BSOD - NTSOKRNL.exe

[chetansha]

HI I was having these error yesterday, so i made a fresh install of win 7. This error still persists. Am attaching the needed files.
QuadCore AMD Athlon II X4 630, - brand new
MSI 890GXM-G65 (MS-7642) - 4 months old
Corsair XMS3 CM3X2G1333C9 - brand new - 2x 2 GB
Microsoft Windows 7 Ultimate - x64
Onboard Audio and Video

 

[ttran]

HI I was having these error yesterday, so i made a fresh install of win 7. This error still persists. Am attaching the needed files.
QuadCore AMD Athlon II X4 630, - brand new
MSI 890GXM-G65 (MS-7642) - 4 months old
Corsair XMS3 CM3X2G1333C9 - brand new - 2x 2 GB
Microsoft Windows 7 Ultimate - x64
Onboard Audio and Video

Hi and welcome to SF!


This is pretty straight forward, it was caused by your Kaspersky antivirus software (Kaspersky Internet Security Suite). Please uninstall it completely. If you need an alternative program for protection, I recommend to try Microsoft security essential, it is free and known for BSODs free.
Removal tool for Kaspersky Lab products

MSE--->http://www.microsoft.com/security_essentials

BUGCHECK SUMMARY:

BugCheck 3B, {c0000005, fffff80002a8c805, fffff88009a24c80, 0}

Probably caused by : ntkrnlmp.exe ( nt!ExpInterlockedPopEntrySListFault16+0 )

Followup: MachineOwner
---------
PROCESS_NAME:  [COLOR=Lime]avp.exe<----Kaspersky[/COLOR]

Let us know if you need help

Tuan

 

[chetansha]

Hi, i have removed kaspersky as of now. By the way, how / where did you find this bug check ? in the dmp file ?

 

[ttran]

you need to have a tool called WinDbg to read the DMP. You can download the tool from Microsoft Web page (it's a complicated and long installation process to me).

Let us know how things turn out

Tuan

 

[chetansha]

Uh hu, i prefer to leave it the experts. Have removed Kaspersky as of now.
But to let you, i was using kaspersky 2010 earlier and never had problems. 3 days back my processor ( AMD Athlon x4 620) conked out due to malfunction of heatsink fan. I replaced with a new x4 630, i started getting problems from then on.
Then last night i made fresh install of win 7, installed Kaspersky 2011, the problem of NTSOKRNL.exe was repeated, this is when i posted here.

The error i got earlier - before fresh install of win7
Dump File : 080410-26551-01.dmp
Crash Time : 04-08-2010 21:01:56
Bug Check String : SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000007e
Parameter 1 : ffffffff`c0000005
Parameter 2 : fffff800`02c88c23
Parameter 3 : fffff880`057c07c8
Parameter 4 : fffff880`057c0030
Caused By Driver : Wdf01000.sys
Caused By Address : Wdf01000.sys+31a71
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\Minidump\080410-26551-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 7600

==================================================
Dump File : 080410-30747-01.dmp
Crash Time : 04-08-2010 20:34:18
Bug Check String : NTFS_FILE_SYSTEM
Bug Check Code : 0x00000024
Parameter 1 : 00000000`001904fb
Parameter 2 : fffff880`06bb2e38
Parameter 3 : fffff880`06bb26a0
Parameter 4 : fffff800`02cfd687
Caused By Driver : Ntfs.sys
Caused By Address : Ntfs.sys+213d8
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\Minidump\080410-30747-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 7600
==================================================

I have not saved those files. Any pointers with the above ?

 

[Tews]

The dmp(s) point to ntkrpamp.exe or ntoskrnl.exe as the probable cause. We know this is not the case, as these are core OS files, and will definitely not cause a BSOD. They are just the default files the debuggers blame when they can't see a better cause. To pin the problem down, enable driver verifier..

- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

 

[chetansha]

i did what was told to do, PC never started up. I saw on the screen USBFILTER.sys ( usb 3.0 driver, i just installed now).Went in the BIOS, disabled USB 3.0 controller, then used system restore to get my pc on. Another BSOD.

 

[Tews]

Did you enable driver verifier???

 

[chetansha]

yes that was done.

 

[ttran]

KB 980226 "STOP: 0X000000D5" error message on a computer that is running Windows Vista, Windows 7, Windows Server 2008, or Windows Server 2008 R2

 

[chetansha]

ok so i apply an hotfix ?

 

[CarlTR6]

Yes, it is worth a try. But first create a restore point so that you can go back if necessary.

 

[chetansha]

well i cant find the download link there.
Link for hotfix i meant. sorry. i got the security essentials running.

 

[CarlTR6]

http://www.microsoft.com/security_essentials/

 

[chetansha]

Had two more BSOD today morning. Booted my PC using a boot CD and retriving data before i do a fresh install of win 7. I have manged to save the dmp files. Can i post them ?

