BSOD when running Delta Force game for 8-10 minutes

[callofdemons]

Hello,

I am having a BSOD issue recently and by reading the mini dumps It says it get's crushed by their Anti Cheat software (ACE). Can someone please assist me to find out why the ACE is crushing my system? Maybe a driver?

 

[ubuysa]

You're not the first to fall foul of an anti-cheat tool, and you won't be the last. All of them cause BSODs now and then on many different systems and ANtiCheatExpert (ACE) is no exception.

You have two choices really....

1. Delete the ACE software (do a web search on how to remove ACE) and see whether the game will run without it
2. Contact ACE at support@anticheatexpert.com, provide them these dumps and ask them to fix it.

There is nothing else (AFAIK) that you can do to fix this.

 

[callofdemons]

Hey Ubuysa, thank you for your prompt response. Unfortunately this issue is not affecting everyone. Uninstalling ACE is just reinstall it back on first game start. Question is, is there something in the dumps attached that may indicate what triggers the ACE to crush? Will it help to investigate if I also upload the analyzed mini dump that has reverse trace route? I also see there is a warning about my bluetooth:

WARNING: Check Image - Checksum mismatch - Dump: 0x201482, File: 0x201504 - C:\ProgramData\Dbg\sym\BTHport.sys\9BFC3B54202000\BTHport.sys

 

[ET_Explorer]

Question is, is there something in the dumps attached that may indicate what triggers the ACE to crush?

The anti cheat files may be getting corrupted.

 

[ubuysa]

I see that Bluetooth error occasionally. Ordinarily a checksum mismatch would indicate a possible RAM issue but this one seems to be a false positive. However, there are other indications that RAM might be an issue, so it's worth running a RAM test just in case....

1. Download Memtest86 (free), use the imageUSB.exe tool extracted from the download to make a bootable USB drive containing Memtest86 (1GB is plenty big enough). Do this on a different PC if you can, because you can't fully trust yours at the moment.
2. Then boot that USB drive on your PC, Memtest86 will start running as soon as it boots.
3. If no errors have been found after the four iterations of the 13 different tests that the free version does, then restart Memtest86 and do another four iterations. Even a single bit error is a failure.

ACE crashes in those dumps because it references a memory page that is invalid (not allocated, paged out, or bad)...

rax=ffffa1805849b000 rbx=0000000000060070 rcx=ffffb50d3a05e730
rdx=ffffec731e43c8d8 rsi=ffffde8c5079fee0 rdi=ffffb50d3a05e6b8
rip=fffff80765b12d00 rsp=ffffb50d3a05e618 rbp=ffffb50d3a05f720
 r8=0000000000000008  r9=0000000000000001 r10=ffffc5e2f178b000
r11=ffffb50d3a05e728 r12=0000000000000001 r13=ffffde8c45882e10
r14=ffffde8c50d7f2b0 r15=0000000000000002
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050202
ACE_BASE+0xc2d00:
fffff807`65b12d00 488b440af8 mov rax,qword ptr [rdx+rcx-8] ds:002b:ffffa180`5849b000=????????????????
Resetting default scope

The MOV instruction at offset 0xC2D00 into ACE_BASE.sys uses the RAX, RDX and RCX registers as pointers into memory. Although the addresses in RAX, RDX and RCX look to be reasonable (they don't look unusual) the resulting memory address is invalid - note the ???????? at the data segment register (ds) address - this indicates that the RAX+RDX-8 address (ffff8df3`768d78d0) is in an invalid memory segment.

Either ACE_BASE.sys has fouled up the values in RDX, or RCX (which is very likely with these types of driver) or the RAM backing those pages is bad. I would expect bad RAM to have a bigger effect on your system than just this game, which is why I think the ACE driver is most likely to be at fault. Only ACE can fix that.

 

[axe0]

Many of these drivers nest deep into Windows to monitor for hack attempts, but this comes with many caveats.

You really need to be contacting their support and have them look into it to fix this. The dump indicates stack pointer error, which could be a misaligned pointer, null pointer reference or memory corruption.

Out of curiosity I checked for potential stack corruption or similar issues, but I don't see real garbage or other problems with the stack within the scope of the minidump. Everything is pointing to the ACE driver using a bad pointer resulting in the crash. This also means the stack pointer error is a side-effect of the pointer bug.

 

[xilolee]

There were a lot of bios updates in the meanwhile:

Read More:

Version 4101
1.Enhanced system performance, stability and allowed the C1E power state to be disabled.

