BSOD ntoskrnl.exe Windows 7

JustRelaxASC · Jul 6, 2014

Hello everyone,
In the past month or so I started getting BSODs: http://i.imgur.com/AnjpPWQ.png
Thats from the past couple of days only because I reinstalled Windows hoping that it will fix it, but sadly, it didn't. It crashed few times while I was trying to reinstall it and when it finally did boot I got "The procedure entry point could not be located in the dynamic link library GDI32.dll." And then "Windows explorer has stopped working" and "Fatal error, Windows will restart in 1 minute" and WerFault.exe - Application Error "The instruction at 0x7760879e referenced memory at 0x000000000. The memory could not be written."Also after Windows reinstall I got "Cryptographic Services has stopped working"
I also got a red screen with yellow letters once with "SYSTEM_SERVICE_EXCEPTION"
I constantly get "Aw, Snap!" thing on Google Chrome and after a couple of minutes it gives me the BSOD. I also get "Catalyst Control Center: Host application has stopped working" message as soon as PC boots.
All of the recent BSODs were cause by ntoskrnl.exe+6f880 and ntoskrn.exe+75bc0 except for the ones I got today which were cause by atikmdag.sys+131e7c and fltmgr.sys+4aae. Someone told me to try to unplug some of the devices and see if the BSOD will appear, and eventually, it did, the only thing I didn't try to unplug is my USB Mouse, I unplugged it now and will see what happens..., if it even has to do something with it.

Alec Mowat · Jul 6, 2014

That's the windows kernel

If you can upload a couple of the dmp files from the windows/minidump directory, I can give you more specific information.

JustRelaxASC · Jul 6, 2014

http://goo.gl/zYDp75 There you go

Alec Mowat · Jul 6, 2014

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\amowat\Desktop\New folder\070614-20560-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`03255000 PsLoadedModuleList = 0xfffff800`03498890
Debug session time: Sun Jul 6 12:48:41.812 2014 (GMT-4)
System Uptime: 0 days 5:28:25.640
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff800035e9743, fffff8800bb3bac0, 0}

Probably caused by : memory_corruption ( nt!MiSectionDelete+3f )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800035e9743, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800bb3bac0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!MiSectionDelete+3f
fffff800`035e9743 0fba633814 bt dword ptr [rbx+38h],14h

CONTEXT: fffff8800bb3bac0 -- (.cxr 0xfffff8800bb3bac0)
rax=fffff8a00d21f000 rbx=0000000000000000 rcx=fffff8a006685ed0
rdx=fffff8a00bf4ce90 rsi=0000000000000001 rdi=fffff8a006685ed0
rip=fffff800035e9743 rsp=fffff8800bb3c4a0 rbp=fffff8a00b5af010
r8=0000000000000001 r9=0000000000000001 r10=0000000000000020
r11=fffff8800bb3c5f0 r12=0000000000000000 r13=fffffa8005b73000
r14=00000000ffffffff r15=fffff8a005766480
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00210246
nt!MiSectionDelete+0x3f:
fffff800`035e9743 0fba633814 bt dword ptr [rbx+38h],14h ds:002b:00000000`00000038=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: chrome.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800035e9743

STACK_TEXT:
fffff880`0bb3c4a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiSectionDelete+0x3f

FOLLOWUP_IP:
nt!MiSectionDelete+3f
fffff800`035e9743 0fba633814 bt dword ptr [rbx+38h],14h

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiSectionDelete+3f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 531590fb

STACK_COMMAND: .cxr 0xfffff8800bb3bac0 ; kb

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x3B_nt!MiSectionDelete+3f

BUCKET_ID: X64_0x3B_nt!MiSectionDelete+3f

Followup: MachineOwner
---------

2: kd> .cxr 0xfffff8800bb3bac0
rax=fffff8a00d21f000 rbx=0000000000000000 rcx=fffff8a006685ed0
rdx=fffff8a00bf4ce90 rsi=0000000000000001 rdi=fffff8a006685ed0
rip=fffff800035e9743 rsp=fffff8800bb3c4a0 rbp=fffff8a00b5af010
r8=0000000000000001 r9=0000000000000001 r10=0000000000000020
r11=fffff8800bb3c5f0 r12=0000000000000000 r13=fffffa8005b73000
r14=00000000ffffffff r15=fffff8a005766480
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00210246
nt!MiSectionDelete+0x3f:
fffff800`035e9743 0fba633814 bt dword ptr [rbx+38h],14h ds:002b:00000000`00000038=????????

Alec Mowat · Jul 6, 2014

These dumps are all over the place.
However; they do have this in common
Probably caused by : memory_corruption ( nt!MiSectionDelete+3f )

I'm going with
A. Bad RAM.
B. Timings on RAM are not setup correctly.

Small chance it's the processor or the page file.

JustRelaxASC · Jul 6, 2014

Alec Mowat :

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\amowat\Desktop\New folder\070614-20560-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`03255000 PsLoadedModuleList = 0xfffff800`03498890
Debug session time: Sun Jul 6 12:48:41.812 2014 (GMT-4)
System Uptime: 0 days 5:28:25.640
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff800035e9743, fffff8800bb3bac0, 0}

Probably caused by : memory_corruption ( nt!MiSectionDelete+3f )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800035e9743, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800bb3bac0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!MiSectionDelete+3f
fffff800`035e9743 0fba633814 bt dword ptr [rbx+38h],14h

