyIrpStackDownward+0x1b0
04 ffffd001`5bd0d130 fffff803`d4a867dd nt!VfMajorVerifyIrpStackDownward+0x83
05 ffffd001`5bd0d190 fffff803`d4a8cd59 nt!IovpCallDriver1+0x5e5
06 ffffd001`5bd0d2e0 fffff803`d4a8188c nt!VfBeforeCallDriver+0x165
07 ffffd001`5bd0d310 fffff800`b4acd989 nt!IovCallDriver+0x348
08 ffffd001`5bd0d360 fffff800`b6252eab VerifierExt!IofCallDriver_internal_wrapper+0x71
09 ffffd001`5bd0d3a0 ffffe000`6129e3f0 [COLOR=#FF0000][B][U]NIWinCDEmu[/U][/B][/COLOR]+0x9eab
0a ffffd001`5bd0d3a8 ffffd001`5bd0d540 0xffffe000`6129e3f0
0b ffffd001`5bd0d3b0 ffffcf81`29ce6dc0 0xffffd001`5bd0d540
0c ffffd001`5bd0d3b8 fffff800`b4acce3a 0xffffcf81`29ce6dc0
0d ffffd001`5bd0d3c0 ffffd001`5bd0d460 VerifierExt!KeClearEvent_wrapper+0x1a
0e ffffd001`5bd0d3f0 ffffe000`6129e3f0 0xffffd001`5bd0d460
0f ffffd001`5bd0d3f8 ffffcf81`29ce6dc0 0xffffe000`6129e3f0
10 ffffd001`5bd0d400 fffff803`d46f4900 0xffffcf81`29ce6dc0
11 ffffd001`5bd0d408 fffff803`d46ac16c nt!NonPagedPoolDescriptor+0x1c0
12 ffffd001`5bd0d410 fffff800`b62519ef nt!ExAllocatePoolWithTag+0x71c
13 ffffd001`5bd0d4e0 ffffcf81`23574fa0 NIWinCDEmu+0x89ef
14 ffffd001`5bd0d4e8 ffffe000`6129e3f0 0xffffcf81`23574fa0
15 ffffd001`5bd0d4f0 ffffcf81`29ce6dc0 0xffffe000`6129e3f0
16 ffffd001`5bd0d4f8 ffffcf81`00000000 0xffffcf81`29ce6dc0
17 ffffd001`5bd0d500 ffffe000`6129e3f0 0xffffcf81`00000000
18 ffffd001`5bd0d508 fffff800`b4ad4c12 0xffffe000`6129e3f0
19 ffffd001`5bd0d510 fffff803`d4a81911 VerifierExt!xdv_IRP_MJ_PNP_wrapper+0xfe
1a ffffd001`5bd0d570 fffff803`d4a9e100 nt!IovCallDriver+0x3cd
1b ffffd001`5bd0d5c0 fffff803`d4a81911 nt!ViFilterDispatchPnp+0x22c
1c ffffd001`5bd0d600 fffff803`d47ad2b2 nt!IovCallDriver+0x3cd
1d ffffd001`5bd0d650 fffff803`d47ad164 nt!PnpAsynchronousCall+0x102
1e ffffd001`5bd0d690 fffff803`d47ad01d nt!PnpQueryDeviceRelations+0x88
1f ffffd001`5bd0d750 fffff803`d484e835 nt!PipEnumerateDevice+0xe9
20 ffffd001`5bd0d7d0 fffff803`d492423f nt!PipProcessDevNodeTree+0x1a1
21 ffffd001`5bd0da50 fffff803`d44eb10c nt!PiProcessStartSystemDevices+0x87
22 ffffd001`5bd0daa0 fffff803`d44a438c nt!PnpDeviceActionWorker+0x3bc
23 ffffd001`5bd0db50 fffff803`d4509c70 nt!ExpWorkerThread+0x28c
24 ffffd001`5bd0dc00 fffff803`d455efc6 nt!PspSystemThreadStartup+0x58
25 ffffd001`5bd0dc60 00000000`00000000 nt!KiStartSystemThread+0x16
Phew, that is a long stack. Now, according to the stack we see that the Native Instrument's ISO Mounter (NIWinCDEmu.sys) driver was flagged by the Driver Verifier which caused the crash.
I would suggest you to uninstall this software and see if the problem is resolved or not.

Kindly remove/physically detach any Razer Devices attached to the system till we are troubleshooting as they are known to cause problems.

Let me know how it goes ^_^
-Pranav
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Wow. Thank you so much for going through all that.

It's been uninstalled/deleted. We'll see if we bluescreen again any time soon. If I do - I'll make sure to tell you.
 

My Computer

System One

  • OS
    Windows 8.1
Wow. Thank you so much for going through all that.

It's been uninstalled/deleted. We'll see if we bluescreen again any time soon. If I do - I'll make sure to tell you.

Hi Lime517 ^_^,

Sure thing. Let me know if anything goes wrong. If the issue is solved, kindly mark this thread as solved :)

-Pranav
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Hm... It did a total freeze - no BSOD this morning. It's done that a few times before too... Was just browsing the web in Chrome.
 

My Computer

System One

  • OS
    Windows 8.1
Hm... It did a total freeze - no BSOD this morning. It's done that a few times before too... Was just browsing the web in Chrome.

What were you doing at other times when the computer froze? Could you please upload a freshly generated SF Diagnostic ZIP file?
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Hi Lime517 ^_^,

There are no dump files and no events related to a Blue Screen in the Event Logs.
You have got 3 hard drives (2 normal HDDs and 1 SSD), what is the age and wattage of the Power Supply?

