Solved BSOD ntoskrnl.exe 64bit

[rapstyle]

Hi all
the ram is ok, i tested with memtest and pass all test without errors
and the hd is ok, tested with the wd program
my computer:

windows 7 ultimate 64 bit
Intel Core i5-3450 3,1GHz
AsRock H77 PRO4/MVP
DDR3 Corsair Vengeance Low Profile CML8GX3M2A1600C9 1600MHz
Sapphire HD 7850
Dell U2412HM
Western Digital Caviar Blue 500GB 3.5" 7200rpm 16MB SATA3 WD5000AAKXPC XFX ProSeries 550W Core Edition

thanks

 

[koolkat77]

Welcome

Problematic software:

Start Menu\Programs\COMODO	Public:Start Menu\Programs\COMODO	Public
Start Menu\Programs\COMODO\COMODO Internet Security	Public:Start Menu\Programs\COMODO\COMODO Internet Security	Public

Comodo Internet Security contributes in blue screens. Search in Google how to uninstall it properly. Make sure all the drivers are gone. If you feel there are remnants of its drivers use Driver Sweeper to get rid of them.

Coming to what was found in the dumps

fffff880`0331b1e8  fffff880`043e9efcUnable to load image \SystemRoot\system32\DRIVERS\VirtuWDDM.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/search.php?id=VirtuWDDM.sys"]VirtuWDDM.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for VirtuWDDM.sys
 VirtuWDDM+0x3efc
-------------------
fffff880`0331b258  fffff880`05303c4fUnable to load image \SystemRoot\system32\DRIVERS\athrx.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for athrx.sys
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/search.php?id=athrx.sys"]athrx.sys[/URL]
 athrx+0x8bc4f
-------------------
fffff880`0331b4e8  fffff880`05b74fa4Unable to load image \SystemRoot\system32\DRIVERS\atikmdag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/search.php?id=atikmdag.sys"]atikmdag.sys[/URL]
 atikmdag+0xb6fa4

:note: Firewall/Antivirus programs like CIS often cause crashes with network drivers if under stress.

After you uninstalled the program I listed in the beginning, update these drivers:

1: kd> lmvm athrx
start             end                 module name
fffff880`05278000 fffff880`053ff000   athrx    T (no symbols)           
    Loaded symbol image file: athrx.sys
    Image path: \SystemRoot\system32\DRIVERS\athrx.sys
    Image name: [COLOR="Red"]athrx.sys[/COLOR]
    Timestamp:       [COLOR="red"] Thu Jan 28 07:25:39 2010 [/COLOR](4B60E793)
    CheckSum:         001852C3
    ImageSize:        00187000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Source:

• Driver Reference Table

For ATI Drivers, uninstall older first from control panel normally and use Driver Sweeper for any remnants:

1: kd> lmvm atikmdag
start             end                 module name
fffff880`05abe000 fffff880`064df000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: [COLOR="red"]atikmdag.sys[/COLOR]
    Timestamp:        [COLOR="red"]Sat Jul 28 07:48:09 2012[/COLOR] (501344D9)
    CheckSum:         009DA146
    ImageSize:        00A21000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Source:

• Driver Reference Table

VIRTU LucidInterop WDDM Driver by LucidLogix
I'd consider to uninstall this program, but if there are driver updates for it, get the latest.

1: kd> lmvm VirtuWDDM
start             end                 module name
fffff880`043e6000 fffff880`043fb000   VirtuWDDM T (no symbols)           
    Loaded symbol image file: VirtuWDDM.sys
    Image path: \SystemRoot\system32\DRIVERS\VirtuWDDM.sys
    Image name: [COLOR="red"]VirtuWDDM.sys[/COLOR]
    Timestamp:        [COLOR="red"]Sun Feb 05 17:24:50 2012[/COLOR] (4F2E6702)
    CheckSum:         0001EB45
    ImageSize:        00015000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Source:

• Driver Reference Table

Run the System File Checker that scans the the integrity of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Then run Disk Check on your hard drive for file system errors and bad sectors on it:

• http://www.sevenforums.com/tutorials/433-disk-check.html

Summary:

STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL
Usual causes:  Kernel mode driver, System Service, BIOS, Windows, 
Virus scanner, Backup tool, compatibility
BugCheck A, {fffff80000c22958, 2, 1, fffff800030a983e}
Unable to load image \SystemRoot\system32\DRIVERS\VirtuWDDM.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for VirtuWDDM.sys
*** ERROR: Module load completed but symbols could not be loaded for VirtuWDDM.sys
Unable to load image \SystemRoot\system32\DRIVERS\atikmdag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
..............................
STOP 0x000000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL
Usual causes:  Device driver
BugCheck D1, {60, 2, 8, 60}
Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )
..............................
STOP 0x000000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL
Usual causes:  Device driver
BugCheck D1, {0, 2, 8, 0}
Probably caused by : NETIO.SYS ( NETIO!RtlReturnTimerWheelEntry+45 )
..............................
STOP 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA 
Usual causes:  Defective hardware (particularly memory - but not just RAM), 
Faulty system service, Antivirus,  Device driver, NTFS corruption, BIOS
BugCheck 50, {fffffa8810a655a4, 0, fffff800030ebc00, 5}
Could not read faulting driver name
Probably caused by : cdd.dll ( cdd!PresentWorkerThread+5ec )

