Random BSOD--ntoskrnl.exe

[alfred67]

Hello

I get random BSOD the only thing in common is the Crash Address: ntoskrnl.exe+7cd40.

I have already ran memtest86 for 7 hours which gave no errors (7 Passes) so dont think its a hardware problem.
Link to my system specs http://speccy.piriform.com/results/zF7R1u3aAPZIKm11WBJxcTU
I have attached a copy of my dumps
Thanks
Alfred67

 

[alfred67]

Ran sfc/verifyonly and found no errors
Running "Verifier" crashed within about 4mins after rebooting.(copy of dump below) anyway to is which driver failed??
Rebooted still running after 10 min so far.

=================================================
Dump File : 041112-14835-01.dmp
Crash Time : 11/04/2012 12:43:43 PM
Bug Check String : KMODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x0000001e
Parameter 1 : 00000000`00000000
Parameter 2 : 00000000`00000000
Parameter 3 : 00000000`00000000
Parameter 4 : 00000000`00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+7cd10
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7601.17727 (win7sp1_gdr.111118-2330)
Processor : x64
Crash Address : ntoskrnl.exe+7cd10
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\041112-14835-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 7601
Dump File Size : 275,152

 

[alfred67]

Ok, it crash again this time it take 3 hours Verifier is running
The computer is not being used just sitting there the dump looks the same as the last one.

Can anyone help ?? Is it possible the ntosknl.exe is corrupted???

Copy of last crash
==================================================
Dump File : 041112-13540-01.dmp
Crash Time : 11/04/2012 4:30:12 PM
Bug Check String : KMODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x0000001e
Parameter 1 : 00000000`00000000
Parameter 2 : 00000000`00000000
Parameter 3 : 00000000`00000000
Parameter 4 : 00000000`00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+7cd10
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7601.17727 (win7sp1_gdr.111118-2330)
Processor : x64
Crash Address : ntoskrnl.exe+7cd10
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\041112-13540-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 7601
Dump File Size : 275,152

 

[writhziden]

So based on the file you uploaded, Windows is not working as it should. Please follow the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html to provide us with more information so we can give more specific troubleshooting steps.


I can give one piece of troubleshooting from the files you provided.

• Try re-installing DirectX using the Download: DirectX Redist (June 2010) - Microsoft Download Center - Download Details and see how the system responds.
  
  Follow the steps for Diagnosing basic problems with DirectX. To re-install your display card drivers as outlined in the DirectX link, use the following steps.
  
  1. Download the latest drivers for your display card(s)
  2. Click Start Menu
  3. Click Control Panel
  4. Click Uninstall a program
  5. For NVIDIA:
     • Uninstall the NVIDIA Graphics Driver (this should uninstall all NVIDIA software and drivers)
     • Restart your computer
     • Make sure NVIDIA 3D Vision Driver, NVIDIA 3D Vision Video Player, NVIDIA HD Audio Driver, and NVIDIA PhysX System Software are not still listed under Uninstall a program through Control Panel
     • If any remain of the above, uninstall one at a time
     • If asked to restart after uninstalling any of the above, do so, and continue uninstalling any remaining NVIDIA items until all are removed
  6. For AMD:
     • Uninstall AMD Catalyst Install Manager if it is listed (this should remove all AMD graphics software and drivers)
     • If AMD Catalyst Install Manager is not listed, use the following method to uninstall the graphics drivers:
       1. Download the latest drivers for your display card(s)
       2. Click Start Menu
       3. Right Click My Computer/Computer
       4. Click Manage
       5. Click Device Manager from the list on the left
       6. Expand Display adapters
       7. Do the following for each adapter (in case you have multiple display cards)
          • Right click the adapter
          • Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
          • Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
       8. Restart your computer after uninstalling drivers for all display cards
       9. Install the latest driver for the display cards once Windows starts
       
       Alternatively:
       1. Login as an adminstrative user
       2. Download the latest drivers for your display card(s)
       3. Click Start Menu
       4. Click Control Panel
       5. Click Hardware and Sound
       6. Click Device Manager (the last link under Devices and Printers)
       7. Expand Display adapters
       8. Do the following for each adapter (in case you have multiple display cards)
          • Right click the adapter
          • Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
          • Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
  7. Restart your computer after uninstalling drivers for all display cards
  8. Install the latest driver for the display cards once Windows starts

