Bsod casued by ntoskrnl (nt+0x7cc40)

Steez · 10 Feb 2012

Hi all, have recently experienced a bsod. WhoCrashed reports that it was probably caused by ntoskrnl.exe (nt+0x7CC40). Had a similar Bsod attributed to the NTKernel a few weeks ago, after reading up on it. I did a memtest which came back clean and checked the disk for errors, which also showed nothing.
Not sure if the problem is related but quite often when watching .mkv's or .avi's on VLC, my system will lock up. It doesn't go to bsod and I can't open up task manager to create a dump file from it.
Neccessary files are attached. (perf report and jcgriff2 report)

System Spec's are ..
OS Windows 7 Home Premium 64 (6.1, Build 7601)
CPU i5 Lynnfield 750
Motherboard Asus P7P55D-E PRO
Memory 2x 2gb Corsair DDR3 1333mhz
Graphics Card(s) MSi GTX 460 1gb
Sound Card Onboard
Monitor(s) Displays Samsung SyncMaster 2494HS
Hard Drives 500gb Seagate sata 3gb's (st3500418as)
PSU Antec 650w 'Truepower'
Case Cooler Master Elite 333
------
Thanks in advance for your time,

Steez.

usasma · 11 Feb 2012

Win7 doesn't like wireless USB adapters. If used with older (Vista) drivers, they will certainly cause BSOD's. Here's my rant about them:

I do not recommend using wireless USB devices. Especially in Win7 systems.
These wireless USB devices have many issues with Win7 - and using Vista drivers with them is almost sure to cause a BSOD.
Should you want to keep using these devices, be sure to have Win7 drivers - DO NOT use Vista drivers!!!
An installable wireless PCI/PCIe card that's plugged into your motherboard is much more robust, reliable, and powerful.

Numerous BSOD's in the WER section of MSINFO32 - but only one memory dump in the upload. If you are using a disk cleanup utility such as CCleaner - please stop immediately!

The WER errors point to a hard drive problem (or the Daemon Tools issue noted below). Please run this free hard drive diagnostic procedure: HD Diagnostic (read the details at the link) - Test ALL of the hard drives.
If you ran the SeaTools for Windows Long test, it's not necessary to run the test again (please let us know).

FYI - older versions of Samsung KIES were known to cause BSOD's. Please ensure that you have the most updated version available from the Samsung website

Daemon Tools (and Alcohol % software) are known to cause BSOD's on Win7 systems due to the sptd.sys driver.
Please uninstall the program, then use the following free tool to ensure that the troublesome sptd.sys driver is removed from your system (pick the 32 or 64 bit system depending on your system's configuration): DuplexSecure - FAQ

MSI Afterburner (along with Riva Tuner and EVGA Precision) are known causes of BSOD's in Win7 systems. Please uninstall the program immediately.

Further info on BSOD error messages available at: http://www.carrona.org/bsodindx.html

The following info is just FYI, I've already addressed the issues that I saw in the above paragraphs:
3RD PARTY DRIVERS PRESENT IN THE DUMP FILES
- Create a System Restore Point prior to doing any of this. DO NOT mess with the drivers themselves - leave the Windows\System32\drivers directory alone unless we specifically direct you to it!
- Please either update the older drivers from the device manufacturer's website - or uninstall them from your system. Reference links are included below.
- DO NOT use Windows Update or the Update Drivers function of Device Manager.
- Please feel free to post back about any drivers that you are having difficulty locating.
- Windows Update exceptions may be noted below for Windows drivers.

Code:


amdxata.sys          Fri Mar 19 12:18:18 2010 (4BA3A3CA)
jraid.sys            Wed Oct 07 07:26:03 2009 (4ACC7ACB)
acs6nts.sys          Wed May 26 02:28:54 2010 (4BFCBFA6)
sptd.sys             Wed Apr 07 21:29:00 2010 (4BBD315C)
PxHlpa64.sys         Tue Jun 23 19:16:35 2009 (4A416253)
MpFilter.sys         Wed Apr 06 16:07:29 2011 (4D9CC801)
AsIO.sys             Mon Aug 03 03:03:16 2009 (4A768BB4)
nusb3xhc.sys         Thu Jan 21 22:22:21 2010 (4B5919ED)
Rt64win7.sys         Fri Jun 10 02:33:15 2011 (4DF1BAAB)
ASACPI.sys           Wed Jul 15 23:31:29 2009 (4A5E9F11)
ai0jn3wo.SYS         Tue Jul 14 17:12:55 2009 (4A5CF4D7)
wacomvhid.sys        Mon Sep 21 19:29:14 2009 (4AB80C4A)
nusb3hub.sys         Thu Jan 21 22:22:18 2010 (4B5919EA)
wacommousefilter.sys Fri Feb 16 13:12:17 2007 (45D5F401)
nvhda64v.sys         Wed Nov 09 09:21:28 2011 (4EBA8C68)
LMouFilt.Sys         Fri Sep 02 02:23:15 2011 (4E607653)
viahduaa.sys         Thu Sep 17 07:04:15 2009 (4AB217AF)
LHidFilt.Sys         Fri Sep 02 02:23:09 2011 (4E60764D)
arusb_win7x.sys      Thu Nov 26 03:55:17 2009 (4B0E4275)
SbieDrv.sys          Sun Oct 17 18:42:23 2010 (4CBB7BCF)
MpNWMon.sys          Wed Apr 06 16:07:23 2011 (4D9CC7FB)
NisDrvWFP.sys        Wed Apr 06 16:08:53 2011 (4D9CC855)
mbam.sys             Tue Aug 02 10:47:45 2011 (4E380E11)
nvlddmkm.sys         Wed Nov 23 20:34:43 2011 (4ECD9F33)
nvBridge.kmd         Fri May 20 23:58:23 2011 (4DD7385F)

