Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: BSOD being caused by ntoskrnl.exe


08 Oct 2010   #1

Windows 7 Ultimate 64bit
 
 
BSOD being caused by ntoskrnl.exe

Hey guys;

I searched these forums for other posts; and generally people just suggested repairing windows.

When i try an repair my windows 7 (Ultimate 64bit) it tells me it cannot upgrade my system to 32bit, and yes i have been clicking x64 when i choose my system type.

Ill dump the Bluescreen viewer reports here as well as the report/.

Thanks for the help guys.

My System SpecsSystem Spec
.

08 Oct 2010   #2

Windows 7 Ultimate 32 bit
 
 

Welcome to the forum. I am sorry your are having problems.

Both of your dumps blame memory corruption and do not point to any specific cause.

Quote:
Error code A, IRQL_NOT_LESS_OR_EQUAL. Usually causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

Error code 1E, KMODE_EXCEPTION_NOT_HANDLED . Usual causes: Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS
Code:
Kernel base = 0xfffff800`02a14000 PsLoadedModuleList = 0xfffff800`02c51e50
Debug session time: Fri Oct  8 17:08:19.452 2010 (GMT-4)
System Uptime: 0 days 4:31:44.294
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa8050910220, 2, 1, fffff80002aa9b7f}

Probably caused by : memory_corruption ( nt!MiReplenishPageSlist+100 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa8050910220, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002aa9b7f, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cbc0e0
 fffffa8050910220 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiReplenishPageSlist+100
fffff800`02aa9b7f f00fba6b1000    lock bts dword ptr [rbx+10h],0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  rundll32.exe

TRAP_FRAME:  fffff88007346010 -- (.trap 0xfffff88007346010)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000001adb00b rbx=0000000000000000 rcx=fdffffffffffffff
rdx=0000000000000050 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002aa9b7f rsp=fffff880073461a0 rbp=fffffa8005100730
 r8=fffff80002cbe400  r9=fffffa8005100000 r10=fffffa8005100750
r11=fffff880073461f8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!MiReplenishPageSlist+0x100:
fffff800`02aa9b7f f00fba6b1000    lock bts dword ptr [rbx+10h],0 ds:5820:00000000`00000010=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002a83ca9 to fffff80002a84740

STACK_TEXT:  
fffff880`07345ec8 fffff800`02a83ca9 : 00000000`0000000a fffffa80`50910220 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`07345ed0 fffff800`02a82920 : fffffa80`07b08b00 fffffa80`50910210 fffffa80`07ea5820 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`07346010 fffff800`02aa9b7f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
fffff880`073461a0 fffff800`02aaa0af : fffff800`02cbe400 00000000`0000002e fffffa80`008030a0 fffffa80`008024a0 : nt!MiReplenishPageSlist+0x100
fffff880`07346200 fffff800`02ab3d14 : 00000000`00000000 ffffffff`00000000 ffffffff`ffffffff 00000000`000002e0 : nt!MiRemoveAnyPage+0x24f
fffff880`07346320 fffff800`02ab06ce : fffff980`18da8000 00000000`00b68040 fffff880`00000000 00000000`00001000 : nt!MmCopyToCachedPage+0xc84
fffff880`07346510 fffff800`02ab0434 : fffffa80`05381310 00000000`00b68040 fffff880`07346650 00000000`00000000 : nt!CcMapAndCopyInToCache+0x20e
fffff880`07346600 fffff880`01256f40 : fffff8a0`0bdb9168 fffff880`07346880 fffffa80`07ed78b0 fffff880`07346800 : nt!CcCopyWrite+0x194
fffff880`07346690 fffff880`0125b413 : fffffa80`07ed78b0 fffffa80`05cf0010 fffff880`07346801 fffff880`07346800 : Ntfs!NtfsCommonWrite+0xda0
fffff880`07346850 fffff880`0102023f : fffffa80`05cf03b0 fffffa80`05cf0010 fffffa80`07eaf6e0 00000000`00000001 : Ntfs!NtfsFsdWrite+0x1c3
fffff880`07346910 fffff880`0101e6df : fffffa80`0615f830 00000000`00000001 fffffa80`0615f800 fffffa80`05cf0010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`073469a0 fffff800`02d9aca9 : 00000000`00000001 fffffa80`07ea5820 00000000`00000001 fffffa80`05cf0010 : fltmgr!FltpDispatch+0xcf
fffff880`07346a00 fffff800`02d9ba43 : fffffa80`05cf03f8 fffffa80`05aef920 fffffa80`07ea5820 fffff800`02bfee80 : nt!IopSynchronousServiceTail+0xf9
fffff880`07346a70 fffff800`02a83993 : 00000000`00000a01 00000000`00000140 00000000`00000000 00000000`01a761f8 : nt!NtWriteFile+0x7e2
fffff880`07346b70 00000000`7796ff3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0010dc78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7796ff3a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiReplenishPageSlist+100
fffff800`02aa9b7f f00fba6b1000    lock bts dword ptr [rbx+10h],0

