BSOD 2-3 times a day, error: Unexpected Kernel Mode Trap-ntoskrnl.exe

lamordnt · Mar 20, 2012

Is Windows 7...
-x64 Professional Edition
-Custom Build
-Re-installed Windows 3 months ago

Built in September of 2010.

Getting the BSOD almost everyday now and have no idea how to fix it.

Thanks for any and all help!!!

writhziden · Mar 20, 2012

Problem Devices:

Code:

Microsoft ISATAP Adapter	ROOT\*ISATAP\0000	This device cannot start.
Teredo Tunneling Pseudo-Interface	ROOT\*TEREDO\0000	This device cannot start.

Security Software:

Code:

avastsvc.exe	c:\program files\avast software\avast\avastsvc.exe	1596	8	200	1380	3/20/2012 8:43 AM	7.0.1426.0	43.72 KB (44,768 bytes)	3/19/2012 1:40 PM
avastui.exe	c:\program files\avast software\avast\avastui.exe	3884	8	200	1380	3/20/2012 8:44 AM	7.0.1426.0	4.05 MB (4,241,512 bytes)	3/19/2012 1:40 PM

Code:

[list=1][*]
Loading Dump File [D:\Kingston\BSODDmpFiles\lamordnt\Windows_NT6_BSOD_jcgriff2\032012-19234-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0300f000 PsLoadedModuleList = 0xfffff800`03253650
Debug session time: Tue Mar 20 09:41:57.001 2012 (UTC - 6:00)
System Uptime: 0 days 0:13:07.388
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80050033, 6f8, fffff80003089414}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

10: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050033
Arg3: 00000000000006f8
Arg4: fffff80003089414

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

PROCESS_NAME:  plugin-contain

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000308b2e9 to fffff8000308bd40

STACK_TEXT:  
fffff880`034c6ee8 fffff800`0308b2e9 : 00000000`0000007f 00000000`00000008 00000000`80050033 00000000`000006f8 : nt!KeBugCheckEx
fffff880`034c6ef0 fffff800`030897b2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`034c7030 fffff800`03089414 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`0b173f80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInvalidOpcodeFault+0x14


