BSOD randomly strikes when gaming, "ntoskrnl.exe"?

[toastygstar]

Hello everyone, this is the first time i have ever posted in a tech support forum but this one has really got me baffled so any help will be most appreciated.

I have followed the instruction and posted the files here . Or if you prefer to download them from the site i have figured out how to attach them.

Unfortunately sometimes it does not actually BSOD so no dump is recorded, however by luck i saved one to documents a few days ago and i put that in a folder entitled "olddump".

After interrogating that one and the two that followed (unfortunately those ones are lost) i believe the error has something to do with ntoskrnl.exe something about symbols not found, looking around on google hasn't dug anything i can use up so if anyone can point me in the right direction would be great!

I first started getting errors whilst playing battlefield 3, i can usually play bf3 reasonably with no lag, get the odd crash but these ones were different and ended up in a restart or bsod, the problem is and why i am so sketchy is the errors occurred extremely randomly, and sometimes after extended periods of gametime.

It wasnt too much of an issue and i didnt give it much thought until i tried to play the guild wars 2 beta weekend, then i was hit with almost constant BSOD 1 or 2 minutes into getting in, this one was alot easier to pinpoint and after a few restarts i worked out it was FRAPS that was causing the problems, i disabled and it worked fine.

In between this i was playing Age of Empires 3 on-line with no problems at all.

When the BWE3 finished i gave my computer a spring clean, clearing out all dust, getting rid of all the "crap" i didnt need, removed all my old fraps videos and gave it a defrag, disk cleanup, full virus scan, i defiantly noticed the difference.

I began playing Empire Total War and i received a number of BSOD, also some crashes which froze my computer and what i can only describe as gave a "blind" effect on the screen, the sound turned into a "hum"?

I had a previous problem like this with my RAM so i did a memtest, it detected no errors at all. I have 1 stick of DDR3 RAM 4GB which i am unable to change at present.

Last night i did every scan i possibly could, i ran a chkdsk, defrag, sfc scan, full virus scan, registry clean.. yet when i get back into Empire Total War this afternoon exactly the same thing although this time it just shut down.

I have been monitoring temperatures at idle for the past week now and the temps rarely go above 42 idle and are quite consistent (GPU stays under 40), as i say fans are cleared of dust and can confirm they are all spinning.

I think it is graphical related simply because it only happens when i play video games although the "ntoskrnl.exe" i got from the dump file makes me think it may be some NT coding, i am really not sure?

Over the period of the errors i have done the following;

- updated my graphic card to the latest drivers
- carried out various scans/cleanups
- searched google to try and find what is wrong with limited success
- i have even tried gently shaking my desk incase something was loose or faulty
- removed/put back different USB (printer etc.) to see if that made a difference

I did notice whilst playing movies from DVD, it would freeze at specific points, no big deal but it froze my whole computer for a good 5 minutes when i tried to move on, maybe related maybe not.

Things i am unable to do

- Buy/change hardware , unfortunately this is not possible at present although i am looking at purchasing more RAM.

Things i am unwilling to do

- Windows reinstall, i really would like to keep this as a last last resort, simply because the amount i would have to backup, i really dont have the time or patience although if it is the only option then i will obviously consider it.

Things i am going to try

- another ckhdsk, i did one but not sure i did it correctly, i tried to do one while posting this but had to exit it due to lagging my pc
- paying different games to really isolate the issue
- get another BSOD so i can grab the newest minidump

Before i posted this i unlocked the forth core of my processor to see if it would help.

It may be something simple that i am missing, im not sure but it has been doing my head in for two days now and i think a fresh pair of eyes wouldnt go a miss!

I am really new towards all of this.

Thanks in advance

- Andrew

Specs (also in .zip file)
AMD Phenom(tm) II X4 B40 Processor
DDR3 4GB RAM
AMD Radeon HD 6700 Series

 

[toastygstar]

-update- after some real troubleshooting i am of the view its the cooling on my PC which is very unfortunate.. very odd, when i loaded up my total war the temps shot up from around ~40 to nearly 60 (i think my pc cuts out at around 60/70), my GPU which increased greatly in temperature, i guess the fans are working, just not how they should be.

