[SOLVED] Bsod help

[Doomvor]

So i just recently reformatted my hdd due to bluescreens from "attempted_switch_from_dpc" and started using an ssd , i have recently encountered the error again but it seems to only happen when i am using discord, any idea what could be causing this, i am thinking it might be my sound card drivers (as i am using a now discontinued sound blaster recon3di).

I can provide a few dmp files if necessary as well as any other information that could be helpful.

I am using a fairly outdated mobo (g1. sniper z97 with a 4790k and a 5700xt) I've done all the normal tests such as memory and chkdsk scans as well as dism and have come up with no irregularities.

It happens more often when i am streaming/watching a stream on discord but does happen every now and again when just using discord in general. I've narrowed it down to basically discord being the culprit but i am unsure as to why it is the culprit.

Sometimes it happens when i'm playing a game, sometimes it just happens randomly, it's not very consistent.

the dmp files indicate the issue is possibly all over the place (its indicated ndis.sys or ntkrnlmp.exe on different occasions), it makes no real sense to me.

https://1drv.ms/u/s!Anwg_zGu6cDVhiMbPXgPnfyUbt9t?e=iv5Xh5
This is a onedrive of my most recent minidump of the bluescreen due to edf5.exe while i was streaming on discord.

Any assistance would be greatly appreciated, thank you.

 

[gardenman]

Hi, I ran the dump file through the debugger and got the following information: https://jsfiddle.net/jcherfod/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

File information:	022221-5421-01.dmp (Feb 22 2021 - 01:21:38)
Bugcheck:	ATTEMPTED_SWITCH_FROM_DPC (B8)
Probably caused by:	ntkrnlmp.exe (Process: EDF5.exe)
Uptime:	0 Day(s), 7 Hour(s), 43 Min(s), and 34 Sec(s)

Possible Motherboard page: https://www.gigabyte.com/us/Motherboard/G1Sniper-Z97-rev-1x
There's is 1 BIOS update but it's unlikely to help you. Wait for additional information before deciding to update or not. Important: Verify that I have linked to the correct motherboard. Updating your BIOS can be risky. Never try it when you might lose power (lightning storms, recent power outages, etc).

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Doomvor]

Just to confirm, that is the correct motherboard. Thank you.

 

[Colif]

that is an unusual error, i am not sure i seen it before

my initial reaction to unusual errors is check ram
Try running memtest86 on each of your ram sticks, one stick at a time, up to 4 passes. Only error count you want is 0, any higher could be cause of the BSOD. Remove/replace ram sticks with errors.
Memtest is created as a bootable USB so that you don’t need windows to run it

i can see error relating to lan drivers (i was hoping it wouldn't s finding newer Killer drivers might be difficult)

 

[Doomvor]

I'll try the memtest next chance i get, in the mean time i was watching a video on youtube and got a bsod with the same error (attempted_switch_from_dpc)

https://1drv.ms/u/s!Anwg_zGu6cDVhiUkq0rmvdgTz0D1?e=mR1g4x
the following is another dmp file i've uploaded to onedrive pointing towards the probable cause of ntkrnlmp.exe which is pointing towards process chrome.exe

I will try the memtest and report back, thank you.

 

[Colif]

weird, I typed it as unusual but forums said Usual error...

I will ask a friend to convert dumps.

 

[Doomvor]

I have run the memtest and everything came back clean, no issues.

 

[Colif]

Chrome is victim not cause

very rarely are BSOD caused by exe files.

i have to go for a few hours but will reply once friend looks at dumps

 

[gardenman]

I ran the dump file through the debugger and got the following information: https://jsfiddle.net/v1omqgb9/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

File information:	022321-5437-01.dmp (Feb 23 2021 - 05:09:31)
Bugcheck:	ATTEMPTED_SWITCH_FROM_DPC (B8)
Probably caused by:	ntkrnlmp.exe (Process: chrome.exe)
Uptime:	0 Day(s), 22 Hour(s), 55 Min(s), and 52 Sec(s)

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Doomvor]

i can see error relating to lan drivers (i was hoping it wouldn't s finding newer Killer drivers might be difficult)

Could this be a probable cause?
My mobo has a built in E2200 which isn't updated on the regular anymore.
The thought crossed my mind to remove the killer networking software, wipe the item in device manager and reinstall it with the files from gigabytes website. (or maybe run it with the auto-install drivers that windows installs when it detects the hardware as that was what i had to do before due to a bunch of non-paged pool memory leak nonsense due to the killer network manager stuff)

The blue screens seem random, sometimes they happen within hours, sometimes within days, other times within weeks, but there is decent amounts of network traffic when it happens.

