Solved BSOD Random but Linked to NTOSKRNL Failure

[traderyoda]

Greetings,

...and thanks in advance for the support.

My PC is custom and I built it up a few years ago; it's been like a rock until a few months ago. I started to get a few BSODs, so I tried rolling back Windows - that didn't help. I tracked things to some memory issues, so I ran Memtest86+ and found one stick with a few errors on Test #8. Rather than take a chance I just replaced the memory with 4 new 2GB Corsair sticks - I tested each of the new sticks with Memtest before installing and they all passed. I thought I had the problem licked until I got another BSOD. Using BlueScreenView the fault is either a '0A' or a '50' almost always traced to ntoskrnl.exe. I tried to search for typical causes and did things like turn off Firewire in BIOS, remove some software people suggested were problematic, etc. - no change. The BSODs seem to occur when the PC has been running awhile. If I leave the PC running all night about 1/2 the time I'll wake up to a BSOD. Finally I bit the bullet and reloaded Windows 7 Pro 64 and all my software for a fresh start- a major pain, but I was getting desperate. A few days later and another BSOD. I'm getting nervous that this is a hardware problem. This PC is not overclocked and runs cool, and I can't find any evidence of a board problem. Power supply checks out perfectly. So I'm about out of ideas and could use a hand.

I've attached a snippet from BlueScreenView and the ZIP file from the diagnostic tool.

Cheers,
TY

 

[Arc]

ntkrnlmp.exe is not the reason behind the BSOD but it is the kernel on which the crash takes place. When the crash dump recording mechanism fails to detect any reason behind the BSOD, it blames the kernel itself. As it happens with you.

BugCheck 50, {fffff80022ee91af, 8, fffff80022ee91af, 2}


[COLOR=Red]Could not read faulting driver name[/COLOR]
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+448c6 )

Followup: MachineOwner
---------

A stop ox50 BSOD is PAGE_FAULT_IN_NONPAGED_AREA. As per Carrona.org,

Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS

Your BIOS is very old.

BiosVersion = 2301   
[COLOR=Red]BiosReleaseDate = 07/10/2009[/COLOR]

But it is the latest one.

Let us check the other possibilities, one by one.

Test your RAM modules for possible errors.

How to Test and Diagnose RAM Issues with Memtest86+
​

Run memtest86+ for at least 8 consecutive passes.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

If it does not show any error, enable Driver Verifier to monitor the drivers.

Driver Verifier - Enable and Disable
​

Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[traderyoda]

Thanks Arc...

Yes, nothing much I can do about the BIOS - that was my first stop in the hunt, but no dice.

I'll go back and test the RAM again, stick by stick. I've read that Memtest86+ Test #8 is the most challenging, and before I replaced my RAM with the 4 new 2GB sticks it only faulted on that test. I did test the new sticks (Test #8) and they all passed. But it's worth repeating. I'll run the entire series of tests and post back.

Question: how can you tell whether the RAM is bad or it's a memory controller problem on the hardware side?

BEST,
TY

 

[Arc]

Question: how can you tell whether the RAM is bad or it's a memory controller problem on the hardware side?

Do the test first with all the RAM modules attached. If failures are detected, then we will see how can we dig further.

 

[traderyoda]

Greeting Arc

Memtest86+ ran through 9 passes with all RAM in and all tests - no errors. So it appears I do not have a RAM or memory controller error. Anything else I need to do before running the driver monitoring program?

Cheers,
TY

 

[Arc]

You may disable the Epson entries in the startup.

 

[traderyoda]

Will do - will get to it now!

THX
TY

 

[traderyoda]

Arc - ran with Driver Verifier enabled per directions. It ran perfectly doing my normal office work and such. I was done with the machine for awhile and I decided to transfer a large block (over 200 gigs) of music to a blank harddrive figuring it would put some stress on the system. Got a BSOD very quickly. The dump file is attached.

This is pretty much what I've experienced before... I seem to get a BSOD when I have the machine loaded up, or when I leave it transferring large files overnight. Maybe it's a heat related problem, although it's run for many years configured as it is now.

Thanks again for hangin' in there with me!

Cheers,
TY

 

[Arc]

The verifier enabled crash dump reports memory failure.

BugCheck A, {fffffa860117eb0a, 2, 0, fffff80002ef7537}

[COLOR=Red]Probably caused by : memory_corruption [/COLOR]( nt!MiPfnShareCountIsZero+77 )

Followup: MachineOwner
---------

Is the blank HDD is one of your removable discs? In that case it might be associated with some chipset (USB) issue. Though the manufacturer does not have any update listed, you may try the Intel® Driver Update Utility from https://downloadcenter.intel.com/default.aspx .

Sometimes the antivirus also may cause blockage to storage filters. Uninstall Avast using Avast Uninstall Utility. Just on a test basis. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.

Then try to replicate the issue, with DV disabled. Let us know the result.

 

[traderyoda]

Hmmm... memory problem. I naively assumed I had a RAM problem and swapped out RAM, maybe unnecessarily.

I'm in the process of taking each of these steps.

The blank harddrive was a recently reformatted internal SATA WD 750GB Green Drive. I use it as a backup storage device for music.

As soon as I get this done I'll give it another large transfer, see what happens and report back!

 

[traderyoda]

Arc...

Performed each recommended step and now running MSE w/MBAM. Driver Verifier off and bye-bye to Avast! using Avastclear. The result: 24hrs under several large file transfers with no BSODs! I think you nailed the problem. I should have been suspicious of Avast!. An automatic update a few months ago caused mysterious problems with my Squeezecenter music server setup - it took hours to identify Avast! as the source of the problem. If Avast! turns out to be the problem again it's use as an anti-virus package is questionable.