Kindly follow the below steps -
  1. Please remove/physically detach any Razer Devices (Razer DeathAdder, Razer BlackWidow) attached to the system as they are known to cause problems. (I really wonder how Razer names their devices though ;) )
  2. Please disable the NVIDIA Streaming Service by following this **LINK**.
  3. If the above steps do not solve the problem, kindly perform the Hardware Diagnostics from this **LINK** and report back the results. Kindly report the temperatures as well of the system while idle and under load.
  4. Please turn on Driver Verifier (if the issues are still not solved) using this **GUIDE** and then make sure that you let it crash the system a few times and then upload a freshly generated SF Diagnostic ZIP file.


Let me know how it goes ^_^

-Pranav
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Sorry for taking so long. Been a busy week. The Power Supply is about a year or two old, a Corsair RM550 80 Plus Gold PSU. It's solid.

I did unplug my Razer keyboard and mouse (The only peripherals from them I have - unless you count the mousepad, but that's wireless and I can't find the dongle ;) ) this time for the vast majority of the time driver verifier did it's dozen boots and crashes. I had to go into safe mode to disable verifier after a while. (Replugged after ~ 5 crashes to see if I could actually get all the way to the desktop. Made no difference.)
I disabled the NVIDIA Streaming Service.
I took a bit of a look at the hardware stuff, I benchmark my PC here and there, and have stress tested it before, the CPU runs a bit hot when under heavy heavy load (I have SpeedFan set to let it go no hotter than 75c because I'd sooner take a bit more heat then super loud fans), but everything else is good. I have run Memtest86 recently and let it go for a few hours, doing multiple passes, and it came up clean.

One other thing, when the PC freezes while audio is playing (Eg. Youtube video) the audio keeps going for a while. Recently I just let the audio keep going for as long as it could (I was watching a music video) to see what would happen and if it would reach the end of the song or not. It almost reached the end of the song (went for about another 2 minutes after freezing), and then as soon as the audio stream finished it gave me a blue screen with the error DPC_WATCHDOG_VIOLATION. Sure enough, the bluescreen showed up in bluescreenview when I rebooted, though it didn't have that error associated with it. Idk if that's helpful or not though.

So - finally, the updated SF diagnostic ZIP file, with lots of new BSOD minidumps. View attachment 58423

Thanks for going through this with me. I really do appreciate it.
 

My Computer

System One

  • OS
    Windows 8.1
Hi lime517 ^_^,

You are welcome ^_^. I have analysed the latest Driver Verifier dumps and below has been provided an analysis of the same for informative purposes :-

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is because the driver was specified in the registry as being suspect (by the administrator) and the kernel has enabled substantial checking of this driver. If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will be among the most commonly seen crashes.
Arguments:
Code:
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 0000000000000060, Handle value being referenced.
Arg3: ffffe001c992e900, Address of the current process.
Arg4: fffff8001a1dc430, Address inside the driver that is performing the incorrect reference.
So, it seems that a driver thought of a user mode handle as a kernel mode. According to the rules, it is not allowed and only the handles originated in Kernel Mode can be accessed as Kernel Handles. It would be like having a British Pound and trying to use it as a dollar in US. That wouldn't work right? Hence, the Driver Verifier caught the responsible driver and crashed the system. Let's take a look at the stack to see if we have the culprit -
Code:
0: kd> knL
 # Child-SP          RetAddr           Call Site
00 ffffd000`31caf1f8 fffff803`f86946b0 nt!KeBugCheckEx
01 ffffd000`31caf200 fffff803`f8699fa0 nt!VerifierBugCheckIfAppropriate+0x3c
02 ffffd000`31caf240 fffff803`f8549ba9 nt!VfCheckUserHandle+0x1b8
03 ffffd000`31caf320 fffff803`f83bf715 nt!ObReferenceObjectByHandleWithTag+0xd939
04 ffffd000`31caf3c0 fffff803`f83da82e nt!ObReferenceObjectByHandle+0x25
05 ffffd000`31caf410 fffff803`f816b1b3 nt!NtSetEvent+0x6e
06 ffffd000`31caf460 fffff803`f8163600 nt!KiSystemServiceCopyEnd+0x13
07 ffffd000`31caf5f8 fffff800`1a1dc430 nt!KiServiceLinkage
08 ffffd000`31caf600 ffffcf81`9b81a001 [COLOR=#FF0000][B][U]rzpmgrk[/U][/B][/COLOR]+0x1430
09 ffffd000`31caf608 ffffcf81`9b81a000 0xffffcf81`9b81a001
0a ffffd000`31caf610 00000000`00000400 0xffffcf81`9b81a000
0b ffffd000`31caf618 ffffe001`cc6e18b0 0x400
0c ffffd000`31caf620 00000000`00000000 0xffffe001`cc6e18b0
Yay, we found the culprit. It is the "rzpmgrk.sys" driver or the Razer Overlay Support Driver. I would suggest you to get rid of the Razer Software and drivers as they are known to cause problems. Unfortunately, I see that the Razer devices are still plugged in. Could you please remove them and get rid of the Razer stuff?
Please do a system wide search for the above driver and rename it to "rzpmgrkbak.sys". Reboot your system (Don't attach the Razer Devices as of now) and do the search again and make sure that the above driver has not been created again.

Let me know how it goes ^_^

-Pranav
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Back
Top