BSOD playing Rocket League, ARK

Paulobr02 · 18 Sep 2018

Hello everyone,

I've been facing some issues while playing games for a while and now it is becoming more often. Sometimes when I was playing Rocket League or Albion Online, the entire computer did freeze and I had to force reboot, this was not so frequent and it was something I could deal with. I returned to play ARK 2 weeks ago and until last Tuesday it was running perfectly fine, but now the same freeze is happening to ARK(and also a less heavy game: Two Point Hospital) everytime I try to play, sometimes I cannot even join a game, the PC freezes at the menu itself. I also faced the same issue once using Firefox while navigating through some sites.
It is confusing because most of the times I do not get BSOD, but when I do, I notice that msfs.sys was mentioned but I've seen other errors too.
Then I started to try to reproduce the issue and see what is going on, so I tried stress test softwares against CPU and it went fine. Also against GPU and it went fine, however when I tried to do both at the same time, then I got the same BSOD. Something is wrong and I don't know what.
I've already did GPU and Audio drivers complete removal and clean install, upgraded BIOS firmware to the latest and tried to play these games with very low graphic settings but that didn't help.

So now I've done some research and ended up here on this forum and it seems that now I will find answers :).

I did enable the Driver Verifier(following instructions of Using Driver Verifier to identify issues with Drivers - Windows 7 Help Forums) and tried to reboot my machine, but I got stuck on bootloop but got rid of it. I am attaching the dump file generated(091818-5171-01.dmp).
I am not sure what the other dmp file is about(091718-5906-01.dmp), but I wanted to share it too. Hope it is helpful.

Well that's it, I hope it is clear enough. Thanks in advance for any help with this annoying issue!

Ztruker · 18 Sep 2018

The first thing I noticed is you are way back level. You have Win 10 version 1607/14393 which was released in August of 2016. You need to update to at least the 1709/16299 version though the 1803/17134 version (current) would be better.

See here: Download Windows 10

I suggest creating a flash drive then using it to upgrade to the April 2018 (1803) version by running setup.exe from it while booted in Windows 10.

It would be a very good idea to make an image backup of you system using Macrium Reflect Free to an external hard drive before upgrading so you can easily and quickly get back to where you are if something goes wrong.

The 9/18 dump shows a problem with WmBEnum.sys.

Code:

ffffdf81`1c0ad048  fffff804`dc6001f0Unable to load image \SystemRoot\system32\drivers\WmBEnum.sys, Win32 error 0n2
*** ERROR: Module load completed but symbols could not be loaded for WmBEnum.sys
 WmBEnum+0x1f0

Driver Description: Logitech WingMan Virtual Bus Enumerator Driver
Driver Update Site: https://support.logitech.com/en_us/s...umerator&t=All

Look for a newer driver for the Joystick or replace it and see if that helps.

Paulobr02 · 19 Sep 2018

Hello Ztruker

Thanks so much for your help.
I've done what you suggested and also did reset the Windows(kept files only) so I could remove Logitech driver and also other drivers which could be causing issues.
After the Windows got reset, I updated to the latest version(1803/17134) as you said. I only installed Nvidia drivers after that and few other softwares.
Unfortunately the issue is still happening so I executed the Driver Verifier again and got stuck on bootloop due to BSOD. It showed rzendpt.sys as the problematic driver but only at the first time, all the other BSODs I had in boot did not show anything except "DRIVER VERIFIER DETECTED VIOLATION". After that I executed the Log Detector again and uploaded the results here.

Any suggestions?
Really appreciate your assistance!

Ztruker · 19 Sep 2018

Would you run the beta log collector and post it's zip file please. It collects a lot of additional data which may be helpful. The latest dump is useless as it has problems with symbol resolution for some reason.

See Blue Screen of Death (BSOD) Posting Instructions , the beta collector link is at the bottom called log collector v2-beta15.zip.

Paulobr02 · 19 Sep 2018

Sure, please find it attached.

Ztruker · 19 Sep 2018

There should be a full memory dump in C:\WINDOWS\MEMORY.DMP. Please zip it and upload to a file sharing site like Microsoft's OneDrive. It's 286MB so will take you a while to upload it. Post a link to it here so I can download it to look at it with windbg once the upload completes.

Crash dump found at C:\WINDOWS\MEMORY.DMP
Creation date: 09/19/2018 15:56:12
Size on disk: 286 MB

Thanks.

Paulobr02 · 19 Sep 2018

Sure, check if you can access: Microsoft OneDrive - Access files anywhere. Create docs with free Office Online.

Ztruker · 19 Sep 2018

Yes, downloaded the dump file, thanks.

There is something screwy with your operating system. Getting symbols are WRONG errors.

It did mention rzendpt.sys, which is your Razer RzEndPt driver. You could uninstall the Razer mouse and try a different one, see if that makes a difference

Code:

BugCheck C4, {2000, fffff802ece126e5, 0, 6e657a72}

*** ERROR: Module load completed but symbols could not be loaded for rzendpt.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_EPROCESS                                  ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPCR                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KTHREAD                                   ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
Probably caused by : ntoskrnl.wrong.symbols.exe ( nt_wrong_symbols!5B9C6BE1953000 )

Are you over clocking CPU or memory? If so, put everything back to nominal and test.

Paulobr02 · 19 Sep 2018

Yeah I noticed those drivers got installed automatically. I did remove them completely and tested another mouse and the issue remains on Ark and even stress testing GPU/CPU. Any idea what are these wrong symbols?

No, actually I have never tried overclocking.. My BIOS settings are all auto and most of the functions like cool'n'quiet, C6 were all active and I did disable everything thinking that maybe that could be the issue(some conflict on Bios vs CPU or GPU level) but that also didn't make difference.

Not sure if it will help, but I will let memtest86 running tests overnight and see if anything shows up. Will post here tomorrow.

This issue is really frustrating. Let me know if I should try anything else.
Thanks for the help!

Ztruker · 20 Sep 2018

I don't know what is wrong with your OS but there should not be all those problems with symbols in the dumps you've uploaded, both the mini dump and the full dump. You native language is Portuguese (Brazil) but that shouldn't matter or at least it has never caused a symbol problem before.

I'll ask some of the other BSOD folk, see what they think.

Running memtest86 overnight is a good idea though. Can't hurt and may find something.

Would also be good to look at your hard drives (120GB SSD and 2TB HDD) with Crystal Disk Info (Portable) , see what it reports. (DuckDuckGo is a safe site to download from).

On my system, CDI looks like this:

Attachment 204919 Attachment 204920