[SOLVED] BSOD from ntoskrnl.exe and others

Hockeywarrior · Sep 27, 2010

· OS - Windows 7 Ultimate 64 bit full version
· Clean install -- this OS was the first installed on the hard drive
· Hardware age: 1 month for CPU, MB, and HD. 1 year for video card and PSU.
· OS installation age: 1 month, clean install. (installed when I built my system)
· Intel i-7 930 Bloomfield 2.8 ghz (8 cores)
· Geforce 260 GTX 896 MB
· Asus Rampage III microi-ATX motherboard
· Roswill 630 Watt PSU

So for the last month I have been having pretty much one BsoD per day, basically ever since I put this mostly new system together myself. I haven't been able to trace the cause of the crashes. It never happens when I am gaming -- the majority of the time my PC BsoD's I am either not using or am browsing the internet.

A couple of days ago I decided to stop using Mozilla because it has been crashing constantly, and I figured it might be related to my Bso, and began to use Google Chrome instead. Sure enough I had no BSoD yesterday, but as of today that changed -- I came home and noticed it had strangely crashed a few times (?) because there were three minidumps instead of just one.

I actually haven't seen the last few BSoD's happen but lately windows debug has been telling me that they're caused by ntoskrnl.exe. But past dumps have given other causes, such as win32k.sys, Ntfs.sys, and dxgmms1.sys. I have also seen these BSoD errors in the last few weeks (only the ones I have witnessed):

PFN LIST CORRUPT
SYSTEM SERVICE EXCEPTION
IRQL NOT LESS OR EQUAL
MEMORY MANAGEMENT

Seeing all of this and doing a bit of research, I thought that maybe my memory was messed up, so I ran Memtest 86+ overnight and had no errors. I also checked my RAM voltages in my BIOS. My RAM's recommended voltages are 1.55-1.75 and my numbers were a tad slow so I changed it to 1.6. Obviously this didn't change anything.

I'm also positive that my RAM is compatible with my motherboard because the exact product code for the RAM is listed as compatible memory in the mobo manual.

And as of today I have been getting errors saying that Windows Explorer has stopped working ... it actually happened while typing this. Really weird.

Just so you know I attached all of the dumps I've been able to keep from the last two weeks, in the BSoD dumps.zip file. And the Perfmon.html file is included in the Windows7_Vista zip file.

So I know these things can be tricky but I really want to get to the bottom of this problem. Any help would be greatly appreciated!

jcgriff2 · Sep 27, 2010

Re: BSOD from ntoskrnl.exe and others

Hi -

Remove Daemon Tools/ Alcohol 120. The common driver sptd.sys is known to cause BSODs.

You mentioned seeing ntfs.sys in a prior BSOD. One of the 3 dumps noted "HIVE" - referring to the registry.

Run chkdsk /r on the HDD.

If BSODs persist, run the Driver Verifier -- http://jcgriff2.com/driver_verifier.htm

Windbg Logs
--> http://jcgriff2.net/BSOD_Logs/_99-dbug_Hockeywarrior_Windows7x64_09-27-2010_jcgriff2_.txt
--> http://jcgriff2.net/BSOD_Logs/_99-dbug_Hockeywarrior_Windows7x64_09-27-2010_jcgriff2_.txt.zip

Regards. . .

jcgriff2

`

BSOD BUGCHECK SUMMARY

Code:

[font=lucida console]
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Sep 27 12:50:51.506 2010 (GMT-4)
System Uptime: 0 days 0:33:29.630
Probably caused by : ntkrnlmp.exe ( nt!HvIsCellAllocated+171 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  rundll32.exe
Bugcheck code 00000050
Arguments fffff8a0`4de2d008 00000000`00000000 fffff800`02d455d1 00000000`00000005
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Sep 27 12:16:08.828 2010 (GMT-4)
System Uptime: 0 days 0:25:14.952
Probably caused by : ntkrnlmp.exe ( nt!HvCheckHive+90 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  rundll32.exe
Bugcheck code 00000050
Arguments fffff8a0`4bcc8008 00000000`00000000 fffff800`02d06970 00000000`00000005
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Sep 27 11:49:36.805 2010 (GMT-4)
System Uptime: 0 days 0:57:50.929
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
BUGCHECK_STR:  0x4E_99
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  rundll32.exe
Bugcheck code 0000004E
Arguments 00000000`00000099 00000000`001c536a 00000000`00000000 00000000`00000000
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  

by [color=navy]jcgriff2     
             
         J. C. Griffith, Microsoft MVP[/color]   
             
           [url=https://mvp.support.microsoft.com/profile/Griffith][color=#000055][u]https://mvp.support.microsoft.com/profile/Griffith[/u][/color][/url]   
             