I think it is my GPU fan though, because it didn't stabilise, it just kept increasing and when i closed down the application it decreased back down to 40, with my CPU at a stable 45.

Will be helpful if the mods could keep it in this forum until i have confirmed the issue, maybe someone would be able to confirm it anyway from the logs, i don't know.

I am wondering if it has anything related to the overpower feature that comes with the control centre thing for my graphics card, i recently disabled overpower/clocking thing as i dislike the whole thing and i never even knew it was switched on! Will try and update tomorrow or tonight depending how bothered i can be to lug my box out

 

[karlsnooks]

WIN | type %windir%\minidump

What do you see? do you see several files listed? How many?

WIN = key with microsoft logo on top.

 

[toastygstar]

Thank you for the response, and yes i do, it is showing now something to do with "ataport.SYS" which i will start looking at now, the one last night did not have a bsod it just went straight into restart, regarding temps i launched a game (lotro, a mmo) and went into the game on ultra high, and the temp is alot more stable, the same one i tested it on last night..

edit: the file attached is the only dmp showing, i believe it is from the crash last night, although it wasnt bsod...

 

[karlsnooks]

how many files do you see in %windir%\minidump?

 

[toastygstar]

Only the one i posted here.

 

[karlsnooks]

toasty,
I need you to read very carefully this writeup and make sure that all settings are as specified. Right now I can tell that at least one setting is wrong.

[FONT=&quot]MEMORY DUMPS - REQUIREMENTS[/FONT]


Enable automatic management of the Paging file
WIN + PAUSE/BREAK key combo |
Advanced system settings (left-hand side) |
Advanced tab, Performance section, Settings |
Advanced tab, Virtual Memory section, Change |
checkmark Automatically manage paging file size for all drives |
OK | OK | OK



STARTUP AND RECOVERY SETTINGS
WIN + PAUSE/BREAK key combo |
Advanced system settings (left-hand side) |
Advanced tab, Startup and Recovery section, Settings |
System Failure section | checkmark Write an Event to the system log
| uncheck Automatically restart |


Under Write debugging information, select Small memory dump |
in the Small dump directory: box, enter %SystemRoot%\Minidump| OK

If Overwrite any existing file is checked, then:
Ø Under Write debugging information, select Kernel memory dump
Ø Uncheck Overwrite any existing file
Ø Under Write debugging information, select Small memory dump
Ø OK button
If you get a crazy message from Win 7 about your paging file being too small, then just ignore the message since we have already made sure that the paging file is set to be managed by Win 7.

ENABLE THE WINDOWS ERROR REPORTING SERVICE
WIN key | type SERVICES.MSC | ENTER |
Scroll down to Windows Error Reporting Service |
Rt-clk on Windows Error Reporting Service | Properties |
General tab | for Startup type, choose Automatic |
In Service status, Start button (unless grayed out) | OK


ASSURE THAT CCLEANER IS NOT DELETING DUMPS
CCLEANER | Cleaner icon | Windows tab | System category |
Uncheck Memory Dumps
· WINDOWS ERROR REPORTING SERVICE must NOT be disabled!
· WIN | Services.msc | Enter
· Under Name, locate Windows Error Reporting Service
· If Status is not Started, then
Right-click on Windows Error Reporting Service |choose START
· If Startup Type is not Automatic, then
Right-click on Windows Error Reporting Service |
choose Properties | General tab |
set Startup type to Automatic
· Close Services.msc (I like to use ALT + F4)

After a crash, the minidump file will be in %SystemRoot%\Minidump
%SystemRoot% is generally C:\Windows

 

[toastygstar]

I will do that, i just recovered from another crash, i had the game i mentioned running in the backround and it shut down without anything, will get back to you shortly and once again thank-you.

