BSOD everytime, ntoskrnl.exe

fuze03 · 23 Jul 2013

Team,

I get a BSOD error everytime i boot into normal mode. I have checked various drivers and even reinstalled windows but still get the error. I am running windows 7 home premium on a Dell inspiron 620. Uploaded the diags from SF tool. Please help.

Thanks in advance.

koolkat77 · 23 Jul 2013

Use the System File Checker tool and Run Disk Check:

Repair Windows 7 System Files with System File Checker

Run Disk Check in Windows 7 for Bad Sectors & Errors

McAfee is a frequent cause of BSOD's. Remove and replace with Microsoft Security Essentials & the Free version of Malwarebytes, update and make full scans separately:

Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase

Microsoft Security Essentials - Microsoft Windows

Malwarebytes Free

Do not start the trial version of MalwareBytes

You may also take a look at:

Good & Free System Security Combination

Reduce items at start up:

Performing a Clean Startup in Windows 7

Add, or Remove Startup Programs in Windows 7

Your Antivirus software is basically whats just needed there.

Upload a screenshot using:

CrystalDiskInfo

For how to upload a screenshot or file, read here

Test your Hard Drive by running:

Hard Drive Diagnostic Procedure

Monitor hardware temperature with system monitoring software like Speccy or HWMonitor:

Piriform - Speccy

CPUID - HWMonitor

For how to upload a screenshot or file, read here

If you continue to get bsods, Enable Driver Verifier to see if it catches any misbehaving driver:

Driver Verifier - Enable and Disable

Using Driver Verifier to identify issues with Drivers

BSOD SUMMARY:

Code:

Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Wed Jul 24 07:29:23.352 2013 (UTC + 6:00)
System Uptime: 0 days 0:01:52.585
BugCheck A, {100000124, 2, 1, fffff80002911ab5}
Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+115 )
BUGCHECK_STR:  0xA
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Wed Jul 24 06:38:50.186 2013 (UTC + 6:00)
System Uptime: 0 days 0:03:17.045
BugCheck 1E, {ffffffffc0000005, fffffa80051eb3ef, 0, 7fffffa003c}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4977d )
BUGCHECK_STR:  0x1E_c0000005_R
PROCESS_NAME:  svchost.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Wed Jul 24 06:35:13.744 2013 (UTC + 6:00)
System Uptime: 0 days 0:04:37.603
BugCheck 1E, {ffffffffc0000005, fffffa80051de3ef, 0, fffa003c}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4977d )
BUGCHECK_STR:  0x1E_c0000005_R
PROCESS_NAME:  mscorsvw.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Wed Jul 24 06:33:41.720 2013 (UTC + 6:00)
System Uptime: 0 days 0:05:21.953
BugCheck BE, {60088, 8c4000009710d025, fffff8800265b330, a}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+442cb )
BUGCHECK_STR:  0xBE
PROCESS_NAME:  mscorsvw.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Wed Jul 24 06:30:16.542 2013 (UTC + 6:00)
System Uptime: 0 days 4:24:59.932
BugCheck 1E, {ffffffffc0000005, fffff80002911ab5, 0, ffffffffffffffff}
Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+115 )
BUGCHECK_STR:  0x1E_c0000005_R
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Wed Jul 24 06:28:00.019 2013 (UTC + 6:00)
System Uptime: 0 days 0:03:33.252
BugCheck 1E, {ffffffffc0000005, fffffa80052da610, 0, 7fffffa8000}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4977d )
BUGCHECK_STR:  0x1E_c0000005_R
PROCESS_NAME:  iexplore.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Wed Jul 24 06:20:00.983 2013 (UTC + 6:00)
System Uptime: 0 days 0:00:11.842
BugCheck C9, {4, fffffa8005858c20, 0, 0}
*** WARNING: Unable to verify timestamp for kdcom.dll
*** ERROR: Module load completed but symbols could not be loaded for kdcom.dll
Probably caused by : kdcom.dll ( kdcom+1bb3 )
BUGCHECK_STR:  0xc9_4
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Wed Jul 24 06:08:39.219 2013 (UTC + 6:00)
System Uptime: 0 days 0:02:07.452
BugCheck 1E, {ffffffffc0000005, fffffa8005141610, 0, 7fffffa8000}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4977d )
BUGCHECK_STR:  0x1E_c0000005_R
PROCESS_NAME:  svchost.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Wed Jul 24 05:02:06.686 2013 (UTC + 6:00)
System Uptime: 0 days 0:04:08.919
BugCheck 1E, {ffffffffc0000005, fffffa8005197610, 0, 7fffffa8000}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4977d )
BUGCHECK_STR:  0x1E_c0000005_R
PROCESS_NAME:  svchost.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Wed Jul 24 04:57:37.365 2013 (UTC + 6:00)
System Uptime: 0 days 0:06:46.546
BugCheck 1E, {ffffffffc0000005, fffff80002b7aa9a, 1, 18}
Probably caused by : ntkrnlmp.exe ( nt!ObpCreateHandle+29a )
BUGCHECK_STR:  0x1E_c0000005_R
PROCESS_NAME:  iexplore.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

fuze03 · 24 Jul 2013

Thanks for your reply KoolKat77. You did list all the tests possible :).
SFC had no errors.
Chkdsk had no errors.
There is no AV right now as I had uninstalled McAfee earlier.
I did a clean startup and it worked fine for a while and then crashed again with nothing (no Apps) but IE running.
It is running fine for now but I still have not identified what was causing the BSOD's. I will try the driver verifier next.

fuze03 · 24 Jul 2013

Ran the driver verifier and checked the dump files. ATAPORT.SYS was the culprit which on further checking was being caused by a rootkit. Ran TDSSkiller to kill the rootkit. The system looks much better now. no BSOD. I am runiing the verifier again and will keep it running for a day or so to see if it picks anything else.

Thanks for the direction.

koolkat77 · 24 Jul 2013

Glad you got it sorted!
Thanks for letting us know :)