ntoskrnl.exe BSOD

MargeS

Over the last few weeks I've started getting the BSOD.

The minidump file reveals that the driver ntoskrnl.exe is the cause;
1) IRQL NOT LESS OR EQUAL
2) PFN LIST CORRUPT
3) DRIVER CORRUPTED EXPOOL

The laptop is a HP Zbook 15 G3 and the only change I made was by adding 16GB of memory. The laptop is 3 months old and still a fairly clean setup. I've all the drivers up to date and the BIOS has been flashed twice to the latest update released on Oct 27th.

The Device Manager shows no driver issues.
I've ran memory check & hard drive check, everything appears to be fine - nothing shows up.

Is my only option at this stage to go through each and every device in Device Manager and force an update on each driver?

irishgeo

MargeS wrote: »

Over the last few weeks I've started getting the BSOD.

The minidump file reveals that the driver ntoskrnl.exe is the cause;
1) IRQL NOT LESS OR EQUAL
2) PFN LIST CORRUPT
3) DRIVER CORRUPTED EXPOOL

The laptop is a HP Zbook 15 G3 and the only change I made was by adding 16GB of memory. The laptop is 3 months old and still a fairly clean setup. I've all the drivers up to date and the BIOS has been flashed twice to the latest update released on Oct 27th.

The Device Manager shows no driver issues.
I've ran memory check & hard drive check, everything appears to be fine - nothing shows up.

Is my only option at this stage to go through each and every device in Device Manager and force an update on each driver?

Looks like faulty RAM. Download and run a program called memtest

MargeS

irishgeo wrote: »

Looks like faulty RAM. Download and run a program called memtest

OK running memtest.
So far, 0 errors but I'll let it go for a few hours.

MargeS

MemTest completed twice.

passed 48/48 100%
0 errors

I guess it's back to reinstalling each and every driver?

johndoe99

irishgeo was right to suspect a RAM issue as ntoskrnl.exe is RAM related. Seen memtest has passed, it is a faulty driver.

You can reinstall a fresh copy of the ntoskrnl.exe file from your Windows disc.

irishgeo

Get a copy of the bluescreen crash dump. Probably in c: windows minidumps and upload it to here and post the results

http://www.osronline.com/page.cfm?name=Analyze

MargeS

irishgeo wrote: »

Get a copy of the bluescreen crash dump. Probably in c: windows minidumps and upload it to here and post the results

Sorry didn't see the bit about uploading to here.

The saga continues. Explorer is not responding in a timely manner now.
Right clicking on anything and it takes an age for the contextual menu to appear.
I'm spending a lot of time looking at spinning circles this weekend.

• sfc /scannow reveals dodgy files that can't be fixed
• Safe Mode runs perfectly. Absolutely no issues. Not sure where to go from here.
• Every driver in Device Manager is the latest version.

irishgeo

Did that not website not point to an issue.

MargeS

3 days of my life I'll never get back.

Updated every driver on the machine - never straight forward

Anyway, I've solved the issue of the slow explorer and severely slow contextual menu - it was Malwarebytes that was running the CPU at a fairly constant 90% to 100%

I'm going to sit tight for a while and see how if the machine stabilises.

MargeS

So this is just on going.
I've uninstalled Windows Security Essentials and just have Malwarebytes. The laptop is usable, though waking it from sleep/deep sleep is painful. I'm better off doing a complete shut down/restart.

I know I should contact HP support, but I just know they will tell me to restore windows (not an option as there are no restore points from August/Septermber.)
Windows reinstall is not an option as they only supplied a DVD with Win7 drivers.

I've posted to the site where I bought the memory but haven't gotten a response yet.

Do any of the crash analysis below point to the memory being at fault? Every BSOD error is different.

So far the BSOD causes have been:

• SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION
• PAGE_FAULT_IN_NONPAGED_AREA
• DRIVER_VERIFIER_DETECTED_VIOLATION
• IRQL_NOT_LESS_OR_EQUAL
• DRIVER_CORRUPTED_EXPOOL
• PFN_LIST_CORRUPT

Some of the debug info is:

BUGCHECK_STR: 0xC1_22
SPECIAL_POOL_CORRUPTION_TYPE: 22
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: Lightroom.exe
CURRENT_IRQL: 0

---

OVERLAPPED_MODULE: Address regions for 'USBSTOR' and 'umpass.sys' overlap

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034f7100
GetUlongFromAddress: unable to read from fffff800034f71c8
fffffffffffffba8

FAULTING_IP:
nt!ObReferenceObjectSafe+c
fffff800`032d87cc 498b02 mov rax,qword ptr [r10]

MM_INTERNAL_CODE: 0
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: csrss.exe

---

BUGCHECK_STR: 0xc4_89
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2

---

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034ac100
GetUlongFromAddress: unable to read from fffff800034ac1c8
fffff800035a5114 Nonpaged pool

CURRENT_IRQL: 2

FAULTING_IP:
nt! ?? ::NNGAKEGL::`string'+217e
fffff800`035a5114 55 push rbp
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0xA
PROCESS_NAME: System