BSOD ntoskrnl.exe (Help please!)

jacklindr · 28 Oct 2013

For the better part of a year I’ve been trying to figure out why I get random BSOD almost always cause by ntoskrnl.exe… (ntoskrnl.exe+7cd40 and ntoskrnl.exe+75b80)

I just about tried everything I could read about and I’m starting to suspect that it’s a hardware issue.

The strange thing is that quite a few times my computer crashes after my browser has crashes too. Also it almost never crashes when playing games….

I’ve reinstalled Windows 7 a few times. And run Chkdsk many times.

I’ve tested my ram for 10 hours, tested my harddisk, stress tested my graphic cards and CPU.

I’ve tried using both the OEM drivers and the newest drivers.

Tried with and without windows updates.

I know AVG, daemon tools and mcafee sometimes causes problems , so they’re not installed.

And probably tried a few things I can’t remember right now.

Now I’m hoping someone here can help or at least figure out what exactly the problem is.
I suspect it might be my Intel Graphics Card… For a long time I suspected my Wifi-thingy, but the the computer should crash while playing online games, right? Also, I don’t if it can be ram problems that memtest86 doesn’t pick up???

All the help I can get I greatly appreciated!!

(P.s. First post here, so I hope everything is as it should be)

Arc · 28 Oct 2013

It might be a hardware error.

Code:

fffff880`035ca858 fffff800`030f65a3 nt!KeBugCheckEx
fffff880`035ca860 fffff800`03077cae nt! ?? ::FNODOBFM::`string'+0x43801
fffff880`035ca9c0 fffff880`04474d6b nt!KiPageFault+0x16e
fffff880`035cab50 fffff880`04475cb6 umbus!UMBus_AssignHardwareIDs+0x107
fffff880`035cabd0 fffff880`044748c6 umbus!UMBus_CreatePdo+0x1da
fffff880`035caf40 fffff880`00f1be8d umbus!UMBus_EvtDeviceListCreatePdo+0x8a
fffff880`035caf70 fffff880`00efeb0e Wdf01000!FxChildList::CreateDevice+0xbd
fffff880`035cb3c0 fffff880`00efecae Wdf01000!FxChildList::ProcessBusRelations+0x79e
fffff880`035cb470 fffff880`00eedd2f Wdf01000!FxPkgPnp::HandleQueryBusRelations+0xca
fffff880`035cb530 fffff880`00eed5d7 Wdf01000!FxPkgFdo::_PnpQueryDeviceRelations+0x6f
fffff880`035cb570 fffff880`00eec79a Wdf01000!FxPkgPnp::Dispatch+0x18f
fffff880`035cb5d0 fffff880`00eec866 Wdf01000!FxDevice::Dispatch+0x19a
fffff880`035cb610 fffff800`03523d26 Wdf01000!FxDevice::DispatchWithLock+0xa6
fffff880`035cb650 fffff800`034364ae nt!IovCallDriver+0x566
fffff880`035cb6b0 fffff800`0343681a nt!PnpAsynchronousCall+0xce
fffff880`035cb6f0 fffff800`03438b67 nt!PnpQueryDeviceRelations+0xfa
fffff880`035cb7b0 fffff800`0346915c nt!PipEnumerateDevice+0x117
fffff880`035cb810 00000000`00000000 nt!PipProcessDevNodeTree+0x21c

Those UserMode Root Bus enumerator entries making me think that hardware tests should be done at first.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

Stress test the Graphics Card using Furmark.
Video Card - Stress Test with Furmark

Stress test the CPU.
Hardware - Stress Test With Prime95

Let us know the results.

jacklindr · 29 Oct 2013

Ok, the results are in. I ran all the tests, some I have done before, but did it again to be on the safe side.

Memtest86+ 10 hours. - PASSED

Prime95 2+ hours (99 tests) Hope that's long enough. 0 errors, 0 warnings. - So PASSED

Furmark Burn-in benchmark Intel HD 3000 - PASSED

Furmark Burn-in benchmark Nvidia GT 635M - PASSED

So all good I guess. Is it possible it sould be my Wifi LAN or perhaps (a wildshot) my router...

jacklindr · 29 Oct 2013

Oh and btw, I've downloaded the Diagnostics tool from western digital and checked my harddisk, also passed.

And my browser is still crashing a lot, sometimes followed by a BSOD.

Arc · 29 Oct 2013

Enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any. Post it following the Blue Screen of Death (BSOD) Posting Instructions.

jacklindr · 29 Oct 2013

Ok. Here's a bunch of new dumps.

All of these are from crashes after I've enabled Driver Verifier AND all are while or just after rebooting. Non of them are from when the computer is running (though that's just a matter of time).

Hope that's ok... And thanks a lot for your help so far, Arc!

jacklindr · 30 Oct 2013

And yet another minidumb. This time I got a BSOD while the computer was up and running (with verifier enabled).

Again my browser started acting up and shortly after the computer crashed.

Arc · 30 Oct 2013

Uninstall the audio driver. Then clean all the leftovers using Drivers - Clean Left over Files after Uninstalling.

