BSOD Win7 Pro 64bit - ntoskrnl.exe??

pskierczy · 13 Nov 2010

Hi,

Lately I've build new system and almost from begin have some problems with BSOD.
First was solved by rising voltage for my RAM. and evrything was OK.

But yesterday I try tu update my Windows, and when instalation (after downloading and reboot) rach 35% first BSOD appeard ;/ and then was just worse. It take me a lot of time to "undo" upgrades. And then Windows log in, but then stuck...i wasn't able to do anything, just move the mouse pointer. So I checked my HDD and RAM (ESTools(samsung) and memtest86+) and got no errors.

I manage (don't know how exacly), and decided to post there my BSOD reports...

PS. BSOD View showed that problem was caused by ntoskrnl.exe, but as I read some posts it may be wrong.

What may casuse this BSODs??
Sorry for any mistakes

Jonathan_King · 13 Nov 2010

Start by removing SPTD with this tool: http://www.duplexsecure.com/download...t-v174-x64.exe

Code:

sptd.sys         Tue Aug 24 02:13:12 2010 (4C7362F8)
ah7zmub2.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
a2pa1zf3.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
advypt8v.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
af10l466.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
aoz71d5a.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
aw1mhyej.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
axp5fjk9.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
awm568tg.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
a00mtprf.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
ad7n1ok0.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)

Remove Gigabyte's Easy Saver program as well:

Code:

gdrv.sys         Thu Mar 12 23:22:29 2009 (49B9D175)

Also, remove McAfee, and Comodo:

Code:

cmderd.sys       Fri Sep 10 18:07:24 2010 (4C8AAC1C)
cmdguard.sys     Fri Sep 10 18:07:10 2010 (4C8AAC0E)
cmdhlp.sys       Fri Sep 10 18:06:39 2010 (4C8AABEF)

Install these updated Realtek NIC drivers: Realtek

Install these updated JMicron SATA drivers: ftp://driver.jmicron.com.tw/SATA_Con...17.59_WHQL.zip

If the BSODs persist, enable driver verifier: Driver Verifier - Enable and Disable

...Summary of the dumps

Code:


Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Sat Nov 13 01:28:50.059 2010 (UTC - 5:00)
System Uptime: 0 days 0:01:27.355
Probably caused by : ntkrnlmp.exe ( nt!RtlpCoalesceFreeBlocks+205 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x3B
PROCESS_NAME:  WerFault.exe
FAILURE_BUCKET_ID:  X64_0x3B_nt!RtlpCoalesceFreeBlocks+205
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Sat Nov 13 01:26:49.671 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:58.966
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+21bc6 )
BUGCHECK_STR:  0x1a_5003
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  dw20.exe
FAILURE_BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+21bc6
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Fri Nov 12 06:44:25.354 2010 (UTC - 5:00)
System Uptime: 0 days 0:01:02.790
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29731 )
BUGCHECK_STR:  0x1a_5003
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  atieclxx.exe
FAILURE_BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+29731
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Fri Nov 12 06:37:00.482 2010 (UTC - 5:00)
System Uptime: 0 days 0:01:19.918
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+1feaa )
BUGCHECK_STR:  0x1a_5005
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  xRaidSetup.exe
FAILURE_BUCKET_ID:  X64_0x1a_5005_nt!_??_::FNODOBFM::_string_+1feaa
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Fri Nov 12 06:34:22.480 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:51.916
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+3683c )
BUGCHECK_STR:  0x1a_5003
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  svchost.exe
FAILURE_BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+3683c
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Fri Nov 12 06:29:54.576 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:41.012
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+21b46 )
BUGCHECK_STR:  0x1a_5003
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  cmdagent.exe
FAILURE_BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+21b46
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Fri Nov 12 06:15:02.933 2010 (UTC - 5:00)
System Uptime: 0 days 0:01:22.229
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+409b4 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0xBE
PROCESS_NAME:  WerFault.exe
FAILURE_BUCKET_ID:  X64_0xBE_nt!_??_::FNODOBFM::_string_+409b4
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Fri Nov 12 06:12:39.383 2010 (UTC - 5:00)
System Uptime: 0 days 0:01:03.819
Probably caused by : memory_corruption ( nt!MiSwapWslEntries+6a )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  svchost.exe
FAILURE_BUCKET_ID:  X64_0x50_nt!MiSwapWslEntries+6a
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Nov 11 04:59:39.242 2010 (UTC - 5:00)
System Uptime: 0 days 0:02:50.537
Probably caused by : memory_corruption ( nt!MiSwapWslEntries+6a )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  WerFault.exe
FAILURE_BUCKET_ID:  X64_0x50_nt!MiSwapWslEntries+6a
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Nov 11 04:46:41.770 2010 (UTC - 5:00)
System Uptime: 0 days 0:03:54.456
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4a89 )
BUGCHECK_STR:  0x1a_41289
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  WerFault.exe
FAILURE_BUCKET_ID:  X64_0x1a_41289_nt!_??_::FNODOBFM::_string_+4a89
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

pskierczy · 13 Nov 2010

Ok, but why Comodo?? It's my Internet Security Software and can it make such as big probems??
I need SPTD for DeamonTools, so when I remove it I should also remove Deamon because it will be useless ;/
And even more interesting for me is why drivers delivered with MOBO can cause BSOD...

really this common used programs cause BSOD??