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiReplenishPageSlist+100

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiReplenishPageSlist+100

BUCKET_ID:  X64_0xA_nt!MiReplenishPageSlist+100

Followup: MachineOwner
---------

Kernel base = 0xfffff800`02a03000 PsLoadedModuleList = 0xfffff800`02c40e50
Debug session time: Fri Oct  8 19:44:10.588 2010 (GMT-4)
System Uptime: 0 days 2:34:17.429
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80002a98b7f, 0, ffffffffffffffff}

Probably caused by : memory_corruption ( nt!MiReplenishPageSlist+100 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002a98b7f, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MiReplenishPageSlist+100
fffff800`02a98b7f f00fba6b1000    lock bts dword ptr [rbx+10h],0

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cab0e0
 ffffffffffffffff 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff8800a0615d8 -- (.exr 0xfffff8800a0615d8)
ExceptionAddress: fffff80002a98b7f (nt!MiReplenishPageSlist+0x0000000000000100)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff8800a061680 -- (.trap 0xfffff8800a061680)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8000000000 rbx=0000000000000000 rcx=fdffffffffffffff
rdx=0000000000000050 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002a98b7f rsp=fffff8800a061810 rbp=fffffa80051006e0
 r8=fffff80002cad400  r9=fffffa8005100000 r10=fffffa8005100700
r11=fffff8800a061868 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!MiReplenishPageSlist+0x100:
fffff800`02a98b7f f00fba6b1000    lock bts dword ptr [rbx+10h],0 ds:00000000`00000010=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002aada39 to fffff80002a73740

STACK_TEXT:  
fffff880`0a060e08 fffff800`02aada39 : 00000000`0000001e ffffffff`c0000005 fffff800`02a98b7f 00000000`00000000 : nt!KeBugCheckEx
fffff880`0a060e10 fffff800`02a72d82 : fffff880`0a0615d8 fffef280`00000000 fffff880`0a061680 00000000`00000005 : nt!KiDispatchException+0x1b9
fffff880`0a0614a0 fffff800`02a7168a : 00000000`00007ffe 00000000`018ecfff fffffa80`05f94560 fffffa80`05e1c060 : nt!KiExceptionDispatch+0xc2
fffff880`0a061680 fffff800`02a98b7f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a
fffff880`0a061810 fffff800`02a990af : fffff800`02cad400 00000000`0000002c fffffa80`00802440 fffffa80`00801840 : nt!MiReplenishPageSlist+0x100
fffff880`0a061870 fffff800`02a912c7 : 00000000`00000002 fffff880`00000002 fffffa80`05e1c3f8 00000000`00000002 : nt!MiRemoveAnyPage+0x24f
fffff880`0a061990 fffff800`02a8d9c6 : 00000000`00000001 00000000`03db3000 fffff880`0a061be0 fffff680`0001ed98 : nt!MiResolveDemandZeroFault+0x577
fffff880`0a061a80 fffff800`02a7182e : 00000000`00000001 00000000`00000007 00000000`00000001 00000000`7efdb000 : nt!MmAccessFault+0x5c6
fffff880`0a061be0 00000000`646eb1f8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0022e220 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x646eb1f8


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiReplenishPageSlist+100
fffff800`02a98b7f f00fba6b1000    lock bts dword ptr [rbx+10h],0

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!MiReplenishPageSlist+100

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x1E_nt!MiReplenishPageSlist+100

BUCKET_ID:  X64_0x1E_nt!MiReplenishPageSlist+100

Followup: MachineOwner
---------
I find out of date drivers on your system; some of them are really obsolete. Out of date drivers can and do cause memory corruption can BSOD's. Update the drivers below, especially those in red font.
Quote:
gdrv.sys Sat Oct 13 03:22:00 2007 - Uninstall Gigabyte's Easy Saver program, as it is known to cause BSODs.

