[HELP] ntoskrnl.exe & ntkrnlmp.exe & fltmgr.sys BSOD Issue

Arc · 01 Nov 2012

OK, nvidia display driver failed to be loaded there.

Code:

fffff880`033d2138  fffff880`0f1694f1*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
 nvlddmkm+0xbd4f1

You may update it from Drivers - Download NVIDIA Drivers.

But, as it is stop 0x50, and there is a couple of IRQL_NOT_LESS_OR_EQUAL too, better you uninstall norton, at lease as a test.

Uninstall these two:

Start Menu\Programs\Norton 360
Start Menu\Programs\Norton Management

Uninstall those using Norton removal tool and then install Microsoft Security Essentials - Microsoft Windows.

Let us know the results.

Mattrhorn · 18 Nov 2012

Yet Again there was another BSOD, But this time was different...
Ysterday, my computer restarted for a Windows Update... Now i have my BD-Rom Drive Back and working fine. But i started to install a game through a disc, and opened up a steam game by accident, then i got a Blue Screen. These are the logs from WhoCrashed.exe:

On Sun 18/11/2012 11:24:27 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\111812-38001-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x7EFC0)
Bugcheck code: 0xA (0xFFFFFA80310BB2D0, 0x2, 0x1, 0xFFFFF80003595376)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

On Sun 18/11/2012 11:24:27 PM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
Bugcheck code: 0xA (0xFFFFFA80310BB2D0, 0x2, 0x1, 0xFFFFF80003595376)
Error: IRQL_NOT_LESS_OR_EQUAL
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

And my computer was having problems with the SF Tool so i dont know whether or not you got everything you needed

Arc · 19 Nov 2012

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa80310bb2d0, 2, 1, fffff80003595376}

Probably caused by : memory_corruption ( nt!MiReleaseConfirmedPageFileSpace+86 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa80310bb2d0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80003595376, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003710100
GetUlongFromAddress: unable to read from fffff800037101c0
 fffffa80310bb2d0 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiReleaseConfirmedPageFileSpace+86
fffff800`03595376 480fb328        btr     qword ptr [rax],rbp

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff880037d28e0 -- (.trap 0xfffff880037d28e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8011bbb010 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003595376 rsp=fffff880037d2a70 rbp=00000000fa80161c
 r8=fffff880037d2aa0  r9=0000000000000002 r10=0000000000000000
r11=0000058000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiReleaseConfirmedPageFileSpace+0x86:
fffff800`03595376 480fb328        btr     qword ptr [rax],rbp ds:fffffa80`11bbb010=77c0fcffffff1d22
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800034e0569 to fffff800034e0fc0

STACK_TEXT:  
fffff880`037d2798 fffff800`034e0569 : 00000000`0000000a fffffa80`310bb2d0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`037d27a0 fffff800`034df1e0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`037d28e0 fffff800`03595376 : fffff8a0`246be520 00000000`00000000 fffffa80`1127a820 00000000`00000000 : nt!KiPageFault+0x260
fffff880`037d2a70 fffff800`03549e71 : fa80161c`649000c0 00000000`0008c011 fa80161c`649000c0 fffff800`037d3926 : nt!MiReleaseConfirmedPageFileSpace+0x86
fffff880`037d2af0 fffff800`0377c0cb : fffffa80`161c6410 00000000`00000000 00000000`0008c081 fffffa80`11f99e30 : nt! ?? ::FNODOBFM::`string'+0x2ad4d
fffff880`037d2bc0 fffff800`0352d651 : fffffa80`161c6418 00000000`00000001 00000000`00000000 00000000`00000631 : nt!MiSegmentDelete+0x7b
fffff880`037d2c00 fffff800`0352d515 : 00000000`00000000 00000000`00000080 fffffa80`0cd36b30 fffffa80`00000012 : nt!MiProcessDereferenceList+0x131
fffff880`037d2cc0 fffff800`03777e5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiDereferenceSegmentThread+0x10d
fffff880`037d2d40 fffff800`034d1d26 : fffff880`009b2180 fffffa80`0cdf4500 fffff880`009bd0c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`037d2d80 00000000`00000000 : fffff880`037d3000 fffff880`037cd000 fffff880`037d27f0 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiReleaseConfirmedPageFileSpace+86
fffff800`03595376 480fb328        btr     qword ptr [rax],rbp

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiReleaseConfirmedPageFileSpace+86

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+86

BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+86

Followup: MachineOwner
---------

Your crash dumps are not showing any finite probable cause. In such a situation, it is better to enable Driver Verifier to monitor the drivers.

Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight, per RAM module per slot.

Let us know the results, with the subsequent crash dumps, if any.

Mattrhorn · 19 Nov 2012

I ran verifier last night untill the morning and i doubt anything came up... i left m ycomputer on all day and nothing, soo i think it was just a flook. Thanks for taking a look anyways arc

Mattrhorn · 19 Nov 2012

Well this makes me very upset but i just had ANOTHER BSOD!!!... Luckily its telling me something this time ( I hope :) ). Heres the Logs and ill set up the SFfile for you:

On Tue 20/11/2012 2:13:18 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\111912-36473-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x7EFC0)
Bugcheck code: 0x1A (0x5003, 0xFFFFF70001080000, 0x49F3A, 0x49F3800093A74)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

On Tue 20/11/2012 2:13:18 AM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: dxgmms1.sys (dxgmms1!VidMmInterface+0x22165)
Bugcheck code: 0x1A (0x5003, 0xFFFFF70001080000, 0x49F3A, 0x49F3800093A74)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\drivers\dxgmms1.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: DirectX Graphics MMS
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system which cannot be identified at this time.

It appears that there is something with the network management... I am tempted to run the memtest so i think ill stand off and do that, let me know what you think

Arc · 20 Nov 2012

Update the display driver to the latest.
Latest NVIDIA ForceWare Video Drivers Windows 7

Uninstall Norton and all Symentec products using Norton Removal tool.
Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.

Download and install those, and then run full system scans with both of them, one by one.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight, per RAM module per slot.

Mattrhorn · 15 Dec 2012

Yet Again... These seem to be way less frequently which is good. but still going on.
Tell me what you think. I was doing absolutly nothing at this time as I was away from my computer.

On Sun 16/12/2012 12:53:20 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\121512-37877-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x7EFC0)
Bugcheck code: 0xA (0xFFFFFA80314CC2A8, 0x2, 0x1, 0xFFFFF80003593376)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

On Sun 16/12/2012 12:53:20 AM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
Bugcheck code: 0xA (0xFFFFFA80314CC2A8, 0x2, 0x1, 0xFFFFF80003593376)
Error: IRQL_NOT_LESS_OR_EQUAL
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

Arc · 16 Dec 2012

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight, per RAM module per slot.

Mattrhorn · 24 Dec 2012

Well Im getting them again, This time its not getting any clues. I Got 2 BSOD's within around 24 hours and it seems to bee something important this time. I Updated my Video Driver right after the first one and i thought that would have fixed it, then a second one happened this morning while i was asleep (the first one happened around 3:00PM yesterday)

Any ways i ran a memtest and nothing came up and here's the who crashed analysis:

On Mon 24/12/2012 7:40:39 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\122412-34975-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x7EFC0)
Bugcheck code: 0xA (0xFFFFFA80315CE2A0, 0x2, 0x1, 0xFFFFF80003580376)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

On Mon 24/12/2012 7:40:39 AM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntfs.sys (Ntfs+0x7C9F3)
Bugcheck code: 0xA (0xFFFFFA80315CE2A0, 0x2, 0x1, 0xFFFFF80003580376)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system which cannot be identified at this time.

On Sun 23/12/2012 7:01:28 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\122312-57065-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x7EFC0)
Bugcheck code: 0xA (0xFFFFFA8031363310, 0x2, 0x1, 0xFFFFF80003533376)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

On Sun 16/12/2012 12:53:20 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\121512-37877-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x7EFC0)
Bugcheck code: 0xA (0xFFFFFA80314CC2A8, 0x2, 0x1, 0xFFFFF80003593376)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

Arc · 24 Dec 2012

IRQL Less or not Equal accompanied by a lot of fltmgr.sys error indicates an Antivirus program's filter management system causing some messes there.

Uninstall Norton and all Symentec products using Norton Removal tool , at least as a test.
Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.

Download and install those, and then run full system scans with both of them, one by one.

Let us know the results.

Also, free up the startup.

Click on the Start button
Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
Select the “Startup” tab.
Deselect all items other than the antivirus.
Apply > OK
Accept the restart.