           [url=www.jcgriff2.com][color=#000055][u]www.jcgriff2.com[/u][/color][/url] 


¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨


  [/font]

Hockeywarrior · Sep 28, 2010

Re: BSOD from ntoskrnl.exe and others

OK thanks for the reply. I uninstalled Daemon Tools and ran the disk check. The funny thing is in addition to explorer crashing all the time yesterday, a ton of my programs wouldn't work either. Now, after the disk check did its thing, I'm not having any issues with those programs.

It will probably take some time to see if I'm still getting BSoD's, because I don't know the trigger (s) that cause it every single time, and it sometimes can take a while for it to happen. I'll keep you posted.

Can you explain what the driver verifier actually does? I'm curious before I use it.

Thanks again.

Hockeywarrior · Sep 29, 2010

Re: BSOD from ntoskrnl.exe and others

OK so the disk check DEFINITELY did not solve the problem. I had no BSOD's yesterday, but today, as I was using Microsoft Word to do some work, I got a BSOD, related to win32k.

PAGE FAULT IN A NON PAGED AREA

This time though, when the PC restarted things were clearly messed up. My windows background was set to default and I was unable to run most programs. My PC clock was also set to military time for some reason. On top of this, Windows Explorer kept crashing.

So I restarted my PC in safe mode and that is how I'm typing this right now. I have attached the crash dump. I haven't had a chance to run driver verifier yet, mainly because I don't have the time at the moment.

Apparently something is very very wrong here.

Thanks for your help ...

Hockeywarrior · Sep 30, 2010

Re: BSOD from ntoskrnl.exe and others

BUMP.

Could someone please offer their insight into this please? Thanks

Hockeywarrior · Sep 30, 2010

Re: BSOD from ntoskrnl.exe and others

Well it looks like I'll just talk to myself then.

As of right now I am running the driver verifier. I guess I'm a about half way through since it said to run it for at least 24 hours.

I don't really see the point of it though, since Windows is pretty screwed up right now. I can't pin icons to the task bar, things crash occasionally, and small things like text size and when I drag windows I only see empty boxes ... all of this happened after the most recent BSOD.

I'm pretty close to just reformatting and reinstalling Windows 7. Of course, if this is a hardware issue then I guess it won't make a difference.

jcgriff2 · Oct 1, 2010

Re: BSOD from ntoskrnl.exe and others

Hi -

The lone dump had a bugcheck = 0x50 = invalid memory referenced

sptd.sys still showing up -

Code:

[font=lucida console]
sptd.sys     Sun Oct 11 16:55:14 2009 (4AD24632)
[/font]

Disable it via REGEDIT.

1. Create system restore point
START | type create | "Create a system restore point"

2. Go in to regedit -
START | type regedit

Code:

[FONT=Lucida Console]
[COLOR=red]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sptd[/COLOR]
    Type    		REG_DWORD    0x1
    [COLOR=Blue]Start    [/COLOR]           REG_DWORD    [COLOR=blue]0x0[/COLOR]
    ErrorControl        REG_DWORD    0x1
    ImagePath	        REG_EXPAND_SZ    System32\Drivers\sptd.sys
    DisplayName         REG_SZ       sptd
    Group	        REG_SZ       Boot Bus Extender
    Tag		        REG_DWORD    0x3
[/font]

- go to the SPTD key in red
- 2x-click on sptd "folder"
- locate "Start"
- 2x-click on blue icon next to "Start"
- change the DWORD 0 to 4 (disable)

See if sptd.sys disablement helps.

