Two BSOD caused by "ntoskrnl.exe" on Windows 7 64 bit

fede0411 · 11 Aug 2010

Hi

My PC:

"windows 7 64bit
the original OS was windows XP
OEM Version"

"Hardware: P5k pro, Intel core 2quad CPU Q6600, 4,0gb ram, Nvidia GeForce 9600gt"

I attached the dumps files about this two BSOD.. please help me!

thank you very much! =)

ttran · 12 Aug 2010

I suspect the graphic card. Please re-install video driver. When upgrading your graphic driver you MUST remove all traces of the current driver. In order to do that we recommend using Guru3D - Driver Sweeper

When it is removed then download and install the fresh copy.

Also, re-install directx as well:
Download details: DirectX End-User Runtime

BUGCHECK SUMMARY:

Code:

BugCheck 3B, {c0000005, fffff80002a964b4, fffff880059210b0, 0}

Unable to load image \SystemRoot\System32\win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : dxgmms1.sys ( dxgmms1!VidSchIsVSyncEnabled+c6 )

Followup: MachineOwner
---------
BugCheck 50, {fffff928c1d45ca8, 1, fffff80002ba607a, 5}


Could not read faulting driver name
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1ee )

Followup: Pool_corruption
---------

Regard,

Tuan

fede0411 · 12 Aug 2010

ttran said:

I suspect the graphic card. Please re-install video driver. When upgrading your graphic driver you MUST remove all traces of the current driver. In order to do that we recommend using Guru3D - Driver Sweeper

When it is removed then download and install the fresh copy.

Also, re-install directx as well:
Download details: DirectX End-User Runtime

BUGCHECK SUMMARY:

Code:

BugCheck 3B, {c0000005, fffff80002a964b4, fffff880059210b0, 0}

Unable to load image \SystemRoot\System32\win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : dxgmms1.sys ( dxgmms1!VidSchIsVSyncEnabled+c6 )

Followup: MachineOwner
---------
BugCheck 50, {fffff928c1d45ca8, 1, fffff80002ba607a, 5}


Could not read faulting driver name
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1ee )

Followup: Pool_corruption
---------

Regard,

Tuan

I had just finished to re-install driver and directX when BSOD again.. here dump file:

ttran · 12 Aug 2010

The results from the DMP files do not give a definitive answer. While we investigate further here are a few things that you can do.

1-Run a system file check to verify and repair you system files. You do this by typing cmd in search, then right click and run as admin. SFC /SCANNOW

2-Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Boot from the CD, and leave it running for at least 5 or 6 passes.

3-Device manager
Please go to start>search>type device manager.
Are there any "unknown devices" with yellow triangles on them?
Is you driver there , listed, and working?

If your driver is missing, or there is a yellow triangle on it, you will need to update it.

5-Driver verifier
please run Verifier with these settings:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
NOTE: You can use Low Resource Simulation if you'd like. From my limited experimentation it makes the BSOD's come faster.
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

If that doesn't work, post back and we'll have to see about fixing the registry entry off-line:

Code:

Delete these registry keys (works in XP, Vista, Win7):
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDrivers
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDriverLevel

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users

fede0411 · 12 Aug 2010

ttran said:

The results from the DMP files do not give a definitive answer. While we investigate further here are a few things that you can do.

1-Run a system file check to verify and repair you system files. You do this by typing cmd in search, then right click and run as admin. SFC /SCANNOW

2-Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Boot from the CD, and leave it running for at least 5 or 6 passes.

3-Device manager
Please go to start>search>type device manager.
Are there any "unknown devices" with yellow triangles on them?
Is you driver there , listed, and working?

If your driver is missing, or there is a yellow triangle on it, you will need to update it.

5-Driver verifier
please run Verifier with these settings:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
NOTE: You can use Low Resource Simulation if you'd like. From my limited experimentation it makes the BSOD's come faster.
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

If that doesn't work, post back and we'll have to see about fixing the registry entry off-line:

Code:

Delete these registry keys (works in XP, Vista, Win7):
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDrivers
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDriverLevel

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users

- I done the system file check

- I already run memtest86 one day ago.. i left work him for all night long until a stupid blackout.. he worked about 14hours.. passes complete, no error.

