SOLVED BSOD - W7-64bit - ntkernel or something.

[PoisonWolf]

Hi folks,

I'm having some trouble with a BSOD. I hate this dreaded BSOD as the last time this happened....it started increasing in frequency until I did a clean-install of W7. It hasn't occurred for about 3 months now and I just had one again. As you can understand, this has stirred some panic as I hate reinstalling things.

I've attached the dump here..hopefully you guys can help me identify what precisely is causing the BSOD as opposed to "Whocrashed" just telling me the following vague statements...

When this crash happened....I was transferring files to an external device (the transfer was completed)....and I was just copying stuff on my local hard drive to another local hard drive. Out of the blue...the BSOD appeared while no transfer or file copying was in progress. Only thing I can think of is that the external device (a PSP) was connected to a shoddy cheap 4-port USB hub which is rather old. The 4-port hub has a Logitech mice dongle and a microsoft dongle for a keyboard. At this point, I'm not sure if it's causing it...but I've stopped using it for now.

Anyhow...I'm running a 2.6 Ghz Propus, GA-MA790GPT-UD3H motherboard with 16 GB of RAM (ram has been tested with memtest in the past when I bought it for more than 24 hours and it was fine), 2 SSDs, and 2 regular HDDs, with a 430 watt Corsair PSU. GPU is a HIS IceQ 4670 radeon. I think that's pretty much the entirety of the PC.

Thank you so much for anyone that can help me identify the little bugger that's giving me grief. I really hope this doesn't get worst over time again.

P.S. I've attached the crash dump here in the .zip file as per forum rules.

On Thu 7/26/2012 3:48:22 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\072512-14336-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x7F1C0)
Bugcheck code: 0x50 (0xFFFFF7FFFB20B0E0, 0x8, 0xFFFFF7FFFB20B0E0, 0x2)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

 

[Shintaro]

Welcome to the W7 forums.

I hope that we can help.

If this is your motherboard(http://www.gigabyte.com/products/product-page.aspx?pid=3143#dl)
Then please download and install the LAN and Audio drivers.

Hope this helps.

 

[PoisonWolf]

Welcome to the W7 forums.

I hope that we can help.

If this is your motherboard(http://www.gigabyte.com/products/product-page.aspx?pid=3143#dl)
Then please download and install the LAN and Audio drivers.

Hope this helps.

Thank you for looking into my minidump file.

Did it specify that my LAN drivers and AUDIO drivers were the culprit?

 

[Shintaro]

Mate,

The crash was complaining about WMPlayer.exe

MM_INTERNAL_CODE: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: wmplayer.exe
CURRENT_IRQL: 0

But also your LAN drivers are very old.

Rt64win7.sys Thu Feb 26 20:04:13 2009

 

[PoisonWolf]

Mate,

The crash was complaining about WMPlayer.exe


But also your LAN drivers are very old.

Thank you Shintaro!

I've stopped using WMPlayer...ugh....dang windows media player.

And I've updated the LAN drivers. Will stick to VLC Player for a while and see how it pans out.

The audio drivers are as recent as I can get them to be from the manufacturer's motherboard site.

 

[Shintaro]

Mate,
Please continue to use Media Player. We need to find the problem.

Please post any new crashes.

 

[PoisonWolf]

Mate,
Please continue to use Media Player. We need to find the problem.

Please post any new crashes.

Hi Shintaro,

Thank you so much for your continued assistance on the matter. Okay, I'll continue to use the Windows Media Player...! It's very random as to when it happens though...but I also notice something odd with windows media player.

Say if I play a song with it....on 50% volume on the windows media player....and I put the computer to sleep. When I wake the computer up...and replay the song...the volume would be much louder....I'm guessing 100% even though the volume slider is still on 50%.

I'm not sure if this odd observation has anything to do with why windows media player crashes. Could a faulty MP3 with a bad character/symbol in the name cause a BSOD?

Just random things that come to mind as to how WMPlayer.exe can cause a BSOD.

 

[Shintaro]

It could be that because Windows Media Player accesses the internet, your out of date LAN driver could have caused the problem.

With the volume problem, maybe the Audio drivers.

See how it goes and please keep us updated.

 

[PoisonWolf]

It could be that because Windows Media Player accesses the internet, your out of date LAN driver could have caused the problem.

With the volume problem, maybe the Audio drivers.

See how it goes and please keep us updated.

I just got another BSOD...I've uploaded the minidump here.

This time, Windows Media Player wasn't even running and the computer had just booted up. The screen read something like SYSTEM_SERVICE_EXCEPTION. A google search brought me to a microsoft link which suggested that this typically relates to "user-mode" graphics. Could you elaborate on that? Does it perhaps hint that my GPU is dying or something?

Any ideas?

Thank you so far Shintaro,
Cheers.
P.S. I was also initially only running 512mb to 1024mb of page file on 2 of my internal SSDs. I have now raised the page file to 2048-4096 on each of the SSDs. Not sure if this helps with the SYSTEM_SERVICE_EXCEPTION.

 

[Shintaro]

Hmmm, could you please create a CD/DVD/USB which ever, and do an offline scan of your computer please.
http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline/

 

[PoisonWolf]

Hmmm, could you please create a CD/DVD/USB which ever, and do an offline scan of your computer please.
http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline/

Hi Shintaro,

Based on that suggestion, to you think I have some sort of rootkit or virus?

What do you think if I went through the route of using driver verifier to try and instigate the BSODs and see what the minidumps bring up?

Thanks in advance again for your guidance on the matter. You've been a great help so far. This BSOD is making it very hard for me to do my work on the PC since I never know when I may lose all my info....

P.S. Maybe I should try memtest again on the 16GB of ram...hmm.

 

[Shintaro]

It is one of the things that we do, just to make sure.
How long ago did you test the RAM?

