Win7 Ultimate 64bit NTOSKRNL.EXE BSOD

Aseem September · Apr 6, 2015

Hi everyone.

I know there are a few NTOSKRNL.EXE BSOD threads already but in reading those answers and following those steps i havent been able to resolve my issue.

I am running Win 7 64-bit Ultimate on an i5 4690k on a MSi gaming 7 motherboard. Yes, i have already removed the OC, still the issue persists.

I have checked my HDDs, no issue there. Also ran memtest for 3 passes, no issues again.
Ran Dr. Web antivirus, none found.

Also ran chkdsk on all disks, everything fine.

sfc /scannow also doesnt report anything.

I get PFN_LIST_CORRUPT BSODs regularly, once or twice daily, following steps on other guides i used BlueScreenViewer to see what driver was causing it. Turns out its NTOSKRNL.EXE most of the times and fltmgr.sys twice.

Following other steps i used Driver Verifier, after 12 hours i got a BSOD, but not the PFN_LIST_CORRUPT, but IRQL_NOT_LESS_OR_EQUAL with NTOSKRNL.EXE, never got this BSOD before. Now the system wont boot, i get this BOSD each time. So i booted in safe mode, reset the verifier and successfully booted into normal windows.

I sometimes, once a week, get this BSOD as well - MEMORY_MANAGEMENT with the dxgmms1.sys driver.

i am uploading all the minidumps of the different BSODs and different drivers causing it.
https://www.mediafire.com/?7xvqf5cf5n4hxh7

Please help, what other steps i can follow to give you more information?
Thank you

EDIT - BSODs occur when i am doing anything, whether playing a game, or browsing or watching a movie or nothing at all (PC on but idle).
Graphics card is msi gtx 970 gaming 4g.
Ram is 2*8gb G.Skill Ripjaws F3-12800CL10S-8GBXL

junkeymonkey · Apr 6, 2015

you should still boot in safe mode

for me I would start with any gimmick/bloatware [ like with asus there asus suite monitoring tool type things ] just for the most part things really don't have anything to do with the boards operation out side of the standard chipset drivers and all.. uninstall the gpu drivers .. restart and let it sit and do some light things to see if the bsod reoccurs.. if things seem fine reinstall the vid card driver and retest ..

nothing but the basics and k.i s.s.

I do think its a software/ driver issue

Aseem September · Apr 7, 2015

yes, there are a lot of monitoring tools with the MSI board, but i do use them.
Anyway, i'll uninstall them and gpu drivers and let you know if it happens again.
the issue sometimes happens after 24 hours, so please be patient.
Thank you.

EDIT - if anyone can read the dump files and let me know if this is due to a specific file or something, some other threads had success with this. I dont know how to read and understand a dump file. Thanks

EDIT2 - since i cant reproduce the issue, i am running prime95 (blend test) and MSI kombustor (memory burn) to overload CPU,RAM,GPU and Gfx memory. hoping it'll crash

junkeymonkey · Apr 7, 2015

the dump file you gave is a download and I don't do that, sorry and that site or something seemed to want to freeze my browser up when I went to look
so I baled out of it ...

also I use that same memory did you buy it one stick at a time or did you get the 2 stick factory matched kit ??

http://www.newegg.com/Product/Product.aspx?Item=N82E16820231489&ignorebbr=1

Aseem September · Apr 7, 2015

i uploaded the files to mediafire.com its a file hosting site. where and how should i upload it so you can access it?

I did buy them together, but it wasnt a pack, its two individual packs which contain single sticks. Should this be a RAM issue? i have complete 3 passes (twice) of memtest86.

junkeymonkey · Apr 7, 2015

hard to say ?? the rule is to buy a kit I sent you a p.m on my experience of what you got
if you want

look here
https://social.technet.microsoft.com/Forums/en-US/28f90b1b-7960-459a-8488-a9fa33e76913/bsod-caused-by-ntoskrnlexe?forum=w8itprohardware

you may copy and paste this part in a post maybe enough

example ........
CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: atieclxx.exe

CURRENT_IRQL: 1

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: atikmpag+15c65

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: atikmpag

IMAGE_NAME: atikmpag.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 5417612a