- There aren't uknown devices

- I will run driver verifier and I will let you know

fede0411 · 12 Aug 2010

ok, here dump file of the BSOD after running Driver Verifier!

Jonathan_King · 12 Aug 2010

The dump is pointing to memory corruption, unfortunately not a specific driver.

Please remove Avast with this tool: http://files.avast.com/files/eng/aswclear5.exe

Replace it with MSE: http://www.microsoft.com/security_essentials

Update your Realtek audio drivers: Realtek

...Summary of the Dumps:

Code:


Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Thu Aug 12 14:48:56.466 2010 (UTC - 4:00)
System Uptime: 0 days 1:52:30.230
BugCheck A, {fffffa801b12e320, 2, 1, fffff80002a8931f}
Probably caused by : memory_corruption ( nt!MiDeleteKernelStackPages+ab )
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR:  0xA
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨

fede0411 · 13 Aug 2010

at the moment i updated realtek driver and it is not crashing! we'll see

fede0411 · 13 Aug 2010

can you check this dump file?
Attachment 91081

reventon · 13 Aug 2010

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff800074f0ff8, 0, fffff880053c1293, 2}

Unable to load image \??\C:\Windows\system32\drivers\aswMonFlt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswMonFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for aswMonFlt.sys

Could not read faulting driver name
Probably caused by : aswMonFlt.sys ( aswMonFlt+5293 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff800074f0ff8, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff880053c1293, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cfd0e0
 fffff800074f0ff8 

FAULTING_IP: 
aswMonFlt+5293
fffff880`053c1293 49396a20        cmp     qword ptr [r10+20h],rbp

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800356cb40 -- (.trap 0xfffff8800356cb40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffffebfffffffb rbx=0000000000000000 rcx=fffff880053ceda0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880053c1293 rsp=fffff8800356ccd0 rbp=01cb3b0147246554
 r8=fffffa8003968a68  r9=0000000000005424 r10=fffff800074f0fd8
r11=0000000000004000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
aswMonFlt+0x5293:
fffff880`053c1293 49396a20        cmp     qword ptr [r10+20h],rbp ds:6080:fffff800`074f0ff8=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002b448f2 to fffff80002ac5740

STACK_TEXT:  
fffff880`0356c9d8 fffff800`02b448f2 : 00000000`00000050 fffff800`074f0ff8 00000000`00000000 fffff880`0356cb40 : nt!KeBugCheckEx
fffff880`0356c9e0 fffff800`02ac382e : 00000000`00000000 00000000`000012ef 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x40ec0
fffff880`0356cb40 fffff880`053c1293 : fffff800`00b96080 00000000`00000000 fffff880`053c1518 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0356ccd0 fffff800`00b96080 : 00000000`00000000 fffff880`053c1518 00000000`00000000 00000000`00000000 : aswMonFlt+0x5293
fffff880`0356ccd8 00000000`00000000 : fffff880`053c1518 00000000`00000000 00000000`00000000 fffff880`053c1518 : 0xfffff800`00b96080


STACK_COMMAND:  kb

FOLLOWUP_IP: 
aswMonFlt+5293
fffff880`053c1293 49396a20        cmp     qword ptr [r10+20h],rbp

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  aswMonFlt+5293

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: aswMonFlt

IMAGE_NAME:  aswMonFlt.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c2906fa

FAILURE_BUCKET_ID:  X64_0x50_aswMonFlt+5293

BUCKET_ID:  X64_0x50_aswMonFlt+5293

Followup: MachineOwner

Avast still blamed.

Remove it, and if you still get problems then run a Memtest.

Memtest - Instructions:

Download the ISO (or the .exe for USB drives) from here Memtest86+ - Advanced Memory Diagnostic Tool

Then (if you have chosen the ISO) burn the ISO using IsoRecorder: ISO Recorder v3 Download (How to use IsoRecorder)

Boot from the CD/USB and run the test (at least 7 passes per test) with only one stick of RAM in place at a time.

It is a time consuming process but it is the only way to be sure it isn't a RAM fault.

For your final test, run the test with all the RAM in place.