BSOD errors with different strings caused by ntoskrnl.exe and ndis.sys

[brycemaster]

Hi all, I've tried searching for a few months to no avail, but these issues have been occurring for a while now and I turn to the wisdom of the masses;
I've been getting pretty infrequent random BSOD errors. Most of them have no bug check string and blame ntoskrnl.exe or ndis.sys

Attached are the SF Diagnostic tool's findings with a fetch all. Unfortunately I have little experience with BSOD's so I have no idea how to read dump files and the like.
View attachment 265797

I do however think that the issue is related to drivers, as my pc is very new, and only suffered issues after I copied my files and settings across, but I think I may have copied too much when getting my old files such as really old outdated drivers, but I have no idea how to get rid of them as they are not made very obvious as to what they are in hardware manager, and I have downloaded and updated all the drivers for the relevant parts of my pc that I know of (my profile has my stats but I will also post a screenshot from speccy here)
View attachment 265800

I have also run a memtest+ with about 8 passes with no problems.

The issue seems to occur most often when watching videos from my external hard drives or online streaming etc. but this may just be me being paranoid.

The issue is very intermittent as it can go weeks at a time with nothing happening...

Thanks very much for taking the time to give me a hand!

 

[Arc]

Daemon Tools, Alcohol 120% and Power Archiver Pro uses SCSI Pass Through Direct (SPTD), which is a well known BSOD causer. Uninstall Daemon Tools at first. Then download SPTD standalone installer from Disk-Tools.com, and execute the downloaded file as guided below :

• Double click to open it.
• Click this button only:
• 
• If it is grayed out, as in the picture, there is no more SPTD in your system, and you just close the window.

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Your crash dumps are not showing any finite probable cause.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If memtest comes clean, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.
______________________________________________________________________
BSOD ANALYSIS:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d8a00ef549, b3b7465ef28cd34f, fffff880017be4bf, 1}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d8a00ef549, Reserved
Arg2: b3b7465ef28cd34f, Reserved
Arg3: fffff880017be4bf, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
    0 : A generic data region
    1 : Modification of a function or .pdata
    2 : A processor IDT
    3 : A processor GDT
    4 : Type 1 process list corruption
    5 : Type 2 process list corruption
    6 : Debug routine modification
    7 : Critical MSR modification

Debugging Details:
------------------


FAULTING_IP: 
ndis!NdisCoCreateVc+1f32
fffff880`017be4bf 837f2001        cmp     dword ptr [rdi+20h],1

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x109

PROCESS_NAME:  System

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`0357e498 00000000`00000000 : 00000000`00000109 a3a039d8`a00ef549 b3b7465e`f28cd34f fffff880`017be4bf : nt!KeBugCheckEx


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !ndis
    fffff880017be59d - ndis!NdisCoCreateVc+2010
    [ 46:4e ]
1 error : !ndis (fffff880017be59d)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

 

[brycemaster]

Thanks for the quick reply, I have uninstalled Daemon tools, and the uninstall button for the standalone was greyed out indicating nothing more was present on my system.
And apologies I mistyped in my original post but I have used Memtest86+ for 8 passes and it came up clean. I'll edit my original post to show this.

I've made a system restore point and am enabling driver verifier now. I'll check back in 24 hours or if a BSOD happens.

 

[brycemaster]

Thanks for the quick reply, I have uninstalled Daemon tools, and the uninstall button for the standalone was greyed out indicating nothing more was present on my system.
And apologies I mistyped in my original post but I have used Memtest86+ for 8 passes and it came up clean. I'll edit my original post to show this.

I've made a system restore point and am enabling driver verifier now. I'll check back in 24 hours or if a BSOD happens.

Well, I've had driver verifier on now for about 24 hours and so far no BSOD. However, as I stated before, there have been times where the blue screens have gone a week or so without happening so this may or may not have been fixed when I uninstalled Daemon tools.

Any ideas? Thank you.

 

[Arc]

Removing Daemon Tools and freeing up startup can solve any issue, but it is difficult to say with certainty.

You observe it for say one week. Let us know the situation then.

But no BSOD with DV enabled over 24 hours sounds very good to me. It almost nullifies the possibility of a driver error there.

 

[brycemaster]

Ok thanks, I'll keep an eye on it and turn off driver verifier. If I BSOD again or a week goes by I'll check in. Thanks very much for the help.

Also, are there any good alternative to Daemon tools that do not cause BSOD's? Just out of interest.

Thanks again for the helpful replies!

 

[Arc]

All the programs that emaluate a virtual drive are problematic. Daemon Tools and Alcohol are the widest problems, but none the rest are safe.

If you dont have a DVD drive, and you want to run ISO files, I would suggest you to use either free 7-Zip or not very costly Winrar. They extracts all the different disc image files, so the basic work will be equally dont with them. At a maximum, you will miss the DVD movie start screens only and nothing more.

 

[brycemaster]

All the programs that emaluate a virtual drive are problematic. Daemon Tools and Alcohol are the widest problems, but none the rest are safe.

