Blue screen: is it due to ntoskrnl.exe?

Question

Hello,  Since this morning I've experienced several blue screens. I regularly download software but haven't installed anything in about a week, and there was no issue until this morning. I feel like it happens shortly after opening Windows Live Mail: after trying twice to open my email and getting 2 blue screens, I restarted the computer and avoided opening my email, and for now, there's been no problem. What's curious is that it doesn't crash immediately upon opening WLM. I have this report from Windows:  Problem signature:  Problem event name: BlueScreen  System version: 6.1.7600.2.0.0.768.3  Locale ID: 1036   Additional problem information:  BCCode: 19  BCP1: 0000000000000003  BCP2: FFFFFA80084C7940  BCP3: FFFFFA80084C7940  BCP4: FFFA80084C794000  OS Version: 6_1_7600  Service Pack: 0_0  Product: 768_1   Files helping to describe the problem:  C:\Windows\Minidump\120810-19422-01.dmp  C:\Users\Morgane\AppData\Local\Temp\WER-56581-0.sysdata.xml  Configuration: Windows 7 / Firefox 3.6.12  I also ran WhoCrashed following a post I read on a forum; here’s the report:  Crash Dump Analysis --------------------------------------------------------------------------------  Crash dump directory: C:\windows\Minidump  Crash dumps are enabled on your computer.   On Wed 08/12/2010 12:07:38 GMT, your computer crashed  crash dump file: C:\windows\Minidump\120810-19422-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x70740) Bugcheck code: 0x19 (0x3, 0xFFFFFA80084C7940, 0xFFFFFA80084C7940, 0xFFFA80084C794000) Error: BAD_POOL_HEADER file path: C:\windows\system32
toskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a pool header is corrupt. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.   On Wed 08/12/2010 12:07:38 GMT, your computer crashed  crash dump file: C:\windows\memory.dmp This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0) Bugcheck code: 0x19 (0x3, 0xFFFFFA80084C7940, 0xFFFFFA80084C7940, 0xFFFA80084C794000) Error: BAD_POOL_HEADER product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a pool header is corrupt. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.   On Wed 08/12/2010 11:56:18 GMT, your computer crashed  crash dump file: C:\windows\Minidump\120810-17674-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x70740) Bugcheck code: 0xD1 (0x1500743, 0x2, 0x0, 0xFFFFF88004A7AED3) Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL file path: C:\windows\system32
toskrnl.exe  product: Microsoft® Windows® Operating System  company: Microsoft Corporation  description: NT Kernel & System  Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.  This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.  The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.  But the applications ntoskrnl.exe and ntkrnlmp.exe are essential for booting Windows, right? So I don't know what to do. (I'm a complete beginner in this area)  One more thing: this may not be related, but Kaspersky has notified me several times recently that the kernel mode memory patch program was suspicious, but since I thought it was a legitimate program, I didn't take any action.  Thank you very much for your help :)

guigui0001 · Accepted Answer

Hello,

--> We will check that your system files have not been modified:

* Once the PC is started, go to Start, then in the search bar, type cmd . Right-click on the result, then click on Run as administrator

* In the command prompt window (the black window), type sfc/verifyonly and press enter.

* At the end of the operation, post a screenshot in this topic.

==> To help you: Tutorial on sfc

zetopskateuse · Answer

It's done! Apparently, everything is fine: [IMG=http://img232.imageshack.us/img232/3866/cmdy.png][/IMG]

guigui0001 · Answer

Okay,  We will perform a  System Restore  to try to fix your issue.  Note: a system restore is a powerful utility that will only modify system files, the registry, and programs. Your documents will not be affected. However, any changes made to your PC after the restore point we choose will be lost.   * Go to Start > All Programs > Accessories >  System Tools .  * Click on  System Restore .  * If you are on Vista/7, confirm the operation.  * In the small window that appears, click Next, as shown in the image below:  http://img814.imageshack.us/img814/4331/restc.png  * A list of restore points appears. Choose a restore point earlier than your issues, then click Next.  * The restoration begins, please wait during the operation.  * Your PC may ask you to restart. Backup your data and restart it.  * After the restart, let me know if the issues return.  ==> To help you: Tutorial on system restore

zetopskateuse · Answer

Sure! Thanks ;) I'm going to do that tonight because if it takes too long I won't have the time now, but what do you think about the reports I posted? Can't we identify the problem from there?

