BSOD caused by ntoskrnl.exe

Toggle sidebar Toggle sidebar
W

wqill2016

Prominent
May 3, 2017
19
0
510
I bought this laptop second hand, it is a lenovo T520, I have always loved the thinkpads they are so utilitarian. So although the guy I bought it from said it would blue screen from time to time.. I negotiated a good price and more for the love of it than anything else.. I bought it.

Upon trying it out, it has BSOD'ed mostly when there is a higher system load it seems. figured I would get around to fixing it when I had more time from work and just continued using my other computer for day to day.

3 months later..

I have a need of a second computer now So I decided to tried swapping out the RAM...same problem..I also wiped the computer enitrely, re-installed win10...same problem...I have changed the HDD....well you can guess..lol

After reading through your forum last night I decided to test the original RAM again although I had already previously tried swapping it, just to be thorough and to get more data

I used memtest64, ran a full scan and recieved not one single error..

I have uploaded my DMP file and memtest86 file:

https://drive.google.com/open?id=0B3uWDEh78ZePNmNGTktfMlY1V1U

I figure it is something to do with a fake, faulty or incorrect driver..

Any help you can give me would be most appreciated, Thank you so much in advance

 
Solution
Colif
normally dx errors are related to graphics card and if I am right, the majority of errors relating to the creators update & graphics are Nvidia so perhaps they are the ones who need to release a patch to fix it.

you looking on google for answers is generally what I do if I don't know them :)
Sort by date Sort by votes
i can't read dump files but while we wait for someone who can, can you download and run who crashed - it will give us a glimpse of the errors you getting and might help us solve them

Copy/paste summary in here and I see what I can do :)

even if it just blames ntoskrnl (new technology operating system kernel) the codses might give me a clue as to whats happening, and may show another file name as well.

I assume you visited http://pcsupport.lenovo.com/au/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t520/downloads and clicked start scan as that should show you any newer drivers.
 
Upvote 0 Downvote
Thanks for getting back to me so quickly, yeah I downloaded all of my drivers from the lenovo support page originally but I will run that again.

Here is the info from 'whocrashed' Thanks.

System Information (local)
--------------------------------------------------------------------------------

Computer name: DESKTOP-7SQH01Q
Windows version: Windows 10 , 10.0, build: 14393
Windows dir: C:\Windows
Hardware: 4243VJG, LENOVO
CPU: GenuineIntel Intel(R) Core(TM) i5-2540M CPU @ 2.60GHz Intel586, level: 6
4 logical processors, active mask: 15
RAM: 8467492864 bytes total




--------------------------------------------------------------------------------
Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.

On Wed 03/05/2017 19:42:47 your computer crashed
crash dump file: C:\Windows\Minidump\050317-30968-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14E7C0)
Bugcheck code: 0xD1 (0xFFFFF8038B5D7B80, 0xFF, 0xB0, 0xFFFFF8038B5D7B80)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 03/05/2017 19:42:47 your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: dxgmms1.sys (dxgmms1+0x6B9E)
Bugcheck code: 0xD1 (0xFFFFF8038B5D7B80, 0xFF, 0xB0, 0xFFFFF8038B5D7B80)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\drivers\dxgmms1.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: DirectX Graphics MMS
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.





--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

2 crash dumps have been found and analyzed. No offending third party drivers have been found. Connsider using WhoCrashed Professional which offers more detailed analysis using symbol resolution. Also configuring your system to produce a full memory dump may help you.


Read the topic general suggestions for troubleshooting system crashes for more information.

Note that it's not always possible to state with certainty whether a reported driver is responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further.
 
Upvote 0 Downvote
if you don't have any suspect firefox extensions then I would suspect one of the generic drivers or the old 2012 sd driver is corrupting memory.

you might run cmd.exe as an admin then run
verifier.exe /standard /all
to try to force window to bugcheck if a driver dose something wrong.
Note: be sure you know how to get into safe mode so you can run
verifier.exe /reset
to turn off verifier after you are done testing.
if verifier finds anything it will name the bad driver in the bugcheck memory dump.

you could also disable the sd device if you can not find a driver for it. (just to make sure it is not the cause of the corruption)

other causes of corruption can be sound drivers for the motherboard conflicting with the sound driver for the GPU.
-----------
when I look up your machine, I don't see the bios that you are running and I only see driver updates up to windows 8.1
http://pcsupport.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t520/4243/4243vjg/download

you have generic versions of many drivers installed.
better if you can find updates for your machine.


----------
while running firefox.exe it made calls to directx but something corrupted the stack
and caused the dirctx to crash.

I would be disable any firefox browser extensions.
------
old driver installed:
RICOH SD/MMC Driver
\SystemRoot\System32\drivers\risdxc64.sys Thu Sep 20 21:35:19 2012



 
Upvote 0 Downvote
Hey thanks guys I tried the verifier rebooted at least ten times, no stops, nothing..