Version 4001
1.Updated with Intel microcode 0x12B to address elevated voltage requests during idle or light activity, further mitigating Vmin Shift instability issues.
2.The option to disable C1E in the BIOS has been removed to ensure it remains enabled, reducing processor stress and maintaining stability per Intel's recommendation.

Version 3802
1.The new BIOS includes Intel microcode 0x129 to enhance the stability of Intel Core 13th and 14th Gen processors.
2.The factory default settings are set to Intel Default Settings, which now include non-K processors (the K series were already included in previous versions).

Version 3701
Updated with microcode 0x125 to ensure eTVB operates within Intel specifications

Version 3603
1. Introduce the ""Performance Preferences"" with options for Intel Default Settings (Performance/Extreme) and ASUS Advanced OC Profile.
2. Redefine the factory defaults based on Intel’s new ""Intel Default Settings"" for various CPU SKUs.
3. Change F5 from ""Load Optimized Defaults"" to ""Reset to Defaults"".
4. Add warnings when users switch from the defaults to other settings.

Version 3501
The update introduces the Intel Baseline Profile option, allowing users to revert to Intel factory default settings for basic functionality, lower power limits, and improving stability in certain games.

Version 3401
1.Improved DDR5 compatibility
2.Further optimized CEP settings when disabled

Version 3302
1. Update the Intel microcode to version 0x123, allowing for disabling CEP for improved performance on Intel 14th Gen non-K series processors*
2. Disabling CEP for performance enhancement may lead to increased power consumption and temperature. Ensure adequate CPU cooling or use a higher-spec cooling solution.
3. Enhanced compatibility with 256GB memory.
*Intel CEP function varies by the CPU model. Check your CPU's specifications or reach out to its technical support for more information.

Version 3101
1. Improve system stability
2. Update ME to version 16.1.30.2307
3. This update includes the patch for the LogoFAIL vulnerabilities
4. Add PCIe Bifurcation options for GPU with M.2 storage

Version 2802
1. Update Microcode for Intel® Core™ 14th gen processors
2. Update ME to version 16.1.30.2264 for Intel® Core™ 14th gen processors
3. Improve system stability

Version 2703
1. Recommended for vital update to mitigate the potential security vulnerabilities
2. Improve system stability

Version 2602
Before BIOS update, please download Intel ME update tool from ASUS support site, and update ME firmware to Version 16.1.27.2176 to ensure optimized system settings.
1. Improve system stability and compatibility for the Intel® Core™ 14th gen processors
2. Fix the compatibility and instability issues when configuring RAID for high-capacity storage
3. Do update the intel ME to version 16.1.27.2176

Version 2403
1. Improve system performance.
2. Improve memory compatibility.

Version 2305
Improve system performance and security.
Support ME update function
Improve AURA SW experience
Improve DRAM stability
Please back up your Bitlocker recovery key and suspend Bitlocker encryption in the operating system before updating your BIOS or ME firmware.

Version 2204
- improve single 24/48GB memory module compatibility
- Improved system compatibility and stability
- Update Intel ME firmware

Version 2103
1. Improve system overclocking stability on 13th Gen Intel Processors
2. Update Microcode for 13th Gen Intel Processors
3. Update Microcode for 12th Gen Intel Processors

Version 2004
1. Improve system performance
2. Update ME version to 16.1.25.1885v2
3. Many ME updates and optimizations for the next-gen CPU are included. This version does NOT allow rolling back to the previous versions, not even via USB BIOS FlashBack™, to ensure better compatibility.

Version 1720
1. Improve system stability
2. Update Microcode for next generation Intel Processors.

Most likely, there were also new chipset drivers that you didn't install.
Please, try to update all the drivers, bios, firmware and so forth: ROG STRIX Z690-F GAMING WIFI | Gaming motherboards｜ROG - Republic of Gamers｜ROG Global

You also have ene.sys installed (enetechio is its service name) and gameflt.sys (gameflt is its service name): those ones are a known cause of bsods.
And four cpuz files (running)...?

 

[callofdemons]

I did a memory test @ubuysa suggested above with 0 errors reported
@xilolee I already updated my bios and chipset. I already updated everything, even tried downgrading my Nvidia to the November since I know that one had no issues.
About the cpuz I am not sure, but I did had HWMonitor application to monitor my temperatures at some point, not sure if it was in this dump.

How do I uninstall enetechio and gamefit? can't find them

 

[xilolee]

The logs you sent show an older BIOS.
If you made all the changes, post new logs.

