Solved BSOD's, WhoCrashed says ntoskrnl.exe

[bunabayashi]

Hi guys, PC noob builder here. 3 weeks ago I built up a gaming pc for my son (specs are in my profile for those interested). The build went very well considering it was my first time ever (prior to this my most adventurous attempt inside a case was switching out a bad video card). I used the tutorials from Newegg, and like I said the build & os install went pretty well. Shortly after original install & lots of automatic updates we began getting seemingly random BSOD's which I really couldn't figure out, so I took it to Geek Squad. They had it for several days and tested the crap out of each piece of hardware, could find no problems. Did a new install of the OS there and things are MUCH better, however I am still getting 1-2 BSOD's a day, and almost always overnight as the pc idles. I used Whocrashed, and a long string of crashes are attributed to ntoskrnl.exe:

example: On Sun 4/21/2013 7:43:41 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042113-20202-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x34 (0x50853, 0xFFFFF8800C2AE588, 0xFFFFF8800C2ADDE0, 0xFFFFF80002C81B05)
Error: CACHE_MANAGER
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a problem occurred in the file system's cache manager.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

I read the posts on the forum where others experienced similar problems pointing to ntoskrnl.exe, but before I jump in and start changing things I thought I would post my own thread and dump files to see what the experts think is the best way to solve this pesky issue. Thanks in advance, having read a big volume of posts I have to say this forum is completely awesome and the amount & quality of help offered is just fantastic.

If I need to provide any other info please let me know, Dave

[edit] by 'tested the crap out of', I mean memtest and stress tests as well as checking volatges and connections, they really went over it thoroughly and could find no issues.

 

[Arc]

Hello bunabayashi.

First make it sure that the firmware of SAMSUNG SSD 830 is up to date.
https://www.samsung.com/us/support/owners/product/MZ-7PC512N/AM

Then scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Let us know the results. Depending on those we will do the further troubleshooting, if needed.

 

[bunabayashi]

Thanks for the quick reply, I'm on it

 

[bunabayashi]

SSD firmware is up to date, TDSSKiller didn't find anything, going to run the Windows Defender Offline later today.

 

[Arc]

Also enable Driver Verifier to monitor the drivers, as the crash dumps are not stating anything clearly.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[bunabayashi]

Thank you, I will do that also overnight.

 

[bunabayashi]

May I ask why you say that the crash dumps are not stating anything clearly? I just would like to understand more

 

[Arc]

May I ask why you say that the crash dumps are not stating anything clearly? I just would like to understand more

Coz they are not stating anything clearly.

It is expected that the hint about a probable reason is included in the memory dump. It is not present there all the times, and in those situation DV is to be applied.

 

[bunabayashi]

all right, no worries

running DV now, Windows Defender Offline found no problems in full scan

 

[MrDismal]

Hi bunabayashi, just like to say I'm seeing a similar issue with my PC. I actually just posted up a post about 30 mins ago you'll see it in the list. I'll keep an eye on this thread.

 

[bunabayashi]

let me know how your sleuthing goes, with DV running it's blue-screened twice, hoping to get half a dozen or so before I post the results for analysis

 

[Arc]

Two will be enough. Disable DV first, then post it following the Blue Screen of Death (BSOD) Posting Instructions.

If needed, we will suggest for DV later again.

 

[bunabayashi]

Thanks!

 

[Arc]

The BSODs are caused by AMD/ATI display driver.

fffff880`07d0e538  fffff880`0494efa7Unable to load image \SystemRoot\system32\DRIVERS\[URL="http://www.carrona.org/drivers/driver.php?id=atikmdag.sys"]atikmdag.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=atikmdag.sys"]atikmdag.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=atikmdag.sys"]atikmdag.sys[/URL]
 atikmdag+0xe1fa7

and the driver is kinda old.

fffff880`0486d000 fffff880`05367000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
[COLOR=Red]    Image name: atikmdag.sys
    Timestamp:        Fri Apr 06 07:18:25 2012 [/COLOR](4F7E4B69)
    CheckSum:         00AABC48
    ImageSize:        00AFA000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update your ATI/AMD display driver.
You can get it from the link in our forum, http://www.sevenforums.com/graphic-...alyst-video-driver-windows-7-a.html#post17671, or you may go to AMD Graphics Driver and Software and opt for Automatically Detect and Install the appropriate driver for your card.

During installation, you may opt for advanced installation, and install the display driver only, not the Catalyst Control Center.

Also, as a test, test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

And Stress test the Graphics Card using Furmark.
Video Card - Stress Test with Furmark

Let us know the results.

 

[bunabayashi]

Ok, driver updated. I used the Catalyst software, according to the log it created, it installed vers. 9.012.0.0000

I'll start in on the stress tests now

Thanks!

