Solved Several BSoD related to "ntoskrnl.exe"

[Erox]

I buildt my own custom computer about 3 months ago, and i've kept getting bluescreens.

the bluescreens appear after i've played a medium-required game (spec wise) like Just Cause 2, or tougher games, like "Total War: Rome 2". The "tougher" graphics, the quicker i blue screen. I've installed BlueScreenViewer, and noticed that every bluescreen, even though the "titles" may be different, all relates to the file "ntoskrnl.exe".

some of the blue screens i've gotten:
"BAD_POOL_HEADER"
"PFN_LIST_CORRUPT"
"MEMORY_MANAGEMENT"
"KMODE_EXCEPTION_NOT_HANDLED"

Let me know if i've skipped some valueable information
I ran the latest version of Memtest, found 0 errors.
Please help me, I have no idea of what can cause these errors. I also got the newest drivers currently available for all my components, including BIOS.

 

[Brink]

Hey Erox, and welcome to Seven Forums.

Please read the instructions here: Blue Screen of Death (BSOD) Posting Instructions, and post back with the needed information. One of our BSOD experts should be by later when able to further help.

 

[Arc]

Hi Erox.

Daemon Tools, Alcohol 120% and Power Archiver Pro uses SCSI Pass Through Direct (SPTD), which is a well known BSOD causer. Uninstall Daemon Tools at first. Then download SPTD standalone installer from Disk-Tools.com, and execute the downloaded file as guided below :

• Double click to open it.
• Click this button only:
• 
• If it is grayed out, as in the picture, there is no more SPTD in your system, and you just close the window.

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.
If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.


If memtest comes to be free form errors, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.
________________________________________________________________________________________

BugCheck A, {fffff70440005300, 0, 1, fffff800030880d9}

Probably caused by : memory_corruption ( nt!MiUpdateWsle+2b9 )

Followup: MachineOwner
--------------------------------------------------------------------
BugCheck 19, {3, fffffa800661bd70, fffffa800661bd00, fffffa800661bd00}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+a53 )

Followup: Pool_corruption
--------------------------------------------------------------------
BugCheck 4E, {99, f7e3, 3, 2f962}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

 

[Erox]

it "worked"

ok, so i uninstalled daemontools and deletes all the SPDTs (the button was grey), and checked every driver not from microsoft in the verifier, and rebooted.

Bluescreen while booting.

Rebooted in safemode, disabled verifier and now im back in normal mode

i think the bluescreen dump is named "112313-3681-01" (I dont know if thats even helping you hehe, you know what you're doing )

I would also like to add that i did a Memtest a couple of days ago, 9 passes with no errors.

Oh, and by the way, this forum is really helpfull, and the fact that this is free makes me feel guilty! Is it possible to donate to this website?

 

[Arc]

The driver verifier enabled crash dump indicates to Virtual Audio Cable by EuMus Design.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D6, {fffff98007605018, 0, fffff88005002b15, 0}

[COLOR=Red][B]*** WARNING: Unable to verify timestamp for vrtaucbl.sys
*** ERROR: Module load completed but symbols could not be loaded for vrtaucbl.sys[/B][/COLOR]

Could not read faulting driver name
Probably caused by : portcls.sys ( portcls!GetMaxMapRegisters+5 )

Followup: MachineOwner
---------

And it is old enough.

fffff880`051e5000 fffff880`051f3a00   vrtaucbl T (no symbols)           
    Loaded symbol image file: vrtaucbl.sys
    Image path: \SystemRoot\system32\DRIVERS\vrtaucbl.sys
[COLOR=Red]    Image name: vrtaucbl.sys
    Timestamp:        Mon Feb 15 22:37:10 2010[/COLOR] (4B797F3E)
    CheckSum:         0001BBDF
    ImageSize:        0000EA00
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Try to update the driver. I am not 100% sure as I dont have the idea about the device, but may be it is the place to update the driver? Ventrilo - Download

If no feasible update is available, rebove the audio device.

Let us know how the computer is working after applying the changes.

 

[Erox]

Ok, so this is interesting-
I removed Ventrilo from my computer, and reinstalled it from their website. But when i uninstalled vent, i saw a program called "virtual audio cable", downloaded the 10th of august (right when the bluescreens began i believe) so i uninstalled that aswell.

i rebooted my computer with verifier enabled just as last time. I did not bluescreen at bootup, i logged into my windows user. I was on the desktop for about 3-5 seconds before i bluescreened. (i pressed the google chrome-shortcut right before it happened).

I'll give you the new dump files

 

[Arc]

The Zip does not contain anuthing new after the dumps of post #4.

Disable verifier now and run the computer normally. Let us know how it is working. Report about any further crash. If needed, later we will enable verifier again.

 

[Erox]

Ok, I just played Total War: Rome 2 and bluescreened

2 days ago, before i deleted the Virtual Audio Cable, i couldn't play Total War: Rome 2 for 5 minutes without bluescreening. yesterday i played it for 3-4 hours! and today i bluescreened within an hour

BUT theres no new dumps

What do i do now?

