BSOD, can not do a restore!

Yankie007 · 02 Oct 2010

Hi,
Recently, I was playing with my desktop gadgets and downloading new stuff and Bang, BSOD. I tried to do a system restore because the desktop gadgets don't appear anymore ands I can't open it from control pannel. I did a system restore and I got another BSOD and now it tells me this:

System restore did not complete successfully

It could not access the file due to anti-virus, try disable it. (I disabled my anti-virus to restore it but it failed again with the same message)

Error occur: 0x80070005

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7600.2.0.0.768.3
Locale ID: 1033

Additional information about the problem:
BCCode: 50
BCP1: FFFFFA80189A7F16
BCP2: 0000000000000000
BCP3: FFFFF880071B0AA6
BCP4: 0000000000000002
OS Version: 6_1_7600
Service Pack: 0_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\100210-32417-01.dmp
C:\Windows\Temp\WER-37206-0.sysdata.xml

Read our privacy statement online:
http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

Can you please help me with this problem, because I really don't know what to do?
Thanks,
Yannik

Here is my Computer Specs:

Windows Version:
Windows 7 Home Premium

System type:
64-Bit Operating system

Processor version:
Intel ® Core (TM) i7 CPU 930 @ 2.80GHz 2.79GHz

Installed Memory (RAM):
6GB

Hard Drive Capacity:
1Tb

Video Card:
Graphics card manufacturer: ATI
Graphics Chipset: Radeon HD 5700 Series
Dedicated graphics memory: 1024 MB

Sound Card:
Manufacturer: Creative Sb-X-Fi
Version 1.10.13
DirectX Version: 10.0

Motherboard:
Manufacturer: Gigabyte
Model type: X58A-UD3R

lorddenis · 02 Oct 2010

please folow this posting instructions:

https://www.sevenforums.com/crashes-d...tructions.html

Yankie007 · 02 Oct 2010

Hi,
I've looked at the instruction, but at the third steps, I'm supposed to Run a System Health Report - by clicking START | type perfmon /report. Where do I type this ? Do I type this under search programs or in the "run" section?

CarlTR6 · 02 Oct 2010

Yankie007 said:

Hi,
I've looked at the instruction, but at the third steps, I'm supposed to Run a System Health Report - by clicking START | type perfmon /report. Where do I type this ? Do I type this under search programs or in the "run" section?

Click on the start orb at the bottom left of your screen. Type perfmon /report in the search box at the bottom. Click on perfmon /report at the top of the box.

DeanP · 02 Oct 2010

Hi, Recently, I was playing with my desktop gadgets and downloading new stuff and Bang, BSOD.

Consider un-installing the new stuff? That might be your problem.
If you cannot do this in Windows Mode - try it in Safe Mode.

Hopalong X · 02 Oct 2010

Yankie007

Glad to see you made it over here from the other section.
They will take good care of you.

Everyone be gentle with the junior member.

Mike

Yankie007 · 02 Oct 2010

Hi,
I did the test with the software and save the file in html. I didn't understand how to Zip up the entire Windows_NT6_BSOD_jcgriff2 folder & the PERFMON HTML file and attach the zip file to the post. I try just send the html file as an attachment but it doen't work. Do you have an idea?

lorddenis · 02 Oct 2010

select both the file and the html and right click "add to archive" that shuld rar them. and then you just upload it .

Yankie007 · 02 Oct 2010

my bsod file.zip
Hi,
Recently, I was playing with my desktop gadgets and downloading new stuff and Bang, BSOD. I tried to do a system restore because the desktop gadgets don't appear anymore ands I can't open it from control pannel. I did a system restore and I got another BSOD and now it tells me this:

System restore did not complete successfully

It could not access the file due to anti-virus, try disable it. (I disabled my anti-virus to restore it but it failed again with the same message)

Error occur: 0x80070005

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7600.2.0.0.768.3
Locale ID: 1033

Additional information about the problem:
BCCode: 50
BCP1: FFFFFA80189A7F16
BCP2: 0000000000000000
BCP3: FFFFF880071B0AA6
BCP4: 0000000000000002
OS Version: 6_1_7600
Service Pack: 0_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\100210-32417-01.dmp
C:\Windows\Temp\WER-37206-0.sysdata.xml

Read our privacy statement online:
http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

Can you please help me with this problem, because I really don't know what to do?
Thanks,
Yannik

Here is my Computer Specs:

Windows Version:
Windows 7 Home Premium

System type:
64-Bit Operating system

Processor version:
Intel ® Core (TM) i7 CPU 930 @ 2.80GHz 2.79GHz

Installed Memory (RAM):
6GB

Hard Drive Capacity:
1Tb

Video Card:
Graphics card manufacturer: ATI
Graphics Chipset: Radeon HD 5700 Series
Dedicated graphics memory: 1024 MB

Sound Card:
Manufacturer: Creative Sb-X-Fi
Version 1.10.13
DirectX Version: 10.0

Motherboard:
Manufacturer: Gigabyte
Model type: X58A-UD3R

CarlTR6 · 02 Oct 2010

I will take a look. You have a handful of BSOD's. I looked at your five most recent BSOD's.