As far as I was aware Attempted_Switch_From_DPC is sometimes caused by driver issues.

So my only thoughts are that it could be a corrupted windows installation or bad network drivers, i usually keep my drivers as up to date as i possibly can, perhaps one of the newer drivers for the network card (developed by microsoft and not rivet) doesn't mesh well with my setup?

I'm more throwing out possibilities rather than saying these are the case. I'm fairly stumped on this issue and have been working for a few months to try and pin down the problem.

To preface, I've had this build for 5 years (aside from the 5700 xt) and didn't have any issues with blue screens until around the beginning of 2020, but they were sparse and intermittent so it didn't really bother me (they happened maybe once every 4 months), but now that i've moved over to an SSD and reinstalled windows, the bsods have been anywhere from every few hours to every week (i've had this current setup since the start of 2021), so the only thing i can think of is that a more up to date driver i have installed since the reformat is causing the issue, the network card possibly being the prime suspect, but that's just supposition as i am not certain of the actual cause.

I did get an ndis.sys bsod a week or so ago (also attempted_switch_from_dpc) but it pointed towards ndis.sys instead of the current ntkrnlmp.exe

https://1drv.ms/u/s!Anwg_zGu6cDVhiHUaFnAOqb9Y_Vw?e=Yja743
this is a one drive for the ndis.sys error i got 2 weeks ago btw, not sure if it would illuminate any issues.

 

[Doomvor]

Quick update,
Received another bluescreen this morning, this time it was ndis.sys pointing towards system as the process. I do have the minidump if it would be useful.

https://1drv.ms/u/s!Anwg_zGu6cDVhiap2yBXeUJOKiFb?e=bfy1Tg
One drive of the most recent minidump

I'm convinced it's more than likely my network drivers but finding "up to date" drivers for the E2200 is damn near impossible and i have no idea where i would even start since killer support page gives me a link to the update catalog that has 19 different options of the same driver.

I have also noticed an abnormal amount of paged pool memory when windows installs an update via windows update.
Goes to about 1.2gb or higher for paged pool memory when using windows update. But i'm not too worried about that part until after i fix the current bsods

Thanks once again for any assistance.

Update
I ran a few more chkdsk on my HDD and SSD, no errors found on either (ran them a few times to be sure), then ran a few sfc scans which found a few errors (on the first pass) and was able to repair them, it created a log file but i don't see which files it repaired in the log file, testing to see if i can reproduce the bluescreen under similar environments as before.

 

[gardenman]

I think @Colif might have missed the last reply. I think I did too. There are issues with the forum sometimes not notifying people of new posts. Anyway, he might reply later today.

I ran the 2 new dump files through the debugger and got the following information: https://jsfiddle.net/L974zme8/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

Spoiler: Dump File Results

File information:	022821-5421-01.dmp (Feb 28 2021 - 07:39:42)
Bugcheck:	ATTEMPTED_SWITCH_FROM_DPC (B8)
Probably caused by:	ndis.sys (Process: System)
Uptime:	0 Day(s), 14 Hour(s), 56 Min(s), and 06 Sec(s)

File information:	020921-8781-01.dmp (Feb 9 2021 - 22:41:21)
Bugcheck:	ATTEMPTED_SWITCH_FROM_DPC (B8)
Probably caused by:	ndis.sys (Process: System)
Uptime:	0 Day(s), 22 Hour(s), 58 Min(s), and 32 Sec(s)

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Doomvor]

Something i immediately noticed from the dump is that the driver is an E2400 driver (these are the drivers windows auto-installs when detecting the hardware) instead of an E2200, that might be a likely culprit. Although again, as i elaborated before i have no idea where to find E2200 drivers anymore or even if it would fix the issue.

And no worries, I've tried to do a little bit on my own but I haven't been able to fix the issue, I appreciate the time and effort that is spent helping me with my problem.

 

[Colif]

ndis mentioned in last 2 bsod is Network Driver Interface Service
Chrome crashing. ug more indication it is Killer...

its possible the drivers you have are for several different models as the description for driver package in next link includes E2400 among others.

did you try this? https://support.killernetworking.com/download/killer-software-package-windows-10-1803/ as its dated Jan 2021 but likely has older drivers in it.

sorry I am slow. Have a headache today so lucky I am even trying

 

[Doomvor]

I have just recently installed it and will report back in a few days whether or not I have received a bluescreen.

I had to remove it in the past due to some non-paged pool memory leaks (before the reformat) and managed to get the system to work so the thought didn't cross my mind to try the software package again.

Thank you again for the assistance.

 

[Doomvor]

Just had a bluescreen so that wasn't the issue this time.

I received an "attempted switch from dpc" bluescreen, pointing towards win32kbase.sys with the possible offending process being atieclxx.exe (part of my amd video drivers i believe)

here is the minidump for it
https://1drv.ms/u/s!Anwg_zGu6cDVhiqb7uZ5V6YB_Mam?e=mCXRdY

 

[gardenman]

I ran the dump file through the debugger and got the following information: https://jsfiddle.net/rekmdg12/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

File information:	030321-5593-01.dmp (Mar 3 2021 - 08:13:22)
Bugcheck:	ATTEMPTED_SWITCH_FROM_DPC (B8)
Probably caused by:	win32kbase.sys (Process: atieclxx.exe)
Uptime:	2 Day(s), 11 Hour(s), 25 Min(s), and 15 Sec(s)

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Colif]

so the process that crashed is made by AMD so it has to be part of the GPU drivers since you have a Intel CPU.

dpc = deferred procedure call (just cause I know what it means doesn't mean I know what it is)
not exactly sure what cause of it is, its not obvious
could be the next oldest driver (since we upgraded Killer)

Dec 01 2016

cthda.sys

Sound Blaster HD Audio driver (Creative Technology Ltd)

what Creative soundcard do you have?
everything after that is either Intel and likely okay, or made in 2020. Age doesn't always mean anything though.

 

[Doomvor]

I have the sound blaster recon3di drivers installed

The motherboard has an "Onboard Creative Sound Core3D™ quad-core audio processor"

I went and checked my audio drivers after you mentioned them and noticed that I had 2 sets of sound blaster recon3di drivers installed, I've since reinstalled my audio drivers (removing the duplicates)

I've also taken a look at my "reliability monitor" and noticed that my audio drivers crash at least twice just before the bluescreen typically occurs.

 

[Colif]

lets see if the duplicate drivers were cause

wonder how your Creative drivers are newer than the ones on their site - https://support.creative.com/Produc...dID=20885&prodName=Sound Blaster Recon3D PCIe

can you tell me what driver number you on? it should show that in device manager.

 

[Doomvor]

I am using 6.0.101.1043 (11/9/2015) (this is a driver that the device manager updates to when I "update driver" in the device manager for the device). At which point the "update driver" claims my drivers are up to date on future checks.

I assume it might be a hardware compatibility driver from microsoft.

 

[Colif]

thats a copy of the 2015 driver that was given to Microsoft for testing by Creative.
so it is same one, just different dates.

lets see if it crashes now you removed the duplicate.

 

[Doomvor]

I'll write back in a few days or the next time I bluescreen, whichever comes first.

Thank you for your help.

 

[Doomvor]

just had a bluescreen with the following error

Kernel_security_check_failure bsod

says csrss.exe was the issue with a point towards sshid.sys (i believe this is my steelseries keyboard)

Here is the one drive of my bluescreen
https://1drv.ms/u/s!Anwg_zGu6cDVhivzdpuEjJVxgAB6?e=LOR0Oh

 

[gardenman]

I ran the dump file through the debugger and got the following information: https://jsfiddle.net/tcu4vnwe/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

File information:	030421-5546-01.dmp (Mar 4 2021 - 12:08:02)
Bugcheck:	KERNEL_SECURITY_CHECK_FAILURE (139)
Driver warnings:	*** WARNING: Unable to verify timestamp for sshid.sys
Probably caused by:	sshid.sys (Process: csrss.exe)
Uptime:	1 Day(s), 1 Hour(s), 49 Min(s), and 53 Sec(s)

Crashing driver:

Oct 06 2020

sshid.sys

SteelSeries Engine HID driver https://steelseries.com/

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.