# [SOLVED] ntoskrnl.exe BSOD



## Cat Box (Oct 24, 2009)

Hi, 

In the past few days I have had pretty regular BSODs due to what seems to be the ntoskrnl.exe crashing.

To the best of my knowledge all my various drivers are up to date as well as my OS.

I ran memtest86 for almost 20 hours in the past three days with no sign of the RAM being 'bad'.

CrystalDiskInfo shows my hard drives to be in working order free of defects.

Now for the pertinent information requested in the BSOD form...

=============================================

· OS - Windows 7 64bit

· What was original installed OS on system? - None.

· Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)? - Retail version I purchased.

· Age of system (hardware) - Less than twelve months.

· Age of OS installation - have you re-installed the OS? - Less than twelve months, with NO re-install.

· CPU - AMD Phenom II X4 925 2.80 GHz

· Video Card - NVIDIA GeForce GTX 570

· MotherBoard - Gigabyte GA-790XT-USB3

· Power Supply - Cooler Master 600 watts

· System Manufacturer - Various parts assembled by me.

· Exact model number - N/A

View attachment BSOD.zip


----------



## Cat Box (Oct 24, 2009)

*Re: ntoskrnl.exe BSOD*

48 hour bump.


----------



## Cat Box (Oct 24, 2009)

*Re: ntoskrnl.exe BSOD*

Ran memtest for over 20 hours and came up with 2 errors.

=================================================
Time: 21:34:01 Iterations: 24 Test Selection: St# Pass: 21 Errors: 2

Test | Pass | Failing address | Good | Bad | Err-bits | Count | Cpu
7 | 6 | 00123a85fd0 - 4666.3 MB | 01000000 | 00000000 | 01000000 | 1 | 0
7 | 6 | 0012ba85fb0 - 4791.3 MB | 01000000 | 00000000 | 01000000 | 2 | 0​


----------



## Cat Box (Oct 24, 2009)

*Re: ntoskrnl.exe BSOD*

Four day bump...


----------



## satrow (Feb 4, 2012)

*Re: ntoskrnl.exe BSOD*

Sorry for the extended delays Cat, we've been understaffed in this section recently.

Any memtest error means there's a problem either with the RAM or with the slot. To check, test only 1 stick in slot 1 for 7+ passes (or until you hit an error). If you have only 1 'bad' stick, test it again in Slot2.

Any hardware problem will beat anything we can do with drivers and software to fix it, if you have to replace only 1 RAM stick, please continue testing with the remaining *good* one, in Windows.

In the most recent dump (0xD1), Driver Verifier flagged *TotRec8.sys* Total Recorder WDM audio filter driver Sound recording tools: Total Recorder - captures any audio from the Internet, records audio from CD, microphone, line-in, converts any sound formats to WAVE and MP3 <--- uninstall or update it.

3rd party drivers:


> LHidFilt.Sys	6/17/2009 17:49:39
> LMouFilt.Sys	6/17/2009 17:49:43
> amdxata.sys	3/19/2010 17:18:18
> nusb3hub.sys	11/19/2010 02:34:24
> ...


