Solved Random ntoskernel.exe BSOD under varying conditions. Please help.

[justhekicker]

Okay back in June of 2012 i decided to build my first computer. Everything went smoothly and i was up and running for a couple of months until i started to get random BSODs. They happen when i have been playing heavy games or when i have just been searching the internet. Sometimes i can game for 8 hours straight no problem then the next time like 20 min. I ignored them because they only happened every couple weeks. A month ago i had had enough and decided to do something about it. I read every thread i could about it and here is a list of what i have already tried.

I have run bluescreenview and the only consistent file that is causing problems is ntoskernel.exe or some driver file that is different every time

1. Updated all of my drivers
2. Ran verifier for 24 hours and it caused no BSOD
3. Ran memtest with no found errors for 48 hours
4. Ran a GPU stress test with no BSOD or errors
5. Ran CPU stress test with no BSOD or errors
6. Ran manufacturer HDD test with no errors
7. Reformatted raid drive and re-installed windows and still got BSODs
8. Took drives out of raid and re-installed windows to a dedicated drive

I have done everything except actually opening her up because i am still new to messing with hardware. I am at my wits end and would like any suggestions please.

 

[Northernsoul55]

Hi,

Your issue is most likely network related:

***************************************************************************
****
*
*
* Bugcheck Analysis
*
*
*
***************************************************************************
****
Use !analyze -v to get detailed debugging information.
BugCheck D1, {45d8, 2, 0, fffff88001a51d90}
Probably caused by : tcpip.sys ( tcpip!IppPendPacket+20 )
Followup: MachineOwner
---------
6: kd> !analyze -v
***************************************************************************
****
*
*
* Bugcheck Analysis
*
*
*
***************************************************************************
****
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at
an interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.

tcpip.sys
Microsoft TCP/IP Driver (networking related)

Please run SFC to check the integrity of all Windows 7 system files:

Click on the Start > Type in search cmd
Right click cmd at top and Run as Administrator
Type SFC /scannow at the prompt

:ar: http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Do you have any Avg/Avira software installed?

I have asked another member to assist who is better equipped to deal with network issues / drivers.

Cheers

Dave

 

[Arc]

With what my friend Northernsoul55 suggested, update the following drivers:

• Atheros AR9485 Wireless Network Adapter : from http://www.atheros.cz/
• Intel(R) 82579V Gigabit Network Connection: from Intel Download Center

fffff880`068ba000 fffff880`06b6a000   athrx      (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\[URL="http://www.carrona.org/drivers/driver.php?id=athrx.sys"]athrx.sys[/URL]
    Image name: [URL="http://www.carrona.org/drivers/driver.php?id=athrx.sys"]athrx.sys[/URL]
    Timestamp:        [COLOR=Red]Fri Oct 21 15:15:10 2011 [/COLOR](4EA13F26)
    CheckSum:         002AF1A0
    ImageSize:        002B0000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
================================================================================
fffff880`05368000 fffff880`053bf000   e1c62x64   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\[URL="http://www.carrona.org/drivers/driver.php?id=e1c62x64.sys"]e1c62x64.sys[/URL]
    Image name: [URL="http://www.carrona.org/drivers/driver.php?id=e1c62x64.sys"]e1c62x64.sys[/URL]
    Timestamp:        [COLOR=Red]Wed Jul 20 22:07:53 2011[/COLOR] (4E270461)
    CheckSum:         00057931
    ImageSize:        00057000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

As you can see, both the drivers are very old, so there are fair chance of network blockage. Updates are necessary.

And, at the same time, Uninstall Super AntiSpyware, as it has some known issues with windows 7 sometimes.

Let us know the results.

 

[justhekicker]

Okay i ran sms/scannow and it didn't find any problems. I updated both of my network drivers. I don't think it's the network drivers though because i have turned each one off in turn with a BSOD on each one exclusively.

Also I forgot to mention that i have updated my BIOS

The BSODs are usually about once or twice a week so i will post as soon as one occurs or if nothing occurs in two weeks i will mark as solved.

 

[Arc]

When you get the next BSOD, upload teh crash dump to be analyzed. May be it may give us some more hint about the issue.

 

[justhekicker]

Okay it's been two weeks with no BSOD. I'm not sure if it was the drivers or unistalling Avira and superantispyware. Thanks guys so much for helping.

Follow up question. Is MSE enough for antivirus, firewall, spyware, and malware or should i get another program to supplement it.

 

[Arc]

Okay it's been two weeks with no BSOD. I'm not sure if it was the drivers or unistalling Avira and superantispyware. Thanks guys so much for helping.

Good to know. I guess you can mark this thread as solved now.

