Solved BSOD ntoskrnl.exe

[Raleia]

Been receiving this BSOD for awhile now, it's not frequent just happens every now and then. Last time it happened was July of last year; now it's happened two times in around 3-4 weeks.

Here is the Diagnostic Tool Report in the attachment. I have also included a BlueScreenView crash.txt as well.

Now sure what's causing it and I can't seem to find a answer, so anything help would be much appreciated.
These past two times this close have happened while playing Tera, so not sure if that's linked or not.



Thank you very much.

 

[koolkat77]

Welcome to Seven Forums

Right now it looks like the cause of your BSOD is your ATI graphic driver. If you are overclocking any hardware please stop. Perform a clean install of the drivers in the following method:

Sometimes drivers remain, not completely uninstalled. Follow this tutorial for complete removal of drivers of the particular program:

• How to Clean Left Over Driver Files with Driver Sweeper

• AMD Driver Autodetect

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
Probably caused by : atikmdag.sys ( atikmdag+7aebc )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------
CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  System

CURRENT_IRQL:  2

TAG_NOT_DEFINED_c000000f:  FFFFF88002F93FB0

EXCEPTION_RECORD:  fffff88002f8c9b8 -- (.exr 0xfffff88002f8c9b8)
ExceptionAddress: fffff8800735bebc (atikmdag+0x000000000007aebc)
   ExceptionCode: c000001d (Illegal instruction)
  ExceptionFlags: 00000000
NumberParameters: 0

TRAP_FRAME:  fffff88002f8ca60 -- (.trap 0xfffff88002f8ca60)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8007cd7ec8
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800735bebc rsp=fffff88002f8cbf0 rbp=fffff88002f8cc10
 r8=0000000000000000  r9=fffff880072e1000 r10=fffff88002f8cab8
r11=fffff88002f8cbe0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
atikmdag+0x7aebc:
fffff880`0735bebc ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000328963e to fffff80003291c10

STACK_TEXT:  
fffff880`02f8ba98 fffff800`0328963e : fffffa80`070ecfa0 00000000`00000400 fffff880`02f8c210 fffff800`032bcb80 : nt!KeBugCheck
fffff880`02f8baa0 fffff800`032bc84d : fffff800`034a1368 fffff800`033de1fc fffff800`0321c000 fffff880`02f8c9b8 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`02f8bad0 fffff800`032bb625 : fffff800`033e2008 fffff880`02f8bb48 fffff880`02f8c9b8 fffff800`0321c000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`02f8bb00 fffff800`032cc5b1 : fffff880`02f8c9b8 fffff880`02f8c210 fffff880`00000000 fffffa80`00000004 : nt!RtlDispatchException+0x415
fffff880`02f8c1e0 fffff800`032912c2 : fffff880`02f8c9b8 fffffa80`07cc0000 fffff880`02f8ca60 fffffa80`07589668 : nt!KiDispatchException+0x135
fffff880`02f8c880 fffff800`0328f41f : fffff880`02f8ca60 fffff880`07364702 00000015`00000000 fffff880`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`02f8ca60 fffff880`0735bebc : fffffa80`07cc0000 fffffa80`07589668 fffffa80`075b3020 00000000`00000022 : nt!KiInvalidOpcodeFault+0x11f
fffff880`02f8cbf0 fffffa80`07cc0000 : fffffa80`07589668 fffffa80`075b3020 00000000`00000022 fffff880`02f8cc40 : atikmdag+0x7aebc
fffff880`02f8cbf8 fffffa80`07589668 : fffffa80`075b3020 00000000`00000022 fffff880`02f8cc40 fffff880`07305cf1 : 0xfffffa80`07cc0000
fffff880`02f8cc00 fffffa80`075b3020 : 00000000`00000022 fffff880`02f8cc40 fffff880`07305cf1 fffffa80`075ef340 : 0xfffffa80`07589668
fffff880`02f8cc08 00000000`00000022 : fffff880`02f8cc40 fffff880`07305cf1 fffffa80`075ef340 fffffa80`075b3020 : 0xfffffa80`075b3020
fffff880`02f8cc10 fffff880`02f8cc40 : fffff880`07305cf1 fffffa80`075ef340 fffffa80`075b3020 00000000`00000000 : 0x22
fffff880`02f8cc18 fffff880`07305cf1 : fffffa80`075ef340 fffffa80`075b3020 00000000`00000000 00000000`00000000 : 0xfffff880`02f8cc40
fffff880`02f8cc20 fffffa80`075ef340 : fffffa80`075b3020 00000000`00000000 00000000`00000000 fffff880`02f8cc70 : atikmdag+0x24cf1
fffff880`02f8cc28 fffffa80`075b3020 : 00000000`00000000 00000000`00000000 fffff880`02f8cc70 fffff880`040a9bb9 : 0xfffffa80`075ef340
fffff880`02f8cc30 00000000`00000000 : 00000000`00000000 fffff880`02f8cc70 fffff880`040a9bb9 fffffa80`07589190 : 0xfffffa80`075b3020


