Windows 7: "ntoskrnl.exe" BSOD - Random moments

timason · 20 Jan 2012

I have been getting "ntoskrnl.exe" driver problem for the last few days. I have tried reinstalling my drivers and I even did a system restore but still remains...

Here are dmp files in the zips.
I can also provide other related files if needed.

Thanks,

Tim

pcunite · 20 Jan 2012

Disk or RAM is bad most likely ... make sure everything is seated well.

timason · 20 Jan 2012

I think its a driver version but i am not sure. My graphic card is Radeon HD 6950...

writhziden · 20 Jan 2012

Code:


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\timason\Windows_NT6_BSOD_jcgriff2\011912-13306-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02c56000 PsLoadedModuleList = 0xfffff800`02e93e70
Debug session time: Thu Jan 19 14:02:40.080 2012 (UTC - 7:00)
System Uptime: 0 days 0:07:48.001
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, b5f6c, 2, 1}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000b5f6c, page frame number
Arg3: 0000000000000002, current page state
Arg4: 0000000000000001, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002d5613c to fffff80002cc65c0

STACK_TEXT:  
fffff880`0c3536a8 fffff800`02d5613c : 00000000`0000004e 00000000`00000099 00000000`000b5f6c 00000000`00000002 : nt!KeBugCheckEx
fffff880`0c3536b0 fffff800`02c6a407 : 00000000`0005f000 fffffa80`02191410 00000000`00000000 fffff880`0c353878 : nt!MiBadShareCount+0x4c
fffff880`0c3536f0 fffff800`02fda03d : fffff980`048c0000 fffff8a0`0c5b4250 fffffa80`00000000 fffff800`00000000 : nt! ?? ::FNODOBFM::`string'+0x2c11b
fffff880`0c3539d0 fffff800`02cdf3b7 : 00000000`00040000 fffffa80`06a08200 00000000`00000000 00000000`00ac0000 : nt!CcUnmapVacb+0x5d
fffff880`0c353a10 fffff800`02cb6144 : fffffa80`08edfb01 fffffa80`07da2a50 fffffa80`07d86701 00000000`00000000 : nt!CcUnmapVacbArray+0x1b7
fffff880`0c353aa0 fffff800`02cb9bdc : fffffa80`07d867e0 00000000`00000011 fffffa80`07d867e0 fffff800`00000000 : nt!CcDeleteSharedCacheMap+0x140
fffff880`0c353b10 fffff800`02cba3ec : fffff880`069aed00 fffff880`0c353c18 00000000`00000000 fffff880`00000000 : nt!CcWriteBehind+0x5bc
fffff880`0c353bc0 fffff800`02cd37e1 : fffffa80`06a3dee0 fffff880`012f1980 fffff800`02ecd160 00000000`00000002 : nt!CcWorkerThread+0x1c8
fffff880`0c353c70 fffff800`02f666fa : fffff880`0c2140e0 fffffa80`09de6040 00000000`00000080 fffffa80`06a1d040 : nt!ExpWorkerThread+0x111
fffff880`0c353d00 fffff800`02ca4b46 : fffff880`02fd5180 fffffa80`09de6040 fffff880`02fdffc0 fffff880`0126d810 : nt!PspSystemThreadStartup+0x5a
fffff880`0c353d40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`02d5613c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aa44

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\timason\Windows_NT6_BSOD_jcgriff2\011912-20014-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02c0a000 PsLoadedModuleList = 0xfffff800`02e47e70
Debug session time: Thu Jan 19 04:08:55.271 2012 (UTC - 7:00)
System Uptime: 0 days 2:18:05.566
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
..........................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d8a16c76d2, b3b7465ef3e948c8, fffff80002c13ae5, 1}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d8a16c76d2, Reserved
Arg2: b3b7465ef3e948c8, Reserved
Arg3: fffff80002c13ae5, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
	0 : A generic data region
	1 : Modification of a function or .pdata
	2 : A processor IDT
	3 : A processor GDT
	4 : Type 1 process list corruption
	5 : Type 2 process list corruption
	6 : Debug routine modification
	7 : Critical MSR modification

Debugging Details:
------------------


BUGCHECK_STR:  0x109

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002c7a5c0

STACK_TEXT:  
fffff880`031a8598 00000000`00000000 : 00000000`00000109 a3a039d8`a16c76d2 b3b7465e`f3e948c8 fffff800`02c13ae5 : nt!KeBugCheckEx


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff80002c13aea - nt! ?? ::FNODOBFM::`string'+2d55
	[ e9:e8 ]
1 error : !nt (fffff80002c13aea)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

If you are overclocking anything, please stop.

