none
Windows 7 Blue Screen Issues With Alt-tabbing From WoW

    Question

  • As the title says, lately I've been having blue screens which are mostly caused by wow.

    Previously I've had the occasional bsod (once a month or so) when alt tabbing, but it was pretty rare. However recently, I've had something more like 1 a day, usually caused by alt tabbing out of wow. It seems the longer I'm alt tabbed the more likely it is to happen. I haven't experienced the same problem with any other game, although the occasional monthly ones usually happen when I'm changing my music as I alt tab out of League of Legends.

    I downloaded bluescreenview and it appears the cause is some combination of win32k.sys as well as ntoskrnl.exe             Based off the fact that it is happening more with a more demanding game, I'm guessing the problem is most likely due to a bad stick of ram, but I'd like a second opinion.

    I'll attach a few of the most recent dump files (the one today is slightly different than the ones last week which seems slightly odd).

    http://puu.sh/8lVuH     http://puu.sh/8lVtT      http://puu.sh/8lVse

    Thanks in advance for any help, and I hope image files are okay :)

    Thursday, April 24, 2014 7:53 PM

Answers

  • Thanks, and it's not, no. You can't exactly debug pictures :')

    We have two consistent bug checks:

    SYSTEM_SERVICE_EXCEPTION (3b)

    This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.

    This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code.

    BugCheck 3B, {c0000005, fffff80002e5301e, fffff88008945c70, 0}

    0: kd> ln fffff80002e5301e
    (fffff800`02e52ff8)   nt!ExEnterCriticalRegionAndAcquireFastMutexUnsafe+0x26   |  (fffff800`02e53040)   nt!PsIsProtectedProcess
    

    ^^ The exception occurred in nt!ExEnterCriticalRegionAndAcquireFastMutexUnsafe. This is a routine that first enters a critical region, and then acquires the specified fast mutex for the calling thread.

    PAGE_FAULT_IN_NONPAGED_AREA (50)

    This indicates that invalid system memory has been referenced.

    Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).

    Another common cause is the installation of a faulty system service.

    Antivirus software can also trigger this error, as can a corrupted NTFS volume.

    BugCheck 50, {fffff900c25efcf0, 0, fffff9600032c69d, 0}
    

    ^^ Address fffff900c25efcf0 was written to by the instruction at address fffff9600032c69d.

    1: kd> r cr2
    Last set context:
    cr2=fffff900c25efcf0
    

    ^^ The 1st parameter address was stored in cr2 prior to calling the page fault handler.

    1: kd> !pte fffff900c25efcf0
                                               VA fffff900c25efcf0
    PXE at FFFFF6FB7DBEDF90    PPE at FFFFF6FB7DBF2018    PDE at FFFFF6FB7E403090    PTE at FFFFF6FC80612F78
    Unable to get PXE FFFFF6FB7DBEDF90
    

    ^^ Can't see whether or not it's valid/non-valid.

    1: kd> .trap fffff880`073858e0
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000011 rbx=0000000000000000 rcx=fffff900c376ae40
    rdx=00000000701215e6 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff9600032c69d rsp=fffff88007385a70 rbp=0000000000000001
     r8=0000000000000000  r9=0000000000000410 r10=fffff80002e4e000
    r11=0000000000000022 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+0x2d:
    fffff960`0032c69d 488b4f20        mov     rcx,qword ptr [rdi+20h] ds:00000000`00000020=??????????
    

    ^^ On the instruction we failed on, address fffff960`0032c69d deferenced rdi+20h where rdi is 0000000000000000. All of this would result in a memory write to the address 00000000`00000020.

    1: kd> dd 00000000`00000020
    00000000`00000020  ???????? ???????? ???????? ????????
    00000000`00000030  ???????? ???????? ???????? ????????
    00000000`00000040  ???????? ???????? ???????? ????????
    00000000`00000050  ???????? ???????? ???????? ????????
    00000000`00000060  ???????? ???????? ???????? ????????
    00000000`00000070  ???????? ???????? ???????? ????????
    00000000`00000080  ???????? ???????? ???????? ????????
    00000000`00000090  ???????? ???????? ???????? ????????
    

    Right, so the code wanted to write to 00000000`00000020 which as we can see above is a completely invalid address. The 1st parameter and cr2 however note we failed writing to address fffff900c25efcf0. This does not make sense, and is essentially not logically possible.

    The hardware was told to write to 00000000`00000020, and the hardware came back and said 'I cannot write to fffff900c25efcf0'. Another way to think about it is if you kindly asked the waiter of your table for more water, he writes it down, but comes back and says 'I'm sorry, but we're all out of coffee'.