What IS or antyvir you recommend?? Is windows firewall good enough?

But OK :) Thanks a lot by now.
To check stability i will use:
Prime95 and OCCT Perestroika.
anything else??

Jonathan_King · 13 Nov 2010

Yes, do remove Daemon Tools. Here is a bunch of threads you can see where STPD caused BSODs:

Solved: I had a BSOD - PC Help Forum
Bsod: System_service_exception - Tech Support Forum
Asus G51jx-A1 BSOD bccode c5 - Tech Support Forum
[SOLVED] Yet Another BSOD help me thread... - Tech Support Forum
[SOLVED] Random BSODs - Tech Support Forum
Unknown Crashes
BSOD - different reasons (IRQ_NOT_LESS_OR_EQUAL, RTCore32, atacpi, etc) - Tech Support Forum
Win 7 BSOD, Daily + Randomly - Tech Support Forum

3rd-party security products, including anti-virus and firewalls, are notorious for causing BSODs. Since Comodo (cmdagent.exe) was running in one of the dumps, it might not hurt to remove it. Remember, once the BSODs are over, you can install Comodo again if you wish.

Microsoft Security Essentials, and the Windows firewall, are what I recommend: http://www.microsoft.com/security_essentials

pskierczy · 15 Nov 2010

Hi,

I remove or upgade all things that Jonathan_King described.
And I got another 2 BSOD. One appeard when I was using computer for about 10-15mins, while using Firerox, another when system was starting (after desktop shown while loading other drivers and stuff I think).

Maybe it is important - I'm using Win7 dowloaded from MSDNAA server.

----------edit--------
Scan with ESTool and memtest86+ (both newest versions) didn't show any errors.
After second BSOD I ran windows memory diagnostic tool (not sure about english name of this program) from system startup menu (F8 while booting) and got some memory errors

zigzag3143 · 15 Nov 2010

pskierczy said:

Hi,

I remove or upgade all things that Jonathan_King described.
And I got another 2 BSOD. One appeard when I was using computer for about 10-15mins, while using Firerox, another when system was starting (after desktop shown while loading other drivers and stuff I think).

Maybe it is important - I'm using Win7 dowloaded from MSDNAA server.

----------edit--------
Scan with ESTool and memtest86+ (both newest versions) didn't show any errors.
After second BSOD I ran windows memory diagnostic tool (not sure about english name of this program) from system startup menu (F8 while booting) and got some memory errors

You didnt remove all the things Jonathan_King recommended. You are still running daemon tools/alcohol120. He is correct--you need to remove itand till you do we cant find the real cause.

These were caused by memory corruption probably because of it. You hace to remove it if you want the BSOD's to stop.

Nine of 13 are directly tied to memory corruption. It may not show in Memtest because you arent running them when you tested.

Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads
[/quote]
You can use MagicDisc as an alternative.

Freeware MagicISO Virtual CD/DVD-ROM(MagicDisc) Overview

Code:

sptd.sys        fffff880`011aa000    0x0015d000    8/24/2010 01:13:12            0x4c7362f8    fffff880`0104d000

Also you still are running COMODO. Until its gone and sptd.sys are you WILL keep having BSOD's

What is cmderd.sys ? Description COMODO Internet Security Eradication Driver C:WINDOWSsystem32driverscmderd.sys

Code:

cmderd.sys        fffff880`013fd000    0x00009000    9/10/2010 17:07:24            0x4c8aac1c    fffff880`013f4000                
cmdguard.sys        fffff880`03eac000    0x00042000    9/10/2010 17:07:10            0x4c8aac0e    fffff880`03e6a000                
cmdhlp.sys        fffff880`03f6c000    0x0000b000    9/10/2010 17:06:39            0x4c8aabef    fffff880`03f61000

pskierczy · 15 Nov 2010

Sorry, but I remove it... using unintallers (SPTD and Demon).
Maybe I should remove older dump reports. And I should mention that last two or three are up to date.
And please tell me If i'm running windows memory diagnostic tool its DOS-like so i think that none of windows programs and drivers are loaded. Why it shown errors??
And another curious thing - why I got BSOD while installing windows upgrades??

I also have used CCleaner to clean my registery, but I did it after my last post. But i checked my todays dump reports using "BlueScreenView" and couldn't find files/drivers you mentioned: comodo and SPTD.
Of course I can be wrong :)

PS. Only two newest - today one - dump reports are updated. Should I rebuild this report and post it again??

Jonathan_King · 16 Nov 2010

CCleaner deletes dump files, so please don't run CCleaner again until this is sorted out.

There was a bit of a confusion with your last report. If the BSODs persist, could you upload a new report, and we'll go from there?

pskierczy · 16 Nov 2010

I have unchecked deleting dump files, so I got them all. But I think that good idea is to delete all dump files because if I got BSOD again it will be easier to analize, right?

Jonathan_King · 16 Nov 2010

Well we can usually tell which dumps to run by their dates, and comparing them to your last posting date, but in this case it won't hurt anything, because your old dumps are "backed up" in previous attachments, in case we want them.

We just don't like to receive a BSOD report, and it turns out there are no dumps in it because CCleaner gets them every time the machine reboots!