Question I'm getting BSODs more often than usual now, so I am getting worried ?

[iamchax]

I have been getting BSODs more frequently the past few months and I am getting worried about being unable to fix them. Some of them did not save because the dumps were having issues but that was resolved with sfc /scannow (since that founds some problems and resolved them). I also tried DISM but that found no issues and I cannot recall when some of the BSODs even happened.

I remember some of the errors being (I may have had others but I can't remember):
PAGE FAULT IN NONPAGED AREA
DPC WATCHDOG VIOLATION

I noticed that a lot of them happened when I was playing 'Lost Ark' which has Easy Anti-Cheat so it may have something to do with that?

I also noticed this error before the crash (which I have seen prior to a previous bluescreen but could be unrelated):

" The driver \Driver\WudfRd failed to load for the device ROOT\DISPLAY\0000 "

Anyway here is the minidump: https://www.mediafire.com/file/f5tows7qtym2yh1/101624-12750-01.dmp/file

 

[Lutfij]

Using WinDBG, this shows up as the trigger;
EasyAntiCheat_EOS.sys
Try and reinstall the game or exclude Easy-anticheat from your system using this poster's advice.

 

[ubuysa]

As above, EastAntiCheat is your problem. You're not the first to have issues with an anti-cheat tool and I doubt you'll be the last.

From the dump...

FAILURE_BUCKET_ID:  AV_R_(null)_EasyAntiCheat_EOS!unknown_function

You can't fix this yourself, I would go to the Easy support page and log the problem.

 

[iamchax]

Will that pull out logs of the previous crash or will I have to wait for it to happen again? Is there also no way to contact EAC themselves? I can't find a way!

 

[iamchax]

ok i tried using the process monitor they said to use on their support page and followed the steps but EAC closes when I even use the process monitor so I can't collect any logs...

EDIT: Nvm it works after I launch the game first, time to collect logs for now. I also enabled 'Core isolation' on Win10 (it was disabled because of a bunch of incompatible drivers which I removed) and will check to see if that works!

 

[KingLoki]

Does the anticheat process run every bootup or only when the game starts?

 

[iamchax]

Does the anticheat process run every bootup or only when the game starts?

only when the game starts

 

[KingLoki]

Will the game run without it?

 

[iamchax]

Will the game run without it?

nope as it will close if EAC is closed

 

[johnbl]

I think the anticheat software was a victim of a stack corruption. I would start fixing the various other problems your system has.


you can down load microsoft autoruns from here:
https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
get it and run it. find the driver entry that shows this path:
C:\Program Files\Corsair\Corsair Device Control Service\bin\CorsairLLAccess64.sys Mon Feb 5 01:17:49 2024
and delete the entry. (or you can uninstall that version and the entry will go away if the uninstaller works correctly)
do this because you have two copies of the same driver loaded from different directories. This happens if a vendor changes the directory structure on a new build but you don't delete the old program before you install the new one.
this shows up in the debugger as something like this
CorsairLLAccess64 \??\C:\Program Files\Corsair\Corsair iCUE5 Software\CorsairLLAccess64.sys Thu Jul 25 00:15:07 2024 (66A1FB7B)
CorsairLLAccess64_fffff801e4a50000 \??\C:\Program Files\Corsair\Corsair Device Control Service\bin\CorsairLLAccess64.sys Mon Feb 5 01:17:49 2024 (65C0A7BD)

windows adds a postfix number like this _fffff801e4a50000 one when the driver collides in memory with another driver.
find and delete the oldest entry called CorsairLLAccess64_fffff801e4a50000 using autoruns.

second problem is this
\SystemRoot\system32\DRIVERS\cfosspeed6.sys Mon Jun 7 01:17:37 2021
just delete this you do not need it and it can cause issues.

you should use autoruns and disable this entry:
C:\Program Files (x86)\MSI\One Dragon Center\Mystic_Light\Lib\NTIOLib_X64.sys Sun Jul 9 19:13:57 2017
(or look for a update, it might control your light but it has same name as the overclock tool., if you update, be sure to remove the old copy first, as the setup program does not do the uninstall of the old driver)

other issues but I have to run for a few mins
many of your windows core files have been modified:
you will want to start cmd.exe as an admin, then run
sfc.exe /scannow
then run
DISM.exe /Online /Cleanup-Image /RestoreHealth

Using DISM to Check and Repair Windows Image | Windows OS Hub

You can use the SFC (System File Checker) and DISM (Deployment Image Servicing and Management) commands to check and repair the integrity of system files and Component Store of your…

woshub.com

you should decide if you want this driver installed:
\SystemRoot\system32\DRIVERS\npcap.sys Wed Jan 17 14:48:37 2024
i think it is a network packet capture driver. sometimes used to hack machines, sometimes used by malware to insert ads, sometimes used with game cheat software. Guess there are other uses but it can insert data and might cause corruption. You should know it is on your system.

you also have some very old 2010 era usb drivers that could cause various problems since all of the various usb specfication updates over the years.
these drivers were:
\SystemRoot\system32\drivers\SiLib.sys Thu Jul 15 15:08:26 2010
and
SystemRoot\system32\drivers\SiUSBXp.sys Thu Jul 15 15:27:13 2010
you will have to decide why they are on your system. You can uninstall them or use autoruns and disable them.
you can reenable them if you need them.

