BSOD Win7 Pro 64bit - ntoskrnl.exe??

pskierczy · Nov 13, 2010

Hi,

Lately I've build new system and almost from begin have some problems with BSOD.
First was solved by rising voltage for my RAM. and evrything was OK.

But yesterday I try tu update my Windows, and when instalation (after downloading and reboot) rach 35% first BSOD appeard ;/ and then was just worse. It take me a lot of time to "undo" upgrades. And then Windows log in, but then stuck...i wasn't able to do anything, just move the mouse pointer. So I checked my HDD and RAM (ESTools(samsung) and memtest86+) and got no errors.

I manage (don't know how exacly), and decided to post there my BSOD reports...

PS. BSOD View showed that problem was caused by ntoskrnl.exe, but as I read some posts it may be wrong.

What may casuse this BSODs??
Sorry for any mistakes

Jonathan_King · Nov 13, 2010

Start by removing SPTD with this tool: http://www.duplexsecure.com/download/SPTDinst-v174-x64.exe

Code:

sptd.sys         Tue Aug 24 02:13:12 2010 (4C7362F8)
ah7zmub2.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
a2pa1zf3.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
advypt8v.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
af10l466.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
aoz71d5a.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
aw1mhyej.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
axp5fjk9.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
awm568tg.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
a00mtprf.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)
ad7n1ok0.SYS     Tue Jul 14 17:12:55 2009 (4A5CF4D7)

Remove Gigabyte's Easy Saver program as well:

Code:

gdrv.sys         Thu Mar 12 23:22:29 2009 (49B9D175)

Also, remove McAfee, and Comodo:

Code:

cmderd.sys       Fri Sep 10 18:07:24 2010 (4C8AAC1C)
cmdguard.sys     Fri Sep 10 18:07:10 2010 (4C8AAC0E)
cmdhlp.sys       Fri Sep 10 18:06:39 2010 (4C8AABEF)

Install these updated Realtek NIC drivers: Realtek

Install these updated JMicron SATA drivers: ftp://driver.jmicron.com.tw/SATA_Controller/Windows/JMB36X_WinDrv_R1.17.59_WHQL.zip

If the BSODs persist, enable driver verifier: http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

...Summary of the dumps

Code:

[font=lucida console]
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Sat Nov 13 01:28:50.059 2010 (UTC - 5:00)
System Uptime: 0 days 0:01:27.355
Probably caused by : ntkrnlmp.exe ( nt!RtlpCoalesceFreeBlocks+205 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x3B
PROCESS_NAME:  WerFault.exe
FAILURE_BUCKET_ID:  X64_0x3B_nt!RtlpCoalesceFreeBlocks+205
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Sat Nov 13 01:26:49.671 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:58.966
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+21bc6 )
BUGCHECK_STR:  0x1a_5003
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  dw20.exe
FAILURE_BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+21bc6
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Fri Nov 12 06:44:25.354 2010 (UTC - 5:00)
System Uptime: 0 days 0:01:02.790
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29731 )
BUGCHECK_STR:  0x1a_5003
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  atieclxx.exe
FAILURE_BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+29731
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Fri Nov 12 06:37:00.482 2010 (UTC - 5:00)
System Uptime: 0 days 0:01:19.918
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+1feaa )
BUGCHECK_STR:  0x1a_5005
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  xRaidSetup.exe
FAILURE_BUCKET_ID:  X64_0x1a_5005_nt!_??_::FNODOBFM::_string_+1feaa
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Fri Nov 12 06:34:22.480 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:51.916
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+3683c )
BUGCHECK_STR:  0x1a_5003
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  svchost.exe
FAILURE_BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+3683c
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Fri Nov 12 06:29:54.576 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:41.012
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+21b46 )
BUGCHECK_STR:  0x1a_5003
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  cmdagent.exe
FAILURE_BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+21b46
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Fri Nov 12 06:15:02.933 2010 (UTC - 5:00)
System Uptime: 0 days 0:01:22.229
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+409b4 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0xBE
PROCESS_NAME:  WerFault.exe
FAILURE_BUCKET_ID:  X64_0xBE_nt!_??_::FNODOBFM::_string_+409b4
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Fri Nov 12 06:12:39.383 2010 (UTC - 5:00)
System Uptime: 0 days 0:01:03.819
Probably caused by : memory_corruption ( nt!MiSwapWslEntries+6a )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  svchost.exe
FAILURE_BUCKET_ID:  X64_0x50_nt!MiSwapWslEntries+6a
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Nov 11 04:59:39.242 2010 (UTC - 5:00)
System Uptime: 0 days 0:02:50.537
Probably caused by : memory_corruption ( nt!MiSwapWslEntries+6a )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  WerFault.exe
FAILURE_BUCKET_ID:  X64_0x50_nt!MiSwapWslEntries+6a
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Nov 11 04:46:41.770 2010 (UTC - 5:00)
System Uptime: 0 days 0:03:54.456
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4a89 )
BUGCHECK_STR:  0x1a_41289
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  WerFault.exe
FAILURE_BUCKET_ID:  X64_0x1a_41289_nt!_??_::FNODOBFM::_string_+4a89
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  
[/font]

pskierczy · Nov 13, 2010

Ok, but why Comodo?? It's my Internet Security Software and can it make such as big probems??
I need SPTD for DeamonTools, so when I remove it I should also remove Deamon because it will be useless ;/
And even more interesting for me is why drivers delivered with MOBO can cause BSOD...

really this common used programs cause BSOD??

