Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: "ntoskrnl.exe" BSOD - Random moments


20 Jan 2012   #1

Windows 7 Ultimate 64bit
 
 
"ntoskrnl.exe" BSOD - Lots of crashes, very frequent

I have been getting "ntoskrnl.exe" driver problem for the last few days. I have tried reinstalling my drivers and I even did a system restore but still remains...

Here are dmp files in the zips.
I can also provide other related files if needed.

Thanks,

Tim

My System SpecsSystem Spec
.

20 Jan 2012   #2

Windows 7 x64
 
 

Disk or RAM is bad most likely ... make sure everything is seated well.
My System SpecsSystem Spec
20 Jan 2012   #3

Windows 7 Ultimate 64bit
 
 

I think its a driver version but i am not sure. My graphic card is Radeon HD 6950...
My System SpecsSystem Spec
.


20 Jan 2012   #4

Windows 7 Home Premium 64 Bit
 
 

Code:
  1. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\timason\Windows_NT6_BSOD_jcgriff2\011912-13306-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02c56000 PsLoadedModuleList = 0xfffff800`02e93e70 Debug session time: Thu Jan 19 14:02:40.080 2012 (UTC - 7:00) System Uptime: 0 days 0:07:48.001 Loading Kernel Symbols ............................................................... ................................................................ .................................... Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4E, {99, b5f6c, 2, 1} Probably caused by : memory_corruption ( nt!MiBadShareCount+4c ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 00000000000b5f6c, page frame number Arg3: 0000000000000002, current page state Arg4: 0000000000000001, 0 Debugging Details: ------------------ BUGCHECK_STR: 0x4E_99 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff80002d5613c to fffff80002cc65c0 STACK_TEXT: fffff880`0c3536a8 fffff800`02d5613c : 00000000`0000004e 00000000`00000099 00000000`000b5f6c 00000000`00000002 : nt!KeBugCheckEx fffff880`0c3536b0 fffff800`02c6a407 : 00000000`0005f000 fffffa80`02191410 00000000`00000000 fffff880`0c353878 : nt!MiBadShareCount+0x4c fffff880`0c3536f0 fffff800`02fda03d : fffff980`048c0000 fffff8a0`0c5b4250 fffffa80`00000000 fffff800`00000000 : nt! ?? ::FNODOBFM::`string'+0x2c11b fffff880`0c3539d0 fffff800`02cdf3b7 : 00000000`00040000 fffffa80`06a08200 00000000`00000000 00000000`00ac0000 : nt!CcUnmapVacb+0x5d fffff880`0c353a10 fffff800`02cb6144 : fffffa80`08edfb01 fffffa80`07da2a50 fffffa80`07d86701 00000000`00000000 : nt!CcUnmapVacbArray+0x1b7 fffff880`0c353aa0 fffff800`02cb9bdc : fffffa80`07d867e0 00000000`00000011 fffffa80`07d867e0 fffff800`00000000 : nt!CcDeleteSharedCacheMap+0x140 fffff880`0c353b10 fffff800`02cba3ec : fffff880`069aed00 fffff880`0c353c18 00000000`00000000 fffff880`00000000 : nt!CcWriteBehind+0x5bc fffff880`0c353bc0 fffff800`02cd37e1 : fffffa80`06a3dee0 fffff880`012f1980 fffff800`02ecd160 00000000`00000002 : nt!CcWorkerThread+0x1c8 fffff880`0c353c70 fffff800`02f666fa : fffff880`0c2140e0 fffffa80`09de6040 00000000`00000080 fffffa80`06a1d040 : nt!ExpWorkerThread+0x111 fffff880`0c353d00 fffff800`02ca4b46 : fffff880`02fd5180 fffffa80`09de6040 fffff880`02fdffc0 fffff880`0126d810 : nt!PspSystemThreadStartup+0x5a fffff880`0c353d40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: nt!MiBadShareCount+4c fffff800`02d5613c cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!MiBadShareCount+4c FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c Followup: MachineOwner ---------
  2. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\timason\Windows_NT6_BSOD_jcgriff2\011912-20014-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02c0a000 PsLoadedModuleList = 0xfffff800`02e47e70 Debug session time: Thu Jan 19 04:08:55.271 2012 (UTC - 7:00) System Uptime: 0 days 2:18:05.566 Loading Kernel Symbols ............................................................... ................................................................ .................................... Loading User Symbols Loading unloaded module list .......................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 109, {a3a039d8a16c76d2, b3b7465ef3e948c8, fffff80002c13ae5, 1} *** WARNING: Unable to verify timestamp for win32k.sys *** ERROR: Module load completed but symbols could not be loaded for win32k.sys Probably caused by : memory_corruption Followup: memory_corruption --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* CRITICAL_STRUCTURE_CORRUPTION (109) This bugcheck is generated when the kernel detects that critical kernel code or data have been corrupted. There are generally three causes for a corruption: 1) A driver has inadvertently or deliberately modified critical kernel code or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx 2) A developer attempted to set a normal kernel breakpoint using a kernel debugger that was not attached when the system was booted. Normal breakpoints, "bp", can only be set if the debugger is attached at boot time. Hardware breakpoints, "ba", can be set at any time. 3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data. Arguments: Arg1: a3a039d8a16c76d2, Reserved Arg2: b3b7465ef3e948c8, Reserved Arg3: fffff80002c13ae5, Failure type dependent information Arg4: 0000000000000001, Type of corrupted region, can be 0 : A generic data region 1 : Modification of a function or .pdata 2 : A processor IDT 3 : A processor GDT 4 : Type 1 process list corruption 5 : Type 2 process list corruption 6 : Debug routine modification 7 : Critical MSR modification Debugging Details: ------------------ BUGCHECK_STR: 0x109 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION PROCESS_NAME: System CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002c7a5c0 STACK_TEXT: fffff880`031a8598 00000000`00000000 : 00000000`00000109 a3a039d8`a16c76d2 b3b7465e`f3e948c8 fffff800`02c13ae5 : nt!KeBugCheckEx STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff80002c13aea - nt! ?? ::FNODOBFM::`string'+2d55 [ e9:e8 ] 1 error : !nt (fffff80002c13aea) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
If you are overclocking anything, please stop.
  1. Possible causes are Memory problems... Drivers...
  2. Possible causes are Memory problems... Drivers...
Thanks to Dave76 for help understanding possible causes.
  • Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).


