Bluescreen error when ALT+Tabbing out of full-screen games and when quitting full-screen games

Hi Jack,

The attached DMP file is of the PAGE_FAULT_IN_NONPAGED_AREA (50) bug check.

This indicates that invalid system memory has been referenced.

Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).

Another common cause is the installation of a faulty system service.

Antivirus software can also trigger this error, as can a corrupted NTFS volume.

If we take a look at the call stack:

0: kd> kb
RetAddr           : Args to Child                                                           : Call Site
fffff800`033041e4 : 00000000`00000050 fffff900`c2ccdd78 00000000`00000000 fffff880`0c522340 : nt!KeBugCheckEx
fffff800`03282fee : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x42907
fffff960`00762142 : 00000000`3c4b0000 fffff880`0c522700 fffff880`0c522980 fffff960`00761f2a : nt!KiPageFault+0x16e
fffff960`00768cfe : 00000000`00000000 fffff880`0c522d60 fffff880`0c522aa8 00000000`00000000 : cdd!CDDMULTISURFLOCK::vInit+0x1aa
fffff960`00769ffb : 00000000`00000000 fffff900`c2886c18 fffff900`c72a9908 00000000`00000000 : cdd!BitBltBitmap+0x1ca
fffff960`0076b008 : 00000000`00000000 fffff800`03292d64 00000000`00000000 00000000`00000000 : cdd!DrvBitBlt+0x17b
fffff960`002ac07b : fffffa80`065d1bc8 00000000`00000000 00000000`00000000 00000000`00000001 : cdd!DrvCopyBits+0x44
fffff960`001f1544 : 00000000`00000000 00000000`00000000 00000000`0000cccc 00000000`00000000 : win32k!OffCopyBits+0xc7
fffff960`001f19d8 : fffff900`c2886c18 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!SpBitBlt+0x418
00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!SpCopyBits+0x44

We have various cdd function calls. cdd.dll is the Canonical Display Driver from Microsoft, it's a system file. The first function, DrvCopyBits, translates between device-managed raster surfaces and GDI standard-format bitmaps. The next function, DrvBitBlt, provides general bit-block transfer capabilities between device-managed surfaces, between GDI-managed standard-format bitmaps, or between a device-managed surface and a GDI-managed standard-format bitmap.

-----------------------------------------

A surface is managed by a particular output device, rather than by the Graphics Engine (kernel-mode GDI). There are two types of device-managed surfaces: standard format bitmap and nonstandard-format surfaces.

- A standard-format bitmap can be either opaque or nonopaque. These terms indicate whether GDI has information about the location and format of the bitmap. For a standard-format bitmap that is opaque, the display driver must handle all rendering tasks done on the surface. For a standard-format bitmap that is nonopaque, the display driver handles some rendering tasks, and can refer others back to GDI.

 - A display driver calls on GDI to create a nonstandard-format surface. After creating the surface, GDI returns a surface handle to the display driver, which must carry out all subsequent operations pertaining to the surface. One type of nonstandard-format surface is the device-dependent bitmap (DIB), which is supported to allow drivers such as the VGA driver perform faster bitmap-to-screen block transfers.

-----------------------------------------

Then, we have a BitBltBitmap function call which performs a bit-block transfer of the color data corresponding to a rectangle of pixels from the specified source device context into a destination device context. Directly afterwards, we have a lock. Essentially what happened was you tabbed out of your game, the display driver called on GDI to create a nonstandard-format surface, but there was a lock. What caused this lock? Let's find out.

-----------------------------------------

1. First off, Update to Service Pack 1 ASAP: http://windows.microsoft.com/en-us/windows7/install-windows-7-service-pack-1

2. Remove and replace AVG with Microsoft Security Essentials for temporary troubleshooting purposes:

AVG removal tool - http://www.avg.com/us-en/utilities

MSE -  http://windows.microsoft.com/en-us/windows/security-essentials-download

3. Remove your Asus AI Suite software via the Control Panel. It's very buggy bloatware.

4.

