Solved Windows 7 Ultimate crashing - ntoskrnl.exe

[enrique936]

I ran chkdsk with no errors in the HDD, and Hitachi's long test with no errors, I upload now the screenshots of both hard drives running crystal disk info, and the latest dump files:

 

[enrique936]

also, I don't know if it has anything to do, but the SSD is configured as MBR not GPT

 

[YoYo155]

As it should be.
I'll take a look at the dump once I get to my analysis PC.

 

[enrique936]

thanks! I'll be waiting for your answer

 

[enrique936]

I upload the files from the most recent crashes, just in case:

 

[YoYo155]

If you had Driver Verifier it would be more helpful to crash with it logging!

Btw, all of the old dumps point to memory faults, BUT there's one dump (from the 03/06/13 batch) that points to a held driver but you cant access the IRPs (also could be bad RAM) but with DV it could be more precise in pointing us while debugging.

http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

 

[enrique936]

I'll enable driver verifier now to see if I can get it to crash again, it usually happens when I'm trying to update certain programs, but it happens randomly, not with specific programs.

 

[YoYo155]

Did you have Malwarebytes while crashing before as well?

Just to keep you posted I'm editing these as I go through the recent dumps.

060313-19110-01.dmp - indicates "iusb3hub.sys" as the culprit (but that is not always the case).

 

[enrique936]

Yes, malwarebytes was the first program I installed since I did the clean install, followed by MSE

 

[YoYo155]

.bugcheck
Bugcheck code 00000024
Arguments 00000000`001904fb fffff880`0b08d158 fffff880`0b08c9b0 fffff880`012b228a

# Child-SP          RetAddr           : Args to Child                                                           : Call Site
00 fffff880`0b08c188 fffff880`01222688 : 00000000`00000024 00000000`001904fb fffff880`0b08d158 fffff880`0b08c9b0 : [B][COLOR=Red]nt!KeBugCheckEx[/COLOR][/B]
01 fffff880`0b08c190 fffff880`01311343 : fffff880`0126c95c fffff880`0b08d770 fffff880`0b08d770 00000000`00000018 : [COLOR=Red][B]Ntfs! ?? ::FNODOBFM::`string'+0x2899[/B][/COLOR]
02 fffff880`0b08c1d0 fffff800`02cfccdc : fffff880`0b08d158 fffff880`0b08c9b0 00000000`00000000 fffff880`012371f0 : [COLOR=Red][B]Ntfs! ?? ::NNGAKEGL::`string'+0x81c8[/B][/COLOR]
03 fffff880`0b08c200 fffff800`02cfc75d : fffff880`0126c950 fffff880`0b08d770 00000000`00000000 fffff880`0121e000 : nt!_C_specific_handler+0x8c
04 fffff880`0b08c270 fffff800`02cfb535 : fffff880`0126c950 fffff880`0b08c2e8 fffff880`0b08d158 fffff880`0121e000 : nt!RtlpExecuteHandlerForException+0xd
05 fffff880`0b08c2a0 fffff800`02d0c4d1 : fffff880`0b08d158 fffff880`0b08c9b0 fffff880`00000000 00000000`00000050 : nt!RtlDispatchException+0x415
06 fffff880`0b08c980 fffff800`02cd1282 : fffff880`0b08d158 fffff8a0`00204bc0 fffff880`0b08d200 00000000`0000002a : nt!KiDispatchException+0x135
07 fffff880`0b08d020 fffff800`02ccfdfa : 00000000`00000001 00000000`0000164b 00000000`00000700 fffff8a0`00204bc0 : nt!KiExceptionDispatch+0xc2
08 fffff880`0b08d200 fffff880`012b228a : fffff880`00000001 00000000`0000000e fffff880`012b66b0 00000000`000007ff : nt!KiPageFault+0x23a (TrapFrame @ fffff880`0b08d200)
09 fffff880`0b08d390 fffff880`012b3ec1 : 00000000`00000010 fffff880`012b3e20 00000000`00000010 00000000`00010286 : Ntfs!NtfsQueryDirectory+0x33a
0a fffff880`0b08d730 fffff880`012b67bf : fffffa80`0ff4fe40 00000000`00000000 00000000`00000002 00000000`00000000 : Ntfs!NtfsCommonDirectoryControl+0xa1
0b fffff880`0b08d770 fffff800`0317bd26 : fffff980`0ac4cc60 fffff980`0ac4cc60 fffffa80`0ff4fe40 fffff880`0b08d798 : Ntfs!NtfsFsdDirectoryControl+0x10f
0c fffff880`0b08d7e0 fffff880`00e47bcf : fffff980`0ac4cfb8 fffff880`0b08d880 fffffa80`0f4173a0 fffffa80`12a68bd0 :[B][COLOR=RoyalBlue] nt!IovCallDriver+0x566[/COLOR][/B]
0d fffff880`0b08d840 fffff880`00e466df : fffffa80`0f1938e0 fffffa80`0f1938e0 fffffa80`0f193800 fffff980`0ac4cc60 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
0e fffff880`0b08d8d0 fffff800`0317bd26 : fffff980`0ac4cc60 00000000`00000002 fffffa80`0f42df20 00000000`00000000 : fltmgr!FltpDispatch+0xcf
0f fffff880`0b08d930 fffff800`02fbc2ad : fffff980`0ac4cc60 00000000`00000001 fffffa80`0f42df20 fffffa80`12782450 : [COLOR=RoyalBlue][B]nt!IovCallDriver+0x566[/B][/COLOR]
10 fffff880`0b08d990 fffff800`02cd0e93 : fffffa80`11786060 fffff880`0b08db60 00000000`0561ee58 fffff880`0b08da88 : nt!NtQueryDirectoryFile+0x1ad
11 fffff880`0b08da70 00000000`76f7166a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0b08dae0)
12 00000000`0561ee38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f7166a