STACK_COMMAND: .cxr 0xffffd0003898ab80 ; kb

FAILURE_BUCKET_ID: 0x3B_atikmpag+15c65

BUCKET_ID: 0x3B_atikmpag+15c65

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x3b_atikmpag+15c65

FAILURE_ID_HASH: {c087950b-706e-a928-c891-26e838f83e22}

Aseem September · Apr 7, 2015

Ok i used the debugger to open the dump files.
here they are

Most common one PFN_LIST_CORRUPT

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000037fbd4, page frame number
Arg3: 0000000000000002, current page state
Arg4: 000000000037fe51, 0

Debugging Details:
------------------

BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: uTorrent.exe

CURRENT_IRQL: 2

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

LAST_CONTROL_TRANSFER: from fffff80003323cdc to fffff80003293ec0

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`03323cdc cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiBadShareCount+4c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 54d0317d

IMAGE_VERSION: 6.1.7601.18741

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x4e_99_nt!mibadsharecount+4c

FAILURE_ID_HASH: {4c83cdad-f603-74ff-b7e1-9eb7f3029c2a}

Uncommon - MEMORY_MANAGEMENT

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000783, The subtype of the bugcheck.
Arg2: fffff8800a793100
Arg3: fffff98027d80000
Arg4: fffff8a00c769a00

Debugging Details:
------------------

BUGCHECK_STR: 0x1a_783

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: uTorrent.exe

CURRENT_IRQL: 2

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

LAST_CONTROL_TRANSFER: from fffff80003348891 to fffff800032dcec0

STACK_COMMAND: kb

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+2bb9b
fffff800`03348891 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+2bb9b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 54d0317d

IMAGE_VERSION: 6.1.7601.18741

FAILURE_BUCKET_ID: X64_0x1a_783_nt!_??_::FNODOBFM::_string_+2bb9b

BUCKET_ID: X64_0x1a_783_nt!_??_::FNODOBFM::_string_+2bb9b

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x1a_783_nt!_??_::fnodobfm::_string_+2bb9b

FAILURE_ID_HASH: {20ecc165-1ef6-340d-495b-069c7f7e81fc}

After the driver verifier - IRQL_NOT_LESS_OR_EQUAL

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000000001f0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800032e0f35, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003516100
GetUlongFromAddress: unable to read from fffff800035161c0
00000000000001f0 Nonpaged pool

CURRENT_IRQL: 2

FAULTING_IP:
nt!KeSetEvent+1e3
fffff800`032e0f35 488b00 mov rax,qword ptr [rax]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR: 0xA

PROCESS_NAME: System

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

TRAP_FRAME: fffff8800336a950 -- (.trap 0xfffff8800336a950)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000001f0 rbx=0000000000000000 rcx=fffff88009b7d210
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800032e0f35 rsp=fffff8800336aae0 rbp=0000000000000000
r8=0000000000000000 r9=fffff80003459e80 r10=00000000000001f0
r11=fffff80003496480 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe cy
nt!KeSetEvent+0x1e3:
fffff800`032e0f35 488b00 mov rax,qword ptr [rax] ds:00000000`000001f0=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800032dc469 to fffff800032dcec0

STACK_COMMAND: kb

FOLLOWUP_IP:
MBfilt64+1817
fffff880`067f1817 ?? ???

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: MBfilt64+1817

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: MBfilt64

IMAGE_NAME: MBfilt64.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a7267b0

FAILURE_BUCKET_ID: X64_0xA_VRF_MBfilt64+1817

BUCKET_ID: X64_0xA_VRF_MBfilt64+1817

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0xa_vrf_mbfilt64+1817

FAILURE_ID_HASH: {3414a0c9-f17d-f07d-746a-a89ad9b168e6}

EDIT - Though utorrent.exe is mentioned in two of the dump files, similar BSODs occurred because of mpc-HC.exe and fifa15.exe

junkeymonkey · Apr 8, 2015

utorrent ,exe [just seeing the word ''torrent '' makes ne feel unsafe]

what ever you got under that - google --- windows 7 utorrent .exe bsod --- and see if something strikes home with what your doing ??

http://www.sevenforums.com/bsod-help-support/256475-bsod-utorrent-ntoskrnl-exe-netio-sys.html

or

http://www.bleepingcomputer.com/forums/t/509279/blue-screen-of-death-problem-with-utorrent-driver-irql-not-less-or-equal/

mpc-HC.exe

that player may just be buggy or just bad ?? try something like vlc ??

fifa15.exe

is this a retail genuine copy ?? when I google that the first links to show are crack sites ??