CONTEXT: fffff8800bb3bac0 -- (.cxr 0xfffff8800bb3bac0)
rax=fffff8a00d21f000 rbx=0000000000000000 rcx=fffff8a006685ed0
rdx=fffff8a00bf4ce90 rsi=0000000000000001 rdi=fffff8a006685ed0
rip=fffff800035e9743 rsp=fffff8800bb3c4a0 rbp=fffff8a00b5af010
r8=0000000000000001 r9=0000000000000001 r10=0000000000000020
r11=fffff8800bb3c5f0 r12=0000000000000000 r13=fffffa8005b73000
r14=00000000ffffffff r15=fffff8a005766480
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00210246
nt!MiSectionDelete+0x3f:
fffff800`035e9743 0fba633814 bt dword ptr [rbx+38h],14h ds:002b:00000000`00000038=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: chrome.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800035e9743

STACK_TEXT:
fffff880`0bb3c4a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiSectionDelete+0x3f

FOLLOWUP_IP:
nt!MiSectionDelete+3f
fffff800`035e9743 0fba633814 bt dword ptr [rbx+38h],14h

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiSectionDelete+3f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 531590fb

STACK_COMMAND: .cxr 0xfffff8800bb3bac0 ; kb

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x3B_nt!MiSectionDelete+3f

BUCKET_ID: X64_0x3B_nt!MiSectionDelete+3f

Followup: MachineOwner
---------

2: kd> .cxr 0xfffff8800bb3bac0
rax=fffff8a00d21f000 rbx=0000000000000000 rcx=fffff8a006685ed0
rdx=fffff8a00bf4ce90 rsi=0000000000000001 rdi=fffff8a006685ed0
rip=fffff800035e9743 rsp=fffff8800bb3c4a0 rbp=fffff8a00b5af010
r8=0000000000000001 r9=0000000000000001 r10=0000000000000020
r11=fffff8800bb3c5f0 r12=0000000000000000 r13=fffffa8005b73000
r14=00000000ffffffff r15=fffff8a005766480
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00210246
nt!MiSectionDelete+0x3f:
fffff800`035e9743 0fba633814 bt dword ptr [rbx+38h],14h ds:002b:00000000`00000038=????????

So what this means?

Alec Mowat · Jul 6, 2014

These dumps are all over the place.
However; they do have this in common
Probably caused by : memory_corruption ( nt!MiSectionDelete+3f )

I'm going with
A. Bad RAM.
B. Timings on RAM are not setup correctly.

Small chance it's the processor or the page file.

See my next post; Probably caused by : memory_corruption ( nt!MiSectionDelete+3f )

Your RAM is bad.

JustRelaxASC · Jul 6, 2014

Alec Mowat :

So how can I be sure, and how do I fix it?

Alec Mowat · Jul 6, 2014

JustRelaxASC :

Hardware problem, replace the RAM.

Try removing one stick and see if it crashes. If so, try the other stick.

If it's DDR3, you are best replacing both sticks anyway (assuming there are two).

Is this a new setup?
Post your hardware specs.

Check temperatures too.

JustRelaxASC · Jul 6, 2014

Alec Mowat :

It is DDR3
It's not a new setup
There are my hardware specs when you click on my profile pic but anyways here you go:
AMD Phenom II X4 955@3.20 GHz
Gigabyte GA-MA770T-UD3P
1920x1080@60Hz
1024MB ATI Radeon HD 5700 Series
4GB DDR3 RAM

Alec Mowat · Jul 6, 2014

I would check your CPU temperatures first.

if you have two sticks, I'd pull one out and see if it BSODs, and try the other one.

If so, you'll need to replace the RAM.

JustRelaxASC · Jul 6, 2014

The CPU temp is arround 40 so I think it's fine
The thing is it may not bsod when I pull out the stick not bcs its problem with stick but bcs it just doesn't, for example 2 days ago it didn't bsod at all and today it did like 4 times.
I'm on my phone at the moment bcs im running memtest on pc and it currently has 2103 errors, I don't think that's good.

Alec Mowat · Jul 6, 2014

Bad memory is bad memory. You are better off replacing all of it anyway, DDR3 doesn't play well with sticks from other brands. Pick up a new kit and keep the good stick for troubleshooting purposes.

JustRelaxASC · Jul 6, 2014

But how can I be sure that it's a RAM problem, what if I buy new RAM and problem persists?

Alec Mowat · Jul 6, 2014

JustRelaxASC :

All evidence points to bad memory. If it's not the memory, it could be the CPU or the motherboard.

Unless you are overclocking.

JustRelaxASC · Jul 7, 2014

Alec Mowat :

I did not overclock anything.

Alec Mowat · Jul 7, 2014

You'll need to replace the memory then

Semxt · Jul 10, 2014

Forgive me for coming in to someone else's thread like this.

I'm suffering a 0x3b bsod caused by atikmdag.sys.

My thread:
http://www.tomshardware.co.uk/answers/id-2175402/system-service-exception-atikmdag-sys-stop-error-0x3b-starting-game.html

Thanks in advance.

eedijs · Jul 11, 2014

To be sure, you should probably test it with Memtest86

JustRelaxASC · Jul 11, 2014

eedijs :

I did, at first test it came up with over 3000 errors after 1 pass, then I did it again and after 1 pass it came up with 35 errors only (only compared to 3000 from the first test), and then I let it over night and in 6 passes it came up with 905 errors, I just didn't try testing the 1 stick only and then the other one alone.

eedijs · Jul 11, 2014

lol, my stick has only 1 error and I'm replacing it. Getting bunch of bsods and freezing. My topic is still on the first page I think.

BSOD ntoskrnl.exe Windows 7

Honorable

Honorable

Honorable

Honorable

Honorable

Honorable

Honorable

Honorable

Honorable

Honorable

Honorable

Honorable

Honorable

Honorable

Honorable

Honorable

Honorable

Reputable

Honorable

Honorable

Honorable

Share this page