Solved Multiple BSoD's - ntoskrnl.exe

[Holy Dribble]

Hello,

So I've recently created my own custom build computer and have had multiple BSoD's to the point of me worrying frantically as to why they're reoccurring with higher frequency.

The activities I usually participate in which BSoD's happen are;

• Watching YouTube videos (sometimes have more than two open in separate Google Chrome tabs),
• Opening multiple tabs in Google Chrome (Not always the case - 13 tabs open as I'm typing this),
• Playing games such as League of Legends, RuneScape or Mortal Kombat,
• Leaving the computer idle/or in Sleep Mode.

I've tried;

• Re-installing Windows 7 Professional x64,
• Using BlueScreenView to identify the fault, finding that three of four BSoD's since re-installation of Windows were caused by "ntoskrnl.exe", whilst one was caused by "Ntfs.sys" and "ntoskrnl.exe",
• Running Memtest86+ for 9 Passes with no errors,
• Running a Visual Memory Stress test,
• Running Malwarebytes and CCleaner, along with avast Antivirus to no avail,
• Updating all known Drivers I can possibly think of (probably missing a ton),
• Checking for new Windows Updates - I have SP1, and there are no new updates available.

BSoD's so far; (This list by the looks of it is going to get much worse)

• 060614-16676-01.dmp - 06/06/2014 18:25:29 - SYSTEM_SERVICE_EXCEPTION - 0x0000003b
• 060714-15927-01.dmp - 07/06/2014 00:48:54 - MEMORY_MANAGEMENT - 0x0000001a
• 060814-18298-01.dmp - 08/06/2014 01:13:43 - NTFS_FILE_SYSTEM - 0x00000024
• 060914-15553-01.dmp - 08/06/2014 15:46:47 - PAGE_FAULT_IN_NONPAGED_AREA - 0x00000050
• 060914-17721-01.dmp - 09/06/2014 00:54:41 - PAGE_FAULT_IN_NONPAGED_AREA - 0x00000050
• 060714-15927-01.dmp - 09/06/2014 15:57:58 - MEMORY_MANAGEMENT - 0x0000001a
• 061014-13509-01.dmp - 10/06/2014 20:09:53 - MEMORY_MANAGEMENT - 0x0000001a
• 061114-16099-01.dmp - 11/06/2014 16:48:50 - PAGE_FAULT_IN_NONPAGED_AREA - 0x00000050

Side Note: I've been noticing Google Chrome Adobe Shockwave crashing regularly and tabs reverting to "Aw, Snap!", whilst games crash either mid-way, after automatic closure (League of Legends) or manual closure. I've even had League of Legends tell me my client files may be corrupt and ask me to repair my installation (has never had that issue before).

Something really is wrong, and I am at my wits end with this. All computer hardware components are new (except for speakers and my headset) and this has been happening daily for the past week.

If anyone can shed some light on the situation, (I'm not much of a computer guru) I'd be over the moon!

 

[Holy Dribble]

Seems I just had another BSoD, involving "ntoskrnl.exe" and "win32k.sys" with the Bug Check String "PAGE_FAULT_IN_NONPAGED_AREA" - 0x00000050

I was playing RuneScape whilst watching a YouTube video this time, about five tabs in Google Chrome (mostly this forum).

I updated the main post list of BSoD's, but I'll attach the .zip file made by dm log collector in this post as I don't know if replacing the old .zip will delete any information needed of the previous BSoD's.

 

[Holy Dribble]

Another BSoD, involving "ntoskrnl.exe" again with the Bug Check String "MEMORY_MANAGEMENT" - 0x0000001a.

Playing a game this time (had it crash mid-way twice before this BSoD happened) and was watching a streamer on Twitch.

Again, I'll post the updated .zip which still contains the old .dmp's. It seems if I do these activites, I can sort-of force a BSoD, but I'm adamant it's something to do with my GPU.

I've also uninstalled avast! Antivirus and installed MSE instead, it's been giving me some false positives on games and at the moment I am unsure if it was causing any of the BSoD's or not, so might as well play it safe.

Any help again is greatly appreciated!

 

[Thedoctor44]

Rather than posting again each time it is best that you update the original post as it gives us the impression that somebody is already helping you.

BugCheck 1A, {[COLOR="Red"]41790[/COLOR], [COLOR="Green"]fffffa8002027e20[/COLOR], ffff, 0}

The memory manager has detected page table page corruption.

