BSOD: ntoskrnl.exe, often caused when gaming

[andreeabiancapop2]

So, I've been having issues for the last 6 months (?) with BSODs occurring when playing certain games such as Overwatch, League of Legends, Fortnite, and a few others like Golf with Friends -- but only those since my laptop is ok with other games, including others that are graphics intensive like The Witcher 3; frequently the perpetrator was shown to be ntoskrnl.exe. I've looked into so many solutions for this but it seems that it's relatively unique to everyone.

Unfortunately, I'm not extremely knowledgeable about how laptops actually work when it comes to overclocking, memory, CPUs, or GPUs and I worry about changing too much and accidentally bricking my laptop. I wish I kept a longer log of dumps but it was only today that I decided to finally reach out about it.

-----------------------------------------------------------------------------------------

Computer specs can be found here: http://speccy.piriform.com/results/t6HMenixhPnnzqAwKZ3Q7GP
Dumps can be found here, including the driver verifier one and a screenshot of the GPU at work when playing Fortnite: https://drive.google.com/open?id=17JI1Rznu0kKoFjQ_qLYQ3410ZcRhlTTe

I was unable to replicate the BSOD today using the games but the one from August 6th is from playing Fortnite (and is pretty much a duplicate of most of my crashes), the other from today was attempting to boot up a different game when it crashed.

netfilter2.sys was shown to be the culprit of the driver verifier but I'm not sure if that can even be removed or updated properly. I also reinstalled my Nvidia driver after doing a driver verification using DDU so it's a fresh install.

-----------------------------------------------------------------------------------------
This is the WhoCrashed analysis as well:

On Tue 2018-08-07 6:31:41 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\080718-32250-01.dmp
This was probably caused by the following module: netfilter2.sys (0xFFFFF8023E946978)
Bugcheck code: 0xC4 (0x2000, 0xFFFFF8023E946978, 0x0, 0x51544C46)
Error: DRIVER_VERIFIER_DETECTED_VIOLATION
file path: C:\WINDOWS\system32\drivers\netfilter2.sys
product: Windows (R) Win 7 DDK driver
company: Windows (R) Win 7 DDK provider
description: NetFilter SDK WFP Driver (WPP)
Bug check description: This is the general bug check code for fatal errors found by Driver Verifier.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: netfilter2.sys (NetFilter SDK WFP Driver (WPP), Windows (R) Win 7 DDK provider).
Google query: netfilter2.sys Windows (R) Win 7 DDK provider DRIVER_VERIFIER_DETECTED_VIOLATION

-----------------------------------------------------------------------------------------

On Tue 2018-08-07 6:31:41 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: netfilter2.sys (0xFFFFF8023E946978)
Bugcheck code: 0xC4 (0x2000, 0xFFFFF8023E946978, 0x0, 0x51544C46)
Error: DRIVER_VERIFIER_DETECTED_VIOLATION
file path: C:\WINDOWS\system32\drivers\netfilter2.sys
product: Windows (R) Win 7 DDK driver
company: Windows (R) Win 7 DDK provider
description: NetFilter SDK WFP Driver (WPP)
Bug check description: This is the general bug check code for fatal errors found by Driver Verifier.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: netfilter2.sys (NetFilter SDK WFP Driver (WPP), Windows (R) Win 7 DDK provider).
Google query: netfilter2.sys Windows (R) Win 7 DDK provider DRIVER_VERIFIER_DETECTED_VIOLATION

-----------------------------------------------------------------------------------------

On Tue 2018-08-07 5:08:22 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\080718-34703-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x198430)
Bugcheck code: 0x4E (0x9A, 0x10E3D2, 0x2, 0x0)
Error: PFN_LIST_CORRUPT
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the page frame number (PFN) list is corrupted.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

-----------------------------------------------------------------------------------------

On Mon 2018-08-06 7:34:34 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\080618-38875-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x198430)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF803AE61E8A2, 0xFFFFF68902DDE6F0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

Hopefully, it's just some silly and easy solution to it -- and thank you ahead of time for those who help.

-----------------------------------------------------------------------------------------

On a fun note, I didn't know using your gmail caused your nickname to be auto-set. Alas, so it be.

 

[johnbl]

NetFilter SDK TDI Hook Driver (third party driver) passed a bad parameter to a windows routine.
windows verifier caught the error can called a bugcheck so it could be looked at.

https://carrona.org/drivers/driver.php?id=netfilter2.sys

basically you would update the driver (see link to the software in the above link)
or remove the software package if you don't need it or did not install it (malware)

then turn off windows verifier via
start cmd.exe as an admin and run
verifier.exe /reset

most likely you turned on verifier to find the cause of the other corruptions show in the other memory dumps. without looking at the bugcheck i can not see the date stamp of the driver. it might just be old. Often these types of drivers are used in hacking software or game cheats or password collection programs. just make sure you actually want it installed.

 

[andreeabiancapop2]

NetFilter SDK TDI Hook Driver (third party driver) passed a bad parameter to a windows routine.
windows verifier caught the error can called a bugcheck so it could be looked at.

https://carrona.org/drivers/driver.php?id=netfilter2.sys

basically you would update the driver (see link to the software in the above link)
or remove the software package if you don't need it or did not install it (malware)

then turn off windows verifier via
start cmd.exe as an admin and run
verifier.exe /reset

most likely you turned on verifier to find the cause of the other corruptions show in the other memory dumps. without looking at the bugcheck I can not see the date stamp of the driver. it might just be old. Often these types of drivers are used in hacking software or game cheats or password collection programs. just make sure you actually want it installed.

I attempted to update it then uninstall it by deleting the file but it seems the actual netfilter2.sys file can't be deleted in the system32 folder. I'm not sure if a clean reinstallation of Windows might solve it because I can't find a way to delete it; it keeps mentioning that it's in use despite it not being active in the processes.

I can move it around (moved it to the desktop) but it's still pretty much undeletable at the moment.

EDIT: Ok, in safe mode it can be deleted, I ran the verifier again and got another BSOD before windows could boot, this time it was scpvbus.sys...

Dump file included here:
https://drive.google.com/open?id=1BSGM6EwDYgHzZIJoJ0q9KkrFjnNKfRuV

WhoCrashed analysis:

On Tue 2018-08-07 10:34:47 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\080718-27734-01.dmp
This was probably caused by the following module: scpvbus.sys (0xFFFFF80A21D3B048)
Bugcheck code: 0xC4 (0x2000, 0xFFFFF80A21D3B048, 0x0, 0x56706353)
Error: DRIVER_VERIFIER_DETECTED_VIOLATION
file path: C:\WINDOWS\system32\drivers\scpvbus.sys
product: Scp Virtual Bus Driver
company: Scarlet.Crush Productions
description: Scp Virtual Bus Driver
Bug check description: This is the general bug check code for fatal errors found by Driver Verifier.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: scpvbus.sys (Scp Virtual Bus Driver, Scarlet.Crush Productions).
Google query: scpvbus.sys Scarlet.Crush Productions DRIVER_VERIFIER_DETECTED_VIOLATION

It seems like there's a lot of drivers that just aren't happy with my computer so I may have to go through one by one with the verifier to remove them. Tomorrow I may give a try to see if I can replicate a BSOD again with the games I played since I'm not sure if removing that driver fixed the issue or it was only one layer among many to get to the actual problem.