What IS or antyvir you recommend?? Is windows firewall good enough?

But OK

Thanks a lot by now.
To check stability i will use:
Prime95 and OCCT Perestroika.
anything else??

Jonathan_King · Nov 13, 2010

Yes, do remove Daemon Tools. Here is a bunch of threads you can see where STPD caused BSODs:

Solved: I had a BSOD - PC Help Forum
Bsod: System_service_exception - Tech Support Forum
Asus G51jx-A1 BSOD bccode c5 - Tech Support Forum
[SOLVED] Yet Another BSOD help me thread... - Tech Support Forum
[SOLVED] Random BSODs - Tech Support Forum
Unknown Crashes
BSOD - different reasons (IRQ_NOT_LESS_OR_EQUAL, RTCore32, atacpi, etc) - Tech Support Forum
Win 7 BSOD, Daily + Randomly - Tech Support Forum

3rd-party security products, including anti-virus and firewalls, are notorious for causing BSODs. Since Comodo (cmdagent.exe) was running in one of the dumps, it might not hurt to remove it. Remember, once the BSODs are over, you can install Comodo again if you wish.

Microsoft Security Essentials, and the Windows firewall, are what I recommend: http://www.microsoft.com/security_essentials

pskierczy · Nov 15, 2010

Hi,

I remove or upgade all things that Jonathan_King described.
And I got another 2 BSOD. One appeard when I was using computer for about 10-15mins, while using Firerox, another when system was starting (after desktop shown while loading other drivers and stuff I think).

Maybe it is important - I'm using Win7 dowloaded from MSDNAA server.

----------edit--------
Scan with ESTool and memtest86+ (both newest versions) didn't show any errors.
After second BSOD I ran windows memory diagnostic tool (not sure about english name of this program) from system startup menu (F8 while booting) and got some memory errors

zigzag3143 · Nov 15, 2010

pskierczy said:
Hi,

I remove or upgade all things that Jonathan_King described.
And I got another 2 BSOD. One appeard when I was using computer for about 10-15mins, while using Firerox, another when system was starting (after desktop shown while loading other drivers and stuff I think).

Maybe it is important - I'm using Win7 dowloaded from MSDNAA server.

----------edit--------
Scan with ESTool and memtest86+ (both newest versions) didn't show any errors.
After second BSOD I ran windows memory diagnostic tool (not sure about english name of this program) from system startup menu (F8 while booting) and got some memory errors

You didnt remove all the things Jonathan_King recommended. You are still running daemon tools/alcohol120. He is correct--you need to remove itand till you do we cant find the real cause.

These were caused by memory corruption probably because of it. You hace to remove it if you want the BSOD's to stop.

Nine of 13 are directly tied to memory corruption. It may not show in Memtest because you arent running them when you tested.

Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads
[/quote]
You can use MagicDisc as an alternative.

Freeware MagicISO Virtual CD/DVD-ROM(MagicDisc) Overview

Code:

[COLOR=Red][B]sptd.sys        fffff880`011aa000    0x0015d000    8/24/2010 01:13:12            0x4c7362f8    fffff880`0104d000     [/B][/COLOR]

Also you still are running COMODO. Until its gone and sptd.sys are you WILL keep having BSOD's

What is cmderd.sys ? Description COMODO Internet Security Eradication Driver C:WINDOWSsystem32driverscmderd.sys

Code:

[COLOR=Red][B]cmderd.sys        fffff880`013fd000    0x00009000    9/10/2010 17:07:24            0x4c8aac1c    fffff880`013f4000                
cmdguard.sys        fffff880`03eac000    0x00042000    9/10/2010 17:07:10            0x4c8aac0e    fffff880`03e6a000                
cmdhlp.sys        fffff880`03f6c000    0x0000b000    9/10/2010 17:06:39            0x4c8aabef    fffff880`03f61000          [/B][/COLOR]

pskierczy · Nov 15, 2010

Sorry, but I remove it... using unintallers (SPTD and Demon).
Maybe I should remove older dump reports. And I should mention that last two or three are up to date.
And please tell me If i'm running windows memory diagnostic tool its DOS-like so i think that none of windows programs and drivers are loaded. Why it shown errors??
And another curious thing - why I got BSOD while installing windows upgrades??

I also have used CCleaner to clean my registery, but I did it after my last post. But i checked my todays dump reports using "BlueScreenView" and couldn't find files/drivers you mentioned: comodo and SPTD.
Of course I can be wrong

PS. Only two newest - today one - dump reports are updated. Should I rebuild this report and post it again??