  • An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
    a. Backup your system and user files
    b. Create a system restore point
    c. If you do not have a Windows 7 DVD, Create a system repair disc
    d. Run Driver Verifier

    If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

    Thanks to zigzag3143 for contributing to the Verifier steps.
    If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
My System SpecsSystem Spec
20 Jan 2012   #5

Windows 7 Ultimate 64bit
 
 

Thank you, I am proceeding.
My System SpecsSystem Spec
20 Jan 2012   #6

Windows 7 Home Premium 64 Bit
 
 

Alright. Post back any .dmp files from the crashes caused by Verifier. That will help to determine any incompatible drivers.
My System SpecsSystem Spec
28 Jan 2012   #7

Windows 7 Ultimate 64bit
 
 

Ok, now I really don't know, I did the ram test (both of them) but no problem appeared. I reinstalled the system a few times changing a few things in the BIOS. I discovered that my ram wasnt running in MFP (1600mkz) so I fixed that. It seemed to stabilize itself for a few days. But now it restarted, and its something to do with memory as the crash emits a loud noise like ram crash.
Here is some dmp. Thanks for the help.



Tim
My System SpecsSystem Spec
29 Jan 2012   #8

Windows 7 Home Premium 64 Bit
 
 

Code:
Loading Dump File [C:\Users\Mike\Downloads\timason\012812-166047-01\012812-165017-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c62000 PsLoadedModuleList = 0xfffff800`02ea7670
Debug session time: Sat Jan 28 13:37:23.183 2012 (GMT-7)
System Uptime: 0 days 0:14:52.979
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 135f6c, 2, 1}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000135f6c, page frame number
Arg3: 0000000000000002, current page state
Arg4: 0000000000000001, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  wmpnetwk.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002d67d7c to fffff80002cdec40

STACK_TEXT:  
fffff880`0c9da2d8 fffff800`02d67d7c : 00000000`0000004e 00000000`00000099 00000000`00135f6c 00000000`00000002 : nt!KeBugCheckEx
fffff880`0c9da2e0 fffff800`02c8e442 : fffffa80`03fa41c0 00000000`00000001 ffffffff`ffffffff fffff880`0c9dab00 : nt!MiBadShareCount+0x4c
fffff880`0c9da320 fffff800`02de069a : fffffa80`06b2c758 fffff880`0c9da530 00000000`00000000 fffffa80`0000000d : nt! ?? ::FNODOBFM::`string'+0x21513
fffff880`0c9da510 fffff800`02f2251d : fffffa80`06d2b060 ffffffff`00000001 ffffffff`ffffffff fffff880`0c9dab60 : nt!MiEmptyWorkingSet+0x24a
fffff880`0c9da5c0 fffff800`0312ffcd : 00000000`00000001 00000000`00000801 00000000`00000000 64536553`00000000 : nt!MmAdjustWorkingSetSizeEx+0xad
fffff880`0c9da640 fffff800`03034aab : 00000000`00000008 00000000`00000000 00000000`00000001 00000000`00fff7f0 : nt!PspSetQuotaLimits+0x32d
fffff880`0c9da790 fffff800`02cdded3 : fffffa80`06d2b060 fffff880`0c9dab60 00000000`0387d6c0 00000000`0387d6c0 : nt! ?? ::NNGAKEGL::`string'+0x4a9b0
fffff880`0c9daae0 00000000`771b14da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00fff7b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771b14da


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`02d67d7c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------
Possible causes are Memory problems... Drivers...

Run both memory diagnostics again, Memtest86+ and the Windows Memory Diagnostic tool. Sometimes they miss problems on one run and catch them on a subsequent run.
My System SpecsSystem Spec
29 Jan 2012   #9

Windows 7 Ultimate 64bit
 
 

I am running the test right now, ram by ram. If an error appears, does it just mean that it's faulty?
My System SpecsSystem Spec
29 Jan 2012   #10

Windows 7 Home Premium 64 Bit
 
 

If an error occurs, it means either the module or the slot is faulty and you should test the module in a known good slot (where RAM has passed multiple times before) to determine whether it is the module or slot.
My System SpecsSystem Spec
Reply

 "ntoskrnl.exe" BSOD - Random moments




Thread Tools




Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 07:52 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33