Windbg Logs
--> http://jcgriff2.net/BSOD_Logs/_99-dbug_Hockeywarrior_Windows7x64_09-30-2010_jcgriff2_.txt
--> http://jcgriff2.net/BSOD_Logs/_99-dbug_Hockeywarrior_Windows7x64_09-30-2010_jcgriff2_.txt.zip

Regards. . .

jcgriff2

`

BSOD BUGCHECK SUMMARY

Code:

[font=lucida console]
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Wed Sep 29 17:25:19.739 2010 (GMT-4)
System Uptime: 0 days 7:07:11.863
Probably caused by : win32k.sys ( win32k!vAlphaPerPixelOnly+26 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  WINWORD.EXE
Bugcheck code 00000050
Arguments fffff900`82a26f78 00000000`00000000 fffff960`000e98ae 00000000`00000002
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``  [/font]

Hockeywarrior · Oct 7, 2010

Re: BSOD from ntoskrnl.exe and others

Thanks for the help. I just thought I would post an update. Ever since the last BSOD last week (that seemed to screw some stuff up in Windows), I have been totally BSOD free, until today. I came back to my computer later in the day and saw that it had rebooted.

Looking at the crash dump with Windows Debug it says the probable cause of the BSOD was Ntfs.sys. I WOULD attach the crash dump but now Windows is telling me that I don't have permission to zip the file. What the heck is going on?

Thanks

Hockeywarrior · Oct 7, 2010

Re: BSOD from ntoskrnl.exe and others

Oh and I forgot one thing -- I disabled that file in the registery like you told me to. But upon doing more research I found out that it is required for windows to start! Is it a good idea to disable it then?

Jonathan_King · Oct 7, 2010

Re: BSOD from ntoskrnl.exe and others

It's required for SPTD to start, not Windows. That is a fine way to do it.

With due respect to BSOD master jcgriff2, may I propose a different way to remove SPTD?

Use the manufacturer's tool to uninstall SPTD: http://www.duplexsecure.com/download/SPTDinst-v174-x64.exe

That will actually remove SPTD, rather than just disabling it.

The choice is us to you.

Hockeywarrior · Oct 8, 2010

Re: BSOD from ntoskrnl.exe and others

Well I came back to my PC tonight and had yet another BSOD! This time Windows Debug told me it was cuased by fileinfo.sys.

Once again Windows will NOT let me zip these dumps -- access is denied. How do I make it so I can zip them? I already AM an administrator.

This is yet another new problem that I never had before, as I have already zipped and sent some dumps to you. Every time I have a BSOD things get more and more screwed up in Windows.

I'm quickly approaching the point where I want to wipe everything and reinstall Win7 fresh. But, I want to make sure this isn't somehow a hardware problem (though I doubt that now, since I had a full week with no crashing).

Jonathan_King · Oct 8, 2010

Re: BSOD from ntoskrnl.exe and others

Follow these directions instead: http://www.techsupportforum.com/f217/blue-screen-of-death-bsod-posting-instructions-452654.html

Hockeywarrior · Oct 8, 2010

Re: BSOD from ntoskrnl.exe and others

Jonathan_King said:
Follow these directions instead: http://www.techsupportforum.com/f217/blue-screen-of-death-bsod-posting-instructions-452654.html

I already did that in the first post. You want me to do it again?

Jonathan_King · Oct 8, 2010

Re: BSOD from ntoskrnl.exe and others

Please.

While dumps is probably all we need, the jcgriff2 report contains other info as well, such as event viewer logs.

Better too much info than not enough.

Hockeywarrior · Oct 8, 2010

Re: BSOD from ntoskrnl.exe and others

Jonathan_King said:
Please.

While dumps is probably all we need, the jcgriff2 report contains other info as well, such as event viewer logs.

Better too much info than not enough.

Ugh I was in the middle of recompiling the folder when my system BSOD'd AGAIN! (MEMORY MANAGEMENT, ntoskrnl.exe) This is getting ridiculous. I decided to boot into safe mode and do everything from there, but when I tried that, it started to load all the windows files, then just rebooted to Normal Mode without asking me.

So my PC won't even boot into safemode ... this is crazy! I'm even having trouble backing up some data because Windows for some reason won't let me view hidden files on my system. I go into Control Panel to show hidden files, and every time I hit apply, it doesn't remember the setting.

I'm going to try to compile that file again, but I'm quickly approaching just wiping everything and reinstalling Windows 7 fresh -- especially since so many things are messed up right now.

jcgriff2 · Oct 8, 2010

Re: BSOD from ntoskrnl.exe and others

Hockeywarrior said:
it says the probable cause of the BSOD was Ntfs.sys.

NTFS = HDD

Run HDD diagnostics - http://www.techsupportforum.com/2828431-post7.html

Start with SeaTools for DOS.