Aseem September · Apr 8, 2015

yes its the genuine FIFA 15 played online using Origin
There is nothing on utorrent, i have it run on startup. no downloads currently ongoing.
have used mpc-hc for years without issue. working on other pc as well.

in the dump files under Image Name its memory_management. so is this a memory (RAM) issue?
since the same BSOD occurs for various programs, it shouldnt be program specific.

I have uninstalled the MSI bloatware. OC still on. Prime95 and Kombustor running for25+ hours without issue. cpu and gpu temps below 80C.
could be it WAS because of the MSi bloatware.
i will report back in another 24 hours.

if possible look through the dumo data t see what could be the problem.

junkeymonkey · Apr 8, 2015

could be ?? or something that affected the items in the report ?? all you can do is say that was it and move on

thing about the memory issue is you don't know for sure -- some programs can use memory and hog it and may not release any memory for another program to use and then it crashes to a memory error [google chrome is known to do this ]

lots of times folks bad memory stick when in fact its a program misusing the memory ..

so anyway if its working fine with out the msi stuff then that may just of been bad or something in that utorrent has corrupted things in some way if it a internet transmission thing

if you got more of the issues just remove the next thing down the line

good luck

junkeymonkey · Apr 8, 2015

http://www.tomshardware.com/answers/id-2551399/utorrent-crashes.html

johnbl · Apr 8, 2015

ok, looking at the first memory dump, here are the problems I see:

you have overclocking software installed and it is a 2012 version
\SystemRoot\system32\DRIVERS\AcpiCtlDrv.sys Tue Jul 17 10:07:16 2012
remove Intel(R) Extreme Tuning Utility Performance Tuning Acpi Control Driver
and retest for failure.

it is not likely that this "extreme tuning utility" from 2012 is going to properly set voltages and clock rates for a low voltage CPU that came out in may 2014. (it will set voltages too high for the clock rates)

your actual bugcheck was in a Realtek HiDefinition Audio driver
\SystemRoot\system32\drivers\MBfilt64.sys Thu Jul 30 20:40:32 2009

I would update the driver to a more current version, or disable the high definition audio support in your GPU if you are not getting sound from speakers in your monitor (via the video cable)

- you are running \SystemRoot\system32\DRIVERS\xusb21.sys Thu Aug 13 15:10:17 2009
xbox adapter, you need to update this to xusb22.sys the old one has a bug that leads to memory corruption.
(you can get the new driver from the microsoft website)

the memory dump I looked at, I could not read your BIOS info so I don't now the bios version or clock rates but
be sure to update your BIOS to a version that was release after your CPU was released. If you don't the various BIOS settings for default voltages will be wrong for your low power CPU and you will have various problems.

Aseem September · Apr 8, 2015

Bios version is released after my CPU and contains the update to support the CPU, though there is one more bios update available it only adds certain keyboards so i will not update to that.

i never used inter extreme tuning utility. I had read in forums that it is better to use the bios to tinker with OC. though i have uninstalled it because it was part of the motherboard CD bloatware.

I updated all drivers using the LIVE Update utility provided by MSI, so the realtek drivers were updated. in any case i only use the audio from my HDMI cable. i only use the TV speakers with it. There is nothing connected to the audio ports at the back/front of the Cabinet.

The XBox drivers are old. though the same things are installed in an identical, and i mean identical, PC that i got for my younger brother.

Thank you for your analysis. Since i have uninstalled the MSI bloatware i have not had an issue, prime95 and kombustor still having 100% cpu and 99% gpu load. I am hoping that the issue is resolved.

I am not going to update the realtek and xbox drivers right now. so that i can see if the bloatware itself was the problem. If the issue persists i will update them one by one to check for stability and the cause of the issue so i can report back.

Thank you.

Aseem September · Apr 8, 2015

Got another BSOD - PFN_LIST_CORRUPT now with a new process, Actual Multiple Monitor, used for better multimonitor functionality.

