Windows 7: BSOD, "ntoskrnl.exe"

Erox · 05 Jun 2014

so this is my story:

I had a thread on this forum before, but we were never able to find the reason for the bluescreens. My pc would no longer boot (at all), and therefore i had given up. i recently bought a new motherboard, and now im able to use my computer, but i keep getting these "random" BSOD frequently when playing games.
I'm not entirely sure, but im pretty certain that it's not my RAM nor motherboard that is the problem, i ran a memtest86 on my ram with 0 errors, and my motherboard is brand new.
here you can see the earlier/older thread
Several BSoD related to "ntoskrnl.exe"

Thedoctor44 · 05 Jun 2014

Code:

Versjon	6.1.7600 Build 7600

You do not have Service Pack 1 installed, you need to install it otherwise your system will remain vulnerable to threats.

Your Logitech GSeries headset driver is causing issues.

Code:

BugCheck C2, {99, fffffa8006aee903, 0, 0}

*** WARNING: Unable to verify timestamp for ladfGSCamd64.sys
*** ERROR: Module load completed but symbols could not be loaded for ladfGSCamd64.sys
Probably caused by : ladfGSCamd64.sys ( ladfGSCamd64+397 )

Code:

2: kd> lmvm ladfGSCamd64
start             end                 module name
fffff880`01e24000 fffff880`01e86880   ladfGSCamd64 T (no symbols)           
    Loaded symbol image file: ladfGSCamd64.sys
    Image path: \SystemRoot\system32\DRIVERS\ladfGSCamd64.sys
    Image name: ladfGSCamd64.sys
    Timestamp:        Mon Apr 15 19:39:12 2013 (516C4950)
    CheckSum:         0006DEE3
    ImageSize:        00062880
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it here.
Logitech Support - Downloads, Manuals, FAQs & More

It looks like the Logitech driver is trying to free an invalid memory address.

Erox · 06 Jun 2014

I downloaded all available windows updates, and removed the troublemaking driver, because i could not find a newer version of it.
however, I still got two bluescreens recently while playing Dota 2

Thedoctor44 · 06 Jun 2014

Another USB bugcheck.

Upload the list of all the third party drivers Using NirSoft DriverView:

Download and execute Driverview
View > Hide Microsoft Drivers
Edit > Select all
File > Save Selected Items
In the Save dialog, Set the path to desktop, Put "Driverview" in the name field, and save.
Zip the .txt file and upload it.

Code:

BugCheck 50, {ffffffffffffff93, 1, fffff960000d415d, 0}


Could not read faulting driver name
Probably caused by : hardware ( win32k!PhaseShift+a1 )

This bugcheck indicates that invalid memory was referenced.

The 1st parameter is the address being referenced, it's clearly an invalid page, although the Page Table Entries haven't been saved.

Code:

X64_IP_MISALIGNED

There has been an Instructions Pointer misalignment which can be caused by drivers or faulty RAM, in this case most likely faulty RAM.

Memtest86 will test your RAM

Information

Run Memtest86 for at least 8 passes so we get enough information to confirm that your RAM isn't failing

Erox · 06 Jun 2014

I sent my RAM sticks to customer service a couple of months ago thinking they were the root of all these bluescreens, but they found 0 errors. they ran memtest overnight, 9 passes overall with 0 errors. i cannot run memtest on my own computer at the moment because i have no free cds, and memtest simply won't work together with my USB-stick (error message: "An error (1) occured while executing syslinux. Your USB won't be bootable")

however, I followed your instructions regarding the Driverview, I've added the zip file to this post.

Thedoctor44 · 07 Jun 2014

I noticed you have this installed.

Code:

Driver Name       : GVTDrv64.sys
Address           : 0x06BB6000
End Address       : 0x06BC0000
Size              : 0x0000a000
Load Count        : 1
Index             : 153
File Type         : Unknown
Description       : 
Version           : 
Company           : 
Product Name      : 
Modified Date     : 07.06.2014 00:23:46
Created Date      : 05.06.2014 02:50:29
Filename          : C:\Windows\GVTDrv64.sys
File Attributes   : A
Service Name      : GVTDrv64
Service Display Name: 
Digital Signature :

It's the Gigabyte Easy Tune 6 driver, it's known to cause issues including BSODs with Windows.

Remove it completely.

I can't seem to find a timestamp on your USB 3.0 driver.

Update it here if it's outdated.

https://downloadcenter.intel.com/Default.aspx?lang=eng

I would remove Norton as a test.
Use this removal tool.

https://support.norton.com/sp/en/uk/...rProfile_en_us

Replace it with MSE and Malwarebytes.

Microsoft Security Essentials - Microsoft Windows

Malwarebytes | Free Anti-Malware & Internet Security Software

Tip

Make sure you don't enable the free trial of malwarebytes pro, deselect the option when prompted.

Erox · 08 Jun 2014

I followed your steps, but the bluescreens keep coming.

