BSOD being caused by ntoskrnl.exe


  1. Posts : 2
    Windows 7 Ultimate 64bit
       #1

    BSOD being caused by ntoskrnl.exe


    Hey guys;

    I searched these forums for other posts; and generally people just suggested repairing windows.

    When i try an repair my windows 7 (Ultimate 64bit) it tells me it cannot upgrade my system to 32bit, and yes i have been clicking x64 when i choose my system type.

    Ill dump the Bluescreen viewer reports here as well as the report/.

    Thanks for the help guys.
      My Computer


  2. Posts : 11,990
    Windows 7 Ultimate 32 bit
       #2

    Welcome to the forum. I am sorry your are having problems.

    Both of your dumps blame memory corruption and do not point to any specific cause.

    Error code A, IRQL_NOT_LESS_OR_EQUAL. Usually causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

    Error code 1E, KMODE_EXCEPTION_NOT_HANDLED . Usual causes: Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS
    Code:
    Kernel base = 0xfffff800`02a14000 PsLoadedModuleList = 0xfffff800`02c51e50
    Debug session time: Fri Oct  8 17:08:19.452 2010 (GMT-4)
    System Uptime: 0 days 4:31:44.294
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .........................
    Loading User Symbols
    Loading unloaded module list
    ........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck A, {fffffa8050910220, 2, 1, fffff80002aa9b7f}
    
    Probably caused by : memory_corruption ( nt!MiReplenishPageSlist+100 )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: fffffa8050910220, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
        bit 0 : value 0 = read operation, 1 = write operation
        bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff80002aa9b7f, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cbc0e0
     fffffa8050910220 
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    nt!MiReplenishPageSlist+100
    fffff800`02aa9b7f f00fba6b1000    lock bts dword ptr [rbx+10h],0
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    BUGCHECK_STR:  0xA
    
    PROCESS_NAME:  rundll32.exe
    
    TRAP_FRAME:  fffff88007346010 -- (.trap 0xfffff88007346010)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000001adb00b rbx=0000000000000000 rcx=fdffffffffffffff
    rdx=0000000000000050 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002aa9b7f rsp=fffff880073461a0 rbp=fffffa8005100730
     r8=fffff80002cbe400  r9=fffffa8005100000 r10=fffffa8005100750
    r11=fffff880073461f8 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    nt!MiReplenishPageSlist+0x100:
    fffff800`02aa9b7f f00fba6b1000    lock bts dword ptr [rbx+10h],0 ds:5820:00000000`00000010=????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80002a83ca9 to fffff80002a84740
    
    STACK_TEXT:  
    fffff880`07345ec8 fffff800`02a83ca9 : 00000000`0000000a fffffa80`50910220 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
    fffff880`07345ed0 fffff800`02a82920 : fffffa80`07b08b00 fffffa80`50910210 fffffa80`07ea5820 00000000`00000000 : nt!KiBugCheckDispatch+0x69
    fffff880`07346010 fffff800`02aa9b7f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
    fffff880`073461a0 fffff800`02aaa0af : fffff800`02cbe400 00000000`0000002e fffffa80`008030a0 fffffa80`008024a0 : nt!MiReplenishPageSlist+0x100
    fffff880`07346200 fffff800`02ab3d14 : 00000000`00000000 ffffffff`00000000 ffffffff`ffffffff 00000000`000002e0 : nt!MiRemoveAnyPage+0x24f
    fffff880`07346320 fffff800`02ab06ce : fffff980`18da8000 00000000`00b68040 fffff880`00000000 00000000`00001000 : nt!MmCopyToCachedPage+0xc84
    fffff880`07346510 fffff800`02ab0434 : fffffa80`05381310 00000000`00b68040 fffff880`07346650 00000000`00000000 : nt!CcMapAndCopyInToCache+0x20e
    fffff880`07346600 fffff880`01256f40 : fffff8a0`0bdb9168 fffff880`07346880 fffffa80`07ed78b0 fffff880`07346800 : nt!CcCopyWrite+0x194
    fffff880`07346690 fffff880`0125b413 : fffffa80`07ed78b0 fffffa80`05cf0010 fffff880`07346801 fffff880`07346800 : Ntfs!NtfsCommonWrite+0xda0
    fffff880`07346850 fffff880`0102023f : fffffa80`05cf03b0 fffffa80`05cf0010 fffffa80`07eaf6e0 00000000`00000001 : Ntfs!NtfsFsdWrite+0x1c3
    fffff880`07346910 fffff880`0101e6df : fffffa80`0615f830 00000000`00000001 fffffa80`0615f800 fffffa80`05cf0010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
    fffff880`073469a0 fffff800`02d9aca9 : 00000000`00000001 fffffa80`07ea5820 00000000`00000001 fffffa80`05cf0010 : fltmgr!FltpDispatch+0xcf
    fffff880`07346a00 fffff800`02d9ba43 : fffffa80`05cf03f8 fffffa80`05aef920 fffffa80`07ea5820 fffff800`02bfee80 : nt!IopSynchronousServiceTail+0xf9
    fffff880`07346a70 fffff800`02a83993 : 00000000`00000a01 00000000`00000140 00000000`00000000 00000000`01a761f8 : nt!NtWriteFile+0x7e2
    fffff880`07346b70 00000000`7796ff3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`0010dc78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7796ff3a
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt!MiReplenishPageSlist+100
    fffff800`02aa9b7f f00fba6b1000    lock bts dword ptr [rbx+10h],0
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  nt!MiReplenishPageSlist+100
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9
    
