Solved BSOD Issue ntfs ntoskrnl dxgkrnl nvlddmkm

[Revenge3223]

I have for the last 6 months been dealing with this issue. for the last 5 months it was every 2 or 3 weeks maybe if that before one would occur, and i would not care much. but for the last month or so, it has been 2 or so a day.. and im only on the PC for 4 hours. Im getting real tired with it. I have been researching for awhile now and well..no solutions have yet to rear their head. this issue seems real complex so i will break it down for you all.

I started getting the constant bsod really bad lately, so i backed up what i needed, and cleared the hard disk. no cigar, it started happening before even re introducing the files back to the PC. I downloaded BSV (blue screen view) and here are the highlighted files: DXGKRNL.SYS NTOSKRNL.EXE NVLDDMKM.SYS NTFS.SYS; ive been looking for solution and i have nothing as of yet. i will upload all 4 DMP files for you all to view.

Other information:
the bsod happens rather, at random, once upon taking it out of sleep, 3 random, any time while not playing a video game, have never had it happen while playing a game; i play BF3 Iracing and Guild Wars 2. This PC is just turning 1 year old; Hardware: Intel I5 3.0 GHZ, Nvidia 550ti, 8GB ddr3 1333 GHZ ram, win 7, 120 MM water cooling etc....not the top end machine but not a web browser, for sure. Norton Antivirus is installed, always has, and has been great for 8 years, until apparently now if this is a virus.

 

[marsmimar]

Hello Revenge and welcome to Seven Forums.

Suggest you follow this tutorial for BSOD posting instructions. One of your problems (NVLDDMKM.SYS) is related to an Nvidia graphics card driver so the dump files would be very helpful.

http://www.sevenforums.com/bsod-help-support/96879-blue-screen-death-bsod-posting-instructions.html

Another built-in Windows 7 diagnostic tool is Driver Verifier. It runs in the background and tries to test your installed drivers. If problems are encountered it will generate a BSOD and corresponding dump file that can be analyzed.

http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

 

[Revenge3223]

sorry mars, I am quite new to this forum as you probably can tell; and a bit hasty in making a post; i attacthed the .dmp files in the orig post; here is the zip folder created from the SF program

 

[marsmimar]

Thank you for the dump files. The bugcheck analysis shows several "generic" errors (that I've highlighted in red) that usually indicate a hardware problem; more specifically, a problem with the installed memory module(s). I think that would be a good starting point.

Bug Check 0x3B: SYSTEM_SERVICE_EXCEPTION (Windows Debuggers)

Driver Reference Table - ntkrnlmp.exe

Driver Reference Table - ntoskrnl.exe

Windows Installation Encountered An Unexpected Error 0xc0000005

Driver Reference Table - win32k.sys

Driver Reference Table - cdd.dll

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

[COLOR="Red"]SYSTEM_SERVICE_EXCEPTION (3b)[/COLOR]
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8000309930b, Address of the instruction which caused the bugcheck
Arg3: fffff8800bd796b0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

BugCheck 3B, {c0000005, fffff8000309930b, fffff8800bd796b0, 0}

[COLOR="red"]Probably caused by : ntkrnlmp.exe[/COLOR] ( nt!KiInsertTimerTable+13b )

Debugging Details:
------------------

[COLOR="Red"]EXCEPTION_CODE: (NTSTATUS) 0xc0000005[/COLOR] - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KiInsertTimerTable+13b
fffff800`0309930b 488b42f8        mov     rax,qword ptr [rdx-8]

CONTEXT:  fffff8800bd796b0 -- (.cxr 0xfffff8800bd796b0)
rax=0000000000000001 rbx=fffffa800c63fc20 rcx=0000000000000001
rdx=bffff880009ed168 rsi=0000000000001de0 rdi=fffff880009e9180
rip=fffff8000309930b rsp=fffff8800bd7a080 rbp=fffff880009ed168
 r8=ffffffffffffffff  r9=00000000000000df r10=fffff880009e9180
r11=fffff880009e9100 r12=fffff880009ed168 r13=0000000000000001
r14=0000000000000000 r15=000000c4d618716f
iopl=0         nv up ei ng nz na po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010287
nt!KiInsertTimerTable+0x13b:
fffff800`0309930b 488b42f8        mov     rax,qword ptr [rdx-8] ds:002b:bffff880`009ed160=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

[COLOR="red"]BUGCHECK_STR:  0x3B[/COLOR]