LHidFilt.Sys Fri Sep 21 07:05:39 2007
- Logitech SetPoint HID Filter Driver Downloads

LMouFilt.Sys Fri Sep 21 07:05:43 2007 - Logitech SetPoint HID Filter Driver, Downloads

LUsbFilt.Sys Fri Sep 21 07:05:46 2007 - Logitech SetPoint USB Filter Downloads

Rt64win7.sys Thu Feb 26 04:04:13 2009 - Latest PCIe GBE (GigaBit Ethernet) drivers here: Realtek

RTKVHD64.sys Thu Jun 26 23:21:58 2008 - Realtek High Definition Audio Function Driver Realtek
I can't say these drivers caused your crashers; but they are definitely not contributing to the stability of your system. Take care of the above drivers, reboot and run your system. Let's see how it does. Let us know and upload any new BSOD's.
My System SpecsSystem Spec
08 Oct 2010   #3
Microsoft MVP

 
 

You only have 35 hotfixes installed, there's at least 45 to 60 (or more) available for Windows 7.
Please visit Windows Update and get the rest of the updates.

Please uninstall Catalyst Control Center as it can cause BSOD's in some systems. If needed, feel free to reinstall it after we're finished troubleshooting.

Please update your Logitech Mouse/Keyboard software/drivers as the one's that are currently installed are from 2007

Please uninstall the Gigabyte tools from your system. If they're not installed, please rename C:\Windows\System32\drivers\gdrv.sys to gdrv.BAK (it's from 2007 also).

Please run Driver Verifier according to these instructions:
Quote:
Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Windows 7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
NOTE: You can use Low Resource Simulation if you'd like. From my limited experimentation it makes the BSOD's come faster.
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

If that doesn't work, post back and we'll have to see about fixing the registry entry off-line:
Code:
Delete these registry keys (works in XP, Vista, Windows 7):
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDrivers
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDriverLevel
More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users

BSOD BUGCHECK SUMMARY
Code:

Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Fri Oct  8 19:44:10.588 2010 (UTC - 4:00)
System Uptime: 0 days 2:34:17.429
Probably caused by : memory_corruption ( nt!MiReplenishPageSlist+100 )
BUGCHECK_STR:  0x1E_c0000005
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  chrome.exe
Bugcheck code 0000001E
Arguments ffffffff`c0000005 fffff800`02a98b7f 00000000`00000000 ffffffff`ffffffff
ииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииии``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Fri Oct  8 17:08:19.452 2010 (UTC - 4:00)
System Uptime: 0 days 4:31:44.294
Probably caused by : memory_corruption ( nt!MiReplenishPageSlist+100 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0xA
PROCESS_NAME:  rundll32.exe
Bugcheck code 0000000A
Arguments fffffa80`50910220 00000000`00000002 00000000`00000001 fffff800`02aa9b7f
ииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииии``
  
  
My System SpecsSystem Spec
.


08 Oct 2010   #4

Windows 7 Ultimate 64bit
 
 

Well; ill be back in up to 36 hours then

And thanks; both of you
My System SpecsSystem Spec
08 Oct 2010   #5

Windows 7 Ultimate 32 bit
 
 

You are welcome. John and I both hope this solves your problems.
My System SpecsSystem Spec
Reply

 BSOD being caused by ntoskrnl.exe




Thread Tools



Similar help and support threads for2: BSOD being caused by ntoskrnl.exe
Thread Forum
Solved BSOD, Caused by ntoskrnl.exe BSOD Help and Support
Solved BSOD caused by ntoskrnl.exe BSOD Help and Support
BSOD caused by ntoskrnl.exe BSOD Help and Support
Please Help I get all my BSoD's are caused by ntoskrnl What can I do? BSOD Help and Support
Solved BSOD caused by ntoskrnl.exe? BSOD Help and Support
BSOD caused by ntoskrnl.exe BSOD Help and Support
BSOD caused by ntoskrnl.exe BSOD Help and Support

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

й Designer Media Ltd

All times are GMT -5. The time now is 02:13 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33