 

[bunabayashi]

System seems to be much more stable, had a bsod overnight while the computer sat unattended (no stress tests or anything going on). In addition to the dump files I am attaching, I noticed that on restart an automatic update from Windows had occurred so I thought I would include those details also:

Definition Update for Microsoft Security Essentials - KB2310138 (Definition 1.149.463.0)

Installation date: ‎4/‎24/‎2013 3:27 AM

Installation status: Successful

Update type: Optional

Install this update to revise the definition files that are used to detect viruses, spyware, and other potentially unwanted software. Once you have installed this item, it cannot be removed.

More information:
Microsoft Security Essentials - Microsoft Windows

Help and Support:
Microsoft Security Essentials - Microsoft Windows

and also

Security Update for Windows 7 for x64-based Systems (KB2840149)

Installation date: ‎4/‎24/‎2013 3:00 AM

Installation status: Successful

Update type: Important

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article. After you install this update, you may have to restart your system.

More information:
Microsoft Security Bulletin MS13-036 - Important : Vulnerabilities in Kernel-Mode Driver Could Allow Elevation Of Privilege (2829996)

Help and Support:
Microsoft Support

Thank you for your continued help, Dave

 

[Arc]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

[COLOR=Red]BugCheck 24[/COLOR], {1904fb, fffff88005df00a8, fffff88005def900, fffff80002e705eb}

Probably caused by : ntkrnlmp.exe ( nt!RealSuccessor+1b )

Followup: MachineOwner
---------

According to Carrona.org, STOP 0x00000024: NTFS_FILE_SYSTEM
Usual causes: Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

Your physical memory is more than sufficient.

ITEM | VALUE
Installed Physical Memory (RAM) | 16.0 GB
Total Physical Memory | 15.9 GB
Available Physical Memory | 13.9 GB

So it should not be the problem. Still, for being sure, test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

The device drivers you use to control the storage are all the system drivers. So they should not fail,.

ITEM | VALUE
Driver | c:\windows\system32\drivers\atapi.sys
Driver | c:\windows\system32\drivers\msahci.sys
Driver | c:\windows\system32\drivers\atapi.sys
Driver | c:\windows\system32\drivers\atapi.sys

For a safety reason, run SFC /SCANNOW Command - System File Checker. If any of those drivers are corrupt, the scan will attempt to repair those.

Disable indexing.

• http://www.sevenforums.com/tutorials/25343-windows-search-turn-off.html
• http://www.sevenforums.com/tutorials/194374-indexer-backoff-enable-disable-windows-7-a.html

Your Antivirus is MSE. it is not the problem as it can be expected.

If you have any backup or defraging program installed, uninstall those.

Test the 2 TB HDD with Toshiba HDD Diagnostic Tools.

Try to change the SATA cables. Also try to change the ports to connect the SATA cables. Use the unused ports.

If still the problems exist, we have only two things to blame.

 

[bunabayashi]

Thank you for the quick reply. I ran the SFC /SCANNOW Command - System File Checker and it detected no problems. I Disabled indexing as instructed. I don't have any 3rd party backup or defragging programs installed, so no worries there.

When I went to the link noted above, I downloaded the 1st utility, Windows Diagnostic Tool Ver. 1.12
(For IDE/ATA/SATA Hard Drives). Interestingly, when I ran it (as Administrator), I would get the user interface as pictured below:

however, it would not allow me to 'select' the hard drive to check it, I could click anywhere and it wouldn't highlite the drive, add a check mark or whatever Toshiba does to indicate the drive is selected. Clicking Short Test or Extended Test would result in

I'm sure I'm doing something wrong but I can't figure out what that is. While I was fussing with that I got another BSOD, I have attached the info.

 

[Arc]

Thank you for the quick reply. I ran the SFC /SCANNOW Command - System File Checker and it detected no problems. I Disabled indexing as instructed. I don't have any 3rd party backup or defragging programs installed, so no worries there.

When I went to the link noted above, I downloaded the 1st utility, Windows Diagnostic Tool Ver. 1.12
(For IDE/ATA/SATA Hard Drives). Interestingly, when I ran it (as Administrator), I would get the user interface as pictured below:

however, it would not allow me to 'select' the hard drive to check it, I could click anywhere and it wouldn't highlite the drive, add a check mark or whatever Toshiba does to indicate the drive is selected. Clicking Short Test or Extended Test would result in

I'm sure I'm doing something wrong but I can't figure out what that is. While I was fussing with that I got another BSOD, I have attached the info.

You cannot select the Toshiba HDD? Try Seatool for dos: SeaTools | Seagate download. Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run. Seatools run on every HDD.

Also, as a test only .... uninstall MSE and use Avast free. It might be causing the fltmgr error.

Event[9428]:
Log Name: System
Source: Microsoft Antimalware
Date: 2013-04-24T03:59:05.000
Event ID: 3002
Task: N/A
Level: Error
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: Owner-PC
Description:
Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.
Feature: Network Inspection System
Error Code: 0x80070006
Error description: The handle is invalid.
Reason: The filter driver has successfully restarted.

 

[Britton30]

Here are a couple of tools to test your SSD.

It is the RED rectangle highlighted "Download" here: HDDScan It supports SSDs as well.


The freeware version is in tiny print at the bottom. SSDLife download page - freeware, professional and portable version downloads.