 

[alfred67]

Thank you very much will report back

 

[alfred67]

Zips you requested

Windows 7 -- Home Premium 64 bit
OS installed --1 year ago
OEM came pre-installed
Purchased from Dell

System is 1 yr old
Tried to reintall windows 7 once already

 

[writhziden]

Security Software (this is just a check that it is installed and working properly; nothing needs to be done with this information at this time):

mcagent.exe	c:\program files\mcafee.com\agent\mcagent.exe	4520	8	200	1380	09/04/2012 5:35 PM	11.0.644.0	1.60 MB (1,675,160 bytes)	21/12/2011 6:33 PM

[list=1][*]Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\alfred67\Windows7_Vista_jcgriff2\040912-14274-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`03416000 PsLoadedModuleList = 0xfffff800`0365a650
Debug session time: Mon Apr  9 13:27:21.913 2012 (UTC - 6:00)
System Uptime: 0 days 0:00:30.646
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff960000f4efc, fffff88008668c30, 0}

Probably caused by : win32k.sys ( win32k!SURFACE::Map+16c )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff960000f4efc, Address of the instruction which caused the bugcheck
Arg3: fffff88008668c30, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k!SURFACE::Map+16c
fffff960`000f4efc 488b09          mov     rcx,qword ptr [rcx]

CONTEXT:  fffff88008668c30 -- (.cxr 0xfffff88008668c30)
rax=fffff900c32d1910 rbx=fffffa800ac63aa0 rcx=f7fff900c32d1830
rdx=0000000003950000 rsi=0000000000000001 rdi=f7fff900c32d1830
rip=fffff960000f4efc rsp=fffff88008669610 rbp=fffff900c07f3010
 r8=fffff78000000008  r9=0000000000000000 r10=0000000000000000
r11=fffff88003165180 r12=fffff88008669770 r13=0000000000000000
r14=fffff960002f1ae0 r15=fffff960002f1ac0
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
win32k!SURFACE::Map+0x16c:
fffff960`000f4efc 488b09          mov     rcx,qword ptr [rcx] ds:002b:f7fff900`c32d1830=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff960000f4efc

STACK_TEXT:  
fffff880`08669610 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!SURFACE::Map+0x16c


FOLLOWUP_IP: 
win32k!SURFACE::Map+16c
fffff960`000f4efc 488b09          mov     rcx,qword ptr [rcx]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!SURFACE::Map+16c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4f2b63bd

STACK_COMMAND:  .cxr 0xfffff88008668c30 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_win32k!SURFACE::Map+16c

BUCKET_ID:  X64_0x3B_win32k!SURFACE::Map+16c

Followup: MachineOwner
---------

[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\alfred67\Windows7_Vista_jcgriff2\040812-14788-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`03418000 PsLoadedModuleList = 0xfffff800`0365c650
Debug session time: Sun Apr  8 14:47:39.275 2012 (UTC - 6:00)
System Uptime: 0 days 2:30:01.007
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8800bb5c668, 0, fffff96000120f89, 2}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!xxxScanSysQueue+14f9 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8800bb5c668, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff96000120f89, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036c6100
 fffff8800bb5c668 

FAULTING_IP: 
win32k!xxxScanSysQueue+14f9
fffff960`00120f89 448bac24e8000000 mov     r13d,dword ptr [rsp+0E8h]

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  zuma.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800b95c3f0 -- (.trap 0xfffff8800b95c3f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c0a8d770 rbx=0000000000000000 rcx=fffff900c0e1f110
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000120f89 rsp=fffff8800b95c580 rbp=fffff8800b95cb60
 r8=0000000000000001  r9=fffff900c0e1f110 r10=fffff900c0cfb010
r11=fffff8800b95c550 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
win32k!xxxScanSysQueue+0x14f9:
fffff960`00120f89 448bac24e8000000 mov     r13d,dword ptr [rsp+0E8h] ss:0018:fffff880`0b95c668=00000201
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000343fc50 to fffff80003494d40