I will leave the machine running and under various loads for another 24 hours to see where things wind up.

Your assistance is very much appreciated and I've learned a lot - THANKS!

TY

 

[Arc]

You are welcome. Let us know about any further issue.

 

[traderyoda]

Greeting Arc,

Well... all I can say is you rock... I've loaded this computer up running video games, transferring large files back and forth, etc. - zero BSODs. I think you hit the nail on the head regarding Avast! It's problematic software.

I hope this ordeal helps others down the line!

The time you took to help is a pretty cool thing - thanks to you and the Forum for saving my sanity!

Cheers
TY

 

[Arc]

Good news.

Let us know for any further BSOD.

 

[traderyoda]

Arc... I was just about to write that we could mark this case closed. The machine has been very stable for days after being pushed pretty hard. I opened a browser to answer your last message and !bang!... another BDOD - 0x50 again. Dump file is attached.

Nothing has been changed on the computer - no software added other that a few Windows 7 updates. About the only issue I've noticed has been a few crashes of MS Office software, and crashes of a Logitech software player called Squeezeplay that is integrated into my home's Squeezecenter music server.

Cheers,
TY

 

[Arc]

I would suggest you to run Driver Verifier for one more time.

.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff80022ed61e3, 8, fffff80022ed61e3, 2}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+43836 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff80022ed61e3, memory referenced.
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation.
Arg3: fffff80022ed61e3, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003106100
GetUlongFromAddress: unable to read from fffff800031061c0
 fffff80022ed61e3 Nonpaged pool

FAULTING_IP: 
+1ced260
fffff800`22ed61e3 ??              ???

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

TRAP_FRAME:  fffff8800bd27840 -- (.trap 0xfffff8800bd27840)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80091f9570 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000003 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80022ed61e3 rsp=fffff8800bd279d0 rbp=0000000000000000
 r8=fffff80002e59000  r9=0000000000000000 r10=fffffffffffffffb
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
fffff800`22ed61e3 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002f4b5e4 to fffff80002ecebc0

FAILED_INSTRUCTION_ADDRESS: 
+1ced260
fffff800`22ed61e3 ??              ???

STACK_TEXT:  
fffff880`0bd276d8 fffff800`02f4b5e4 : 00000000`00000050 fffff800`22ed61e3 00000000`00000008 fffff880`0bd27840 : nt!KeBugCheckEx
fffff880`0bd276e0 fffff800`02ecccee : 00000000`00000008 fffff800`22ed61e3 00000000`00000000 000001fd`f94045d1 : nt! ?? ::FNODOBFM::`string'+0x43836
fffff880`0bd27840 fffff800`22ed61e3 : fffff8a0`032b4060 00000000`00d5f1a8 00000000`00000067 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0bd279d0 fffff8a0`032b4060 : 00000000`00d5f1a8 00000000`00000067 00000000`00000000 00000000`00000000 : 0xfffff800`22ed61e3
fffff880`0bd279d8 00000000`00d5f1a8 : 00000000`00000067 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff8a0`032b4060
fffff880`0bd279e0 00000000`00000067 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xd5f1a8
fffff880`0bd279e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000067 : 0x67


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+43836
fffff800`02f4b5e4 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+43836

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  531590fb

IMAGE_VERSION:  6.1.7601.18409

FAILURE_BUCKET_ID:  X64_0x50_BAD_IP_nt!_??_::FNODOBFM::_string_+43836

BUCKET_ID:  X64_0x50_BAD_IP_nt!_??_::FNODOBFM::_string_+43836

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x50_bad_ip_nt!_??_::fnodobfm::_string_+43836

FAILURE_ID_HASH:  {1238cc2c-f87a-7833-bbe8-ec5c8d1ba968}

Followup: MachineOwner
---------

 

[traderyoda]

Will do - it's back on now. I'll wait for the next BSOD and post. It might take a few days.

Thanks!
TY

 

[traderyoda]

Hi Arc... been a while because the machine has been running smoothly - no BSODs... until a few minutes ago when I got another one (minidump attached). Driver Verifier was running. It seems to be identifying "MsMpEng.exe" as the faulting process - I found it in the MSE folder. But you'll probably see more than I can make out in the dump file.

Cheers,
TY

 

[Arc]

BugCheck A, {fffffa86058ae5aa, 2, 0, fffff80002ecdd67}

Probably caused by : memory_corruption ( nt!MiPfnShareCountIsZero+77 )

Followup: MachineOwner
---------

If you apply RAMs in two slots only (either the black two or the yellow two) as a test, how does it run?

Sometimes some motherboards cannot do it properly with all the RAM slots occupied.

 

[traderyoda]

Originally the machine had 4GB (two 2GB sticks in two slots). I added another 4GB to occupy all four slots. Maybe this is the problem. When I encountered this problem I saw the memory fault and just decided to replace the RAM with 4 new sticks... this did not cure the problem.

I'll pull two sticks and load the machine up to see if I can generate another BSOD - will report back.

One question: do you think this might have something to do with running auto in BIOS in terms of RAM voltage and speed? These are 80MHz DDR2 RAM sticks. I've read that if you occupy 4 slots you should step back on the speed (to 667MHz) and manually set the voltage to the required voltage (2.1 in this case). I've also heard of people trying higher voltages to get the RAM stable. What do you think?