Random BSOD. Reports attached

Akira181 · 16 Jan 2011

I uninstalled Daemon Tools and ran the Duplex Secure, but I think I hit install instead of uninstall. Updated all the drivers and removed the sptd.sys.

The 4th BSOD came while I was trying to upload the reports to here. Haven't ran the reports again, I think the BSOD mentioned something about drivers.

I'm struggling with the chkdsk part though. I have 4 hard drives in this system, when I follow the command prompt instructions, it only runs the chkdsk on my C: (which is a partition on one of the drives)

CarlTR6 · 16 Jan 2011

Try adding the volume to the chkdsk command: chkdsk c: /r /f where "c" is whatever drive you wish to check.

Akira181 · 17 Jan 2011

Things have gotten worse if that's even possible. I've never had a system bluescreen so much, including Windows ME. Starting to think I have got buggy RAM or something.

Attached another report and some of the CHKDSK log files. BSOD twice when I tried to run them.

C:

Code:

Chkdsk was executed in read-only mode on a volume snapshot.

Checking file system on C:
The type of the file system is NTFS.
Volume label is Boot Disk.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
144640 file records processed. File verification completed.
138 large file records processed. 0 bad file records processed. 2 EA records processed. 104 reparse records processed. CHKDSK is verifying indexes (stage 2 of 3)...
209984 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 3)...
144640 file SDs/SIDs processed. Cleaning up 342 unused index entries from index $SII of file 0x9.
Cleaning up 342 unused index entries from index $SDH of file 0x9.
Cleaning up 342 unused security descriptors.
Security descriptor verification completed.
32673 data files processed. CHKDSK is verifying Usn Journal...
36029256 USN bytes processed. Usn Journal verification completed.
Windows has checked the file system and found no problems.

83843203 KB total disk space.
37010812 KB in 111514 files.
81728 KB in 32674 indexes.
0 KB in bad sectors.
248763 KB in use by the system.
65536 KB occupied by the log file.
46501900 KB available on disk.

4096 bytes in each allocation unit.
20960800 total allocation units on disk.

2 logfiles for C: for some reason. Only remember running it once.

Code:

Chkdsk was executed in read-only mode on a volume snapshot.

Checking file system on C:
The type of the file system is NTFS.
Volume label is Boot Disk.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
144640 file records processed. File verification completed.
145 large file records processed. 0 bad file records processed. 2 EA records processed. 104 reparse records processed. CHKDSK is verifying indexes (stage 2 of 3)...
209944 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 3)...
144640 file SDs/SIDs processed. Cleaning up 328 unused index entries from index $SII of file 0x9.
Cleaning up 328 unused index entries from index $SDH of file 0x9.
Cleaning up 328 unused security descriptors.
Security descriptor verification completed.
32653 data files processed. CHKDSK is verifying Usn Journal...
37077856 USN bytes processed. Usn Journal verification completed.
Windows has checked the file system and found no problems.

83843203 KB total disk space.
37001652 KB in 111416 files.
81664 KB in 32654 indexes.
0 KB in bad sectors.
250039 KB in use by the system.
65536 KB occupied by the log file.
46509848 KB available on disk.

4096 bytes in each allocation unit.
20960800 total allocation units on disk.
11627462 allocation units available on disk.

D: (hard disk was formatted before the build and is still empty)

Code:

Chkdsk was executed in read/write mode.

Checking file system on D:
Volume dismounted. All opened handles to this volume are now invalid.
Volume label is busted.

CHKDSK is verifying files (stage 1 of 3)...
256 file records processed. File verification completed.
3 large file records processed. 0 bad file records processed. 0 EA records processed. 0 reparse records processed. CHKDSK is verifying indexes (stage 2 of 3)...
280 index entries processed. Index verification completed.


CHKDSK is verifying security descriptors (stage 3 of 3)...
256 file SDs/SIDs processed. Cleaning up 4 unused index entries from index $SII of file 0x9.
Cleaning up 4 unused index entries from index $SDH of file 0x9.
Cleaning up 4 unused security descriptors.
Security descriptor verification completed.
12 data files processed. Windows has checked the file system and found no problems.

