BSOD - ntoskrnl.exe errors

CNapolitan13 · 06 Mar 2013

My computer has been getting the BSOD frequently over the past couple of weeks. It happens most of the time when I am playing league of legends, but that isn't always the case. I have already tried to run a memtest, but it would get stuck in a loop on test 8 that would say I have between 0-32767 (it kept going down to 0 and back up to 32767 and repeat this action). I have already checked to see if all of my drivers are up to date and they are.

Any help on the matter would be greatly appreciated as this issue is starting to get frustrating.

Thanks,

Cam

Saurabh A · 07 Mar 2013

Hi CNapolitan13,

The 'Mini dump' points at 'ntkrnlmp.exe' (driver) as the cause of system crash.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80003574db7, fffff88010a41640, 0}

Probably caused by : ntkrnlmp.exe ( nt!KeUserModeCallback+12b )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80003574db7, Address of the instruction which caused the bugcheck
Arg3: fffff88010a41640, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Please try removing 'avast' anti-virus avast! Uninstall Utility | Download aswClear for avast! Removal; and recheck results. Also install 'Windows Updates' to install 'Microsoft Security Essentials' (and other required updates): Install Windows updates in Windows 7.

If the issue persists, uninstall 'Malware Bytes' while we perform troubleshooting: Programs and Features - Uninstall or Change a Program. For better results, you may run this utility: http://www.malwarebytes.org/mbam-clean.exe > Check results

Hope this helps. Do reply if you have any further questions; would be glad to assist.

CNapolitan13 · 07 Mar 2013

I did the steps that you listed above, and after each you said to check results. I assumed that you meant to run a memtest so that is what I did. After each step I had the same result. The test 8 loop that would occur about 4:50 seconds in every time I attempted to run the test. I'm not sure if you have any other ideas or if you meant something else by check results, but those did not seem to help with the memtest at least. Thanks for trying though.

CNapolitan13 · 07 Mar 2013

bump

CNapolitan13 · 09 Mar 2013

I have experienced some more BSODs in the past couple of days, and I was able to run memtest for almost 12 hours. It showed about 200 errors in total in ten passes. I have some additional information regarding newer crashes so I figured I would post them here again.

Saurabh A · 10 Mar 2013

Hi CNapolitan13,

Thank you for the reply. Apologies for the delay in response; was off-work.

Following are details of the recent 'Memory Dumps':

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa80034c9440, ffff, 0}

Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3a2 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa80034c9440
Arg3: 000000000000ffff
Arg4: 0000000000000000


Followup: MachineOwner
---------

2: kd> !sysinfo cpuspeed
CPUID:        "Intel(R) Core(TM) i7-3820 CPU @ 3.60GHz"
MaxSpeed:     3600
CurrentSpeed: 3602


------------------------------------------------------------------------------



*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {f, d, 0, fffff800032184ca}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 000000000000000f, memory referenced
Arg2: 000000000000000d, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800032184ca, address which referenced memory




------------------------------------------------------------------------------



*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {3452, 5870b000, fffff7000108ec80, 61400001a2af0424}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35163 )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000003452, The subtype of the bugcheck.
Arg2: 000000005870b000
Arg3: fffff7000108ec80
Arg4: 61400001a2af0424



------------------------------------------------------------------------------


*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {8885, fffffa800185e800, fffffa800185d600, 201}

Probably caused by : memory_corruption ( nt!MiRelinkStandbyPage+115 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000008885, The subtype of the bugcheck.
Arg2: fffffa800185e800
Arg3: fffffa800185d600
Arg4: 0000000000000201

The errors may point at a possible 'Memory corruption'. Would like to know if you ran the 'Memory diagnostics' with each 'Memory at one time'. Please refer to this 'tutorial' for detailed steps: RAM - Test with Memtest86+

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.
Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.
If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
3. Test the next stick of RAM (stick #2) in the next motherboard slot.
If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

Hope this helps. Do reply with the findings; will take it forward.

CNapolitan13 · 11 Mar 2013

After trying this approach, I think that the problem was one of my RAM sticks. I tested the two I had individually in the different slots and one of them would come up with errors while the other would not. So I think that my problem is a defective stick. Thanks for your help.

Saurabh A · 11 Mar 2013

Hi CNapolitan13,

If using a particular 'memory stick' causes the system to crash, it is likely to be a faulty component.
Glad that you've isolated the root cause; thank you for the confirmation.

BSOD - ntoskrnl.exe errors

BSOD - ntoskrnl.exe errors

More blue screens