 

[toastygstar]

okay i will number the paragraphs so it will be easier for you to see what i have corrected.

1) It was already ticked
2) Corrected, i wasnt too sure about the check box of the overwrite existing file bit, although it was already ticked but i left it at what is was (kernal with overwrite ticked), i corrected the dmp path which appeared to be going to an actual file? Was odd
3) It was disabled for some odd reason.... started it up
4) I dont have CC cleaner, the only thing i have liked that was bundled with my AVG.. PC tuneup or something like that, which is i can imagine what has been changing all this? I know with tuneup thing it only deletes that stuff when i tell it to.

Am going to hit a restart and hope it will now report, will start a game up when it boots and see if i can "force" the error again.

 

[toastygstar]

Okay i managed to get another error quite soon after going into the game, it is defiantly showing similarities to Empire Total War, Battlefield 3 etc.

I checked the minidump and nothing, took a photo of the crash, here . And nothing in event log, only a critical power failure.

This is baffling me...

 

[karlsnooks]

Uplooad the minidumpsettings.txt file that the script puts on your desktop.

# **********************INSTRUCTIONS**************************
# STEP 1 ** RUN POWERSHELL AS ADMINISTRATOR ******************
# ************************************************************
#
# WIN key | type POWERSHELL | do NOT hit ENTER |
# in the PROGRAMS list, right-click on WINDOWS POWERSHELL |
# choose "Run as administrator" |
# Click on the YES button (if such appears)
#
# WIN key = key with Microsoft log on top
#
# for the guru:
# WIN | type POWERSHELL | CTRL+SHIFT+ENTER key combo | ALT+Y keycombo
# ************************************************************
# STEP 2 ** COPY AND PASTE ***********************************
# ************************************************************
#
# COPY the script using CTRL+C,
# COPY every line of script down thru both EXIT statements
#
# PASTE into Powershell
#----Right-Click at the PowerShell Prompt
#----(Ctrl+V does not work)
#
# Start copying with first script line without a # at start of the line
# Note: Actually, you can paste the entire file if you rather
#-------Lines starting with a # are ignored by PowerShell
# ************************************************************
# STEP 3 ** SCRIPT OUTPUT & SCRIPT PURPOSE *******************
# ************************************************************
# --The script output and purpose is given at the very front of the script
#
# --The script output and purpose is given at the very front of the script
#
# ************************************************************
# ***************** NOTE - POWERSHELL VERSION*****************
# if you receive this error msg:
#--The system can not find the path specified
# you may need to update your PowerShell
# you must be using Powershell 2.0 or later.
#
# To determine your Powershell version:
#---Run PowerShell
#---enter $host.version
#---you should see at least:
# Major Minor Build Revision
# ----- ----- ----- --------
# 2......0......-1.....-1
#
# If you do not see the above, update your Vista/Win 7.
# ************************************************************
# *************** NOTE - EXECUTION POLICY*********************
# If you haven't set the execution policy, you may need to:
#---Run PowerShell
#---enter SET-EXECUTIONPOLICY -EXECUTIONPOLICY REMOTESIGNED
# ************************************************************

# **************************************************************
# Puts MiniDumpSettings.TXT in your user profile folder
# WIN | type %userprofile%\ then click on MiniDumpSettings.TXT
# to view the important minidump settings
# WIN = key with Microsoft logo on top
# **************************************************************
gwmi Win32_OSRecoveryConfiguration | 
select minidumpdirectory, expandedminidumpdirectory,overwriteexistingdebugfile,kerneldumponly,`
debuginfotype,autoreboot,writedebuginfo,writetosystemlog > $env:userprofile\minidumpsettings.txt

EXIT
EXIT

 

[toastygstar]

minidumpdirectory          : %SystemRoot%\Minidump
expandedminidumpdirectory  : C:\Windows\Minidump
overwriteexistingdebugfile : True
kerneldumponly             : False
debuginfotype              : 2
autoreboot                 : False
writedebuginfo             : True
writetosystemlog           : True

It wasnt a huge file so i hope its okay if i just put it here.

edit: also just a note the minidump folder icon has a "lock" symbol on it, suggesting it has some form of permissions on it, wild guess here but could it be something to do with my pc not having the permission to put one in, strange i know but my reason is i get some in there, but the last two crashes i have had nothing.