STACK_TEXT:  
fffff880`0b95c288 fffff800`0343fc50 : 00000000`00000050 fffff880`0bb5c668 00000000`00000000 fffff880`0b95c3f0 : nt!KeBugCheckEx
fffff880`0b95c290 fffff800`03492e6e : 00000000`00000000 fffff880`0bb5c668 fffff880`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x43d76
fffff880`0b95c3f0 fffff960`00120f89 : 00000035`0000012b fffff880`0b95cb60 00000000`00000000 00000000`0000012b : nt!KiPageFault+0x16e
fffff880`0b95c580 fffff960`0015abf7 : fffff900`c0cfb010 fffff880`0b95ca28 00000000`00000000 00000000`00000000 : win32k!xxxScanSysQueue+0x14f9
fffff880`0b95c8c0 fffff960`0015b085 : 00000000`00000000 fffff800`000025ff 00000000`00000000 fffffa80`ffffffff : win32k!xxxRealInternalGetMessage+0x453
fffff880`0b95c9a0 fffff960`00153a97 : 00000000`73382450 00000000`0008ec80 00000000`0008fd20 00000000`7efdb001 : win32k!xxxInternalGetMessage+0x35
fffff880`0b95c9e0 fffff800`03493fd3 : fffffa80`06fddb60 00000000`0008e2f8 fffff880`0b95ca88 00000000`00000000 : win32k!NtUserPeekMessage+0x77
fffff880`0b95ca70 00000000`733cfdea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0008e2d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x733cfdea


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!xxxScanSysQueue+14f9
fffff960`00120f89 448bac24e8000000 mov     r13d,dword ptr [rsp+0E8h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!xxxScanSysQueue+14f9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4f2b63bd

FAILURE_BUCKET_ID:  X64_0x50_win32k!xxxScanSysQueue+14f9

BUCKET_ID:  X64_0x50_win32k!xxxScanSysQueue+14f9

Followup: MachineOwner
---------


[/list]

The crashes point to either Windows file corruption or memory problems.

• If you are overclocking any hardware, please stop.
  
  
• Run Disk Check with Automatically fix file system errors checked. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html.
  For any drives that do not give the message:
  Windows has checked the file system and found no problems
  run disk check again as above. In other words, if it says:
  Windows has made corrections to the file system
  after running the disk check, run the disk check again.
  
  
• Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
  If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
  Once these steps have been followed, it is safe to remove and replace components within your computer.

 

[alfred67]

Hello

--ran memtest86 for 7 hours which gave no errors (7 Passes)
--Run SFC/SCANNOW --no errors

When I get home from work will run Disk check and the windows memory check and report back

Thanks for your help

Alfred67

 

[alfred67]

Ran Windows memory check --found no problems
Ran Disk check --log read the following

Checking file system on C: The type of the file system is NTFS. Volume label is OS. A disk check has been scheduled. Windows will now check the disk. CHKDSK is verifying files (stage 1 of 3)... 218368 file records processed. File verification completed. 406 large file records processed. 0 bad file records processed. 0 EA records processed. 60 reparse records processed. CHKDSK is verifying indexes (stage 2 of 3)... 285128 index entries processed. Index verification completed. 0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 3)... 218368 file SDs/SIDs processed. Cleaning up 4 unused index entries from index $SII of file 0x9. Cleaning up 4 unused index entries from index $SDH of file 0x9. Cleaning up 4 unused security descriptors. Security descriptor verification completed. 33381 data files processed. CHKDSK is verifying Usn Journal... 36300520 USN bytes processed. Usn Journal verification completed. Windows has checked the file system and found no problems. 963876863 KB total disk space. 76165176 KB in 177869 files. 113216 KB in 33382 indexes. 0 KB in bad sectors. 351323 KB in use by the system. 65536 KB occupied by the log file. 887247148 KB available on disk. 4096 bytes in each allocation unit. 240969215 total allocation units on disk. 221811787 allocation units available on disk. Internal Info: 00 55 03 00 3f 39 03 00 2f f1 05 00 00 00 00 00 .U..?9../....... 25 02 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 %...<........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Windows has finished checking your disk. Please wait while your computer restarts

 

[writhziden]

Alright, since you seem sure it is not hardware, let's check for driver conflicts.