STACK_COMMAND:  kb

FOLLOWUP_IP: 
atikmdag+7aebc
fffff880`0735bebc ??              ???

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  atikmdag+7aebc

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME:  atikmdag.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  50d225df

FAILURE_BUCKET_ID:  X64_0x1E_atikmdag+7aebc

BUCKET_ID:  X64_0x1E_atikmdag+7aebc

Followup: MachineOwner
---------

2: kd> lmvm atikmdag
start             end                 module name
fffff880`072e1000 fffff880`07df7000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Thu Dec 20 02:38:55 2012 (50D225DF)
    CheckSum:         00AC6529
    ImageSize:        00B16000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Start Menu\Programs\Avira	Public:Start Menu\Programs\Avira	Public
Start Menu\Programs\Avira\Avira Desktop	Public:Start Menu\Programs\Avira\Avira Desktop	Public

Not the best security software, often contributes in bsods. Please remove it using its removal tool from here: Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase

Recommended from a strict BSOD perspective, compatibility & stability compared to other antiviruses/internet security software. It is free and lightweight:-

• Microsoft Security Essentials, Free antivirus for windows.
• Malwarebytes Anti-Malware Free
• Good and Free system security combination
  
  

   Warning

:ar: Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Perform a System File Check to check the integrity of all protected Windows 7 :

1. Click on the start rb:
2. Type CMD on Search
3. Left click and Run as Administrator
4. Type

   SFC /scannow

Full tutorial here:

• SFC /Scannow Command - System File Checker

Disk Check on your hard drive for file system errors and bad sectors on it.

• How to run Disk Check on Windows 7

If you have an SSD, make sure the following are up to date:

• SSD firmware
• BIOS Version
• Chipset Drivers
• Hard disk controller drivers/SATA drivers
• If you have a Marvell IDE ATA/ATAPI device, make sure the drivers are up to date from the Intel site or Marvell site and not from your motherboard/vendor support site.

Number down items at start-up. Keep only your anti-virus, this also improves the time for logging into windows.

• http://www.sevenforums.com/tutorials/1401-startup-programs-change.html
• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Go through this link if you have time:

• How to troubleshoot video card problems

Let us know the results

 

[Raleia]

I finally finished everything (good thing I had a day off).

Ran Driver Sweeper in safe mode to remove all the old files and re-installed the newest drivers.

Replaced Avira with MSE and re-installed Malwarebytes with a no-trial version. Did full scans on separate occasions and both found nothing.

SFC /scannow also found no problems.

DiskCheck on all 3 drives found no problems.

Downloaded the Samsung Magician Software and everything is up-to-date on my SSD.

Turned off a few run-on-start programs.

Last but no least, updated my AMD 770 Chipset drivers.

So, hopefully everything will be fine, but there's no way I can "stress-test" it due to it happening when it wants to, so if it happens again I'll be back. (hopefully I won't have to)

I appreciate the time and help koolkat, thank you very much!

