BSOD when gaming "ntkrnlmp.exe"?? HELP please

mike890 · 01 Jan 2010

I'm running windows 7 x64 pro and during gaming, at random times a BSOD would appear and the only useful info i found on the blue screen is that is says "ntkrnlmp.exe" and IRQL_not less or equal.

I updated my bios and drivers and I have tested my memory using the windows memory test overnight and no error were found. Please help me track down what is causing this. Could a power supply be causing this issue? I feel that my enermax 400W power supply might be too low to power my system.

I have attached the minidump file, any help is greatly appreciated.

Thanks

zigzag3143 · 01 Jan 2010

mike890 said:

I'm running windows 7 x64 pro and during gaming, at random times a BSOD would appear and the only useful info i found on the blue screen is that is says "ntkrnlmp.exe" and IRQL_not less or equal.

I updated my bios and drivers and I have tested my memory using the windows memory test overnight and no error were found. Please help me track down what is causing this. Could a power supply be causing this issue? I feel that my enermax 400W power supply might be too low to power my system.

I have attached the minidump file, any help is greatly appreciated.

Thanks

Hi and welcome mike

This one probably caused by your ras2tp.sys driver thats the intel network driver. You also have several old drivers (see the list below)

I would update the drivers
run a system file check to verify and repair your system files
type cmd in search>right click and run as admin>sfc /scannow

Hope this helps

Ken J

Code:

RTCore64.sys        fffff880`05c9b000    fffff300`05ca1000    0xfffffa8000006000    0x42941d90    5/25/2005 1:39:12 AM                        
secdrv.SYS        fffff880`05d4a000    fffff880`05d55000    0x0000b000    0x4508052e    9/13/2006 8:18:38 AM                        
speedfan.sys        fffff880`01662000    fffff880`01669000    0x00007000    0x45168798    9/24/2006 8:26:48 AM

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\123109-19093-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`0305f000 PsLoadedModuleList = 0xfffff800`0329ce50
Debug session time: Fri Jan  1 01:15:43.968 2010 (GMT-5)
System Uptime: 0 days 2:01:58.359
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {1000000, 2, 0, fffff800030dc2d2}

Probably caused by : ntkrnlmp.exe ( nt!KiProcessExpiredTimerList+72 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000001000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800030dc2d2, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800033070e0
 0000000001000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiProcessExpiredTimerList+72
fffff800`030dc2d2 803818          cmp     byte ptr [rax],18h

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff88002f8b450 -- (.trap 0xfffff88002f8b450)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000001000000 rbx=0000000000000000 rcx=fffffa8006741c00
rdx=0000000000000102 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030dc2d2 rsp=fffff88002f8b5e0 rbp=0000000000072597
 r8=fffff88002f65301  r9=0000000000000003 r10=0000000000000097
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!KiProcessExpiredTimerList+0x72:
fffff800`030dc2d2 803818          cmp     byte ptr [rax],18h ds:00000000`01000000=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030d0469 to fffff800030d0f00

STACK_TEXT:  
fffff880`02f8b308 fffff800`030d0469 : 00000000`0000000a 00000000`01000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`02f8b310 fffff800`030cf0e0 : fffff880`02f8b630 fffffa80`06741c20 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`02f8b450 fffff800`030dc2d2 : fffffa80`06741c20 fffffa80`04583938 fffffa80`04583938 00000000`00000102 : nt!KiPageFault+0x260
fffff880`02f8b5e0 fffff800`030dce7e : 00000011`0a150516 fffff880`02f8bc58 00000000`00072597 fffff880`02f66868 : nt!KiProcessExpiredTimerList+0x72
fffff880`02f8bc30 fffff800`030dc697 : 00000004`fb57acc2 00000004`00072597 00000004`fb57ac0a 00000000`00000097 : nt!KiTimerExpiration+0x1be
fffff880`02f8bcd0 fffff800`030d96fa : fffff880`02f63180 fffff880`02f6dfc0 00000000`00000000 fffff880`13e93760 : nt!KiRetireDpcList+0x277
fffff880`02f8bd80 00000000`00000000 : fffff880`02f8c000 fffff880`02f86000 fffff880`02f8bd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiProcessExpiredTimerList+72
fffff800`030dc2d2 803818          cmp     byte ptr [rax],18h

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!KiProcessExpiredTimerList+72

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0xA_nt!KiProcessExpiredTimerList+72

BUCKET_ID:  X64_0xA_nt!KiProcessExpiredTimerList+72

Followup: MachineOwner
---------

mike890 · 02 Jan 2010

I updated my networking driver but another BSOD came up during web browsing watching youtube. What program did you use in the previous screenshot where it shows what driver was causing the error?

