none
BSOD caused by ntoskrnl.exe

    Question

  • Hello,
    
    I have a problem and I hope you can help. Thank you in advance :)
    
    I am running 
    
    AMD Athlon(tm) 7850 Dual-Core Processor
    4,00 GB RAM	
    Asus M2N68-AM SE2 motherboard
    NVIDIA GeForce 9400 GT 1gb 
    
    
    I have a pretty disturbing Problem with my Computer for some time. I am becoming irregularly BSOD. 
    
    I was running a windows XP 32 bit OS, and I had problems with the sound and with different drivers. I became a some BSOD and the cause according to the WDK (Windows Debugging Tools) minidump check was the driver of my TV-USB Stick, then of my wireless-n usb stick and at the end
    ntoskrnl.exe. At some point I even lost my HDD. As I started the computer the HDD couldn't be find. I have tested it on another computer and it was found. Well I bought a new one for my PC and installed my XP again, but I got again the BSODs. At the end I thought that my 32 bit XP doesn't work good on my system. 
    
    I got an Windows 7 Professional 64 bit licence through my University. I have formatted the HDD and installed the brand new Windows 7 64 bit OS. I was running the computer for a good 2 days. I managed to install and prepare everything as it should be (latest updates etc.).
    
    And today I got a new BSOD. I opened the minidump with the WDK and the cause is ntoskrnl.exe.
    What is actually doing this ntoskrnl.exe ? Why am do I still become this BSOD ? 
    
    I have tested my memory with memtest and other programs. Everything is ok. I have also checked my brand new HDD, and everything is ok.
    
    I am going even a little crazy thinking of BIOS Viruses. I need the PC for my research at the university and so on. I can't lose it.
    
    Here what I get by opening the minidump with WDK.
    
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [E:\Mini Dump Win 7\050810-18252-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: *** Invalid ***
    ****************************************************************************
    * Symbol loading may be unreliable without a symbol search path.           *
    * Use .symfix to have the debugger choose a symbol path.                   *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ****************************************************************************
    Executable search path is: 
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Windows 7 Kernel Version 7600 MP (2 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
    Machine Name:
    Kernel base = 0xfffff800`0281c000 PsLoadedModuleList = 0xfffff800`02a59e50
    Debug session time: Sat May  8 20:26:01.208 2010 (UTC + 2:00)
    System Uptime: 0 days 3:57:13.018
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...........................
    Loading User Symbols
    Loading unloaded module list
    ...........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1, {75072dd9, 0, fffe, fffff88007cd1ca0}
    
    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
    
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KTHREAD                                   ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    Probably caused by : ntoskrnl.exe ( nt+70600 )
    
    
    =======================================================================================================
    
    ADDITIONAL_DEBUG_TEXT:  
    Use '!findthebuild' command to search for the target build information.
    If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.
    
    MODULE_NAME: nt
    
    FAULTING_MODULE: fffff8000281c000 nt
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb
    
    FAULTING_IP: 
    +6131363034346434
    00000000`75072dd9 ??              ???
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    BUGCHECK_STR:  0x1
    
    CURRENT_IRQL:  0
    
    LAST_CONTROL_TRANSFER:  from fffff8000288bb69 to fffff8000288c600
    
    STACK_TEXT:  
    fffff880`07cd1a68 fffff800`0288bb69 : 00000000`00000001 00000000`75072dd9 00000000`00000000 00000000`0000fffe : nt+0x70600
    fffff880`07cd1a70 00000000`00000001 : 00000000`75072dd9 00000000`00000000 00000000`0000fffe fffff880`07cd1ca0 : nt+0x6fb69
    fffff880`07cd1a78 00000000`75072dd9 : 00000000`00000000 00000000`0000fffe fffff880`07cd1ca0 fffffa80`075fb8d0 : 0x1
    fffff880`07cd1a80 00000000`00000000 : 00000000`0000fffe fffff880`07cd1ca0 fffffa80`075fb8d0 000005a0`00000010 : 0x75072dd9
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt+70600
    fffff800`0288c600 48894c2408      mov     qword ptr [rsp+8],rcx
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  nt+70600
    