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000356233, page frame number
Arg3: 0000000000000002, current page state
Arg4: 0000000000356219, 0

Debugging Details:
------------------

BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: ActualMultiple

CURRENT_IRQL: 2

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

LAST_CONTROL_TRANSFER: from fffff80003353cdc to fffff800032c3ec0

STACK_TEXT:
fffff880`0b9e32d8 fffff800`03353cdc : 00000000`0000004e 00000000`00000099 00000000`00356233 00000000`00000002 : nt!KeBugCheckEx
fffff880`0b9e32e0 fffff800`03270b7e : 00000000`00000000 fffff680`00004258 00000000`00000000 00000000`00000000 : nt!MiBadShareCount+0x4c
fffff880`0b9e3320 fffff800`032f5da7 : 00000000`00000000 fffff680`000043d0 fffffa80`0fe7e740 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x320f4
fffff880`0b9e34d0 fffff800`032b13cf : fffffa80`00000000 00000000`0087afff 00000000`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x41f
fffff880`0b9e3690 fffff800`032c3153 : ffffffff`ffffffff fffff880`0b9e3960 fffff880`0b9e39c8 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`0b9e3790 fffff800`032bf710 : fffff960`00168098 00000000`00000001 fffff900`c00bf010 fffff900`c3110cc0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0b9e3928 fffff960`00168098 : 00000000`00000001 fffff900`c00bf010 fffff900`c3110cc0 00000000`00000000 : nt!KiServiceLinkage
fffff880`0b9e3930 fffff960`001683f4 : ffffffff`00000000 fffff880`00000000 fffff900`c3110cc0 00000000`00000000 : win32k!SURFACE::bDeleteSurface+0x3c8
fffff880`0b9e3a80 fffff960`00128b49 : ffffffff`d905197e fffff900`c3110cc0 ffffffff`d905197e fffff960`00128a74 : win32k!bDeleteSurface+0x34
fffff880`0b9e3ab0 fffff800`032c3153 : fffffa80`0fe80060 fffff880`0b9e3b60 00000000`0185000f 00000000`023e0000 : win32k!NtGdiDeleteObjectApp+0xd5
fffff880`0b9e3ae0 000007fe`fefc108a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0012fa38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007fe`fefc108a

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`03353cdc cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiBadShareCount+4c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 54d0317d

IMAGE_VERSION: 6.1.7601.18741

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x4e_99_nt!mibadsharecount+4c

FAILURE_ID_HASH: {4c83cdad-f603-74ff-b7e1-9eb7f3029c2a}

Dump file - https://www.mediafire.com/?2hi50hv35pvpxn5

Since It had been 36+ hours of continuous Prime95 and Kombustor, i hoped that the issue was gone and decided to update the Xbox driver, in order to update the software asked me to uninstall old drivers, The BSOD came in 5 seconds after i uninstalled the old driver.

But the Dump shows the cause to e the Actual multiple monitor. I dont understand why the same BSOD is happening for so many different processes.

EDIT - Turns out the XBox drivers from 2009 are the latest ones, i redownloaded from microsoft website and its still the same. They havent updated it in 6 years. Please correct me if i am wrong.

johnbl · Apr 8, 2015

WinRing0x64.sys causes bugchecks on windows 8, not sure if it causes problems for windows 7.

USRFindHandle.sys BigFix BESClient Application running
xusb21.sys you should update to version xusb22.sys (the current version)
remove:
\C:\Program Files (x86)\MSI Afterburner\RTCore64.sys Sun Mar 10 22:32:06 2013
(overclocking software, remove until you find the cause of the bugcheck)

Realtek HiDefinition Audio driver is from 2009, I would update it from your motherboard vendor.

-------------
you have a lot of custom 3rd party drivers running and overclocking software running. I would remove the overclocking software and turn on verifier.exe to look for drivers that are corrupting memory.
run cmd.exe as an admin, then
verifier.exe /standard /all
I would also set the memory dump type to kernel to get the error logs saved to the memroy dump.
reboot and run until you get the next bugcheck.
use verifier.exe /reset
to turn off the extra driver checking in windows when done
--------
looks like a old bug in windows but your system looks like you have the update/fix so I am not sure.
will look at it for a minute. The process that caused the failure was
ActualMultiple.exe it lookes like it ended up trying to unlock the same address twice or just a bogus address.

