Windows 7: BSOD - Was running fine...

Virtuoso X · 09 Sep 2010

Hello.
I Have posted a thread alittle while ago regarding a BSOD. Was running smoothly for a good few days now, then all of a sudden i received another BSOD actually two, after i restarted from the first, i came to post my BSOD and it restarted again.

Any help is much appreciated

DUMP files attached.

Capt.Jack Sparrow · 09 Sep 2010

Hello and Welcome !!

The Dumps are pointing to Core OS File which would not be the issue. Lets Start with basics.

Run a Hardware Diagnostic (Memory and Hard Drive) follow this link for instructions Hardware Diagnostic !! « Captain Debugger

Uninstall Symantec completely out of the System Download and run the Norton Removal Tool to uninstall your Norton product | Norton Support and install Microsoft Security Essentials

Bugcheck:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa801e9b167a, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8000328cbf7, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034ac0e0
 fffffa801e9b167a 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiPfnShareCountIsZero+77
fffff800`0328cbf7 0fb6511a        movzx   edx,byte ptr [rcx+1Ah]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  chrome.exe

TRAP_FRAME:  fffff8800ac840b0 -- (.trap 0xfffff8800ac840b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000fffffffffffff rbx=0000000000000000 rcx=fffffa801e9b1660
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000328cbf7 rsp=fffff8800ac84240 rbp=0000058000000000
 r8=0000000000a33b22  r9=0000000000000006 r10=fffff8a009e7b700
r11=fffff80003400e00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
nt!MiPfnShareCountIsZero+0x77:
fffff800`0328cbf7 0fb6511a        movzx   edx,byte ptr [rcx+1Ah] ds:fffffa80`1e9b167a=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003273ca9 to fffff80003274740

STACK_TEXT:  
fffff880`0ac83f68 fffff800`03273ca9 : 00000000`0000000a fffffa80`1e9b167a 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0ac83f70 fffff800`03272920 : fffffa80`09d3fc20 fffffa80`0416ea40 00000000`000007ff fffff880`0ac844a0 : nt!KiBugCheckDispatch+0x69
fffff880`0ac840b0 fffff800`0328cbf7 : fffffa80`05f901f0 fffffa80`05eed2f0 fffff6fc`c0164700 fffff800`0337ad89 : nt!KiPageFault+0x260
fffff880`0ac84240 fffff800`0329ebcb : 00000000`000e0000 fffffa80`0416ea40 00000000`00000000 fffff880`0ac84440 : nt!MiPfnShareCountIsZero+0x77
fffff880`0ac842b0 fffff800`0358b1b5 : fffff980`2c900000 fffff8a0`101dc7e0 fffff8a0`00000000 fffff880`00000000 : nt!MmUnmapViewInSystemCache+0x520
fffff880`0ac84590 fffff800`0328d567 : 00000000`000c0000 fffffa80`07f8ede0 00000000`00000000 00000000`00100000 : nt!CcUnmapVacb+0x5d
fffff880`0ac845d0 fffff800`032933b5 : fffff980`00000001 00000000`00100000 fffffa80`0ba33840 00000000`00000001 : nt!CcUnmapVacbArray+0x1b7
fffff880`0ac84660 fffff800`03591922 : 00000000`00100000 00000000`00131000 fffff880`0ac84730 fffff880`0ac847c0 : nt!CcGetVirtualAddress+0x2c5
fffff880`0ac846f0 fffff880`014cbc48 : fffff880`00000000 00000000`00000005 fffffa80`0e7467f0 fffffa80`00001001 : nt!CcCopyRead+0x132
fffff880`0ac847b0 fffff880`011930c8 : fffffa80`0c532f20 fffffa80`0e746788 fffff680`0003cd78 fffffa80`0c532f01 : Ntfs!NtfsCopyReadA+0x1a8
fffff880`0ac84980 fffff880`01196c2a : fffff880`0ac84a50 00000000`07896403 00000000`07896400 fffffa80`0c532f00 : fltmgr!FltpPerformFastIoCall+0x88
fffff880`0ac849e0 fffff880`011b45f0 : fffffa80`0c532f20 00000000`00000000 fffff880`0ac84b40 00000000`00001000 : fltmgr!FltpPassThroughFastIo+0xda
fffff880`0ac84a20 fffff800`03592289 : fffffa80`0c532f20 00000000`00000001 fffffa80`07f3d9f0 fffffa80`0c532f20 : fltmgr!FltpFastIoRead+0x1d0
fffff880`0ac84ac0 fffff800`03273993 : 00000000`000003c8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x417
fffff880`0ac84bb0 00000000`74112dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`037dea68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74112dd9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiPfnShareCountIsZero+77
fffff800`0328cbf7 0fb6511a        movzx   edx,byte ptr [rcx+1Ah]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiPfnShareCountIsZero+77

