Random BSOD--ntoskrnl.exe

Page 1 of 2 12 LastLast

  1. Posts : 12
    Windows 7 64 bit
       #1

    Random BSOD--ntoskrnl.exe


    Hello

    I get random BSOD the only thing in common is the Crash Address: ntoskrnl.exe+7cd40.

    I have already ran memtest86 for 7 hours which gave no errors (7 Passes) so dont think its a hardware problem.
    Link to my system specs http://speccy.piriform.com/results/z...PZIKm11WBJxcTU
    I have attached a copy of my dumps
    Thanks
    Alfred67

      My Computer


  2. Posts : 12
    Windows 7 64 bit
    Thread Starter
       #2

    Ran sfc/verifyonly and found no errors
    Running "Verifier" crashed within about 4mins after rebooting.(copy of dump below) anyway to is which driver failed??
    Rebooted still running after 10 min so far.

    =================================================
    Dump File : 041112-14835-01.dmp
    Crash Time : 11/04/2012 12:43:43 PM
    Bug Check String : KMODE_EXCEPTION_NOT_HANDLED
    Bug Check Code : 0x0000001e
    Parameter 1 : 00000000`00000000
    Parameter 2 : 00000000`00000000
    Parameter 3 : 00000000`00000000
    Parameter 4 : 00000000`00000000
    Caused By Driver : ntoskrnl.exe
    Caused By Address : ntoskrnl.exe+7cd10
    File Description : NT Kernel & System
    Product Name : Microsoft® Windows® Operating System
    Company : Microsoft Corporation
    File Version : 6.1.7601.17727 (win7sp1_gdr.111118-2330)
    Processor : x64
    Crash Address : ntoskrnl.exe+7cd10
    Stack Address 1 :
    Stack Address 2 :
    Stack Address 3 :
    Computer Name :
    Full Path : C:\Windows\Minidump\041112-14835-01.dmp
    Processors Count : 8
    Major Version : 15
    Minor Version : 7601
    Dump File Size : 275,152
      My Computer


  3. Posts : 12
    Windows 7 64 bit
    Thread Starter
       #3

    Ok, it crash again this time it take 3 hours Verifier is running
    The computer is not being used just sitting there the dump looks the same as the last one.

    Can anyone help ?? Is it possible the ntosknl.exe is corrupted???

    Copy of last crash
    ==================================================
    Dump File : 041112-13540-01.dmp
    Crash Time : 11/04/2012 4:30:12 PM
    Bug Check String : KMODE_EXCEPTION_NOT_HANDLED
    Bug Check Code : 0x0000001e
    Parameter 1 : 00000000`00000000
    Parameter 2 : 00000000`00000000
    Parameter 3 : 00000000`00000000
    Parameter 4 : 00000000`00000000
    Caused By Driver : ntoskrnl.exe
    Caused By Address : ntoskrnl.exe+7cd10
    File Description : NT Kernel & System
    Product Name : Microsoft® Windows® Operating System
    Company : Microsoft Corporation
    File Version : 6.1.7601.17727 (win7sp1_gdr.111118-2330)
    Processor : x64
    Crash Address : ntoskrnl.exe+7cd10
    Stack Address 1 :
    Stack Address 2 :
    Stack Address 3 :
    Computer Name :
    Full Path : C:\Windows\Minidump\041112-13540-01.dmp
    Processors Count : 8
    Major Version : 15
    Minor Version : 7601
    Dump File Size : 275,152
      My Computer


  4. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #4

    So based on the file you uploaded, Windows is not working as it should. Please follow the https://www.sevenforums.com/crashes-d...tructions.html to provide us with more information so we can give more specific troubleshooting steps.


    I can give one piece of troubleshooting from the files you provided.
    • Try re-installing DirectX using the Download: DirectX Redist (June 2010) - Microsoft Download Center - Download Details and see how the system responds.

      Follow the steps for Diagnosing basic problems with DirectX. To re-install your display card drivers as outlined in the DirectX link, use the following steps.