I have attached the minidump from the latest BSOD
I greatly appreciate any help

usasma · 02 Jan 2010

Please start with this:

H/W Diagnostics:
Please start by running these hardware diagnostics:
Memory Diagnostics (read the details at the link)
HD Diagnostic (read the details at the link)

Also, please run one of these free, independent online malware scans to ensure that your current protection hasn't been compromised: Malware (read the details at the link)

Please replace this driver with one that's released for Win7: RTCore64.sys Wed May 25 02:39:12 2005

Then, please run Driver Verifier using these instructions:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line.

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users

mike890 · 03 Jan 2010

I have check my memory again using memtest86+ and found no errors with 8 passes, I used driver verifier and a BSOD came up right away and said something about "HIDCLASS.SYS" I also ran a system files check and no problems were found. No virus were found either

I attached the latest minidump from using driver verifier, hopefully someone can point me to the right direction

Thanks

usasma · 03 Jan 2010

HIDCLASS.SYS is a Microsoft driver (not one that Driver Verifier was asked to verify.
As such we've gotta assume that this is a Windows corruption or a hardware problem.

To rule out Windows, please rerun the Driver Verifier again - this time selecting ALL drivers. This will significantly slow down your system. Once you get another dump, let us know and then turn off the Verifier.

I suspect that there's a USB device that's causing issues - but it's just a guess at this point.
What USB devices do you have installed on the system. What make and model is the system (so we can see what USB devices it has built into it).

mike890 · 04 Jan 2010

Thanks for all the help, I selected check all drivers and here is the BSOD that came up. It doesnt seem to say which driver causes the problem.

The only thing attached to my usb ports is a bluetooth dongle that came with my logitech mx5500 keyboard/mouse set, and a brother hl-2040 laser printer that is powered off.

usasma · 05 Jan 2010

IMO this would seem likely to rule out Windows as the cause - and would seem to make hardware problems more likely. In this case it points to DirectX as being a problem (that's different from the USB from the previous post). Please ensure that Driver Verifier is turned off - as we won't need it any more and it'll just create more BSOD's.

Some things to try:
- another video card
- unplugging the HP printer
- unplugging the keyboard and using a wired PS2 keyboard.

Next, run these hardware diagnostics

H/W Diagnostics:
Please start by running these hardware diagnostics:
Memory Diagnostics (read the details at the link)
HD Diagnostic (read the details at the link)

Also, please run one of these free, independent online malware scans to ensure that your current protection hasn't been compromised: Malware (read the details at the link)

After that, there's 2 avenues to pursue:
- a clean install of Windows with no additional programs (to make absolutely sure that it's not the cause)
- removing every single unnecessary component in order to test the system (if you still get BSOD's it's something on the system - if you don't, then it's in the pile of stuff that you removed).

mike890 · 07 Jan 2010

I have ran the memory and hard drive diagnostics and no errors were found. I'm planning to re-install windows and was wondering after reinstalling windows should I start driver verifier and then install drivers one by one to see which is causing the BSODS?

The Bsods that comes up when using driver verifier points to windows drivers, does that mean my install is corrupt?

Also culd it be related to my power supply, I just had another BSOD today and again occured during a gaming session I tried using the winDbg tool and all it came up was "hardware". If anyone could dig up more info on the minidump that would be great

usasma · 07 Jan 2010

No, don't use Driver Verifier in this way.
Driver Verifier stresses drivers by doing things to them that aren't intended.
The stress can cause a driver to crash - even if it wouldn't crash under normal circumstances.
It's best to only use Driver Verifier when you already have evidence that a 3rd party driver is currently causing BSOD's on that particular Windows installation.

The point of a reinstall isn't to give you a working copy of Windows (unfortunately). Rather it's a test to see if the old copy of Windows was at fault (if you reinstall and everything works - then it was the old copy of Windows that was at fault). OTOH, if you still have problems, then you can be pretty sure that it's a hardware problem that's causing your issues (and then you can troubleshoot what piece of hardware it is - and in your case I'd start with the video card).

Running an analysis is fairly easy - it's massaging the data and interpreting it that's the hard part. This is a STOP 0x1E error (more info on that here: BSOD Index )
At the top of that page you can see the usual causes - so that's where you start in troubleshooting. In this case, since it's a new OS, compatibility is more significant than it would be with an older OS

Please remove the program associated with RTCore64.sys as it's an older program (from 2005) and may have compatibility issues with Win7. It's most likely associated with RivaTuner or EVGA Precision

If the BSOD's keep occurring, please run Driver Verifier according to these directions:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line.

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users