Multiple BSoD's - ntoskrnl.exe

Page 1 of 2 12 LastLast

  1. Posts : 7
    Windows 7 Professional x64
       #1

    Multiple BSoD's - ntoskrnl.exe


    Hello,

    So I've recently created my own custom build computer and have had multiple BSoD's to the point of me worrying frantically as to why they're reoccurring with higher frequency.

    The activities I usually participate in which BSoD's happen are;
    • Watching YouTube videos (sometimes have more than two open in separate Google Chrome tabs),
    • Opening multiple tabs in Google Chrome (Not always the case - 13 tabs open as I'm typing this),
    • Playing games such as League of Legends, RuneScape or Mortal Kombat,
    • Leaving the computer idle/or in Sleep Mode.


    I've tried;
    • Re-installing Windows 7 Professional x64,
    • Using BlueScreenView to identify the fault, finding that three of four BSoD's since re-installation of Windows were caused by "ntoskrnl.exe", whilst one was caused by "Ntfs.sys" and "ntoskrnl.exe",
    • Running Memtest86+ for 9 Passes with no errors,
    • Running a Visual Memory Stress test,
    • Running Malwarebytes and CCleaner, along with avast Antivirus to no avail,
    • Updating all known Drivers I can possibly think of (probably missing a ton),
    • Checking for new Windows Updates - I have SP1, and there are no new updates available.


    BSoD's so far; (This list by the looks of it is going to get much worse)
    • 060614-16676-01.dmp - 06/06/2014 18:25:29 - SYSTEM_SERVICE_EXCEPTION - 0x0000003b
    • 060714-15927-01.dmp - 07/06/2014 00:48:54 - MEMORY_MANAGEMENT - 0x0000001a
    • 060814-18298-01.dmp - 08/06/2014 01:13:43 - NTFS_FILE_SYSTEM - 0x00000024
    • 060914-15553-01.dmp - 08/06/2014 15:46:47 - PAGE_FAULT_IN_NONPAGED_AREA - 0x00000050
    • 060914-17721-01.dmp - 09/06/2014 00:54:41 - PAGE_FAULT_IN_NONPAGED_AREA - 0x00000050
    • 060714-15927-01.dmp - 09/06/2014 15:57:58 - MEMORY_MANAGEMENT - 0x0000001a
    • 061014-13509-01.dmp - 10/06/2014 20:09:53 - MEMORY_MANAGEMENT - 0x0000001a
    • 061114-16099-01.dmp - 11/06/2014 16:48:50 - PAGE_FAULT_IN_NONPAGED_AREA - 0x00000050


    Side Note: I've been noticing Google Chrome Adobe Shockwave crashing regularly and tabs reverting to "Aw, Snap!", whilst games crash either mid-way, after automatic closure (League of Legends) or manual closure. I've even had League of Legends tell me my client files may be corrupt and ask me to repair my installation (has never had that issue before).

    Something really is wrong, and I am at my wits end with this. All computer hardware components are new (except for speakers and my headset) and this has been happening daily for the past week.

    If anyone can shed some light on the situation, (I'm not much of a computer guru) I'd be over the moon!
    Last edited by Holy Dribble; 11 Jun 2014 at 11:37.
      My Computer


  2. Posts : 7
    Windows 7 Professional x64
    Thread Starter
       #2

    Seems I just had another BSoD, involving "ntoskrnl.exe" and "win32k.sys" with the Bug Check String "PAGE_FAULT_IN_NONPAGED_AREA" - 0x00000050

    I was playing RuneScape whilst watching a YouTube video this time, about five tabs in Google Chrome (mostly this forum).

    I updated the main post list of BSoD's, but I'll attach the .zip file made by dm log collector in this post as I don't know if replacing the old .zip will delete any information needed of the previous BSoD's.
    Last edited by Holy Dribble; 09 Jun 2014 at 08:07.
      My Computer


  3. Posts : 7
    Windows 7 Professional x64
    Thread Starter
       #3

    Another BSoD, involving "ntoskrnl.exe" again with the Bug Check String "MEMORY_MANAGEMENT" - 0x0000001a.

    Playing a game this time (had it crash mid-way twice before this BSoD happened) and was watching a streamer on Twitch.

    Again, I'll post the updated .zip which still contains the old .dmp's. It seems if I do these activites, I can sort-of force a BSoD, but I'm adamant it's something to do with my GPU.

    I've also uninstalled avast! Antivirus and installed MSE instead, it's been giving me some false positives on games and at the moment I am unsure if it was causing any of the BSoD's or not, so might as well play it safe.

