Solved ntoskrnl.exe BSOD about once a month, usually when booting

[tpattgeek]

This is my parent's PC. Built in April '11. Everything was fine for ~4 months then started getting random BSOD you'll find in the attachment. Since then, it happens randomly about once a month. It'll do it sitting idle, they'll reboot it, and it'll do it as soon as it's logging in. Reboot again, then it's fine for a month or so.

I checked the update history and several updates were installed about a month prior to the first BSOD. All drivers are up to date and this PC is really only used for webmail, skype, and typical browsing. I have identical software (avast AV, logmein, hamachi, etc.) installed on other machines with the same OS with no issues. I ran memtest for 3+ hours and Prime 95 (blend) for 2+ hours with no issues on either. My specs are:

Windows 7 Enterprise 64-bit - Retail
Asus P8H67-M Pro
Intel i5-2500K
4GB Mushkin Memory
On-board Intel HD3000 graphics
On-board audio
Seasonic S12-380 380W PSU
Logitech C270 webcam

 

[tpattgeek]

Bump... any ideas???

 

[writhziden]

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\tpattgeek\Windows_NT6_BSOD_jcgriff2\010812-12136-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02a17000 PsLoadedModuleList = 0xfffff800`02c5c670
Debug session time: Sun Jan  8 18:25:15.549 2012 (UTC - 7:00)
System Uptime: 0 days 0:40:44.782
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff9800646f988, 2, 0, fffff80002ab24af}

Probably caused by : memory_corruption ( nt!MiResolveProtoPteFault+13f )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff9800646f988, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ab24af, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cc6100
 fffff9800646f988 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiResolveProtoPteFault+13f
fffff800`02ab24af 488b00          mov     rax,qword ptr [rax]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  AvastSvc.exe

TRAP_FRAME:  fffff8800882c650 -- (.trap 0xfffff8800882c650)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff9800646f988 rbx=0000000000000000 rcx=0000000000000004
rdx=000000000007ac03 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ab24af rsp=fffff8800882c7e0 rbp=fffff8a000e2ec88
 r8=0000000000000000  r9=0000058000000000 r10=0000000073ddc858
r11=fffff68000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!MiResolveProtoPteFault+0x13f:
fffff800`02ab24af 488b00          mov     rax,qword ptr [rax] ds:fffff980`0646f988=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002a931e9 to fffff80002a93c40

STACK_TEXT:  
fffff880`0882c508 fffff800`02a931e9 : 00000000`0000000a fffff980`0646f988 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0882c510 fffff800`02a91e60 : 00000000`00000157 00000000`00000157 00000000`000001ff 00000000`7ac03121 : nt!KiBugCheckDispatch+0x69
fffff880`0882c650 fffff800`02ab24af : 80000000`891c6867 fffff680`00001bc0 fffffa80`019b5520 00000000`00000000 : nt!KiPageFault+0x260
fffff880`0882c7e0 fffff800`02ab1053 : 00000000`0009aa38 00000000`73ddc858 fffff680`0039eee0 fffffa80`06266ec8 : nt!MiResolveProtoPteFault+0x13f
fffff880`0882c870 fffff800`02aa0f19 : 00000000`73d52400 00000000`73ddc858 fffffa80`064a7e48 00000000`00000000 : nt!MiDispatchFault+0x1c3
fffff880`0882c980 fffff800`02a91d6e : 00000000`00000008 00000000`73ddc858 fffff880`0882cb01 00000000`0c49f604 : nt!MmAccessFault+0x359
fffff880`0882cae0 00000000`73ddc858 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0994e7b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x73ddc858


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiResolveProtoPteFault+13f
fffff800`02ab24af 488b00          mov     rax,qword ptr [rax]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiResolveProtoPteFault+13f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiResolveProtoPteFault+13f

BUCKET_ID:  X64_0xA_nt!MiResolveProtoPteFault+13f

Followup: MachineOwner
---------

PROCESS_NAME: AvastSvc.exe

While Avast may not cause blue screen errors on all systems, it is known to do so on some systems. Please uninstall Avast using avast! Uninstall Utility and replace with Microsoft Security Essentials - Free Antivirus for Windows to run with Windows Firewall.

panais also has put together this list of security software Good and Free system security combination. Give him rep for his hard work if you decide to follow it.

 

[tpattgeek]

I think I'd rather take my chances with Alwil. But thanks for the response! Where exactly did you find that excerpt?

 

[writhziden]

I think I'd rather take my chances with Alwil. But thanks for the response! Where exactly did you find that excerpt?

It's listed in the debugging file I provided within the code. It's about midway down if you scroll using the sidebar.

 

[tpattgeek]

How come I was only seeing ntoskrnl.exe in ALL of my dmp's? I was using bluescreenview. What is that you're using?

 

[writhziden]

How come I was only seeing ntoskrnl.exe in ALL of my dmp's? I was using bluescreenview. What is that you're using?

ntoskrnl.exe is often blamed by bluescreenview since it is an important system file that runs over the top of most of the system. We use Windbg on these forums because it is developed by Microsoft and gives more details on possible causes.

 

[tpattgeek]

Perfect, thanks so much.

 

[writhziden]

No problem. Let us know if you need further assistance.

 

[tpattgeek]

I may need assistance with a different issue, but that's another thread.