 

[callofdemons]

Please find attached the latest crash report

 

[ET_Explorer]

RAID Controller PCI\VEN_8086&DEV_467F&SUBSYS_86941043&REV_00\3&11583659&0&70 The drivers for this device are not installed.

 

[callofdemons]

I read that this driver is optional. Do I need it? Can be related to my issue?

 

[ET_Explorer]

+++ WER3 +++:
Fault bucket 2301844475279554685, type 1
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: utweb.exe
P2: 1.5.0.6157
P3: 67914709
P4: ntdll.dll

The UTWEB.EXE Windows Virus directly affects the DLL Files that cause a malfunction in the Windows.
https://www.geeksforgeeks.org/what-is-utweb-exe-how-to-fix-its-system-errors/

 

[ubuysa]

The missing RAID driver will be the Intel RST driver. If you're not using Optane memory and you're not running a RAID array then you don't need it.

I've gone through the full call stack on each of those recent dumps, I've also looked at your loaded drivers lists and there are some new observations....

• Each dump appears to fail in the ACE_BASE.sys driver, so we still cannot rule out this driver as being flaky. It's VERY common to see anti-cheat drivers causing BSODs, so for me this is still the most likely point of failure.
• In four of the dumps an Acronis driver is also called (file_protector.sys). It's not impossible that there may be some conflict between that Acronis driver and ACE. Try (temporarily) uninstalling or completely deactivating Acronis (then reboot) and see whether the BSODs continue.
• In the fifth dump we don't see file_protector.sys called explicitly, but there is a storage driver operation in progress; we see ntfs.sys, storport.sys, and stornvme.sys called. It's thus entirely possible that Acronis was involved in this BSOD as well.
• I can see from the list of loaded drivers that you have BitDefender installed. There is no indication that BitDefender is involved, but third-party security products are common causes of BSODs and it's certainly possible that there may be a conflict between ACE/Acronis/BitDefender that none of these vendors anticipated. You might also try uninstalling BitDefender (as well as Acronis) and see whether the BSODs continue.

I think it would be wise for you to try to reduce the complexity of your system to see whether there is a conflict between ACE and something else. You could do that via a clean boot (via msconfig) and uncheck those services you can do without temporarily to see whether there is a configuration in which ACE doesn't BSOD?

 

[xilolee]

I would uninstall ArmouryCrate, msi afterburner, patriot software with the help of an uninstall tool.

Read More:

Install the free version of one of these programs designed to uninstall other programs (portable programs are not installed, you can run them from their folder):
wise program uninstaller 3.2.3 portable (current)
iobit uninstaller 14.2 (current)
smarty uninstaller 4.91 (current)
geek uninstaller 1.5.2 (working but a bit outdated)
revo uninstaller 2.5.8 portable (working but a bit outdated)

Then, with the help of the uninstaller program you chose (i.e., open it and it should remove the remnants after the normal uninstallation), uninstall the mentioned program(s).

Run the armourycrate uninstall tool: https://dlcdnets.asus.com/pub/ASUS/...l_Tool.zip?model=ROG STRIX Z690-F GAMING WIFI

Utorrent web (utweb.exe) is a legitimate application that can be used to download files.
Files that can be downloaded may, or may not, have (or contain):
- copyright;
- malicious software;
- a different name than the content.
In any case, it is a good idea to do a thorough scan of the downloaded files with utorrent (or similar programs) with multiple tools (your antivirus and virustotal, at least).

 

[callofdemons]

The missing RAID driver will be the Intel RST driver. If you're not using Optane memory and you're not running a RAID array then you don't need it.

I've gone through the full call stack on each of those recent dumps, I've also looked at your loaded drivers lists and there are some new observations....

• Each dump appears to fail in the ACE_BASE.sys driver, so we still cannot rule out this driver as being flaky. It's VERY common to see anti-cheat drivers causing BSODs, so for me this is still the most likely point of failure.
• In four of the dumps an Acronis driver is also called (file_protector.sys). It's not impossible that there may be some conflict between that Acronis driver and ACE. Try (temporarily) uninstalling or completely deactivating Acronis (then reboot) and see whether the BSODs continue.
• In the fifth dump we don't see file_protector.sys called explicitly, but there is a storage driver operation in progress; we see ntfs.sys, storport.sys, and stornvme.sys called. It's thus entirely possible that Acronis was involved in this BSOD as well.
• I can see from the list of loaded drivers that you have BitDefender installed. There is no indication that BitDefender is involved, but third-party security products are common causes of BSODs and it's certainly possible that there may be a conflict between ACE/Acronis/BitDefender that none of these vendors anticipated. You might also try uninstalling BitDefender (as well as Acronis) and see whether the BSODs continue.

