Windows 7: BSOD after win7 updates, ntoskrnl.exe+253d0

[Dezekration]

System Started getting BSOD's after a windows update with reference to the ntoskrnl.exe in every crash. I just replaced the RAM today thinking it was possibly a memory issue, but to no avail, I'm still getting frequent BSOD's. I ran an /FS SCANNOW and there were no integrity problems, as well as a chkdisk that also came up empty. Any help is greatly appreciated.

 

[YoYo155]

Hello and welcome .
The dumps are showing driver issues but apart from two separate dumps showing
activity of an nVidia (before the update to the beta driver) and a very old iaStor driver,

0: kd> lmvm iastor
Browse full module list
start             end                 module name
fffff880`0104c000 fffff880`01168000   iaStor   T (no symbols)           
    Loaded symbol image file: iaStor.sys
    Image path: \SystemRoot\system32\DRIVERS\iaStor.sys
    Image name: iaStor.sys
    Browse all global symbols  functions  data
    Timestamp:        [COLOR=Red][U][B]Fri Jun 05 04:53:40 2009[/B][/U][/COLOR]

they aren't concise about a single driver.
Now, if the RAM is brand new I would hold off on testing it and focusing on Driver Verifier for now.
Please enable Driver Verifier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Please enable driver verifier following this TUTORIAL | But using these settings:

1. Go to Start and type in "verifier" (without the quotes) and press Enter
2. Select "Create custom settings (for code developers)" and click "Next"
3. Select "Select individual settings from a full list" and click "Next"
4. Select everything EXCEPT FOR "Low Resource Simulation", "Force Pending I/O Requests", "IRP Logging" and click "Next"
5. Select "Select driver names from a list" and click "Next"
6. Then select all drivers NOT provided by Microsoft, Unknown, or Macrovision and click "Next"
7. Select "Finish" on the next page.

Post back with a couple of DV enabled crashes .

 

[Dezekration]

Been up and running for 5 hours without any BSOD's with Driver Verifier running, will let you know as soon as one occurs, thank you for the response.

 

[YoYo155]

Thanks for the update .
Keep it enabled for 48 hours ,while normally using the PC (as if it wasn't enabled), or until a few crashes occur.

 

[Dezekration]

i've been stressing it, playing league of legends and ffxvi while streaming videos on youtube for the past 8 hours or so, still no crashes, it's trying to make a liar out of me I swear.

 

[Dezekration]

Alright, Had 3 consecutive BSOD's, updated logs incoming.

 

[YoYo155]

Thanks for the feedback .
The dumps point to a potential HDD hardware error.

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: fffff6fc00022ff8, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffffc000000e, error status (normally i/o status code)
Arg3: 00000001f02ea860, current process (virtual address for lock type 3, or PTE)
Arg4: fffff800045ff4c0, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

ERROR_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was specified.

DISK_HARDWARE_ERROR: There was error with disk hardware

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
3990 errors : !nt (fffff800045ff000-fffff800045fffff)

Other bugchecks were 0xF4 which are usually attributed to storage.

Please test the HDD.
Please post a picture of disk managment.

• http://www.sevenforums.com/tutorials/274797-disk-management-post-screen-capture-image.html

   Warning

The Following Method Should NOT Be Performed On An SSD!

Testing the HDD:

1. Perform a Disk Check | Disk Check
2. Then Post the results following | THIS METHOD
3. Download SeaTools for DOS if you don't want to use a CD to test the HDD you can use YUMI – Multiboot USB Creator to create a bootable USB (instructions are found at the bottom of both pages).
4. If SeaTools for Windows is unable to recognize your HDD visit HDDdiag and follow the instructions.

If SeaTools For DOS does not recognize the drive;
Boot into the BIOS using the *Fx key.
Look for an entry called SATA Mode (or something similar), it should be set to IDE / AHCI.
It's probably set to AHCI which is why SeaTools doesn't recognize them in the DOS environment.
Set it to IDE then save and exit usually by pressing the F10 key.
Now boot into SeaTools and it should detect the drives.
Start the Long Test and let it run.
Upon completion don't try to boot into Windows as it will only result in a BSOD, go back into the BIOS
and change the SATA setting back to what it was in the first place.

• *Popular BIOS access keys.

Post back with the results, based upon them we need to determine our next action .

 

[Dezekration]

Alright, logs attached, I ran the seagate tool from a flash drive and it passed the tests.

 

[YoYo155]

Thanks for the feedback .
The CHKDSK looks good as well as you said that the drive passed the seatools tests.
In that case I would remove intel rapid storage.

Get rid of intel rapid storage. First uninstall it from Control Panel > Programs and Features.
Then Uninstall the driver from device manager.

