BSOD, random bugs - Ntoskrnl.exe


  1. PJM
    Posts : 5
    Microsoft Windows 7 Professional x64.
       #1

    BSOD, random bugs - Ntoskrnl.exe


    All details listed below and in attached.zip as advised.

    Thank you for taking the time to assist with my issue.


    072115-42822-01.dmp 21/07/2015 07:55:52 SYSTEM_THREAD_EXCEPTION_NOT_HANDLED 0x1000007e ffffffff`c0000005 fffff800`02ffcc7c fffff880`03784f78 fffff880`037847d0 ntoskrnl.exe ntoskrnl.exe+394c7c NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7601.17944 (win7sp1_gdr.120830-0333) x64 ntoskrnl.exe+394c7c C:\Windows\Minidump\072115-42822-01.dmp 8 15 7601 282,112 21/07/2015 07:57:30


    072015-47190-01.dmp 20/07/2015 16:17:54 PAGE_FAULT_IN_NONPAGED_AREA 0x00000050 fffff6af`428000a0 00000000`00000000 fffff800`02d98817 00000000`00000005 ntoskrnl.exe ntoskrnl.exe+7efc0 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7601.17944 (win7sp1_gdr.120830-0333) x64 ntoskrnl.exe+7efc0 C:\Windows\Minidump\072015-47190-01.dmp 8 15 7601 282,112 20/07/2015 16:21:31


    072015-27846-01.dmp 20/07/2015 07:56:21 KMODE_EXCEPTION_NOT_HANDLED 0x0000001e 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 Ntfs.sys Ntfs.sys+c41a NT File System Driver Microsoft® Windows® Operating System Microsoft Corporation 6.1.7600.16385 (win7_rtm.090713-1255) x64 ntoskrnl.exe+7ef90 C:\Windows\Minidump\072015-27846-01.dmp 8 15 7601 282,112 20/07/2015 08:02:17


    072015-33711-01.dmp 20/07/2015 07:54:07 BAD_POOL_CALLER 0x000000c2 00000000`00000007 00000000`0000109b 00000000`00520054 fffff8a0`03677e4c ntoskrnl.exe ntoskrnl.exe+7efc0 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7601.17944 (win7sp1_gdr.120830-0333) x64 ntoskrnl.exe+7efc0 C:\Windows\Minidump\072015-33711-01.dmp 8 15 7601 282,112 20/07/2015 07:55:31


    071715-26707-01.dmp 17/07/2015 08:18:11 MEMORY_MANAGEMENT 0x0000001a 00000000`00003452 00000000`759e8000 fffff700`01081528 21400001`d32bd00c ntoskrnl.exe ntoskrnl.exe+7efc0 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7601.17944 (win7sp1_gdr.120830-0333) x64 ntoskrnl.exe+7efc0 C:\Windows\Minidump\071715-26707-01.dmp 8 15 7601 282,056 17/07/2015 08:19:39
      My Computer


  2. PJM
    Posts : 5
    Microsoft Windows 7 Professional x64.
    Thread Starter
       #2

    In addition tothe above, I have also experienced recently.

    Crash List



    Created by using BlueScreenView

    Dump File Crash Time Bug Check String Bug Check Code Parameter 1 Parameter 2 Parameter 3 Parameter 4 Caused By Driver Caused By Address File Description Product Name Company File Version Processor Crash Address Stack Address 1 Stack Address 2 Stack Address 3 Computer Name Full Path Processors Count Major Version Minor Version Dump File Size Dump File Time 072315-27346-01.dmp 23/07/2015 07:56:38 NTFS_FILE_SYSTEM 0x00000024 00000000`001904fb fffff880`03738718 fffff880`03737f70 fffff800`02cf86de Ntfs.sys Ntfs.sys+48d8 NT File System Driver Microsoft® Windows® Operating System Microsoft Corporation 6.1.7600.16385 (win7_rtm.090713-1255) x64 ntoskrnl.exe+7efc0 C:\Windows\Minidump\072315-27346-01.dmp 8 15 7601 282,112 23/07/2015 07:58:30
    Last edited by PJM; 23 Jul 2015 at 02:32. Reason: attachment
      My Computer


  3. PJM
    Posts : 5
    Microsoft Windows 7 Professional x64.
    Thread Starter
       #3

    Hi,

    A further observation of this fail.

    Initial boot bluescreens before I get the opportunity to log in to Windows. When I hard power cycle, Windows loads everytime on that second attempt.