Possible causes are Memory problems... Drivers...
Possible causes are Memory problems... Drivers...

Thanks to Dave76 for help understanding possible causes.

Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. Run Driver Verifier

If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.

timason · 20 Jan 2012

Thank you, I am proceeding.

writhziden · 20 Jan 2012

Alright. Post back any .dmp files from the crashes caused by Verifier. That will help to determine any incompatible drivers.

timason · 28 Jan 2012

Ok, now I really don't know, I did the ram test (both of them) but no problem appeared. I reinstalled the system a few times changing a few things in the BIOS. I discovered that my ram wasnt running in MFP (1600mkz) so I fixed that. It seemed to stabilize itself for a few days. But now it restarted, and its something to do with memory as the crash emits a loud noise like ram crash.
Here is some dmp. Thanks for the help.

Tim

writhziden · 29 Jan 2012

Code:

Loading Dump File [C:\Users\Mike\Downloads\timason\012812-166047-01\012812-165017-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c62000 PsLoadedModuleList = 0xfffff800`02ea7670
Debug session time: Sat Jan 28 13:37:23.183 2012 (GMT-7)
System Uptime: 0 days 0:14:52.979
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 135f6c, 2, 1}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000135f6c, page frame number
Arg3: 0000000000000002, current page state
Arg4: 0000000000000001, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  wmpnetwk.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002d67d7c to fffff80002cdec40

STACK_TEXT:  
fffff880`0c9da2d8 fffff800`02d67d7c : 00000000`0000004e 00000000`00000099 00000000`00135f6c 00000000`00000002 : nt!KeBugCheckEx
fffff880`0c9da2e0 fffff800`02c8e442 : fffffa80`03fa41c0 00000000`00000001 ffffffff`ffffffff fffff880`0c9dab00 : nt!MiBadShareCount+0x4c
fffff880`0c9da320 fffff800`02de069a : fffffa80`06b2c758 fffff880`0c9da530 00000000`00000000 fffffa80`0000000d : nt! ?? ::FNODOBFM::`string'+0x21513
fffff880`0c9da510 fffff800`02f2251d : fffffa80`06d2b060 ffffffff`00000001 ffffffff`ffffffff fffff880`0c9dab60 : nt!MiEmptyWorkingSet+0x24a
fffff880`0c9da5c0 fffff800`0312ffcd : 00000000`00000001 00000000`00000801 00000000`00000000 64536553`00000000 : nt!MmAdjustWorkingSetSizeEx+0xad
fffff880`0c9da640 fffff800`03034aab : 00000000`00000008 00000000`00000000 00000000`00000001 00000000`00fff7f0 : nt!PspSetQuotaLimits+0x32d
fffff880`0c9da790 fffff800`02cdded3 : fffffa80`06d2b060 fffff880`0c9dab60 00000000`0387d6c0 00000000`0387d6c0 : nt! ?? ::NNGAKEGL::`string'+0x4a9b0
fffff880`0c9daae0 00000000`771b14da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00fff7b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771b14da


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`02d67d7c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

Possible causes are Memory problems... Drivers...

Run both memory diagnostics again, Memtest86+ and the Windows Memory Diagnostic tool. Sometimes they miss problems on one run and catch them on a subsequent run.

timason · 29 Jan 2012

I am running the test right now, ram by ram. If an error appears, does it just mean that it's faulty?

writhziden · 29 Jan 2012

If an error occurs, it means either the module or the slot is faulty and you should test the module in a known good slot (where RAM has passed multiple times before) to determine whether it is the module or slot.

Windows 7: "ntoskrnl.exe" BSOD - Random moments

"ntoskrnl.exe" BSOD - Random moments problems?