 

[koolkat77]

Post either way & good luck

 

[Raleia]

Alright, seems that specific BSOD has been "fixed" but another seems to have popped up. :/

I've attached 2 Minidump files from 2 separate occasions.
Attached the BlueScreenView crasht.txt as well.

 

[koolkat77]

Upload a screenshot of your hard disk using CrystalDiskInfo:

• CrystalDiskInfo Standard Edition
• How to Upload and Post a Screenshot and File in Seven Forums

Make a hard drive test from the hard drive manufacturers website:

• Hard Drive Diagnostic Procedure

Let's run driver verifier and see if it catches any misbehaving drivers:

• Driver Verifier Enable/Disable

 

[Raleia]

Here's the 3 pics of my 3 HDD's.

Kinda confused on the 2nd one, prolly because I'm so tired from work today.

Will try the 3rd one tomorrow, going to bed for now.

G is the HD that all of my games and Tera is installed on and Tera is the game I've been playing that's giving me BSOd's, not even sure if it's related, F is just my basic storage drive for music, movies etc and C is well yea...

Edit, sorry about my pro cropping skills, I've been up since 1am EST for work and it's now 11:36, so I'll check back in the morning, need some sleep now. Thanks again!

 

[koolkat77]

When you're back:
Let's run driver verifier and see if it catches any misbehaving drivers:

• Driver Verifier Enable/Disable

 

[Raleia]

Ok, so I ran the verifier.exe and selected all non-microsoft drivers. When the computer was booting it BSOD.
I've attached the minidump and crash.txt from BlueSceenView.

 

[koolkat77]

Don't disable verifier yet.

 

[Raleia]

Well, I kinda already did, do you want me to re-do it and just boot in safe-mode, since I can't boot the computer with verifier running?

Edit: Also, I looked up the dtsoftbus01.sys thing and that seems to be linked to Daemon Tools Lite, do you want me to un-install that first?

 

[koolkat77]

OK. Never mind.

I will let you know if you have to enable it again.

 

[koolkat77]

Please uninstall the following two software:

1. CD-ROM Class Filter Driver by Gear Software. Also comes with iTunes.
2. Daemon Tools driver Possible BSOD issues in Win7

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C9, {23e, fffff88001097324, fffff9800b672ee0, 0}

*** WARNING: Unable to verify timestamp for GEARAspiWDM.sys
*** ERROR: Module load completed but symbols could not be loaded for GEARAspiWDM.sys
Unable to load image \SystemRoot\system32\DRIVERS\dtsoftbus01.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dtsoftbus01.sys
*** ERROR: Module load completed but symbols could not be loaded for dtsoftbus01.sys
Probably caused by : dtsoftbus01.sys ( dtsoftbus01+1324 )

Followup: MachineOwner
---------

Uninstall using the free version of Revo Uninstaller which gives you the option to delete the left over registry entry of the program.

• Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

 

[Raleia]

How would I go about uninstalling the CD-ROM Class Filter Driver? Itunes nor it shows up in Revo Uninstaller.

 

[Arc]

Daemon Tools, Alcohol 120% and Power Archiver Pro uses SCSI Pass Through Direct (SPTD), which is a well known BSOD causer. Uninstall Daemon Tools at first. Then download SPTD standalone installer from Disk-Tools.com, and execute the downloaded file as guided below :

• Double click to open it.
• Click this button only:
• 
• If it is grayed out, as in the picture, there is no more SPTD in your system, and you just close the window.

Uninstall iTunes from Control Panel > programs and features.
When done, run CCleaner's registry cleaner.
Then search in C:\Windows\System32\drivers and\or C:\Windows\SysWoW64\drivers.
if GEARAspiDWM.sys is still there, delete it manually.

 

[Raleia]

No SPTD so that's good. Uninstalled Itunes and GEARAspiDWM.sys is gone. Now what should I do?

 

[Arc]

Observe how it is working and let us know the situation. take your time to observe it. If you get more BSODs, upload the dumps.

 

[Raleia]

Should I do the verifier.exe again or just normal stuff?

 

[Arc]

Run it normally.

 

[Raleia]

Alright, thank you very much!