*I strongly suggest you uninstall Eset and Comodo security products* as either, or both, might be playing a part in this. Install this: Microsoft Security Essentials - Free Antivirus for Windows and enable the Windows built-in firewall during testing.

```
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff88006793490, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: fffff88006793490, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003513100
GetUlongFromAddress: unable to read from fffff800035131c0
 fffff88006793490 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
TotRec8+1e490
fffff880`06793490 488b3dd16fffff  mov     rdi,qword ptr [TotRec8+0x15468 (fffff880`0678a468)]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xD1

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff88003b1c0f0 -- (.trap 0xfffff88003b1c0f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffdfffa3f1228 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88006793490 rsp=fffff88003b1c280 rbp=0000000000000162
 r8=0000000000000000  r9=0000000000000000 r10=fffff88006793490
r11=fffffa800972af78 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
TotRec8+0x1e490:
fffff880`06793490 488b3dd16fffff  mov     rdi,qword ptr [TotRec8+0x15468 (fffff880`0678a468)] ds:fffff880`0678a468=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032e3769 to fffff800032e41c0

FAILED_INSTRUCTION_ADDRESS: 
TotRec8+1e490
fffff880`06793490 488b3dd16fffff  mov     rdi,qword ptr [TotRec8+0x15468 (fffff880`0678a468)]

STACK_TEXT:  
fffff880`03b1bfa8 fffff800`032e3769 : 00000000`0000000a fffff880`06793490 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff880`03b1bfb0 fffff800`032e23e0 : fffffa80`069ac260 00000000`00000000 00000000`00000001 00000000`00000002 : nt!KiBugCheckDispatch+0x69
fffff880`03b1c0f0 fffff880`06793490 : fffff880`0678a968 00000000`00000002 00000000`00000162 00000000`00000000 : nt!KiPageFault+0x260
fffff880`03b1c280 fffff880`0678a968 : 00000000`00000002 00000000`00000162 00000000`00000000 00000000`00000000 : TotRec8+0x1e490
fffff880`03b1c288 00000000`00000002 : 00000000`00000162 00000000`00000000 00000000`00000000 00000000`00000000 : TotRec8+0x15968
fffff880`03b1c290 00000000`00000162 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x2
fffff880`03b1c298 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x162


STACK_COMMAND:  kb

FOLLOWUP_IP: 
TotRec8+1e490
fffff880`06793490 488b3dd16fffff  mov     rdi,qword ptr [TotRec8+0x15468 (fffff880`0678a468)]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  TotRec8+1e490

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: TotRec8

IMAGE_NAME:  TotRec8.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4e1708d0

FAILURE_BUCKET_ID:  X64_0xD1_VRF_CODE_AV_BAD_IP_TotRec8+1e490

BUCKET_ID:  X64_0xD1_VRF_CODE_AV_BAD_IP_TotRec8+1e490

Followup: MachineOwner
---------
```
3 previous dumps looked like this:

```
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8008d01b30, Terminating object
Arg3: fffffa8008d01e10, Process image file name
Arg4: fffff80003596660, Explanatory message (ascii)

Debugging Details:
------------------

----- ETW minidump data unavailable-----

PROCESS_OBJECT: fffffa8008d01b30

IMAGE_NAME:  csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: csrss

FAULTING_MODULE: 0000000000000000 

PROCESS_NAME:  csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0xF4_fffff800c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`077c00e8 fffff800`0361d772 : 00000000`000000f4 00000000`00000003 fffffa80`08d01b30 fffffa80`08d01e10 : nt!KeBugCheckEx
fffff880`077c00f0 fffff800`035caf7b : ffffffff`ffffffff fffffa80`095c0060 fffffa80`08d01b30 fffffa80`08d01b30 : nt!PspCatchCriticalBreak+0x92
fffff880`077c0130 fffff800`0354a0f4 : ffffffff`ffffffff 00000000`00000001 fffffa80`08d01b30 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x176d6
fffff880`077c0180 fffff800`03292f13 : fffffa80`08d01b30 fffff800`c0000005 fffffa80`095c0060 00000000`079806f0 : nt!NtTerminateProcess+0xf4
fffff880`077c0200 fffff800`0328f4d0 : fffff800`032de9df fffff880`077c0b78 fffff880`077c08d0 fffff880`077c0c20 : nt!KiSystemServiceCopyEnd+0x13
fffff880`077c0398 fffff800`032de9df : fffff880`077c0b78 fffff880`077c08d0 fffff880`077c0c20 00000000`07981f30 : nt!KiServiceLinkage
fffff880`077c03a0 fffff800`03293302 : fffff880`077c0b78 00000000`000713b8 fffff880`077c0c20 00000000`07981a08 : nt! ?? ::FNODOBFM::`string'+0x48e24
fffff880`077c0a40 fffff800`03291e7a : 00000000`00000001 00000000`07980ca8 00000000`77552901 00000000`000713b8 : nt!KiExceptionDispatch+0xc2
fffff880`077c0c20 00000000`77428e3d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
00000000`07980cb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77428e3d


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0xF4_fffff800c0000005_IMAGE_csrss.exe

BUCKET_ID:  X64_0xF4_fffff800c0000005_IMAGE_csrss.exe

Followup: MachineOwner
---------
```
It's not a BSOD type I'm familiar with, it looks to me that a 3rd party driver caused memory corruption that was flagged by an internal security check.