    IMAGE_NAME:  memory_corruption
    
    FAILURE_BUCKET_ID:  X64_0xA_nt!MiReplenishPageSlist+100
    
    BUCKET_ID:  X64_0xA_nt!MiReplenishPageSlist+100
    
    Followup: MachineOwner
    ---------
    
    Kernel base = 0xfffff800`02a03000 PsLoadedModuleList = 0xfffff800`02c40e50
    Debug session time: Fri Oct  8 19:44:10.588 2010 (GMT-4)
    System Uptime: 0 days 2:34:17.429
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .........................
    Loading User Symbols
    Loading unloaded module list
    ........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1E, {ffffffffc0000005, fffff80002a98b7f, 0, ffffffffffffffff}
    
    Probably caused by : memory_corruption ( nt!MiReplenishPageSlist+100 )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    KMODE_EXCEPTION_NOT_HANDLED (1e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff80002a98b7f, The address that the exception occurred at
    Arg3: 0000000000000000, Parameter 0 of the exception
    Arg4: ffffffffffffffff, Parameter 1 of the exception
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    FAULTING_IP: 
    nt!MiReplenishPageSlist+100
    fffff800`02a98b7f f00fba6b1000    lock bts dword ptr [rbx+10h],0
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  ffffffffffffffff
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cab0e0
     ffffffffffffffff 
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    BUGCHECK_STR:  0x1E
    
    PROCESS_NAME:  chrome.exe
    
    CURRENT_IRQL:  2
    
    EXCEPTION_RECORD:  fffff8800a0615d8 -- (.exr 0xfffff8800a0615d8)
    ExceptionAddress: fffff80002a98b7f (nt!MiReplenishPageSlist+0x0000000000000100)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: ffffffffffffffff
    Attempt to read from address ffffffffffffffff
    
    TRAP_FRAME:  fffff8800a061680 -- (.trap 0xfffff8800a061680)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffffa8000000000 rbx=0000000000000000 rcx=fdffffffffffffff
    rdx=0000000000000050 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002a98b7f rsp=fffff8800a061810 rbp=fffffa80051006e0
     r8=fffff80002cad400  r9=fffffa8005100000 r10=fffffa8005100700
    r11=fffff8800a061868 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe nc
    nt!MiReplenishPageSlist+0x100:
    fffff800`02a98b7f f00fba6b1000    lock bts dword ptr [rbx+10h],0 ds:00000000`00000010=????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80002aada39 to fffff80002a73740
    
    STACK_TEXT:  
    fffff880`0a060e08 fffff800`02aada39 : 00000000`0000001e ffffffff`c0000005 fffff800`02a98b7f 00000000`00000000 : nt!KeBugCheckEx
    fffff880`0a060e10 fffff800`02a72d82 : fffff880`0a0615d8 fffef280`00000000 fffff880`0a061680 00000000`00000005 : nt!KiDispatchException+0x1b9
    fffff880`0a0614a0 fffff800`02a7168a : 00000000`00007ffe 00000000`018ecfff fffffa80`05f94560 fffffa80`05e1c060 : nt!KiExceptionDispatch+0xc2
    fffff880`0a061680 fffff800`02a98b7f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a
    fffff880`0a061810 fffff800`02a990af : fffff800`02cad400 00000000`0000002c fffffa80`00802440 fffffa80`00801840 : nt!MiReplenishPageSlist+0x100
    fffff880`0a061870 fffff800`02a912c7 : 00000000`00000002 fffff880`00000002 fffffa80`05e1c3f8 00000000`00000002 : nt!MiRemoveAnyPage+0x24f
    fffff880`0a061990 fffff800`02a8d9c6 : 00000000`00000001 00000000`03db3000 fffff880`0a061be0 fffff680`0001ed98 : nt!MiResolveDemandZeroFault+0x577
    fffff880`0a061a80 fffff800`02a7182e : 00000000`00000001 00000000`00000007 00000000`00000001 00000000`7efdb000 : nt!MmAccessFault+0x5c6
    fffff880`0a061be0 00000000`646eb1f8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
    00000000`0022e220 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x646eb1f8
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt!MiReplenishPageSlist+100
    fffff800`02a98b7f f00fba6b1000    lock bts dword ptr [rbx+10h],0
    