3: kd> kc
Call Site
nt!KeBugCheckEx
nt!MiBadShareCount
nt! ?? ::FNODOBFM::`string'
nt!MiDeleteVirtualAddresses
nt!NtFreeVirtualMemory
nt!KiSystemServiceCopyEnd
nt!KiServiceLinkage
win32k!SURFACE::bDeleteSurface
win32k!bDeleteSurface
win32k!NtGdiDeleteObjectApp
nt!KiSystemServiceCopyEnd
0x0

machine info:
BIOS Release Date 12/24/2014
BIOS Version V1.8
Product Z97 GAMING 7 (MS-7916)
Version 1.0
Processor ID c3060300fffbebbf
Processor Version Intel(R) Core(TM) i5-4690K CPU @ 3.50GHz
Processor Voltage 8ch - 1.2V
External Clock 100MHz
Max Speed 3800MHz
Current Speed 3500MHz

Aseem September · Apr 8, 2015

EDIT - Just saw your edit. How to delete this post?

The computer wasnt put to sleep, and i do not have auto sleep after ** minutes enabled.

My system is not of ASRock. its MSI gaming 7 motherboard. I think you probably downloaded someone else's dump file.

junkeymonkey · Apr 8, 2015

I don't know but looking things up antivirus programs pop up and as well with the torrent stuff running ?? to me with that no telling whats polluted if so
like the guy in the bleeping computer link said ''Torrents are a good way to get infected with Malware, as you are not sure what you are downloading and from who.''

http://answers.microsoft.com/en-us/windows/forum/windows_vista-hardware/bugcheck-dump-help/5e3d7c5c-5c03-43f1-b0ff-5bb2a9cdd369

also as johnbl said if there a old incompatible software and so on - like I said you got to make a list of things and start removing/ test update /test

have you ran disk check ?? bad sectors can cause these things and corrupt files that were not recovered and relocated properly

Aseem September · Apr 8, 2015

Yes Disk Check ran on all my disks, no bad sectors on any of the disks.
I dont run any Anti Virus software continuously. Though i have run antivirus, antimalware and antiadware softs after the error started to check if that was the issue, no viruses found and the softwares were uninstalled thereafter.

I installed the realtek drivers from the live update ultility so i dont know why they are old, anyway i dont use the onboard sound card, ony the HDMI output.
XBox drivers are the latest, even though they are from 2009.

Installing the realtek drivers from the website now.

My question is why the same BSOD for so many different processes?

junkeymonkey · Apr 8, 2015

could be until your able to pinpoint exactly what one is the true cause .. for all you know something got into core windows ??

but I still fee its a software or driver issue -- just I'm not there for a hands on or by any means know what all you got going on --

it may come down to startin back from square one and be a lot more careful on what you load or install ???

Aseem September · Apr 8, 2015

I really really dont wanna reinstall windows. i do have a lot of softwares installed but none that i hadnt been using for years before.
sfc /scannow doesnt report anything, so the core windows files should be okay right?

junkeymonkey · Apr 8, 2015

have you tried this ??

http://answers.microsoft.com/en-us/windows/wiki/windows_other-system/driver-verifier-tracking-down-a-mis-behaving/f5cb4faf-556b-4b6d-95b3-c48669e4c983

https://msdn.microsoft.com/en-us/library/windows/hardware/ff545448(v=vs.85).aspx

well not to reinstall windows just remove things that were added when this issue started as I said go down the list of things and if needed right down to base windows

a reinstall would be a last ditch effort [but then you will know your clean]

johnbl · Apr 8, 2015

the 2009 xbox drivers are old, you want to go up to the microsoft site and get the new version I think they are dated in 2012 but the driver name was changed. old version was called xusb21.sys and is auto installed via windows.
the new one is xusb22.sys and is installed from a setup program on the microsoft hardware site. sorry, it has been a while since i have installed it, maybe this link: http://www.microsoft.com/hardware/en-us/d/xbox-360-controller-for-windows

Aseem September · Apr 8, 2015

Yes i did read a lot of previous threads and driver verifier was mentioned in them, i mentioned that in my first post.

Here are the details of the first ever BSOD i got - PFN_CORRUPT_LIST with chrome.exe
Two days after i got the system.