    I am then prompted with the bluescreen notification with option to check for a solution
      My Computer


  4. Posts : 2,781
    Windows 10 Pro x64
       #4

    Hiya and welcome to SevenForums!
    Code:
    BugCheck 1000007E, {ffffffffc0000005, fffff80002ffcc7c, fffff88003784f78, fffff880037847d0}
    
    Probably caused by : ntkrnlmp.exe ( nt!NtQueryDirectoryObject+238 )
    Code:
    BugCheck 24, {1904fb, fffff88003738718, fffff88003737f70, fffff80002cf86de}
    
    Probably caused by : Ntfs.sys ( Ntfs+11eda8 )

    Run SeaTools SeaTools for DOS and Windows - How to Use

    Run MemTest86+, It must be MemTest86+. RAM - Test with Memtest86+

    Run sfc /scannow and chkdsk /r.
    Install the latest updates from Windows Update.

    Do the exact same steps for chkdsk /r but instead of typing in sfc /scannow type chkdsk /r.

    SFC /SCANNOW Command - System File Checker

    Snap a picture when the BSOD occurs.
      My Computer


  5. PJM
    Posts : 5
    Microsoft Windows 7 Professional x64.
    Thread Starter
       #5

    I will get on to that, in the meanwhile I ran Windbg against some of my dumps, I'll post the outputs I have.

    Code:
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
     
    Loading Dump File [C:\Windows\Minidump\080715-31527-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    Symbol search path is: C:\Symbols;srv*
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
    Machine Name:
    Kernel base = 0xfffff800`02c4b000 PsLoadedModuleList = 0xfffff800`02e8f670
    Debug session time: Fri Aug 7 08:02:04.448 2015 (UTC + 1:00)
    System Uptime: 0 days 0:01:54.447
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    Use !analyze -v to get detailed debugging information.
    BugCheck 1A, {41284, 60ac001, 0, fffff70001080000}
    Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3c8 )
    Followup: MachineOwner
    ---------
    7: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 0000000000041284, A PTE or the working set list is corrupt.
    Arg2: 00000000060ac001
    Arg3: 0000000000000000
    Arg4: fffff70001080000
    Debugging Details:
    ------------------
     
    OVERLAPPED_MODULE: Address regions for 'nwifi' and 'RtsUVStor.sy' overlap
    BUGCHECK_STR: 0x1a_41284
    CUSTOMER_CRASH_COUNT: 1
    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
    PROCESS_NAME: Bginfo.exe
    CURRENT_IRQL: 0
    LAST_CONTROL_TRANSFER: from fffff80002d20a37 to fffff80002cc9fc0
    STACK_TEXT: 
    fffff880`09559f38 fffff800`02d20a37 : 00000000`0000001a 00000000`00041284 00000000`060ac001 00000000`00000000 : nt!KeBugCheckEx
    fffff880`09559f40 fffff800`02cfb280 : fffff700`01080000 d5500001`7ba4f867 e0300001`7b57ec66 fffffa80`00000001 : nt! ?? ::FNODOBFM::`string'+0x4ac3
    fffff880`09559f80 fffff800`02cb681f : fffffa80`00000000 00000000`0bbeffff 00000000`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x4e8
    fffff880`0955a140 fffff800`02cc9253 : ffffffff`ffffffff fffff880`0955a410 fffff880`0955a478 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
    fffff880`0955a240 fffff800`02cc5810 : fffff960`000d7110 00000000`00000001 fffff900`c00f8010 fffff900`c1a84010 : nt!KiSystemServiceCopyEnd+0x13
    fffff880`0955a3d8 fffff960`000d7110 : 00000000`00000001 fffff900`c00f8010 fffff900`c1a84010 00000000`00000000 : nt!KiServiceLinkage
    fffff880`0955a3e0 fffff960`000d7460 : 00000000`00000000 fffff880`00000000 fffff900`c1a84010 00000000`00000000 : win32k!SURFACE::bDeleteSurface+0x3c8
    fffff880`0955a530 fffff960`0009800d : 00000000`05050245 fffff900`c1a84010 00000000`00000245 00000000`05050245 : win32k!bDeleteSurface+0x34
    fffff880`0955a560 fffff800`02cc9253 : fffffa80`0aa88b50 00000000`767a37e0 00000000`00000001 00000000`00050000 : win32k!NtGdiDeleteObjectApp+0xd5
    fffff880`0955a590 00000000`74952e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`0008d448 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74952e09
     