Code:


Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\021012-21730-01.dmp]
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Thu Feb  9 21:49:55.937 2012 (UTC - 5:00)
System Uptime: 0 days 5:00:10.326
Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+7271 )
BUGCHECK_STR:  0x1a_31
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  firefox.exe
FAILURE_BUCKET_ID:  X64_0x1a_31_nt!_??_::NNGAKEGL::_string_+7271
Bugcheck code 0000001A
Arguments 00000000`00000031 fffffa80`067e5240 fffff880`04957000 fffff8a0`0d15c108
BiosVersion = 1602   
BiosReleaseDate = 12/14/2010
CPUID:        "Intel(R) Core(TM) i5 CPU         750  @ 2.67GHz"
MaxSpeed:     2670
CurrentSpeed: 2674
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

Steez · 12 Feb 2012

Thanks for your reply usasma.
I have followed your instructions and removed Daemon Tools and sptd.sys, updates Kies to the lastest release, removed MSI afterburner and also ran a Long Test with "Seatools" which passed.

Also out of the third patry driver list, I updated viahduaa.sys and removed the Waccom software which took care of wacommousefilter.sys any other Waccom drivers, also paying attention to your info about wireless USB drivers. I did a reinstall of the logitech software, couldn't find any Win7 dedicated installers they only seem to have Vista/Win7 installers wrapped up into one.

There are a couple of dated drivers from Asus that I need to update, which your website notes as being causes for BSOD's.

usasma · 12 Feb 2012

The only Asus driver that I've noted causes BSOD's is the 2004/2005 version of ASACPI.sys.
The 2009 version (that you have) is just fine.

Steez · 12 Feb 2012

Okay no worries then. I havn't had any 0x1A's recently so that problem may well be solved.
However I did experience a 0xA (IQRL less or not equal). I've attached another jcgriff report, but removed two .dmp's that I added to the minidump folder that I could look at via WhoCrashed. The firefox dmp was nearly 500mb.

usasma · 13 Feb 2012

sptd.sys is still present. Did you run the sptd.sys removal tool from here?: DuplexSecure - FAQ

If you did, then try this:

- create a System Restore point.
- create a System Repair disc and ensure that it works. To do this, go to Start...All Programs...Maintenance...Create a System Repair Disc
- disable any startups that name sptd.sys using Autoruns (free from here: Autoruns for Windows )
- rename sptd.sys to sptd.BAD (it's probably in C:\Windows\System32\drivers)
- reboot and see if that fixes the problem(s)

Still using the USB wireless adapter. If the BSOD's continue after removing sptd.sys, then we've gotta consider it as a cause.

Further info on BSOD error messages available at: http://www.carrona.org/bsodindx.html

The following info is just FYI, I've already addressed the issues that I saw in the above paragraphs:
3RD PARTY DRIVERS PRESENT IN THE DUMP FILES
- Create a System Restore Point prior to doing any of this. DO NOT mess with the drivers themselves - leave the Windows\System32\drivers directory alone unless we specifically direct you to it!
- Please either update the older drivers from the device manufacturer's website - or uninstall them from your system. Reference links are included below.
- DO NOT use Windows Update or the Update Drivers function of Device Manager.
- Please feel free to post back about any drivers that you are having difficulty locating.
- Windows Update exceptions may be noted below for Windows drivers.