If you dont have a DVD drive, and you want to run ISO files, I would suggest you to use either free 7-Zip or not very costly Winrar. They extracts all the different disc image files, so the basic work will be equally dont with them. At a maximum, you will miss the DVD movie start screens only and nothing more.

Ah ok cool, I've got Winrar and 7-Zip, I didn't know they could open .iso files cheers for the heads up! Still no sign of BSOD's either, I'll check back in a week if not sooner.

 

[brycemaster]

Right, just had a BSOD while I was watching a youtube video. Here's the details:
MEMORY_MANAGEMENT
Caused by driver: tcpip.sys
At address: tcpip.sys+70b0
Crash address: ntoskrnl.exe+7efc0

I've attached the dump file. View attachment 266113

UPDATE:
Here's a newly created SF_Diagnositc tool output as well if it helps: View attachment 266116

 

[Arc]

Update Atheros AR8151 PCI-E Gigabit Ethernet Controller (NDIS 6.20) Driver from Drivers for Atheros AR8151 and Windows 7.

fffff880`04524000 fffff880`04542000   L1C62x64   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\L1C62x64.sys
[COLOR=Red]    Image name: L1C62x64.sys
    Timestamp:        Thu Jul 19 08:25:34 2012 [/COLOR](50077726)
    CheckSum:         0001FE91
    ImageSize:        0001E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Now Disable GPU acceleration for flash player. When a video on you tube is running, right click on it.
Then click on "settings"
View attachment 266117

In the next page, uncheck "hardware acceleration option.
View attachment 266118

Now close it.

I hope you Removed Spotify WebHelper from startup?

Scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Let us know the results.

 

[brycemaster]

Update Atheros AR8151 PCI-E Gigabit Ethernet Controller (NDIS 6.20) Driver from Drivers for Atheros AR8151 and Windows 7.

fffff880`04524000 fffff880`04542000   L1C62x64   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\L1C62x64.sys
[COLOR=Red]    Image name: L1C62x64.sys
    Timestamp:        Thu Jul 19 08:25:34 2012 [/COLOR](50077726)
    CheckSum:         0001FE91
    ImageSize:        0001E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Now Disable GPU acceleration for flash player. When a video on you tube is running, right click on it.
Then click on "settings"
View attachment 266117

In the next page, uncheck "hardware acceleration option.
View attachment 266118

Now close it.

I hope you Removed Spotify WebHelper from startup?

Scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Let us know the results.

Hi, I've just disabled hardware acceleration using the above method. I've already got malwarebytes running a full scan which I'll give the results of when it's completed. I've also scanned with Microsoft security essentials, which found nothing.

I removed everything from startup apart from Murgeemon which is a necessary tool for me to use my dual monitor setup correctly, hopefully this isn't an issue.

I downloaded the drivers from the site provided, but there is no .exe to install them, they come as .inf .sys and .cat files. Do I simply right click>install on the .inf files or is there another procedure? I've never had a driver not have a .exe before I'm afraid.

As for the windows defender offline, I'll have to wait until later to do it as I have to go to work soon. I'll attempt it as soon as I can burn a disc and run the scan.

Thanks for the help, I really appreciate it.

EDIT: Whoops, forgot to mention that the anti-rootkit came up empty as well.

 

[Arc]

Good going so far.
With the updated network driver and hardware acceleration disabled, try to check if it is crashing anymore in the similar type of activities.

 

[brycemaster]

Like I said I got a problem with the network drivers as theres no .exe to install them. The .zip just had the files inside... Is it ok to right click install the .ini files in there?

 

[Arc]

Like I said I got a problem with the network drivers as theres no .exe to install them. The .zip just had the files inside... Is it ok to right click install the .ini files in there?

Follow it : http://www.sevenforums.com/tutorials/97061-driver-install-device-manager.html

You have to install the .sys file contained in the zip

 

[brycemaster]

Like I said I got a problem with the network drivers as theres no .exe to install them. The .zip just had the files inside... Is it ok to right click install the .ini files in there?

Follow it : http://www.sevenforums.com/tutorials/97061-driver-install-device-manager.html

You have to install the .sys file contained in the zip

Ok my network driver is up to date, just have to wait if i get another bsod now. Thanks once again for all your help

 

[Arc]

Wait for it Wait for seven more days at a max

 

[brycemaster]

Wait for it Wait for seven more days at a max

Well, it's been a week and nothing, so do you think that's got it? If so I'll mark this thread as solved. Thanks again for all the help Arc!

 

[Arc]

Well, really good
Considering it as solved now. If there is any further issue, let us know in BSOD Help and Support - Windows 7 Help Forums

 

[brycemaster]

Well, really good
Considering it as solved now. If there is any further issue, let us know in BSOD Help and Support - Windows 7 Help Forums

Almost like I cursed myself by saying it was fixed Just got a BSOD while watching a youtube vid, but I have no idea if it's the cause. Attached is the report from bluescreenview: View attachment 267520

 

[Arc]

Post it following the Blue Screen of Death (BSOD) Posting Instructions.