    FOLLOWUP_NAME:  MachineOwner
    
    IMAGE_NAME:  ntoskrnl.exe
    
    BUCKET_ID:  WRONG_SYMBOLS
    
    Followup: MachineOwner
    ---------
    

    Saturday, May 08, 2010 8:13 PM

Answers

  • APC_INDEX_MISMATCH (1)

    This is a kernel internal error. The most common reason to see this
    bugcheck is when a filesystem or a driver has a mismatched number of
    calls to disable and re-enable APCs. The key data item is the
    Thread->KernelApcDisable field. A negative value indicates that a driver
    has disabled APC calls without re-enabling them.  A positive value indicates
    that the reverse is true.

    Check your HDD for errors (use chkdsk) and update all your drivers (TerraTec Home Cinema - Cinergy_Hybrid-Stick_HID.sys which is very old - Wed Mar 12 10:02:22 2008 ).

    best regards
    André


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Saturday, May 08, 2010 10:37 PM
  • One thing I would suggest is to update the display adapter drivers to the latest version (uninstall the older drivers first):

    http://www.nvidia.com/object/win7_winvista_64bit_197.45_whql.html

    Also, the process that crashed with the APC_INDEX_MISMATCH error was the CinergyDvr.exe (see bolded):

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1, {75072dd9, 0, fffe, fffff88007cd1ca0}

    Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    APC_INDEX_MISMATCH (1)
    This is a kernel internal error. The most common reason to see this
    bugcheck is when a filesystem or a driver has a mismatched number of
    calls to disable and re-enable APCs. The key data item is the
    Thread->KernelApcDisable field. A negative value indicates that a driver
    has disabled APC calls without re-enabling them.  A positive value indicates
    that the reverse is true. This check is made on exit from a system call.
    Arguments:
    Arg1: 0000000075072dd9, address of system function (system call)
    Arg2: 0000000000000000, Thread->ApcStateIndex << 8 | Previous ApcStateIndex
    Arg3: 000000000000fffe, Thread->KernelApcDisable
    Arg4: fffff88007cd1ca0, Previous KernelApcDisable

    Debugging Details:
    ------------------


    FAULTING_IP:
    +3331613862393864
    00000000`75072dd9 ??              ???

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x1

    PROCESS_NAME:  CinergyDvr.exe

    CURRENT_IRQL:  0

    LAST_CONTROL_TRANSFER:  from fffff8000288bb69 to fffff8000288c600

    STACK_TEXT: 
    fffff880`07cd1a68 fffff800`0288bb69 : 00000000`00000001 00000000`75072dd9 00000000`00000000 00000000`0000fffe : nt!KeBugCheckEx
    fffff880`07cd1a70 fffff800`0288baa0 : fffffa80`0748a060 00000000`0008e2e8 fffff880`07cd1bc8 00000000`00000000 : nt!KiBugCheckDispatch+0x69
    fffff880`07cd1bb0 00000000`75072dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
    00000000`0008ebf8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75072dd9


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!KiSystemServiceExit+245
    fffff800`0288baa0 4883ec50        sub     rsp,50h

    SYMBOL_STACK_INDEX:  2

    SYMBOL_NAME:  nt!KiSystemServiceExit+245

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

    FAILURE_BUCKET_ID:  X64_0x1_SysCallNum_4_nt!KiSystemServiceExit+245

    BUCKET_ID:  X64_0x1_SysCallNum_4_nt!KiSystemServiceExit+245

    Followup: MachineOwner
    ---------

    That the CinergyDvr.exe crashed may give a good indication the the problem is with the Cinergy stick.

    Also, you should enter a "symbol path" in WinDbg for best results in analyzing dump files:

    Click on WinDbg > File > Symbol File Path  and then paste the following under "Symbol path":

    SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

    then click "OK"

    Then close WinDbg and answer "Yes" to the "Save information for workspace" question.