Jonathan_King · Nov 16, 2010

CCleaner deletes dump files, so please don't run CCleaner again until this is sorted out.

There was a bit of a confusion with your last report. If the BSODs persist, could you upload a new report, and we'll go from there?

pskierczy · Nov 16, 2010

I have unchecked deleting dump files, so I got them all. But I think that good idea is to delete all dump files because if I got BSOD again it will be easier to analize, right?

Jonathan_King · Nov 16, 2010

Well we can usually tell which dumps to run by their dates, and comparing them to your last posting date, but in this case it won't hurt anything, because your old dumps are "backed up" in previous attachments, in case we want them.

We just don't like to receive a BSOD report, and it turns out there are no dumps in it because CCleaner gets them every time the machine reboots!

pskierczy · Nov 16, 2010

So I should remove it from my system (CCleaner) or just do not run cleaning??

Jonathan_King · Nov 16, 2010

As long as it's not running, I guess it doesn't matter whether it is installed or not. To save you the trouble of reinstalling it later, go ahead and keep it installed.

pskierczy · Nov 17, 2010

Hi,

Another BSOD. In short:
-system was running for about 12-20h since my last post,
-I was using my computer for playing (Titan Quest) and watching .mkv movies, and everything was OK.
-for night i turned off monitor(rather do not important) but uTorrent was working,
-in the morning when I turned on the monitor BSOD was already here. (system rebooting is turned off so I'm not sure whet it appears)

after restarting system 3 aps - Catalyst Center(ATI), GG (polish mesanger) and Nokia PCSuite - shown errors (not sune what errors. but I think smth about acces errors).

And, what might be important, firefox is crashing from time to time (yesterday 3-5 times) and today once by now.

Any ideas.

-----------------------EDIT
Hi again.

I'm pretty sure that ATi graphics drivers may cause this BSODs... but I cannot update them, I don't know why...

Whats more recently prompt about checking orginality of my OS shown, so I download and install "Windows Activation Update" and run it. And I got error message - Instalation of upgrades(actialization(?)) failed. Error info - 0xC80003FA.
And just minutes after I got prompt to reinstall system again...
What is happening??

Jonathan_King · Nov 18, 2010

Where did you get your copy of Windows 7?

Remove Easy Saver:

Code:

gdrv.sys         Thu Mar 12 23:22:29 2009 (49B9D175)

Download these ATI drivers I extracted: 2shared - download 10-7_vista64_win7_64_dd.zip

Manually point Device Manager to them, to install them: http://www.sevenforums.com/tutorials/97061-driver-install-device-manager.html

A RAM test isn't a bad idea either: http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

...Summary of the dumps

Code:

[font=lucida console]
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Wed Nov 17 02:35:00.034 2010 (UTC - 5:00)
System Uptime: 1 days 19:13:39.455
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4a89 )
BUGCHECK_STR:  0x1a_41289
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  audiodg.exe
FAILURE_BUCKET_ID:  X64_0x1a_41289_nt!_??_::FNODOBFM::_string_+4a89
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  
[/font]

pskierczy · Nov 18, 2010

Because of yesterday prompt of "illegal OS" I reinstall Win7... By now everything seems to be OK. But I install drivers and apps carefully - MS Security Ess. instead od Comodo, no Deamontools, just drivers directly from producer site, not from CD and only drivers withoud strange programs such as Easy saver.

So Thank you very much for your patience and help.
Still I'm not sure what exacly cause this BSODs but if somehow I find it out I'll give you info.

One more thanks,
You're awsome.

Jonathan_King · Nov 18, 2010

Alright, if the BSODs persist, don't hesitate to post again.

pskierczy · Nov 24, 2010

Hi again,

BSOD still appears. But I think that they're caused by RAM. By now I'm doing long (8-10h) tests.
I got another question. Lately I got "serious" problem - Windows wasn't able to find some files. I was wandering if RAM problems can make such as "couldn't find file" problem?? Another one is that instead of "windows/system32/<file_name>" there were "windows/qystem32/<file_name>". I think - register error. Could it be caused by CCleaner register cleaning or rather somekind of virus (i was running MS Essential)?

Sorry for such as messy post

Jonathan_King · Nov 24, 2010

Where did you get your copy of Windows 7?

To test for a RAM problem, see this tutorial: http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

pskierczy · Nov 25, 2010

I got my windows copy from msdnaa server

(my university gave us such as possibility).

What about RAM tests. By now I've already tested:
Slot 2 (counting from CPU [let call them from DDR_0 to DDR_3) and both RAM sticks (tested al least for 6h - 17 passes). And got no errors. Earlier with both sticks pluged (slots DDR_1+DDR_3) and 9h test i got errors...

Can it influence the test results that I got bad timings settings (7-7-7-24) instead of (7-7-7-20) when testing both RAM sticks??

Jonathan_King · Nov 25, 2010

What is the model of your motherboard and RAM?

BSOD Win7 Pro 64bit - ntoskrnl.exe??

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

Account closed by request

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer