Random BSOD refers to ntoskrnl.exe

Page 1 of 4 123 ... LastLast

  1. Posts : 25
    windows 7 Home Premium 64bit
       #1

    Random BSOD refers to ntoskrnl.exe


    Windows 7 Home Premium gives a BSOD randomly, sometimes when the computer is being used and other times when it is idling. Any and all help would be appreciated.
    Last edited by JimW1956; 04 Sep 2012 at 23:02. Reason: Adding Dump File
      My Computer


  2. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #2

    Welcome aboard.

    The dump is not specifying anything there!
    Code:
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck A, {300100000009, 2, 1, fffff80002cd6266}
    
    Probably caused by : win32k.sys ( win32k!TimersProc+197 )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 0000300100000009, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
        bit 0 : value 0 = read operation, 1 = write operation
        bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff80002cd6266, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002efa100
     0000300100000009 
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    nt!KiInsertTimerTable+c6
    fffff800`02cd6266 4c894008        mov     qword ptr [rax+8],r8
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    BUGCHECK_STR:  0xA
    
    PROCESS_NAME:  csrss.exe
    
    TRAP_FRAME:  fffff880023127e0 -- (.trap 0xfffff880023127e0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000300100000001 rbx=0000000000000000 rcx=0000000000019283
    rdx=fffff80002e64f90 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002cd6266 rsp=fffff88002312970 rbp=fffffa8005235538
     r8=fffffa8007830cb0  r9=000000000000006b r10=fffff80002e3de80
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    nt!KiInsertTimerTable+0xc6:
    fffff800`02cd6266 4c894008        mov     qword ptr [rax+8],r8 ds:00003001`00000009=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80002cca769 to fffff80002ccb1c0
    
    STACK_TEXT:  
    fffff880`02312698 fffff800`02cca769 : 00000000`0000000a 00003001`00000009 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
    fffff880`023126a0 fffff800`02cc93e0 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`07830c90 : nt!KiBugCheckDispatch+0x69
    fffff880`023127e0 fffff800`02cd6266 : 00000000`00000202 fffff800`02cd081a fffff880`009e7180 fffffa80`08821510 : nt!KiPageFault+0x260
    fffff880`02312970 fffff800`02cd5fa0 : ffffffff`fffca4a0 fffff800`02e3de80 fffffa80`07830c90 00000000`00000000 : nt!KiInsertTimerTable+0xc6
    fffff880`023129d0 fffff800`02cd5ea4 : fffff900`c064ddf0 ffffffff`fffca4a0 00000000`00000000 fffff960`00000002 : nt!KiSetTimerEx+0xf0
    fffff880`02312a60 fffff960`00144b77 : 00000000`00000000 00000000`00000001 00000000`00000004 fffff800`02cd4033 : nt!KeSetTimer+0x14
    fffff880`02312aa0 fffff960`0014554b : 00000000`00000000 fffff960`00365f10 00000000`00000004 00000000`00000001 : win32k!TimersProc+0x197
    fffff880`02312af0 fffff960`000d5098 : fffffa80`0000007b 00000000`0000000f fffff880`00000001 ffffffff`800002e4 : win32k!RawInputThread+0x9ab
    fffff880`02312bc0 fffff960`00155d9a : fffffa80`00000002 fffff880`01fe5f40 00000000`00000020 00000000`00000000 : win32k!xxxCreateSystemThreads+0x58
    fffff880`02312bf0 fffff800`02cca453 : fffffa80`078b6980 00000000`00000004 000007ff`fffae000 00000000`00000000 : win32k!NtUserCallNoParam+0x36
    fffff880`02312c20 000007fe`fd761eea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`002ef798 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fd761eea
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    win32k!TimersProc+197
    fffff960`00144b77 488b5c2450      mov     rbx,qword ptr [rsp+50h]
    
    SYMBOL_STACK_INDEX:  6
    
    SYMBOL_NAME:  win32k!TimersProc+197
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: win32k
    