Error code 50 (3 times), PAGE_FAULT_IN_NONPAGED_AREA - usual causes are Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS.

Error code 4E, PFN_LIST_CORRUPT - Device driver, ?memory

Three dumps blame APPFLT64.SYS, which is a Panda driver. The other two blame corrupted memory. Notice in usual causes of error code 50 that antivirus is listed. I suggest that uninstall Panda using this uninstall tool: Info > Tool. Third party antivirus programs are a known cause of BSOD's on some Win 7 systems. Download and install Microsoft Security Essentials in its place.

You have a number of older drivers on your system and some are very obsolete. Older drivers can and do cause memory corruption with Win 7.

CT20XUT.SYS Mon Dec 29 09:03:00 2008 -
ctac32k.sys Wed Jul 02 04:38:22 2008 -
ctaud2k.sys Mon Dec 29 09:01:47 2008 -
CTEXFIFX.SYS Mon Dec 29 09:02:55 2008 -
CTHWIUT.SYS Mon Dec 29 09:03:03 2008 -
ctoss2k.sys Mon Dec 29 08:59:50 2008 -
ctprxy2k.sys Mon Dec 29 09:01:50 2008 -
ctsfm2k.sys Mon Dec 29 08:59:37 2008 -
emupia2k.sys Mon Dec 29 08:59:30 2008 -
ha20x2k.sys Mon Dec 29 09:01:12 2008 -
MarvinBus64.sys Fri Sep 23 17:17:03 2005 -
NETTDI64.SYS Tue Jun 16 06:54:59 2009 -
pavboot64.sys Mon Jun 29 07:50:23 2009 -
ShldFlt.sys Thu Feb 28 07:22:30 2008 -

Update these drivers or uninstall the hardware/software they are associated with.

- I have listed links to most of the drivers in the code box below. Please use the links there to see what info I've found about those drivers.
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

Code:

Kernel base = 0xfffff800`02e54000 PsLoadedModuleList = 0xfffff800`03091e50
Debug session time: Thu Sep 30 18:15:10.373 2010 (GMT-4)
System Uptime: 0 days 0:00:41.513
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa804589042f, 0, fffff880091c1aa6, 5}

Unable to load image \??\C:\Windows\system32\Drivers\APPFLT64.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for APPFLT64.SYS
*** ERROR: Module load completed but symbols could not be loaded for APPFLT64.SYS

Could not read faulting driver name
Probably caused by : APPFLT64.SYS ( APPFLT64+daa6 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa804589042f, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff880091c1aa6, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030fc0e0
 fffffa804589042f 

FAULTING_IP: 
APPFLT64+daa6
fffff880`091c1aa6 833b00          cmp     dword ptr [rbx],0

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88003377720 -- (.trap 0xfffff88003377720)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000b0cdb0cd rbx=0000000000000000 rcx=fffffa800a3f1801
rdx=fffffa800a3e6801 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880091c1aa6 rsp=fffff880033778b0 rbp=0000000000000001
 r8=fffffa800a3e6800  r9=fffffa8005207248 r10=fffff880091ceac0
r11=000000003aef3aef r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
APPFLT64+0xdaa6:
fffff880`091c1aa6 833b00          cmp     dword ptr [rbx],0 ds:00000000`00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002f438c1 to fffff80002ec4740

STACK_TEXT:  
fffff880`033775b8 fffff800`02f438c1 : 00000000`00000050 fffffa80`4589042f 00000000`00000000 fffff880`03377720 : nt!KeBugCheckEx
fffff880`033775c0 fffff800`02ec282e : 00000000`00000000 fffffa80`4589042f 00000000`00000000 fffffa80`526c5054 : nt! ?? ::FNODOBFM::`string'+0x40e8b
fffff880`03377720 fffff880`091c1aa6 : fffffa80`0a99c940 00000000`00000001 00000000`00000000 fffffa80`07093060 : nt!KiPageFault+0x16e
fffff880`033778b0 fffffa80`0a99c940 : 00000000`00000001 00000000`00000000 fffffa80`07093060 00000000`00000000 : APPFLT64+0xdaa6
fffff880`033778b8 00000000`00000001 : 00000000`00000000 fffffa80`07093060 00000000`00000000 fffff880`091c7f28 : 0xfffffa80`0a99c940
fffff880`033778c0 00000000`00000000 : fffffa80`07093060 00000000`00000000 fffff880`091c7f28 00000000`0000ca10 : 0x1


