BSOD pointing to ntoskrnl.exe - Major Slow boot up now!!

[Maco88]

Hi All,

I have a new build which has been running flawlessly for the past 3 month, no errors of any kind, extremely fast boot times and shutdowns, a pleasure to use.

The other day though I experienced a BSOD (surprised and disappointed) and ran Whocrashed and got the following error details: (please ignore the dates in bold, my system clock was set to those date on purpose)

[FONT=Segoe UI, Arial]Crash dump directory: C:\Windows\Minidump[/FONT]

[FONT=Segoe UI, Arial][FONT=Segoe UI, Arial]Crash dumps are enabled on your computer.
[/FONT][/FONT]
[FONT=Segoe UI, Arial]On Wed 18/09/2009 11:22:32 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\091909-29312-01.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]ntoskrnl.exe[/FONT] (nt+0x70740)
Bugcheck code: 0xF4 (0x3, 0xFFFFFA8009191B30, 0xFFFFFA8009191E10, 0xFFFFF80002F8A2D0)
Error: [FONT=Segoe UI, Arial]CRITICAL_OBJECT_TERMINATION[/FONT]
file path: C:\Windows\system32\ntoskrnl.exe
product: [FONT=Segoe UI, Arial]Microsoft® Windows® Operating System[/FONT]
company: [FONT=Segoe UI, Arial]Microsoft Corporation[/FONT]
description: NT Kernel & System
Bug check description: This indicates that a process or thread crucial to system operation has unexpectedly exited or been terminated.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.
[/FONT]

[FONT=Segoe UI, Arial]On Fri 18/09/2009 11:22:32 PM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]ntkrnlmp.exe[/FONT] (nt!KeBugCheckEx+0x0)
Bugcheck code: 0xF4 (0x3, 0xFFFFFA8009191B30, 0xFFFFFA8009191E10, 0xFFFFF80002F8A2D0)
Error: [FONT=Segoe UI, Arial]CRITICAL_OBJECT_TERMINATION[/FONT]
Bug check description: This indicates that a process or thread crucial to system operation has unexpectedly exited or been terminated.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.
[/FONT]

This BSOD has only happened twice now in past 2 days, but this has caused my Boot times to become quite long. Normally i was logged into Windows 7 within about 40sec from start to finish. Now it is taking between 90sec - 120sec.

However once inside Windows 7, everything appears to be working smoothly. The only time the BSOD happened was on boot up.

My problem now is trying to figure out if it is just a corrupt ntoskrnl.exe file and/or ntkrnlmp.exe file and what the best approach would be to fix this.

Though after checking my system, those 2 files do exist but are not in the C:\Windows\system32\ folder. Are they suppose to reside in there????

If so, (1) would using the Windows 7 install disc to copy them over fix this??
Or (2) should I be trying a "System Repair" ??

I really do not want to do a fresh install if I can avoid it.

The only possible cause I can think of that I have done in the past couple of days that may have screwed something was that in preparation for some overclocking (I am still running my system Stock) I ran a stress test using AIDA64 on stock clocks for 5 hours, which passed without a hitch. System was fine until I logged off and noticed the BSOD and slow boot time the next time I used my computer.

My Specs are:
ASUS P8P67 PRO (M/B), Intel i5-2500K (CPU), 8GB G.Skill RAM, 1TB Samsung f4 Spinpoint drive, Corsair HX850 PSU.

Much thanks
M88

 

[writhziden]

Please follow the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html to provide us with the full crash reports so we can do a more in-depth analysis.


Yes, those files are supposed to reside there. Also, 3rd party blue screen crash analysis often blames Windows processes. So does the tool we use, but it provides more information to track down the actual cause, which is why we use it.

Also, the BugCheck codes you are getting are going to blame Windows files since they indicate a Windows process was terminated unexpectedly. These crashes typically indicate a hard disk problem or system corruption.


This could mean hard disk corruption, bad sectors, a failing hard disk, Windows files or registry corruption, viruses, or memory problems.

• If you are overclocking any hardware, please stop.
  
  
• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html (you may need to search for wininit instead of chkdsk).
  For any drives that do not give the message:
  Windows has checked the file system and found no problems
  run disk check again as above. In other words, if it says:
  Windows has made corrections to the file system
  after running the disk check, run the disk check again.
  