    Also, are you able to provide the minidump file from the netbook?

     

    • Marked as answer by sentinelvd Sunday, May 09, 2010 10:14 PM
    Sunday, May 09, 2010 11:59 AM
  • well thank you very much. I didn't install any video drivers, it was the windows who found everything alone. I installed the new now...i can't find newer drivers for the Cinergy TV stick, so i will just get rid of it....and i hope i wont get the blue screens again :)

     

    Thank you for the help, i will mark it as answered, and lets cross fingers that we will not meet each other again because ot a BSOD : ))

     

    Thank you guys !

     

    • Marked as answer by sentinelvd Sunday, May 09, 2010 10:14 PM
    Sunday, May 09, 2010 10:14 PM

All replies

  • Upload the dmp files from your Windows\Minidump folder to your Skydrive and post a link here, so that we can look at the dumps. Maybe we see the cause
    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Saturday, May 08, 2010 9:21 PM
  • Hi,

    thank you for the fast response. 

    http://cid-d6fd838d26d0c284.skydrive.live.com/browse.aspx/.Public?uc=1

    There you can find the mini dump of my Win 7 (050810-18252-01) and all the mini dumps from my old XP (mini dump XP 32 bit), may be they can also help.

    cheers

    Saturday, May 08, 2010 10:10 PM
  • APC_INDEX_MISMATCH (1)

    This is a kernel internal error. The most common reason to see this
    bugcheck is when a filesystem or a driver has a mismatched number of
    calls to disable and re-enable APCs. The key data item is the
    Thread->KernelApcDisable field. A negative value indicates that a driver
    has disabled APC calls without re-enabling them.  A positive value indicates
    that the reverse is true.

    Check your HDD for errors (use chkdsk) and update all your drivers (TerraTec Home Cinema - Cinergy_Hybrid-Stick_HID.sys which is very old - Wed Mar 12 10:02:22 2008 ).

    best regards
    André


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Saturday, May 08, 2010 10:37 PM
  • You could infact download the hd utility at it's manufacturer site and run a test on the hd itself, if any error found during the test, high chances the hd is bad

    Saturday, May 08, 2010 11:25 PM
  • Also, which TV-USB Stick do you have. and have you checked for updated drivers for it?

    Also, what display adapter is installed?

    Sunday, May 09, 2010 4:06 AM
  • well the hd is brand new (a month or something like this). I checked it with the Windows tool and with the tool from WD, both times the test was passed.

    here is the report from the WD Tool (i also made a boot check, again ok).

    Test Option: EXTENDED TEST Model Number: WDC WD32 00AAJS-00L7A Unit Serial Number: N/A Firmware Number: 01.0 Capacity: 320.07 GB SMART Status: Not Available Test Result: PASS Test Time: 11:20:41, May 09, 2010

    Sunday, May 09, 2010 9:23 AM
  • yes i have the latest drivers installed. From the web site of the manufacturer (http://www.terratec.net/de/produkte/treiber/produkte_treiber_de_91891.html)

    I have a Cinergy Hybrid Stick by Terratec. There is simply nothing more i can do with the drivers. All other sys drivers are also the latest, i always download them from the manufacturer's web site. 

    What do you mean with display adapter ? if you mean my video card, it  is NVIDIA GeForce 9400 GT 1gb .

    Sunday, May 09, 2010 9:27 AM
  • Hi, thank you very much for the fast report. 

    I checked the HDD twice (boot scan and in windows) with the Windows tool and tool by the HDD manufacturer. Everything was ok. And the HDD is brand new ( a month or something like that).

    I don't know why the Cinergy_Hybrid-Stick_HID.sys is so old, i have the latest drivers from the manufacturer, i installed them again, for just in case.

    Is it possible to have another reaseon ? I mean, if it is the stick i cant make much more than just give it back to the shop. And see if i will still recieve the problems. 