 

[Arc]

Follow it: http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html
Go to Option Two, Point 2. Download the .reg file and merge it in registry by double clicking it.

Now wait for another BSOD. When it occurred, search the .dmp files manually in the default path: C:\Windows\Minidump or %SystemRoot%\Minidump. See if the crash dump is recorded or not (hopefully it will be recorded).Post it following the Blue Screen of Death (BSOD) Posting Instructions.

Also try to take a camera snap of the bluescreen. May be the code can give some idea.

 

[Erox]

Here we go

Allright, new bluescreen- and this time it left us a dump!

 

[Arc]

If you are sure that the memory is free from errors, enable driver verifier for one more time. This crash dump is not providing about on which it is crashed.

BTW, it appears that Daemon Tools are still there.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {3452, 402000, fffff70001084b70, 8dd00001a9c83424}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35163 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000003452, The subtype of the bugcheck.
Arg2: 0000000000402000
Arg3: fffff70001084b70
Arg4: 8dd00001a9c83424

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_3452

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  rundll32.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800030ffe33 to fffff8000308ebc0

STACK_TEXT:  
fffff880`07928ee8 fffff800`030ffe33 : 00000000`0000001a 00000000`00003452 00000000`00402000 fffff700`01084b70 : nt!KeBugCheckEx
fffff880`07928ef0 fffff800`0305f892 : fffffa80`0a951b30 fffffa80`00000000 fffff8a0`000001fc fffff880`00000000 : nt! ?? ::FNODOBFM::`string'+0x35163
fffff880`079297a0 fffff800`0336315a : fffff8a0`0210c060 fffff880`07929ae0 00000000`00000000 fffffa80`0a8991d0 : nt!MmCleanProcessAddressSpace+0x96
fffff880`079297f0 fffff800`033492ed : 00000000`000000ff 00000000`00000001 000007ff`fffd6000 fffffa80`0a905550 : nt!PspExitThread+0x56a
fffff880`079298f0 fffff800`030816fa : 00000000`00000001 fffff880`07929a68 00000000`0095f800 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`07929920 fffff800`03081a40 : 00000000`77cf45e8 fffff880`079299a0 fffff800`03349260 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`079299a0 fffff800`0308def7 : fffffa80`0a8991d0 00000000`77cf45c0 00000000`000000c0 00000000`00000000 : nt!KiInitiateUserApc+0x70
fffff880`07929ae0 00000000`77c42bba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0095f618 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c42bba


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+35163
fffff800`030ffe33 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+35163

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035

FAILURE_BUCKET_ID:  X64_0x1a_3452_nt!_??_::FNODOBFM::_string_+35163

BUCKET_ID:  X64_0x1a_3452_nt!_??_::FNODOBFM::_string_+35163

Followup: MachineOwner
---------

 

[Erox]

Allright, I double, tripplechecked to see if Daemon tools was properly uninstalled, i repeated the earlier steps of how to uninstall the SPTDs, and followed the instructions of how to manually uninstall Daemon Tools ( on this link )

I enabled verifier once again, bluescreened 3-5 seconds after start-up (after my dekstop appeared on-screen),

good news(?); dump recorded

 

[Arc]

Daemon Tools is still starting up with windows.

DAEMON Tools Lite    "c:\program files (x86)\daemon tools lite\dtlite.exe" -autorun    Even-PC\UpdatusUser    HKU\S-1-5-21-3575535164-2222396146-1872462359-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The BSOD is occured on Nova Shield

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {e3, fffff880047913ef, 13f0f0360, 0}

*** WARNING: Unable to verify timestamp for NSKernel.sys
*** ERROR: Module load completed but symbols could not be loaded for NSKernel.sys
Probably caused by : [URL="http://systemexplorer.net/file-database/file/nskernel-sys"]NSKernel.sys[/URL] ( NSKernel+113ef )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000e3, Kernel Zw API called with user-mode address as parameter.
Arg2: fffff880047913ef, Address inside the driver making the incorrect API call.
Arg3: 000000013f0f0360, User-mode address used as API parameter.
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_e3

FAULTING_IP: 
NSKernel+113ef
fffff880`047913ef 85c0            test    eax,eax

FOLLOWUP_IP: 
NSKernel+113ef
fffff880`047913ef 85c0            test    eax,eax

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  GoogleCrashHan

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800035554ec to fffff800030c8bc0