 

[ttran]

It's weird, in this new dump file, Microsoft security Essential is blamed, especially MsMpEng.exe, part of Microsoft Window Defender. You can try to turn it off if possible.
What is msmpeng.exe and how to remove it

Can you please perform system file check and let me know the result:
http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html
If it report error, please do it again until it said it can't find any more error (violation), or until it give up and tell you it was unable to fix some files.

amdppm.sys was blamed, it is AMD Processor Device Driver. It can be driver issue or hardware issue. First of all, please download and install fresh copy of processor driver.

STOP 0x0000001E: KMODE_EXCEPTION_NOT_HANDLED

Usual causes: Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS

Try this free stress test: http://www.mersenne.org/freesoft/

Prime95 Setup:
- extract the contents of the zip file to a location of your choice
- double click on the executable file
- select "Just stress testing"
- select the "Blend" test. If you've already run MemTest overnight you may want to run the "Small FFTs" test instead.
- "Number of torture test threads to run" should equal the number of CPU's times 2 (if you're using hyperthreading).
The easiest way to figure this out is to go to Task Manager...Performance tab - and see the number of boxes under CPU Usage History
Then run the test for 6 to 24 hours - or until you get errors (whichever comes first).
The Test selection box and the stress.txt file describes what components that the program stresses.

BUGCHECK SUMMARY:

BugCheck 3B, {c0000005, fffff80002a8a7f6, fffff88003737dd0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KeInterlockedClearProcessorAffinityEx+36 )

Followup: MachineOwner
---------
PROCESS_NAME:  [COLOR=Red]MsMpEng.exe[/COLOR] <---Window Defender
BugCheck 1E, {0, 0, 0, 0}

Probably caused by : amdppm.sys ( amdppm!C1Halt+2 )

Followup: MachineOwner
---------

Let us know if you need help

Tuan

 

[chetansha]

Tried to do a fresh install of win 7 - i got UDF file system error. Just ran memtest - Here is what memtest told -
TST - 4 / PASS - 0 / FAILURE ADDRESS - 00095F7519C . 2399.4 MB/ GOOD - ee6eff7f / bad - ece6eff7f / error bits - 02000000 / Count - 1.

 

[ttran]

Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot. Test the sticks individually, and if you find a good one, test it in all slots.

 

[chetansha]

tested individually, one good, one bad.

 

[jcgriff2]

Tried to do a fresh install of win 7 - i got UDF file system error. Just ran memtest - Here is what memtest told -
TST - 4 / PASS - 0 / FAILURE ADDRESS - 00095F7519C . 2399.4 MB/ GOOD - ee6eff7f / bad - ece6eff7f / error bits - 02000000 / Count - 1.

Take out the bad RAM stick for now.

I replaced with a new x4 630, i started getting problems from then on.
Then last night i made fresh install of win 7, installed Kaspersky 2011, the problem of NTSOKRNL.exe was repeated, this is when i posted here.

The error i got earlier - before fresh install of win7
Dump File : 080410-26551-01.dmp
Crash Time : 04-08-2010 21:01:56
Bug Check String : SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000007e
Parameter 1 : ffffffff`c0000005
Parameter 2 : fffff800`02c88c23
Parameter 3 : fffff880`057c07c8
Parameter 4 : fffff880`057c0030
==================================================
Dump File : 080410-30747-01.dmp
Crash Time : 04-08-2010 20:34:18
Bug Check String : NTFS_FILE_SYSTEM
Bug Check Code : 0x00000024
Parameter 1 : 00000000`001904fb
Parameter 2 : fffff880`06bb2e38
Parameter 3 : fffff880`06bb26a0
Parameter 4 : fffff800`02cfd687
Caused By Driver : Ntfs.sys
==================================================

I have not saved those files. Any pointers with the above ?

#1 = 0x7e (0xc0000005,,,) = thread threw an exception

#2 = 0x24 (0x1904fb,,,) = NTFS file system + exception error 0xc0000005

The most recent dump has a bugcheck = 0x1e (0x0,,,) = kernel mode exception. Looking deeper into this dump, we find the exception code 0xc0000005 as well -

[FONT=lucida console]EXCEPTION_RECORD:  fffff88002d1b8b8 -- (.exr 0xfffff88002d1b8b8)[/FONT]
[FONT=lucida console].exr 0xfffff88002d1b8b8[/FONT]
[FONT=lucida console]ExceptionAddress: fffff80002a812aa (nt!KiSecondaryClockInterrupt+0x000000000000013a)[/FONT]
[FONT=lucida console] ExceptionCode: [COLOR=red]c0000005[/COLOR] (Access violation)[/FONT]
[FONT=lucida console]ExceptionFlags: 00000000[/FONT]
[FONT=lucida console]NumberParameters: 2[/FONT]
[FONT=lucida console] Parameter[0]: 0000000000000000[/FONT]
[FONT=lucida console] Parameter[1]: ffffffffffffffff[/FONT]
[FONT=lucida console]Attempt to read from address [COLOR=blue]ffffffffffffffff[/COLOR]  [/FONT]

You can see the 0xc0000005 exception error. The blue "f" = high values, i.e., there is no such memory address.