244196000 KB total disk space.
21588 KB in 8 files.
16 KB in 14 indexes.
73660 KB in use by the system.
65536 KB occupied by the log file.
244099868 KB available on disk.

4096 bytes in each allocation unit.
61049000 total allocation units on disk.
61024967 allocation units available on disk.

E: (C: partition is on this disk. E: partition itself is also empty)

Code:

Chkdsk was executed in read/write mode.

Checking file system on E:
The type of the file system is NTFS.
Volume label is New Volume.

CHKDSK is verifying files (stage 1 of 5)...
256 file records processed. File verification completed.
0 large file records processed. 0 bad file records processed. 0 EA records processed. 0 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
280 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
256 file SDs/SIDs processed. Cleaning up 5 unused index entries from index $SII of file 0x9.
Cleaning up 5 unused index entries from index $SDH of file 0x9.
Cleaning up 5 unused security descriptors.
Security descriptor verification completed.
12 data files processed. CHKDSK is verifying file data (stage 4 of 5)...
240 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
40065023 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.

160352797 KB total disk space.
21588 KB in 8 files.
16 KB in 14 indexes.
0 KB in bad sectors.
71097 KB in use by the system.
65536 KB occupied by the log file.
160260096 KB available on disk.

4096 bytes in each allocation unit.
40088199 total allocation units on disk.
40065024 allocation units available on disk.

F: (pretty much full)

Code:

Chkdsk was executed in read/write mode.  

Checking file system on F:
The type of the file system is NTFS.
Volume label is Anime.

CHKDSK is verifying files (stage 1 of 5)...
  21504 file records processed.                                          File verification completed.
  7 large file records processed.                                      0 bad file records processed.                                        0 EA records processed.                                              0 reparse records processed.                                       CHKDSK is verifying indexes (stage 2 of 5)...
  29044 index entries processed.                                         Index verification completed.
  0 unindexed files scanned.                                           0 unindexed files recovered.                                       CHKDSK is verifying security descriptors (stage 3 of 5)...
  21504 file SDs/SIDs processed.                                         Security descriptor verification completed.
  3771 data files processed.                                            CHKDSK is verifying Usn Journal...
  6649392 USN bytes processed.                                             Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
  21488 files processed.                                                 File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
  203430 free clusters processed.                                         Free space verification is complete.
Windows has checked the file system and found no problems.

 244198552 KB total disk space.
 243272212 KB in 17462 files.
     11044 KB in 3772 indexes.
         0 KB in bad sectors.
    101576 KB in use by the system.
     65536 KB occupied by the log file.
    813720 KB available on disk.

      4096 bytes in each allocation unit.
  61049638 total allocation units on disk.
    203430 allocation units available on disk.

CarlTR6 · 17 Jan 2011

The file system looks fine. CheckDisk did some cleaning up. Can you boot and run in the Safe mode without BSOD's?

One of your dumps contains no data. Of the other two latest dumps, one blames your NTFS file system; the other blames hardware. All of your drivers look up to date. Let's start checking hardware. Test your RAM with Memtest86 following the instructions in this tutorial: RAM - Test with Memtest86+. Run Memtest from a cold boot after your computer has been off for an hour or two. Let it run for a minimum of 7 passes. This will take 6-8 hours. If you see any errors, you can stop the test. Post back with your results.

Code:

Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c1b000 PsLoadedModuleList = 0xfffff800`02e58e50
Debug session time: Mon Jan 17 14:49:18.567 2011 (GMT-5)
System Uptime: 0 days 0:00:27.190
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002f67f0c, fffff8800249c770, 0}

Probably caused by : hardware ( nt!CmpKcbCacheLookup+99c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002f67f0c, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800249c770, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!CmpKcbCacheLookup+99c
fffff800`02f67f0c 8e01            mov     es,word ptr [rcx]

CONTEXT:  fffff8800249c770 -- (.cxr 0xfffff8800249c770)
rax=0000000000000001 rbx=0000000000000000 rcx=fffff80002e90f3f
rdx=fffff8a0012058f8 rsi=fffffa8005af2690 rdi=fffff8a001205850
rip=fffff80002f67f0c rsp=fffff8800249d140 rbp=fffff8a000009a01
 r8=0000000000000000  r9=000000000000fffe r10=0000000000000000
r11=fffff8800249d2f0 r12=fffff8a001205820 r13=0000000000000001
r14=fffff8a0000224a8 r15=fffff8a0000224a8
iopl=0         ov up ei pl zr na po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010a47
nt!CmpKcbCacheLookup+0x99c:
fffff800`02f67f0c 8e01            mov     es,word ptr [rcx] ds:002b:fffff800`02e90f3f=????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  LogonUI.exe

