BSOD error 0x00000109

[MusicMan13]

For about the past week, I've been getting this blue screen within about 30-40 minutes of turning my computer on. Works fine in safe mode, but on a normal boot it's consistently crashing with this same error every time. I've attempted to follow various other threads of users who had similar issues, but I'm afraid I need some personalized guidance. Any and all help greatly appreciated.

Oh right, and it's being caused by ntoskrnl.exe

Side-note: I had been unable to install any Windows Updates (or even run the Windows Update program) for over a year. After this issue began and I started trying to fix things, I narrowed it down to the fact that my BITS service could not start. I found someone with a similar issue and it works great now. I was able to install all but about 4 or so (which was roughly 90 updates!) For some reason there are a few updates that either won't install in the first place (error 800B0100) or will download and install and then fail to configure after restarting and therefore revert back to before the update.

 

[Arc]

Your crash dumps are not showing any finite probable cause.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If memtest comes free from errors, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any. Post it following the Blue Screen of Death (BSOD) Posting Instructions.

** DO IT FIRST: Also, Daemon Tools, Alcohol 120% and Power Archiver Pro uses SCSI Pass Through Direct (SPTD), which is a well known BSOD causer. Uninstall Daemon Tools at first. Then download SPTD standalone installer from Disk-Tools.com, and execute the downloaded file as guided below :

• Double click to open it.
• Click this button only:
• 
• If it is grayed out, as in the picture, there is no more SPTD in your system, and you just close the window.

__________________________________________________________________________________
BSOD ANALYSIS:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d897612793, b3b7465ee9df6565, fffff80000b96bb0, 6}

*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Probably caused by : ntoskrnl.exe ( nt_fffff80000b95000+1bb0 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
[COLOR=Red]1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
[/COLOR]2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.[COLOR=Red]
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.[/COLOR]
Arguments:
Arg1: a3a039d897612793, Reserved
Arg2: b3b7465ee9df6565, Reserved
Arg3: fffff80000b96bb0, Failure type dependent information
Arg4: 0000000000000006, Type of corrupted region, can be
    0 : A generic data region
    1 : Modification of a function or .pdata
    2 : A processor IDT
    3 : A processor GDT
    4 : Type 1 process list corruption
    5 : Type 2 process list corruption
    6 : Debug routine modification
    7 : Critical MSR modification

Debugging Details:
------------------


FAULTING_IP: 
nt_fffff80000b95000+1bb0
fffff800`00b96bb0 48895c2408      mov     qword ptr [rsp+8],rbx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x109

PROCESS_NAME:  System

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`03bbd5d8 00000000`00000000 : 00000000`00000109 a3a039d8`97612793 b3b7465e`e9df6565 fffff800`00b96bb0 : nt!KeBugCheckEx


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt_fffff80000b95000+1bb0
fffff800`00b96bb0 48895c2408      mov     qword ptr [rsp+8],rbx

SYMBOL_NAME:  nt_fffff80000b95000+1bb0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt_fffff80000b95000

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5149a99c

FAILURE_BUCKET_ID:  X64_0x109_6_nt_fffff80000b95000+1bb0

BUCKET_ID:  X64_0x109_6_nt_fffff80000b95000+1bb0

Followup: MachineOwner
---------

 

[MusicMan13]

Alright, so I ran Memtest86+ overnight (ran through 10 passes) and at the end there were no errors found.

I uninstalled Daemon Tools and there is no more SPTD on my system.

I'm about to run Driver Verifier. I'll post back with the results.

 

[MusicMan13]

Ran the Driver Verifier as instructed in the linked thread and the computer booted fine and ran (albeit slowly, as expected) for about half an hour before crashing again to the same crash error as usual. The BSOD sat at "Initializing disk for crash dump..." for over half an hour but wouldn't proceed, so there's no crash dump file to look at.

Interesting to note, when viewing the list of drivers via Driver Verifier, I noticed there are two identical ntoskrnl.exe drivers listed (which of course weren't being tested in that run because they're Microsoft Corp. drivers). I'm guessing this isn't normal?

I ran the Driver Verifier with just these two checked which caused my computer to crash on boot up every time.

 

[Arc]

That is the system kernel. It should not be selected while applying DV, otherwise it will BSOD instantly as you experienced. But the double version of it is kinda odd. For making it sure, Scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

 

[MusicMan13]

Does it matter if I scan my system in Safe Mode vs. normal boot? Because it won't get through a full scan before crashing if it's not in Safe Mode.

I'm gonna assume not. I got the following with TDSSKiller.

 

[Arc]

Run the TDSSkiller scan in normal mode. WDO scans it from outside windows.

If you want to scan with MBAM, use that in Safe Mode.

 

[MusicMan13]

Ahh, okay. I can run it again in normal mode.

 

[MusicMan13]

When I ran it in safe mode I got 2 threats (see edited post above).

I ran TDSSKiller again in normal mode and it found 0 threats.

About to run WDO now.

 

[Arc]

Whatever, delete both of them.

Then run it one more time, to make it sure that there is no more threats.

 

[MusicMan13]

Check. Ran it again, no more threats. Burning a WDO disc now.

 

[Arc]

Both the threats are subject to cause BSODs.

 

[MusicMan13]

Good to know! Thanks!

Currently still waiting for WDO to download the files to burn. It's taking a little while, so I'm holding my breath and hoping it doesn't crash in the middle of burning the disc.

 

[MusicMan13]

Ooo! Duplicate ntoskrnl.exe is gone!

 

[Arc]

May be there are some more good news waiting .... in my best guess.

 

[MusicMan13]

Should I still run WDO? Or should I just let my computer run for a while and see if it crashes again or if we perhaps already fixed it?

 

[MusicMan13]

I don't want to jinx anything, but it's been running in normal mode for about an hour which is longer than it's done since this started happening. I'll post later letting you know if I've had any more BSODs or not.

 

[MusicMan13]

I've been working on my computer since my last post, and I now believe it's safe to say...I'm BSOD-free! Thank you so much!

 

[Arc]

That's what I meant to say as "some more good news waiting"

Inform us after a couple of days ... it will be nice