Multiple BSODs caused by ntkrnlmp.exe in Windows 10

Drew Behrens · 10 May 2017

Hi there,
I have recently bought a new Gigabyte P15f v7 laptop (specs found at P15F v7 | Laptop - GIGABYTE
).
I upgraded it with another 8GB of Kingston DDR4-2400Mhz KVR24S17S8/8 memory and a Samsung 960 EVO 250GB SSD.
I have been having multiple BSODs at mostly random times. Some seemed to occur around the time I would disconnect from my WiFi connection in order to reconnect. I was doing this because I would suddenly loose internet connection on my home WiFi (this wasn't happening on other connected devices). This led me to believe it was a WiFi related issue, however after updating the WiFi drivers (and others like chipset, bluetooth, IDE ATA/ATAPI and graphics etc...) I am still experiencing the BSODs.
I used WinDbg to try find the issue. Most of the time the driver causing the crash is ntkrnlmp.exe and I often get a DPC_WATCHDOG_VIOLATION code on the BSOD screen. I did notice for one dump file in WinDbg that avgntflt.sys caused the crash. After uninstalling Avira antivirus I have not received this problem again, but the ntkrnlmp.exe problems still occur.
I have now used verifier to try identify the problem. I receive a BSOD right after boot before the Windows login screen. WinDbg again identifies ntkrnlmp.exe as the cause. I attach the report you guys ask for in the sticky

Please help! Thanks in advance

philc43 · 12 May 2017

Hi and welcome to TenForums :)

If you take the new memory stick out do you still get the BSOD? I ask because the new one is not a matched pair with the original and this is a known cause of BSOD with many motherboards.

Drew Behrens · 12 May 2017

Hi

Yeah I know they're not perfectly matched. Unfortunately when I got the new 8GB there wasn't the exact same Kingston model around, so I specifically got another module of Kingston with the same latency and speed rating.

When I take it out and run verifier, I still get BSOD on boot just before the login screen. Also tried with only the new stick of RAM in and the same thing happens. Seems its not RAM matching....

philc43 · 12 May 2017

OK, it was important to check that aspect before digging deeper. Thanks for verifying and running the test with both new and old sticks of RAM. At the moment I'm not able to find anything else that will help.

Drew Behrens · 12 May 2017

Dam....
Thanks for your help. Really hope you or someone else can find something

Ztruker · 13 May 2017

The latest (5/9 3:23PM) dump indicates a problem with MBAMChameleon.sys.

Code:

ffffad01`975a3078  fffff80f`c959c671Unable to load image MBAMChameleon.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for MBAMChameleon.sys
*** ERROR: Module load completed but symbols could not be loaded for MBAMChameleon.sys
 MBAMChameleon+0xc671

Driver Description: Malwarebytes Chameleon Protection Driver
Driver Update Site: https://www.malwarebytes.org/chameleon/

Uninstall Malwarebytes Chameleon and see if that resolves your problem. If it does, you can see if the 3.1.33.0 version makes any difference. If not, leave it uninstalled.

Drew Behrens · 14 May 2017

Thanks for the response.

Interestingly, Malwarebytes didn't appear in the installed programs list. This made me think something was a bit weird with the installation and it therefore could be causing the issues. I removed it by running the uninstall exe manually, followed by a run of CCleaner.

I ran verifier which then resulted in BSODs on startup again. Seems it wasn't the problem, unless there are still malwarebytes drivers hanging arund somehow from an incomplete uninstall? I attach my latest dump, hopefully it will help.

Ztruker · 14 May 2017

That dump shows a problem with Malwarebytes anti-malware mbae64.sys.

Code:

BugCheck C4, {2006, ffffd4036ea32a28, fffff803921b01b0, ffffb001a83c9638}
Unable to load image mbae64.sys, Win32 error 0n2
*** ERROR: Module load completed but symbols could not be loaded for mbae64.sys

Code:

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000002006, subclass of driver violation.
Arg2: ffffd4036ea32a28
Arg3: fffff803921b01b0
Arg4: ffffb001a83c9638

If Malwarebytes is installed, uninstall it for now: MBAM Clean Removal Process

Drew Behrens · 15 May 2017

Thanks for that analysis.

Seems it was the problem and if I just used BlueScreenView instead of WinDbg I would have seen it as well!!
Anyway, I had some trouble removing Malwarebytes completely. Turns out there's a newer version of the removal tool that did the trick including removing mbae64.sys.

After running verifier again MBfilt64.sys was causing crashes! Another Malwarebytes driver that wasn't removed. I manually removed it in safe mode from C:\Windows\System32\drivers. Verifier then didn't crash before start-up as usual. Seemed the problem was fixed. However about 15 seconds after logging in it would crash. What's weird is that no dump files have been saved for the 3 or 4 times I did this.

Any suggestions?

javadth1 · 15 May 2017

hi when you remove the new added ram problem exist again ?