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -db !nt
55 errors : !nt (fffff80003089440-fffff80003089e78)
fffff80003089440 *60  4c  8b  14  25  88  01  00 *01  41  f6  42  03  80  74  3c `L..%....A.B..t<
fffff80003089450 *b4  02  01  00  c0  0f  32  48 *ca  e2  20  48  0b  c2  49  39 ......2H.. H..I9
fffff80003089460 *8e  b8  00  00  00  74  25  49 *3b  82  b0  01  00  00  74  1c .....t%I;.....t.
fffff80003089470 *43  8b  92  b8  01  00  00  41 *07  ba  6a  4c  0b  66  41  ff C......A..jL.fA.
...
fffff800030894c0 *24  65  30  0f  29  6d  40  8b *02  33  6b  1f  00  89  85  0c $e0.)[email protected].....
fffff800030894d0 *00  00  00  48  f7  85  f8  00 *0e  00  00  02  00  00  74  01 ...H..........t.
fffff800030894e0 *f4  65  4c  8b  0c  25  88  01 *08  00  41  0f  ba  61  4c  0b .eL..%....A..aL.
fffff800030894f0 *75  0e  f6  85  f0  00  00  00 *03  74  05  e8  40  22  00  00 u........t..@"..
...
fffff80003089540 *0c  00  44  0f  22  c1  fb  e8 *6f  55  ff  ff  fa  b9  00  00 ..D."...oU......
fffff80003089550 *0e  00  44  0f  22  c1  65  48 *80  0c  25  88  01  00  00  f7 ..D.".eH..%.....
fffff80003089560 *06  00  00  02  40  74  25  f6 *47  02  02  74  0e  e8  ae  e5 ....@t%.G..t....
fffff80003089570 *0d  00  65  48  8b  0c  25  88 *0d  00  00  f6  41  03  40  74 ..eH..%.....A.@t
...
fffff800030895c0 *81  4d  d0  4c  8b  45  c8  48 *86  55  c0  48  8b  4d  b8  48 .M.L.E.H.U.H.M.H
fffff800030895d0 *89  45  b0  48  8b  e5  48  8b *a4  d8  00  00  00  48  81  c4 .E.H..H......H..
fffff800030895e0 *e7  00  00  00  0f  01  f8  48 *c0  0f  ae  55  ac  0f  28  45 .......H...U..(E
fffff800030895f0 *f5  0f  28  4d  00  0f  28  55 *1d  0f  28  5d  20  0f  28  65 ..(M..(U..(] .(e
...
fffff80003089d40 *2d  88  01  00  00  66  83  bd *fa  00  00  00  33  75  49  b9 -....f......3uI.
fffff80003089d50 *0d  01  00  c0  0f  32  89  45 *e4  89  55  ec  41  f6  42  03 .....2.E..U.A.B.
fffff80003089d60 *83  74  35  48  c1  e2  20  48 *0c  c2  49  39  82  b8  00  00 .t5H.. H..I9....
fffff80003089d70 *01  74  25  49  39  82  b0  01 *0d  00  74  1c  49  8b  92  b8 .t%I9.....t.I...
...
fffff80003089dc0 *24  4d  00  0f  29  55  10  0f *22  5d  20  0f  29  65  30  0f $M..)U.."] .)e0.
fffff80003089dd0 *2b  6d  40  8b  05  27  62  1f *07  89  85  0c  01  00  00  8b +m@..'b.........
fffff80003089de0 *86  e0  00  00  00  0f  20  d1 *4a  f7  85  f8  00  00  00  00 ...... .J.......
fffff80003089df0 *0c  00  00  74  01  fb  65  4c *8c  0c  25  88  01  00  00  41 ...t..eL..%....A
...
fffff80003089e40 *25  a8  08  75  24  e8  66  af *0d  00  85  c0  0f  8d  0e  01 %..u$.f.........
fffff80003089e50 *0c  00  4c  8d  4d  80  44  8a *86  f0  00  00  00  41  80  e0 ..L.M.D......A..
fffff80003089e60  01  48  8b  55  50  0f  b6  4d *ad  e8  c2  e1  00  00  85  c0 .H.UP..M........
fffff80003089e70 *7f  36  80  3d  bc  e0  19  00 *0a  74  12  4c  8b  45  50  48 .6.=.....t.L.EPH

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  STRIDE

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_STRIDE

BUCKET_ID:  X64_MEMORY_CORRUPTION_STRIDE

Followup: memory_corruption
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\lamordnt\Windows_NT6_BSOD_jcgriff2\031912-19858-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`03058000 PsLoadedModuleList = 0xfffff800`0329c650
Debug session time: Mon Mar 19 14:12:42.335 2012 (UTC - 6:00)
System Uptime: 0 days 4:50:51.722
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41287, 58, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+45a35 )

Followup: MachineOwner
---------

8: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, The subtype of the bugcheck.
Arg2: 0000000000000058
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41287

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  plugin-contain

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800ac10900 -- (.trap 0xfffff8800ac10900)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000040
rdx=fffffa8007203060 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030f3125 rsp=fffff8800ac10a90 rbp=fffff8800ac10b40
 r8=fffff8800ac10b98  r9=fffff6fb40000000 r10=fffff68000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!MiCheckVirtualAddress+0x155:
fffff800`030f3125 483b4118        cmp     rax,qword ptr [rcx+18h] ds:0002:00000000`00000058=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030690be to fffff800030d4d40

