Solved All kinds of BSOD caused by ntoskrnl.exe

[Schmoerff]

Goodevening people,

I have been getting a lot of bluescreens the last week.
Only today, i've had:
- Three IRQL_NOT_LESS_OR_EQUAL screens, two caused by ntoskrnl.exe, the last one caused by avast.
- Two SYSTEM_SERVICE_EXCEPTION screens, all caused by ntoskrnl.exe
- One ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY screen, also caused by ntoskrnl.exe
- One IRQL_GT_ZERO_AT_SYSTEM_SERVICE screen, also cause by ntoskrnl.exe

I'm using Windows 7 Enterprise SP.

The latest .dmp file contained the following:

Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Maarten\Desktop\050815-9906-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18798.amd64fre.win7sp1_gdr.150316-1654
Machine Name:
Kernel base = 0xfffff800`02a4a000 PsLoadedModuleList = 0xfffff800`02c8f890
Debug session time: Fri May  8 21:58:19.352 2015 (UTC + 2:00)
System Uptime: 0 days 0:02:39.164
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
....

************* Symbol Loading Error Summary **************
Module name            Error
ntoskrnl               The system cannot find the file specified

You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002ab4945, fffff8800b21fa90, 0}

*** WARNING: Unable to verify timestamp for mssmbios.sys
*** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt+6a945 )

Followup: MachineOwner
---------

Somehow, since the crashes started, my wifi connection has gotten severely worse. I don't know if this is a related problem or something else entirely.
I hope someone could assist me, i've already replaced Avast with Security Essentials.
Regards,

 

[Arc]

Various different BSODs are there, within a short time span. Which indicates to some sort of memory issue.

Test your RAM modules for possible errors.

How to Test and Diagnose RAM Issues with Memtest86+
​

Run memtest86+ for at least 8 consecutive passes.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

Let us know the result. We have to do some further things depending on it.

 

[Schmoerff]

I have since then switched my RAM-sticks to slots 2 and 4 (from 1 and 3) and haven't had any issues for the past month. A couple of days ago, i started crashing again. I had about ten crashes within two hours. These crashes were only during intensive gaming. I also noticed my wifi connection was terrible (350 ms latency, while normally, it tends to be around 15).
I have run memtest86 twice, for four and twelve consecutive passes respectively, and haven't had any errors.

 

[Arc]

I have run memtest86 twice, for four and twelve consecutive passes respectively, and haven't had any errors.

You need to run memtest86+, not memtest86 which is an inferior program with a deceptively similar name.

And it would be the best if you can take a camera snap of the memtest86+ screen before closing memtest86+ and let us see the image.

 

[Schmoerff]

I will run memtest86+ tonight. Thanks!

 

[Arc]

Dont forget to click an image after passes are completed. That image may be informative.

 

[Schmoerff]

Well, the first errors came in within 5 minutes. Attached is a photo i took. Please Note: the test is still on its first pass and running, as of the moment of taking this picture. If the photo is not attached, my apologies. Im trying to upload this picture from my mobile phone. If nog uploaded, i will upload the image as soon as the computer has run its 8+ passes in the morning.

 

[Arc]

Stop testing now. A single error is enough.

Now follow the "Part 3: If You Have Errors:" of How to Test and Diagnose RAM Issues with Memtest86+

Errors/red lines means one or more RAM is faulty. But the fault may occur due to a faulty DIMM slot, too, which is a motherboard component. Using memtest86+, you can discriminate between a faulty RAM and a faulty motherboard.

How? Say you have two RAM sticks and two DIMM slots. You obtained errors at the test with all RAM sticks installed. Now, remove all the sticks but one. Test it in all the available slots, one by one. Continue the same procedure for all the available sticks.
How to make the inference that is it a RAM issue or it is a motherboard issue? Suppose you have got the result like that:

test|Slot1|Slot2
RAM1| Error | Error
RAM2|Good|Good

It is a RAM, a bad RAM.

But if you have got a result like that:

test|Slot1|Slot2
RAM1| Error |Good
RAM2| Error |Good

It is a motherboard issue. The particular slot is bad.

If it is a bad RAM, you need to change the RAM. Take the other existing (good) RAM to the shop and get one of the exactly same specification. The best is, get a totally new RAM KIT.

If it is a bad slot, it is a motherboard issue. But changing the motherboard needs a preparation for most of us; so dont populate that slot for the time being.

 

[Schmoerff]

I am testing with one stick now. Is this error always going to show up on test 5 on the first pass? Or does it need to do at least 8 passes if it doesnt error?

Edit: thanks for the quick response, by the way

 

[ACaetta]

Arc, would you have any time to help me? I left a post for a BOSD last Saturday night and have not heard from anyone. Derek asked for info but after I left the info he asked for I have never heard anything more. Now my post seems to be lost and forgotten. Don't know what I am supposed to do. I am new here.

 

[Arc]

I am testing with one stick now. Is this error always going to show up on test 5 on the first pass? Or does it need to do at least 8 passes if it doesnt error?

Edit: thanks for the quick response, by the way

The error may come in the first minute, and it may come after a number of passes. It cannot be said with certainty, mate.

 

[Schmoerff]

I ran the first stick of ram for 16 passes without error. Now running the second stick in the same slot, its at the 6th pass, no errors yet.

 

[Schmoerff]

I have now tested both sticks. I have testes the first stick in its original slot (slot 2, or a2 as the mobo manufacturer calls it), the second stick in slot a2 and the second stick in its original position (4th slot, or b2). None gave any errors, all tests ran 11 passes..

 

[Arc]

There are 4 RAM slots ... have you tested all the sticks in all the slots individually?

 

[Schmoerff]

I haven't, no... I kinda thought that if the first error showed up with ram inserted in a2 and b2, if it isnt the ram, the problem has to be with one of those 2 slots. My apologies.

 

[Schmoerff]

Little update: just went ahead and toon a closer look at the ram i have installed. Turns out they weren't sold as a dual channel kit. Its two sticks with the same model number though, but i read somewhere that this could still produce problems. The ram is cruciale ballistix sport 4gb. Model nr BLS4G3D1609DS1S00. Is it possible that this could be the problem? (Still testing the ram in the other slots ATM.)

 

[Arc]

I think it is dual channel when applied in a dual channel slot, like 0 and 2, 1 and 3 in your case. Still I requested my guru essenbe to have a look at your question.

 

[essenbe]

Your Motherboard manual will tell you which 2 slots the ram should be in. If you test each stick of ram in each slot, it will tell you whether the problem is the ram or the Dimm slots. A bad stick of ram will fail in every slot. A good stick of ram should pass in every slot. So, if you test 1 stick and it passes in all but 1 Dimm Slot, it should indicate to you that the Motherboard has a bad dimm slot.

 

[Schmoerff]

Thanks everybody for their input. Little update:
I have now tested one stick in all slots - without errors.
I have tested the seconden stick in two out of fout slots (the slots i have tested werd the slots i was using when my PC crashed for the last time - no errors.
I am currently testing the third slot with the seconden stick - no errors as of pass 6.
The only time i got errors was when i had both sticks insirted in dual channel.

 

[essenbe]

Are you running the sticks for 8 passes?