Intel GPU BSOD on Windows 10

[watercooled]

So lets just say I'm not overly impressed with Intel's GPU drivers. From day 1 I had to disable hardware acceleration in a number of programs as I was getting things like visual corruption. Then I noticed that I was frequently getting a weird bug upon resuming from screen-off where an open program would be visible but everything else would be black including the task bar and desktop. Entering/resuming from standby seemed to resolve this. But now that's escalated into BSODs with Windows and whocrashed pointing the finger at Intel's GPU drivers.

I've tried several versions of the drivers, both from Intel's website and by letting Windows Update chose it from device manager - either way the problem remains.

The BSOD reads:

Stop code: KMODE_EXCEPTION_NOT_HANDLED
What failed: igdkmd64.sys

Any ideas what to try next? I have memory dumps available if anyone knows how to get more out of them than just using whocrashed?

[satrow]

Yes, attach the zipped minidumps, please (copy them to your Desktop before zipping them), or run the BSOD collection app. from here, it'll collect a lot of other useful info as well.

[watercooled]

You mean on that forum or are you happy to take a look? I'm trying to avoid signing up to yet another support forum if I can help it.

[satrow]

Attaching them here is fine (though the security behind and in that forum is about as good as it gets, if that's your primary concern).

[watercooled]

Is the minidump enough or would you want the kernel dump too? I can upload them and PM you a link if that's OK?

[satrow]

Upload them both, I'll check the minidump first.

[watercooled]

You have PM

[satrow]

Got it, thanks.

I'm having a tough time with this one (as I've done since yesterday with others), I'm still unsure where my problem lies, it might be the MS Symbols server(s), or something in my debugging setup (to add to my confusion, I was also having intermittent browser connection errors before/during/after my debugging slot yesterday).

I uploaded the dump for a cross check to osronline and they seem to have a similar problem verifying the Windows kernel in your dump too. Not sure there's much point in going for the kernel/full dump, the steps needed for this bugcheck type are outside my comfort zone anyway

I do see some points of interest, the bugcheck and subtype is the same as this one, the patch for that is probably too old to be of any use as you'd need to rerun WU and reinstall a number of later KBs, I think.

In addition to the kernel error above, I'm also getting an error verifying the timestamp for one of the Intel graphics drivers, igdkmd64.sys, the one 'blamed' in the OP.

I'm wondering whether a 3rd party driver has loaded into (part of) the memory space used by the Intel driver, this would have the effect of changing the timestamp (at least!) and might also have had a knock-on effect of similarly changing the kernel... ?!

That still leaves the question of whether the MS servers are being flaky or not and skewing my perception... what can I trust?

Carrona's studies give the likely causes for this bugcheck in order of likelihood as:

STOP 0x0000003B: SYSTEM_SERVICE_EXCEPTION
Usual causes: System service, Device driver, graphics driver, ?memory

So, if we ignore the outside chance of malware/root/bootkit infection (and/or a 'cracked' OS?), we can see there's an obvious issue of some kind with a device driver here. If it were my PC, I'd uninstall all 3rd party utility (VM/backup software in this instance) software that had drivers loaded during the crash and then reinstalling the latest Intel drivers - OR - use Driver Verifier to try to flush out the guilty driver.

**************************Sat Nov 12 18:11:11.367 2016 (UTC + 0:00)**************************
Loading Dump File [C:\Users\Me\SysnativeBSODApps\111216-4562-01.dmp]
 
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
 
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
 
Windows 10 Kernel Version 14393 MP (4 procs) Free x64
 
Built by: 14393.447.amd64fre.rs1_release_inmarket.161102-0100
 
System Uptime: 0 days 2:06:35.038
 
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
 
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
 
*** WARNING: Unable to verify timestamp for igdkmd64.sys
 
*** ERROR: Module load completed but symbols could not be loaded for igdkmd64.sys
 
Probably caused by : ntoskrnl.wrong.symbols.exe ( nt_wrong_symbols!5819BD1F820000 )
 
BugCheck 3B, {c0000094, fffff801c80d9e8c, ffff9c8188053b90, 0}
BugCheck Info: SYSTEM_SERVICE_EXCEPTION (3b)
 
Arguments: 
Arg1: 00000000c0000094, Exception code that caused the bugcheck
Arg2: fffff801c80d9e8c, Address of the instruction which caused the bugcheck
Arg3: ffff9c8188053b90, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
BUGCHECK_STR:  5819BD1F
 
PROCESS_NAME:  ntoskrnl.wrong.symbols.exe
 
FAILURE_BUCKET_ID:  WRONG_SYMBOLS_X64_14393.447.amd64fre.rs1_release_inmarket.161102-0100_TIMESTAMP_161102-101703_5819BD1F_nt_wrong_symbols!5819BD1F820000
 
CPUID:        "Intel(R) Core(TM) i3-6100 CPU @ 3.70GHz"
 
