BSOD - ntoskrnl.exe

[James Park]

UPDATE: Please read my most recent reply

Hello, I've been doing some research on this issue. It appears that others have trouble with the BSOD regarding ntoskrnl.exe. I used a tool called "BlueScreenView". It basically gives me a summary of all computer crashes. With an exception of a few, ntoskrnl.exe has been the primary cause of my BSOD. My laptop has crashed before, but today has been very frustrating while my computer hit BSOD 9 times and counting! I followed the instructions from the sticky and included a .ZIP file of BSOD's data so it can be analysed.

HP dv8t-1200 - Windows 7 Ultimate 64-bit

Windows 7 64-bit Home Edition - Preinstalled
I did a clean install*

Hardware is less than a year old.
OS is less than 3 months old.
Intel i5
6GB Ram


Help would be appreciated! Thanks!

Also if it would be of anymore help, I could set up a remote desktop session using programs: Mikogo or Team Viewer and communicate over Skype.

 

[yowanvista]

The dmp(s) point to ntoskrnl.exe as the probable cause. We know this is not the case, as these are core OS files, and will definitely not cause a BSOD. They are just the default files the debuggers blame when they can't see a better cause. We need to run driver verifier to pinpoint the faulting driver...

- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.

Then if it blue screens again upload the contents of C:\Windows\Minidump



http://www.kaspersky.com/productupdates

 

[DeanP]

ntoskrnl.exe is a file used in Windows, I don't really think that may cause the problem.
While the BSOD Team is analyzing your dump files, here's some things you should do.
---------------------------------------
Uninstall your current anti-virus software and replace it with Microsoft Security Essentials (it's free and easy to use).

Do chkdsk /f and sfc /scannow in command prompt for corrupt files/damaged/missing files.

Update all of your drivers to the latest.

Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads
You can use MagicDisc as an alternative.

If you recently installed software, uninstall it or use system restore if you have problems uninstalling it. Software can conflict with the system because of incompatibility or other reasons and cause errors or BSODs.

EDIT: Typed a little bit slow, ignore some bits.

 

[yowanvista]

ntoskrnl.exe is a file used in Windows, I don't really think that may cause the problem.
While the BSOD Team is analyzing your dump files, here's some things you should do.
---------------------------------------
Uninstall your current anti-virus software and replace it with Microsoft Security Essentials (it's free and easy to use).

Do chkdsk /f and sfc /scannow in command prompt for corrupt files/damaged/missing files.

Update all of your drivers to the latest.

Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads
You can use MagicDisc as an alternative.

If you recently installed software, uninstall it or use system restore if you have problems uninstalling it. Software can conflict with the system because of incompatibility or other reasons and cause errors or BSODs.

EDIT: Typed a little bit slow, ignore some bits.

The posted doesn't have any sptd.sys in the dumps

 

[DeanP]

Quote: Originally Posted by DeanP
ntoskrnl.exe is a file used in Windows, I don't really think that may cause the problem.
While the BSOD Team is analyzing your dump files, here's some things you should do.
---------------------------------------
Uninstall your current anti-virus software and replace it with Microsoft Security Essentials (it's free and easy to use).

Do chkdsk /f and sfc /scannow in command prompt for corrupt files/damaged/missing files.

Update all of your drivers to the latest.
Quote:
Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads
You can use MagicDisc as an alternative.


If you recently installed software, uninstall it or use system restore if you have problems uninstalling it. Software can conflict with the system because of incompatibility or other reasons and cause errors or BSODs.

EDIT: Typed a little bit slow, ignore some bits.


The posted doesn't have any sptd.sys in the dumps

How can you and the BSOD Team analyze the crash dumps? I try to analyze my crash dumps with WinDBG and BlueScreenViewer, doesn't work well.

It end up saying that the driver was caused by a file to do with Windows, not by software. (ie. win32k.sys, csrss.exe)

 

[James Park]

Alright guys thanks for the input. I'll let you know when BSOD appears again.

My security system is ZoneAlarm Extreme. It's my Firewall/Anti-Virus/Anti-Spyware.

 

[James Park]

The dmp(s) point to ntoskrnl.exe as the probable cause. We know this is not the case, as these are core OS files, and will definitely not cause a BSOD. They are just the default files the debuggers blame when they can't see a better cause. We need to run driver verifier to pinpoint the faulting driver...

- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.

Then if it blue screens again upload the contents of C:\Windows\Minidump



http://www.kaspersky.com/productupdates

So basically what I have to do is start up the Driver Verier and use my computer until it crashes? And when it does, send the BSOD Team another crash file?

 

[yowanvista]

The dmp(s) point to ntoskrnl.exe as the probable cause. We know this is not the case, as these are core OS files, and will definitely not cause a BSOD. They are just the default files the debuggers blame when they can't see a better cause. We need to run driver verifier to pinpoint the faulting driver...

- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.

Then if it blue screens again upload the contents of C:\Windows\Minidump

So basically what I have to do is start up the Driver Verier and use my computer until it crashes? And when it does, send the BSOD Team another crash file?

