random BSOD at windows boot (ntkrnlmp.exe)

[failepic]

Hi there.I am having random bsods when i log in windows.Then it starts repair but it doesn't find anything to fix.So i restart and the pc works fine.It happens about 1 time per week.Can someone check the minidump and help me please because i dont understand minidumps.Thanks

 

[koolkat77]

Hi -

Welcome to Seven Forums.

Usual causes:  Kernel mode driver, System Service, BIOS, Windows, [U]Virus scanner[/U], Backup tool, compatibility

Your BSOD's were caused by Norton:

fffff880`061e44b8  fffff880`068b59f0Unable to load image \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SYMEVENT64x86.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT64x86.SYS
 SYMEVENT64x86+0x269f0

fffff880`061e4458  fffff880`063de2e0Unable to load image \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\BASHDefs\20130301.001\BHDrvx64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for BHDrvx64.sys
*** ERROR: Module load completed but symbols could not be loaded for BHDrvx64.sys
 BHDrvx64+0x1372e0

fffff880`061e4128  fffff880`06afeab8Unable to load image \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for EraserUtilRebootDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for EraserUtilRebootDrv.sys
 EraserUtilRebootDrv+0x2ab8

Please remove it using its removal tool from here: Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase

We recommended Microsoft Security Essentials from a strict BSOD perspective. Is most compatible & provides most stability compared to other antivirus app/Internet Security Software.

• Microsoft Security Essentials, Free antivirus for windows
• Malwarebytes Anti-Malware Free
• Good and Free system security combination

   Warning

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Perform a System File Check to check the integrity of all protected Windows 7 :

1. Click on the start rb:
2. Type CMD on Search
3. Left click and Run as Administrator
4. Type

   SFC /scannow

Full tutorial here:

• SFC /Scannow Command - System File Checker

Check your hard drive(s) for errors by running chkdsk

• Check your hard disk for errors
• http://www.sevenforums.com/tutorials/433-disk-check.html

Please upload your msinfo32.nfo file. To get this: Start Menu -> Type msinfo32 into the Search programs and files box -> When it opens, go to File, Save -> Save as msinfo32.nfo and save in a place you will remember -> Let it finish the process of gathering and saving the system info -> Right click the .nfo file, click send to compressed (zipped) folder -> Upload the .zip file here.

Please upload your msinfo32.txt file. To get this: Start Menu -> Type msinfo32 into the Search programs and files box -> When it opens, go to File, Export -> Save as msinfo32.txt and save in a place you will remember -> Let it finish the process of gathering and saving the system info -> Right click the .txt file, click send to compressed (zipped) folder -> Upload the .zip file here.

Number down items at start-up. Keep only your anti-virus, this also improves the time for logging into windows.

• http://www.sevenforums.com/tutorials/1401-startup-programs-change.html
• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002ef1cd4}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ef1cd4, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003115100
GetUlongFromAddress: unable to read from fffff800031151c0
 0000000000000000 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+c64
fffff800`02ef1cd4 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  csrss.exe

IRP_ADDRESS:  ffffffffffffff88

TRAP_FRAME:  fffff880061e46a0 -- (.trap 0xfffff880061e46a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff880061e3918 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ef1cd4 rsp=fffff880061e4830 rbp=0000000000000000
 r8=0000000000004740  r9=0000000000000080 r10=0000000000000002
r11=00000000000001c8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!IopCompleteRequest+0xc64:
fffff800`02ef1cd4 488b09          mov     rcx,qword ptr [rcx] ds:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002edc1e9 to fffff80002edcc40

STACK_TEXT:  
fffff880`061e4558 fffff800`02edc1e9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`061e4560 fffff800`02edae60 : 00000000`00000100 fffff880`061e4958 fffffa80`05cca958 fffffa80`0570bc60 : nt!KiBugCheckDispatch+0x69
fffff880`061e46a0 fffff800`02ef1cd4 : 00000000`00000001 00000000`00000000 fffff880`20206f49 fffff880`061e4b18 : nt!KiPageFault+0x260
fffff880`061e4830 fffff800`02ecf657 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff8a0`00000000 : nt!IopCompleteRequest+0xc64
fffff880`061e4900 fffff800`02e8aee5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1c7
fffff880`061e4980 fffff800`0313196a : fffffa80`04d4de30 fffffa80`05ccab30 fffff880`061e4b10 fffff880`061e4b08 : nt!KiCheckForKernelApcDelivery+0x25
fffff880`061e49b0 fffff800`031fa85e : fffffa80`00000004 fffffa80`05ccab30 fffff880`061e4b10 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x292ea
fffff880`061e4aa0 fffff800`02edbed3 : 00000000`00000014 fffffa80`05708b50 00000000`002fe5a8 00000000`002fe801 : nt!NtMapViewOfSection+0x2bd
fffff880`061e4b70 00000000`76d6159a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`002fe588 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d6159a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`02edae60 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  50e79935

FAILURE_BUCKET_ID:  X64_0xA_nt!KiPageFault+260

BUCKET_ID:  X64_0xA_nt!KiPageFault+260

Followup: MachineOwner
---------