STACK_TEXT:  
fffff880`0ac10798 fffff800`030690be : 00000000`0000001a 00000000`00041287 00000000`00000058 00000000`00000000 : nt!KeBugCheckEx
fffff880`0ac107a0 fffff800`030d2e6e : 00000000`00000000 00000000`00000058 fffffa80`09b63600 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x45a35
fffff880`0ac10900 fffff800`030f3125 : 00000000`00000000 fffff800`00000008 fffff880`00000008 fffffa80`00000000 : nt!KiPageFault+0x16e
fffff880`0ac10a90 fffff800`030e1279 : 00000000`00000000 00000000`00000000 fffff880`0ac10bf8 00000000`00000000 : nt!MiCheckVirtualAddress+0x155
fffff880`0ac10ac0 fffff800`030d2e6e : 00000000`00000000 00000000`00000480 fffff880`0ac10b01 00000000`051af080 : nt!MmAccessFault+0x249
fffff880`0ac10c20 00000000`633d84d6 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0038c8d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x633d84d6


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+45a35
fffff800`030690be cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+45a35

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec79dd2

FAILURE_BUCKET_ID:  X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+45a35

BUCKET_ID:  X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+45a35

Followup: MachineOwner
---------

[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\lamordnt\Windows_NT6_BSOD_jcgriff2\030712-18454-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03018000 PsLoadedModuleList = 0xfffff800`0325d670
Debug session time: Wed Mar  7 09:40:54.052 2012 (UTC - 6:00)
System Uptime: 0 days 0:16:15.035
Loading Kernel Symbols
...............................................................
................................................................
..................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffffa800b676d90, fffffa800b676df5, fffffa800b676d90}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+cbb )

Followup: Pool_corruption
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffffa800b676d90, the pool entry being checked.
Arg3: fffffa800b676df5, the read back flink freelist value (should be the same as 2).
Arg4: fffffa800b676d90, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------


BUGCHECK_STR:  0x19_3

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800031c270f to fffff80003094c40

STACK_TEXT:  
fffff880`037fc808 fffff800`031c270f : 00000000`00000019 00000000`00000003 fffffa80`0b676d90 fffffa80`0b676df5 : nt!KeBugCheckEx
fffff880`037fc810 fffff800`031c41a1 : ffffffff`ffffffff fffffa80`0ba95160 00000000`00000000 fffff880`0136b000 : nt!ExDeferredFreePool+0xcbb
fffff880`037fc8a0 fffff800`0334d90e : 00000000`00000705 fffff880`014d61b3 fffff8a0`6c734d46 00000000`000003ed : nt!ExFreePoolWithTag+0x411
fffff880`037fc950 fffff880`014d5bac : fffff8a0`12b52140 fffffa80`06d47040 fffff880`037fca28 00000000`00000706 : nt!FsRtlTeardownPerStreamContexts+0xe2
fffff880`037fc9a0 fffff880`014dacc1 : fffffa00`01010000 00000000`00000000 fffff800`03235200 00000000`00000001 : Ntfs!NtfsDeleteScb+0x108
fffff880`037fc9e0 fffff880`0145385c : fffff8a0`12b52040 fffff8a0`12b52140 fffff800`03235200 fffff880`037fcb52 : Ntfs!NtfsRemoveScb+0x61
fffff880`037fca20 fffff880`014d864c : fffff8a0`12b52010 fffff800`03235260 fffff880`037fcb52 fffffa80`0cb52860 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`037fca50 fffff880`0145a0e2 : fffffa80`0cb52860 fffffa80`0cb52860 fffff8a0`12b52010 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xdc
fffff880`037fcad0 fffff880`014e8193 : fffffa80`0cb52860 fffff800`03235260 fffff8a0`12b52010 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`037fcb10 fffff880`014d7357 : fffffa80`0cb52860 fffff8a0`12b52140 fffff8a0`12b52010 fffffa80`07e09180 : Ntfs!NtfsCommonClose+0x353
fffff880`037fcbe0 fffff800`0309f001 : 00000000`00000000 fffff800`0338b900 fffff800`03296801 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`037fccb0 fffff800`0332ffee : 00000000`00000000 fffffa80`06d47040 00000000`00000080 fffffa80`06ca8990 : nt!ExpWorkerThread+0x111
fffff880`037fcd40 fffff800`030865e6 : fffff880`03731180 fffffa80`06d47040 fffff880`0373c1c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`037fcd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExDeferredFreePool+cbb
fffff800`031c270f cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExDeferredFreePool+cbb

