Windows 7: Sony Vaio BSOD - ntoskrnl

Skers01 · 11 Dec 2012

I have been having a difficult time with BSOD on my 2 year old Vaio laptop. The first blue screen appeared seemingly out of nowhere one afternoon while using the machine all morning. During troubleshooting, all of the subsequent BSOD occur shortly after startup. The only thing that changed on the system during the day of the first occurrence was a Windows update. I restored the computer to the settings prior to that update but did not solve the issue. Often these errors occur even while in Safe Mode while troubleshooting. I have downloaded the dmp file tool and included the files captured by that diagnostic tool. From my limited experience, it appears the error is related to the ntoskrnl.exe. This is very frustrating and hope I can resolve the issue. Thank you in advance for your assistance.

bagavan · 12 Dec 2012

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffffa8006958bb0, 0, fffa8000}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+487ad )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffffa8006958bb0, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 00000000fffa8000, Parameter 1 of the exception

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000350d100
GetUlongFromAddress: unable to read from fffff8000350d1c0
 0000000000000000 Nonpaged pool

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+0
fffffa80`06958bb0 f3a4            rep movs byte ptr [rdi],byte ptr [rsi]

BUGCHECK_STR:  0x1E_c0000005_R

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  mscorsvw.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800629a930 -- (.trap 0xfffff8800629a930)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000091c rbx=0000000000000000 rcx=000000000000011c
rdx=00000000fffa0288 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa8006958bb0 rsp=fffff8800629aac0 rbp=fffff8800629abc0
 r8=0000000000000004  r9=fffffa80097670b0 r10=fffffa8004252840
r11=fffffa80081ae4b0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
fffffa80`06958bb0 f3a4            rep movs byte ptr [rdi],byte ptr [rsi]
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003328a88 to fffff800032ddfc0

STACK_TEXT:  
fffff880`0629a0a8 fffff800`03328a88 : 00000000`0000001e ffffffff`c0000005 fffffa80`06958bb0 00000000`00000000 : nt!KeBugCheckEx
fffff880`0629a0b0 fffff800`032dd642 : fffff880`0629a888 fffffa80`0969a680 fffff880`0629a930 00000000`fffa8000 : nt! ?? ::FNODOBFM::`string'+0x487ad
fffff880`0629a750 fffff800`032dc1ba : 00000000`00000000 00000000`fffa8000 fffff880`0629aa00 fffffa80`0969a680 : nt!KiExceptionDispatch+0xc2
fffff880`0629a930 fffffa80`06958bb0 : fffff880`0629abc0 00000000`fffa00e8 fffffa80`0695c250 fffffa80`0695f750 : nt!KiPageFault+0x23a
fffff880`0629aac0 fffff880`0629abc0 : 00000000`fffa00e8 fffffa80`0695c250 fffffa80`0695f750 00000000`00003000 : 0xfffffa80`06958bb0
fffff880`0629aac8 00000000`fffa00e8 : fffffa80`0695c250 fffffa80`0695f750 00000000`00003000 00000000`00000040 : 0xfffff880`0629abc0
fffff880`0629aad0 fffffa80`0695c250 : fffffa80`0695f750 00000000`00003000 00000000`00000040 fffff880`0629ab40 : 0xfffa00e8
fffff880`0629aad8 fffffa80`0695f750 : 00000000`00003000 00000000`00000040 fffff880`0629ab40 00000000`00000002 : 0xfffffa80`0695c250
fffff880`0629aae0 00000000`00003000 : 00000000`00000040 fffff880`0629ab40 00000000`00000002 fffff880`00100000 : 0xfffffa80`0695f750
fffff880`0629aae8 00000000`00000040 : fffff880`0629ab40 00000000`00000002 fffff880`00100000 00000000`00000002 : 0x3000
fffff880`0629aaf0 fffff880`0629ab40 : 00000000`00000002 fffff880`00100000 00000000`00000002 00000000`fffa0000 : 0x40
fffff880`0629aaf8 00000000`00000002 : fffff880`00100000 00000000`00000002 00000000`fffa0000 fffffa80`03aa4a00 : 0xfffff880`0629ab40
fffff880`0629ab00 fffff880`00100000 : 00000000`00000002 00000000`fffa0000 fffffa80`03aa4a00 00000000`00000024 : 0x2
fffff880`0629ab08 00000000`00000002 : 00000000`fffa0000 fffffa80`03aa4a00 00000000`00000024 ffffffff`80000bb4 : 0xfffff880`00100000
fffff880`0629ab10 00000000`fffa0000 : fffffa80`03aa4a00 00000000`00000024 ffffffff`80000bb4 00000000`0000a000 : 0x2
fffff880`0629ab18 fffffa80`03aa4a00 : 00000000`00000024 ffffffff`80000bb4 00000000`0000a000 00000000`00000000 : 0xfffa0000
fffff880`0629ab20 00000000`00000024 : ffffffff`80000bb4 00000000`0000a000 00000000`00000000 00000000`00009000 : 0xfffffa80`03aa4a00
fffff880`0629ab28 ffffffff`80000bb4 : 00000000`0000a000 00000000`00000000 00000000`00009000 00000000`00000030 : 0x24
fffff880`0629ab30 00000000`0000a000 : 00000000`00000000 00000000`00009000 00000000`00000030 00000000`00000000 : 0xffffffff`80000bb4
fffff880`0629ab38 00000000`00000000 : 00000000`00009000 00000000`00000030 00000000`00000000 fffff880`0629ab78 : 0xa000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+487ad
fffff800`03328a88 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+487ad