Now install the latest version downloaded from Realtek

Almost all the DV enabled crash dumps are saying the same thing.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {1f0, 2, 0, fffff80003083325}

*** WARNING: Unable to verify timestamp for MBfilt64.sys
*** ERROR: Module load completed but symbols could not be loaded for MBfilt64.sys
Probably caused by : MBfilt64.sys ( MBfilt64+1817 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000000001f0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80003083325, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b6100
GetUlongFromAddress: unable to read from fffff800032b61c0
 00000000000001f0 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeSetEvent+1e3
fffff800`03083325 488b00          mov     rax,qword ptr [rax]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff8800372b950 -- (.trap 0xfffff8800372b950)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000001f0 rbx=0000000000000000 rcx=fffff88003dc7210
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003083325 rsp=fffff8800372bae0 rbp=0000000000000000
 r8=0000000000000000  r9=fffff880009ea180 r10=00000000000001f0
r11=fffff800032362c0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe cy
nt!KeSetEvent+0x1e3:
fffff800`03083325 488b00          mov     rax,qword ptr [rax] ds:00000000`000001f0=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000307e129 to fffff8000307eb80

STACK_TEXT:  
fffff880`0372b808 fffff800`0307e129 : 00000000`0000000a 00000000`000001f0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0372b810 fffff800`0307cda0 : 00000000`00000160 00000000`00000001 00000000`00000000 fffff880`03dc7208 : nt!KiBugCheckDispatch+0x69
fffff880`0372b950 fffff800`03083325 : fffffa80`07823a02 fffffa80`07823a80 00000000`00000000 fffff980`0a1aaea0 : nt!KiPageFault+0x260
fffff880`0372bae0 fffff880`07c60817 : fffff880`00000000 fffff980`00000008 fffff800`0322cd00 fffffa80`07609550 : nt!KeSetEvent+0x1e3
fffff880`0372bb50 fffff880`00000000 : fffff980`00000008 fffff800`0322cd00 fffffa80`07609550 fffffa80`07823a80 : MBfilt64+0x1817
fffff880`0372bb58 fffff980`00000008 : fffff800`0322cd00 fffffa80`07609550 fffffa80`07823a80 fffff800`035273fb : 0xfffff880`00000000
fffff880`0372bb60 fffff800`0322cd00 : fffffa80`07609550 fffffa80`07823a80 fffff800`035273fb fffffa80`07823a80 : 0xfffff980`00000008
fffff880`0372bb68 fffffa80`07609550 : fffffa80`07823a80 fffff800`035273fb fffffa80`07823a80 fffffa80`07823a80 : nt!ViPendingWorkers
fffff880`0372bb70 fffffa80`07823a80 : fffff800`035273fb fffffa80`07823a80 fffffa80`07823a80 fffff980`0a1ab000 : 0xfffffa80`07609550
fffff880`0372bb78 fffff800`035273fb : fffffa80`07823a80 fffffa80`07823a80 fffff980`0a1ab000 fffff980`0a1aaea0 : 0xfffffa80`07823a80
fffff880`0372bb80 fffff800`0352747c : fffff800`0322cd90 00000000`00000080 fffffa80`03d099e0 2e324208`00000100 : nt!ViPendingCompleteAfterWait+0x7b
fffff880`0372bbc0 fffff800`0331cbae : c0a20811`41349498 d16e4b50`f189200b 6f1c8602`0a3446c2 621f1428`ab82d540 : nt!ViPendingWorkerThread+0x2c
fffff880`0372bc00 fffff800`0306f8c6 : fffff880`009ea180 fffffa80`03d32040 fffff880`009f4fc0 04982cca`49605e45 : nt!PspSystemThreadStartup+0x5a
fffff880`0372bc40 00000000`00000000 : fffff880`0372c000 fffff880`03726000 fffff880`0372b8d0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
MBfilt64+1817
fffff880`07c60817 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  MBfilt64+1817

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: MBfilt64

IMAGE_NAME:  MBfilt64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a7267b0

FAILURE_BUCKET_ID:  X64_0xA_VRF_MBfilt64+1817

BUCKET_ID:  X64_0xA_VRF_MBfilt64+1817

Followup: MachineOwner
---------

1: kd> lmvm MBfilt64
start             end                 module name
fffff880`07c5f000 fffff880`07c6d000   MBfilt64 T (no symbols)           
    Loaded symbol image file: MBfilt64.sys
    Image path: \SystemRoot\system32\drivers\MBfilt64.sys
    Image name: MBfilt64.sys
    Timestamp:        Fri Jul 31 09:10:32 2009 (4A7267B0)
    CheckSum:         0000FF02
    ImageSize:        0000E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

jacklindr · 30 Oct 2013

Ok, Uninstalled drivers, Cleaned and Reinstalled.

You'll be my personal hero if this fixes my problems!

I get back to you if I get another BSOD OR in case they've stopped :)

Arc · 30 Oct 2013

I am not that much optimistic here though.