BSOD caused by ntoskrnl.exe

Jafar13 · Jan 19, 2015

Hello!

I have during last week encountered about three BSODs, and it's very annoying. I would like to find out which driver is causing the trouble and at least try fixing it.

I ran the memory dump in 2 programs:

1. "WhoCrashed", the only differences found was the ending of the address that caused it (highlighted):

On Thu 15/01-2015 17:47:45 GMT your computer crashed
crash dump file: C:\Windows\Minidump\011515-28375-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x76E80)
Bugcheck code: 0xC5 (0x8, 0x2, 0x0, 0xFFFFF80003206B05)
Error: DRIVER_CORRUPTED_EXPOOL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the system attempted to access invalid memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Thu 15/01-2015 17:47:45 GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
Bugcheck code: 0xC5 (0x8, 0x2, 0x0, 0xFFFFF80003206B05)
Error: DRIVER_CORRUPTED_EXPOOL
Bug check description: This indicates that the system attempted to access invalid memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Tue 13/01-2015 19:14:10 GMT your computer crashed
crash dump file: C:\Windows\Minidump\011315-47937-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75BC0)
Bugcheck code: 0xC5 (0x8, 0x2, 0x0, 0xFFFFF800031FEB05)
Error: DRIVER_CORRUPTED_EXPOOL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the system attempted to access invalid memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Mon 12/01-2015 20:06:54 GMT your computer crashed
crash dump file: C:\Windows\Minidump\011215-56953-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75BC0)
Bugcheck code: 0xC5 (0x8, 0x2, 0x0, 0xFFFFF8000320DB05)
Error: DRIVER_CORRUPTED_EXPOOL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the system attempted to access invalid memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

2. "BlueScreenViewer". The only difference found was in "parameters" and the address that caused it (same as with "WhoCrashed")

So... which driver is causing and and what program is associated with that driver? If I am correct, the first step is trying to reinstall the program/driver.

Thanks for Your time!

EDIT: Here are the .dmp files http://www.sendspace.com/filegroup/1Pw66Xl3oTP6P%2B6C8IX8xAKHZNv5G98T

with the associated virustotal scans:
https://www.virustotal.com/sv/file/8e340618c8801b9843d943cd6c73a0f1e3bd600b39ab2e16d340691b5500fb5f/analysis/1421344982/]
https://www.virustotal.com/sv/file/7a4ebab0029f6e1d483c926c9e695ffaddb0faae0389003fb9266fff1f1c50ce/analysis/1421345003/
https://www.virustotal.com/sv/file/9a9e8accbf222806706c05e3e02bb62cfc13979d2eca9d6bb23a47aefa65fbec/analysis/1421345012/

johnbl · Jan 20, 2015

first bugcheck was a crash in Kaspersky Network filtering component caused by pool corruption.
It is hard to say who corrupted system memory, most often the crashing component is not the one that corrupted the system memory. (just don't know with out setting up verifier.exe)

I would update my network driver (yours looked current but check anyway), update kaspersky

you might want to google on how to use verifier.exe and change your memory dump type to kernel or full memory dump
to have the memory dump save the correct debugging info to help determine who corrupted memory.

you might also want to run memtest86.exe on a boot cd to confirm that it is not a BIOS or hardware issue.

you might want to see if you really want this installed:
\SystemRoot\system32\DRIVERS\hamachi.sys Thu Feb 19 02:36:41 2009

Jafar13 · Jan 20, 2015

johnbl :

I just got another BSOD around 20 mins ago.

WhoCrashed:

On Tue 20/01-2015 20:17:06 GMT your computer crashed
crash dump file: C:\Windows\Minidump\012015-22953-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x76E80)
Bugcheck code: 0xC5 (0x8, 0x2, 0x0, 0xFFFFF800031C0B05)
Error: DRIVER_CORRUPTED_EXPOOL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the system attempted to access invalid memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Tue 20/01-2015 20:17:06 GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: kltdi.sys (kltdi+0x4724)
Bugcheck code: 0xC5 (0x8, 0x2, 0x0, 0xFFFFF800031C0B05)
Error: DRIVER_CORRUPTED_EXPOOL
file path: C:\Windows\system32\drivers\kltdi.sys
product: Kaspersky™ Anti-Virus ®
company: Kaspersky Lab ZAO
description: Network filtering component
Bug check description: This indicates that the system attempted to access invalid memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: kltdi.sys (Network filtering component, Kaspersky Lab ZAO).
Google query: Kaspersky Lab ZAO DRIVER_CORRUPTED_EXPOOL

Apart from that I am going to run the memtest. Can it be on an usb or does it have to be on a cd ?
I do have Hamachi installed on my computer. I think that's why the "hamachi.sys" is in there, I have used the program before and it has worked fine, I don't know why it would case harm now.

I checked the driver versions on my motherboard's page, and they were all up to date.
I set up verifier.exe following this guide: http://www.sevenforums.com/crash-lockup-debug-how/65331-using-driver-verifier-identify-issues-drivers.html
I uninstalled Hamachi just to make sure
I set it to make a "full memory dump", I didn't manage to set up GFlags though, I dont know if that is necessary.

Jafar13 · Jan 23, 2015

I did a memtest, let it run 2 cycles and it found no errors.

The first cycle took around 50 minutes while the 2nd cycle took 2 hours and 20 mins. Is that normal? I wanted to let it run for 3+ cycles but when I saw that the second run took that much time I stopped after 2.

I am still "hoping" for another BSOD to get the full dump and find the faulting driver.

Search

BSOD caused by ntoskrnl.exe

Jafar13

Reputable

johnbl

Polypheme

Jafar13

Reputable

Jafar13

Reputable

TRENDING THREADS

Latest posts

Moderators online

Share this page