ntoskrnl.exe BSOD randomly

[moieu]

I started getting the ntoskrnl.exe bsod a long time ago, then I replaced my ram with the new 16gb ram after running a memtest and it solved all my problems. Just last week I started getting the problems again. I've ran 8 tests on memtest and they've all passed, and I've checked my hdd with SeaTools for Windows, and that had no problems. I then reset my computer to factory settings and stopped having the problem for a day. The next day I started getting the bsods again. I flashed my bios to the latest version because I read that outdated bios could sometimes cause problems, and I'm still getting the bsods. It's usually never on startup. It's mainly after I start a program or when everything starts loading after I log in. But sometimes it'll happen randomly as I'm playing games.

 

[koolkat77]

Welcome to the Forum.

Please complete the steps below.

Based on the bugchecks, I would recommend you follow and complete the steps given below:

1. If you are overclocking any hardware, please stop. Reset any changed values back to default and reset/clear CMOS: Clear CMOS - 3 Ways to Clear the CMOS - Reset BIOS. Uninstall any overclocking tool as these can also be a reason of blue screens.

2. Uninstall your current antivirus software. It can be a cause of BSOD very often. Please remove it with its removal tool and use Microsoft Security Essentials in its place. Malwarebytes is a great combination with it. Go through this thread for more info.

3. Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html

4. Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html to check windows for integrity violations. Run it up to three times to fix all errors. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.

5. Make scans with Kaspersky TDSskiller and ESET Online scanner.

6. Perform a Clean Start up, this will help avoid any problematic applications from bugging the system.

7. Use Revo Uninstaller Free to uninstall stubborn software. Opt for Advanced Mode and uninstall the software, delete the leftover registry entries.

8. Use Crystal Disk Info to upload a screenshot of your Hard Drives (s). Test your Hard Drives (s) running a Hard Drive Diag.

9. Test and Diagnose RAM issues with http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html. Pay close attention to Part 3 of the tutorial "If you have errors" Take the test for at least 7-10 passes. It may take up to 22 passes to find problems. Make sure to run it once after the system has been on for a few hours and is warm, and then also run it again when the system has been off for a few hours and is cold.

10. Monitor hardware temperature for overheating issues with system monitoring software like Speccy or HWMonitor. Upload a screen shot of the Summary tab as well:

• Piriform - Speccy
• CPUID - HWMonitor

11. Install all updates including service pack one: Learn how to install Windows 7 Service Pack 1 (SP1)

​

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\USER\Downloads\SF_05-11-2013\SF_05-11-2013\110513-23680-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.17273.amd64fre.win7_gdr.130318-1532
Machine Name:
Kernel base = 0xfffff800`02a4e000 PsLoadedModuleList = 0xfffff800`02c8ae70
Debug session time: Wed Nov  6 03:10:42.596 2013 (UTC + 6:00)
System Uptime: 0 days 8:24:06.970
Loading Kernel Symbols
.............................................
Loading User Symbols
Loading unloaded module list
..
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c000001d, fffff80002ac6b4d, fffff88004e65140, 0}

Unable to load image Unknown_Module_00000000`00000001, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000001
*** ERROR: Module load completed but symbols could not be loaded for Unknown_Module_00000000`00000001
Probably caused by : hardware ( nt!KeWaitForSingleObject+19d )

Followup: MachineOwner
---------

 

[moieu]

Alright I ran a chkdsk. I don't overclock anything because I don't think my mobo even supports it. I uninstalled Trend Micro Security that came with my computer and I'm going to be installing malwarebytes and security essentials soon, that's what I used before I reset my computer to factory settings. I ran Kaspersky TDSskiller and ESET Online scanner and nothing was found. The zip file here is for the Speccy screenshot, CrystalDiskInfo screenshot and text, and chkdsk text. I'm going to finish applying all updates to my computer, and then run memtest again and sfc /scannow and then I'll get back to you. Thank you for the help by the way.

 

[koolkat77]

TimeCreated : 11/6/2013 2:07:39 AM
Message     : 
              
              Checking file system on C:
              The type of the file system is NTFS.
              Volume label is WIN7.
              
              A disk check has been scheduled.
              Windows will now check the disk.                         
              
              CHKDSK is verifying files (stage 1 of 5)...
                235008 file records processed.                                 
                      
              File verification completed.
                506 large file records processed.                              
                   
                0 bad file records processed.                                  
                 
                0 EA records processed.                                        
                 
                60 reparse records processed.                                  
                  
              CHKDSK is verifying indexes (stage 2 of 5)...
                306948 index entries processed.                                
                      
              Index verification completed.
                0 unindexed files scanned.                                     
                 
                0 unindexed files recovered.                                   
                 
              CHKDSK is verifying security descriptors (stage 3 of 5)...
                235008 file SDs/SIDs processed.                                
                      