      1. Download the latest drivers for your display card(s)
      2. Click Start Menu
      3. Click Control Panel
      4. Click Uninstall a program
      5. For NVIDIA:
        • Uninstall the NVIDIA Graphics Driver (this should uninstall all NVIDIA software and drivers)
        • Restart your computer
        • Make sure NVIDIA 3D Vision Driver, NVIDIA 3D Vision Video Player, NVIDIA HD Audio Driver, and NVIDIA PhysX System Software are not still listed under Uninstall a program through Control Panel
        • If any remain of the above, uninstall one at a time
        • If asked to restart after uninstalling any of the above, do so, and continue uninstalling any remaining NVIDIA items until all are removed
      6. For AMD:
        • Uninstall AMD Catalyst Install Manager if it is listed (this should remove all AMD graphics software and drivers)
        • If AMD Catalyst Install Manager is not listed, use the following method to uninstall the graphics drivers:
          1. Download the latest drivers for your display card(s)
          2. Click Start Menu
          3. Right Click My Computer/Computer
          4. Click Manage
          5. Click Device Manager from the list on the left
          6. Expand Display adapters
          7. Do the following for each adapter (in case you have multiple display cards)
            • Right click the adapter
            • Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
            • Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
          8. Restart your computer after uninstalling drivers for all display cards
          9. Install the latest driver for the display cards once Windows starts


          Alternatively:
          1. Login as an adminstrative user
          2. Download the latest drivers for your display card(s)
          3. Click Start Menu
          4. Click Control Panel
          5. Click Hardware and Sound
          6. Click Device Manager (the last link under Devices and Printers)
          7. Expand Display adapters
          8. Do the following for each adapter (in case you have multiple display cards)
            • Right click the adapter
            • Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
            • Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
      7. Restart your computer after uninstalling drivers for all display cards
      8. Install the latest driver for the display cards once Windows starts
      My Computer


  5. Posts : 12
    Windows 7 64 bit
    Thread Starter
       #5

    Thank you very much will report back
      My Computer


  6. Posts : 12
    Windows 7 64 bit
    Thread Starter
       #6

    Zips you requested

    Windows 7 -- Home Premium 64 bit
    OS installed --1 year ago
    OEM came pre-installed
    Purchased from Dell

    System is 1 yr old
    Tried to reintall windows 7 once already
      My Computer


  7. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #7

    Security Software (this is just a check that it is installed and working properly; nothing needs to be done with this information at this time):
    Code:
    mcagent.exe	c:\program files\mcafee.com\agent\mcagent.exe	4520	8	200	1380	09/04/2012 5:35 PM	11.0.644.0	1.60 MB (1,675,160 bytes)	21/12/2011 6:33 PM