!thread
GetPointerFromAddress: unable to read from fffff80002f09000
THREAD fffffa8011786060  Cid 0300.0dc0  Teb: 000007fffff66000 Win32Thread: 0000000000000000 RUNNING on processor 5
[B][COLOR=SeaGreen]IRP List:
    Unable to read nt!_IRP @ fffff9800ac4cc60[/COLOR][/B]
Not impersonating
GetUlongFromAddress: unable to read from fffff80002e48ba4
Owning Process            fffffa8012547b30       Image:         MsMpEng.exe
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      5194         
Context Switch Count      12651          IdealProcessor: 3             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x0000000076f3fbc0
Stack Init fffff8800b08dc70 Current fffff8800b08cbd0
Base fffff8800b08e000 Limit fffff8800b088000 Call 0
Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5

!verifier 100
Verifier IRP transition log is not available.
Either [COLOR=RoyalBlue][B]Driver Verifier I/O Checking is not enabled[/B][/COLOR],
or Verifier failed to allocate memory for the IRP log.

Driver Verifier !

 

[enrique936]

I enabled driver verifier now and will wait for my computer to crash, I'll post the results as soon as possible, thanks!

 

[enrique936]

here are the latest dump files, I got a BSOD while updating a driver, saying system service exception, and another one when running SF diagnostics tool

 

[YoYo155]

Are these currently installed?

BrFiltLo     Brother USB Mass-Stora Kernel        06/08/2006 21:51:06   
BrFiltUp     Brother USB Mass-Stora Kernel        06/08/2006 21:51:02   
Brserid      Brother MFC Serial Por Kernel        06/08/2006 21:51:11   
BrSerWdm     Brother WDM Serial dri Kernel        06/08/2006 21:51:05   
BrUsbMdm     Brother MFC USB Fax On Kernel        06/08/2006 21:51:00   
BrUsbSer     Brother MFC USB Serial Kernel        09/08/2006 8:11:02 
adp94xx      adp94xx                Kernel        05/12/2008 20:54:42   
adpahci      adpahci                Kernel        01/05/2007 13:30:09   
adpu320      adpu320                Kernel        27/02/2007 21:04:15 
arc          arc                    Kernel        24/05/2007 17:27:55  
ebdrv        Broadcom NetXtreme II  Kernel        31/12/2008 13:29:28 
LSI_FC       LSI_FC                 Kernel        09/12/2008 19:46:09   
SiSRaid2     SiSRaid2               Kernel        24/09/2008 14:28:20  
SiSRaid4     SiSRaid4               Kernel        01/10/2008 17:56:04   
nfrd960      nfrd960                Kernel        06/06/2006 17:11:48   
secdrv       Security Driver        Kernel        13/09/2006 9:18:38

You can reference some HERE

 

[enrique936]

where can I check if those drivers are installed?

 

[enrique936]

I looked in the DV and secdrv is the only one of those drivers that is in the list

 

[enrique936]

I realise I was looking in the wrong place, I have all of those in the System32/drivers folder, except for ebdrv

 

[enrique936]

I got one more BSOD today, here is the file:

 

[Vir Gnarus]

Your crashes often showed corruption caused by a solitary bit. Most common cause of this is hardware, and unfortunately there's not really a good solid way to testing which hardware is the problem without swapping out parts. Since you already ran Memtest, we can rule out memory for now. I have a bad feeling it may be the Trio of Trouble: CPU/PSU/Mobo. Single bit flips like what I witnessed here are most commonly caused by a problem with one of these three parts, but they are also the hardest to test, and are nearly impossible without proper testing equipment. Your best bet is to just start swapping parts. I recommend you start with the power supply, then move on to the CPU, then finally the motherboard.

 

[enrique936]

It may be a little for me to test those parts, because I have a laptop, and also, I don't have another CPU or PSU or motherboard to swap them, right now I'm only getting memory related blue screens when trying to scan my portable WD hard drive, any other time, I get driver irql not less or equal, and page fault in nonpaged area

 

[Vir Gnarus]

Oh, btw, drive problems can cause this too (not as much as Mobo/PSU/CPU), so don't leave that out. I see you tried the Hitachi test as well as CrystalDiskInfo and they didn't show up with anything. Have you tried Short/SMART tests on Seatools as well? Wouldn't hurt. Still, SSDs still can go on the fritz in ways that software tests cannot detect.