• An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
  
  a. Backup your system and user files
  b. Create a system restore point
  c. If you do not have a Windows 7 DVD, Create a system repair disc
  d. In Windows 7:

  • Click the Start Menu
  • Type verifier in Search programs and files (do not hit enter)
  • Right click verifier and click Run as administrator
  • Put a tick in Create custom settings (for code developers) and click next
  • Put a tick in Select individual settings from a full list and click next
  • Set up the individual settings as in the image and click next
    View attachment 207144
  • Put a tick in Select driver names from a list
  • Put a tick next to all non-Microsoft drivers.
  • Click Finish.
  • Restart your computer.

  
  If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using http://www.sevenforums.com/tutorials/700-system-restore.html OPTION TWO.
  
  Thanks to zigzag3143 for contributing to the Verifier steps.
  If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.​
  The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.
  
  When you are ready to disable Verifier: Start Menu -> All Programs -> Accessories -> Right click Command Prompt -> Run as administrator -> Type the following command and then Enter:
  verifier /reset​
  -> Restart your computer.

 

[alfred67]

Hello

Thank you for your help before I had a chance to run verifier the system crashed (see dump below).
Will run verifier now and report back.

==================================================
Dump File : 041412-14055-01.dmp
Crash Time : 14/04/2012 8:47:57 AM
Bug Check String : MEMORY_MANAGEMENT
Bug Check Code : 0x0000001a
Parameter 1 : 00000000`00041289
Parameter 2 : 000007fe`fd3a5001
Parameter 3 : 00000000`00000594
Parameter 4 : 020007fe`fd3a5005
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+7cc80
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7601.17790 (win7sp1_gdr.120305-1505)
Processor : x64
Crash Address : ntoskrnl.exe+7cc80
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\041412-14055-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 7601
Dump File Size : 275,152
==================================================

 

[alfred67]

Started verifier rebooted computer and got the following message:

Files that help describe the problem:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_even_6e218faf7db0beccb4ba7cba458895de6e582ac8_cab_0c20e5eb\WERAB4B.tmp.appcompat.txt
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_even_6e218faf7db0beccb4ba7cba458895de6e582ac8_cab_0c20e5eb\WERAD9D.tmp.WERInternalMetadata.xml
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_even_6e218faf7db0beccb4ba7cba458895de6e582ac8_cab_0c20e5eb\WERCFFE.tmp.mdmp

Read our privacy statement online:
http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

 

[alfred67]