    IMAGE_NAME:  win32k.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  5006fd0d
    
    FAILURE_BUCKET_ID:  X64_0xA_win32k!TimersProc+197
    
    BUCKET_ID:  X64_0xA_win32k!TimersProc+197
    
    Followup: MachineOwner
    ---------
    
    0: kd> .trap 0xfffff880023127e0
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000300100000001 rbx=0000000000000000 rcx=0000000000019283
    rdx=fffff80002e64f90 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002cd6266 rsp=fffff88002312970 rbp=fffffa8005235538
     r8=fffffa8007830cb0  r9=000000000000006b r10=fffff80002e3de80
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    nt!KiInsertTimerTable+0xc6:
    fffff800`02cd6266 4c894008        mov     qword ptr [rax+8],r8 ds:00003001`00000009=????????????????
    0: kd> kv
      *** Stack trace for last set context - .thread/.cxr resets it
    Child-SP          RetAddr           : Args to Child                                                           : Call Site
    fffff880`02312970 fffff800`02cd5fa0 : ffffffff`fffca4a0 fffff800`02e3de80 fffffa80`07830c90 00000000`00000000 : nt!KiInsertTimerTable+0xc6
    fffff880`023129d0 fffff800`02cd5ea4 : fffff900`c064ddf0 ffffffff`fffca4a0 00000000`00000000 fffff960`00000002 : nt!KiSetTimerEx+0xf0
    fffff880`02312a60 fffff960`00144b77 : 00000000`00000000 00000000`00000001 00000000`00000004 fffff800`02cd4033 : nt!KeSetTimer+0x14
    fffff880`02312aa0 fffff960`0014554b : 00000000`00000000 fffff960`00365f10 00000000`00000004 00000000`00000001 : win32k!TimersProc+0x197
    fffff880`02312af0 fffff960`000d5098 : fffffa80`0000007b 00000000`0000000f fffff880`00000001 ffffffff`800002e4 : win32k!RawInputThread+0x9ab
    fffff880`02312bc0 fffff960`00155d9a : fffffa80`00000002 fffff880`01fe5f40 00000000`00000020 00000000`00000000 : win32k!xxxCreateSystemThreads+0x58
    fffff880`02312bf0 fffff800`02cca453 : fffffa80`078b6980 00000000`00000004 000007ff`fffae000 00000000`00000000 : win32k!NtUserCallNoParam+0x36
    fffff880`02312c20 000007fe`fd761eea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02312c20)
    00000000`002ef798 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fd761eea
    0: kd> .trap fffff880`02312c20
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=000007fefd763734
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=000007fefd761eea rsp=00000000002ef798 rbp=0000000000000000
     r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    0033:000007fe`fd761eea ??              ???
    0: kd> kv
      *** Stack trace for last set context - .thread/.cxr resets it
    Child-SP          RetAddr           : Args to Child                                                           : Call Site
    00000000`002ef798 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fd761eea
    ► Do you have any USB hard disk attached, if so, remove it and see if it is stopping crashes, and check for issues in your internal HDDs.

    1. Reseat the sata and power.
    2. Run chkdsk /f/r, following the option two of the tutorial Disk Check
    3. Seatool for dos: SeaTools | Seagate download
      Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

    Is the computer is a part of a network, and there is another computer there in the same name?

    Event[11881]:
    Log Name: System
    Source: Server
    Date: 2012-05-08T02:07:44.000
    Event ID: 2505
    Task: N/A
    Level: Error
    Opcode: N/A
    Keyword: Classic
    User: N/A
    User Name: N/A
    Computer: Dorie-HP
    Description:
    The server could not bind to the transport \Device\NetBT_Tcpip_{E9064561-4FEA-4C35-98DA-2BB3AD430945} because another computer on the network has the same name. The server could not start.
    You should try to get that computer out of the network first, and see what it behaves individually.