BIOS Release Date 11/19/2019
Manufacturer ASUSTeK COMPUTER INC.
Product PRIME X570-PRO

try some of these fixes and reboot and see if you still get a bugcheck

 

[iamchax]

I think the anticheat software was a victim of a stack corruption. I would start fixing the various other problems your system has.


you can down load microsoft autoruns from here:
https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
get it and run it. find the driver entry that shows this path:
C:\Program Files\Corsair\Corsair Device Control Service\bin\CorsairLLAccess64.sys Mon Feb 5 01:17:49 2024
and delete the entry. (or you can uninstall that version and the entry will go away if the uninstaller works correctly)
do this because you have two copies of the same driver loaded from different directories. This happens if a vendor changes the directory structure on a new build but you don't delete the old program before you install the new one.
this shows up in the debugger as something like this
CorsairLLAccess64 \??\C:\Program Files\Corsair\Corsair iCUE5 Software\CorsairLLAccess64.sys Thu Jul 25 00:15:07 2024 (66A1FB7B)
CorsairLLAccess64_fffff801e4a50000 \??\C:\Program Files\Corsair\Corsair Device Control Service\bin\CorsairLLAccess64.sys Mon Feb 5 01:17:49 2024 (65C0A7BD)

windows adds a postfix number like this _fffff801e4a50000 one when the driver collides in memory with another driver.
find and delete the oldest entry called CorsairLLAccess64_fffff801e4a50000 using autoruns.

second problem is this
\SystemRoot\system32\DRIVERS\cfosspeed6.sys Mon Jun 7 01:17:37 2021
just delete this you do not need it and it can cause issues.

you should use autoruns and disable this entry:
C:\Program Files (x86)\MSI\One Dragon Center\Mystic_Light\Lib\NTIOLib_X64.sys Sun Jul 9 19:13:57 2017
(or look for a update, it might control your light but it has same name as the overclock tool., if you update, be sure to remove the old copy first, as the setup program does not do the uninstall of the old driver)

other issues but I have to run for a few mins
many of your windows core files have been modified:
you will want to start cmd.exe as an admin, then run
sfc.exe /scannow
then run
DISM.exe /Online /Cleanup-Image /RestoreHealth

Using DISM to Check and Repair Windows Image | Windows OS Hub

You can use the SFC (System File Checker) and DISM (Deployment Image Servicing and Management) commands to check and repair the integrity of system files and Component Store of your…

woshub.com

you should decide if you want this driver installed:
\SystemRoot\system32\DRIVERS\npcap.sys Wed Jan 17 14:48:37 2024
i think it is a network packet capture driver. sometimes used to hack machines, sometimes used by malware to insert ads, sometimes used with game cheat software. Guess there are other uses but it can insert data and might cause corruption. You should know it is on your system.

you also have some very old 2010 era usb drivers that could cause various problems since all of the various usb specfication updates over the years.
these drivers were:
\SystemRoot\system32\drivers\SiLib.sys Thu Jul 15 15:08:26 2010
and
SystemRoot\system32\drivers\SiUSBXp.sys Thu Jul 15 15:27:13 2010
you will have to decide why they are on your system. You can uninstall them or use autoruns and disable them.
you can reenable them if you need them.

BIOS Release Date 11/19/2019
Manufacturer ASUSTeK COMPUTER INC.
Product PRIME X570-PRO

try some of these fixes and reboot and see if you still get a bugcheck

oh wow, alright i will give all this a try tomorrow and report on it later!

 

[ubuysa]

Will that pull out logs of the previous crash or will I have to wait for it to happen again? Is there also no way to contact EAC themselves? I can't find a way!

I gave you the link! https://www.easy.ac/en-US/support

 

[iamchax]

I gave you the link! https://www.easy.ac/en-US/support

I saw but they only let you submit appeals if you are banned and the support logs just tells you how to collect them.