    It is pretty interesting that on my brand new netbook i got the same problem, caused by ntoskrnl.exe , may be after updates or through my wireless network ? (on the netbook i don't have anything else than the Windows 7 32 bit. There wasn't also any phsical contact between the two PCs.

    Thank you / Vielen Dank


    Sunday, May 09, 2010 9:45 AM
  • One thing I would suggest is to update the display adapter drivers to the latest version (uninstall the older drivers first):

    http://www.nvidia.com/object/win7_winvista_64bit_197.45_whql.html

    Also, the process that crashed with the APC_INDEX_MISMATCH error was the CinergyDvr.exe (see bolded):

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1, {75072dd9, 0, fffe, fffff88007cd1ca0}

    Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    APC_INDEX_MISMATCH (1)
    This is a kernel internal error. The most common reason to see this
    bugcheck is when a filesystem or a driver has a mismatched number of
    calls to disable and re-enable APCs. The key data item is the
    Thread->KernelApcDisable field. A negative value indicates that a driver
    has disabled APC calls without re-enabling them.  A positive value indicates
    that the reverse is true. This check is made on exit from a system call.
    Arguments:
    Arg1: 0000000075072dd9, address of system function (system call)
    Arg2: 0000000000000000, Thread->ApcStateIndex << 8 | Previous ApcStateIndex
    Arg3: 000000000000fffe, Thread->KernelApcDisable
    Arg4: fffff88007cd1ca0, Previous KernelApcDisable

    Debugging Details:
    ------------------


    FAULTING_IP:
    +3331613862393864
    00000000`75072dd9 ??              ???

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x1

    PROCESS_NAME:  CinergyDvr.exe

    CURRENT_IRQL:  0

    LAST_CONTROL_TRANSFER:  from fffff8000288bb69 to fffff8000288c600

    STACK_TEXT: 
    fffff880`07cd1a68 fffff800`0288bb69 : 00000000`00000001 00000000`75072dd9 00000000`00000000 00000000`0000fffe : nt!KeBugCheckEx
    fffff880`07cd1a70 fffff800`0288baa0 : fffffa80`0748a060 00000000`0008e2e8 fffff880`07cd1bc8 00000000`00000000 : nt!KiBugCheckDispatch+0x69
    fffff880`07cd1bb0 00000000`75072dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
    00000000`0008ebf8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75072dd9


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!KiSystemServiceExit+245
    fffff800`0288baa0 4883ec50        sub     rsp,50h

    SYMBOL_STACK_INDEX:  2

    SYMBOL_NAME:  nt!KiSystemServiceExit+245

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

    FAILURE_BUCKET_ID:  X64_0x1_SysCallNum_4_nt!KiSystemServiceExit+245

    BUCKET_ID:  X64_0x1_SysCallNum_4_nt!KiSystemServiceExit+245

    Followup: MachineOwner
    ---------

    That the CinergyDvr.exe crashed may give a good indication the the problem is with the Cinergy stick.

    Also, you should enter a "symbol path" in WinDbg for best results in analyzing dump files:

    Click on WinDbg > File > Symbol File Path  and then paste the following under "Symbol path":

    SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

    then click "OK"

    Then close WinDbg and answer "Yes" to the "Save information for workspace" question.

    Also, are you able to provide the minidump file from the netbook?

     

    • Marked as answer by sentinelvd Sunday, May 09, 2010 10:14 PM
    Sunday, May 09, 2010 11:59 AM
  • well thank you very much. I didn't install any video drivers, it was the windows who found everything alone. I installed the new now...i can't find newer drivers for the Cinergy TV stick, so i will just get rid of it....and i hope i wont get the blue screens again :)

     

    Thank you for the help, i will mark it as answered, and lets cross fingers that we will not meet each other again because ot a BSOD : ))

     

    Thank you guys !

     

    • Marked as answer by sentinelvd Sunday, May 09, 2010 10:14 PM
    Sunday, May 09, 2010 10:14 PM