Random ntoskernel.exe BSOD under varying conditions. Please help.

Hi,

Your issue is most likely network related:

***************************************************************************
****
*
*
* Bugcheck Analysis
*
*
*
***************************************************************************
****
Use !analyze -v to get detailed debugging information.
BugCheck D1, {45d8, 2, 0, fffff88001a51d90}
Probably caused by : tcpip.sys ( tcpip!IppPendPacket+20 )
Followup: MachineOwner
---------
6: kd> !analyze -v
***************************************************************************
****
*
*
* Bugcheck Analysis
*
*
*
***************************************************************************
****
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at
an interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.

tcpip.sys
Microsoft TCP/IP Driver (networking related)

Please run SFC to check the integrity of all Windows 7 system files:

Click on the Start > Type in search cmd
Right click cmd at top and Run as Administrator
Type SFC /scannow at the prompt

SFC /SCANNOW Command - System File Checker

Do you have any Avg/Avira software installed?

I have asked another member to assist who is better equipped to deal with network issues / drivers.

Cheers

Dave

With what my friend Northernsoul55 suggested, update the following drivers:

• Atheros AR9485 Wireless Network Adapter : from http://www.atheros.cz/
• Intel(R) 82579V Gigabit Network Connection: from Intel Download Center

Code:

fffff880`068ba000 fffff880`06b6a000   athrx      (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\athrx.sys
    Image name: athrx.sys
    Timestamp:        Fri Oct 21 15:15:10 2011 (4EA13F26)
    CheckSum:         002AF1A0
    ImageSize:        002B0000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
================================================================================
fffff880`05368000 fffff880`053bf000   e1c62x64   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\e1c62x64.sys
    Image name: e1c62x64.sys
    Timestamp:        Wed Jul 20 22:07:53 2011 (4E270461)
    CheckSum:         00057931
    ImageSize:        00057000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

As you can see, both the drivers are very old, so there are fair chance of network blockage. Updates are necessary.

And, at the same time, Uninstall Super AntiSpyware, as it has some known issues with windows 7 sometimes.

Let us know the results.

When you get the next BSOD, upload teh crash dump to be analyzed. May be it may give us some more hint about the issue.

justhekicker said:

Okay it's been two weeks with no BSOD. I'm not sure if it was the drivers or unistalling Avira and superantispyware. Thanks guys so much for helping.

Good to know. I guess you can mark this thread as solved now.

justhekicker said:

Follow up question. Is MSE enough for antivirus, firewall, spyware, and malware or should i get another program to supplement it.

MSE is enough. Still, we use two other tools as on demand scanners.

• Free MBAM
• Windows Defender Offline

Nothing more is needed there.

This bugcheck code is inherent with AMD/ATI display driver, and so there is a less scope of troubleshoot it. If you use ATI, this particular BSOD may occur.

Code:

.........
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A0000001, {5, 0, 0, 0}

Probably caused by : atikmdag.sys ( atikmdag+2392c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Unknown bugcheck code (a0000001)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000005
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA0000001

PROCESS_NAME:  System

CURRENT_IRQL:  9

TAG_NOT_DEFINED_c000000f:  FFFFF80000BA2FB0

LAST_CONTROL_TRANSFER:  from fffff88005a9a92c to fffff80002e86c00

STACK_TEXT:  
fffff800`00b9c5f8 fffff880`05a9a92c : 00000000`a0000001 00000000`00000005 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9c600 00000000`a0000001 : 00000000`00000005 00000000`00000000 00000000`00000000 00000000`00000000 : atikmdag+0x2392c
fffff800`00b9c608 00000000`00000005 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xa0000001
fffff800`00b9c610 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff800`00b9c660 : 0x5


STACK_COMMAND:  kb

FOLLOWUP_IP: 
atikmdag+2392c
fffff880`05a9a92c ??              ???

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  atikmdag+2392c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME:  atikmdag.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5147d1ba

FAILURE_BUCKET_ID:  X64_0xA0000001_atikmdag+2392c

BUCKET_ID:  X64_0xA0000001_atikmdag+2392c

Followup: MachineOwner
---------

0: kd> lmvm atikmdag
start             end                 module name
fffff880`05a77000 fffff880`065e2000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Tue Mar 19 08:17:22 2013 (5147D1BA)
    CheckSum:         00B1557C
    ImageSize:        00B6B000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

As a try, you may roll the display driver back to one that worked stable for you.
Device Manager - Roll Back Driver