Regards. . .

jcgriff2

`

Hockeywarrior · Oct 9, 2010

Re: BSOD from ntoskrnl.exe and others

jcgriff2 said:
NTFS = HDD

Run HDD diagnostics - http://www.techsupportforum.com/2828431-post7.html

Start with SeaTools for DOS.

Regards. . .

jcgriff2

`

Sorry I haven't been replying very quickly. Since my past post things have gone down hill pretty fast. At one point it was crashing so quickly I wasn't even able to reply on this forum.

So before I could see this post I decided to back up as much data as possible and reinstall Windows 7 fresh. I totally reformatted the HD, and the installation went off without any hitches. But sure enough, today I had two blue screen errors. One was PAGE FAULT IN A NON PAGED AREA (ntfs.sys) and I don't know what the other was.

I got so fed up with this that I just took it to a computer specialist near me that I trust. I know now that it's got to be a hardware problem but I don't have the time anymore to trouble shoot it. I figure it's either my RAM or my HD. Hell my HD is probably full of errors because of all these BSOD's.

I thank you all for your help through all of this. When I find out what the problem is I'll be sure to post here again.

jcgriff2 · Oct 9, 2010

Re: BSOD from ntoskrnl.exe and others

Hi -

A fresh Windows install on a formatted HDD with all Windows Updates & driver updates installed on a system that immediately BSODs does point to hardware as the likely cause.

My only advice to you is to keep in contact with the PC repair shop as you certainly don't want to spend more on repairs than a new system would cost.

Good Luck to you.

Regards. . .

jcgriff2

`

Hockeywarrior · Oct 17, 2010

Re: BSOD from ntoskrnl.exe and others

jcgriff2 said:
Hi -

A fresh Windows install on a formatted HDD with all Windows Updates & driver updates installed on a system that immediately BSODs does point to hardware as the likely cause.

My only advice to you is to keep in contact with the PC repair shop as you certainly don't want to spend more on repairs than a new system would cost.

Good Luck to you.

Regards. . .

jcgriff2

`

And I'm back! Of course, the guys at the PC place couldn't come to a conclusion. As a matter of fact, they couldn't even get it to crash while they had it, so couldn't really analyze the circumstances of the BSODs.

Their guess is that there is either an issue with my RAM or the PSU. They ran 42 passes on my RAM with memtest without any issues, though they said that they did not use a 64 bit version, so that's one thing I could try. They also ran the Hitachi test on my HD with no problems at all. All my hardware checked out according to their tests, but obviously there has to be a hardware problem somewhere.

Because my PSU is a pretty crappy brand, they also said that there could be problems caused by that, and they didn't really have a way of testing the PSU.

Either way, I'm pretty much back where I was, but $100 poorer. The first 4 days I had it back from the PC guys it didn't crash at all, until last night. Dump points to ntoskrnl.exe as the cause.

Why is it that I don't have permission to zip the crash dump files? Do I need to change a setting somewhere?

jcgriff2 · Oct 17, 2010

Re: BSOD from ntoskrnl.exe and others

Hockeywarrior said:
They ran 42 passes on my RAM with memtest without any issues, though they said that they did not use a 64 bit version, so that's one thing I could try.

Why is it that I don't have permission to zip the crash dump files? Do I need to change a setting somewhere?

What memory test did they run?

Let's get fresh reports.

Download and run this app - http://jcgriff2.com/0x2/Windows_NT6_BSOD_v3.03_jcgriff2_.exe

Output = new folder created in Documents = Windows_NT6_BSOD_jcgriff2

Zip the whole folder up and attach to your next post.

Install PC Wizard - http://www.cpuid.com/downloads/pc-wizard/2010.1.95-setup.exe

Be careful -- un-check the boxes for the Ask toolbar.

Run PC Wizard, Click on "File", "Save As", check box for Range - Selected category - Hardware, save as text file. Include in zip attachment.

Regards. . .

jcgriff2

`

[SOLVED] BSOD from ntoskrnl.exe and others

Registered

Attachments

Administrator, Manager, Microsoft Support, MVP

Registered

Registered

Attachments

Registered

Registered

Administrator, Manager, Microsoft Support, MVP

Registered

Registered

Registered

Registered

Registered

Registered

Registered

Registered

Administrator, Manager, Microsoft Support, MVP

Registered

Administrator, Manager, Microsoft Support, MVP

Registered

Administrator, Manager, Microsoft Support, MVP