              Cleaning up 253 unused index entries from index $SII of file 0x9.
              Cleaning up 253 unused index entries from index $SDH of file 0x9.
              Cleaning up 253 unused security descriptors.
              Security descriptor verification completed.
                35971 data files processed.                                    
                     
              CHKDSK is verifying Usn Journal...
                36584656 USN bytes processed.                                  
                        
              Usn Journal verification completed.
              CHKDSK is verifying file data (stage 4 of 5)...
                234992 files processed.                                        
                      
              File data verification completed.
              CHKDSK is verifying free space (stage 5 of 5)...
                223939957 free clusters processed.                             
                         
              Free space verification is complete.
              CHKDSK discovered free space marked as allocated in the
              master file table (MFT) bitmap.
              CHKDSK discovered free space marked as allocated in the volume bi
              tmap.
              [COLOR="Red"]Windows has made corrections to the file system.[/COLOR]
              
               961887231 KB total disk space.
                65630220 KB in 137210 files.
                  129928 KB in 35972 indexes.
                       0 KB in bad sectors.
                  367251 KB in use by the system.
                   65536 KB occupied by the log file.
               895759832 KB available on disk.
              
                    4096 bytes in each allocation unit.
               240471807 total allocation units on disk.
               223939958 allocation units available on disk.
              
              Internal Info:
              00 96 03 00 8a a4 02 00 33 1e 05 00 00 00 00 00  ........3.......
              39 01 00 00 3c 00 00 00 00 00 00 00 00 00 00 00  9...<...........
              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
              
              Windows has finished checking your disk.
              Please wait while your computer restarts.

Other than that, everything looks fine.
Do keep us posted.

 

[moieu]

Alright I updated my windows to SP1 and did like 60 other updates. I also ran the sfc scannow 3 times. It found 1 thing the first time a scanned and nothing else afterwards. I haven't had any blue screens sinse the scannow but I have experienced 2 windows hangs. I was using google chrome and it would just freeze, I could still hear people in skype but I couldn't do anything, I would ctrl alt del and then after like 20 seconds the screen would pop up and it would unfreeze.
EDIT: I'm also going to do the memtest tonight and leave it running, will post results tomorrow. Would do it today but I need my computer for schooling.

 

[koolkat77]

Okay please post an update when you're done with ram tests

 

[moieu]

I was trying to start up my computer last night and was having problems. The computer would start and I could hear all the hardware running but there would be no display. Eventually after power cycling about 3 times it showed BOOTMGR image is corrupted. I reset the computer and ran the windows repair and it let me back on.
EDIT: I couldn't run the memtest because of the problems, I didn't get it to start up until this morning. But I should be able to run them tonight.
EDIT 2: After 3 days just got another blue screen, just the ntoskrnl.exe SYSTEM_SERVICE_EXCEPTION

 

[Britton30]

What happens, or more to the point, doesn't happen, when you try running memtest? If you installed HWinfo it would be interesting to see what your voltages are while in Windows.

 

[moieu]

I'm actually running memtest right now. It's been running for about an hour and a half. It just passed test ten with no errors so far. I was going to hold off on doing it because I didn't want to have to pause my classes to do it, but the blue screens are unbearable. I got 2 today after not having any since the 5th of this month. Both were still dealing with ntoskrnl.exe But I'll check out that program once I get my computer back from testing on memtest. By the way does anyone know a solution for why my computer was not showing display? I could hear everything start up and I could hear all my fans, but my monitor wouldn't turn on. I had to turn off my computer and wait a bit a couple of times for it to finally work. And I got that BOOTMGR image is corrupted screen. That's the only time I got the bootmgr problem but I'd still like to know the cause. To be honest though I don't really think it's my ram cause I had bsods before and I ran memtest and it showed errors on the stock ram, I replaced it with much better ram and it stopped giving me the problems. Also I feel like I should note that these bsods started happening to me after installing a game called 300 Heroes. It's a korean game, and after installing I found a lot of malware on my computer so I removed it instantly and removed all the malware. Of course I did reset my computer to factory settings afterwords so I don't know if the malware could even be on there anymore.

 

[Britton30]

OK, let it run for a minimum of 7 full passes, it may take 8 hours or so.

It may be prudent when memtest is done to re-do the malware scans you did before.

 

[moieu]

Alright will do.