CURRENT_IRQL:  0

MISALIGNED_IP: 
nt!CmpKcbCacheLookup+99c
fffff800`02f67f0c 8e01            mov     es,word ptr [rcx]

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002f67f0c

STACK_TEXT:  
fffff880`0249d140 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!CmpKcbCacheLookup+0x99c


FOLLOWUP_IP: 
nt!CmpKcbCacheLookup+99c
fffff800`02f67f0c 8e01            mov     es,word ptr [rcx]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!CmpKcbCacheLookup+99c

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  .cxr 0xfffff8800249c770 ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED

BUCKET_ID:  X64_IP_MISALIGNED

Followup: MachineOwner
---------

Debug session time: Sun Jan 16 20:16:31.101 2011 (GMT-5)
System Uptime: 0 days 1:44:26.725
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88003138878, fffff880031380e0, fffff88001347063}

Probably caused by : Ntfs.sys ( Ntfs!NtfsPerformVerify+23 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88003138878
Arg3: fffff880031380e0
Arg4: fffff88001347063

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88003138878 -- (.exr 0xfffff88003138878)
ExceptionAddress: fffff88001347063 (Ntfs!NtfsPerformVerify+0x0000000000000023)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 00000000000000b8
Attempt to read from address 00000000000000b8

CONTEXT:  fffff880031380e0 -- (.cxr 0xfffff880031380e0)
rax=fffff88003138ae8 rbx=0000000000000000 rcx=fffffa8003c710d0
rdx=0000000000000000 rsi=0000000000000000 rdi=fffffa8003c710d0
rip=fffff88001347063 rsp=fffff88003138ab0 rbp=fffff80002e285a0
 r8=00000000ffffffff  r9=fffff88003138dd8 r10=0000000000000005
r11=fffff88001295018 r12=fffff88001295000 r13=0000000000000000
r14=fffff88003138c48 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
Ntfs!NtfsPerformVerify+0x23:
fffff880`01347063 488b8ab8000000  mov     rcx,qword ptr [rdx+0B8h] ds:002b:00000000`000000b8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  00000000000000b8

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ebb0e0
 00000000000000b8 

FOLLOWUP_IP: 
Ntfs!NtfsPerformVerify+23
fffff880`01347063 488b8ab8000000  mov     rcx,qword ptr [rdx+0B8h]

FAULTING_IP: 
Ntfs!NtfsPerformVerify+23
fffff880`01347063 488b8ab8000000  mov     rcx,qword ptr [rdx+0B8h]

BUGCHECK_STR:  0x24

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from fffff8800123e4e6 to fffff88001347063

STACK_TEXT:  
fffff880`03138ab0 fffff880`0123e4e6 : 00000000`00000000 fffff800`02e285a0 00000000`00000000 fffffa80`03c710d0 : Ntfs!NtfsPerformVerify+0x23
fffff880`03138af0 fffff880`012bb358 : fffffa80`03c710d0 00000000`00000000 00000000`00000000 fffff800`02c8e2a1 : Ntfs! ?? ::FNODOBFM::`string'+0x90c0
fffff880`03138be0 fffff800`02c90961 : 00000000`00000000 fffff880`012bb200 fffff800`02e28500 00000000`00000002 : Ntfs!NtfsFspClose+0x128
fffff880`03138cb0 fffff800`02f27c06 : 00000000`00000000 fffffa80`039e7b60 00000000`00000080 fffffa80`039cc040 : nt!ExpWorkerThread+0x111
fffff880`03138d40 fffff800`02c61c26 : fffff880`02f63180 fffffa80`039e7b60 fffff880`02f6df80 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03138d80 00000000`00000000 : fffff880`03139000 fffff880`03133000 fffff880`031389f0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsPerformVerify+23

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

STACK_COMMAND:  .cxr 0xfffff880031380e0 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsPerformVerify+23

BUCKET_ID:  X64_0x24_Ntfs!NtfsPerformVerify+23

Followup: MachineOwner
---------

Akira181 · 18 Jan 2011

I had one BSOD when windows was starting up. It was the windows loading splash screen then the bsod came up with system error or something. First time that's happened so I assume that one is the empty dump.