7: kd> [COLOR="Green"]dt nt!_MMPFN fffffa8002027e20[/COLOR]
   +0x000 u1               : <unnamed-tag>
   +0x008 u2               : <unnamed-tag>
   +0x010 PteAddress       : 0xfffff6fb`40000390 _MMPTE
   +0x010 VolatilePteAddress : 0xfffff6fb`40000390 Void
   +0x010 Lock             : 0n1073742736
   +0x010 PteLong          : 0xfffff6fb`40000390
   +0x018 u3               : <unnamed-tag>
   +0x01c UsedPageTableEntries : [COLOR="Red"]0xffff[/COLOR]
   +0x01e VaType           : 0 ''
   +0x01f ViewCount        : 0 ''
   +0x020 OriginalPte      : _MMPTE
   +0x020 AweReferenceCount : 0n128
   +0x028 u4               : <unnamed-tag>

The page table count has actually fallen below zero which is normally caused by device drivers.

I think looking in the raw stack might give us a clue.

Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
 [COLOR="Red"]nvlddmkm+0xcbb01[/COLOR]

7: kd> [COLOR="Blue"]lmvm nvlddmkm[/COLOR]
start             end                 module name
fffff880`0f2e9000 fffff880`0ff4d000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        [COLOR="red"]Tue May 20 00:08:44 2014[/COLOR] (537A8EFC)
    CheckSum:         00C1EA41
    ImageSize:        00C64000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

These latest versions of Nvidia drivers have caused issues for some people.
Try rolling back your display driver.
These instructions are useful.

http://www.sevenforums.com/tutorials/327414-nvidia-drivers-avoid-problems.html?filter

My analysis on the Page Fault in Non Paged Area

BugCheck 50, {[COLOR="Red"]fffff800c2724f38[/COLOR], 0, [COLOR="Blue"]fffff960002feaae[/COLOR], 5}

Although these bugchecks normally indicate faulty RAM I am leaning towards software...

The faulting address being referenced stored in the 2nd control register before the page fault handler was called.

0: kd> [COLOR="Green"]r cr2[/COLOR]
cr2=[COLOR="Red"]fffff800c2724f38[/COLOR]

The address being referenced is invalid, so why would the system reference a memory address that isn't valid?
Well this isn't a Kernel Memory Dump so it's difficult to analyse the actual cause, we will work with what we have though.

0: kd> [COLOR="Green"]!pte fffff800c2724f38[/COLOR]
                                           VA fffff800c2724f38
PXE at FFFFF6FB7DBEDF80    PPE at FFFFF6FB7DBF0018    PDE at FFFFF6FB7E003098    PTE at FFFFF6FC00613920
contains 0000000000199063  contains 0000000000000000
GetUlongFromAddress: unable to read from fffff80002ef65dc
pfn 199       ---DA--KWEV  [COLOR="Red"]not valid[/COLOR]

Looking at the registers we can see that

0: kd> [COLOR="green"]r[/COLOR]
rax=fffff6fb7dbed000 rbx=fffff6fb7dbf0018 rcx=0000000000000050
rdx=fffff800c2724f38 rsi=0000000000000000 rdi=0000000000000000
rip=[COLOR="DarkOrange"]fffff80002cbebc0[/COLOR] rsp=[COLOR="Cyan"]fffff8800af90a58[/COLOR] rbp=fffff8800af90ac0
 r8=0000000000000000  r9=fffff8800af90bc0 r10=0000000000000000
r11=0000000000000000 r12=fffff6fb7e003098 r13=fffff800c2724f38
r14=fffff8800af90bc0 r15=00000000000001f0
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
nt!KeBugCheckEx:
[COLOR="DarkOrange"]fffff800`02cbebc0[/COLOR] 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff880`0af90a60=0000000000000050

fffff800`02cbebc0 dereferenced rsp which then creates a memory write to fffff880`0af90a60

Unfortunately most of the time the Page Table Entries aren't saved in minidumps as it hasn't with this one.

0: kd> [COLOR="Green"]!pte fffff880`0af90a60[/COLOR]
                                           VA fffff8800af90a60
PXE at FFFFF6FB7DBEDF88    PPE at FFFFF6FB7DBF1000    PDE at FFFFF6FB7E2002B8    PTE at FFFFF6FC40057C80
[COLOR="Red"]Unable to get PPE FFFFF6FB7DBF1000[/COLOR]

As a result of this hindrance I thought it would help looking at the loaded modules with the lm command.