    Code:
    1. Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [D:\Kingston\BSODDmpFiles\alfred67\Windows7_Vista_jcgriff2\040912-14274-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330 Machine Name: Kernel base = 0xfffff800`03416000 PsLoadedModuleList = 0xfffff800`0365a650 Debug session time: Mon Apr 9 13:27:21.913 2012 (UTC - 6:00) System Uptime: 0 days 0:00:30.646 Loading Kernel Symbols ............................................................... ................................................................ ................. Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff960000f4efc, fffff88008668c30, 0} Probably caused by : win32k.sys ( win32k!SURFACE::Map+16c ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff960000f4efc, Address of the instruction which caused the bugcheck Arg3: fffff88008668c30, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: win32k!SURFACE::Map+16c fffff960`000f4efc 488b09 mov rcx,qword ptr [rcx] CONTEXT: fffff88008668c30 -- (.cxr 0xfffff88008668c30) rax=fffff900c32d1910 rbx=fffffa800ac63aa0 rcx=f7fff900c32d1830 rdx=0000000003950000 rsi=0000000000000001 rdi=f7fff900c32d1830 rip=fffff960000f4efc rsp=fffff88008669610 rbp=fffff900c07f3010 r8=fffff78000000008 r9=0000000000000000 r10=0000000000000000 r11=fffff88003165180 r12=fffff88008669770 r13=0000000000000000 r14=fffff960002f1ae0 r15=fffff960002f1ac0 iopl=0 nv up ei pl nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206 win32k!SURFACE::Map+0x16c: fffff960`000f4efc 488b09 mov rcx,qword ptr [rcx] ds:002b:f7fff900`c32d1830=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: explorer.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff960000f4efc STACK_TEXT: fffff880`08669610 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!SURFACE::Map+0x16c FOLLOWUP_IP: win32k!SURFACE::Map+16c fffff960`000f4efc 488b09 mov rcx,qword ptr [rcx] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: win32k!SURFACE::Map+16c FOLLOWUP_NAME: MachineOwner MODULE_NAME: win32k IMAGE_NAME: win32k.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4f2b63bd STACK_COMMAND: .cxr 0xfffff88008668c30 ; kb FAILURE_BUCKET_ID: X64_0x3B_win32k!SURFACE::Map+16c BUCKET_ID: X64_0x3B_win32k!SURFACE::Map+16c Followup: MachineOwner ---------
    2. Loading Dump File [D:\Kingston\BSODDmpFiles\alfred67\Windows7_Vista_jcgriff2\040812-14788-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330 Machine Name: Kernel base = 0xfffff800`03418000 PsLoadedModuleList = 0xfffff800`0365c650 Debug session time: Sun Apr 8 14:47:39.275 2012 (UTC - 6:00) System Uptime: 0 days 2:30:01.007 Loading Kernel Symbols ............................................................... ................................................................ ................. Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {fffff8800bb5c668, 0, fffff96000120f89, 2} Could not read faulting driver name Probably caused by : win32k.sys ( win32k!xxxScanSysQueue+14f9 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffff8800bb5c668, memory referenced. Arg2: 0000000000000000, value 0 = read operation, 1 = write operation. Arg3: fffff96000120f89, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000002, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036c6100 fffff8800bb5c668 FAULTING_IP: win32k!xxxScanSysQueue+14f9 fffff960`00120f89 448bac24e8000000 mov r13d,dword ptr [rsp+0E8h] MM_INTERNAL_CODE: 2 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: zuma.exe CURRENT_IRQL: 0 TRAP_FRAME: fffff8800b95c3f0 -- (.trap 0xfffff8800b95c3f0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffff900c0a8d770 rbx=0000000000000000 rcx=fffff900c0e1f110 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff96000120f89 rsp=fffff8800b95c580 rbp=fffff8800b95cb60 r8=0000000000000001 r9=fffff900c0e1f110 r10=fffff900c0cfb010 r11=fffff8800b95c550 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc win32k!xxxScanSysQueue+0x14f9: fffff960`00120f89 448bac24e8000000 mov r13d,dword ptr [rsp+0E8h] ss:0018:fffff880`0b95c668=00000201 Resetting default scope LAST_CONTROL_TRANSFER: from fffff8000343fc50 to fffff80003494d40 STACK_TEXT: fffff880`0b95c288 fffff800`0343fc50 : 00000000`00000050 fffff880`0bb5c668 00000000`00000000 fffff880`0b95c3f0 : nt!KeBugCheckEx fffff880`0b95c290 fffff800`03492e6e : 00000000`00000000 fffff880`0bb5c668 fffff880`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x43d76 fffff880`0b95c3f0 fffff960`00120f89 : 00000035`0000012b fffff880`0b95cb60 00000000`00000000 00000000`0000012b : nt!KiPageFault+0x16e fffff880`0b95c580 fffff960`0015abf7 : fffff900`c0cfb010 fffff880`0b95ca28 00000000`00000000 00000000`00000000 : win32k!xxxScanSysQueue+0x14f9 fffff880`0b95c8c0 fffff960`0015b085 : 00000000`00000000 fffff800`000025ff 00000000`00000000 fffffa80`ffffffff : win32k!xxxRealInternalGetMessage+0x453 fffff880`0b95c9a0 fffff960`00153a97 : 00000000`73382450 00000000`0008ec80 00000000`0008fd20 00000000`7efdb001 : win32k!xxxInternalGetMessage+0x35 fffff880`0b95c9e0 fffff800`03493fd3 : fffffa80`06fddb60 00000000`0008e2f8 fffff880`0b95ca88 00000000`00000000 : win32k!NtUserPeekMessage+0x77 fffff880`0b95ca70 00000000`733cfdea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0008e2d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x733cfdea STACK_COMMAND: kb FOLLOWUP_IP: win32k!xxxScanSysQueue+14f9 fffff960`00120f89 448bac24e8000000 mov r13d,dword ptr [rsp+0E8h] SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: win32k!xxxScanSysQueue+14f9 FOLLOWUP_NAME: MachineOwner MODULE_NAME: win32k IMAGE_NAME: win32k.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4f2b63bd FAILURE_BUCKET_ID: X64_0x50_win32k!xxxScanSysQueue+14f9 BUCKET_ID: X64_0x50_win32k!xxxScanSysQueue+14f9 Followup: MachineOwner ---------
    The crashes point to either Windows file corruption or memory problems.
    • If you are overclocking any hardware, please stop.