 

[x BlueRobot]

[COLOR="Red"]BugCheck 3B[/COLOR], {[COLOR="SeaGreen"]c000001d[/COLOR], fffff80002ac6b4d, fffff88004e65140, 0}

Unable to load image Unknown_Module_00000000`00000001, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000001
*** ERROR: Module load completed but symbols could not be loaded for Unknown_Module_00000000`00000001
Probably caused by : [COLOR="Red"]hardware[/COLOR] ( nt!KeWaitForSingleObject+19d )

1: kd> [COLOR="SeaGreen"]!thread[/COLOR]
GetPointerFromAddress: unable to read from fffff80002cf5000
THREAD fffffa800fc4a590  Cid 0d90.1388  Teb: 000000007ef4d000 Win32Thread: 0000000000000000 RUNNING on processor 1
Not impersonating
GetUlongFromAddress: unable to read from fffff80002c33ba4
Owning Process            fffffa800d83b7b0       Image:         <Unknown>
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      1938895      
Context Switch Count      131637         IdealProcessor: 0             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x0000000001aa76b7
Stack Init fffff88004e65db0 Current fffff88004e65900
Base fffff88004e66000 Limit fffff88004e60000 Call 0
Priority 24 BasePriority 1 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`04e64878 fffff800`02abcde9 : 00000000`0000003b 00000000`c000001d fffff800`02ac6b4d fffff880`04e65140 : nt!KeBugCheckEx
fffff880`04e64880 fffff800`02abc73c : fffff880`04e658d8 fffff880`04e65140 00000000`00000000 fffff800`02aeb820 : nt!KiBugCheckDispatch+0x69
fffff880`04e649c0 fffff800`02ae2fad : fffff800`02cdfb5c 00000000`00000000 fffff800`02a4e000 fffff880`04e658d8 : nt!KiSystemServiceHandler+0x7c
fffff880`04e64a00 fffff800`02aea620 : fffff800`02c0d118 fffff880`04e64a78 fffff880`04e658d8 fffff800`02a4e000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`04e64a30 fffff800`02af76cf : fffff880`04e658d8 fffff880`04e65140 fffff880`00000000 fffffa80`0fc4a590 : nt!RtlDispatchException+0x410
fffff880`04e65110 fffff800`02abcec2 : fffff880`04e658d8 00000046`6c996aab fffff880`04e65980 fffffa80`0f4261b0 : nt!KiDispatchException+0x16f
fffff880`04e657a0 fffff800`02abb01f : fffff880`04e65980 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`04e65980 fffff800`02ac6b4d : 00000000`00000c58 00000000`00000000 00000000`000000cf 00000000`120becd0 : [COLOR="Red"]nt!KiInvalidOpcodeFault[/COLOR]+0x11f (TrapFrame @ [COLOR="SeaGreen"]fffff880`04e65980[/COLOR])
fffff880`04e65b10 fffff800`02db2ad2 : fffff880`04e65c00 fffffa80`00000006 00000000`00000001 fffff800`02ab9400 : nt!KeWaitForSingleObject+0x19d
fffff880`04e65bb0 fffff800`02abcad3 : fffffa80`0fc4a590 00000000`00000c58 fffff880`04e65bf8 fffffa80`0f4261b0 : nt!NtWaitForSingleObject+0xb2
fffff880`04e65c20 00000000`747c2dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04e65c20)
00000000`120bec58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x747c2dd9

[COLOR="SeaGreen"].trap fffff880`04e65980[/COLOR]
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000102 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ac6b4d rsp=fffff88004e65b10 rbp=0000000000000000
 r8=fffffa800d83b838  r9=0000000000000000 r10=fffffffffffffffd
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
[COLOR="Blue"]nt!KeWaitForSingleObject[/COLOR]+0x19d:
fffff800`02ac6b4d ff              ???

I believe we are looking at some memory misalignment boundary errors, which may have caused by invalid machine operation code.

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

 

[moieu]

Alright I did what you just told me to do, and it told me I had to restart my computer in order for it to run. Now my computer gets to the windows boot logo and gives me a bsod saying a driver is trying to access memory that has already been freed. I tried running the windows startup repair but it's not working.

 

[x BlueRobot]

Boot into Safe Mode, and then disable Driver Verifier. The instructions are in the link wrapped around the Information box. Please post the dump files afterwards.

 

[ICIT2LOL]

My 2 cents try thee scanners too

http://www.superantispyware.com/


http://www.bleepingcomputer.com/download/adwcleaner/

(download from bleeping computer)

Personally I would try Hitman Pro too Home - SurfRight

There are more rootkit removers from here too I have used GMER and Sophos and Dr Web Cureit
Best Free Rootkit Scanner and Remover the GMER is a heavy duty thing I find and leave it to last if I have to.

 

[moieu]

Uh..how exactly do I get the dump files? They aren't showing up in bluescreenviewer...

 

[Britton30]

Use the SF Diagnostic tool from this post. http://www.sevenforums.com/bsod-hel...ath-bsod-posting-instructions.html#post836073

The tool, Windbg, they use here is more comprehensive than Blue Screen Viewer.

 

[moieu]

Alright but the folder isn't showing the 3 bsods I got while driver verifier. But here you go.

 

[Britton30]

OK, thanks, BlueRobot should be in and have a look.

 

[x BlueRobot]

As you have said, unfortunately, the Driver Verifier dump files are not there. I would suggest running Driver Verifier again.