Random BSOD reboots - linked to ntoskrnl.exe maybe?

Hello

Since I purchased the components for my current PC over 18 months ago, I've usually had some kind of BSOD rebooting problem. Sometimes it's more frequent than others.

However, I recently grew tired of the problem and thought a disk format and re-install of windows XP SP2 would help. And it did! The PC was then infected by a rootkit virus, which I believe I managed to remove and I've since posted on these forums to check if it's clean (it is). But since getting the rootkit, the BSOD rebooting issues has resurfaced again, although this could be pure coincidence.

Prior to re-installing windows XP, I installed 'NirSoft BlueScreenView' so I could see the contents of the blue screen and ntoskrnl.exe always seemed to be present. I've noticed that this is the same once again.

Can anyone suggest what may be wrong?

Ntoskrnl.exe is a key Windows component and is often cited as the scene of the crime (IMO), rather than as the criminal.

http://en.wikipedia.org/wiki/Ntoskrnl.exe

In BlueScreenView...

Edit/Select All...then File/Save Selected Items.

Save the report as BSOD.txt.

Open BSOD.txt in Notepad, copy all content and paste it into your next reply.

Louis

Edited by hamluis, 15 July 2010 - 10:32 AM.

As requested...

==================================================
Dump File : Mini071410-05.dmp
Crash Time : 14/07/2010 20:44:26
Bug Check String : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code : 0x10000050
Parameter 1 : 0xc289c8b0
Parameter 2 : 0x00000000
Parameter 3 : 0x8050504f
Parameter 4 : 0x00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+2e04f
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini071410-05.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini071410-04.dmp
Crash Time : 14/07/2010 18:09:01
Bug Check String : DRIVER_IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x100000d1
Parameter 1 : 0x00007e89
Parameter 2 : 0x0000001c
Parameter 3 : 0x00000000
Parameter 4 : 0x88502b19
Caused By Driver :
Caused By Address :
File Description :
Product Name :
Company :
File Version :
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini071410-04.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini071410-03.dmp
Crash Time : 14/07/2010 17:37:33
Bug Check String : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000008e
Parameter 1 : 0xc0000005
Parameter 2 : 0x8054a0ba
Parameter 3 : 0xb8da8b04
Parameter 4 : 0x00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+730ba
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini071410-03.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini071410-02.dmp
Crash Time : 14/07/2010 17:19:12
Bug Check String : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000008e
Parameter 1 : 0xc0000005
Parameter 2 : 0xbf8082c6
Parameter 3 : 0xa8e6ab24
Parameter 4 : 0x00000000
Caused By Driver : win32k.sys
Caused By Address : win32k.sys+82c6
File Description : Multi-User Win32 Driver
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini071410-02.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini071410-01.dmp
Crash Time : 14/07/2010 17:09:57
Bug Check String : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code : 0x10000050
Parameter 1 : 0xea965410
Parameter 2 : 0x00000001
Parameter 3 : 0x8054a168
Parameter 4 : 0x00000002
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+73168
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini071410-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini071310-03.dmp
Crash Time : 13/07/2010 19:33:55
Bug Check String : MEMORY_MANAGEMENT
Bug Check Code : 0x0000001a
Parameter 1 : 0x00041284
Parameter 2 : 0x0d59a001
Parameter 3 : 0x00017f3a
Parameter 4 : 0xc0883000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+22c37
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini071310-03.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini071310-02.dmp
Crash Time : 13/07/2010 19:31:26
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x1000000a
Parameter 1 : 0x0003178c
Parameter 2 : 0x00000002
Parameter 3 : 0x00000001
Parameter 4 : 0x8051b0b4
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+440b4
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini071310-02.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini071310-01.dmp
Crash Time : 13/07/2010 19:28:26
Bug Check String : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code : 0x10000050
Parameter 1 : 0xeb2f9000
Parameter 2 : 0x00000000
Parameter 3 : 0xbf8e8044
Parameter 4 : 0x00000002
Caused By Driver : win32k.sys
Caused By Address : win32k.sys+e8044
File Description : Multi-User Win32 Driver
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini071310-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini071010-02.dmp
Crash Time : 10/07/2010 08:54:47
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x1000000a
Parameter 1 : 0xc00f1ae8
Parameter 2 : 0x00000002
Parameter 3 : 0x00000000
Parameter 4 : 0x80510a6a
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+39a6a
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini071010-02.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini071010-01.dmp
Crash Time : 10/07/2010 08:45:18
Bug Check String : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code : 0x10000050
Parameter 1 : 0xd5086008
Parameter 2 : 0x00000000
Parameter 3 : 0x80504a2a
Parameter 4 : 0x00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+2da2a
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini071010-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini070510-01.dmp
Crash Time : 05/07/2010 07:22:19
Bug Check String : DRIVER_IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x100000d1
Parameter 1 : 0x001531a2
Parameter 2 : 0x00000002
Parameter 3 : 0x00000008
Parameter 4 : 0x001531a2
Caused By Driver : USBPORT.SYS
Caused By Address : USBPORT.SYS+56c7
File Description : USB 1.1 & 2.0 Port Driver
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini070510-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini062010-01.dmp
Crash Time : 20/06/2010 21:44:50
Bug Check String : NTFS_FILE_SYSTEM
Bug Check Code : 0x00000024
Parameter 1 : 0x000708e1
Parameter 2 : 0x0000004f
Parameter 3 : 0x00000000
Parameter 4 : 0x00000000
Caused By Driver : Ntfs.sys
Caused By Address : Ntfs.sys+52efe
File Description : NT File System Driver
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini062010-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

Well...your 20 Jun error points to a problem with either the NTFS file system, your hard drive, or the file ntfs.sys.

If you have had these problems from the beginning...my vote would go to the hard drive itself.

I would start by running the appropriate hard drive manufacturer's diagnostic (long test, not short) on that drive.

Bootable Hard Drive Diagnostics - Vox - http://usasma.vox.com/library/post/bootabl...iagnostics.html

Hard Drive Installation and Diagnostic Tools - http://www.bleepingcomputer.com/forums/t/28744/hard-drive-installation-and-diagnostic-tools/

Louis

Ok - ran the diagnostic, came back fine.

But if anything, it's rebooting more often for some reason, possibly more than ever before.

Is there a memory test I can perform? I've had a grudge that it's that for a while now, but I don't know how to prove it.

ps. BlueScreenView always seems to highlight hal.dll as being somewhere involved near the crash, but not sure if that's of use?

Memtest86+ - Advanced Memory Diagnostic Tool - http://www.memtest.org/#downiso

Icrontic » Diagnose with Memtest86+ - http://icrontic.com/articles/diagnose_with_memtest86

How to successfully burn or write an ISO-image to cd or dvd - http://iso.snoekonline.com/iso.htm

Louis