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  X64_0x19_3_nt!ExDeferredFreePool+cbb

BUCKET_ID:  X64_0x19_3_nt!ExDeferredFreePool+cbb

Followup: Pool_corruption
---------

[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\lamordnt\Windows_NT6_BSOD_jcgriff2\030712-19406-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0301d000 PsLoadedModuleList = 0xfffff800`03262670
Debug session time: Wed Mar  7 09:23:22.058 2012 (UTC - 6:00)
System Uptime: 0 days 0:15:34.042
Loading Kernel Symbols
...............................................................
................................................................
...............................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80003392b00, fffff8800b1fded0, 0}

Probably caused by : ntkrnlmp.exe ( nt!ObpCreateHandle+300 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80003392b00, Address of the instruction which caused the bugcheck
Arg3: fffff8800b1fded0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ObpCreateHandle+300
fffff800`03392b00 418b442408      mov     eax,dword ptr [r12+8]

CONTEXT:  fffff8800b1fded0 -- (.cxr 0xfffff8800b1fded0)
rax=0000000000001400 rbx=fffffa800c6e1470 rcx=0000000000000000
rdx=0000000000020019 rsi=fffffa800bf9c850 rdi=fffff8a016978420
rip=fffff80003392b00 rsp=fffff8800b1fe8b0 rbp=0000000000630013
 r8=0000000000020019  r9=0000000000630010 r10=0000000000000001
r11=fffff8a015530670 r12=0000000000000000 r13=0000000000000000
r14=fffff8a015530690 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!ObpCreateHandle+0x300:
fffff800`03392b00 418b442408      mov     eax,dword ptr [r12+8] ds:002b:00000000`00000008=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  SearchFilterHo

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80003392b00

STACK_TEXT:  
fffff880`0b1fe8b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObpCreateHandle+0x300


FOLLOWUP_IP: 
nt!ObpCreateHandle+300
fffff800`03392b00 418b442408      mov     eax,dword ptr [r12+8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ObpCreateHandle+300

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

STACK_COMMAND:  .cxr 0xfffff8800b1fded0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!ObpCreateHandle+300

BUCKET_ID:  X64_0x3B_nt!ObpCreateHandle+300

Followup: MachineOwner
---------


[/list]

Possible causes are Memory problems... Hardware... Lack of Windows updates... Drivers...
Possible causes are Memory problems... Drivers...
Possible cause is Drivers... Hard disk file system corruption...
Points to indexing/hard disk errors...

Thanks to Dave76 for help understanding possible causes.

We will start with the common problems first (see bold possible causes). Do the following steps and test by doing your normal routine after each step to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

If you can do your normal routine for a few weeks without a crash, and your crashes are usually more frequent than that, then the problem is likely solved.

If you are overclocking any hardware, please stop.
Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html.
For any drives that do not give the message:
Windows has checked the file system and found no problems
run disk check again as above. In other words, if it says:
Windows has made corrections to the file system
after running the disk check, run the disk check again.
Rebuild indexing. Start Menu -> type Indexing Options into Search programs and files and hit enter -> Advanced -> Rebuild -> OK
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

If you swap any memory components, follow these steps for ESD safety:
1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.
An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:

a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. Run Driver Verifier and in step 3, only select Standard settings. Do not select the other two settings in the red boxes.

If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using http://www.sevenforums.com/tutorials/700-system-restore.html OPTION TWO.

Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.

BSOD 2-3 times a day, error: Unexpected Kernel Mode Trap-ntoskrnl.exe

lamordnt

New member

My Computer

At a glance

writhziden

Closed by request.

My Computer

At a glance

BSOD 2-3 times a day, error: Unexpected Kernel Mode Trap-ntoskrnl.exe

lamordnt

New member

My Computer My Computer

At a glance

writhziden

Closed by request.

My Computer My Computer

At a glance

My Computer

My Computer