Random BSOD ntoskrnl.exe many bug codes

[sam43209]

I recently had to re-image my PC due to a virus and have been in the process of reinstalling and updating everything. Partway through I started getting many BSODs. Sometimes it will happen before windows finishes loading everything and sometimes it will be stable for quite a while before failing. I believe the computer may have lost power during a windows update shortly before the BSODs started happening but I am not sure. I have checked the dumps with bluescreenView and it always seems to point to ntoskrnl.exe (sometimes it points to a second file as well but that one is always implicated). I have also tried removing my RAM sticks one at a time and still have the same problems. I have included the dump files and am happy to try anything you recommend. PLEASE HELP!

Sam

 

[koolkat77]

Welcome to SevenForums.

Bug Check 1E and McAfee is common.

Start Menu\Programs\McAfee	Public:Start Menu\Programs\McAfee	Public

Start with removing McAfee, it's a frequent cause of BSOD crashes, consider uninstalling it with the McAfee Removal Tool and replace with Microsoft Security Essentials at least to test.

• How to uninstall or reinstall supported McAfee products using the Consumer Products Removal tool (MCPR)
• McAfee Removal Tool - McAfee Uninstaller

Recommended antivirus program for Windows 7 based on stability compared to others:-

• Microsoft Security Essentials - Free Antivirus for Windows
• Malwarebytes - The Free version
• http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

:warn: Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Run these tools and delete anything they may find:

• Anti-rootkit utility TDSSKiller

ESET online scanner:

• Free Online Virus Scanner | ESET

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

• Click on the rb:
• Type CMD on Search
• Left click and Run as Administrator
• Type SFC /scannow

Full tutorial here:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Run Disk Check on your hard disk for file system errors and bad sectors on it:

• http://www.sevenforums.com/tutorials/433-disk-check.html

Free up the start-up, nothing except the antivirus is usually needed.

• http://www.sevenforums.com/tutorials/1401-startup-programs-change.html
• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Let us know the results.

 

[sam43209]

Unfortunately, my employer requires McAfee or else I can't connect to the network so removing it isn't an option. Also, though 1E was the most common I had a number of other bug check error codes in the dumps that I uploaded as well, do any of those point to anything?

I will try the other steps you recommended and report back but in the meantime I would be curious to know if there are any other potential causes or commonalities present in the ~20 dumps I uploaded.

 

[koolkat77]

I see.

Well yes, STOP 1E and STOP A were. Some dump files do not provide anything specific except the codes nor any accurate probably caused by: stuff so we just dump those dumps sometimes making certain tests from their "usual causes" helps as well.

Anyway, here's some info I've collected from few of the dumps:

[FONT="Lucida Console"][B]1.[/B] STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL   
Usual causes:  Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility
Debug session time: Tue Nov 27 03:24:48.676 2012 (UTC + 6:00)
System Uptime: 0 days 0:02:31.956
BugCheck A, {400c0024, 2, 0, fffff80003cd5715}
Probably caused by : ntkrnlmp.exe ( nt!KeSetEvent+1e3 )
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME:  System
........................................................................................................
[B]2.[/B] STOP 0x0000003B: SYSTEM_SERVICE_EXCEPTION    
Usual causes:  System service, Device driver, graphics driver, ?memory
Debug session time: Tue Nov 27 03:21:34.032 2012 (UTC + 6:00)
System Uptime: 0 days 0:02:14.312
BugCheck 3B, {c0000005, fffff880010cb039, fffff8800b096d20, 0}
Probably caused by : fltmgr.sys ( fltmgr!GetContextFromStreamList+99 )
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME:  concentr.exe
---------------------------------------------------------------------------------------------------------
fffff880`0b096bd8  fffff880`010c6000 fltmgr!ExFreeToNPagedLookasideList <PERF> (fltmgr+0x0)
fffff880`0b096be0  fffff880`010e42ac fltmgr!__PchSym_ <PERF> (fltmgr+0x1e2ac)
fffff880`0b096be8  fffff880`010c6000 fltmgr!ExFreeToNPagedLookasideList <PERF> (fltmgr+0x0)
fffff880`0b096bf0  fffff880`010e4288 fltmgr!__PchSym_ <PERF> (fltmgr+0x1e288)
fffff880`0b096bf8  fffff880`01126000 mfehidk
fffff880`0b096c00  fffff880`011ba484 mfehidk+0x94484
fffff880`0b096c08  fffff880`01126000 mfehidk
fffff880`0b096c10  fffff880`011baa54 mfehidk+0x94a54
fffff880`0b096c18  fffff880`01126000 mfehidk
fffff880`0b096c20  fffff880`011babc8 mfehidk+0x94bc8
fffff880`0b096c28  fffff880`010c6000 fltmgr!ExFreeToNPagedLookasideList <PERF> (fltmgr+0x0)
fffff880`0b096c30  fffff880`010e40e4 fltmgr!__PchSym_ <PERF> (fltmgr+0x1e0e4)
fffff880`0b096c38  fffff880`010c6000 fltmgr!ExFreeToNPagedLookasideList <PERF> (fltmgr+0x0)
fffff880`0b096c40  fffff880`010e412c fltmgr!__PchSym_ <PERF> (fltmgr+0x1e12c)
fffff880`0b096c48  fffff880`010c6000 fltmgr!ExFreeToNPagedLookasideList <PERF> (fltmgr+0x0)
fffff880`0b096c50  fffff880`010e4054 fltmgr!__PchSym_ <PERF> (fltmgr+0x1e054)
fffff880`0b096c58  fffff800`03c61000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`0b096c60  fffff800`03efab64 nt!BBTBuffer <PERF> (nt+0x299b64)
fffff880`0b096c68  fffff800`03c61000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`0b096c70  fffff800`03efa780 nt!BBTBuffer <PERF> (nt+0x299780)
fffff880`0b096c78  fffff800`03c61000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`0b096c80  fffff800`03efa6f0 nt!BBTBuffer <PERF> (nt+0x2996f0)
fffff880`0b096c88  fffff800`03c61000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`0b096c90  fffff800`03efa7e0 nt!BBTBuffer <PERF> (nt+0x2997e0)
fffff880`0b096bd0  fffff880`0117f688Unable to load image \SystemRoot\system32\drivers\[URL="http://www.carrona.org/drivers/search.php?id=mfehidk.sys"]mfehidk.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/search.php?id=mfehidk.sys"]mfehidk.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/search.php?id=mfehidk.sys"]mfehidk.sys[/URL]
 mfehidk+0x59688
----------------------------------------------------------------------------------------------------------
.........................................................................................................
[B]3.[/B] STOP 0x0000001E: KMODE_EXCEPTION_NOT_HANDLED    
Usual causes:  Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS
Debug session time: Tue Nov 27 03:18:12.047 2012 (UTC + 6:00)
System Uptime: 0 days 0:02:19.967
BugCheck 1E, {ffffffffc0000005, fffffa800857cbb0, 0, 7efa8000}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+487ad )
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME:  System
----------------------------------------------------------------------------------------------------------
fffff880`055fcb88  fffff880`114c6e55Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
 nvlddmkm+0x1dae55
1: kd> lmvm nvlddmkm
start             end                 module name
fffff880`112ec000 fffff880`11fe0000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        Wed Oct 03 00:21:13 2012 (506B3099)
    CheckSum:         00CD4613
    ImageSize:        00CF4000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
.........................................................................................................
[B]4.[/B] STOP 0x000000CD: PAGE_FAULT_BEYOND_END_OF_ALLOCATION   
Usual causes:  Device driver
Debug session time: Mon Nov 19 21:58:39.096 2012 (UTC + 6:00)
System Uptime: 0 days 0:00:19.392
BugCheck CD, {fffff980085b9000, 0, fffff800032d36ce, 0}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!wcsstr+56 )
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  smss.exe
.........................................................................................................
[B]5.[/B] STOP 0x00000019: BAD_POOL_HEADER    
Usual causes:  Device driver
Debug session time: Sat Nov 17 04:49:57.361 2012 (UTC + 6:00)
System Uptime: 0 days 0:03:58.622
BugCheck 19, {20, fffffa800b042b70, fffffa800b042bf0, c080022}
Probably caused by : ksecdd.sys ( ksecdd!KsecDispatch+b8 )
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME:  WerFault.exe[/FONT]

There's something going on with McAfee from the info from the dump on No. 2. Probably uninstalling and reinstalling McAfee afresh may help. But do make full scan with Malware bytes [Free] and TDSKiller & ESET.

*After reinstalling McAfee, update all networking drivers from the manufacturers website.​

Reinstall the drivers for NVIDIA following this way: Click on the Start rb: ► Control Panel ► Programs ► Uninstall a program ► Uninstall everything related to; NVIDIA and reboot the system. Delete the remaining drivers/older drivers using Driver Fusion/Sweeper. Download this version of the driver: Download NVIDIA Forceware 306.23 WHQL Vista 64 - FileHippo.com

Then you can do the steps mentioned in my first post (apart from uninstalling mcafee).

1. SFC Scan
2. Malware/TDS/ESET
3. Disk Check
4. Freeing up start-up

Hope this helps in resolving the issue. Good luck!

 

[sam43209]

Removing McAfee enterprise has proven to be rather difficult but I have disabled it from starting up and turned off all non-windows services in MSConfig. I have also run SFC and diskcheck and haven't found anything significant. With the antivirus startup and most services disabled I seem to be running mostly stable while using it all day but when I leave my PC overnight I have come back and found that it had crashed and rebooted 2 out of the last 3 times. I have attached the latests dump files and was wondering if you might be able to pinpoint what else seems to be causing the issue.

Thanks for your time,
Sam

 

[koolkat77]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffffa8008527bb0, 0, 7efa8000}

Probably caused by : NETIO.SYS ( NETIO!WfpTimerWheelTimeoutHandler+1e0 )

Followup: MachineOwner
---------

Were the network drivers updated

 

[sam43209]

about halfway through this whole ordeal my network drivers completely failed and I had to uninstall/reinstall and then update them but that was a week or 2 ago.

 

[koolkat77]

I've requested for more help on your thread, we'll have to wait for a reply.

In that between you can test the RAM. Although I don't think the problem is hardware related.

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
​

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
​

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
​

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
​

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
​

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

:info: Errors are sometimes found after 8 passes.
:tip: Do this test overnight, before going to bed.