Hope this helps & keep us posted of further BSoDs

 

[rapstyle]

thanks koolkat77 for the reply..
I have uninstalled comodo.
Now, I have found the drivers win78-10.0.0.75-whql.zip on the atheros site to update the athrx.sys file.
In the zip there are some .inf (athw8.inf, athw8x.inf, netathr.inf, netathrx.inf), some .sys and some .cat.
Should I install any .inf file? If so, which one? Or should I just replace athrx.sys?
Thanks in advance for the help

 

[koolkat77]

thanks koolkat77 for the reply..
I have uninstalled comodo.
Now, I have found the drivers win78-10.0.0.75-whql.zip on the atheros site to update the athrx.sys file.
In the zip there are some .inf (athw8.inf, athw8x.inf, netathr.inf, netathrx.inf), some .sys and some .cat.
Should I install any .inf file? If so, which one? Or should I just replace athrx.sys?
Thanks in advance for the help

Download the .sys files and zip files if they're there.
This tutorial might help you as well,

• http://www.sevenforums.com/tutorials/97061-driver-install-device-manager.html

 

[rapstyle]

I followed the tutorial you have posted before but, after I select the drivers' directory, i get as a result: "the drivers are already updated" (I mean, it doesn't update anything) or something similar.
i'm attaching what I get when I unzip the .zip file.
i also tried installing the athw8.inf file but i get a bsod (related to athrx.sys), now I have reloaded the "recovery point".
Can you explain me in detail what i need to do?
thank you so much

 

[koolkat77]

Select the device, right click and uninstall.
Then install the downloaded driver. It is the fourth one listed.

 

[rapstyle]

Ok, now i have the wifi drivers update at 24/07/2012. And i have also update the video drivers.
which antivirus and firewall do you think are the best? microsoft security essentials is a good solution?
Thanks

 

[koolkat77]

Ok, now i have the wifi drivers update at 24/07/2012. And i have also update the video drivers.
which antivirus and firewall do you think are the best? microsoft security essentials is a good solution?
Thanks

Yes you can use Microsoft security essentials with the great combination of Malware Bytes.

• Microsoft Security Essentials - Free Antivirus for Windows
• Malwarebytes - The Free version
• http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

Run a full scan with both (separately) once downloaded, installed and updated.

 

[rapstyle]

Perfect!! Thanks for the help.
If I get other errors will let you know.
Thanks for the rapid support koolkat

 

[koolkat77]

Good luck, keep us posted

 

[rapstyle]

Another BSOD now
here the files

 

[koolkat77]

STOP 0x0000001A: MEMORY_MANAGEMENT  
Usual causes:  Device driver, memory, kernel
BugCheck 1A, {41201, fffff68000372840, 5ad000093d682005, fffffa800b126010}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+136f2 )

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html
• Guide to using Memtest86+ - Geeks to Go Forums

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.
Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.
If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
3. Test the next stick of RAM (stick #2) in the next motherboard slot.
If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

 

[rapstyle]

I have 2 ram modules and i have tested both individually on 2 of 4 slots I use the most (the second and the fourth on the right side of the cpu) and I haven't got any error.
Now I'm going to test them together but I think they will not generate any problem.
What else could it be? Have you got any idea?

 

[koolkat77]

Test it that way finally and let us know if you're getting more BSODs.

 

[rapstyle]

memtest give me 0 errors.
pc is on since this morning (6 hours) but only now it give me 3 bsod in 5 minutes.
i don't know what is the problemi in this computer.

 

[koolkat77]

I will take a look at them soon.
Did you uninstall the programs I listed in my first post? Did you make full scans with the new security programs?
Run this tool and delete anything it finds:

• Anti-rootkit utility TDSSKiller

 

[rapstyle]

yes, I unistall comodo (now I have mse and windows firewall), virtu and update the ati drivers and the network drivers.
the antirootkit find 0 threads

 

[koolkat77]

Thanks.

Time for Driver verifier, enable for 36 hours, and give me all the dumps you get with it while enabled.

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

 

[rapstyle]

ok, perfect!
Thanks for the support

 

[rapstyle]

after active Driver Verifier I reboot the computer.
Now it freeze when load the destkop.
In Safe Mode it works.