    Any help again is greatly appreciated! :)
    Last edited by Holy Dribble; 09 Jun 2014 at 12:38. Reason: Deleted avast! and installed MSE
      My Computer

  4.    #4

    Rather than posting again each time it is best that you update the original post as it gives us the impression that somebody is already helping you.

    Code:
    BugCheck 1A, {41790, fffffa8002027e20, ffff, 0}
    The memory manager has detected page table page corruption.

    Code:
    7: kd> dt nt!_MMPFN fffffa8002027e20
       +0x000 u1               : <unnamed-tag>
       +0x008 u2               : <unnamed-tag>
       +0x010 PteAddress       : 0xfffff6fb`40000390 _MMPTE
       +0x010 VolatilePteAddress : 0xfffff6fb`40000390 Void
       +0x010 Lock             : 0n1073742736
       +0x010 PteLong          : 0xfffff6fb`40000390
       +0x018 u3               : <unnamed-tag>
       +0x01c UsedPageTableEntries : 0xffff
       +0x01e VaType           : 0 ''
       +0x01f ViewCount        : 0 ''
       +0x020 OriginalPte      : _MMPTE
       +0x020 AweReferenceCount : 0n128
       +0x028 u4               : <unnamed-tag>
    The page table count has actually fallen below zero which is normally caused by device drivers.

    I think looking in the raw stack might give us a clue.

    Code:
    Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for nvlddmkm.sys
    *** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
     nvlddmkm+0xcbb01
    Code:
    7: kd> lmvm nvlddmkm
    start             end                 module name
    fffff880`0f2e9000 fffff880`0ff4d000   nvlddmkm T (no symbols)           
        Loaded symbol image file: nvlddmkm.sys
        Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
        Image name: nvlddmkm.sys
        Timestamp:        Tue May 20 00:08:44 2014 (537A8EFC)
        CheckSum:         00C1EA41
        ImageSize:        00C64000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    These latest versions of Nvidia drivers have caused issues for some people.
    Try rolling back your display driver.
    These instructions are useful.

    NVIDIA Drivers - Avoid Problems

    My analysis on the Page Fault in Non Paged Area

    Code:
    BugCheck 50, {fffff800c2724f38, 0, fffff960002feaae, 5}
    Although these bugchecks normally indicate faulty RAM I am leaning towards software...

    The faulting address being referenced stored in the 2nd control register before the page fault handler was called.

    Code:
    0: kd> r cr2
    cr2=fffff800c2724f38
    The address being referenced is invalid, so why would the system reference a memory address that isn't valid?
    Well this isn't a Kernel Memory Dump so it's difficult to analyse the actual cause, we will work with what we have though.

    Code:
    0: kd> !pte fffff800c2724f38
                                               VA fffff800c2724f38
    PXE at FFFFF6FB7DBEDF80    PPE at FFFFF6FB7DBF0018    PDE at FFFFF6FB7E003098    PTE at FFFFF6FC00613920
    contains 0000000000199063  contains 0000000000000000
    GetUlongFromAddress: unable to read from fffff80002ef65dc
    pfn 199       ---DA--KWEV  not valid
    Looking at the registers we can see that

    Code:
    0: kd> r
    rax=fffff6fb7dbed000 rbx=fffff6fb7dbf0018 rcx=0000000000000050
    rdx=fffff800c2724f38 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002cbebc0 rsp=fffff8800af90a58 rbp=fffff8800af90ac0
     r8=0000000000000000  r9=fffff8800af90bc0 r10=0000000000000000
    r11=0000000000000000 r12=fffff6fb7e003098 r13=fffff800c2724f38
    r14=fffff8800af90bc0 r15=00000000000001f0
    iopl=0         nv up ei pl zr na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
    nt!KeBugCheckEx:
    fffff800`02cbebc0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff880`0af90a60=0000000000000050
    fffff800`02cbebc0 dereferenced rsp which then creates a memory write to fffff880`0af90a60

    Unfortunately most of the time the Page Table Entries aren't saved in minidumps as it hasn't with this one.

    Code:
    0: kd> !pte fffff880`0af90a60
                                               VA fffff8800af90a60
    PXE at FFFFF6FB7DBEDF88    PPE at FFFFF6FB7DBF1000    PDE at FFFFF6FB7E2002B8    PTE at FFFFF6FC40057C80
    Unable to get PPE FFFFF6FB7DBF1000
    As a result of this hindrance I thought it would help looking at the loaded modules with the lm command.