    STACK_COMMAND: kb
    FOLLOWUP_IP: 
    win32k!SURFACE::bDeleteSurface+3c8
    fffff960`000d7110 e9b0010000 jmp win32k!SURFACE::bDeleteSurface+0x57d (fffff960`000d72c5)
    SYMBOL_STACK_INDEX: 6
    SYMBOL_NAME: win32k!SURFACE::bDeleteSurface+3c8
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: win32k
    IMAGE_NAME: win32k.sys
    DEBUG_FLR_IMAGE_TIMESTAMP: 50ad9b54
    FAILURE_BUCKET_ID: X64_0x1a_41284_win32k!SURFACE::bDeleteSurface+3c8
    BUCKET_ID: X64_0x1a_41284_win32k!SURFACE::bDeleteSurface+3c8
    Followup: MachineOwner
    Code:
    Loading Dump File [C:\Windows\Minidump\080515-32151-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    Symbol search path is: C:\Symbols;srv*
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
    Machine Name:
    Kernel base = 0xfffff800`02c61000 PsLoadedModuleList = 0xfffff800`02ea5670
    Debug session time: Wed Aug 5 07:57:42.231 2015 (UTC + 1:00)
    System Uptime: 0 days 0:01:06.199
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    Use !analyze -v to get detailed debugging information.
    BugCheck 1A, {31, fffffa800d7c8dc0, fffff880075b8000, fffff8a002961f02}
    Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+7271 )
    Followup: MachineOwner
    ---------
    6: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 0000000000000031, The subtype of the bugcheck.
    Arg2: fffffa800d7c8dc0
    Arg3: fffff880075b8000
    Arg4: fffff8a002961f02
    Debugging Details:
    ------------------
     
    OVERLAPPED_MODULE: Address regions for 'nwifi' and 'RtsUVStor.sy' overlap
    BUGCHECK_STR: 0x1a_31
    CUSTOMER_CRASH_COUNT: 1
    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
    PROCESS_NAME: WerFault.exe
    CURRENT_IRQL: 0
    LAST_CONTROL_TRANSFER: from fffff80002f38915 to fffff80002cdffc0
    STACK_TEXT: 
    fffff880`07ca7748 fffff800`02f38915 : 00000000`0000001a 00000000`00000031 fffffa80`0d7c8dc0 fffff880`075b8000 : nt!KeBugCheckEx
    fffff880`07ca7750 fffff800`02fb3797 : fffffa80`00000000 fffffa80`0d3e9760 00000000`000000bd fffff8a0`02958000 : nt! ?? ::NNGAKEGL::`string'+0x7271
    fffff880`07ca77b0 fffff800`02d0eceb : ffffffff`ffffffff fffff880`07ca7938 00000000`00008000 fffffa80`0db4b500 : nt!MiRelocateImagePfn+0xf7
    fffff880`07ca7810 fffff800`02d06cbf : fffffa80`0d1ced40 fffff880`07ca7940 fffffa80`0db386e8 00000000`80100080 : nt!MiWaitForInPageComplete+0x7ef
    fffff880`07ca78f0 fffff800`02ced65a : 00000000`00000000 00000000`00000000 ffffffff`ffffffff fffffa80`00000000 : nt!MiIssueHardFault+0x28b
    fffff880`07ca7980 fffff800`02cde0ee : 00000000`00000000 000007fe`f651ae80 00000000`001dc601 00000000`004d67b0 : nt!MmAccessFault+0x146a
    fffff880`07ca7ae0 000007fe`fde344fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
    00000000`001dcdd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fde344fd
     
    STACK_COMMAND: kb
    FOLLOWUP_IP: 
    nt! ?? ::NNGAKEGL::`string'+7271
    fffff800`02f38915 cc int 3
    SYMBOL_STACK_INDEX: 1
    SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+7271
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: nt
    IMAGE_NAME: ntkrnlmp.exe
    DEBUG_FLR_IMAGE_TIMESTAMP: 503f82be
    FAILURE_BUCKET_ID: X64_0x1a_31_nt!_??_::NNGAKEGL::_string_+7271
    BUCKET_ID: X64_0x1a_31_nt!_??_::NNGAKEGL::_string_+7271
    Followup: MachineOwner
    Code:
    Loading Dump File [C:\Windows\Minidump\080415-24538-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    Symbol search path is: C:\Symbols;srv*
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
    Machine Name:
    Kernel base = 0xfffff800`02c08000 PsLoadedModuleList = 0xfffff800`02e4c670
    Debug session time: Tue Aug 4 07:59:58.955 2015 (UTC + 1:00)
    System Uptime: 0 days 0:01:47.775
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................................................
    Loading User Symbols
    Loading unloaded module list
    ....
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    Use !analyze -v to get detailed debugging information.
    BugCheck 1A, {41284, 9d7a001, 3d50, fffff70001080000}
    Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3c8 )
    Followup: MachineOwner
    ---------
    6: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 0000000000041284, A PTE or the working set list is corrupt.
    Arg2: 0000000009d7a001
    Arg3: 0000000000003d50
    Arg4: fffff70001080000
    Debugging Details:
    ------------------
     