Follow up question. Is MSE enough for antivirus, firewall, spyware, and malware or should i get another program to supplement it.

MSE is enough. Still, we use two other tools as on demand scanners.

• Free MBAM
• Windows Defender Offline

Nothing more is needed there.

 

[justhekicker]

Thanks

 

[justhekicker]

Okay so i just got another BSOD. I ran SF again and have uploaded the results and the specific minidump.

 

[Arc]

This bugcheck code is inherent with AMD/ATI display driver, and so there is a less scope of troubleshoot it. If you use ATI, this particular BSOD may occur.

.........
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A0000001, {5, 0, 0, 0}

Probably caused by : atikmdag.sys ( atikmdag+2392c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Unknown bugcheck code (a0000001)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000005
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA0000001

PROCESS_NAME:  System

CURRENT_IRQL:  9

TAG_NOT_DEFINED_c000000f:  FFFFF80000BA2FB0

LAST_CONTROL_TRANSFER:  from fffff88005a9a92c to fffff80002e86c00

STACK_TEXT:  
fffff800`00b9c5f8 fffff880`05a9a92c : 00000000`a0000001 00000000`00000005 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9c600 00000000`a0000001 : 00000000`00000005 00000000`00000000 00000000`00000000 00000000`00000000 : atikmdag+0x2392c
fffff800`00b9c608 00000000`00000005 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xa0000001
fffff800`00b9c610 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff800`00b9c660 : 0x5


STACK_COMMAND:  kb

FOLLOWUP_IP: 
atikmdag+2392c
fffff880`05a9a92c ??              ???

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  atikmdag+2392c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME:  atikmdag.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5147d1ba

FAILURE_BUCKET_ID:  X64_0xA0000001_atikmdag+2392c

BUCKET_ID:  X64_0xA0000001_atikmdag+2392c

Followup: MachineOwner
---------

0: kd> lmvm atikmdag
start             end                 module name
fffff880`05a77000 fffff880`065e2000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Tue Mar 19 08:17:22 2013 (5147D1BA)
    CheckSum:         00B1557C
    ImageSize:        00B6B000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

As a try, you may roll the display driver back to one that worked stable for you.
Device Manager - Roll Back Driver

 

[justhekicker]

So before i could rollback the driver i got another BSOD with another file indicated. I have since rolled it back and i have uploaded the new minidump.

 

[Arc]

This BSOD blames Intel Management Engine Interface.

fffff880`0ad89618  fffff880`03133128Unable to load image \SystemRoot\system32\DRIVERS\[URL="http://www.carrona.org/drivers/driver.php?id=HECIx64.sys"]HECIx64.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=HECIx64.sys"]HECIx64.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=HECIx64.sys"]HECIx64.sys[/URL]
 HECIx64+0xe128

This program comes bundled with the motherboards driver cd, but not anything necessary at all. You may easily delete it from Control Panel> Programs and Features.

It also indicates to cdd.dll.

fffff880`0ad890e8  fffff960`00644000Unable to load image \SystemRoot\System32\cdd.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for cdd.dll
*** ERROR: Module load completed but symbols could not be loaded for cdd.dll
 cdd+0x4000

It is somehow associated with display. Either the driver or the GPU itself in question here.

 

[justhekicker]

Okay so i have uninstalled the Intel management engine. What should i do about the cdd.dll? Should i just wait and see if the GPU driver rollback worked and go from there or is there something that i could test for now?

 

[Arc]

Try the driver rollback, and stress test the Graphics Card using Furmark.
Video Card - Stress Test with Furmark

 

[justhekicker]

Okay so my GPU passed the Furmark so we'll see what happens now.

 

[justhekicker]

So i just got another BSOD. I was just watching TV show using VLC.

 

[Arc]

Your crash dumps are not showing any finite probable cause.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If memtest comes clean, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[justhekicker]

I can run both of these tonight, but i have to say that i have already run both of these tests before i reformatted/reinstalled with no errors and still with BSODs

 

[Northernsoul55]

Best to run them again

Until we sort your BSOD can you please set any overclocking to default as
Overclocking will cause system stability issues:

2: kd> !sysinfo cpuspeed
CPUID:        "Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz"
MaxSpeed:     3400
CurrentSpeed:[COLOR=red] 3502
[/COLOR]

Cheers

Dave

 

[justhekicker]

Alright so memtest found and error on the 9th pass. This is actually a relief to actually find a tangible problem. Hopefully it is the only one. I will not have enough time this weekend to figure out if it is one stick, both sticks, or a mobo slot. I hope it's not a BIOS setting because i am totally lost if it is. I'll let y'all know as soon as i find out.