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_R_nt!_??_::FNODOBFM::_string_+487ad

BUCKET_ID:  X64_0x1E_c0000005_R_nt!_??_::FNODOBFM::_string_+487ad

Followup: MachineOwner
---------

Update your microsoft net framework.

Also run driver verifier and post back the dumps

Driver Verifier - Enable and Disable

Skers01 · 12 Dec 2012

I see Microsoft has a .NET Framework 4.5 available for download. Is that the version I need to update to?

Also, I will run the driver verifier later today and report back.

bagavan · 12 Dec 2012

Yes. Driver verifier tests the drivers and BSOD if it has found a faulty driver.

Please post back the dumps

Skers01 · 13 Dec 2012

Ok, I have updated .net framework to 4.5. Also ran driver verifier per the attached instructions. I did not physically see verifier do anything, but thought I understood that it would be done behind the scenes. I have actually been operating in normal mode for the majority of the evening and only had two BSOD. One was during initial startup and one was at the start of a reboot. I have included a new dump file.

bagavan · 13 Dec 2012

Uninstall/update sony power manager program.

Note: Still MS framework is still causing a BSOD.

Try to disable it from start up menu

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffffa8006911bb0, 0, 7efa8000}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+487ad )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffffa8006911bb0, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 000000007efa8000, Parameter 1 of the exception

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034c6100
GetUlongFromAddress: unable to read from fffff800034c61c0
 0000000000000000 Nonpaged pool

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+999ad74fe0
fffffa80`06911bb0 f3a4            rep movs byte ptr [rdi],byte ptr [rsi]

BUGCHECK_STR:  0x1E_c0000005_R

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  PowerManager.e

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880033a8930 -- (.trap 0xfffff880033a8930)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000091c rbx=0000000000000000 rcx=000000000000011c
rdx=000000007efa0288 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa8006911bb0 rsp=fffff880033a8ac0 rbp=fffff880033a8bc0
 r8=0000000000000004  r9=00000000ffffffff r10=fffffa8008932c10
r11=fffffa800355f040 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
fffffa80`06911bb0 f3a4            rep movs byte ptr [rdi],byte ptr [rsi]
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032e1a88 to fffff80003296fc0