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiPfnShareCountIsZero+77

BUCKET_ID:  X64_0xA_nt!MiPfnShareCountIsZero+77

Hope this helps,
Captain

Virtuoso X · 09 Sep 2010

When running Check Disk -

CHKDSK is verifying files (stage 1 of 3)...
4 percent complete. (48436 of 121088 file records processed
Deleted corrupt attribute list entry
with type code 128 in file 59704.
Attribute record (128, "") from file record segment 60025
is corrupt.
Attribute record (128, "") from file record segment 60026
is corrupt.
Attribute record (128, "") from file record segment 62826
is corrupt.
Attribute record (128, "") from file record segment 62982
is corrupt.
121088 file records processed.
File verification completed.
File record segment 60025 is an orphan.
File record segment 60026 is an orphan.
File record segment 62826 is an orphan.
File record segment 62982 is an orphan.
238 large file records processed.

Errors found. CHKDSK cannot continue in read-only mode.

will be running memtest86+ and HD diag.

also

Quote:

PROCESS_NAME: chrome.exe

does this mean Chrome was causing the BSOD?

Capt.Jack Sparrow · 09 Sep 2010

Nope ! You got BSOD when you were using Chrome that doesn't mean Chrome has caused it. Regarding the check disk download the utlity i mentioned in the article and run the Diagnostic

Virtuoso X · 10 Sep 2010

Also my main drive C: chkdsk results, will be posting the utility results as soon as they finish.

Checking file system on C:
The type of the file system is NTFS.

One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
The attribute of type 0x80 and instance tag 0x0 in file 0xe938
has allocated length of 0x1e1c000 instead of 0x1bdc000.
Deleted corrupt attribute list entry
with type code 128 in file 59704.
Unable to locate attribute with instance tag 0x0 and segment
reference 0x1a00000000ea79. The expected attribute type is 0x80.
Deleting corrupt attribute record (128, "")
from file record segment 60025.
Unable to locate attribute with instance tag 0x0 and segment
reference 0x1a00000000ea7a. The expected attribute type is 0x80.
Deleting corrupt attribute record (128, "")
from file record segment 60026.
Unable to locate attribute with instance tag 0x0 and segment
reference 0xc900000000f56a. The expected attribute type is 0x80.
Deleting corrupt attribute record (128, "")
from file record segment 62826.
Unable to locate attribute with instance tag 0x0 and segment
reference 0x2d00000000f606. The expected attribute type is 0x80.
Deleting corrupt attribute record (128, "")
from file record segment 62982.
121088 file records processed. File verification completed.
240 large file records processed. 0 bad file records processed. 2 EA records processed. 44 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
166426 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
121088 file SDs/SIDs processed. Cleaning up 63 unused index entries from index $SII of file 0x9.
Cleaning up 63 unused index entries from index $SDH of file 0x9.
Cleaning up 63 unused security descriptors.
Security descriptor verification completed.
Inserting data attribute into file 59704.
22671 data files processed. CHKDSK is verifying Usn Journal...
36063984 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
121072 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
472660277 free clusters processed. Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

1953415167 KB total disk space.
62429796 KB in 95637 files.
61336 KB in 22671 indexes.
0 KB in bad sectors.
282927 KB in use by the system.
65536 KB occupied by the log file.
1890641108 KB available on disk.

4096 bytes in each allocation unit.
488353791 total allocation units on disk.
472660277 allocation units available on disk.

Internal Info:
00 d9 01 00 2d ce 01 00 4e 67 03 00 00 00 00 00 ....-...Ng......
ca 02 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 ....,...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

Virtuoso X · 10 Sep 2010

seems that my OS might be corrupt....i keep getting warnings from malware / norton / windows....BSOD just seems more frequent now... will be doing a fresh install...without RAID0 as i see no use in it as using Sata/IDE is the same speed / if not faster then RAID 0

Windows 7: BSOD - Was running fine...

BSOD - Was running fine... problems?