The other two attached dumps both have the same bugcheck -

0x3b (0xc0000005,,,) = system service threw an exception

So we have five dumps, all with the same 0xc0000005 exception error = memory access violation. RAM is a definite culprit here, so run for now with one good stick.

The other item I found -

[FONT=lucida console]LMPC4.SYS    Fri [COLOR=red]Jul[/COLOR] [COLOR=red]20[/COLOR] 07:50:45 [COLOR=red]2007[/COLOR] (46A0A195) - FSPro Labs - LockBox Pro  - [URL="http://www.fspro.net/"]Home - FSPro Labs[/URL] [/FONT]

This app appears to me to involve file encryption. Remove it. It is too old for WIndows 7 x64 and is likely a leading candidate causing the access violation errors.

Another culprit is without a doubt KIS. Remove it using the KIS Removal Tool -

KIS Removal -- jcgriff2.com

Run with a good stick of RAM and double-check the processor.

Windbg Logs
--> http://jcgriff2.com/dbug_logs/_99-dbug_chetansha_Windows7x64_08-06-2010_jcgriff2_.txt
--> http://jcgriff2.com/dbug_logs/_99-dbug_chetansha_Windows7x64_08-06-2010_jcgriff2_.txt.zip

Regards. . .

jcgriff2

.

BSOD BUGCHECK SUMMARY

[FONT=lucida console]Built by: 7600.16539.amd64fre.win7_gdr.100226-1909[/FONT]
[FONT=lucida console]Debug session time: Fri Aug  6 00:55:01.682 2010 (GMT-4)[/FONT]
[FONT=lucida console]System Uptime: 0 days 0:23:13.305[/FONT]
[FONT=lucida console]Probably caused by : amdppm.sys ( amdppm!C1Halt+2 )[/FONT]
[FONT=lucida console]DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT[/FONT]
[FONT=lucida console]BUGCHECK_STR:  0x1E[/FONT]
[FONT=lucida console]PROCESS_NAME:  System[/FONT]
[FONT=lucida console]Bugcheck code 0000001E[/FONT]
[FONT=lucida console]Arguments 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000[/FONT]
[FONT=lucida console]¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``[/FONT]
[FONT=lucida console]Built by: 7600.16539.amd64fre.win7_gdr.100226-1909[/FONT]
[FONT=lucida console]Debug session time: Fri Aug  6 00:29:11.704 2010 (GMT-4)[/FONT]
[FONT=lucida console]System Uptime: 0 days 0:01:11.327[/FONT]
[FONT=lucida console]Probably caused by : ntkrnlmp.exe ( nt!KeInterlockedClearProcessorAffinityEx+36 )[/FONT]
[FONT=lucida console]DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT[/FONT]
[FONT=lucida console]BUGCHECK_STR:  0x3B[/FONT]
[FONT=lucida console]PROCESS_NAME:  MsMpEng.exe[/FONT]
[FONT=lucida console]Bugcheck code 0000003B[/FONT]
[FONT=lucida console]Arguments 00000000`c0000005 fffff800`02a8a7f6 fffff880`03737dd0 00000000`00000000[/FONT]
[FONT=lucida console]¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``[/FONT]
[FONT=lucida console]Built by: 7600.16539.amd64fre.win7_gdr.100226-1909[/FONT]
[FONT=lucida console]Debug session time: Thu Aug  5 03:30:14.101 2010 (GMT-4)[/FONT]
[FONT=lucida console]System Uptime: 0 days 1:01:11.958[/FONT]
[FONT=lucida console]Probably caused by : ntkrnlmp.exe ( nt!ExpInterlockedPopEntrySListFault16+0 )[/FONT]
[FONT=lucida console]DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT[/FONT]
[FONT=lucida console]BUGCHECK_STR:  0x3B[/FONT]
[FONT=lucida console]PROCESS_NAME:  avp.exe[/FONT]
[FONT=lucida console]Bugcheck code 0000003B[/FONT]
[FONT=lucida console]Arguments 00000000`c0000005 fffff800`02a8c805 fffff880`09a24c80 00000000`00000000[/FONT]
[FONT=lucida console]¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``[/FONT]
 
[FONT=lucida console]by [COLOR=navy]jcgriff2     [/COLOR][/FONT]
 
[FONT=lucida console][COLOR=navy]       J. C. Griffith, Microsoft MVP[/COLOR]   [/FONT]
 
[FONT=lucida console]         [URL="https://mvp.support.microsoft.com/profile/Griffith"][COLOR=#000055]https://mvp.support.microsoft.com/profile/Griffith[/COLOR][/URL]   [/FONT]
 
[FONT=lucida console]         [URL="http://www.jcgriff2.com"][COLOR=#000055]www.jcgriff2.com[/COLOR][/URL] [/FONT]
 
[FONT=lucida console]¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨[/FONT]