MaxSpeed:     3700
 
CurrentSpeed: 3696
 
  BIOS Version                  2.80
 
  BIOS Release Date             07/27/2016
 
  Manufacturer                  MSI
 
  Product Name                  MS-7996
 
  Baseboard Product             H110M PRO-VH (MS-7996)
 
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``


   --- E O J ---   2016 Nov 13 21:50:50 PM    importantInfo   Copyright 2016 Mikael Pryor

3rd party drivers loaded:
npf.sys Fri Mar 1 01:31:24 2013 (513004EC)
iwdbus.sys Thu Nov 5 23:10:07 2015 (563BE1CF)
IntcDAud.sys Thu Nov 12 12:58:35 2015 (56448CFB)
eudskacs.sys Wed Dec 9 21:51:42 2015 (5668A26E)
eubakup.sys Wed Dec 9 21:51:48 2015 (5668A274)
EUBKMON.sys Wed Dec 9 21:52:08 2015 (5668A288)
EuFdDisk.sys Wed Dec 9 21:52:13 2015 (5668A28D)
igdkmd64.sys Wed Jan 6 19:30:42 2016 (568D6B62)
rt640x64.sys Thu Jan 21 08:17:40 2016 (56A09424)
TeeDriverW8x64.sys Wed Feb 3 22:41:13 2016 (56B28209)
intelppm.sys Sat Jul 16 03:10:43 2016 (578997A3)
RTKVHD64.sys Tue Jul 26 13:19:23 2016 (5797554B)
VBoxUSBMon.sys Tue Oct 18 18:57:05 2016 (58066271)
VBoxNetLwf.sys Tue Oct 18 18:57:05 2016 (58066271)
VBoxDrv.sys Tue Oct 18 18:57:38 2016 (58066292)
[/CODE]http://www.carrona.org/drivers/driver.php?id=npf.sys
http://www.carrona.org/drivers/driver.php?id=iwdbus.sys
http://www.carrona.org/drivers/driver.php?id=IntcDAud.sys
http://www.carrona.org/drivers/driver.php?id=eudskacs.sys
http://www.carrona.org/drivers/driver.php?id=eubakup.sys
http://www.carrona.org/drivers/driver.php?id=EUBKMON.sys
http://www.carrona.org/drivers/driver.php?id=EuFdDisk.sys
http://www.carrona.org/drivers/driver.php?id=igdkmd64.sys
http://www.carrona.org/drivers/driver.php?id=rt640x64.sys
http://www.carrona.org/drivers/driver.php?id=TeeDriverW8x64.sys
http://www.carrona.org/drivers/driver.php?id=intelppm.sys
http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys
http://www.carrona.org/drivers/driver.php?id=VBoxUSBMon.sys
http://www.carrona.org/drivers/driver.php?id=VBoxNetLwf.sys
http://www.carrona.org/drivers/driver.php?id=VBoxDrv.sys

[watercooled]

Thanks for having a look!

Nope, nothing cracked and to the best of my knowledge there's no malware. After the last BSOD I've already gone and done a bit of spring cleaning; uninstalled a couple of things and stopped others from launching at boot.

I'm a bit uncomfortable about EaseUS backup loading so many drivers but it doesn't have much in the way of options to change startup behaviour. However it's been installed for a while now and I don't think it's had any recent updates. I'm not ruling it out though.

I uninstalled the netgear software (for a managed switch) but I'll double check the winpcap driver has gone too.

Intel management interface - is that necessary for a desktop system?

It also occurred to me that I recently re-enabled hardware acceleration in Firefox. I didn't make a note of when I did this so I'm not sure if it's a possible cause, but I'm pretty confident it breaks *something* as it reliably causes graphical corruption within the application. Firefox was running before every BSOD but that's not saying much as it's generally always running.

I tried OSR myself but after two attempts it never finished after waiting like 30 minutes.

[satrow]

uninstalled the netgear software (for a managed switch) but I'll double check the winpcap driver has gone too.

Intel management interface - is that necessary for a desktop system?

It also occurred to me that I recently re-enabled hardware acceleration in Firefox. I didn't make a note of when I did this so I'm not sure if it's a possible cause, but I'm pretty confident it breaks *something* as it reliably causes graphical corruption within the application. Firefox was running before every BSOD but that's not saying much as it's generally always running.

I did see mention of winpcap as being involved/blamed in a similar BSOD.

IME - doubt it, might be part of the default W10 install though (or just W10's default driver 'updating' 'feature', GRRR). Avoid any 'extras' like this where possible, I was offered it for my Ivy Xeon rig - no thanks, I prefer 'drivers only' where possible, for stability reasons: KISS principle.

Probably better without GPU acceleration, it's likely to push the CPU% (and kernel% = lag, if much over ~5% ime) up, you have the HD 530, it's not great (BTW, there are some issues appearing around the better/best Intel Iris (Pro?) iGPUs, could be some driver bug, might be a good idea to test an older iGPU driver).