 

[Shintaro]

Also what is the RAM configuration? 2 x 8Gb sticks?

 

[PoisonWolf]

It is one of the things that we do, just to make sure.
How long ago did you test the RAM?

I think it was about a year ago. Back then, when I tested the RAM, it was for 24+ hours. No errors were reported. NOt sure how many passes were made.

Also what is the RAM configuration? 2 x 8Gb sticks?

It's 4x4gb sticks by GSkill.

I'm running Prime95 now for a simple blend test to see if the RAM is the culprit. I'll get around to MEMTEST later.

I also think sometime in the next few days, I'll enable driver verifier to see if I can force the BSOD to occur. At this point, I'm honestly at a loss as to what's causing it.

I've done a disk check of all 4 hard drives in my system, none of them had a single error. Not one.

I've updated all the drivers as recent as possible. Even my GPU driver is updated to 12.6 Catalyst.

Malwarebytes shows up nothing. Microsoft Security Essentials shows up nothing. I seriously doubt it's a virus/malware/rootkit though as I'm the only user of my PC and I am as careful as they come.

This is tiresome. I just don't understand how I was "BSOD"-free for about 2 months and suddenly within a week I see 3 BSODs.

 

[Shintaro]

What is the RAM part number?
Is it in the Memory support list?
http://www.gigabyte.com/products/product-page.aspx?pid=3143#dl

(Borrowed from Zigzag3143 posts)

Driver verifier

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Special Pool", "Force Pending I/O Requests" and "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen.
Continue to use your system normally, and if you know what causes the crash, do that repeatedly.
The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.
If it doesn't crash for you, then let it run for at least 36 hours of continuous operation.

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

Have you had anymore crashes since the last time?

 

[Shintaro]

I think I have found the problem.

fffff880`03927778 00000000`00000000
fffff880`03927780 fffffa80`0cf36168
fffff880`03927788 fffff800`030c2bd2 nt!KiCommitThreadWait+0x1d2
fffff880`03927790 fffffa80`0cf36060
fffff880`03927798 fffffa80`0cf36060
fffff880`039277a0 fffff900`c05959e0
fffff880`039277a8 fffff960`000ad644 win32k!xxxRealDefWindowProc+0x27c2
fffff880`039277b0 00000000`0000cc08
fffff880`039277b8 00000000`00000002
fffff880`039277c0 fffff900`00000000
fffff880`039277c8 fffff900`00000008
fffff880`039277d0 fffff960`002da080 win32k!xloIdent
fffff880`039277d8 fffff880`03927820
fffff880`039277e0 fffff880`03927c60
fffff880`039277e8 00000000`00000001
fffff880`039277f0 fffff880`03927840
fffff880`039277f8 fffff880`074a54a1Unable to load image atikmdag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
atikmdag+0x2654a1
fffff880`03927800 00000000`00000000
fffff880`03927808 00000000`00000000
fffff880`03927810 00000000`00000000
fffff880`03927818 00000000`00000000
fffff880`03927820 00000000`00000000
fffff880`03927828 00000000`00000000
fffff880`03927830 00000000`00000000
fffff880`03927838 00000000`00000000
fffff880`03927840 00000000`00000000
fffff880`03927848 00000000`00000000

Are you able to remove the ATI Catalyst Control Center and leave or re-install just the driver?

 

[PoisonWolf]

What is the RAM part number?
Is it in the Memory support list?
http://www.gigabyte.com/products/product-page.aspx?pid=3143#dl

(Borrowed from Zigzag3143 posts)

Driver verifier





Have you had anymore crashes since the last time?

No more crashes since then. It's really random as to when they come.

I think I have found the problem.



Are you able to remove the ATI Catalyst Control Center and leave or re-install just the driver?

I'll try and reinstall the entire Catalyst suite to see if that helps.

Also, Prime95 (64 bit version) was running for about 10 hours and my PC was fine. I do not think it is a hardware issue, I seriously doubt it.

 

[Shintaro]

The problem is the Catalyst suite.
You might be lucky with a reinstall.
Let us know how you get on.

 

[PoisonWolf]

The problem is the Catalyst suite.
You might be lucky with a reinstall.
Let us know how you get on.

I hate the Catalyst suite. I can't seem to fully uninstall it. Using the installer packaging and choosing uninstall, it'll uninstall everything. When I reboot and try to reinstall it again, it'll say that the Catalyst Manager is already installed and up to date!? I did this a few times...no luck. I can't remove the Catalyst suite. I've even went back to the 11.1 .exe files to see if they can detect the older Catalyst Suites or something before it became "Vision Control Center". All the installers says that I have no "ATI" stuff installed when I try to run an uninstall yet when I do an install, it says that the Catalyst Suite Manager is already installed and up to date.

I've tried right clicking and uninstalling the the driver and tick the check-box that says remove associated software with the driver. That doesn't remove the catalyst suite either.

I do not think I'll use any sort of Drive Sweeper as I've heard that it can be dangerous for AMD systems since it'll over-remove files that include chipset related files.

Right now, I've removed as much as I can....and I'm running Microsoft's default ATI Radeon 4670 driver (WMMDC1.1). I'll run this for a week to see if I will get any BSODs. I do not play games on the computer so performance of the driver is irrelevant to me. I just want to rid myself of the BSODs.

This is so frustrating.

UPDATE:
wmplayer.exe crashed again while looping a single song for about an hour. No BSOD though. Just a program not responding. Running MS's stock ati driver.

 

[Shintaro]

Mate,

Removing CCC:
http://support.amd.com/us/kbarticles/Pages/GPU57RemoveOldGraphicsDrivers.aspx

During the install Choose Custom and then untick CCC.

Please post those crash dumps.

Hops this help