    -----------------------

    1. Uninstall any/all installed Asus bloatware, I for example see Asus PC Probe, and AI Suite.

    2. Remove and replace avast! with Microsoft Security Essentials for temporary troubleshooting purposes as it may be causing conflicts:

    avast! removal - http://www.avast.com/uninstall-utility

    MSE -  http://windows.microsoft.com/en-us/windows/security-essentials-download

    3. If the above fails, you have faulty RAM.

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Friday, April 25, 2014 1:18 AM
  • As the title says, lately I've been having blue screens which are mostly caused by wow.

    Previously I've had the occasional bsod (once a month or so) when alt tabbing, but it was pretty rare. However recently, I've had something more like 1 a day, usually caused by alt tabbing out of wow. It seems the longer I'm alt tabbed the more likely it is to happen. I haven't experienced the same problem with any other game, although the occasional monthly ones usually happen when I'm changing my music as I alt tab out of League of Legends.

    I downloaded bluescreenview and it appears the cause is some combination of win32k.sys as well as ntoskrnl.exe             Based off the fact that it is happening more with a more demanding game, I'm guessing the problem is most likely due to a bad stick of ram, but I'd like a second opinion.

    I'll attach a few of the most recent dump files (the one today is slightly different than the ones last week which seems slightly odd).

    http://puu.sh/8lVuH     http://puu.sh/8lVtT      http://puu.sh/8lVse

    Thanks in advance for any help, and I hope image files are okay :)

    Many games are sensitive to alt-tab as the engine is designed to use the DX viewport

    if you quit the game, then you can check messages etc


    Corsair Carbide 300R with window
    Corsair TX850V2 70A@12V
    Asus M5A99FX PRO R2.0 CFX/SLI
    AMD Phenom II 965 C3 Black Edition @ 4.0 GHz
    G.SKILL RipjawsX DDR3-2133 8 GB
    EVGA GTX 6600 Ti FTW Signature 2(Gk104 Kepler)
    Asus PA238QR IPS LED HDMI DP 1080p
    ST2000DM001 & Windows 8.1 Enterprise x64
    Microsoft Wireless Desktop 2000
    Wacom Bamboo CHT470M
    Place your rig specifics into your signature like I have, makes it 100x easier to understand!

    Hardcore Games Legendary is the Only Way to Play!

    Friday, April 25, 2014 1:33 AM

All replies

  • Hi,

    In order to assist you, we will need the .DMP files to analyze what exactly occurred at the time of the crash, etc.

    If you don't know where .DMP files are located, here's how to get to them:

    1. Navigate to the %systemroot%\Minidump folder.

    2. Copy any and all DMP files in the Minidump folder to your Desktop and then zip up these files.

    3. Upload the zip containing the .DMP files to Onedrive or a hosting site of your choice and paste in your reply. Prefered sites: Onedrive, Mediafire, Dropbox, etc. Nothing with wait-timers.

    4 (optional): The type of .DMP files located in the Minidump folder are known as Small Memory Dumps. In %systemroot% there will be what is known as a Kernel-Dump (if your system is set to generate). It is labeled MEMORY.DMP. The difference between Small Memory Dumps and Kernel-Dumps in the simplest definition is a Kernel-Dump contains much more information at the time of the crash, therefore allowing further debugging of your issue. If your upload speed permits it, and you aren't going against any strict bandwidth and/or usage caps, etc, the Kernel-Dump is the best choice. Do note that Kernel-Dumps are much larger in size due to containing much more info, which is why I mentioned upload speed, etc.

    If you are going to use Onedrive but don't know how to upload to it, please visit the following:

    Upload photos and files to Onedrive.

    Please note that any "cleaner" programs such as TuneUp Utilities, CCleaner, etc, by default will delete .DMP files upon use.

    If your computer is not generating .DMP files, please do the following:

    1. Start > type %systemroot% which should show the Windows folder, click on it. Once inside that folder, ensure there is a Minidump folder created. If not, CTRL-SHIFT-N to make a New Folder and name it Minidump.

    2. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Performance > Settings > Advanced > Ensure there's a check-mark for 'Automatically manage paging file size for all drives'.

    3. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Startup and Recovery > Settings > System Failure > ensure there is a check mark next to 'Write an event to the system log'.

    Ensure Small Memory Dump is selected and ensure the path is %systemroot%\Minidump.