    Code:
    Unloaded modules:
    fffff880`07b06000 fffff880`07b77000   spsys.sys
    fffff880`0506d000 fffff880`0507b000   crashdmp.sys
    fffff880`0507b000 fffff880`05085000   dump_storpor
    fffff880`04c9c000 fffff880`04f56000   dump_iaStorA
    fffff880`05085000 fffff880`05098000   dump_dumpfve
    fffff880`07b06000 fffff880`07b77000   spsys.sys
    fffff880`07bb2000 fffff880`07bc5000   [COLOR="rgb(255, 140, 0)"]xusb21.sys[/COLOR]
    fffff880`07b9f000 fffff880`07bb2000   xusb21.sys
    fffff880`07b06000 fffff880`07b77000   spsys.sys
    fffff880`01ce5000 fffff880`01cf3000   crashdmp.sys
    fffff880`01cf3000 fffff880`01cfd000   dump_storpor
    fffff880`04ca4000 fffff880`04f5e000   dump_iaStorA
    fffff880`04f5e000 fffff880`04f71000   dump_dumpfve
    fffff880`041ae000 fffff880`041b6000   UsbCharger.s
    xusb21.sys has been known to cause issues which is a USB driver for your xbox controller.

    http://www.carrona.org/drivers/search.php?id=xusb21.sys

    You could try an update here but I recommend you remove the software.

    Intel Rapid Storage Technology is installed which is known to cause a lot of issues that cannot be fixed apart from a removal of the drivers.

    Uninstall it from Control Panel > Programs and Features. Then Uninstall the driver from device manager.

    1. Right click on "my computer" icon and click "manage" on the context menu.
    2. It will open the "computer management" window.
    3. Select "Device Manager" in the left pane, It will list all the existing devices up.
    4. Expand "Disc Drives" by clicking on the triangle in front of it.
    5. Select one item under it, right click, uninstall.
    6. Continue the process for all items under "Disc Drives"
    7. Now restart the computer. At restart, windows will auto configure the appropriate system driver, msahci.sys.


    You mention you ran a scan with Avast but I cannot see any traces of Avast on your system, I take it you removed it?

    It's known to cause a lot of issues so if so then that's one step closer to victory
      My Computer


  5. Posts : 7
    Windows 7 Professional x64
    Thread Starter
       #5

    Sorry for the triple-post, I'll remember in future to keep it to one post if anything new comes along. :)

    I did un-install avast! Antivirus as I've read countless posts saying it could cause problems, and the fact it was giving me false positives was a nightmare (wasn't prepared to make exceptions either).

    I've uninstalled;
    • Microsoft Xbox 360 Accessories 1.2 (Assuming that's the xusb21.sys driver)
    • Intel Rapid Storage Technology and the drivers under "Disc Drives"


    The issue I'm currently having is that on Step 3 of NVIDIA Drivers - Avoid Problems, there is no "NVIDIA" folder located in my "C" drive.
    In fact, I've done a search to find no "NVIDIA" folder containing any "337.88" folder with the drivers inside anywhere on my computer.

    Got "NVIDIA Corporation" folders dotted in places, but nothing in them relating to what I should be finding.
    EDIT: My NVIDIA drivers update via my NVIDIA GeForce Experience, would that place the drivers elsewhere?
      My Computer

  6.    #6

    If there are no files on the C drive then leave that step, they normally don't do anything, it's not always necessary.
      My Computer


  7. Posts : 7
    Windows 7 Professional x64
    Thread Starter
       #7

    Right, so I've finally just got round to un-installing the latest NVIDIA drivers, but I've had two BSoD's before I had a chance to get round to this.

    The reason I couldn't get them up onto the post as soon as they happened, is because;
    • 061014-13509-01.dmp - 10/06/2014 20:09:53 - MEMORY_MANAGEMENT - 0x0000001a happened whilst a friend was over, playing Mortal Kombat and I decided to leave it until today to post it when I got home.
    • 061114-16099-01.dmp - 11/06/2014 16:48:50 - PAGE_FAULT_IN_NONPAGED_AREA - 0x00000050 happened just before I was attempting to get on the website to post the previous results and backdate the NVIDIA Driver before the doorbell rang. (Goddamn it)


    Anyway, bad luck aside, I'll post the updated .zip folder, keeping in mind that now NVIDIA drivers are backdated to 335.23 to see if that'll fix anything. Hopefully it'll reveal something else if there is anything! :)

    Also, worryingly, Windows Update had apparently never checked for updates or installed updates on my machine. Checked for updates and got the twelve latest ones, but that did bother me a little. I've definitely installed updates before, so that's a mystery to me.