Never did try the safe mode thing. I'll give it a try tonight when I get home from work.

CarlTR6 · 18 Jan 2011

That would explain the empty dmp file.

Akira181 · 18 Jan 2011

well, 8 minutes in and 35% into pass 1, 3 errors. Will do the troubleshooting tomorrow, gotta get some sleep before work

With all the bluescreens I was getting and the positive hype on Windows 7, I'm not surprised with the memtest result. I just hope it's the RAM and not the motherboard that's broken (both are still covered under warranty). This computer has taken so long to get working, I just don't have the will to take it apart anymore.

Thanks for the help though, it's definitely been appreciated! I will post the results of the troubleshooting tomorrow.

*edit
Just remembered that I cannot remove the stick of RAM in the first slot without removing the heatskink first. Talk about demotivating. Maybe time to throw it out and buy a Mac... okay, won't go that far. I'll never buy a Mac in a sound state of mind.

Akira181 · 19 Jan 2011

Okay. Still running MemTest but summary of results so far

The RAM I have is: Corsair DDR3 PC3-12800 (1600) CAS 9-9-9-24 RAM 2x 2GB 1.65V

Stick 1 - Slot 1 - all settings on AUTO (1333 and 9-9-9-24) - No Errors
Stick 1 - Slot 2 - all settings on AUTO (1333 and 9-9-9-24) - No Errors
Stick 1 - Slot 2 - dram increased from 1.5V to 1.64V. Memory clock increased to 1600. Timings left on AUTO (11-11-11-29) - No Errors
Stick 1 - Slot 2 - dram increased from 1.5V to 1.64V. Memory clock increased to 1600. Timings increased to 9-9-9-24 - 3 errors before 1 pass was complete

Stick 2 - Slot 1 - all settings on AUTO (1333 and 9-9-9-24) - No Errors
Stick 2 - Slot 1 - dram increased from 1.5V to 1.64V. Memory clock increased to 1600. Timings left on AUTO (11-11-11-29) - still running. On pass 3, no errors

This is getting confusing. Pass 3 with no errors, I'll assume the RAM is okay. So both sticks and both slots are fine but errors when installed together??

Once this has reached 7 passes, I will install both sticks again, put all settings to AUTO and run again. Maybe one stick was not seated correctly the first time.

But the question remains, if the RAM is specified to be PC3-12800 (1600) CAS 9-9-9-24, why do I get errors at those settings? Okay, voltage says 1.65 but my motherboard goes up in 0.02, so either 1.64 or 1.66. Surely a difference of 0.01V can't make it go from stable to unstable?

CarlTR6 · 19 Jan 2011

I need to ask the hardware Gurus to take a look at your results. I am far from an expert on RAM, voltages and timings. They are going to want some information. Please post your CPUZ, Mainboard, Memory, and SPD tabs. This will give everyone the basic info, Mainboard for the motherboard though the revision is usually not listed, Memory tab can indicate wrong OC attempts or wrong settings, confirmed by the SPD tab which is the JEDEC settings for the RAM. JEDEC is the industry standard that the RAM manufactures use to get stable settings for default.

We will also need the voltage settings for the CPU, RAM and NB or equivalent.
NB or memory controller is important. CPU voltage is listed on the CPU tab, RAM voltage is listed but it's not the actual voltage; it's the recommended voltage.

Akira181 · 19 Jan 2011

okay, I will post them tomorrow.

Just installed both sticks of ram again, set everything to auto and will leave it overnight. Gotta say, both RAM chips fit very snug into the slots. Never had to push on RAM so hard before to get it to sit correctly. I was worried that I'd break the motherboard.

Hopefully it was just me installing it wrong the first time and not faulty after all.

*edit
first pass completed, no errors. Fingers crossed!

Spoke too soon. 2nd pass brought a bunch of errors. Completely confused as to what the problem is now...