Computrace is installed here, could that be doing something?

can I change the bois to what is recommended?

all the drivers I installed from lenovo support page, then ran driver booster and it told me they were all outdated so updated from there..

 
Upvote 0 Downvote
you never know what you get when you run these 3rd party driver installers.
come motherboards require specific versions of drivers to match the BIOS and the actual chip versions installed on the motherboard.

You would go into the bios and see if you have the option to turn off the hardware.
failing that you might be able to disable it in winodows control panel -> device manager.
then manually uninstall the driver. (see if there is a uninstall for the driver, but you will have to turn off plug and play while you uninstall the driver. otherwise plug and play will reinstall the driver a few seconds after you uninstall it.



 
Upvote 0 Downvote
Also just checking, sorry in this is noobily obvious.. I know some stuff but its patchy and all self taught..

should I have 2 display adapters?

in device manager i have listed;

Intel(r) HD graphics 3000 and

NVIDIA NVS 4200M

 
Upvote 0 Downvote
looks like the uninstaller was looking for a registry key to delete and did not find it.

yes, it is ok to have two graphics drivers. One GPU is built into the CPU
the other one is a add on either on the motherboard or in a slot.

each GPU will have audio support built in, these can sometimes conflict with the motherboard sound driver.
the sound support in the GPU is for HDMI and displayport cables which can carry audio signals to speakers in your monitor. Sound drivers are not very smart, they don't know about each other and one may respond and overwrite the others data. Tends to make your GPU not respond. Most often it is the fault of the motherboard sound drivers because microsoft will install a generic version when it installs windows. Often you have to have the updated version provided by the motherboard vendor.



 
Upvote 0 Downvote
Thanks,

I am running latency mon now its still running but have take snips of the screens and added them to google drive
https://drive.google.com/drive/folders/0B3uWDEh78ZePNmNGTktfMlY1V1U

I should have mentioned too, the battery is awful very old only lasts 5 or 10 mins. but didnt think it was relevant. I just leave it plugged in

I'd love to update the bios if I could. could computrace be doing something?

latency mon is also showing my OS to be windows 8...

thank you so much for your continued help

just downloaded the bios updater utility, and I got the updater does not recognize this system

 
Upvote 0 Downvote

Its also common in laptops as the Intel CPU runs desktop and the Nvidia card runs high graphic intensive things like games. Just thought I would mention it :)
 
Upvote 0 Downvote
overall, I would change the memory dump type to kernel so you can provide a kernel memory dump which will have more info about your hardware.

you might go into bios and reset it to defaults and reconfigure, but if this is a laptop, i would think you have a driver mismatch with the hardware.
I would still be trying to get rid of or update the 2101 SD card driver.

providing a kernel memory dump might allow the debugger to see what the problem is. The info is just not saved in a minidump

-----------
- RICOH SD/MMC Driver was still installed.

the bugcheck was in the keyboard driver(i8042prt.sys ), involving interrupts.
kind of strange.

you might uninstall Intel Smart Connect Technology Driver
I think it is a dead product, and is no longer supported.
(unless you are actually using it) file= INSTB64.SYS

you might see if there is a update for you netwew0.sys
Intel Wireless WiFi Link Driver from
https://downloadcenter.intel.com/

 
Upvote 0 Downvote
yeah this a laptop, lenovo T520 i5 8GB

I uninstalled the ricoh sd driver in control panel and then used iobit uninstaller to 'powerful uninstall' and delete the left over files.

its still there, thats wierd..

intel connect I would gladly get rid of also, although there is no uninstaller in control panel. how do you suggest that I get rid of these drivers safely?

looked at my BIOS it is the latest version from the Lenovo site

whilst i was there I went throught devices looking for the SD card to disable it, although there were two things it could be to my untrained eye.. so i didn't risk it.

I have changed my memory dump to kernel dump, I'll try to increase the system load using programs until it crashes and then upload the dump to my google drive.

thankyou SO much again guys

 
Upvote 0 Downvote
ok so I booted back into bios again,

took a photo of the devices to disable with my phone, uploaded to google drive https://drive.google.com/drive/folders/0B3uWDEh78ZePNmNGTktfMlY1V1U

loaded the default settings for everything saved and exited.

I got a stop code boot device inaccessible. which I had before when I reisnalled windows.

went back into the bios and change the SATA mode to compatibility and it booted just fine.
 
Upvote 0 Downvote
I'm going to try putting the computer in SATA AHCI

then mode wipe it and reinstall the latest win 10,

this time I am only going to install the lenovo thinkvantage system update for win 10

for everything else, if necessary, I'm going to use a third party driver update tool to do the rest.

Thank you for all your help fellas, I'll post my results as soon as
 
Upvote 0 Downvote
Here is my update as promised.