    EDIT:
    Another BSoD, was watching a streamer on Twitch and playing a game. This one apparently was caused by driver "dxgmms1.sys". Possibly related to the backdating of the NVIDIA driver, hope it isn't.

    061114-23852-01.dmp - 11/06/2014 - PAGE_FAULT_IN_NONPAGED_AREA - 0x00000050

    If I get a BSOD and upload the .zip file, can I overwrite the previous .zip in this post? Or will you lose information that could show a possible cause? Regardless for the current time, I'll upload it but not overwrite the previous.

    In the meantime, I'm going to run Driver Verifier and see if I get anything out of it.

    The new .zip is NEMESIS-PC-11_06_2014_182131_31. (Why is it less KB?)
    Last edited by Holy Dribble; 11 Jun 2014 at 12:35. Reason: Another BSoD.
      My Computer

  8.    #8

    At first I thought this would be a software issue but now it looks very much like bad RAM.

    Code:
    BugCheck 1A, {5003, fffff70001080000, 6a32, a321449}
    This bugcheck indicates the memory manager found the working set free lists to be corrupt, this is actually mostly caused by bad RAM.
    That's the first indication.

    The second indication is again a 0x50 bugcheck which can be caused by bad RAM or failing software.
    Due to the fact this is a minidump some Page Table Entries haven't been saved, so I can't do a full analysis.

    Code:
    BugCheck 50, {fffff0a00fa66c08, 1, fffff88001237900, 7}
    fffff0a00fa66c08 was referenced by an instruction at fffff88001237900, but we can see that the address being referenced was stored in the 2nd control register before the page fault handler was called.

    Code:
    0: kd> r cr2
    cr2=fffff0a00fa66c08
    Code:
    0: kd> !pte fffff0a00fa66c08
                                               VA fffff0a00fa66c08
    PXE at FFFFF6FB7DBEDF08    PPE at FFFFF6FB7DBE1400    PDE at FFFFF6FB7C2803E8    PTE at FFFFF6F85007D330
    contains 0000000000000000
    not valid
    This shows us the address being referenced was invalid, as I said earlier I cannot check everything.

    Code:
    0: kd> r
    rax=fffff6fb7dbed000 rbx=fffff6fb7dbe1400 rcx=0000000000000050
    rdx=fffff0a00fa66c08 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002c75bc0 rsp=fffff8800a606418 rbp=fffff8800a606480
     r8=0000000000000001  r9=fffff8800a606580 r10=0000000000000000
    r11=0000000000000001 r12=fffff6fb7c2803e8 r13=fffff0a00fa66c08
    r14=fffff8800a606580 r15=00000000000001e1
    iopl=0         nv up ei pl zr na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
    nt!KeBugCheckEx:
    fffff800`02c75bc0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff880`0a606420=0000000000000050
    rsp was deferenced by fffff800`02c75bc0 which results in a complete memory write operation to this address fffff880`0a606420.

    Code:
    0: kd> !pte fffff880`0a606420
                                               VA fffff8800a606420
    PXE at FFFFF6FB7DBEDF88    PPE at FFFFF6FB7DBF1000    PDE at FFFFF6FB7E200298    PTE at FFFFF6FC40053030
    Unable to get PPE FFFFF6FB7DBF1000
    This is where the Page Table Entries weren't recorded so we can't see whether or not if this address is valid.

    So with this being said I believe the best course of action is testing your RAM.


    Memtest86 will test your RAM

       Information

    Run Memtest86 for at least 8 passes so we get enough information to confirm that your RAM isn't failing
      My Computer


  9. Posts : 7
    Windows 7 Professional x64
    Thread Starter
       #9

    I've done the Memtest86+ once already for 9 passes, but I had all four RAM sticks in, so this time I'll test in their sets of two (8GB 2x4GB) and go on from there.

    I'll let you know if I find anything this time. Thanks for the massive help though, I really do appreciate it! :)

    EDIT:
    Seems the first test I did missed it 9 times! Got halfway through the first pass this time around and it found errors. I'm just going to switch slots to 3&4 from 1&2 to double check it's not the slots, and then I'll test my other two RAM sticks for good measure.

    Not fully solved yet, but once I do the last tests and really stress my computer for a few days, we'll know for sure!

    Keep you updated!
    Last edited by Holy Dribble; 11 Jun 2014 at 15:11. Reason: Seems it's the RAM?
      My Computer

  10.    #10

    Okay :)
      My Computer


 
Page 1 of 2 12 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 02:30.
Find Us