Driver Corruption caused BSOD


  • I have been getting some BSOD's on my computer. I know that they are caused by memory corruption or driver corruption. I have run memtest with 10 passes no errors. I have also enabled driver verifyer to help pinpoint which driver is causing the issue, I am just not familiar with reading crash dumps enough to know. 

    Also since I do now know what is causing the BSOD, it is difficult to replicate the issue to force a blue screen.  I have attempted to stress my system in order to cause it without any luck.  Most of the time it happens is when I am not even on my pc, I will wake up to the message stating my pc has rebooted due to error. 

    system info

    Dumpfile 1

    dumpfile 2

    dumpfile 3

    Thursday, November 14, 2013 8:17 AM

All replies

  • Th3gre3k

    It appears that either verifier was not configured correctly or the driver causing this was not in the set being examined.

    Can you type verifier /query and tell us what drivers a re being verified?

    You may have to verify all drivers but this will slow the computer down a bit.

    BugCheck A, {fffffba007af3a98, 2, 1, fffff802f60f3454}
    Probably caused by : memory_corruption ( nt!MiUnlinkFreeOrZeroedPage+1a4 )
    BugCheck A, {fffff6fc6d925560, 2, 0, fffff8004b0451a4}
    Probably caused by : memory_corruption ( nt!MiTryLockProtoPoolPageAtDpc+34 )

    Wanikiya and Dyami--Team Zigzag

    Thursday, November 14, 2013 8:25 AM
  • It appears that it is no longer verifying drivers. I have started driver verifier again using the following instructions 

    Select "Create custom settings (for code developers)" and click "Next
    Select "Select individual settings from a full list" and click "Next"
    Select everything EXCEPT FOR "Low Resource Simulation" 
    For Win 8 dont check Concurrency stress test, and DDI compliance checking click "Next"
    Select "Select driver names from a list" and click "Next"
    Then select all drivers NOT provided by Microsoft and click "Next"
    Select "Finish" on the next page.

    I guess the only thing to do now is wait for another crash. Hopefully it does not take a long time. 

    Thursday, November 14, 2013 8:33 AM
  • Th3gre3k

    You can speed up the process by doing whatever makes it crash in the first place.  May take as long as 48 continuous hours to stress each driver.

    Wanikiya and Dyami--Team Zigzag

    Thursday, November 14, 2013 8:49 AM
  • Again, I do not know what is causing the issue, I have tried to replicate it with out success and typically this happens when I am not on or near my pc. 

    Also, when I enabled driver verifier again, my pc is now crashing on reboot, these crashes are not being recorded in the minidump directory.  I am not sure how to get the driver verifier running since it will not boot with it on. 
    Thursday, November 14, 2013 9:10 AM
  • Th3gre3k

    Turn verifier off (if you can) by typing verifier /reset.

    Lets take a look at your event viewer

    Please provide us with your Event Viewer administrative logs by following these steps:

    Click Start Menu
    Type eventvwr into Search programs and files (do not hit enter)
    Right click eventvwr.exe and click Run as administrator
    Expand Custom Views
    Click Administrative Events
    Right click Administrative Events
    Save all Events in Custom View As...
    Save them in a folder where you will remember which folder and save as Errors.evtx
    Go to where you saved Errors.evtx
    Right click Errors.evtx -> send to -> compressed (zipped) folder
    Upload the .zip file to skydrive or a file sharing service and put a link to it in your next post

    Also these are the things necessary to create DMP files.  Please check you setup

    For dumps to be produced. . .

    ▪ Page file must be on OS drive
    * Page file base allocation size must be > than installed physical RAM
    ▪ Windows Error Reporting (WER) system service should be set to MANUAL
    *Set page file to system managed on the OS drive
    *Set system crash/recovery options to "kernel Memory Dump"
    *User account control must be running.
    * Sometimes SSD drives with older firmware do not create DMPS (update firmware)
    *cleaner applications like Ccleaner delete DMP files so dont run them until you are fixed.

    Wanikiya and Dyami--Team Zigzag

    Thursday, November 14, 2013 10:21 PM
  • Here is my exported error logs 


    Friday, November 15, 2013 7:45 AM
  • I have had two more recent BSOD's lately, one of which I believe has provided me more information as to the cause. Here are the dump files


    The dump from 11/20 referenced ely60x64.sys which I believe is related to my network driver. 

    I am currently using my onboard Lan for my mobo. My mobo is an Intel Dx58so and the network controller for it is Intel 82567LM  I have searched on the Intel site for up to date drivers, however when I search straight from my MOBO page, It does not give me any for windows 8. Also When I search just that specific driver, I find a windows 8 compatible one, however when running the installer I get an error stating "No intel devices found"

    I am thinking I may just need to purchase a PCIe NIC and disable the onboard one. Am I on the right track? 

    Thursday, November 21, 2013 7:09 PM
  • Th3gre3k

    One of two DMPS (112113-17546-01.dmp) is the same error code as previously and still memory corruption.  The other is indeed pointing to your network driver which is still from 2011.  If there is no newer driver you can re-install it in compatibility mode.

    To Run in compatibility mode do the following:

    Right click the installer>properties>compatibility>choose OS

    If you want a quick fix and think that a new PCIe card would do it I would think it would be a different piece of hardware and a different driver and relatively cheap I suspect.

    Wanikiya and Dyami--Team Zigzag

    Friday, November 22, 2013 5:32 AM
  • I tried running a driver update using compatability mode, however that did not correctly update the driver. 

    I have purchased a new PCIe LAN card and installed it. The driver date for this new card is 5/10/2013 so it should be up to date. I have also disabled the older network adapter. 

    However it does not appear this has resolved the issue. This is the most recent BSOD i have gotten since installing the new card/driver 

    crash dump

    • Edited by Th3gre3k Wednesday, November 27, 2013 8:41 AM
    Wednesday, November 27, 2013 8:40 AM
  • Th3gre3k

    A different driver issue unfortunately not conclusive.  Back to driver verifier.  BTW you should also update the below drivers and if you are not using the ely60x64.sys I would rename it to *.BAK to prevent it from loading

    WinRing0x64.sys    7/26/2008 8:29:37 AM   
    LGBusEnum.sys    11/23/2009 8:36:48 PM  
    LGVirHid.sys    11/23/2009 8:36:48 PM   
    SaiK0836.sys    6/11/2010 3:50:31 AM  
    mv61xxmm.sys    10/26/2010 4:25:00 AM   
    mv61xx.sys    10/26/2010 4:25:11 AM   
    e1y60x64.sys    2/15/2011 3:21:13 PM   

    Wanikiya and Dyami--Team Zigzag

    Wednesday, November 27, 2013 2:05 PM
  • I was finally able to get driver verifier running correctly. 
    It looks like the daemon tools driver was conflicting with driver verifier which gave me an IO error at boot. 

    now that I have driver verifier running, I Have received two different blue screens, 

    The First dump seems to point to lvrs64.sys which I found is related to my Logitech webcam, I have since uninstalled the software and disabled the driver

    After doing so I received the second dump which points to RzSynapse.exe. I will try removing the razer synapse software. 

    Removed PII

    Driver Enabled Dump 2

    Thursday, December 05, 2013 6:26 AM
  • Th3gre3k

    Forgive me I am taking your first link out because it is to ALL of your Dropbox.  Second link is ok

    The other DMP file not verified and related to memory corruption

    Wanikiya and Dyami--Team Zigzag

    Thursday, December 05, 2013 6:48 AM
  • Thank you for removing that, not sure how that happened 

    here is the correct link to the first dump file 

    dump 12-3

    Also, this is the results of a verifier /query. I believe I started it correctly 

    • Edited by Th3gre3k Thursday, December 05, 2013 8:04 AM
    Thursday, December 05, 2013 8:02 AM
  • Th3gre3k

    This verified DMP was Related to lvrs64.sys Kernel Audio Improvement Filter Driver from Logitech Inc.  It is still install and still crashing and taking audiodg with it.

    Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    Loading Dump File [C:\Users\Ken\Desktop\120313-37234-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*H:\symbols*
    Symbol search path is: SRV*H:\symbols*
    Executable search path is: 
    Windows 8 Kernel Version 9600 MP (12 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 9600.16422.amd64fre.winblue_gdr.131006-1505
    Machine Name:
    Kernel base = 0xfffff801`c9001000 PsLoadedModuleList = 0xfffff801`c92c5990
    Debug session time: Wed Dec  4 01:44:01.417 2013 (UTC - 5:00)
    System Uptime: 0 days 22:21:55.861
    Loading Kernel Symbols
    Loading User Symbols
    Loading unloaded module list
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    Use !analyze -v to get detailed debugging information.
    BugCheck 3B, {c0000005, fffff80002affca0, ffffd00022c37850, 0}
    *** WARNING: Unable to verify timestamp for lvrs64.sys
    *** ERROR: Module load completed but symbols could not be loaded for lvrs64.sys
    Probably caused by : lvrs64.sys ( lvrs64+37ca0 )
    Followup: MachineOwner
    1: kd> !analyze -v
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    An exception happened while executing a system service routine.
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff80002affca0, Address of the instruction which caused the bugcheck
    Arg3: ffffd00022c37850, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.
    Debugging Details:
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    fffff800`02affca0 488911          mov     qword ptr [rcx],rdx
    CONTEXT:  ffffd00022c37850 -- (.cxr 0xffffd00022c37850;r)
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
    rdx=0000000000000000 rsi=0000000000000052 rdi=0000000080000005
    rip=fffff80002affca0 rsp=ffffd00022c38288 rbp=ffffcf800363eed8
     r8=0000000000000012  r9=0000000000000001 r10=0000000000000000
    r11=ffffd00022c381b0 r12=ffffcf80009fadf0 r13=0000000000000000
    r14=ffffcf8001bb6f80 r15=ffffcf8002876e70
    iopl=0         nv up ei ng nz na pe cy
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010283
    fffff800`02affca0 488911          mov     qword ptr [rcx],rdx ds:002b:00000000`00000000=????????????????
    Last set context:
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
    rdx=0000000000000000 rsi=0000000000000052 rdi=0000000080000005
    rip=fffff80002affca0 rsp=ffffd00022c38288 rbp=ffffcf800363eed8
     r8=0000000000000012  r9=0000000000000001 r10=0000000000000000
    r11=ffffd00022c381b0 r12=ffffcf80009fadf0 r13=0000000000000000
    r14=ffffcf8001bb6f80 r15=ffffcf8002876e70
    iopl=0         nv up ei ng nz na pe cy
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010283
    fffff800`02affca0 488911          mov     qword ptr [rcx],rdx ds:002b:00000000`00000000=????????????????
    Resetting default scope
    PROCESS_NAME:  audiodg.exe
    ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
    LAST_CONTROL_TRANSFER:  from fffff80002adc382 to fffff80002affca0
    ffffd000`22c38288 fffff800`02adc382 : 00000000`80000005 ffffcf80`0363eed8 00000000`00000052 fffff800`02acc6c7 : lvrs64+0x37ca0
    ffffd000`22c38290 00000000`80000005 : ffffcf80`0363eed8 00000000`00000052 fffff800`02acc6c7 00000000`00000000 : lvrs64+0x14382
    ffffd000`22c38298 ffffcf80`0363eed8 : 00000000`00000052 fffff800`02acc6c7 00000000`00000000 00000000`00000000 : 0x80000005
    ffffd000`22c382a0 00000000`00000052 : fffff800`02acc6c7 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffcf80`0363eed8
    ffffd000`22c382a8 fffff800`02acc6c7 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffd000`22c382f0 : 0x52
    ffffd000`22c382b0 00000000`00000000 : 00000000`00000000 00000000`00000000 ffffd000`22c382f0 ffffd000`22c382e0 : lvrs64+0x46c7
    fffff800`02affca0 488911          mov     qword ptr [rcx],rdx
    SYMBOL_NAME:  lvrs64+37ca0
    FOLLOWUP_NAME:  MachineOwner
    MODULE_NAME: lvrs64
    IMAGE_NAME:  lvrs64.sys
    STACK_COMMAND:  .cxr 0xffffd00022c37850 ; kb
    FAILURE_BUCKET_ID:  0x3B_VRF_lvrs64+37ca0
    BUCKET_ID:  0x3B_VRF_lvrs64+37ca0
    FAILURE_ID_HASH_STRING:  km:0x3b_vrf_lvrs64+37ca0
    FAILURE_ID_HASH:  {72a53d32-a793-16bf-9b22-f028278db442}
    Followup: MachineOwner

    Wanikiya and Dyami--Team Zigzag

    Thursday, December 05, 2013 9:10 AM
  • That is what I found as well when I analyzed that dump. Since then I have disabled lvrs64.sys. I just received another BSOD a couple minutes ago, however i am not getting any good information from it, just a memory corruption message. Here is the dump file 


    I am having a hard time finding a solid solution as every dump file points to either a different driver or just memory corruption.

    I recently ran another memtest as well just to verity, I had 6 passes with no errors. 

    Thursday, December 05, 2013 9:25 AM
  • At some point you should start thinking about a clean install.  In the long run it may be faster and less painful for you.

    Wanikiya and Dyami--Team Zigzag

    Friday, December 06, 2013 2:22 AM
  • I completely agree. The downside is, prior to posting in this forum, one of the first troubleshooting steps I performed was a clean install of windows. 

    Even though memtest is reporting no errors. I am going to try swapping out my RAM this weekend, to see if that makes a difference. 
    Friday, December 06, 2013 2:37 AM
  • Alright, here is a quick update, 

    I decided to reprovision my computer, to see if that would make a difference. 

    So I formatted everything and re-installed windows 8. After installing drivers and windows updates, nothing else, I received a blue screen the following morning. 

    After this happened, I decided to format everything and install Window 7 (since my mobo isn't officially windows 8 compatible even though it has been running fine since window 8 first came out and i upgraded). I installed drivers, and started windows updates, didn't get through the first wave of updates before another BSOD. 

    So I have run multiple Memtests with no errors. I have done a full pccheck scan, no errors, HDD/SSD checks, no errors, I have also scanned for root kits and found nothing.  Also when I reinstalled windows 8 recently, I installed it to a different hard drive just to be sure. It made no difference. 

    At this point I am thinking that it must be a mobo issue, maybe a corrupted memory controller or chipset. I don't see what else it could be. 

    Saturday, December 07, 2013 8:52 AM
  • Th3gre3k

    I am thinking SSD first then mobo.  If you have a spare HD I would try that first.

    Wanikiya and Dyami--Team Zigzag

    Saturday, December 07, 2013 6:11 PM