STACK_TEXT:  
fffff880`033a80a8 fffff800`032e1a88 : 00000000`0000001e ffffffff`c0000005 fffffa80`06911bb0 00000000`00000000 : nt!KeBugCheckEx
fffff880`033a80b0 fffff800`03296642 : fffff880`033a8888 fffffa80`0404d3d0 fffff880`033a8930 00000000`7efa8000 : nt! ?? ::FNODOBFM::`string'+0x487ad
fffff880`033a8750 fffff800`032951ba : 00000000`00000000 00000000`7efa8000 fffff880`033a8a00 fffffa80`0404d3d0 : nt!KiExceptionDispatch+0xc2
fffff880`033a8930 fffffa80`06911bb0 : fffff880`033a8bc0 00000000`7efa00e8 fffffa80`06915250 fffffa80`06918750 : nt!KiPageFault+0x23a
fffff880`033a8ac0 fffff880`033a8bc0 : 00000000`7efa00e8 fffffa80`06915250 fffffa80`06918750 00000000`00003000 : 0xfffffa80`06911bb0
fffff880`033a8ac8 00000000`7efa00e8 : fffffa80`06915250 fffffa80`06918750 00000000`00003000 00000000`00000040 : 0xfffff880`033a8bc0
fffff880`033a8ad0 fffffa80`06915250 : fffffa80`06918750 00000000`00003000 00000000`00000040 fffff880`033a8b40 : 0x7efa00e8
fffff880`033a8ad8 fffffa80`06918750 : 00000000`00003000 00000000`00000040 fffff880`033a8b40 00000000`00000002 : 0xfffffa80`06915250
fffff880`033a8ae0 00000000`00003000 : 00000000`00000040 fffff880`033a8b40 00000000`00000002 fffff880`00100000 : 0xfffffa80`06918750
fffff880`033a8ae8 00000000`00000040 : fffff880`033a8b40 00000000`00000002 fffff880`00100000 00000000`00000002 : 0x3000
fffff880`033a8af0 fffff880`033a8b40 : 00000000`00000002 fffff880`00100000 00000000`00000002 00000000`7efa0000 : 0x40
fffff880`033a8af8 00000000`00000002 : fffff880`00100000 00000000`00000002 00000000`7efa0000 fffffa80`08c98000 : 0xfffff880`033a8b40
fffff880`033a8b00 fffff880`00100000 : 00000000`00000002 00000000`7efa0000 fffffa80`08c98000 00000000`00000024 : 0x2
fffff880`033a8b08 00000000`00000002 : 00000000`7efa0000 fffffa80`08c98000 00000000`00000024 ffffffff`80000b6c : 0xfffff880`00100000
fffff880`033a8b10 00000000`7efa0000 : fffffa80`08c98000 00000000`00000024 ffffffff`80000b6c 00000000`0000a000 : 0x2
fffff880`033a8b18 fffffa80`08c98000 : 00000000`00000024 ffffffff`80000b6c 00000000`0000a000 00000000`00000000 : 0x7efa0000
fffff880`033a8b20 00000000`00000024 : ffffffff`80000b6c 00000000`0000a000 00000000`00000000 00000000`00009000 : 0xfffffa80`08c98000
fffff880`033a8b28 ffffffff`80000b6c : 00000000`0000a000 00000000`00000000 00000000`00009000 00000000`00000030 : 0x24
fffff880`033a8b30 00000000`0000a000 : 00000000`00000000 00000000`00009000 00000000`00000030 00000000`00000000 : 0xffffffff`80000b6c
fffff880`033a8b38 00000000`00000000 : 00000000`00009000 00000000`00000030 00000000`00000000 fffff880`033a8b78 : 0xa000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+487ad
fffff800`032e1a88 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+487ad

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_R_nt!_??_::FNODOBFM::_string_+487ad

BUCKET_ID:  X64_0x1E_c0000005_R_nt!_??_::FNODOBFM::_string_+487ad

Followup: MachineOwner
---------

Skers01 · 13 Dec 2012

I updated the power management program from Sony. Also think I got the MS framework disabled from startup. Here is a new set of dump files. Thanks!

bagavan · 13 Dec 2012

Power manager is still responsible for one of crash.

Try disabling that service from start up.

**Arc** · 13 Dec 2012

► Get rid of intel rapid storage.

Right click on "my computer" icon and click "manage" on the context menu.
It will open the "computer management" window.
Select "Device Manager" in the left pane, It will list all the existing devices up.
Expand "Disc Drives" by clicking on the triangle in front of it.
Select one item under it, right click, uninstall.
Continue the process for all items under "Disc Drives"
Now restart the computer. At restart, windows will auto configure the appropriate system driver, msahci.sys.

► update the network driver.
Atheros network adapter driver: ATHEROS drivers for Microsoft Windows (Atheros?????)
Marvell Yukon networking driver: Marvell - Support

First, download the network card driver from manufactuer's website.
Then reinstall the driver:

Click the Start Button, type "devmgmt.msc" (without quotation marks) in the Start Menu Search box and press Enter.
Double click to expand "Network adaptors".
Right click your network card and click Uninstall.
Check "Delete driver software for this device" check box, click OK.
Restart the computer
If windows does not auto configure the appropriate drivers at startup, install the downloaded one manually.

► Clean Up Factory Bloatware

Let us know the results.

Skers01 · 13 Dec 2012

I removed PM from startup and rebooted. Got a BSOD while running dump file tool. I am running Memtest now and will reply back with results from that and latest dump files.

Windows 7: Sony Vaio BSOD - ntoskrnl

Sony Vaio BSOD - ntoskrnl problems?