I think it would be wise for you to try to reduce the complexity of your system to see whether there is a conflict between ACE and something else. You could do that via a clean boot (via msconfig) and uncheck those services you can do without temporarily to see whether there is a configuration in which ACE doesn't BSOD?

I have uninstalled the programs below:

1. uTorrent
2. ArmouryCrate
3. MSI Afterburner
4. Acronis True Image

I saw you mentioned BitDefender but I don't have this software installed. How can i remove the driver safely?

Regardless, please find attached my latest crash report.

 

[ET_Explorer]

Utweb (utorrent web) is still on your computer in startup programs

utweb "c:\users\user\appdata\roaming\utorrent web\utweb.exe" /minimized DESKTOP-DPLU3L9\User HKU\S-1-5-21-3770472248-360026409-3316386802-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

 

[ubuysa]

The BitDefender driver is bddci.sys, it's loaded in all but one of the dumps you just uploaded, and it's old...

11: kd> lmDvmbddci
Browse full module list
start             end                 module name
fffff803`90f30000 fffff803`90f89000   bddci      (deferred)       
    Image path: bddci.sys
 Image name: bddci.sys
    Browse all global symbols  functions  data  Symbol Reload
Timestamp:        Mon Dec  3 16:29:15 2018 (5C053DBB)
    CheckSum:         00066764
    ImageSize:        00059000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

It's possible that BitDefender was installed, it may have been bloatware that was pre-installed when you bought the PC and somewhere down the line it's not been fully or properly uninstalled.

Using the normal Windows File Explorer navigate to the folder C:\Windows\System32\Drivers. The drivers will be listed in there in alphabetical order, so scroll down looking for all drivers whose names begin with BD. You should see bddci.sys but there might be others. If there are other driver files beginning with BD then post a screenshot of that File Explorer page so that we can check that these are all BitDefender drivers and not for something else.

If only bddci.sys is listed in that File Explorer output then you first need to copy it to somewhere else - just in case it's not a BitDefender driver and you need it back. Copy it to the Desktop for example. Now delete the bddci.sys file in the folder C:\Windows\System32\Drivers. If you don't get an error message and if the file disappears then you're done, you just need to reboot. But if you do get an error message it will be because the bddci.sys driver is open in an active process, in that case you'll have to delete it another way. I'll describe the other way once you've tried to delete it this way. Let us know how it goes.


You mentioned that you have uninstalled Acronis True Image, yet in two of the dumps from Sunday 23rd Feb we see a driver called tib_mounter.sys that is loaded...

6: kd> lmDvmtib_mounter
Browse full module list
start             end                 module name
fffff804`69c80000 fffff804`69ca8000   tib_mounter   (deferred)       
    Image path: tib_mounter.sys
Image name: tib_mounter.sys
    Browse all global symbols  functions  data  Symbol Reload
 Timestamp:        Fri Mar 12 10:21:43 2021 (604B2497)
    CheckSum:         00033C2E
    ImageSize:        00028000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

This is a driver for Acronis True Image, so Acronis hasn't been fully uninstalled either. Acronis have a cleanup tool for Acronis True Image, but you need to carefully read the instructions for its use before running it. Once you're happy run that cleanup tool to ensure that all Acronis components are removed. Note that we're not deleting this driver manually as above because there may be other Acronis drivers that need removing and it's best to let the Acronis tool remove them all. Reboot afterwards.


Armoury Crate is often a problem for some people. I have an Asus motherboard and I won't use Armory Crate because I've seen too many people have problems with it. MSI Afterburner is really a GPU overclocking tool and you risk instability overclocking anything, so it's good that this has been uninstalled.

Let's see whether removing bddci.sys and the Acronis left-overs stops these BSODs. It may not, I still think that ACE_BASE.sys is much more likely to be the root cause.

 

[callofdemons]

That's weird, I don't see neither BitDefender nor Acronis drivers in my drivers directory (see attached).

 

[xilolee]

It seems bddci.sys is used by both acronis and bitdefender.

---

After a web search, if I understood correctly, it seems that some products that use Bitdefender Traffic Interceptor SDK are not compatible with bitdefender itself.
Acronis (with antimalware protection) is one of them.
And, evidently, bddci.sys is part of the Bitdefender Traffic Interceptor SDK...