forgot to post copy of the report

Version=1
EventType=APPCRASH
EventTime=129788823779678751
ReportType=2
Consent=1
UploadTime=129788823985599113
ReportIdentifier=9e7cab35-8632-11e1-b164-782bcb90178a
IntegratorReportIdentifier=9e7cab34-8632-11e1-b164-782bcb90178a
Response.BucketId=62335131
Response.BucketTable=4
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=svchost.exe_eventlog
Sig[1].Name=Application Version
Sig[1].Value=6.1.7600.16385
Sig[2].Name=Application Timestamp
Sig[2].Value=4a5bc3c1
Sig[3].Name=Fault Module Name
Sig[3].Value=wevtsvc.dll
Sig[4].Name=Fault Module Version
Sig[4].Value=6.1.7601.17514
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=4ce7ca02
Sig[6].Name=Exception Code
Sig[6].Value=c0000005
Sig[7].Name=Exception Offset
Sig[7].Value=0000000000025797
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=6.1.7601.2.1.0.768.3
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=4105
DynamicSig[22].Name=Additional Information 1
DynamicSig[22].Value=5e7a
DynamicSig[23].Name=Additional Information 2
DynamicSig[23].Value=5e7a4c883bf74a1956e3649787dbe144
DynamicSig[24].Name=Additional Information 3
DynamicSig[24].Value=32e6
DynamicSig[25].Name=Additional Information 4
DynamicSig[25].Value=32e6ea9061be0a3b2feb422f28116bcc
UI[2]=C:\Windows\System32\svchost.exe
UI[3]=Windows Event Log has stopped working
UI[4]=Windows can check online for a solution to the problem.
UI[5]=Check online for a solution (recommended)
UI[6]=Check for a solution later (recommended)
UI[7]=Close
UI[8]=Windows Event Log stopped working and was closed
UI[9]=A problem caused the application to stop working correctly. Windows will notify you if a solution is available.
UI[10]=&Close
LoadedModule[0]=C:\Windows\System32\svchost.exe
LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll
LoadedModule[2]=C:\Windows\system32\kernel32.dll
LoadedModule[3]=C:\Windows\system32\KERNELBASE.dll
LoadedModule[4]=C:\Windows\system32\msvcrt.dll
LoadedModule[5]=C:\Windows\SYSTEM32\sechost.dll
LoadedModule[6]=C:\Windows\system32\RPCRT4.dll
LoadedModule[7]=C:\Windows\system32\ole32.dll
LoadedModule[8]=C:\Windows\system32\GDI32.dll
LoadedModule[9]=C:\Windows\system32\USER32.dll
LoadedModule[10]=C:\Windows\system32\LPK.dll
LoadedModule[11]=C:\Windows\system32\USP10.dll
LoadedModule[12]=C:\Windows\system32\IMM32.DLL
LoadedModule[13]=C:\Windows\system32\MSCTF.dll
LoadedModule[14]=C:\Windows\System32\CRYPTBASE.dll
LoadedModule[15]=C:\Windows\system32\ADVAPI32.dll
LoadedModule[16]=c:\windows\system32\wevtsvc.dll
LoadedModule[17]=C:\Windows\System32\RpcRtRemote.dll
LoadedModule[18]=C:\Windows\System32\secur32.dll
LoadedModule[19]=C:\Windows\System32\SSPICLI.DLL
LoadedModule[20]=C:\Windows\System32\credssp.dll
LoadedModule[21]=C:\Windows\system32\WS2_32.dll
LoadedModule[22]=C:\Windows\system32\NSI.dll
LoadedModule[23]=C:\Windows\system32\mswsock.dll
LoadedModule[24]=C:\Windows\System32\wshtcpip.dll
LoadedModule[25]=C:\Windows\System32\wship6.dll
LoadedModule[26]=C:\Windows\System32\GPAPI.dll
LoadedModule[27]=c:\windows\system32\audiosrv.dll
LoadedModule[28]=c:\windows\system32\POWRPROF.dll
LoadedModule[29]=C:\Windows\system32\SETUPAPI.dll
LoadedModule[30]=C:\Windows\system32\CFGMGR32.dll
LoadedModule[31]=C:\Windows\system32\OLEAUT32.dll
LoadedModule[32]=C:\Windows\system32\DEVOBJ.dll
LoadedModule[33]=c:\windows\system32\MMDevAPI.DLL
LoadedModule[34]=c:\windows\system32\PROPSYS.dll
LoadedModule[35]=c:\windows\system32\AVRT.dll
LoadedModule[36]=C:\Windows\system32\CLBCatQ.DLL
LoadedModule[37]=C:\Windows\System32\WINSTA.dll
LoadedModule[38]=C:\Windows\system32\SHLWAPI.dll
LoadedModule[39]=C:\Windows\System32\CRYPTSP.dll
LoadedModule[40]=C:\Windows\system32\rsaenh.dll
LoadedModule[41]=C:\Windows\System32\audioses.dll
LoadedModule[42]=c:\windows\system32\lmhsvc.dll
LoadedModule[43]=c:\windows\system32\IPHLPAPI.DLL
LoadedModule[44]=c:\windows\system32\WINNSI.DLL
LoadedModule[45]=c:\windows\system32\nrpsrv.DLL
LoadedModule[46]=c:\windows\system32\dhcpcore.dll
LoadedModule[47]=c:\windows\system32\DNSAPI.dll
LoadedModule[48]=C:\Windows\System32\firewallapi.dll
LoadedModule[49]=C:\Windows\System32\VERSION.dll
LoadedModule[50]=C:\Windows\System32\dhcpcore6.dll
LoadedModule[51]=C:\Windows\System32\dhcpcsvc6.DLL
LoadedModule[52]=C:\Windows\System32\dhcpcsvc.DLL
LoadedModule[53]=C:\Windows\system32\NLAapi.dll
LoadedModule[54]=C:\Windows\system32\napinsp.dll
LoadedModule[55]=C:\Windows\system32\pnrpnsp.dll
LoadedModule[56]=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
LoadedModule[57]=C:\Windows\system32\PSAPI.DLL
LoadedModule[58]=C:\Windows\System32\rasadhlp.dll
LoadedModule[59]=C:\Windows\System32\fwpuclnt.dll
LoadedModule[60]=C:\Windows\System32\winrnr.dll
State[0].Key=Transport.DoneStage1
State[0].Value=1
State[1].Key=DataRequest
State[1].Value=iData=1/nDumpFile=//Upload//iCab//d5ebc2ae97c8488081c8a3fc1136eba9.cab/nDumpServer=watson.microsoft.com/nResponseServer=watson.microsoft.com/nResponseURL=//dw//StageFour64.asp?iBucket=62335131&szCab=d5ebc2ae97c8488081c8a3fc1136eba9.cab&EventType=AppCrash64&BucketHash=d5689aa4a60480c5787913a8ba0ad130&MID=F3B9E0E5-1680-4537-9F85-B0859A23534F/nBucket=62335131/nBucketTable=4/nResponse=1/n
FriendlyEventName=Stopped working
ConsentKey=APPCRASH
AppName=Windows Event Log
AppPath=C:\Windows\System32\svchost.exe

 

[alfred67]

Crashed while running verifier copy of dump

Dump File : 041412-14242-01.dmp
Crash Time : 14/04/2012 10:29:30 AM
Bug Check String :
Bug Check Code : 0x00000116
Parameter 1 : fffffa80`07b96010
Parameter 2 : fffff880`01207ae4
Parameter 3 : 00000000`00000000
Parameter 4 : 00000000`0000000d
Caused By Driver : dxgkrnl.sys
Caused By Address : dxgkrnl.sys+5d000
File Description :
Product Name :
Company :
File Version :
Processor : x64
Crash Address : ntoskrnl.exe+7cc80
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\041412-14242-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 7601
Dump File Size : 304,848

 

[writhziden]

We need the actual .dmp files. Please provide the full crash reports for these crashes.

Also, have you done the steps for the DirectX re-install and display card drivers re-install?

 

[alfred67]

Also, have you done the steps for the DirectX re-install and display card drivers re-install?

--Yes

I attached a copy of the dmp

 

[writhziden]

Loading Dump File [D:\Kingston\BSODDmpFiles\alfred67\041412-14242-01\041412-14242-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505
Machine Name:
Kernel base = 0xfffff800`03416000 PsLoadedModuleList = 0xfffff800`0365a650
Debug session time: Sat Apr 14 08:28:46.584 2012 (UTC - 6:00)
System Uptime: 0 days 0:48:53.427
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 116, {fffffa8007b96010, fffff88001207ae4, 0, d}

Unable to load image \SystemRoot\system32\DRIVERS\atikmpag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmpag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys
Probably caused by : atikmpag.sys ( atikmpag+7ae4 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

VIDEO_TDR_FAILURE (116)
Attempt to reset the display driver and recover from timeout failed.
Arguments:
Arg1: fffffa8007b96010, Optional pointer to internal TDR recovery context (TDR_RECOVERY_CONTEXT).
Arg2: fffff88001207ae4, The pointer into responsible device driver module (e.g. owner tag).
Arg3: 0000000000000000, Optional error code (NTSTATUS) of the last failed operation.
Arg4: 000000000000000d, Optional internal context dependent data.

Debugging Details:
------------------


FAULTING_IP: 
atikmpag+7ae4
fffff880`01207ae4 4883ec28        sub     rsp,28h

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

CUSTOMER_CRASH_COUNT:  1

BUGCHECK_STR:  0x116

PROCESS_NAME:  System

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`02bc3888 fffff880`04462000 : 00000000`00000116 fffffa80`07b96010 fffff880`01207ae4 00000000`00000000 : nt!KeBugCheckEx
fffff880`02bc3890 fffff880`04461d87 : fffff880`01207ae4 fffffa80`07b96010 fffffa80`0acba010 fffffa80`0b1f7010 : dxgkrnl!TdrBugcheckOnTimeout+0xec
fffff880`02bc38d0 fffff880`04508f07 : fffffa80`07b96010 00000000`00000000 fffffa80`0acba010 fffffa80`0b1f7010 : dxgkrnl!TdrIsRecoveryRequired+0x21f
fffff880`02bc3900 fffff880`04532b75 : 00000000`ffffffff 00000000`0002ddf7 00000000`00000000 00000000`00000002 : dxgmms1!VidSchiReportHwHang+0x40b
fffff880`02bc39e0 fffff880`045312bb : 00000000`00000102 00000000`00000001 00000000`0002ddf7 00000000`00000000 : dxgmms1!VidSchiCheckHwProgress+0x71
fffff880`02bc3a10 fffff880`045042c6 : ffffffff`ff676980 fffffa80`0b1f7010 00000000`00000000 00000000`00000000 : dxgmms1!VidSchiWaitForSchedulerEvents+0x1fb
fffff880`02bc3ab0 fffff880`04530e7a : 00000000`00000000 fffffa80`0c694920 00000000`00000080 fffffa80`0b1f7010 : dxgmms1!VidSchiScheduleCommandToRun+0x1da
fffff880`02bc3bc0 fffff800`0372cfda : 00000000`fffffc32 fffffa80`0b1fa8c0 fffffa80`069ae9e0 fffffa80`0b1fa8c0 : dxgmms1!VidSchiWorkerThread+0xba
fffff880`02bc3c00 fffff800`034839c6 : fffff800`03607e80 fffffa80`0b1fa8c0 fffff800`03615cc0 fffffa80`0b1d9ee0 : nt!PspSystemThreadStartup+0x5a
fffff880`02bc3c40 00000000`00000000 : fffff880`02bc4000 fffff880`02bbe000 fffff880`02bc23c0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  .bugcheck ; kb

FOLLOWUP_IP: 
atikmpag+7ae4
fffff880`01207ae4 4883ec28        sub     rsp,28h

SYMBOL_NAME:  atikmpag+7ae4

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmpag

IMAGE_NAME:  atikmpag.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4f597fca

FAILURE_BUCKET_ID:  X64_0x116_VRF_IMAGE_atikmpag.sys

BUCKET_ID:  X64_0x116_VRF_IMAGE_atikmpag.sys

Followup: MachineOwner
---------

The crash was Verifier enabled, which is good. In regards to the crash:

• These are all stop 0x116 VIDEO_TDR_FAILURE conditions.
  
  It's not a true crash, in the sense that the bluescreen was initiated only because the combination of video driver and video hardware was being unresponsive, and not because of any synchronous processing exception.
  
  Since Vista, the "Timeout Detection and Recovery" (TDR) components of the OS video subsystem have been capable of doing some truly impressive things to try to recover from issues which would have caused earlier OSs like XP to crash. As a last resort, the TDR subsystem sends the video driver a "please restart yourself now!" command and waits a few seconds. If there's no response, the OS concludes that the video driver/hardware combo has truly collapsed in a heap, and it fires off that stop 0x116 BSOD.
  
  If playing with video driver versions hasn't helped, make sure the box is not overheating. Try removing a side panel and aiming a big mains fan straight at the motherboard and GPU. Run it like that for a few hours or days - long enough to ascertain whether cooler temperatures make a difference. If so, it might be as simple as dust buildup and subsequently inadequate cooling.

  
  The above quote was taken from http://www.sevenforums.com/crashes-debugging/25912-bsod.html#post280172, which is linked to in usasma's thread about this error. Closely follow the first three posts of usasma's thread outlining http://www.sevenforums.com/crash-lo...op-0x116-video_tdr_error-troubleshooting.html and proceed through each step. Let us know if you need further help.