PROCESS_NAME:  taskmgr.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff8000309930b

STACK_TEXT:  
fffff880`0bd7a080 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInsertTimerTable+0x13b

FOLLOWUP_IP: 
nt!KiInsertTimerTable+13b
fffff800`0309930b 488b42f8        mov     rax,qword ptr [rdx-8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KiInsertTimerTable+13b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

[COLOR="red"]IMAGE_NAME:  ntkrnlmp.exe[/COLOR]

DEBUG_FLR_IMAGE_TIMESTAMP:  5147dc36

STACK_COMMAND:  .cxr 0xfffff8800bd796b0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!KiInsertTimerTable+13b

BUCKET_ID:  X64_0x3B_nt!KiInsertTimerTable+13b

Followup: MachineOwner
---------

[COLOR="red"]*** WARNING:[/COLOR] Unable to verify timestamp for dump_iaStor.sys
[COLOR="red"]*** ERROR:[/COLOR] Module load completed but symbols could not be loaded for [COLOR="red"]dump_iaStor.sys[/COLOR]
dump_iaStor+0x3cda

fffff880`0bd78718  fffff960`006fa04e[COLOR="Red"]*** WARNING:[/COLOR] Unable to verify checksum for [COLOR="red"]cdd.dll[/COLOR]
cdd!CHwCommandBuffer::AddBitBltCommand+0x1be


fffff880`0bd78788  fffff960`0024c1dc[COLOR="red"]*** WARNING:[/COLOR] Unable to verify checksum for [COLOR="red"]win32k.sys[/COLOR]
win32k!BOUNDCLIPRGNTOSURFACE::BOUNDCLIPRGNTOSURFACE+0x22c

I'd suggest running a quick check on your machine's memory. The built-in Windows 7 memory diagnostic tool would be a good starting point but I prefer Memtest86 because it's more thorough.

http://www.sevenforums.com/tutorials/715-memory-diagnostics-tool.html

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

I'd also check for any damaged or corrupt system files by running a system file checker scan from an elevated command prompt (option two.) If problems are found, run the scan 3 times and reboot the computer immediately after each scan.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

One of the Forum experts prepared a troubleshooting guide that may also help to track down the problems. It's time consuming (several hours) but has helped many. It's best to follow the steps in the order given as each subsequent step builds on the results of the previous steps.

http://www.sevenforums.com/tutorials/220165-troubleshooting-steps-windows-7-a.html

 

[Revenge3223]

Mars, i will run the ram tests tomorrow; although i am 90% sure that they are not at fault because they are all 100% use-able; (taking all but 1 out and cycling the other in) both check out (4 gb sims, 1600 MHZ - which i haveto update on my profile; i found the hardware spreadsheet i had made and read the labels on the two sticks.) I will though as you cited to run the tests -

I ran the SFC scannow in elevated cmd prompt 3 times; no errors or integrity violations. - I feel this is a bad virus of some sort (seeing as it attacks my browsers plugins such as shockwave, java etc and pretty much terrorizes google chrome by crashing tabs etc) - which has been the biggest symptom and i apologize for leaving that one out). Having said that; i will exploit all avenues you have provided because they are all legitimate and unlike alot of places....you aren't running me in circles.

p.s. Ran the windows memory diagnostic tool; no issues at all to confirm my suspicions that it was not my ram. im off to bed tonight; i will perform the other tasks tomorrow

Sincerely,

Revenge

 

[marsmimar]

Since you suspect this may be malware related, may I suggest you try Windows Defender Offline.

http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html

This free tool performs an offline scan at boot (before Windows loads) to help identify and remove rootkits and other malicious malware. In addition, Windows Defender Offline can be used if you cannot install or start an antivirus program on your computer, or if your installed AV program can’t detect or remove malware on your computer.

Couple of important things to keep in mind:

1. The bootable CD/DVD, USB flash drive, or ISO should be created on a different computer other than the one that you suspect may be infected with malware.
2. The computer used to create the bootable media should be the same architecture (32-bit or 64-bit) as the suspected infected computer.

 

[Revenge3223]

I had my friend Ethan come over; he is an employee of a computer tech company, He ran a few programs in safe mode and well, it was maleware, it removed about 50-100 gigs of my hard drive (went from 750 free to 835 free) of a one TB drive. - This issue is solved; but it shows how this forum more than likely is just going to run you in a circle and i apologize to others that read this and i said that they did not run you in a circle, that is all that happened here, while my friend fixed it in 5 minutes.