Very.. random.

 

[toastygstar]

Please accept my apologises in multiple posts but i am trying to get a grip on it

I discovered where the dumps were being saved, it appears it would go to one file "memory.dmp" in windows folder and overwrite on each event, it stated the same "problem"

Probably caused by : ataport.SYS ( ataport+51e8 )

This has been saved at 01:45 UTC +1 which is strange as my PC operates in a GMT timezone?

But i cannot upload it as the file is huge, 374MB?? that cannot be right?

 

[karlsnooks]

toasty,
I want you to go back over that procedure I gave regarding minidump settings and this time, don't think, just follow the instructions given there.

After doing that and after rebooting, run that script again. Let's see if this time its correct.

Your "lock" symbol I don't understand, but we will get to that.

 

[karlsnooks]

Please accept my apologises in multiple posts but i am trying to get a grip on it

I discovered where the dumps were being saved, it appears it would go to one file "memory.dmp" in windows folder and overwrite on each event, it stated the same "problem"

Probably caused by : ataport.SYS ( ataport+51e8 )

This has been saved at 01:45 UTC +1 which is strange as my PC operates in a GMT timezone?

But i cannot upload it as the file is huge, 374MB?? that cannot be right?

The reason for the huge file is because you didn't carry out the procedure I gave precisely.

Don't worry about the timezone thing.

 

[toastygstar]

toasty,
I want you to go back over that procedure I gave regarding minidump settings and this time, don't think, just follow the instructions given there.

After doing that and after rebooting, run that script again. Let's see if this time its correct.

Your "lock" symbol I don't understand, but we will get to that.

I followed it to the letter, this file was there prior to me doing that, i just "dug it up".

I can go back over it again if you like, but i am pretty sure i followed it exactly, the only thing i never did was reboot .

 

[karlsnooks]

I'm rather sure that you didn't. That's why I gave you that script to run. That script lets me know if the settings are as specified.

 

[toastygstar]

I'm rather sure that you didn't. That's why I gave you that script to run. That script lets me know if the settings are as specified.

I did go back over it, and where the dmp file is being output has changed... which is odd considering the script said it was something else,

I have set it to visit "%SystemRoot%\minidump" for the second time. But your script pointed to that anyway, which is why i am confused.

And you will have to forgive me, i do not know where i have gone wrong, it may well be i have misunderstood your instructions. And it would be helpful if you could point out where it is that is wrong,

If Overwrite any existing file is checked, then:
Ø Under Write debugging information, select Kernel memory dump
Ø Uncheck Overwrite any existing file
Ø Under Write debugging information, select Small memory dump
Ø OK button

This is the bit i am unsure about, my understanding was that if overwrite existing files was checked, keep Kernel memory dump.

If not then uncheck and change it to small memory dump?

 

[karlsnooks]

I can't say it any simpler. Whether it makes sense or not, If you follow the directions precisely, then all will be correct.

After carrying the procedure out just as written, then run the script again and upload the file.

thanks,
karl

 

[toastygstar]

minidumpdirectory          : %SystemRoot%\Minidump
expandedminidumpdirectory  : C:\Windows\Minidump
overwriteexistingdebugfile : False
kerneldumponly             : False
debuginfotype              : 3
autoreboot                 : False
writedebuginfo             : True
writetosystemlog           : True

I hope this is the correct output, as i said i believe i misunderstood that specific part of your instructions, i thought the red bullet point was eluding to something else as i couldn't gather why it was needed to select Kernal Memory then Select it to Small Memory dump.

If this is incorrect then i am sorry, maybe i am tired....