ntoskrnl.exe BSOD about once a month, usually when booting


  1. Posts : 21
    Windows 7 64-bit
       #1

    ntoskrnl.exe BSOD about once a month, usually when booting


    This is my parent's PC. Built in April '11. Everything was fine for ~4 months then started getting random BSOD you'll find in the attachment. Since then, it happens randomly about once a month. It'll do it sitting idle, they'll reboot it, and it'll do it as soon as it's logging in. Reboot again, then it's fine for a month or so.

    I checked the update history and several updates were installed about a month prior to the first BSOD. All drivers are up to date and this PC is really only used for webmail, skype, and typical browsing. I have identical software (avast AV, logmein, hamachi, etc.) installed on other machines with the same OS with no issues. I ran memtest for 3+ hours and Prime 95 (blend) for 2+ hours with no issues on either. My specs are:

    Windows 7 Enterprise 64-bit - Retail
    Asus P8H67-M Pro
    Intel i5-2500K
    4GB Mushkin Memory
    On-board Intel HD3000 graphics
    On-board audio
    Seasonic S12-380 380W PSU
    Logitech C270 webcam
    Last edited by tpattgeek; 10 Jan 2012 at 09:53.
      My Computer


  2. Posts : 21
    Windows 7 64-bit
    Thread Starter
       #2

    Bump... any ideas???
      My Computer


  3. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #3

    Code:
    Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\tpattgeek\Windows_NT6_BSOD_jcgriff2\010812-12136-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
    Machine Name:
    Kernel base = 0xfffff800`02a17000 PsLoadedModuleList = 0xfffff800`02c5c670
    Debug session time: Sun Jan  8 18:25:15.549 2012 (UTC - 7:00)
    System Uptime: 0 days 0:40:44.782
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .....................................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck A, {fffff9800646f988, 2, 0, fffff80002ab24af}
    
    Probably caused by : memory_corruption ( nt!MiResolveProtoPteFault+13f )
    
    Followup: MachineOwner
    ---------
    
    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: fffff9800646f988, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000000, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff80002ab24af, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cc6100
     fffff9800646f988 
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    nt!MiResolveProtoPteFault+13f
    fffff800`02ab24af 488b00          mov     rax,qword ptr [rax]
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    BUGCHECK_STR:  0xA
    
    PROCESS_NAME:  AvastSvc.exe
    
    TRAP_FRAME:  fffff8800882c650 -- (.trap 0xfffff8800882c650)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffff9800646f988 rbx=0000000000000000 rcx=0000000000000004
    rdx=000000000007ac03 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002ab24af rsp=fffff8800882c7e0 rbp=fffff8a000e2ec88
     r8=0000000000000000  r9=0000058000000000 r10=0000000073ddc858
    r11=fffff68000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na po nc
    nt!MiResolveProtoPteFault+0x13f:
    fffff800`02ab24af 488b00          mov     rax,qword ptr [rax] ds:fffff980`0646f988=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80002a931e9 to fffff80002a93c40
    
    STACK_TEXT:  
    fffff880`0882c508 fffff800`02a931e9 : 00000000`0000000a fffff980`0646f988 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
    fffff880`0882c510 fffff800`02a91e60 : 00000000`00000157 00000000`00000157 00000000`000001ff 00000000`7ac03121 : nt!KiBugCheckDispatch+0x69
    fffff880`0882c650 fffff800`02ab24af : 80000000`891c6867 fffff680`00001bc0 fffffa80`019b5520 00000000`00000000 : nt!KiPageFault+0x260
    fffff880`0882c7e0 fffff800`02ab1053 : 00000000`0009aa38 00000000`73ddc858 fffff680`0039eee0 fffffa80`06266ec8 : nt!MiResolveProtoPteFault+0x13f
    fffff880`0882c870 fffff800`02aa0f19 : 00000000`73d52400 00000000`73ddc858 fffffa80`064a7e48 00000000`00000000 : nt!MiDispatchFault+0x1c3
    fffff880`0882c980 fffff800`02a91d6e : 00000000`00000008 00000000`73ddc858 fffff880`0882cb01 00000000`0c49f604 : nt!MmAccessFault+0x359
    fffff880`0882cae0 00000000`73ddc858 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
    00000000`0994e7b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x73ddc858
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt!MiResolveProtoPteFault+13f
    fffff800`02ab24af 488b00          mov     rax,qword ptr [rax]
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  nt!MiResolveProtoPteFault+13f
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3
    
    IMAGE_NAME:  memory_corruption
    
    FAILURE_BUCKET_ID:  X64_0xA_nt!MiResolveProtoPteFault+13f
    
    BUCKET_ID:  X64_0xA_nt!MiResolveProtoPteFault+13f
    
    Followup: MachineOwner
    ---------
    PROCESS_NAME: AvastSvc.exe

    While Avast may not cause blue screen errors on all systems, it is known to do so on some systems. Please uninstall Avast using avast! Uninstall Utility and replace with Microsoft Security Essentials - Free Antivirus for Windows to run with Windows Firewall.

    panais also has put together this list of security software Good and Free system security combination. Give him rep for his hard work if you decide to follow it. :)
    Last edited by writhziden; 09 Jan 2012 at 16:18. Reason: Savior's security combination
      My Computer


  4. Posts : 21
    Windows 7 64-bit
    Thread Starter
       #4

    I think I'd rather take my chances with Alwil. But thanks for the response! Where exactly did you find that excerpt?
      My Computer


  5. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #5

    tpattgeek said:
    I think I'd rather take my chances with Alwil. But thanks for the response! Where exactly did you find that excerpt?
    It's listed in the debugging file I provided within the code. It's about midway down if you scroll using the sidebar.
      My Computer


  6. Posts : 21
    Windows 7 64-bit
    Thread Starter
       #6

    How come I was only seeing ntoskrnl.exe in ALL of my dmp's? I was using bluescreenview. What is that you're using?
      My Computer


  7. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #7

    tpattgeek said:
    How come I was only seeing ntoskrnl.exe in ALL of my dmp's? I was using bluescreenview. What is that you're using?
    ntoskrnl.exe is often blamed by bluescreenview since it is an important system file that runs over the top of most of the system. We use Windbg on these forums because it is developed by Microsoft and gives more details on possible causes.
      My Computer


  8. Posts : 21
    Windows 7 64-bit
    Thread Starter
       #8

    Perfect, thanks so much.
      My Computer


  9. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #9

    No problem. Let us know if you need further assistance. :)
      My Computer


  10. Posts : 21
    Windows 7 64-bit
    Thread Starter
       #10

    I may need assistance with a different issue, but that's another thread. :)
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 00:08.
Find Us