It could be caused by one of the above drivers/software - there's a chance it was malware, I really don't know.


----------



## Cat Box (Oct 24, 2009)

*Re: ntoskrnl.exe BSOD*

I uninstalled TotalRecorder from the system, still getting BSODs.

I also tried alternating the RAM sticks in and out of the first and second slot. I still got BSODs.

I even tried a different set of RAM, one stick at a time while alternating slots. Still got BSODs.

I am considering re-installing Windows to wipe the slate clean as it were. I'm of the belief if I still get BSODs after that it has to be a hardware issue and more than likely the motherboard in particular.


----------



## satrow (Feb 4, 2012)

*Re: ntoskrnl.exe BSOD*

Were *all* memory tests run with 7+ passes? Post #3 said you had memory errors, they're not going to go away, bad hardware is bad and will defeat anything we try to do in Windows or with software.

Do you have the latest dumps you can upload to check?


----------



## Cat Box (Oct 24, 2009)

*Re: ntoskrnl.exe BSOD*

I did 11 passes on each stick of the main set of RAM. Individually the sticks seem to test clean. I've only had the errors show up twice when both sticks where plugged in.

I can run some passes on the alternate set if that will add any info.

Next time I get a fresh dump I will post it.


----------



## Cat Box (Oct 24, 2009)

*Re: ntoskrnl.exe BSOD*

View attachment BSOD-2.zip


----------



## satrow (Feb 4, 2012)

*Re: ntoskrnl.exe BSOD*

Ah, you have a Crucial M4 SSD, there's a firmware bug that causes the crash 1 hour post-boot after a certain number of power on hours (roughly 6 months of up-time). You need to update to the latest firmware from the Crucial Support site.


----------



## Cat Box (Oct 24, 2009)

*Re: ntoskrnl.exe BSOD*

Wow it's been almost six months to the day from the date i purchased it. I also noticed I get about an hour of time from boot-up to BSOD.

I will try the firmware update, which I might add I haven't done since I bought it initially, later tonight after work.

Man I hope it's something as simple as a firmware update. 

I will post an update ASAP.


----------



## loda117 (Aug 6, 2010)

*Re: ntoskrnl.exe BSOD*

We hope it works out for you 
just an FYI i would backup all your data before updating the firmware ...


----------



## Cat Box (Oct 24, 2009)

*Re: ntoskrnl.exe BSOD*

I'm hesitant to believe it, but the firmware update seems to have done the trick.

As I type this I have logged 10 hours and 15 minutes of up-time with no BSODs.

I was lucky to get an hour of use before a BSOD prior to the update.

I will let the PC run overnight and post an update in the morning.


----------



## Cat Box (Oct 24, 2009)

*Re: ntoskrnl.exe BSOD*

I am happy to report that as I type this, I have logged more than 20 hours of uninterrupted up-time.

I guess from this point if I have any issues related to this I will post again, otherwise I want to call this issue "Solved".

Hopefully this can thread will help the next person who has the same issue, which essentially boiled down to updating the firmware on my Crucial M4 SSD.

One last question, should I take any steps or run any programs since I had so many BSODs? I'm thinking of something like a O.S. checker/verifier.

At any rate many thanks to Satrow and Loda117 alongside all the staff here for their help. I really don't think I would have had such a victory without the assistance I received here. 

:thanx:


----------



## satrow (Feb 4, 2012)

*Re: ntoskrnl.exe BSOD*

You're lucky that it was an easy fix, most BSOD problems are much more complicated!

A chkdsk followed by *SFC /scannow* should repair most file errors and fix any System files.

You can mark the thread as [Solved] by using the Thread tools dropdown above if you're happy that the problem has been successfully diagnosed and fixed.


----------



## Cat Box (Oct 24, 2009)

In a case such as this I will happily take lucky any day. Thanks again for the help!


----------



## satrow (Feb 4, 2012)

No worries, our pleasure.


----------