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000019f80c, page frame number
Arg3: 0000000000000002, current page state
Arg4: 000000000019f80b, 0

Debugging Details:
------------------

BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: chrome.exe

CURRENT_IRQL: 2

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

LAST_CONTROL_TRANSFER: from fffff80002f1ba4c to fffff80002e8cbc0

STACK_TEXT:
fffff880`0eddbe18 fffff800`02f1ba4c : 00000000`0000004e 00000000`00000099 00000000`0019f80c 00000000`00000002 : nt!KeBugCheckEx
fffff880`0eddbe20 fffff800`02e38ec9 : 00000000`00000000 fffff680`000b4740 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`0eddbe60 fffff800`02e5c7c3 : fffffa80`0cdda610 fffff700`00001d76 0000007f`fffffff8 fffff8a0`03bf97f0 : nt! ?? ::FNODOBFM::`string'+0x32421
fffff880`0eddbef0 fffff800`02e5d892 : fffffa80`0cdda610 fffffa80`00000000 fffff880`00000e64 fffff800`00000000 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`0eddc7a0 fffff800`0316205a : fffff8a0`0de299e0 fffff880`0eddcae0 00000000`00000000 fffffa80`0cee2310 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0eddc7f0 fffff800`03146b7d : 00000000`00000000 00000000`00000001 00000000`fffa4000 00000000`00000000 : nt!PspExitThread+0x56a
fffff880`0eddc8f0 fffff800`02e7f6fa : 00000000`00000100 fffffa80`0cee23d0 00000000`00000001 fffff800`02e827fd : nt!PsExitSpecialApc+0x1d
fffff880`0eddc920 fffff800`02e7fa40 : 00000000`00000246 fffff880`0eddc9a0 fffff800`03146af0 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`0eddc9a0 fffff800`02e8bef7 : fffffa80`0cee2310 00000000`00000200 00000000`00000000 fffffa80`0d87a290 : nt!KiInitiateUserApc+0x70
fffff880`0eddcae0 00000000`74962e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`043bec68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74962e09

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`02f1ba4c cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiBadShareCount+4c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 531590fb

IMAGE_VERSION: 6.1.7601.18409

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x4e_99_nt!mibadsharecount+4c

FAILURE_ID_HASH: {4c83cdad-f603-74ff-b7e1-9eb7f3029c2a}

Dump file - https://www.mediafire.com/?ra4b7fdirjg679g

Aseem September · Apr 8, 2015

johnbl :

Yes, i downloaded the drivers from this exact same link. When i tried to install them the installer said that it cant install as there is another version already installed and asked me to remove it from the "programs and features".
I couldnt find it in the "programs and features" control panel.

I checked around and was told to remove the drivers from the device manager and then to install them. still the issue persisted, the isntalled asked to remove old version. I checked more threads, found out the i can use a zip software to extract the drivers from the installer. Did that. It contained the xusb21.sys driver and not xusb22.sys.

You can download it then extract it to confirm. These are the latest drivers.

johnbl · Apr 8, 2015

it would also be good to confirm your windows binaries have not been modified or corrupted.
run cmd.exe as an admin, and then sfc.exe /scannow
(if you have not already checked)

the debugger indicated no corruption of the core windows file but the driver list in the last bugcheck shows 3 copies of the same overclocking software and an additonal overclocking driver from another vendor.
------------
if something is corrupting the system list of your virutual memory it will not be detected until a driver attempts to use the bad memroy address. Then the system will bugcheck. You have to try to turn on verifier and try to catch the process in the act of corrupting memory. Otherwise you are just looking at the victims of the memory corruption rather than the cause.

you have to remove drivers, any suspect programs or wait until verifier catches a bad driver overwriting its memory or freeing memory it already freed.

Note: this assumes that memtest86.exe has passes its tests.
Also note: windows will load drivers in a slightly different order on each boot, so if you have a driver that corrupts memroy it tends to corrupt the data of the driver who has its data stored in memory next to the bad drivers data. (and that will change with each boot) even a bad spot in memory will cause different driver failures on each boot.

Aseem September :

Win7 Ultimate 64bit NTOSKRNL.EXE BSOD

Reputable

Polypheme

Reputable

Polypheme

Reputable

Polypheme

Reputable

Polypheme

Reputable

Polypheme

Polypheme

Polypheme

Reputable

Reputable

Polypheme

Reputable

Polypheme

Reputable

Polypheme

Reputable

Polypheme

Polypheme

Reputable

Reputable

Polypheme

Share this page