SiLib.sys - Tue Feb 06 18:13:54 2007

^^ Silicone Labs USBXpress Development Kit, dated from 2007. Find an update for this software or remove the software and/or device if not available - http://www.silabs.com/SUPPORT/Pages/default.aspx

5. Finally, if you're still crashing after all of the above, enable Driver Verifier to look for further corruption:

Driver Verifier:

What is Driver Verifier?

Driver Verifier is included in Windows 8, 7, Windows Server 2008 R2, Windows Vista, Windows Server 2008, Windows 2000, Windows XP, and Windows Server 2003 to promote stability and reliability; you can use this tool to troubleshoot driver issues. Windows kernel-mode components can cause system corruption or system failures as a result of an improperly written driver, such as an earlier version of a Windows Driver Model (WDM) driver.

Essentially, if there's a 3rd party driver believed to be at issue, enabling Driver Verifier will help flush out the rogue driver if it detects a violation.

Before enabling Driver Verifier, it is recommended to create a System Restore Point:

Vista - START | type rstrui - create a restore point
Windows 7 - START | type create | select "Create a Restore Point"
Windows 8 - http://www.eightforums.com/tutorials/4690-restore-point-create-windows-8-a.html

How to enable Driver Verifier:

Start > type "verifier" without the quotes > Select the following options -

1. Select - "Create custom settings (for code developers)"
2. Select - "Select individual settings from a full list"
3. Check the following boxes -
- Special Pool
- Pool Tracking
- Force IRQL Checking
- Deadlock Detection
- Security Checks (Windows 7 & 8)
- DDI compliance checking (Windows 8)
- Miscellaneous Checks
4. Select  - "Select driver names from a list"
5. Click on the "Provider" tab. This will sort all of the drivers by the provider.
6. Check EVERY box that is [B]NOT[/B] provided by Microsoft / Microsoft Corporation.
7. Click on Finish.
8. Restart.

Important information regarding Driver Verifier:

- If Driver Verifier finds a violation, the system will BSOD.

- After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will flag it, and as stated above, that will cause / force a BSOD.

If this happens, do not panic, do the following:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > type "system restore" without the quotes.

- Choose the restore point you created earlier.
If you did not set up a restore point, do not worry, you can still disable Driver Verifier to get back into normal Windows:

- Start > Search > type "cmd" without the quotes.

- To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.
・    Restart and boot into normal Windows.

How long should I keep Driver Verifier enabled for?

It varies, many experts and analysts have different recommendations. Personally, I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier.

My system BSOD'd, where can I find the crash dumps?

They will be located in %systemroot%\Minidump

Any other questions can most likely be answered by this article:
http://support.microsoft.com/kb/244617

Regards,

Patrick

Hi again,

Really appreciated your quick and thorough answer!
Although I carried out all of your suggestions (apart from using the 'driver verifier' tool) and I recieved a different BBCode, this time 3b:

Problem signature
Problem Event Name:    BlueScreen
OS Version:    6.1.7600.2.0.0.256.1
Locale ID:    2057

Files that help describe the problem
121513-32151-01.dmp
sysdata.xml
WERInternalMetadata.xml

Extra information about the problem
BCCode:    3b
BCP1:    00000000C0000005
BCP2:    FFFFF960002DC9ED
BCP3:    FFFFF88004073110
BCP4:    0000000000000000
OS Version:    6_1_7600
Service Pack:    0_0
Product:    256_1

Here is another Sky Drive link to those files relating to this particular instance?
Is there any correlation between the two events? are the errors the same? or am I recieving two different errors?

Thanks again,

Jack

Hi Jack,

The attached DMP file is of the SYSTEM_SERVICE_EXCEPTION (3b) bug check.

This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.

This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code.

--------------------

1. You did not update to Service Pack 1.

2. I still see AVG present in the loaded modules list. Did you run the removal tool?

3. I still see Asus' Ai Suite present.

4. Silicone Labs USBXpress Development Kit is still present as well, same date. You didn't update it or remove it.

Did you follow any of my suggestions?

Regards,

Patrick