I got a bluescreen while playing Civilization V just now, it seems like i only get bluescreens when playing games- I can surf around the internet for however long i want, but once I run a game (with moderate graphics, like Dota 2) I recieve BSODs... could that indicate that theres something wrong with my GPU?

Thedoctor44 · 08 Jun 2014

Memory management isn't my strongest area of expertise but it is the most interesting.
Lets take another look.

Code:

BugCheck 1A, {5100, fffff6fc4005b2c0, 1, 1d}

The first parameter indicates that a bitmap allocation has been corrupted.
This will be an educated guess..

The bitmap allocation or free space bitmap is used to track sectors on a drive, what's happened is some bitmap allocations have been overwritten whilst they are in use by the memory manager.

Code:

2: kd> knL
 # Child-SP          RetAddr           Call Site
00 fffff880`02f8d5e8 fffff800`02ed0ad7 nt!KeBugCheckEx
01 fffff880`02f8d5f0 fffff800`02e926d7 nt! ?? ::FNODOBFM::`string'+0xaed7
02 fffff880`02f8d700 fffff800`033eacac nt!MmMapLockedPagesSpecifyCache+0x50c
03 fffff880`02f8d7d0 fffff800`033ea69a hal!HalpDmaSyncMapBuffers+0x54 <-- dma buffer
04 fffff880`02f8d880 fffff800`033ed83f hal!HalpDmaFlushScatterTransfer+0xae <-- Hal routines
05 fffff880`02f8d8d0 fffff800`033ec7d5 hal!IoFlushAdapterBuffers+0xaf
06 fffff880`02f8d910 fffff880`00e49199 hal!HalPutScatterGatherList+0x85
07 fffff880`02f8d970 fffff880`010e3453 PCIIDEX!BmFlush+0x25 <-- The PCI controller is being blamed
08 fffff880`02f8d9a0 fffff880`010e3104 ataport!IdeProcessCompletedRequests+0x123
09 fffff880`02f8dad0 fffff800`02e822fc ataport!IdePortCompletionDpc+0x1a8 <-- DPC list has emptied
0a fffff880`02f8db90 fffff800`02e6f90a nt!KiRetireDpcList+0x1bc 
0b fffff880`02f8dc40 00000000`00000000 nt!KiIdleLoop+0x5a <-- Processor awaiting instruction

Lets look at your display driver.

Code:

2: kd> lmvm nvlddmkm
start             end                 module name
fffff880`0f01a000 fffff880`0fc7e000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        Tue May 20 00:08:44 2014 (537A8EFC)
    CheckSum:         00C1EA41
    ImageSize:        00C64000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

These latest version have been causing a few issues lately.
I recommend rolling back to a version late last year.

These instructions are useful.

NVIDIA Drivers - Avoid Problems

We could try Furmark but I think it's still a display driver issue here.

Stress test your graphics card with Furmark

I recommend running it for around 30 minutes

Warning

Furmark will increase the temperature of your GPU rapidly so keep and eye on your temperatures

Erox · 09 Jun 2014

I followed your instructions, and uninstalled my NVIDIA drivers like the 'NVIDIA Drivers - Avoid Problems' showed me to do, and installed some eariler drivers from November 2013. (version 331.82)

Right there and then everything seemed fine! i ran FurMark for 30 minutes without issues, and i could play Civilization V for more than 5 minutes without a BSOD (played it for about 90 minutes, no BSOD appeared), it felt like the problem was fixed

However when I shut down my PC that night my windows started installing a bunch of updates, I believe it was 96 updates in total before it would shutdown. So today I thought I'd play a litte more Civilization V, but bluescreened after 5 minutes of gameplay. My windows wouldn't boot normally, it just showed an empty blue screen.

I booted windows repair mode, and now im writing this post.

Thedoctor44 · 09 Jun 2014

I'm on my mobile phone at the moment so I can't look at the attached files.
When you put memtest on a USB stick make sure you format it as Fat32.
We ought to run memtest, as page faults in non paged areas are mainly caused by bad ram.

I will take a look at your files later.

For the sake of debugging here's what I see.

Code:

BugCheck 50, {fffff900e5c46483, 0, fffff960000f827d, 2}

This is the address being referenced by this address.

Code:

2: kd> r cr2
Last set context:
cr2=fffff900e5c46483

The address being referenced was store in the 2nd control register before the page fault handler was called.

Unfortunately most of the time the Page Table Entries aren't save din minidumps so there isn't much analysis I can do.

Code:

2: kd> !pte fffff900e5c46483
                                           VA fffff900e5c46483
PXE at FFFFF6FB7DBEDF90    PPE at FFFFF6FB7DBF2018    PDE at FFFFF6FB7E403970    PTE at FFFFF6FC8072E230
Unable to get PXE FFFFF6FB7DBEDF90

In this case Memtest86 would be the best course of action.