Unloaded modules:
fffff880`07b06000 fffff880`07b77000   spsys.sys
fffff880`0506d000 fffff880`0507b000   crashdmp.sys
fffff880`0507b000 fffff880`05085000   dump_storpor
fffff880`04c9c000 fffff880`04f56000   [COLOR="red"]dump_iaStorA[/COLOR]
fffff880`05085000 fffff880`05098000   dump_dumpfve
fffff880`07b06000 fffff880`07b77000   spsys.sys
fffff880`07bb2000 fffff880`07bc5000   [COLOR="rgb(255, 140, 0)"]xusb21.sys[/COLOR]
fffff880`07b9f000 fffff880`07bb2000   [COLOR="DarkOrange"]xusb21.sys[/COLOR]
fffff880`07b06000 fffff880`07b77000   spsys.sys
fffff880`01ce5000 fffff880`01cf3000   crashdmp.sys
fffff880`01cf3000 fffff880`01cfd000   dump_storpor
fffff880`04ca4000 fffff880`04f5e000   [COLOR="Red"]dump_iaStorA[/COLOR]
fffff880`04f5e000 fffff880`04f71000   dump_dumpfve
fffff880`041ae000 fffff880`041b6000   UsbCharger.s

xusb21.sys has been known to cause issues which is a USB driver for your xbox controller.

http://www.carrona.org/drivers/search.php?id=xusb21.sys

You could try an update here but I recommend you remove the software.

Intel Rapid Storage Technology is installed which is known to cause a lot of issues that cannot be fixed apart from a removal of the drivers.

Uninstall it from Control Panel > Programs and Features. Then Uninstall the driver from device manager.

1. Right click on "my computer" icon and click "manage" on the context menu.
2. It will open the "computer management" window.
3. Select "Device Manager" in the left pane, It will list all the existing devices up.
4. Expand "Disc Drives" by clicking on the triangle in front of it.
5. Select one item under it, right click, uninstall.
6. Continue the process for all items under "Disc Drives"
7. Now restart the computer. At restart, windows will auto configure the appropriate system driver, msahci.sys.

You mention you ran a scan with Avast but I cannot see any traces of Avast on your system, I take it you removed it?

It's known to cause a lot of issues so if so then that's one step closer to victory

 

[Holy Dribble]

Sorry for the triple-post, I'll remember in future to keep it to one post if anything new comes along.

I did un-install avast! Antivirus as I've read countless posts saying it could cause problems, and the fact it was giving me false positives was a nightmare (wasn't prepared to make exceptions either).

I've uninstalled;

• Microsoft Xbox 360 Accessories 1.2 (Assuming that's the xusb21.sys driver)
• Intel Rapid Storage Technology and the drivers under "Disc Drives"

The issue I'm currently having is that on Step 3 of http://www.sevenforums.com/tutorials/327414-nvidia-drivers-avoid-problems.html?filter, there is no "NVIDIA" folder located in my "C" drive.
In fact, I've done a search to find no "NVIDIA" folder containing any "337.88" folder with the drivers inside anywhere on my computer. :huh:

Got "NVIDIA Corporation" folders dotted in places, but nothing in them relating to what I should be finding.
EDIT: My NVIDIA drivers update via my NVIDIA GeForce Experience, would that place the drivers elsewhere?

 

[Thedoctor44]

If there are no files on the C drive then leave that step, they normally don't do anything, it's not always necessary.

 

[Holy Dribble]

Right, so I've finally just got round to un-installing the latest NVIDIA drivers, but I've had two BSoD's before I had a chance to get round to this.

The reason I couldn't get them up onto the post as soon as they happened, is because;

• 061014-13509-01.dmp - 10/06/2014 20:09:53 - MEMORY_MANAGEMENT - 0x0000001a happened whilst a friend was over, playing Mortal Kombat and I decided to leave it until today to post it when I got home.
• 061114-16099-01.dmp - 11/06/2014 16:48:50 - PAGE_FAULT_IN_NONPAGED_AREA - 0x00000050 happened just before I was attempting to get on the website to post the previous results and backdate the NVIDIA Driver before the doorbell rang. (Goddamn it)

Anyway, bad luck aside, I'll post the updated .zip folder, keeping in mind that now NVIDIA drivers are backdated to 335.23 to see if that'll fix anything. Hopefully it'll reveal something else if there is anything!

Also, worryingly, Windows Update had apparently never checked for updates or installed updates on my machine. Checked for updates and got the twelve latest ones, but that did bother me a little. I've definitely installed updates before, so that's a mystery to me.


EDIT:
Another BSoD, was watching a streamer on Twitch and playing a game. This one apparently was caused by driver "dxgmms1.sys". Possibly related to the backdating of the NVIDIA driver, hope it isn't.