 

[iamchax]

I think the anticheat software was a victim of a stack corruption. I would start fixing the various other problems your system has.


you can down load microsoft autoruns from here:
https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
get it and run it. find the driver entry that shows this path:
C:\Program Files\Corsair\Corsair Device Control Service\bin\CorsairLLAccess64.sys Mon Feb 5 01:17:49 2024
and delete the entry. (or you can uninstall that version and the entry will go away if the uninstaller works correctly)
do this because you have two copies of the same driver loaded from different directories. This happens if a vendor changes the directory structure on a new build but you don't delete the old program before you install the new one.
this shows up in the debugger as something like this
CorsairLLAccess64 \??\C:\Program Files\Corsair\Corsair iCUE5 Software\CorsairLLAccess64.sys Thu Jul 25 00:15:07 2024 (66A1FB7B)
CorsairLLAccess64_fffff801e4a50000 \??\C:\Program Files\Corsair\Corsair Device Control Service\bin\CorsairLLAccess64.sys Mon Feb 5 01:17:49 2024 (65C0A7BD)

windows adds a postfix number like this _fffff801e4a50000 one when the driver collides in memory with another driver.
find and delete the oldest entry called CorsairLLAccess64_fffff801e4a50000 using autoruns.

second problem is this
\SystemRoot\system32\DRIVERS\cfosspeed6.sys Mon Jun 7 01:17:37 2021
just delete this you do not need it and it can cause issues.

you should use autoruns and disable this entry:
C:\Program Files (x86)\MSI\One Dragon Center\Mystic_Light\Lib\NTIOLib_X64.sys Sun Jul 9 19:13:57 2017
(or look for a update, it might control your light but it has same name as the overclock tool., if you update, be sure to remove the old copy first, as the setup program does not do the uninstall of the old driver)

other issues but I have to run for a few mins
many of your windows core files have been modified:
you will want to start cmd.exe as an admin, then run
sfc.exe /scannow
then run
DISM.exe /Online /Cleanup-Image /RestoreHealth

Using DISM to Check and Repair Windows Image | Windows OS Hub

You can use the SFC (System File Checker) and DISM (Deployment Image Servicing and Management) commands to check and repair the integrity of system files and Component Store of your…

woshub.com

you should decide if you want this driver installed:
\SystemRoot\system32\DRIVERS\npcap.sys Wed Jan 17 14:48:37 2024
i think it is a network packet capture driver. sometimes used to hack machines, sometimes used by malware to insert ads, sometimes used with game cheat software. Guess there are other uses but it can insert data and might cause corruption. You should know it is on your system.

you also have some very old 2010 era usb drivers that could cause various problems since all of the various usb specfication updates over the years.
these drivers were:
\SystemRoot\system32\drivers\SiLib.sys Thu Jul 15 15:08:26 2010
and
SystemRoot\system32\drivers\SiUSBXp.sys Thu Jul 15 15:27:13 2010
you will have to decide why they are on your system. You can uninstall them or use autoruns and disable them.
you can reenable them if you need them.

BIOS Release Date 11/19/2019
Manufacturer ASUSTeK COMPUTER INC.
Product PRIME X570-PRO

try some of these fixes and reboot and see if you still get a bugcheck

-I removed the second installations of corsair, I previously thought I had removed old entries using a third-party residual uninstaller but I guess it missed some. Corsair software gave me a massive headache earlier this year with each update reinstalling to a new location (they do not know how to properly handle software).
-I removed the cfospeed after uninstalling all MSI programs (since I don't use em) so I also removed that msi dragon center program as well
-npcap.sys is a tool I intentionally installed for use with virtual machines as I use them for classes or general knowledge and it was required for em so I will keep it for now but I can delete later if I ever get sick of it.
- I am not sure why SiLib.sys of SiUSBXp.sys are on my system nor can I even find them in the autorun to remove (manually removing won't work either).
-I ran sfc.exe /scannow prior to this recent blue screen as dumps weren't being created and it found errors then which it corrected and dump files were working again. Just to be safe I ran it right before replying and it found no issues
-I ran DISM.exe /Online /Cleanup-Image /RestoreHealth and it completed successfully

Right now I am currently concerned about SiLib and siUSBxp as its possible they could have caused issues but I could use some help removing them. I found so many unused registry keys and other entries from programs I didn't have installed anymore so I cleaned up a lot of junk (man I had so much mess built up over time I guess my pc got sick of it).

 

[ubuysa]

I saw but they only let you submit appeals if you are banned and the support logs just tells you how to collect them.

You're right, my mistake. In that case contact the game vendor that EasyAntiCheat came with.

BTW. Cleaning the registry is a waste of time and potentially dangerous. The Windows registry doesn't need cleaning and removing redundant entries does nothing useful. Removing entries that you think are redundant (or which some registry cleaning tool flags as redundant) but which aren't is dangerous.