BSDO's seems "ntoskrnl.exe" is the culprit?????

[daveleebond]

keeps getting random BSODs
used BlueScreenView on a minidump and the on red one was ntoskrnkl 7efc0.
how do I find which driver is casing this?
have attached on of the minidumps
have just ran a 6 run memtest and 0 errors.
memory is Corsair Vengeance 8GB (2x4GB)
Windows 7 x64 - all latest windows updates applied.

 

[koolkat77]

Welcome

Please upload your msinfo32.nfo file. To get this: Start Menu -> Type msinfo32 into the Search programs and files box -> When it opens, go to File, Save -> Save as msinfo32.nfo and save in a place you will remember -> Let it finish the process of gathering and saving the system info -> Right click the .nfo file, click send to compressed (zipped) folder -> Upload the .zip file here

Please upload your msinfo32.txt file. To get this: Start Menu -> Type msinfo32 into the Search programs and files box -> When it opens, go to File, Export -> Save as msinfo32.txt and save in a place you will remember -> Let it finish the process of gathering and saving the system info -> Right click the .txt file, click send to compressed (zipped) folder -> Upload the .zip file here

Please post all files following: http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

 

[daveleebond]

sorry, now attached (in same rar archive)

 

[koolkat77]

Were there any recent hardware or software changes made to your computer?

Start Menu\Programs\DAEMON Tools Pro	Public:Start Menu\Programs\DAEMON Tools Pro	Public

Please uninstall DAEMON Tools. It uses a driver called sptd.sys which is known to cause BSODs in Windows 7. Uninstall the software using Add/Remove Programs. Reboot the system. Once the program is uninstalled, run sptd.sys uninstaller to remove the driver from your system.

As an alternative, many people recommend the use of Total Mounter or Magic ISO

*How does the computer work in safe mode?​

 

[daveleebond]

safe mode fine, also ran the util to gather all the files that I should of run in the 1st place.

Have removed both items

New GFX xard installed AMD 5870->7870 but was occurring before that

 

[koolkat77]

Thanks for all the files.

ISSUES:

1. Acronis

Start Menu\Programs\Acronis\True Image	Public:Start Menu\Programs\Acronis\True Image	Public
Start Menu\Programs\Acronis\True Image\Tools and Utilities	Public:Start Menu\Programs\Acronis\True Image\Tools and Utilities	Public
Start Menu\Programs\Acronis\True Image 2013 Plus Pack	Public:Start Menu\Programs\Acronis\True Image 2013 Plus Pack	Public

Caught causing BSOD-s for you. I would suggest you to uninstall it for the time being and see if the system is stable. Use the free version of Revo Uninstaller to uninstall. (Uninstall using Advanced mode)

□ Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems​

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck DE, {2, fffff8a00faebaf8, fffff8200faebaf9, 138fe68c0}

*** WARNING: Unable to verify timestamp for tdrpman.sys
*** ERROR: Module load completed but symbols could not be loaded for tdrpman.sys
Probably caused by : tdrpman.sys ( tdrpman+b3a60 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

POOL_CORRUPTION_IN_FILE_AREA (de)
A driver corrupted pool memory used for holding pages destined for disk.
This was discovered by the memory manager when dereferencing the file.
Arguments:
Arg1: 0000000000000002
Arg2: fffff8a00faebaf8
Arg3: fffff8200faebaf9
Arg4: 0000000138fe68c0

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xDE

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff8000224a4bd to fffff80002298fc0

STACK_TEXT:  
fffff880`121f1c78 fffff800`0224a4bd : 00000000`000000de 00000000`00000002 fffff8a0`0faebaf8 fffff820`0faebaf9 : nt!KeBugCheckEx
fffff880`121f1c80 fffff800`02266c52 : 00000000`00000000 fffffa80`09633e00 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x2c8d1
fffff880`121f1d70 fffff880`0129153f : fffffa80`07f82e18 00000000`00000000 fffff8a0`00000000 00000000`00000000 : nt!CcPurgeCacheSection+0x172
fffff880`121f1de0 fffff880`012b20c3 : fffff880`121f2650 fffff8a0`031ff010 fffff8a0`0bd29bc0 fffff880`121f20e8 : Ntfs!NtfsDeleteFile+0x57b
fffff880`121f2060 fffff880`01220c99 : 00000000`00000000 fffff800`022b46b8 fffff880`121f25b0 00000000`00006000 : Ntfs!NtfsCommonCleanup+0x1653
fffff880`121f2470 fffff800`022a4c48 : fffff880`121f25b0 00000000`00000001 fffffa80`0699a3b0 00000000`00000000 : Ntfs!NtfsCommonCleanupCallout+0x19
fffff880`121f24a0 fffff880`01220d12 : fffff880`01220c80 fffffa80`08e2beb0 fffff880`121f2900 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`121f2580 fffff880`012bfa94 : fffff880`121f2650 fffff880`121f2650 fffff880`121f2650 fffff880`0117dcdf : Ntfs!NtfsCommonCleanupOnNewStack+0x42
fffff880`121f25f0 fffff880`01113bcf : fffff880`121f2650 fffffa80`09630010 fffffa80`09630560 fffffa80`06f8c6d0 : Ntfs!NtfsFsdCleanup+0x144
fffff880`121f2860 fffff880`011126df : fffffa80`08bad620 00000000`00000000 fffffa80`07030d00 fffffa80`09630010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`121f28f0 fffff880`01d49a60 : 00000000`60000001 fffffa80`08d7f010 fffff8a0`00000020 fffff880`01cb416f : fltmgr!FltpDispatch+0xcf
fffff880`121f2950 00000000`60000001 : fffffa80`08d7f010 fffff8a0`00000020 fffff880`01cb416f 00000000`00000001 : tdrpman+0xb3a60
fffff880`121f2958 fffffa80`08d7f010 : fffff8a0`00000020 fffff880`01cb416f 00000000`00000001 fffff880`01d48248 : 0x60000001
fffff880`121f2960 fffff8a0`00000020 : fffff880`01cb416f 00000000`00000001 fffff880`01d48248 fffffa80`0722f760 : 0xfffffa80`08d7f010
fffff880`121f2968 fffff880`01cb416f : 00000000`00000001 fffff880`01d48248 fffffa80`0722f760 fffffa80`08d7f010 : 0xfffff8a0`00000020
fffff880`121f2970 00000000`00000001 : fffff880`01d48248 fffffa80`0722f760 fffffa80`08d7f010 00000000`60000001 : tdrpman+0x1e16f
fffff880`121f2978 fffff880`01d48248 : fffffa80`0722f760 fffffa80`08d7f010 00000000`60000001 fffffa80`09630010 : 0x1
fffff880`121f2980 fffffa80`0722f760 : fffffa80`08d7f010 00000000`60000001 fffffa80`09630010 00000000`00000000 : tdrpman+0xb2248
fffff880`121f2988 fffffa80`08d7f010 : 00000000`60000001 fffffa80`09630010 00000000`00000000 fffff880`01d489f6 : 0xfffffa80`0722f760
fffff880`121f2990 00000000`60000001 : fffffa80`09630010 00000000`00000000 fffff880`01d489f6 fffffa80`09630010 : 0xfffffa80`08d7f010
fffff880`121f2998 fffffa80`09630010 : 00000000`00000000 fffff880`01d489f6 fffffa80`09630010 fffffa80`09630010 : 0x60000001
fffff880`121f29a0 00000000`00000000 : fffff880`01d489f6 fffffa80`09630010 fffffa80`09630010 fffffa80`0722f760 : 0xfffffa80`09630010


STACK_COMMAND:  kb

FOLLOWUP_IP: 
tdrpman+b3a60
fffff880`01d49a60 ??              ???

SYMBOL_STACK_INDEX:  b

SYMBOL_NAME:  tdrpman+b3a60

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tdrpman

IMAGE_NAME:  tdrpman.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5033c542

FAILURE_BUCKET_ID:  X64_0xDE_tdrpman+b3a60

BUCKET_ID:  X64_0xDE_tdrpman+b3a60

Followup: MachineOwner
---------

2: kd> lmvm tdrpman
start             end                 module name
fffff880`01c96000 fffff880`01de0000   tdrpman  T (no symbols)           
    Loaded symbol image file: tdrpman.sys
    Image path: \SystemRoot\system32\DRIVERS\tdrpman.sys
    Image name: tdrpman.sys
    Timestamp:        Tue Aug 21 23:28:34 2012 (5033C542)
    CheckSum:         00154928
    ImageSize:        0014A000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

SUGGESTIONS:

Reduce items at start-up, Antivirus is usually what's needed:

□ http://www.sevenforums.com/tutorials/1401-startup-programs-change.html​

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

• Click on the rb:
• Type CMD on Search
• Left click and Run as Administrator
• Type SFC /scannow

Full tutorial here:

□ http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html​

Disk maintenance with Disk check for hard drive errors:

□ http://www.sevenforums.com/tutorials/433-disk-check.html​

ANTIVIRUS:

Uninstall Microsoft Security Essentials. Download and reinstall afresh and make a full scan.

OVERCLOCKING:

If you are overclocking your system, please return all overclocked components to their stock speeds. If the BSOD's are found not to be caused by the overclock, you can re-overclock the components once we have finished the diagnostics

Start Menu\Programs\MSI Kombustor 2.4	Public:Start Menu\Programs\MSI Kombustor 2.4	Public
Start Menu\Programs\MSI Afterburner	HTPC\Dave:Start Menu\Programs\MSI Afterburner	HTPC\Dave
Start Menu\Programs\MSI Afterburner\SDK	HTPC\Dave:Start Menu\Programs\MSI Afterburner\SDK	HTPC\Dave

This is overclocking software and can lead to system instability and BSOD's. Please reset all components to their stock speeds and then remove the software.
​

REINSTALL VIDEO DRIVERS; METHOD:

Click on the Start rb: ► Control Panel ► Programs ► Uninstall a program ► Uninstall everything related to; ATI and restart the system. Delete remnants of its drivers/older drivers using Driver Fusion/Sweeper

Install latest afresh from:

□ AMD Driver Autodetect​

Perform a Video Card - Stress Test with Furmark:

□ http://www.sevenforums.com/tutorials/100356-video-card-stress-test-furmark.html

Monitor your temps with Speccy during these tests:
​

□ Speccy - System Information - Free Download​

Post a screen shot of the Summary tab of speccy as well:

• http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

Post back if the system is stable or not.​

Then test RAM >
Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
​

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
​

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
​

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
​

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
​

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

:info: Errors are sometimes found after 8 passes.
:tip: Do this test overnight, before going to bed.

 

[daveleebond]

Cheers, will carry out all suggested over the weekend

 

[koolkat77]

Good luck

 

[koolkat77]

Any updates?