    SYMBOL_STACK_INDEX:  4
    
    SYMBOL_NAME:  nt!MiReplenishPageSlist+100
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9
    
    IMAGE_NAME:  memory_corruption
    
    FAILURE_BUCKET_ID:  X64_0x1E_nt!MiReplenishPageSlist+100
    
    BUCKET_ID:  X64_0x1E_nt!MiReplenishPageSlist+100
    
    Followup: MachineOwner
    ---------
    I find out of date drivers on your system; some of them are really obsolete. Out of date drivers can and do cause memory corruption can BSOD's. Update the drivers below, especially those in red font.
    gdrv.sys Sat Oct 13 03:22:00 2007 - Uninstall Gigabyte's Easy Saver program, as it is known to cause BSODs.

    LHidFilt.Sys Fri Sep 21 07:05:39 2007
    - Logitech SetPoint HID Filter Driver Downloads

    LMouFilt.Sys Fri Sep 21 07:05:43 2007 - Logitech SetPoint HID Filter Driver, Downloads

    LUsbFilt.Sys Fri Sep 21 07:05:46 2007 - Logitech SetPoint USB Filter Downloads

    Rt64win7.sys Thu Feb 26 04:04:13 2009 - Latest PCIe GBE (GigaBit Ethernet) drivers here: Realtek

    RTKVHD64.sys Thu Jun 26 23:21:58 2008 - Realtek High Definition Audio Function Driver Realtek
    I can't say these drivers caused your crashers; but they are definitely not contributing to the stability of your system. Take care of the above drivers, reboot and run your system. Let's see how it does. Let us know and upload any new BSOD's.
      My Computer


  3. Posts : 5,705
    Win7 x64 + x86
       #3

    You only have 35 hotfixes installed, there's at least 45 to 60 (or more) available for Win7.
    Please visit Windows Update and get the rest of the updates.

    Please uninstall Catalyst Control Center as it can cause BSOD's in some systems. If needed, feel free to reinstall it after we're finished troubleshooting.

    Please update your Logitech Mouse/Keyboard software/drivers as the one's that are currently installed are from 2007

    Please uninstall the Gigabyte tools from your system. If they're not installed, please rename C:\Windows\System32\drivers\gdrv.sys to gdrv.BAK (it's from 2007 also).

    Please run Driver Verifier according to these instructions:
    Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

    So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

    Then, here's the procedure:
    - Go to Start and type in "verifier" (without the quotes) and press Enter
    - Select "Create custom settings (for code developers)" and click "Next"
    - Select "Select individual settings from a full list" and click "Next"
    - Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
    NOTE: You can use Low Resource Simulation if you'd like. From my limited experimentation it makes the BSOD's come faster.
    - Select "Select driver names from a list" and click "Next"
    Then select all drivers NOT provided by Microsoft and click "Next"
    - Select "Finish" on the next page.

    Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

    Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

    If you can't get into Windows because it crashes too soon, try it in Safe Mode.
    If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

    If that doesn't work, post back and we'll have to see about fixing the registry entry off-line:
    Code:
    Delete these registry keys (works in XP, Vista, Win7):
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDrivers
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDriverLevel
    More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users

    BSOD BUGCHECK SUMMARY
    Code:
    
    Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
    Debug session time: Fri Oct  8 19:44:10.588 2010 (UTC - 4:00)
    System Uptime: 0 days 2:34:17.429
    Probably caused by : memory_corruption ( nt!MiReplenishPageSlist+100 )
    BUGCHECK_STR:  0x1E_c0000005
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    PROCESS_NAME:  chrome.exe
    Bugcheck code 0000001E
    Arguments ffffffff`c0000005 fffff800`02a98b7f 00000000`00000000 ffffffff`ffffffff
    ииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииии``
    Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
    Debug session time: Fri Oct  8 17:08:19.452 2010 (UTC - 4:00)
    System Uptime: 0 days 4:31:44.294
    Probably caused by : memory_corruption ( nt!MiReplenishPageSlist+100 )
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    BUGCHECK_STR:  0xA
    PROCESS_NAME:  rundll32.exe
    Bugcheck code 0000000A
    Arguments fffffa80`50910220 00000000`00000002 00000000`00000001 fffff800`02aa9b7f
    ииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииии``
      
      
      My Computer


  4. Posts : 2
    Windows 7 Ultimate 64bit
    Thread Starter
       #4

    Well; ill be back in up to 36 hours then :)

    And thanks; both of you :)
      My Computer


  5. Posts : 11,990
    Windows 7 Ultimate 32 bit
       #5

    You are welcome. John and I both hope this solves your problems. :)
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

й Designer Media Ltd
All times are GMT -5. The time now is 06:27.
Find Us