1. Right click on "my computer" icon and click "manage" on the context menu.
2. It will open the "computer management" window.
3. Select "Device Manager" in the left pane, It will list all the existing devices up.
4. Expand "IDE ATA/ATAPI controllers" by clicking on the triangle in front of it.
5. Select one Intel device item under it, right click, uninstall.
6. Continue the process for all Intel items under "IDE ATA/ATAPI controllers"
7. Now restart the computer. At restart, windows will auto configure the appropriate native system driver.

Then I would scan for corrupt files as 3990 errors is not right at all,
I would follow that with a MEMtest86+.

• Follow this tutorial on how to use the SFC/ SCANNOW tool in Windows.

Testing the RAM:

Test and Diagnose RAM Issues with Memtest86+:

• RAM - Test with Memtest86+

   Tip

• :info: Pay close attention to part 3 of the tutorial "If you have errors"
• :tip: Test the RAM with Memtest86+ for at least 7-10 passes. It may take up to 22 passes to find problems. Make sure to run it once after the system has been on for a few hours and is warm, and then also run it again when the system has been off for a few hours and is cold.

When done with the testing procedure take a picture and upload it here.
Post back with the results .

 

[Dezekration]

Alright, will do, I did the first 2 portions of it, Uninstalled the rapid storage and the fs /scannow came back with no integrity issues. I'll run the memtest overnight, I let it run for 3 hours and got 3 passes with no errors, but i'll let it run for a full cycle when I go to bed tonight and report back on a 7+ pass run

 

[YoYo155]

Thanks
Let us know how things fare.

 

[Dezekration]

2 fresh BSOD's, memtest went through 12 passes and came back with no errors. new logs attached.

 

[Dezekration]

bump

 

[Dezekration]

bump

 

[YoYo155]

I'm sorry for the slow reply, but please don't bump the thread.

Now for the dumps.
Both of them are 0xC5, DRIVER CORRUPTED EXPOOL.

The DRIVER_CORRUPTED_EXPOOL bug check has a value of 0x000000C5. This indicates that the
system attempted to access invalid memory at a process IRQL that was too high.

An attempt occurred to touch invalid memory at a process IRQL that is too high. This is almost always
caused by drivers that have corrupted the system pool. If you’ve recently installed any new software,
check to see if it’s properly installed; and check for updated drivers on the manufacturer’s web site.

In our earlier attempt of using Driver Verifier it indicated memory corruption and storage
issues I suggest to run it again using the same settings as in post #2 to see what it comes up with this time.

How old is the HDD and the PSU?
Can you correlate any change made to the PC, be it software or hardware, prior to the BSOD's started?

 

[Dezekration]

Before the issues began I ran windows update and updated my chipset and ethernet drivers. I rolled both of them back. the HDD and PSU are about 4 years old. New set of BSOD's attached.

 

[YoYo155]

Thanks for the update .

Going through the new dumps I noticed that the vast majority are showing file system activity,
I found that you're using a very old driver that does just that.

lmvm [U][B]iaStor[/B][/U]
start             end                 module name
fffff880`01002000 fffff880`0111e000   iaStor   T (no symbols)           
    Loaded symbol image file: iaStor.sys
    Image path: \SystemRoot\system32\DRIVERS\iaStor.sys
    Image name: iaStor.sys
    Timestamp:        [COLOR=Red][U][B]Fri Jun 05 04:53:40 2009[/B][/U][/COLOR]

• Driver Reference Table - iaStor.sys

Please remove intel rapid storage technology.

Get rid of intel rapid storage. First uninstall it from Control Panel > Programs and Features.
Then Uninstall the driver from device manager.

1. Right click on "my computer" icon and click "manage" on the context menu.
2. It will open the "computer management" window.
3. Select "Device Manager" in the left pane, It will list all the existing devices up.
4. Expand "IDE ATA/ATAPI controllers" by clicking on the triangle in front of it.
5. Select one Intel device item under it, right click, uninstall.
6. Continue the process for all Intel items under "IDE ATA/ATAPI controllers"
7. Now restart the computer. At restart, windows will auto configure the appropriate native system driver.

Please remove the Sendori monitoring software.

c:\program files (x86)\sendori\sndappv2.exe

Scan for possible infection.

• Download TDSS-Killer and scan for rootkits.
• Download Kaspersky Rescue CD and scan for other types of infections. (a how-to tutorial)

Keep us in the know .

 

[Dezekration]

good call on the TDSS, I did in fact have a rootkit virus, it has been dispatched. I uninstalled sendori and the rapid storage and removed the devices and rebooted as asked. I'll have to hunt down an cd to burn the iso onto then i'll run the rescue cd virus scan, I will let you know if any further problems persist, thank you very much.

 

[YoYo155]

Thanks for the feedback .
You can use a USB thubmdrive (1GB+) to create the Kaspersky Rescue CD, it will even be faster that way .

How to record Kaspersky Rescue Disk 10 to an USB device and boot my computer from it?

 

[Dezekration]

Alright, thanks for the link there, making a boot image on my usb drive now then running it, will post back with results.