Yes this is what you have to do

 

[James Park]

The dmp(s) point to ntoskrnl.exe as the probable cause. We know this is not the case, as these are core OS files, and will definitely not cause a BSOD. They are just the default files the debuggers blame when they can't see a better cause. We need to run driver verifier to pinpoint the faulting driver...

- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.

Then if it blue screens again upload the contents of C:\Windows\Minidump

So basically what I have to do is start up the Driver Verier and use my computer until it crashes? And when it does, send the BSOD Team another crash file?

Yes this is what you have to do

I noticed that a lot of people are having the same problem regarding ntoskrnl.exe. What exactly is it and why is it so hard to just point to a specific cause?

 

[James Park]

Ok, I'm still having trouble with the BSOD. It hasn't happened 10 times in a day like before, but it's been happening every other day. It feels entirely random as I cannot pinpoint what software or program might be causing this. I followed all the directions the first time and I'm not sure what I can do! I have no viruses or spywares on my computer because I scan regularly with Zone Alarm Extreme Security. Does this have anything to do with my registry? I have no programs that "cleans" it out. Please help!

Thanks and happy holidays!

 

[DeanP]

My security system is ZoneAlarm Extreme. It's my Firewall/Anti-Virus/Anti-Spyware.

Uninstall ZoneAlarm Extreme and use Microsoft Security Essentials.
Link to MS Security Essentials - http://www.microsoft.com/security_essentials/

I noticed that a lot of people are having the same problem regarding ntoskrnl.exe. What exactly is it and why is it so hard to just point to a specific cause?

ntoskrnl.exe is a Windows .exe file and it's not the definite cause of BSOD.

Ok, I'm still having trouble with the BSOD. It hasn't happened 10 times in a day like before, but it's been happening every other day. It feels entirely random as I cannot pinpoint what software or program might be causing this. I followed all the directions the first time and I'm not sure what I can do! I have no viruses or spywares on my computer because I scan regularly with Zone Alarm Extreme Security. Does this have anything to do with my registry? I have no programs that "cleans" it out. Please help!

Thanks and happy holidays!

Once you have turned on Driver Verifier as yowanvista requested. Get a BSOD after Driver Verifier is on and then turn it off. Upload the dumps after turning off Driver Verifier.

If you cannot access in Windows Mode to turn off Driver Verifier - use Safe Mode.

 

[reventon]

Hi,

The cause is clear here:

[font=lucida console]
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

[COLOR=Blue][B]DRIVER_VERIFIER_DETECTED_VIOLATION[/B][/COLOR] (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
    the operating system. The only supported way to extend a kernel
    mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000002
Arg3: fffff8000300bc40
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_91

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002ed824a to fffff80002e83740

STACK_TEXT:  
fffff800`04508018 fffff800`02ed824a : 00000000`000000c4 00000000`00000091 00000000`00000002 fffff800`0300bc40 : nt!KeBugCheckEx
fffff800`04508020 fffff800`02e23569 : 00000000`00000000 00000000`00000000 00000000`00000002 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4904
fffff800`04508060 fffff800`02e2394d : fffff800`04508000 fffff800`0450e000 00000000`00000000 00000000`00000000 : nt!RtlEnoughStackSpaceForStackCapture+0x15
fffff800`04508090 fffff800`02f46c2b : 00000000`00000001 fffffa80`0760c910 fffff800`045081c0 00000000`00000000 : nt!RtlWalkFrameChain+0x59
fffff800`045080c0 fffff880`04463264 : fffffa80`0760c900 fffff880`044b6110 00000000`00000002 00000000`00000000 : nt!RtlCaptureStackBackTrace+0x4b
fffff800`045080f0 fffffa80`0760c900 : fffff880`044b6110 00000000`00000002 00000000`00000000 00000000`00000000 : vsdatant+0x11264
fffff800`045080f8 fffff880`044b6110 : 00000000`00000002 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffffa80`0760c900
fffff800`04508100 00000000`00000002 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : vsdatant+0x64110
fffff800`04508108 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x2


STACK_COMMAND:  kb

FOLLOWUP_IP: 
vsdatant+11264
fffff880`04463264 ??              ???

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  vsdatant+11264

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vsdatant

IMAGE_NAME:  [COLOR=Red][B]vsdatant.sys[/B][/COLOR]

DEBUG_FLR_IMAGE_TIMESTAMP:  4bdf0b8a

FAILURE_BUCKET_ID:  X64_0xc4_91_vsdatant+11264

BUCKET_ID:  X64_0xc4_91_vsdatant+11264

Followup: MachineOwner
---------
[/font]

The Driver Verifier detected a violation in Zone Alarm's driver. Therefore ZA needs to be removed:

Zone Alarm Removal tool -> http://download.zonealarm.com/bin/free/support/cpes_clean.exe (run in Safe Mode without Networking)

Then reset the Windows Firewall to its default settings -
START -> type cmd.exe -> right-click -> run as administrator -> type netsh advfirewall reset press enter

I think you will find that doing so will solve all your problems.