STACK_COMMAND:  kb

FOLLOWUP_IP: 
APPFLT64+daa6
fffff880`091c1aa6 833b00          cmp     dword ptr [rbx],0

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  APPFLT64+daa6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: APPFLT64

IMAGE_NAME:  APPFLT64.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4ac3c620

FAILURE_BUCKET_ID:  X64_0x50_APPFLT64+daa6

BUCKET_ID:  X64_0x50_APPFLT64+daa6

Followup: MachineOwner
---------

Kernel base = 0xfffff800`02e49000 PsLoadedModuleList = 0xfffff800`03086e50
Debug session time: Thu Sep 30 18:13:32.595 2010 (GMT-4)
System Uptime: 0 days 6:56:46.734
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, dc4c, 2, dc4b}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000000dc4c, page frame number
Arg3: 0000000000000002, current page state
Arg4: 000000000000dc4b, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  CAPTUR~3.EXE

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002f4938c to fffff80002eb9740

STACK_TEXT:  
fffff880`0d4431a8 fffff800`02f4938c : 00000000`0000004e 00000000`00000099 00000000`0000dc4c 00000000`00000002 : nt!KeBugCheckEx
fffff880`0d4431b0 fffff800`02f164d2 : fffffa80`031834e0 00000000`00000001 00000000`00000000 fffff800`030705a8 : nt!MiBadShareCount+0x4c
fffff880`0d4431f0 fffff800`02f7a29d : fffffa80`031834e0 fffff880`0d443340 00000000`00000080 00000000`000caca7 : nt! ?? ::FNODOBFM::`string'+0x11aa2
fffff880`0d443250 fffff800`02e6e40e : 00000000`00000000 fffff880`0d443340 ffffffff`ffffffff 00000000`00000530 : nt!MiRemoveLowestPriorityStandbyPage+0x2ad
fffff880`0d4432d0 fffff800`02ee56ce : fffff980`233ea000 00000000`0b05c160 fffff880`00000000 00000000`00001000 : nt! ?? ::FNODOBFM::`string'+0x44ef3
fffff880`0d4434c0 fffff800`02ee5434 : fffffa80`0745f010 00000000`0b05c160 fffff880`0d443600 00000000`00000000 : nt!CcMapAndCopyInToCache+0x20e
fffff880`0d4435b0 fffff880`012a8fb8 : 00000000`0b62d670 fffffa80`0ad31f00 fffff880`0d4436a0 fffffa80`00004970 : nt!CcCopyWrite+0x194
fffff880`0d443640 fffff880`01167132 : fffffa80`0ad31f20 fffff880`0116a732 fffffa80`00004970 00000000`00004901 : Ntfs!NtfsCopyWriteA+0x208
fffff880`0d443830 fffff880`0116ac2a : fffff880`0d443900 fffffa80`0b934d78 00000000`0b05ae00 00000000`00004900 : fltmgr!FltpPerformFastIoCall+0xf2
fffff880`0d443890 fffff880`011887fe : 00000000`00004970 00000000`00000000 fffffa80`0ad31f20 fffffa80`057080d8 : fltmgr!FltpPassThroughFastIo+0xda
fffff880`0d4438d0 fffff880`01167132 : 00000000`00000000 fffff880`0116a732 22549769`c86c5512 fffffa80`0ad31f20 : fltmgr!FltpFastIoWrite+0x1ce
fffff880`0d443970 fffff880`0116ac2a : fffff880`0d443a40 fffffa80`057080d8 00000000`0b05ae00 00000000`00004900 : fltmgr!FltpPerformFastIoCall+0xf2
fffff880`0d4439d0 fffff880`011887fe : 00000000`00004970 00000000`00000000 fffffa80`0ad31f20 fffff880`0d443b40 : fltmgr!FltpPassThroughFastIo+0xda
fffff880`0d443a10 fffff800`031d080e : fffffa80`0ad31f94 fffff880`0d443ad8 00000000`00000000 fffffa80`0ad31f94 : fltmgr!FltpFastIoWrite+0x1ce
fffff880`0d443ab0 fffff800`02eb8993 : 00000000`00000901 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x5ad
fffff880`0d443bb0 00000000`755a2dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0aeaf0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x755a2dd9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`02f4938c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

I will give you help with the drivers.