  
• Run all Basic tests with SeaTools: S.M.A.R.T. Check, Short Drive Self Test, Drive Information, Short Generic, and Long Generic. Run the tests for all HDDs.
  SeaTools for Windows
  
  SeaTools for DOS​
  
  
• If you have an SSD, make sure the following are up to date:
  • SSD firmware
  • BIOS Version
  • Chipset Drivers
  • Hard disk controller drivers/SATA drivers
  • If you have a Marvell IDE ATA/ATAPI device, make sure the drivers are up to date from the Intel site or Marvell site and not from your motherboard/vendor support site.
  
  
• Check Windows for corruption. Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations. Use OPTION THREE of http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html to provide us with the sfcdetails.txt file if errors occur.
  
  
• Download and install Malwarebytes, update it, do not start the free trial, and then run a full scan. Also run a full scan with your antivirus software installed on your system. If you do not have antivirus software installed, see the http://www.sevenforums.com/system-s...-system-security-combination.html#post1732627 for better security steps and scanning tools. Make sure to update the security software before running the full scan.
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
     Warning

  Before you proceed with the following, answer these two questions: Are you still under warranty? Does your warranty allow you to open up the machine to check hardware? If you are unsure of the answers to these questions, contact your system manufacturer. :warn:WARNING: The steps that follow can void your warranty!!!
  
  For Part 3: If You Have Errors: If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working. If you do not have an anti-static workbench, desk, or pad, you can use your computer tower/case by finding a metal hold in it, such as a drive bay.
  Once these steps have been followed, it is safe to remove and replace components within your computer.

If you need further help, please follow the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html to provide us with the full crash reports so we can do a more in-depth analysis.

 

[Maco88]

Thanks Writhziden

I will follow the BSOD Posting Instructions and repost the details, along with some of the other suggestion.

Cheers

 

[writhziden]

You're welcome. Let us know if you need help as you go through the steps or if you find the problem.

 

[Maco88]

After reading your 1st reply Writhziden, I decided to take one step at a time and that was starting with "Chkdsk".

Before I post the "Chkdsk" log, whatever "Chkdsk" did, it seems to have fixed (fingers crossed) whatever happened a few days ago. So far booting into Windows 7 is back to the way it was, super fast, and no BSOD. Task Manager is showing the CPU usage at 1 - 3% mostly, and everything seems fines, as the way I have know mty system to work, efficiently smooth and fast.

Having said that, I would be curious as to what the cause was if we can find it. I am more than happy to post the BSOD report (using the guide) after the "Chkdsk" has been looked at.


Here is the log from the "Chkdsk"

Source = Wininit [Date: 21/06/2012 - 3:40pm]

