BSOD 6 times, usually while Idle - ntoskrnl.exe

[Entropy42]

Computer has done this randomly ever since it was built. Sometimes it goes 1 day, sometimes it goes 2 weeks. It is on 24/7, and most of the crashes are while I am not working and it is just idling. Today it crashed while I was typing a post in Chrome.

Used WhoCrashed to find out that 5/6 crashes were ntoskrnl.exe, 1 was rt64win7.sys.
BugCheck names were: memory_management, bad_pool_caller, memory_management, system_service_exception, driver_irql_not_less_or_equal (rt64win7.sys), irql_not_less_or_equal

Have run memcheck and passed all tests with no errors.
After the rt64win7.sys/driver_irql_not_less_or_equal crash the BSOD said it was a tcpip.sys error so I updated my network drivers. Thought that fixed it as I had 15 days of uptime until today's crash.

Now I'm at a loss, hopefully someone can help.

 

[Arc]

Hi Entropy42.

First of all, Update your ATI/AMD display driver to the latest WHQL. It is too old.

fffff880`07e05000 fffff880`07e5a000   atikmpag T (no symbols)           
    Loaded symbol image file: atikmpag.sys
    Image path: atikmpag.sys
[COLOR=Red]    Image name: atikmpag.sys
    Timestamp:        Wed Oct 26 06:51:58 2011[/COLOR] (4EA760B6)
    CheckSum:         0005289A
    ImageSize:        00055000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

You can get it from the link in our forum, http://www.sevenforums.com/graphic-...alyst-video-driver-windows-7-a.html#post17671, or you may go to AMD Graphics Driver and Software and opt for Automatically Detect and Install the appropriate driver for your card.

During installation, you may opt for advanced installation, and install the display driver only, not the Catalyst Control Center.

The realtek network driver is not too old; but it is failing (on hardware?).

BugCheck D1, {8089, 2, 1, fffff88001a839c3}

*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** [COLOR=Red]ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys[/COLOR]
[COLOR=Red][B]Probably caused by : hardware ( Rt64win7+1ac84 )[/B][/COLOR]

Followup: MachineOwner
---------

Update it from Realtek ..... take the Win7 and WinServer 2008 R2 Auto Installation Program (the 4th one in the list).

Also, Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

Let us know the results.

 

[Entropy42]

Thank you very much for the advice. I've updated the drivers and will run memtest tonight (I did run it overnight in the past with no errors, but it was not a version that required a bootable USB/CD). It could be a while before I know if the problem is fixed, since I recently went 15 days with no crashes.

 

[Entropy42]

Ran MemTest for the weekend, 19 passes completed, no errors.

 

[Arc]

OK, let us know for any further issue.

 

[Entropy42]

Computer has blue screened twice since my last post. Apparently updating the drivers did not fix the issue. Updated SF Diag Tool dump attached.

 

[Arc]

It is hardware level failure.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002f6be7c, fffff8800a8b1d30, 0}

[COLOR=Red]Probably caused by : hardware[/COLOR] ( nt!RtlpCopyAces+39c )

Followup: MachineOwner
---------

Last hardware failure was on rt64win7.sys, the onboard network adapter see post #2.

I would suggest you to RMA the motherboard.

 

[Entropy42]

Rather than sending in the whole mobo, I disabled the onboard network adapter in the bios and put in a PCI-E network card. Still getting BSODs, but they have a huge range of bugcheck names. KMODE_EXCEPTION_NOT_HANDLED, SYSTEM_SERVICE_EXCEPTION, SYSTEM_THREAD_EXCEPTION_NOT_HANDLED, PAGE_FAULT_IN_NONPAGED_AREA.

They almost always occur when I am not even at my computer and it is just sitting idle overnight with the displays off.

Uptime between crashes still ranges from less than a day, to 12 days.

I've attached another zip from the SF Diagnostic Tool.

 

[Arc]

I've attached another zip from the SF Diagnostic Tool.

Sorry?

I thought that the issue is identified, but as you want another check, I will do. Upload the data properly.