Code:


jraid.sys            Wed Oct 07 07:26:03 2009 (4ACC7ACB)
sptd.sys             Wed Apr 07 21:29:00 2010 (4BBD315C)
acs6nts.sys          Wed May 26 02:28:54 2010 (4BFCBFA6)
amdxata.sys          Fri Mar 19 12:18:18 2010 (4BA3A3CA)
PxHlpa64.sys         Tue Jun 23 19:16:35 2009 (4A416253)
MpFilter.sys         Wed Apr 06 16:07:29 2011 (4D9CC801)
AsIO.sys             Mon Aug 03 03:03:16 2009 (4A768BB4)
arusb_win7x.sys      Thu Nov 26 03:55:17 2009 (4B0E4275)
nusb3xhc.sys         Thu Jan 21 22:22:21 2010 (4B5919ED)
Rt64win7.sys         Fri Jun 10 02:33:15 2011 (4DF1BAAB)
ASACPI.sys           Wed Jul 15 23:31:29 2009 (4A5E9F11)
adjyhxt9.SYS         Tue Jul 14 17:12:55 2009 (4A5CF4D7)
wacomvhid.sys        Mon Sep 21 19:29:14 2009 (4AB80C4A)
nusb3hub.sys         Thu Jan 21 22:22:18 2010 (4B5919EA)
wacommousefilter.sys Fri Feb 16 13:12:17 2007 (45D5F401)
nvhda64v.sys         Wed Nov 09 09:21:28 2011 (4EBA8C68)
LHidFilt.Sys         Fri Sep 02 02:23:09 2011 (4E60764D)
LMouFilt.Sys         Fri Sep 02 02:23:15 2011 (4E607653)
viahduaa.sys         Wed Aug 04 03:51:53 2010 (4C591C19)
SbieDrv.sys          Sun Oct 17 18:42:23 2010 (4CBB7BCF)
NisDrvWFP.sys        Wed Apr 06 16:08:53 2011 (4D9CC855)
mbam.sys             Tue Aug 02 10:47:45 2011 (4E380E11)
nvBridge.kmd         Fri May 20 23:58:23 2011 (4DD7385F)
nvlddmkm.sys         Wed Nov 23 20:34:43 2011 (4ECD9F33)
ai0jn3wo.SYS         Tue Jul 14 17:12:55 2009 (4A5CF4D7)
viahduaa.sys         Thu Sep 17 07:04:15 2009 (4AB217AF)
MpNWMon.sys          Wed Apr 06 16:07:23 2011 (4D9CC7FB)

Code:


Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\021112-17596-01.dmp]
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Fri Feb 10 20:12:26.504 2012 (UTC - 5:00)
System Uptime: 0 days 0:24:03.893
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : dxgmms1.sys ( dxgmms1!VidSchiInterlockedInsertTailList+23 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0xA
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_0xA_dxgmms1!VidSchiInterlockedInsertTailList+23
Bugcheck code 0000000A
Arguments fffffa80`2e0497a8 00000000`00000002 00000000`00000001 fffff800`030a3c1f
BiosVersion = 1602   
BiosReleaseDate = 12/14/2010
CPUID:        "Intel(R) Core(TM) i5 CPU         750  @ 2.67GHz"
MaxSpeed:     2670
CurrentSpeed: 2675
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\021012-21730-01.dmp]
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Thu Feb  9 21:49:55.937 2012 (UTC - 5:00)
System Uptime: 0 days 5:00:10.326
Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+7271 )
BUGCHECK_STR:  0x1a_31
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  firefox.exe
FAILURE_BUCKET_ID:  X64_0x1a_31_nt!_??_::NNGAKEGL::_string_+7271
Bugcheck code 0000001A
Arguments 00000000`00000031 fffffa80`067e5240 fffff880`04957000 fffff8a0`0d15c108
BiosVersion = 1602   
BiosReleaseDate = 12/14/2010
CPUID:        "Intel(R) Core(TM) i5 CPU         750  @ 2.67GHz"
MaxSpeed:     2670
CurrentSpeed: 2674
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

Steez · 13 Feb 2012

I re-ran the sptd.sys remover with admin privilages and can't find it anywhere now. It doesnt show up in Autoruns, and a search in system32/drivers doesn't find it either. I'll upload another jcgriff for analysis.

usasma · 14 Feb 2012

No sign of sptd.sys
Let's wait and see if it BSOD's again.

Steez · 23 Feb 2012

Alright so its been a while and I've had no Bsods since. However I have been experience lock ups or "hangs", I'm not entirely sure what the correct term is.
To be more specific, recently while playing The Witcher 2, quite frequently I will experience a lock up. Only once have I been able to create a memory dump from task manager, other times nothing responds, I will usually end up rebooting. From looking at the dmp in Whocrashed, it's bugcheck is 0x0 and reports that wow64cpu.sys may be the cause. The dmp file is over 1gb so I won't upload it.
Similar lockup's have been experienced in VLC while watching an .avi or .mkv

Still possible driver issues?

usasma · 23 Feb 2012

Upload another jcgriff2 report - it'll contain info that may be able to help us nail down the cause.
It'd help to know when (by the system clock) the last freeze/hang occurred.