061114-23852-01.dmp - 11/06/2014 - PAGE_FAULT_IN_NONPAGED_AREA - 0x00000050

If I get a BSOD and upload the .zip file, can I overwrite the previous .zip in this post? Or will you lose information that could show a possible cause? Regardless for the current time, I'll upload it but not overwrite the previous.

In the meantime, I'm going to run Driver Verifier and see if I get anything out of it.

The new .zip is NEMESIS-PC-11_06_2014_182131_31. (Why is it less KB?)

 

[Thedoctor44]

At first I thought this would be a software issue but now it looks very much like bad RAM.

BugCheck 1A, {[COLOR="Red"]5003[/COLOR], fffff70001080000, 6a32, a321449}

This bugcheck indicates the memory manager found the working set free lists to be corrupt, this is actually mostly caused by bad RAM.
That's the first indication.

The second indication is again a 0x50 bugcheck which can be caused by bad RAM or failing software.
Due to the fact this is a minidump some Page Table Entries haven't been saved, so I can't do a full analysis.

BugCheck 50, {[COLOR="red"]fffff0a00fa66c08[/COLOR], 1, [COLOR="Blue"]fffff88001237900[/COLOR], 7}

fffff0a00fa66c08 was referenced by an instruction at fffff88001237900, but we can see that the address being referenced was stored in the 2nd control register before the page fault handler was called.

0: kd> [COLOR="Green"]r cr2[/COLOR]
[COLOR="Red"]cr2=fffff0a00fa66c08[/COLOR]

0: kd> [COLOR="green"]!pte fffff0a00fa66c08[/COLOR]
                                           VA fffff0a00fa66c08
PXE at FFFFF6FB7DBEDF08    PPE at FFFFF6FB7DBE1400    PDE at FFFFF6FB7C2803E8    PTE at FFFFF6F85007D330
contains 0000000000000000
[COLOR="Red"]not valid[/COLOR]

This shows us the address being referenced was invalid, as I said earlier I cannot check everything.

0: kd> [COLOR="Green"]r[/COLOR]
rax=fffff6fb7dbed000 rbx=fffff6fb7dbe1400 rcx=0000000000000050
rdx=fffff0a00fa66c08 rsi=0000000000000000 rdi=0000000000000000
rip=[COLOR="Red"]fffff80002c75bc0[/COLOR] rsp=[COLOR="Cyan"]fffff8800a606418[/COLOR] rbp=fffff8800a606480
 r8=0000000000000001  r9=fffff8800a606580 r10=0000000000000000
r11=0000000000000001 r12=fffff6fb7c2803e8 r13=fffff0a00fa66c08
r14=fffff8800a606580 r15=00000000000001e1
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
nt!KeBugCheckEx:
[COLOR="Red"]fffff800`02c75bc0[/COLOR] 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:[COLOR="Purple"]fffff880`0a606420[/COLOR]=0000000000000050

rsp was deferenced by fffff800`02c75bc0 which results in a complete memory write operation to this address fffff880`0a606420.

0: kd> [COLOR="Green"]!pte fffff880`0a606420[/COLOR]
                                           VA fffff8800a606420
PXE at FFFFF6FB7DBEDF88    PPE at FFFFF6FB7DBF1000    PDE at FFFFF6FB7E200298    PTE at FFFFF6FC40053030
Unable to get PPE FFFFF6FB7DBF1000

This is where the Page Table Entries weren't recorded so we can't see whether or not if this address is valid.

So with this being said I believe the best course of action is testing your RAM.


Memtest86 will test your RAM

   Information

Run Memtest86 for at least 8 passes so we get enough information to confirm that your RAM isn't failing

 

[Holy Dribble]

I've done the Memtest86+ once already for 9 passes, but I had all four RAM sticks in, so this time I'll test in their sets of two (8GB 2x4GB) and go on from there.

I'll let you know if I find anything this time. Thanks for the massive help though, I really do appreciate it!

EDIT:
Seems the first test I did missed it 9 times! Got halfway through the first pass this time around and it found errors. I'm just going to switch slots to 3&4 from 1&2 to double check it's not the slots, and then I'll test my other two RAM sticks for good measure.

Not fully solved yet, but once I do the last tests and really stress my computer for a few days, we'll know for sure!

Keep you updated!

 

[Thedoctor44]

Okay

 

[Holy Dribble]

So I've had a couple of days of testing fully, really stressing the computer without the faulty RAM and the computer not once BSoD'd.

Sent back the RAM and got a new set free of charge. Have only just received it today, but I can definitely conclude this whole problem is finally over and I'll be installing the new set later on this evening.

Thanks for all the help! You've saved my summer.