    Event[14725]:
    Log Name: System
    Source: Service Control Manager
    Date: 2012-05-18T08:20:01.484
    Event ID: 7001
    Task: N/A
    Level: Error
    Opcode: N/A
    Keyword: Classic
    User: N/A
    User Name: N/A
    Computer: Dorie-HP
    Description:
    The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
    The dependency service or group failed to start.
    I have nothing to say against Avast, but I would suggest you install Malwarebytes : Free anti-malware and have a full scan your system with it, in safe mode.

    Let us know how things went.
      My Computer


  3. Posts : 25
    windows 7 Home Premium 64bit
    Thread Starter
       #3

    Thank You for your help & suggestions!
    Only USB device is the mouse. Hadn't noticed 2 pc's with the same name I changed one of them.
    I reseated the SATA , memory , & power. Then ran 10 passes of memtest+ no problems, ran chkdsk Option 2 with suggested switches no problems.
    I haven't run Seatools yet.
    I did give in over the weekend and did a clean reinstall but within 6 hrs. got a BSOD and several since then. I have attached the latest dump files using the SF Diagnostic Tool. I know it looks like I'm way behind on updating everything, but have done all updates since reinstall.
    I use Avast & Malwarebytes , just hadn't got it installed on this pc until this morning.
    I am confused though, I shut the pc down yesterday afternoon and didn't boot it back up til around 9 this morning and haven't had a BSOD yet; Knock on Wood.
    I will keep you updated.
      My Computer


  4. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #4

    Jim, do one more thing. Enable Driver Verifier.
    Driver Verifier - Enable and Disable

    It will monitor your third party drivers, and will put the exact information in the subsequent dumps, if any.
      My Computer


  5. Posts : 25
    windows 7 Home Premium 64bit
    Thread Starter
       #5

    Well 2 days using the pc problem free then a BSOD sometime last night when idle. I ran SeaTools/Seagate yesterday afternoon finding no problems.
    I hope I enabled Driver Verifier correctly.
    Attached is the dump file from this morning, hopefully it will tell us something.
    Last edited by JimW1956; 13 Sep 2012 at 16:56. Reason: Renamed Log
      My Computer


  6. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #6

    Jim, the latest dump you supplied is of 11th of this month, that means before the time you have enabled driver verifier.

    We wanted to check a crash dump with the verifier on, so it will be of no help in this case

    The latest one, dated 11/9 2012 shows this:
    Code:
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1A, {5003, fffff70001080000, 2669, 266d00004c09}
    
    Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29731 )
    
    Followup: MachineOwner
    ---------
    A bugcheck 1A occurs due to a device driver or a memory related issue. As no device driver is found earlier, I suggested you to enable driver verifier so that the third party drivers can be monitored. But the crash shows that it is an earlier one.

    On the basis of that dump, I would suggest you to run memtest.
    RAM - Test with Memtest86+
      My Computer


  7. Posts : 25
    windows 7 Home Premium 64bit
    Thread Starter
       #7

    Arc,

    I noticed the date on the file also but thought I was missing something. I'm not sure why the last BSOD didn't create a dump file.
    I'll run memtest tonight and tomorrow and post an update tomorrow evening.
    Again I want to Thank You for your help and guidance with this problem.
      My Computer


  8. Posts : 25
    windows 7 Home Premium 64bit
    Thread Starter
       #8

    I ran memtest86+ for 14 Passes (21hrs) with no Errors. I guess I'll keep my fingers crossed the BSOD nightmare is over unless you have other suggestions to try to pinpoint the problem.
      My Computer


  9. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #9

    Wait a couple of days, see how it works now.

    If it keeps crashing, let us know.
      My Computer


  10. Posts : 25
    windows 7 Home Premium 64bit
    Thread Starter
       #10

    I didn't have to wait long. The system crashed last night at idle and then twice this morning while I was trying to run the SF Diagnostic tool. Finally ended up going into Safe Mode to get the Dump Files for you. Hopefully this file will help.
      My Computer


 
Page 1 of 4 123 ... LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 09:29.
Find Us