    • Run Disk Check with Automatically fix file system errors checked. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log.
      For any drives that do not give the message:
      Windows has checked the file system and found no problems
      run disk check again as above. In other words, if it says:
      Windows has made corrections to the file system
      after running the disk check, run the disk check again.

    • Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.

    • Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

      If you swap any memory components, follow these steps for ESD safety:
      1. Shut down and turn off your computer.
      2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
      3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
      4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.

      Once these steps have been followed, it is safe to remove and replace components within your computer.
      My Computer


  8. Posts : 12
    Windows 7 64 bit
    Thread Starter
       #8

    Hello

    --ran memtest86 for 7 hours which gave no errors (7 Passes)
    --Run SFC/SCANNOW--no errors

    When I get home from work will run Disk check and the windows memory check and report back

    Thanks for your help

    Alfred67
      My Computer


  9. Posts : 12
    Windows 7 64 bit
    Thread Starter
       #9

    Ran Windows memory check --found no problems
    Ran Disk check --log read the following

    Checking file system on C: The type of the file system is NTFS. Volume label is OS. A disk check has been scheduled. Windows will now check the disk. CHKDSK is verifying files (stage 1 of 3)... 218368 file records processed. File verification completed. 406 large file records processed. 0 bad file records processed. 0 EA records processed. 60 reparse records processed. CHKDSK is verifying indexes (stage 2 of 3)... 285128 index entries processed. Index verification completed. 0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 3)... 218368 file SDs/SIDs processed. Cleaning up 4 unused index entries from index $SII of file 0x9. Cleaning up 4 unused index entries from index $SDH of file 0x9. Cleaning up 4 unused security descriptors. Security descriptor verification completed. 33381 data files processed. CHKDSK is verifying Usn Journal... 36300520 USN bytes processed. Usn Journal verification completed. Windows has checked the file system and found no problems. 963876863 KB total disk space. 76165176 KB in 177869 files. 113216 KB in 33382 indexes. 0 KB in bad sectors. 351323 KB in use by the system. 65536 KB occupied by the log file. 887247148 KB available on disk. 4096 bytes in each allocation unit. 240969215 total allocation units on disk. 221811787 allocation units available on disk. Internal Info: 00 55 03 00 3f 39 03 00 2f f1 05 00 00 00 00 00 .U..?9../....... 25 02 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 %...<........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Windows has finished checking your disk. Please wait while your computer restarts
      My Computer


  10. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #10

    Alright, since you seem sure it is not hardware, let's check for driver conflicts.
    • An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
      a. Backup your system and user files
      b. Create a system restore point
      c. If you do not have a Windows 7 DVD, Create a system repair disc
      d. In Windows 7:
      • Click the Start Menu
      • Type verifier in Search programs and files (do not hit enter)
      • Right click verifier and click Run as administrator
      • Put a tick in Create custom settings (for code developers) and click next
      • Put a tick in Select individual settings from a full list and click next
      • Set up the individual settings as in the image and click next
        Attachment 207144
      • Put a tick in Select driver names from a list
      • Put a tick next to all non-Microsoft drivers.
      • Click Finish.
      • Restart your computer.


      If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

      Thanks to zigzag3143 for contributing to the Verifier steps.
      If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
      The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.

      When you are ready to disable Verifier: Start Menu -> All Programs -> Accessories -> Right click Command Prompt -> Run as administrator -> Type the following command and then Enter:
      verifier /reset
      -> Restart your computer.
      My Computer


 
Page 1 of 2 12 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 00:49.
Find Us