    BUGCHECK_STR: 0x1a_41284
    CUSTOMER_CRASH_COUNT: 1
    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
    PROCESS_NAME: Bginfo.exe
    CURRENT_IRQL: 0
    LAST_CONTROL_TRANSFER: from fffff80002cdda37 to fffff80002c86fc0
    STACK_TEXT: 
    fffff880`02a2bf38 fffff800`02cdda37 : 00000000`0000001a 00000000`00041284 00000000`09d7a001 00000000`00003d50 : nt!KeBugCheckEx
    fffff880`02a2bf40 fffff800`02cb8280 : fffff700`01080000 d5000001`4439e867 ed000001`44a9fc66 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4ac3
    fffff880`02a2bf80 fffff800`02c7381f : fffffa80`00000000 00000000`0c1dffff 00000000`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x4e8
    fffff880`02a2c140 fffff800`02c86253 : ffffffff`ffffffff fffff880`02a2c410 fffff880`02a2c478 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
    fffff880`02a2c240 fffff800`02c82810 : fffff960`000c7110 00000000`00000001 fffff900`c00bf010 fffff900`c3637010 : nt!KiSystemServiceCopyEnd+0x13
    fffff880`02a2c3d8 fffff960`000c7110 : 00000000`00000001 fffff900`c00bf010 fffff900`c3637010 00000000`00000000 : nt!KiServiceLinkage
    fffff880`02a2c3e0 fffff960`000c7460 : 00000000`00000000 fffff880`00000000 fffff900`c3637010 00000000`00000000 : win32k!SURFACE::bDeleteSurface+0x3c8
    fffff880`02a2c530 fffff960`0008800d : 00000000`0905029b fffff900`c3637010 00000000`0000029b 00000000`0905029b : win32k!bDeleteSurface+0x34
    fffff880`02a2c560 fffff800`02c86253 : fffffa80`0c1e6060 00000000`74e337e0 00000000`00000001 00000000`00050000 : win32k!NtGdiDeleteObjectApp+0xd5
    fffff880`02a2c590 00000000`74bb2e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`0008d448 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74bb2e09
     
    STACK_COMMAND: kb
    FOLLOWUP_IP: 
    win32k!SURFACE::bDeleteSurface+3c8
    fffff960`000c7110 e9b0010000 jmp win32k!SURFACE::bDeleteSurface+0x57d (fffff960`000c72c5)
    SYMBOL_STACK_INDEX: 6
    SYMBOL_NAME: win32k!SURFACE::bDeleteSurface+3c8
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: win32k
    IMAGE_NAME: win32k.sys
    DEBUG_FLR_IMAGE_TIMESTAMP: 50ad9b54
    FAILURE_BUCKET_ID: X64_0x1a_41284_win32k!SURFACE::bDeleteSurface+3c8
    BUCKET_ID: X64_0x1a_41284_win32k!SURFACE::bDeleteSurface+3c8
    Followup: MachineOwner
    ---------
    Thanks for the welcome and thanks for the reply. Since I first posted I've been researching debug when I've had the time, I'm picking up as much as I can, I'm just as keen to learn as I am to repair my fault(s)
      My Computer


  6. Posts : 2,781
    Windows 10 Pro x64
       #6

    No problem! Well i couldn't analyze those 2 specific dumps as i got an symbol error.
      My Computer


  7. PJM
    Posts : 5
    Microsoft Windows 7 Professional x64.
    Thread Starter
       #7

    Laith said:
    No problem! Well i couldn't analyze those 2 specific dumps as i got an symbol error.

    I had the same issue, used !symfix which loaded the correct symbol set as I apparently had downloaded the wrong set locally.
      My Computer


  8. Posts : 2,781
    Windows 10 Pro x64
       #8

    Oh, it mentioned that while analyzing. Thanks i'll use that next time wrong symbols are loaded.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 09:34.
Find Us