[watercooled]

The only reason winpcap was installed on this system was because of some Adobe Air based configuration software for a managed network switch. The winpcap driver did stay behind after uninstalling it but I've uninstalled it now.

I went and disabled the option to 'automatically download apps and custom icons...' under devices and printers - IIRC that also applies to automatic driver updates? Annoyingly, I forgot about this 'feature' and was reminded of it whilst I was in the middle of something, the screen went blank and I got the accessory reconnect jingle and I realised Windows had just decided to install a newer driver.

I can't quite remember now what version the original driver was but I did try rolling back and it didn't help so I'm wondering if it got corrupted somehow.

Anyway, most recently I completely uninstalled the display adapter in device manager and allowed Windows to fall back to the default driver. Then I had it check for updates and fetch the latest one from Windows Update, and that's where I'm at currently.

Two oddities I have noticed whilst playing with Intel drivers is the installer just seems to hang occasionally - no CPU or disk activity, it just sits there adding dots to the 'installing something......' text which I've had to forcibly close as it never finishes.

The other, is devices and printers takes *ages* to open for some reason, and consumes max CPU (all 4 threads of my i3) whilst it's 'working' with the green bar crawling across the top. That's a recent thing but I've no idea what's causing it.

I've tried quite a few drivers, since I started recording the ones I've tried, last 4 digits including: 4501, 4300, 4364.

IMO Intel really have some work to do with actually offering you the correct drivers - if I search for the i3 6100 then is says 4501 is the latest stable driver, but if I search for HD 530 then it offers me the newer 4542 (which I've not tried yet). Their driver numbering is also weird, with the version on the website differing from the one displayed in the application and in device manager, but at least the last 4 digits seem to be the same...

[watercooled]

Well it was going well for a while but it's just happened again. That's with a load of stuff uninstalled and HW accel disabled in Firefox. I guess I'll just try the latest drivers now.

It's just frustrating not knowing what's causing it - surely windows isn't BSODing for everyone using Intel GPU and its associated drivers? I wonder if it's worth considering a reformat if it persists after this new driver? I mean I'd rather avoid it but I'm really stuck for what to try next.

Weirdly this BSOD only produced a minidump, no kernel dump, but OSR did at least work for me this time.

Some of the more interesting lines include

EXCEPTION_CODE: (NTSTATUS) 0xc0000094 - {EXCEPTION}  Integer division by zero.

FAULTING_IP: 
igdkmd64+2c9e8c

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  0

BAD_PAGES_DETECTED: 71d5


 *** Memory manager detected 29141 instance(s) of page corruption, target is likely to have memory corruption.

Hang on... Chrome? (I've only just noticed that as I was typing.) What could that mean?

Edit: Also, with regard to reformatting (if it comes to that) - is Win10's built-in 'reformat' feature as good as a proper disk wipe + reinstall from iso image in terms of avoiding any damaged files/configuration/malware/etc? I assume they hash everything to make sure it's intact?

[satrow]

Chrome was the active Process at the time of the dump, the problem might have been triggered some ticks prior to that, "*** Memory manager detected 29141 instance(s) of page corruption, target is likely to have memory corruption." <- looks like there might be a 'bad' driver running interference in active memory, might be time for that fresh install and disallow Windows Update from doing any hardware driver updating? Then be very careful about installing only vital utility software for the first week - ten days.

This might be the best way to get a clean copy of the latest W10 (or any other supported Windows) version, it uses the MS servers and is safe according to my contacts:
http://www.majorgeeks.com/files/deta...load_tool.html

[watercooled]

Thanks again for the help! I'll give this new driver a go then reformat if not. I also ran Windows' memory diagnostic utility last night and it finished cleanly. I also tried updating UEFI (before starting the thread IIRC), but it made no difference.

Aside from that option in devices and printers, is there anything else I should change to stop Win Update updating drivers without asking?

[satrow]

I think using that option should be enough, try to keep it as clean as possible once installed, if you have to use backup software, see if you can run it from a scheduled task with any Services set to manual. Can't think what else you can do - sometimes W10 just resets any changes with the next update anyway.

[watercooled]

TBH I could make do without the disk imaging software for a while, and my file backup software can be set to run as a scheduled task rather than a service like you say (in fact I think that's how I have it set up now).

One other weird (but probably completely unrelated) thing I've noticed with Windows is how it handles, or more specifically freaks out about, offline network drives. If it's a mapped network drive, it takes ages to log in until it times out. If it's set as a network location instead, it avoids the login mounting problem but still causes explorer to misbehave e.g. hanging for a while if it attempts to access the shares, and not updating directory changes properly without hitting F5. Despite looking, I can't seem to find a proper way around this which I find a bit perplexing - surely I'm not the only one who wants to map network drives which aren't always available?