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
Attribute record of type 0xa0 and instance tag 0x4 is cross linked
starting at 0xb0e4e for possibly 0x1 clusters.
Some clusters occupied by attribute of type 0xa0 and instance tag 0x4
in file 0x17894 is already in use.
Deleting corrupt attribute record (160, $I30)
from file record segment 96404.
Attribute record of type 0xa0 and instance tag 0x4 is cross linked
starting at 0xb0e4f for possibly 0x1 clusters.
Some clusters occupied by attribute of type 0xa0 and instance tag 0x4
in file 0x17995 is already in use.
Deleting corrupt attribute record (160, $I30)
from file record segment 96661.
105728 file records processed. File verification completed.
1468 large file records processed. 0 bad file records processed. 2 EA records processed. 44 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
The index bitmap for index $I30 in file 0x17894 is invalid or missing.
Correcting error in index $I30 for file 96404.
The index bitmap $I30 is present but there is no corresponding
index allocation attribute in file 0x17894.
Correcting error in index $I30 for file 96404.
The down pointer of current index entry with length 0x18 is invalid.
00 00 00 00 00 00 00 00 18 00 00 00 03 00 00 00 ................
ff ff ff ff ff ff ff ff ec ba cd 8f f2 ea cc 01 ................
ec ba cd 8f f2 ea cc 01 c3 a0 64 e3 e8 f2 cc 01 ..........d.....
Sorting index $I30 in file 96404.
The index bitmap for index $I30 in file 0x17995 is invalid or missing.
Correcting error in index $I30 for file 96661.
The index bitmap $I30 is present but there is no corresponding
index allocation attribute in file 0x17995.
Correcting error in index $I30 for file 96661.
The down pointer of current index entry with length 0x18 is invalid.
00 00 00 00 00 00 00 00 18 00 00 00 03 00 00 00 ................
ff ff ff ff ff ff ff ff ec ba cd 8f f2 ea cc 01 ................
ec ba cd 8f f2 ea cc 01 c3 a0 64 e3 e8 f2 cc 01 ..........d.....
Sorting index $I30 in file 96661.
146042 index entries processed. Index verification completed.
CHKDSK is scanning unindexed files for reconnect to their original directory.
Recovering orphaned file S09EP01 (96405) into directory file 96404.
Recovering orphaned file S09EP02 (96408) into directory file 96404.
Recovering orphaned file S09EP03 (96410) into directory file 96404.
Recovering orphaned file S09EP04 (96412) into directory file 96404.
Recovering orphaned file S09EP05 (96415) into directory file 96404.
Recovering orphaned file S09EP0~1 (96418) into directory file 96404.
Recovering orphaned file S09EP06 - Missing (96418) into directory file 96404.
Recovering orphaned file S09EP07 (96420) into directory file 96404.
Recovering orphaned file S09EP08 (96423) into directory file 96404.
Recovering orphaned file S09EP09 (96427) into directory file 96404.
Recovering orphaned file S09EP10 (96430) into directory file 96404.
Recovering orphaned file S09EP11 (96433) into directory file 96404.
Recovering orphaned file S09EP12 (96437) into directory file 96404.
Recovering orphaned file S09EP13 (96440) into directory file 96404.
Recovering orphaned file S09EP14 (96444) into directory file 96404.
Recovering orphaned file S09EP15 (96447) into directory file 96404.
Recovering orphaned file S09EP16 (96450) into directory file 96404.
Recovering orphaned file S09EP17 (96453) into directory file 96404.
Recovering orphaned file S09EP18 (96456) into directory file 96404.
Recovering orphaned file S09EP19 (96459) into directory file 96404.
Recovering orphaned file S09EP20 (96462) into directory file 96404.
Recovering orphaned file S09EP21 (96465) into directory file 96404.
Recovering orphaned file S09EP22 (96469) into directory file 96404.
Recovering orphaned file S09EP23 (96472) into directory file 96404.
Recovering orphaned file S09EP24 (96477) into directory file 96404.
Recovering orphaned file S09EP25 (96480) into directory file 96404.
Recovering orphaned file S09EP26 (96483) into directory file 96404.
Recovering orphaned file VIDEO_TS (96662) into directory file 96661.
28 unindexed files scanned. Recovering orphaned file AUDIO_TS (96663) into directory file 96661.
0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
105728 file SDs/SIDs processed. Cleaning up 20 unused index entries from index $SII of file 0x9.
Cleaning up 20 unused index entries from index $SDH of file 0x9.
Cleaning up 20 unused security descriptors.
Security descriptor verification completed.
20158 data files processed. CHKDSK is verifying Usn Journal...
34114992 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
Read failure with status 0xc0000185 at offset 0x10f9d000 for 0x10000 bytes.
Read failure with status 0xc0000185 at offset 0x10f9d000 for 0x1000 bytes.
Windows replaced bad clusters in file 37345
of name \Windows\System32\winevt\Logs\MEDIAC~1.EVT.
105712 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
144769437 free clusters processed. Free space verification is complete.
Adding 1 bad clusters to the Bad Clusters File.
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

976657407 KB total disk space.
397290648 KB in 82586 files.
53896 KB in 20159 indexes.
8 KB in bad sectors.
235107 KB in use by the system.
65536 KB occupied by the log file.
579077748 KB available on disk.

4096 bytes in each allocation unit.
244164351 total allocation units on disk.
144769437 allocation units available on disk.

Internal Info:
00 9d 01 00 63 91 01 00 cc fd 02 00 00 00 00 00 ....c...........
20 03 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 ...,...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

 

[Maco88]

Just did a scan of the drive using HD Sentinel and it shows the drive at 96% health, 100 % performance.

There are 7 weak sectors found on the disk surface. They may be remapped any time in the later use of the disk. (not sure if it something i need to do or HD Sentinel does????)


Read test showed:
1 bad sector
1 damaged sector

 

[writhziden]

The remapping of sectors is actually something that NTFS does automatically as an Operating System (OS) runs. Windows will start throwing errors in the Event Viewer logs if it does not do it properly, so you should check those periodically. Bad sectors are a normal occurrence with hard drives, but you should check the drive once a week with http://www.sevenforums.com/tutorials/433-disk-check.html to make sure the bad sectors and corrections to the file system do not continue. If they do continue, that may indicate a bad hard disk.

http://www.sevenforums.com/tutorials/226084-event-viewer-open-use-windows-7-a.html