 

[James Park]

Hi,

The cause is clear here:

[font=lucida console]
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

[COLOR=Blue][B]DRIVER_VERIFIER_DETECTED_VIOLATION[/B][/COLOR] (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
    the operating system. The only supported way to extend a kernel
    mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000002
Arg3: fffff8000300bc40
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_91

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002ed824a to fffff80002e83740

STACK_TEXT:  
fffff800`04508018 fffff800`02ed824a : 00000000`000000c4 00000000`00000091 00000000`00000002 fffff800`0300bc40 : nt!KeBugCheckEx
fffff800`04508020 fffff800`02e23569 : 00000000`00000000 00000000`00000000 00000000`00000002 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4904
fffff800`04508060 fffff800`02e2394d : fffff800`04508000 fffff800`0450e000 00000000`00000000 00000000`00000000 : nt!RtlEnoughStackSpaceForStackCapture+0x15
fffff800`04508090 fffff800`02f46c2b : 00000000`00000001 fffffa80`0760c910 fffff800`045081c0 00000000`00000000 : nt!RtlWalkFrameChain+0x59
fffff800`045080c0 fffff880`04463264 : fffffa80`0760c900 fffff880`044b6110 00000000`00000002 00000000`00000000 : nt!RtlCaptureStackBackTrace+0x4b
fffff800`045080f0 fffffa80`0760c900 : fffff880`044b6110 00000000`00000002 00000000`00000000 00000000`00000000 : vsdatant+0x11264
fffff800`045080f8 fffff880`044b6110 : 00000000`00000002 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffffa80`0760c900
fffff800`04508100 00000000`00000002 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : vsdatant+0x64110
fffff800`04508108 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x2


STACK_COMMAND:  kb

FOLLOWUP_IP: 
vsdatant+11264
fffff880`04463264 ??              ???

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  vsdatant+11264

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vsdatant

IMAGE_NAME:  [COLOR=Red][B]vsdatant.sys[/B][/COLOR]

DEBUG_FLR_IMAGE_TIMESTAMP:  4bdf0b8a

FAILURE_BUCKET_ID:  X64_0xc4_91_vsdatant+11264

BUCKET_ID:  X64_0xc4_91_vsdatant+11264

Followup: MachineOwner
---------
[/font]

The Driver Verifier detected a violation in Zone Alarm's driver. Therefore ZA needs to be removed:

Zone Alarm Removal tool -> http://download.zonealarm.com/bin/free/support/cpes_clean.exe (run in Safe Mode without Networking)

Then reset the Windows Firewall to its default settings -
START -> type cmd.exe -> right-click -> run as administrator -> type netsh advfirewall reset press enter

I think you will find that doing so will solve all your problems.

Thanks for the help! Am I to remove Zone Alarm Extreme Security forever or can I just download it from ZA and install it again? I rather not get another security program because I paid for a licence already.

 

[DeanP]

Uninstall forever and use MS Security Essentials. If I was you I would ask for a refund for the Zonealarm license.

Sent from my iPhone

 

[James Park]

Uninstall forever and use MS Security Essentials. If I was you I would ask for a refund for the Zonealarm license.

Sent from my iPhone

I personally never used Microsoft Security Essentials. How does it compare to other security suites like Zone Alarm, Kaspersky, Avast, ect. I'm very careful to keep my PC running without viruses/spywares and fast. I'm just a bit concerned about switching since MSE is "free" and so far most free security suites I've used in the past has huge leaks.

 

[zigzag3143]

Uninstall forever and use MS Security Essentials. If I was you I would ask for a refund for the Zonealarm license.

Sent from my iPhone

I personally never used Microsoft Security Essentials. How does it compare to other security suites like Zone Alarm, Kaspersky, Avast, ect. I'm very careful to keep my PC running without viruses/spywares and fast. I'm just a bit concerned about switching since MSE is "free" and so far most free security suites I've used in the past has huge leaks.

MSE is a decent AV app. It is substantially better than Kaspersky, Avast, Symantec, etc in terms of resources used, frequency of BSOD's and protection.


Ken J

 

[James Park]

Uninstall forever and use MS Security Essentials. If I was you I would ask for a refund for the Zonealarm license.

Sent from my iPhone

I personally never used Microsoft Security Essentials. How does it compare to other security suites like Zone Alarm, Kaspersky, Avast, ect. I'm very careful to keep my PC running without viruses/spywares and fast. I'm just a bit concerned about switching since MSE is "free" and so far most free security suites I've used in the past has huge leaks.

MSE is a decent AV app. It is substantially better than Kaspersky, Avast, Symantec, etc in terms of resources used, frequency of BSOD's and protection.


Ken J

Alright thanks! I'll take yalls word. I wonder if I could get a partial refund after using ZA for 5 months. If ZA is really what's causing the problem, their software engineers has to do some patching.

 

[DeanP]

MS Security Essentials is free, it does speed up your computer booting and does not cause a lot of BSOD.