BSOD errors with different strings caused by ntoskrnl.exe and ndis.sys

brycemaster · 27 Apr 2013

Hi all, I've tried searching for a few months to no avail, but these issues have been occurring for a while now and I turn to the wisdom of the masses;
I've been getting pretty infrequent random BSOD errors. Most of them have no bug check string and blame ntoskrnl.exe or ndis.sys

Attached are the SF Diagnostic tool's findings with a fetch all. Unfortunately I have little experience with BSOD's so I have no idea how to read dump files and the like.
Attachment 265797

I do however think that the issue is related to drivers, as my pc is very new, and only suffered issues after I copied my files and settings across, but I think I may have copied too much when getting my old files such as really old outdated drivers, but I have no idea how to get rid of them as they are not made very obvious as to what they are in hardware manager, and I have downloaded and updated all the drivers for the relevant parts of my pc that I know of (my profile has my stats but I will also post a screenshot from speccy here)
Attachment 265800

I have also run a memtest+ with about 8 passes with no problems.

The issue seems to occur most often when watching videos from my external hard drives or online streaming etc. but this may just be me being paranoid.

The issue is very intermittent as it can go weeks at a time with nothing happening...

Thanks very much for taking the time to give me a hand! :)

Arc · 27 Apr 2013

Daemon Tools, Alcohol 120% and Power Archiver Pro uses SCSI Pass Through Direct (SPTD), which is a well known BSOD causer. Uninstall Daemon Tools at first. Then download SPTD standalone installer from Disk-Tools.com, and execute the downloaded file as guided below :

Double click to open it.
Click this button only:
If it is grayed out, as in the picture, there is no more SPTD in your system, and you just close the window.

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

Click on the Start button
Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
Select the “Startup” tab.
Deselect all items other than the antivirus.
Apply > OK
Accept then restart.

Your crash dumps are not showing any finite probable cause.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If memtest comes clean, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.
______________________________________________________________________
BSOD ANALYSIS:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d8a00ef549, b3b7465ef28cd34f, fffff880017be4bf, 1}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d8a00ef549, Reserved
Arg2: b3b7465ef28cd34f, Reserved
Arg3: fffff880017be4bf, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
    0 : A generic data region
    1 : Modification of a function or .pdata
    2 : A processor IDT
    3 : A processor GDT
    4 : Type 1 process list corruption
    5 : Type 2 process list corruption
    6 : Debug routine modification
    7 : Critical MSR modification

Debugging Details:
------------------


FAULTING_IP: 
ndis!NdisCoCreateVc+1f32
fffff880`017be4bf 837f2001        cmp     dword ptr [rdi+20h],1

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x109

PROCESS_NAME:  System

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`0357e498 00000000`00000000 : 00000000`00000109 a3a039d8`a00ef549 b3b7465e`f28cd34f fffff880`017be4bf : nt!KeBugCheckEx


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !ndis
    fffff880017be59d - ndis!NdisCoCreateVc+2010
    [ 46:4e ]
1 error : !ndis (fffff880017be59d)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

brycemaster · 27 Apr 2013

Thanks for the quick reply, I have uninstalled Daemon tools, and the uninstall button for the standalone was greyed out indicating nothing more was present on my system.
And apologies I mistyped in my original post but I have used Memtest86+ for 8 passes and it came up clean. I'll edit my original post to show this.

I've made a system restore point and am enabling driver verifier now. I'll check back in 24 hours or if a BSOD happens.

brycemaster · 28 Apr 2013

brycemaster said:

Thanks for the quick reply, I have uninstalled Daemon tools, and the uninstall button for the standalone was greyed out indicating nothing more was present on my system.
And apologies I mistyped in my original post but I have used Memtest86+ for 8 passes and it came up clean. I'll edit my original post to show this.

I've made a system restore point and am enabling driver verifier now. I'll check back in 24 hours or if a BSOD happens.

Well, I've had driver verifier on now for about 24 hours and so far no BSOD. However, as I stated before, there have been times where the blue screens have gone a week or so without happening so this may or may not have been fixed when I uninstalled Daemon tools.

Any ideas? Thank you.

Arc · 29 Apr 2013

Removing Daemon Tools and freeing up startup can solve any issue, but it is difficult to say with certainty.

You observe it for say one week. Let us know the situation then.

But no BSOD with DV enabled over 24 hours sounds very good to me. It almost nullifies the possibility of a driver error there.

brycemaster · 29 Apr 2013

Ok thanks, I'll keep an eye on it and turn off driver verifier. If I BSOD again or a week goes by I'll check in. Thanks very much for the help.

Also, are there any good alternative to Daemon tools that do not cause BSOD's? Just out of interest.

Thanks again for the helpful replies! :)

Arc · 29 Apr 2013

All the programs that emaluate a virtual drive are problematic. Daemon Tools and Alcohol are the widest problems, but none the rest are safe.

If you dont have a DVD drive, and you want to run ISO files, I would suggest you to use either free 7-Zip or not very costly Winrar. They extracts all the different disc image files, so the basic work will be equally dont with them. At a maximum, you will miss the DVD movie start screens only and nothing more.

brycemaster · 29 Apr 2013

Arc said:

All the programs that emaluate a virtual drive are problematic. Daemon Tools and Alcohol are the widest problems, but none the rest are safe.

If you dont have a DVD drive, and you want to run ISO files, I would suggest you to use either free 7-Zip or not very costly Winrar. They extracts all the different disc image files, so the basic work will be equally dont with them. At a maximum, you will miss the DVD movie start screens only and nothing more.

Ah ok cool, I've got Winrar and 7-Zip, I didn't know they could open .iso files cheers for the heads up! Still no sign of BSOD's either, I'll check back in a week if not sooner.

brycemaster · 30 Apr 2013

Right, just had a BSOD while I was watching a youtube video. Here's the details:
MEMORY_MANAGEMENT
Caused by driver: tcpip.sys
At address: tcpip.sys+70b0
Crash address: ntoskrnl.exe+7efc0

I've attached the dump file. Attachment 266113

UPDATE:
Here's a newly created SF_Diagnositc tool output as well if it helps: Attachment 266116

Arc · 30 Apr 2013

Update Atheros AR8151 PCI-E Gigabit Ethernet Controller (NDIS 6.20) Driver from Drivers for Atheros AR8151 and Windows 7.

Code:

fffff880`04524000 fffff880`04542000   L1C62x64   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\L1C62x64.sys
    Image name: L1C62x64.sys
    Timestamp:        Thu Jul 19 08:25:34 2012 (50077726)
    CheckSum:         0001FE91
    ImageSize:        0001E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Now Disable GPU acceleration for flash player. When a video on you tube is running, right click on it.
Then click on "settings"
Attachment 266117

In the next page, uncheck "hardware acceleration option.
Attachment 266118

Now close it.

I hope you Removed Spotify WebHelper from startup?

Scan the system for possible virus infection with the following programs.

Let us know the results.