FIX BSOD SYSTEM_SERVICE_EXCEPTION ntoskrnl.exe

FlashGuard

Reputable
Mar 22, 2017
47
0
4,530
So yesturday i did a few things.

Installed a VPN
Installed utorrent
Installed a game"Project Reality"
Then did a clean install of the most recent nvidia driver.

the Display Driver Uninstaller provided an error while it restarted the pc.
Then it constantly failed to install the 3 most recent Nvidia drivers.
I deleted the nvidia files that remained and booted to SAFE MODE.

there the installs failed and after wiping for a 3rd try i was succesfull on installing the driver.

Then i started to stream as i do a lot. That is when the first BSOD occured. Then again after it restarted and booted. So then i frantically started to remove the VPN, P2P, game and uninstall unused games.

While using CCleaner to uninstall games it BSOD multiple times IN SAFE MODE!!

After fighting with my system i downgraded to the 3rd most recent video driver. Which with a clean install went off without an issue.

now my system crashes the same mannor whenever i multitask to much. with a definite crash if i am working while its booting the startup programs. which are only Discord, Skype, Win Defender, CCleaner and Asus center. I will post the crash reports next. i do not want to try to get them and crash then loose this thread

******************************************************************************************

--------------------------------------------------------------------
who crashed report
--------------------------------------------------------------------

Windows version: Windows 10 , 10.0, build: 14393
Windows dir: C:\Windows
Hardware: ASUSTeK COMPUTER INC., M5A97 R2.0
CPU: AuthenticAMD AMD FX(tm)-8350 Eight-Core Processor AMD586, level: 21
8 logical processors, active mask: 255
RAM: 17075384320 bytes total




--------------------------------------------------------------------------------
Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.

On Sun 4/30/2017 11:06:35 PM your computer crashed
crash dump file: C:\Windows\Minidump\043017-21593-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14E7C0)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF802FA4E3F92, 0xFFFFD201391D0C90, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 4/30/2017 11:06:35 PM your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: win32kfull.sys (win32kfull!xxxProcessHidInput+0x4B98)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF802FA4E3F92, 0xFFFFD201391D0C90, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\win32kfull.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Full/Desktop Win32k Kernel Driver
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Sun 4/30/2017 10:26:21 PM your computer crashed
crash dump file: C:\Windows\Minidump\043017-18343-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14E7C0)
Bugcheck code: 0x18 (0x0, 0xFFFFD10443418080, 0x10, 0xB80775D28510558C)
Error: REFERENCE_BY_POINTER
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the reference count of an object is illegal for the current state of the object.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 4/30/2017 9:34:50 PM your computer crashed
crash dump file: C:\Windows\Minidump\043017-43062-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14E7C0)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF802C34FD7C4, 0xFFFFAE017B368BC0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 4/30/2017 9:14:43 PM your computer crashed
crash dump file: C:\Windows\Minidump\043017-17484-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14E7C0)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF803AC6D6F92, 0xFFFFA8809F518F20, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


*******************************************************************************

Current Nvidia Driver: 381.65-desktop-win10-64bit-international-whql

I also preformed a memory test for my ram through windows. It came up with no errors at all. Which is expected since this computer is 3 months old and not overclocked at all.


I also uninstalled and removed the "Fake" drives the VPN created to run.
Windows Defender is basic but reports no viruses.

All temps on my rig are cool:
CPU 26 C
GPU 52 C
MOBO 33 C


EVENT VIEWER Codes
Error 7023
Error 1001
Error 7000
Error 7009
Critical 41
Error 10016
Error 10010
 
Solution
Softether VPN is not the cause of your problem, well it didn't cause it on purpose. Softether VPN is a highly regarded and trusted application, that is open source. (See https://github.com/SoftetherVPN/SoftEtherVPN) your issues were likely caused by an incompatible driver from SoftEther or an incompatible chipset on your computer. You should do them a favor and report this issue to them by submitting an issue via the repo above or by their preference following the link at the top of the repo labeled for support, so they can fix it. Include your crash logs and any other information that might be useful to them including hardware specs and steps to reproduce.

SoftEther is not a virus nor has it ever been. Your right, your BSODs seem to...

Vic 40

Titan
Ambassador

Before all of this the system ran fine? No issues at all ...



 

FlashGuard

Reputable
Mar 22, 2017
47
0
4,530



yes it did. However i found the solution trudging through the internet.



 

FlashGuard

Reputable
Mar 22, 2017
47
0
4,530
Uninstalled VPN Program, Then DISABLED AND UNINSTALLED THE VPN DRIVER in device manager

I used https://answers.microsoft.com/en-us/windows/wiki/windows_10-update/driver-verifier-tracking-down-a-mis-behaving/f5cb4faf-556b-4b6d-95b3-c48669e4c983 this windows program to force the stupid driver out of hiding.

Then i used BlueScreenView:
http://www.nirsoft.net/utils/blue_screen_view.html

Then I found that the issue was not my ntoskrnl.exe But was in fact crashing due to another file "ndisrd.sys"

which after review i found that the file was a FAKE!

https://www.symantec.com/security_response/writeup.jsp?docid=2009-072717-3058-99&tabid=2

and

http://www.exterminate-it.com/malpedia/file/ndisrd.sys

These links helped me find and delete the Registry keys to this bug. After deleting the registry keys (which had slightly different names but the same location) i booted into safe mode WITHOUT NETWORKING. There i could delete the ndisrd.sys.

PLEASE NOTE THAT FOR FUTURE VIEWS TO DOWNLOAD YOUR ETHERNET DRIVERS FOR REINSTALL AFTER REMOVAL!!

However i just used a windows 10 USB install (by selecting it upon PC boot) to repair windows. Which fixed any issues with the registry and installed the correct Ethernet files. Be warned it took a while (20min) for windows to do this.

ROLLBACK AND SYSTEM RESTORES WILL NOT WORK! Due to the fact that the file will simple re install itself if the files.

Now i have the drivers updated including my video card. Today i started to stream and played games with no crashes! :D
 

TheWired

Reputable
Dec 6, 2014
4
0
4,520
Softether VPN is not the cause of your problem, well it didn't cause it on purpose. Softether VPN is a highly regarded and trusted application, that is open source. (See https://github.com/SoftetherVPN/SoftEtherVPN) your issues were likely caused by an incompatible driver from SoftEther or an incompatible chipset on your computer. You should do them a favor and report this issue to them by submitting an issue via the repo above or by their preference following the link at the top of the repo labeled for support, so they can fix it. Include your crash logs and any other information that might be useful to them including hardware specs and steps to reproduce.

SoftEther is not a virus nor has it ever been. Your right, your BSODs seem to be driver related, your right it could have been caused by softether. However the program is not a virus. You probably suffered from a driver bug, these things happen but, I've been using it for 3 or so years now without issue, but I also run the server on server hardware, likely verified hardware, and i'm not a fringe case. I run the client on all my machines again without issue. I even update it when i can, again without issue. I'm sounding like a broken record but i can't drive home the point enough. If you have a program that causes a blue screen it likely isn't a virus. It is likely a software bug that is causing some major issues. If a virus wanted to BSOD your computer it would BSOD it and make sure it never woke up. If the program you installed happened to actually be a virus, I would look into where you got it from, and only download programs from official sources. Never install modified versions of a program unless you are fully prepared to deal with the fallout incase there is a virus contained. you should also check checksums too as this will tell you if a file is incomplete or messed up in some way.
 
Solution