    4. Double check that the WERS is ENABLED:

    Start > Search > type services.msc > Under the name tab, find Windows Error Reporting Service > If the status of the service is not Started then right click it and select Start. Also ensure that under Startup Type it is set to Automatic rather than Manual. You can do this by right clicking it, selecting properties, and under General selecting startup type to 'Automatic', and then click Apply.

    If you cannot get into normal mode to do any of this, please do this via Safe Mode.

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Thursday, April 24, 2014 9:52 PM
  • Is that not the same information that I included in the pictures? Anyways, here they are.

    http://www.sendspace.com/file/xfwfr9

    Friday, April 25, 2014 12:48 AM
  • Thanks, and it's not, no. You can't exactly debug pictures :')

    We have two consistent bug checks:

    SYSTEM_SERVICE_EXCEPTION (3b)

    This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.

    This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code.

    BugCheck 3B, {c0000005, fffff80002e5301e, fffff88008945c70, 0}

    0: kd> ln fffff80002e5301e
    (fffff800`02e52ff8)   nt!ExEnterCriticalRegionAndAcquireFastMutexUnsafe+0x26   |  (fffff800`02e53040)   nt!PsIsProtectedProcess
    

    ^^ The exception occurred in nt!ExEnterCriticalRegionAndAcquireFastMutexUnsafe. This is a routine that first enters a critical region, and then acquires the specified fast mutex for the calling thread.

    PAGE_FAULT_IN_NONPAGED_AREA (50)

    This indicates that invalid system memory has been referenced.

    Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).

    Another common cause is the installation of a faulty system service.

    Antivirus software can also trigger this error, as can a corrupted NTFS volume.

    BugCheck 50, {fffff900c25efcf0, 0, fffff9600032c69d, 0}
    

    ^^ Address fffff900c25efcf0 was written to by the instruction at address fffff9600032c69d.

    1: kd> r cr2
    Last set context:
    cr2=fffff900c25efcf0
    

    ^^ The 1st parameter address was stored in cr2 prior to calling the page fault handler.

    1: kd> !pte fffff900c25efcf0
                                               VA fffff900c25efcf0
    PXE at FFFFF6FB7DBEDF90    PPE at FFFFF6FB7DBF2018    PDE at FFFFF6FB7E403090    PTE at FFFFF6FC80612F78
    Unable to get PXE FFFFF6FB7DBEDF90
    

    ^^ Can't see whether or not it's valid/non-valid.

    1: kd> .trap fffff880`073858e0
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000011 rbx=0000000000000000 rcx=fffff900c376ae40
    rdx=00000000701215e6 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff9600032c69d rsp=fffff88007385a70 rbp=0000000000000001
     r8=0000000000000000  r9=0000000000000410 r10=fffff80002e4e000
    r11=0000000000000022 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+0x2d:
    fffff960`0032c69d 488b4f20        mov     rcx,qword ptr [rdi+20h] ds:00000000`00000020=??????????
    

    ^^ On the instruction we failed on, address fffff960`0032c69d deferenced rdi+20h where rdi is 0000000000000000. All of this would result in a memory write to the address 00000000`00000020.

    1: kd> dd 00000000`00000020
    00000000`00000020  ???????? ???????? ???????? ????????
    00000000`00000030  ???????? ???????? ???????? ????????
    00000000`00000040  ???????? ???????? ???????? ????????
    00000000`00000050  ???????? ???????? ???????? ????????
    00000000`00000060  ???????? ???????? ???????? ????????
    00000000`00000070  ???????? ???????? ???????? ????????
    00000000`00000080  ???????? ???????? ???????? ????????
    00000000`00000090  ???????? ???????? ???????? ????????
    

    Right, so the code wanted to write to 00000000`00000020 which as we can see above is a completely invalid address. The 1st parameter and cr2 however note we failed writing to address fffff900c25efcf0. This does not make sense, and is essentially not logically possible.

    The hardware was told to write to 00000000`00000020, and the hardware came back and said 'I cannot write to fffff900c25efcf0'. Another way to think about it is if you kindly asked the waiter of your table for more water, he writes it down, but comes back and says 'I'm sorry, but we're all out of coffee'.

    -----------------------

    1. Uninstall any/all installed Asus bloatware, I for example see Asus PC Probe, and AI Suite.

    2. Remove and replace avast! with Microsoft Security Essentials for temporary troubleshooting purposes as it may be causing conflicts:

    avast! removal - http://www.avast.com/uninstall-utility

    MSE -  http://windows.microsoft.com/en-us/windows/security-essentials-download

    3. If the above fails, you have faulty RAM.

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Friday, April 25, 2014 1:18 AM