BSOD > Please Help ntoskrnl.exe

[emh1989]

Random occurrence of bsods have been happening most recently due to my drivers being corrupted. Can someone take a look at them to tell me what I have to update to resolve this.

 

[Saurabh A]

Hi emh1989,

Download and run the 'SF_Diagnostic_Tool.exe file' as suggested in the tutorial link for better 'BSOD analysis': http://www.sevenforums.com/bsod-help-support/96879-blue-screen-death-bsod-posting-instructions.html

After download, click 'Grab all' to capture the Mini-Dump, Event Logs, Update Logs, Driver List and MGDiag reports. Apart from the 'Mini dump' the information in these files is vital for investigation.

Do reply with the information; would be glad to assist.

 

[emh1989]

Thanks for replying. Here it is

 

[Saurabh A]

Hi emh1989,

Please run 'Chkdsk' from command prompt to detect and fix errors on the disk: http://www.sevenforums.com/tutorials/433-disk-check.html

Source: MsiInstaller
Event ID: 10005
SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2013 -- Error 27054. CA_Error27054: SetupAction(0xC0070642): Installation failed.

Remove 'AVG 2013 & AVG Tuneup (Registry Cleaner)' to see if that helps. You may choose to use 'Microsoft Security Essentials'; has shown better results from 'Windows' stability stand point.

The Mini-dump exhibits the following errors:

nwifi.sys
Bug Code: (0x0000001e)
Bug String: KMODE_EXCEPTION_NOT_HANDLED
NativeWiFi Miniport Driver

tcpip.sys 
Bug Code: (0x0000001e)
Bug String: KMODE_EXCEPTION_NOT_HANDLED
Microsoft TCP/IP Driver (networking related)

Please try re-installing the 'Network Drivers' for 'ASUS 802.11n Wireless LAN Card' and for 'Microsoft Virtual WiFi Miniport Adapter'. Would suggest you to uninstall the current drivers from 'Device Manager', restart the unit and try a fresh set of drivers.

Logs also point at 'nVidia related 'application crashes'

nvtray.exe
Source: Application Error
Date: 2013-02-21T23:48:38.000
Event ID: 1000
Faulting application name: nvtray.exe, version: 7.17.13.697, time stamp: 0x506b3bc0
Faulting module name: nvtray.exe, version: 7.17.13.697, time stamp: 0x506b3bc0
Exception code: 0x40000015
Fault offset: 0x0000000000153481
Faulting process id: 0x123c
Faulting application start time: 0x01ce10b30cea2bf0
Faulting application path: C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
Faulting module path: C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
Report Id: 1ecc3768-7cab-11e2-8903-f46d0425995c

If the issue persists, you may try re-installing display drivers for the nVidia card installed in the system.

Other file corruptions are also observed in the system logs; like

Source: Microsoft-Windows-WMI
Event ID: 10
Description: 
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Would also suggest you to run SFC Tool to check the integrity of 'Windows files' in the system: http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Hope this helps. Do reply with the findings.

 

[emh1989]

K i did all that. It helped for a day. But im back to having problems with the tcpip.sys and ntoskrnl.exe. Ive tried reinstalling the drivers for ASUS 802.11n Wireless LAN Card and for Microsoft Virtual WiFi Miniport Adapter. Nothing has changed.

 

[Saurabh A]

Hi emh1989,

Thank you for the response.

This code points at an old Intel Driver; please try updating the driver and check results: Intel Download Center

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

Unable to load image intelppm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for intelppm.sys
*** ERROR: Module load completed but symbols could not be loaded for intelppm.sys
Probably caused by : intelppm.sys ( intelppm+39c2 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.

*** WARNING: Unable to verify timestamp for afw.sys
*** ERROR: Module load completed but symbols could not be loaded for afw.sys
afw+0x388b

This relates to Agnitum Firewall Driver. This is not required in the system as 'Windows Firewall' is working already. Please follow the steps in this article to clear this firewall completely: How do I uninstall Outpost manually?

Hope you have removed 'AVG' from the system; also found that 'BullGuard' is also working in the system. Having two anti-virus software in the system can cause serious trouble. Please remove it and recheck results. You may run the 'removal tool' (uninstaller utility) from here: http://www.bullguard.com/support/product-guides/bullguard-internet-security-guides/uninstall.aspx

Also ensure that all 'Windows Updates' are properly installed after the above mentioned steps are executed.

Hope this helps. Do reply with the findings; would be glad to assist.