guigui0001 · Answer

It takes two or three minutes for a restore.  I can't identify the problem based on the manipulation I had you do, simply because sfc didn't detect any issues.  See you later!

zetopskateuse · Answer

Alright, I'm doing this tonight anyway because I'm leaving in 5 minutes! Thanks anyway.

guigui0001 · Answer

Sure, keep me posted.

zetopskateuse · Answer

I'm back :)

Earlier in post 5, I was talking about the first reports, for example, the WhoCrashed report doesn't provide anything? Is there no way to interpret it? Because to be honest, I'm not sure how to deal with system restoration: no bugs since this morning even when trying to open Windows Live Mail again, but thinking about it, I suspect an older problem because a few weeks ago I left my computer in sleep mode and when I returned it was turned off. When I turned it back on, I got exactly the same thing as this morning: the screen "windows was not shut down properly, etc." and a message "windows has restarted after an unexpected shutdown," but I don't remember the exact date so I'm worried about losing all the software I've installed over the past few weeks by doing a restoration :s

guigui0001 · Answer

Re,

You say "even trying to open Windows Live Mail but thinking about it I suspect an older problem because a few weeks ago I left my computer in sleep mode and when I returned it was off."

It's not the same problem.

Just restore your system to a date two or three days ago, that should be fine.

As for your whocrashed reports, they detect a problem in Windows kernel files, that's why I had you do the sfc command, but apart from that, there's nothing to take from it.

zetopskateuse · Answer

Understood! I did the restoration, I restored the system to how it was on December 5th. Now I just have to wait to see if the problem comes back?

guigui0001 · Answer

Yep :)

phil1982 · Answer

Hello guigui, I have an HP with Windows 7, an i5 with 4GB of RAM. I worked on a project with Windows Live Movie Maker, the movie lasts 2h30 (I spent two intensive weeks making it) and when I try to save it in any format (HD, DVD...) it starts and around 7% (it varies sometimes) it crashes with a BSOD (blue screen of death) and restarts. This puts me in a state... If you could help me, that would be really cool. Here is the error message on restart, and then there is the one from the Whocrashed software (I did the analysis you mentioned earlier with cmd, verifyonly… it tells me everything is ok, no violations)   Problem Signature:  Problem Event Name: BlueScreen  System Version: 6.1.7600.2.0.0.768.3  Locale Identifier: 1036  Additional Problem Information:  BCCode: 50  BCP1: FFFFFFFF9D4D5D30  BCP2: 0000000000000001  BCP3: FFFFF880051DD19E  BCP4: 0000000000000005  OS Version: 6_1_7600  Service Pack: 0_0  Product: 768_1  Files helping to describe the problem:  C:\Windows\Minidump\012811-17674-01.dmp  C:\Users\pinhas\AppData\Local\Temp\WER-33150-0.sysdata.xml  Read our online privacy statement:  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x040c  If the online privacy statement is not available, read the offline version:  C:\Windows\system32\fr-FR\erofflps.txt     Crash dump directory: C:\Windows\Minidump  Crash dumps are enabled on your computer.   On Tue 08/02/2011 22:58:28 GMT your computer crashed crash dump file: C:\Windows\Minidump\020811-24694-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x70740) Bugcheck code: 0x50 (0xFFFFFFFFADE7EA30, 0x1, 0xFFFFF880053E719E, 0x5) Error: PAGE_FAULT_IN_NONPAGED_AREA file path: C:\Windows\system32
toskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that invalid system memory has been referenced. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.   On Tue 08/02/2011 22:58:28 GMT your computer crashed crash dump file: C:\Windows\memory.dmp This was probably caused by the following module: nvlddmkm.sys (nvlddmkm+0x12819E) Bugcheck code: 0x50 (0xFFFFFFFFADE7EA30, 0x1, 0xFFFFF880053E719E, 0x5) Error: PAGE_FAULT_IN_NONPAGED_AREA file path: C:\Windows\system32\drivers
vlddmkm.sys product: NVIDIA Windows Kernel Mode Driver, Version 188.17 company: NVIDIA Corporation description: NVIDIA Windows Kernel Mode Driver, Version 188.17 Bug check description: This indicates that invalid system memory has been referenced. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. A third-party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: nvlddmkm.sys (NVIDIA Windows Kernel Mode Driver, Version 188.17 , NVIDIA Corporation). Google query: nvlddmkm.sys NVIDIA Corporation PAGE_FAULT_IN_NONPAGED_AREA      -------------------------------------------------------------------------------- Conclusion --------------------------------------------------------------------------------  2 crash dumps have been found and analyzed. A third-party driver has been identified to be causing system crashes on your computer. It is strongly suggested that you check for updates for these drivers on their company websites. Click on the links below to search with Google for updates for these drivers:  nvlddmkm.sys (NVIDIA Windows Kernel Mode Driver, Version 188.17 , NVIDIA Corporation)  If no updates for these drivers are available, try searching with Google on the names of these drivers in combination with the errors that have been reported for these drivers and include the brand and model name of your computer as well in the query. This often yields interesting results from discussions from users who have been experiencing similar problems.

guigui0001 · Answer

Hmmm... Do you have another PC available?

phil1982 · Answer

Hi Guigui, sorry but my email box put your email in the spam folder and I just saw your message, yes, I have another Toshiba PC running Vista.

guigui0001 · Answer

Well, then try to make your movie from the vista, and tell me how it goes.

phil1982 · Answer

The problem is that my project, which took me two weeks to complete, is on my HP (Windows 7), so I don't want to redo everything (otherwise, with Vista, I made plenty of films and it works fine).

guigui0001 · Answer

Je ne peux pas effectuer cette action.

Anonymous user · Answer

Hello,

@phil1982: This might help you…

??STOP: 0x0000008e or STOP 0x00000050 PAGE_FAULT_IN_NON_PAGED_AREA:

or "The file setupdd.sys could not be loaded: The error code is 4: the installation cannot continue… Press any key to exit" at startup or during installation, I have the following error messages:
"The file Ntfs.sys is corrupted…" or "KERNEL DEBUGGING DLL"… "The file setupdd.sys could not be loaded. The error code is 7. The installation cannot continue… a memory stick problem… Remember that the minimum requirement is 64 MB… Otherwise, test your modules one by one. Note: The problem can also occur if your processor is defective or poorly ventilated.

??STOP: 0x00000050 PAGE_FAULT_IN_NONPAGED_AREA:

(0xC25E0026, 0x00000001, 0xF8101CD1, 0x00000000) ntfs.sys - Address F8101CD1 base at F808D000, DataStamp 3b7dc5d0":
If the problem does not come from the memory sticks, try replacing your graphics card at least for the duration of the Windows XP installation. - Npfs.sys PAGE_FAULT_IN_NONPAGED_AREA: again a memory stick problem.

??STOP: 0x00000050 PAGE_FAULT_IN_NONPAGED_AREA:

Just before the name of the file that caused the above error. Conduct a search for the file and once found, check in which directory it is located. You can also right-click on it and choose "Properties". These two maneuvers will give you reliable information on the software or device it depends on. You now have two possible solutions: Either it’s a service that starts up every time Windows boots, or your device driver needs to be updated (hoping that a driver specifically written for Windows XP is available). In the first case, restart in safe mode and try to recreate the crash and therefore the error message. If nothing special happens in this mode, launch the "System Configuration Editor" and disable each Microsoft service listed in this menu one by one. Finally, it can happen that the issue comes from faulty software. Again, always in the "System Configuration Editor", disable all auto-start commands related to the problematic program.

Jay76 · Answer

Hello,  I have this infamous blue screen that appears from time to time and interrupts me in the middle of an online game ... which tends to irritate me ...  I also ran a WHOCRASHED analysis  Here is the summary:  Crash dump directory: C:\Windows\Minidump  Crash dumps are enabled on your computer.   On Tue 01/05/2012 20:48:54 GMT your computer crashed crash dump file: C:\Windows\Minidump\050112-6442-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x7CC80) Bugcheck code: 0xF4 (0x3, 0xFFFFFA8007FD8060, 0xFFFFFA8007FD8340, 0xFFFFF80002F95660) Error: CRITICAL_OBJECT_TERMINATION file path: C:\Windows\system32
toskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a process or thread crucial to system operation has unexpectedly exited or been terminated. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.   On Tue 01/05/2012 14:25:32 GMT your computer crashed crash dump file: C:\Windows\Minidump\050112-5366-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x7CC80) Bugcheck code: 0xF4 (0x3, 0xFFFFFA8007FD08E0, 0xFFFFFA8007FD0BC0, 0xFFFFF80002F8B660) Error: CRITICAL_OBJECT_TERMINATION file path: C:\Windows\system32
toskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a process or thread crucial to system operation has unexpectedly exited or been terminated. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.   On Sun 18/03/2012 09:53:05 GMT your computer crashed crash dump file: C:\Windows\Minidump\031812-6037-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x7CD40) Bugcheck code: 0xF4 (0x3, 0xFFFFFA8007627830, 0xFFFFFA8007627B10, 0xFFFFF80002DE15F0) Error: CRITICAL_OBJECT_TERMINATION file path: C:\Windows\system32
toskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a process or thread crucial to system operation has unexpectedly exited or been terminated. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.   On Sat 17/03/2012 15:02:20 GMT your computer crashed crash dump file: C:\Windows\Minidump\031712-5382-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x7CD40) Bugcheck code: 0xF4 (0x3, 0xFFFFFA8007623B30, 0xFFFFFA8007623E10, 0xFFFFF80002D895F0) Error: CRITICAL_OBJECT_TERMINATION file path: C:\Windows\system32
toskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a process or thread crucial to system operation has unexpectedly exited or been terminated. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.   On Sat 25/02/2012 14:24:08 GMT your computer crashed crash dump file: C:\Windows\Minidump\022512-5974-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x7CC40) Bugcheck code: 0xF4 (0x3, 0xFFFFFA8007867B30, 0xFFFFFA8007867E10, 0xFFFFF80002D8E8B0) Error: CRITICAL_OBJECT_TERMINATION file path: C:\Windows\system32
toskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a process or thread crucial to system operation has unexpectedly exited or been terminated. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.   On Tue 24/01/2012 17:43:40 GMT your computer crashed crash dump file: C:\Windows\Minidump\012412-5319-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x7CC40) Bugcheck code: 0xF4 (0x3, 0xFFFFFA800784EB30, 0xFFFFFA800784EE10, 0xFFFFF80002DDE8B0) Error: CRITICAL_OBJECT_TERMINATION file path: C:\Windows\system32
toskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a process or thread crucial to system operation has unexpectedly exited or been terminated. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.   On Wed 18/01/2012 14:38:02 GMT your computer crashed crash dump file: C:\Windows\Minidump\011812-5756-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x7CC40) Bugcheck code: 0xF4 (0x3, 0xFFFFFA80075CE060, 0xFFFFFA80075CE340, 0xFFFFF80002DD88B0) Error: CRITICAL_OBJECT_TERMINATION file path: C:\Windows\system32
toskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a process or thread crucial to system operation has unexpectedly exited or been terminated. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.   On Wed 11/01/2012 22:55:05 GMT your computer crashed crash dump file: C:\Windows\Minidump\011112-5257-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x7CC40) Bugcheck code: 0xF4 (0x3, 0xFFFFFA8007F9EB30, 0xFFFFFA8007F9EE10, 0xFFFFF80002DE88B0) Error: CRITICAL_OBJECT_TERMINATION file path: C:\Windows\system32
toskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a process or thread crucial to system operation has unexpectedly exited or been terminated. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.   On Wed 04/01/2012 11:43:48 GMT your computer crashed crash dump file: C:\Windows\Minidump\010412-5101-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x7CC40) Bugcheck code: 0xF4 (0x3, 0xFFFFFA800733E9B0, 0xFFFFFA800733EC90, 0xFFFFF80002D808B0) Error: CRITICAL_OBJECT_TERMINATION file path: C:\Windows\system32
toskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a process or thread crucial to system operation has unexpectedly exited or been terminated. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.   The following dump files were found but could not be read. These files may be corrupt: C:\Windows\Minidump\022712-5974-01.dmp C:\Windows\Minidump\043012-6006-01.dmp   Could someone give me a solution to resolve this problem?  Thank you in advance.

ceubri · Answer

I know that the message is already a long time ago, but my blue screen came from a poorly installed driver (Wacom tablet). If that can help...

Julien · Answer

Yes, it's a driver problem. Graphics card on my part.

Blue screen: is it due to ntoskrnl.exe?

21 answers

Storage space running out soon

Canon pixma printer not detected via livebox 7

Tf1+ will develop games based on its favorite shows

Ps project: €0.10/gb tax to fund the networks

Iphone 14 accidentally encrypted backup.

Convert ts to m2ts

Invisible text boxes or word forms on pdf

I can't even find a single string.

Unable to open xsl and xslx files

Texture issues in enshrouded