STACK_TEXT:  
fffff880`071f9718 fffff800`035554ec : 00000000`000000c4 00000000`000000e3 fffff880`047913ef 00000001`3f0f0360 : nt!KeBugCheckEx
fffff880`071f9720 fffff800`03555fd5 : fffffa80`07def8d0 fffff800`0355732e ffffffff`80001948 ffffffff`80001948 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`071f9760 fffff800`035574ae : 00000000`002ffa01 fffff8a0`026dc6e0 00000000`00000000 fffff800`0356701d : nt!ViZwCheckAddress+0x35
fffff880`071f97a0 fffff800`03559d62 : fffff880`047913ef fffff880`071f9a20 ffffffff`80001948 fffff880`04790b0a : nt!ViZwCheckUnicodeString+0x2e
fffff880`071f97e0 fffff880`047913ef : fffff980`23272fe0 ffffffff`80001948 fffff880`071f9a20 fffff880`071f9b00 : nt!VfZwQueryValueKey+0x42
fffff880`071f9830 fffff980`23272fe0 : ffffffff`80001948 fffff880`071f9a20 fffff880`071f9b00 00000000`00001000 : NSKernel+0x113ef
fffff880`071f9838 ffffffff`80001948 : fffff880`071f9a20 fffff880`071f9b00 00000000`00001000 fffff880`071f9870 : 0xfffff980`23272fe0
fffff880`071f9840 fffff880`071f9a20 : fffff880`071f9b00 00000000`00001000 fffff880`071f9870 00000000`00000002 : 0xffffffff`80001948
fffff880`071f9848 fffff880`071f9b00 : 00000000`00001000 fffff880`071f9870 00000000`00000002 fffff880`047909ec : 0xfffff880`071f9a20
fffff880`071f9850 00000000`00001000 : fffff880`071f9870 00000000`00000002 fffff880`047909ec 00000000`00000000 : 0xfffff880`071f9b00
fffff880`071f9858 fffff880`071f9870 : 00000000`00000002 fffff880`047909ec 00000000`00000000 fffff880`071f9a60 : 0x1000
fffff880`071f9860 00000000`00000002 : fffff880`047909ec 00000000`00000000 fffff880`071f9a60 fffff880`071f9b60 : 0xfffff880`071f9870
fffff880`071f9868 fffff880`047909ec : 00000000`00000000 fffff880`071f9a60 fffff880`071f9b60 00000000`00000c40 : 0x2
fffff880`071f9870 00000000`00000000 : fffff880`071f9a60 fffff880`071f9b60 00000000`00000c40 00000000`00000000 : NSKernel+0x109ec


STACK_COMMAND:  kb

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  NSKernel+113ef

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NSKernel

IMAGE_NAME:  NSKernel.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  529490fd

FAILURE_BUCKET_ID:  X64_0xc4_e3_NSKernel+113ef

BUCKET_ID:  X64_0xc4_e3_NSKernel+113ef

Followup: MachineOwner
---------

3: kd> lmvm NSKernel
start             end                 module name
fffff880`04780000 fffff880`047de000   NSKernel T (no symbols)           
    Loaded symbol image file: NSKernel.sys
    Image path: NSKernel.sys
    Image name: NSKernel.sys
    Timestamp:        Tue Nov 26 17:45:57 2013 (529490FD)
    CheckSum:         0005131A
    ImageSize:        0005E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

So either dont use it, or ask the game developer about the further steps about it.

 

[Erox]

another bluescreen

I found some DAEMON tools lite files that I had forgotten, and found the the source of the mysterious "Nova Shield" came from my antivirus- called "Bulldog", so i just uninstalled it.

new bluescreen:

 

[Arc]

If you are 100% sure that there is no error with memory, enable Driver Verifier once again.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 2cb20, 2, 7592f}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

 

[Erox]

Thank you for a quick reply

the driver verifier gave me this blue screen:

 

[Arc]

It catches the display driver this time.

BugCheck C4, {f6, 218, fffffa8008bad060, fffff8800f92a879}

*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
[COLOR=Red]Probably caused by : nvlddmkm.sys[/COLOR] ( nvlddmkm+9a879 )

Followup: MachineOwner
---------

Install the NVIDIA DRIVERS 314.22WHQL only.

• Uninstall All nvidia items in Control Panel > Programs and features
  • 3D Vision Control Driver
  • 3D Vision Driver
  • Graphics Driver
  • HD Audio Driver
  • PhysX
  • nvidia Update
  (Are you using nvidia chipset drivers? If so, dont uninstall anything other than those are listed).
• Now follow Drivers - Clean Left over Files after Uninstalling
• Download 314.22 WHQL. While installing, Select Custom (Advanced) install. In the next page, follow this settings:
  
  

Then, better you continue with DV on, to see if it catches anything else.

 

[Erox]

uh-oh

Theres been a slight problem, i dont know if im allowed to share screenshots, but this is what just showed up when i tried to boot my PC to follow your steps 5 minutes ago

 

[Arc]

I have suggested this exact steps to at least 1000 of peoples. Other members also copied this instruction by quoting me and by that way it got suggested to at least 1000 more times. It never caused such a situation.

So it is not caused by following those steps.

For details, have a look here: BSOD Index

• STOP 0xC0000221: STATUS_IMAGE_CHECKSUM_MISMATCH
• Usual causes: Device driver, System DLL corruption, Faulty hardware in I/O path (a disk error, faulty RAM, or a corrupted page file), BIOS

Boot into System Recovery options and try a System Restore.