 

[Entropy42]

Yeah, from the crashes I submitted before, you said it was a hardware problem with my onboard NIC, but I disabled that and am still getting the crash, so I was hoping someone could look at the more recent crashes and see what they indicate the problem to be. I updated the previous post with the zip file from the SF tool, is that data uploaded wrong?
Thanks for the help.

 

[Arc]

Yeah, from the crashes I submitted before, you said it was a hardware problem with my onboard NIC, but I disabled that and am still getting the crash, so I was hoping someone could look at the more recent crashes and see what they indicate the problem to be. I updated the previous post with the zip file from the SF tool, is that data uploaded wrong?
Thanks for the help.

The information obtained from the latest crash dump:

fffff880`035294f8  fffff880`07e7bd57Unable to load image Rt64win7.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Rt64win7.sys
[COLOR=Red]*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys[/COLOR]
 Rt64win7+0x7d57

 

[Entropy42]

I'm not sure what that means, but it seems like its blaming my network drivers again. I uninstalled them and reinstalled the newest ones from Realtek's site (which I had already done, but maybe they've changed).

Strangely, uninstalling/reinstalling the drivers caused my network card to claim that there was no network cable plugged in. It no longer recognizes the cable that I've been using for months, but is accepting a different cable.

 

[Arc]

Yes, it means that the realtec NIC is still active and causing BSODs in he same way. And it nullifies your statement that realtek NIC is disabled, unfortunately.

 

[Entropy42]

I disabled the onboard NIC in BIOS, but had to install a PCI-E NIC in order to keep using my computer, it seems the new one also uses the Realtek chipset, and the same driver. The fact that I'm still getting the issue with a different NIC makes me think its a software rather than hardware issue though.

 

[Arc]

Most possible.

But it makes the situation complicated at the first look. Anyway, update the driver following post #2 and let us know for any further issue.

 

[Entropy42]

Yeah, unfortunately the driver update didn't fix it. BSOD after 4 days of uptime. Using "WhoCrashed" it says the last crash (and several before it) are due to ntoskrnl.exe, but that's the core of windows, so I guess it could be anything.

 

[Arc]

Yeah, unfortunately the driver update didn't fix it. BSOD after 4 days of uptime. Using "WhoCrashed" it says the last crash (and several before it) are due to ntoskrnl.exe, but that's the core of windows, so I guess it could be anything.

Post it following the Blue Screen of Death (BSOD) Posting Instructions.

 

[Entropy42]

Updated zip attached.

 

[Arc]

BugCheck D1, {fffff88041a86c9c, 2, 8, fffff88041a86c9c}

Probably caused by : tcpip.sys ( tcpip!TcpPartitionGetNextExpirationTick+101 )

Followup: MachineOwner
---------

In short, it reports a network driver failure. No adequate reason of it, as your network driver is the latest version. Something else might be playing in the background.

You need to enable driver verifier. But before enabling it, alter the display driver a bit, cause it is failing too.

fffff800`00b9c508  fffff880`07a46b36Unable to load image atikmpag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmpag.sys
[COLOR=Red]*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys[/COLOR]
 atikmpag+0x45b36

Uninstall your installed latest version of the display driver.

• How-To Uninstall AMD Catalyst Drivers From A Windows Based System

Then clean up any possible leftover.

• http://www.sevenforums.com/tutorials/83814-drivers-clean-left-over-files-after-uninstalling.html

Then install version 13.9 WHQL only.

• Previous AMD Catalyst? Display Drivers

Lately we have seen a lot of issues with the latest 13.12 WHQL AMD Catalyst.

Now enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[Entropy42]

I did all of this and ran DV, selecting all non-MS drivers. The computer BSOD before the login prompt, both times with IRQL_NOT_LESS_EQUAL. It did not generate a log of the crash though. I am going through now and selecting smaller sets of drivers to try and find which driver caused me to be unable to boot. Is there a place I should be looking for the "results" of DV? Would it have recorded info about those crashes that is not a standard BSOD crash dump?