I booted into BIOS and loaded its default config. then used a usb to perfrom a clean install of windows.

after the windows install was finished, I installed ThinkVantage System Update for Windows 10, for my system T520 4243, from:

http://pcsupport.lenovo.com/mx/en/products/LAPTOPS-AND-NETBOOKS/THINKPAD-T-SERIES-LAPTOPS/THINKPAD-T520/4243/downloads/DS012808

it found 3 drivers to install; sound driver, connect2 and RICOH SD card reader driver, I installed all.

after rebooting a few times I found that 2 finger scroll on my trackpad and other thinkpad 'special buttons' had also been enabled which wern't enabled before.. maybe a background process from this update installed them.

I decided to play it safe this time and not use a 3rd party driver installer as I had done on previous installs and risk later running into BSOD issues as happened before.

(just for reference: I used IObit driver booster previously, I like this program as it is super user friendly, neat and fast, I have used this program on several computers and never experienced a problem before.

I put it down to the fact that it doesnt undserstand the foibles of windows 10 on the thinkpad T520..

lenovo doesnt even support updating the T520 to win 10 I found out by checking their site...)

I then went into device manager and right clicked each device chose update driver and let it search automatically for updates. it found some for my wifi and ethernet. nothing else needed to be updated.

(there was one exclamation mark under 'other devices' the PCI serial port.

After googling the device ID found out it was Intel AMT - 'Active Management Technology'. which I neither want or need, so I have left it like that.

I then went to NVIDIA and let their website detect my video card and download the latest update, which I then installed

then I went to intel and downloaded their driver auto-update program which detected newer drivers for my chipset which I then installed.

since then everything has been fine... no BSODs' as of yet... fingers crossed but I think shes happy and healthy.

Thanks everyone for your help, I'm sure we would have detected the problem, but I decided it might be more than one problem due to third party drivers and decided a fresh install might be the easiest and cleanest way.

 
Upvote 0 Downvote
basically, most of the debugger commands will not work with the corrupted memory dump.
The ones that do work, I can not trust the information.

I would remove the below devices, I would go into windows control panel and disable every sound source I could find and reboot.
I would delete the virtual memory and re enable it to delete the c:\pagefile.sys

the actual bugcheck you got was related to the memory manager but the code was not documented.
the code was 0x61941 it is not a documented error code. I think it might mean that a device disconnected but only microsoft would know.

I would remove the below drivers, make a new pagefile.sys. you should also google "how to force a memory dump from the keyboard" make the registry settings and reboot and force a memory dump after about 5 minutes of running your system. do this in hopes of getting a memory dump that is not corrupted.

I looked at another system running the same windows build, it has similar corruptions and it looked like a problem with audio devices that were corrupting system memory. (still not sure but it is why i suggest disabling all of the audio devices and rebooting) you would also want to make sure you update all of the audio device drivers from your motherboard vendors website, this will include the drivers for the CPU and any add on GPU. both the cpu and GPU will have audio drivers for the graphics.

anyway if you can get a memory dump that is not so corrupted i might be able to read the internal logs and stack info.

----------
memory dump was corrupted, Will see if I can poke around and find out what the problem might be.

remove this:
\SystemRoot\System32\Drivers\SmartDefragDriver.sys Mon Dec 23 02:05:52 2013
looks like it is this http://www.iobit.com/en/iobitsmartdefrag.php

this driver might be out of date:
\SystemRoot\system32\drivers\dfx12x64.sys Tue Aug 28 12:10:34 2012
(it could be Explore Systems Virtual Audio Device )
 
Upvote 0 Downvote
even the manually initiated memory dump was corrupted.
on this version of windows on your machine:
Built by: 15063.0.amd64fre.rs2_release.170317-1834

at least the restore point did not have the two drivers installed so you know it was not caused by those two drivers.

I would turn off virtual memory in order to delete c:\pagefile.sys then turn it back on.
you should also change the memory dump type to kernel memory dump and reboot
and try and make a kernel memory dump. the file will be c:\windows\memory.dmp

I will see if I can read it the internal error logs.
this can be a bug in windows, where they upgraded a device driver that they should not have. Most likely a driver with the same name that was custom on your machine.
 
Upvote 0 Downvote
Ok so I turned off virtual memory and restarted

I then went into file options and turned off hide system files.

pagefile.sys wasn't there, so I guess it is auto-deleted

I turned virtual memory back on, restarted and I saw the file.

I have changed to kernel dump, and forced a memory dump but the file is almost 8GB..so I zipped it with winrar, setting it to split into 1gb files..

and its zipped down to one file thats less than 800mb...

hope its not an issue/corrupt again. sorry for my noobishness

since I have restored I havent received a BSOD, but then I havent used it much either have had loads to do.

also upon looking in control panel I see 2 'other devices'. rather than the one for AMT i had originally.

any ideas what the other is?

device ID: Device PCI\VEN_1180&DEV_E823&SUBSYS_21CF17AA&REV_05\4&26e1841f&0&00E4 requires further installation.

I have uploaded 2 screenshots also.

Thanks so much
 
Upvote 0 Downvote
I have split the dump into 7pieces, which I am uploading to my google drive as we speak. If you could check them that would be most appreciated, thanks again for all of your help
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom