Windows 7: Please help, BSOD killing me.

Brosekai · 31 Jan 2011

Hi,

Please help me fix my laptop that is BSODing all the time. 16 times over the last couple of days.

Running Windows 7 on an Acer Aspire 5536 laptop, just over a year old.

Bug Check String has mostly been IRQL_NOT_LESS_OR_EQUAL, but sometimes KMODE_EXCEPTION_NOT_HANDLED.

ntoskrnl.exe has been showing up in all of the BSODs. But sometimes different drivers appear to be cause in some instances.

Bug Check codes are usually 0x0000001e or 0x0000000a.

PLEASE HELP, NEED TO FIX THIS IMMEDIATELY AS IT IS HINDERING MY SCHOOL WORK.

Help is greatly appreciated.

I will try to answer as many questions as I can but I am not an expert with this sort of computer stuff.

JMH · 31 Jan 2011

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.

{To ensure minidumps are enabled:

*Go to Start, in the Search Box type: sysdm.cpl, press Enter.
*Under the Advanced tab, click on the Startup and Recovery Settings... button.
*Ensure that Automatically restart is unchecked.
*Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
*Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
*OK
* Reboot if changes have been made.}

wish · 31 Jan 2011

Follow this instruction to collect necessary files.
Blue Screen of Death (BSOD) Posting Instructions.

Brosekai · 31 Jan 2011

Ok, uploading ZIP now

wish · 31 Jan 2011

For troubleshooting purpose I would recommend you to uninstall McAfee and replace it with MSE. You may go back later after the BSOD have gone.
http://www.microsoft.com/security_essentials/

Perform check disk:
Right click cmd.exe → run as admin → chkdsk /r /f

Update these drivers:

Code:

pcouffin.sys Tue Dec 05 06:39:30 2006 → low level access layer for CD devices (A part of many different CD/DVD burning programs)
mdmxsdk.sys  Mon Jun 19 14:27:26 2006 → Conexant Modem Diagnostic Interface x86 Driver
wacommousefilter.sys Fri Feb 16 10:12:17 2007 → Wacom(tablet) Mouse Filter
SynTP.sys    Thu Jun 18 19:33:58 2009 → Synaptic Touch Pad Driver
RTKVHD64.sys Wed Aug 05 02:46:28 2009 → Realtek HD Audio
athrx.sys    Wed Jul 08 17:49:13 2009 → Atheros Network Adapter
AtiHdmi.sys  Fri Jun 05 01:31:42 2009 → ATI driver
atikmdag.sys Thu Jul 02 10:45:07 2009 → ATI driver

Code:

Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03600000 PsLoadedModuleList = 0xfffff800`0383de50
Debug session time: Mon Jan 31 18:21:30.886 2011 (GMT-8)
System Uptime: 0 days 0:07:34.617
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff88001224d16, 0, ffffffffffffffff}

Probably caused by : Ntfs.sys ( Ntfs!TxfLookupAclForTransaction+26 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88001224d16, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP: 
Ntfs!TxfLookupAclForTransaction+26
fffff880`01224d16 488b8988000000  mov     rcx,qword ptr [rcx+88h]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800038a80e0
 ffffffffffffffff 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  sdclt.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff8800233b0f8 -- (.exr 0xfffff8800233b0f8)
ExceptionAddress: fffff88001224d16 (Ntfs!TxfLookupAclForTransaction+0x0000000000000026)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff8800233b1a0 -- (.trap 0xfffff8800233b1a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800233b358 rbx=0000000000000000 rcx=7b8948cd8b48fffb
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001224d16 rsp=fffff8800233b330 rbp=0000000000000000
 r8=fffff8a000000200  r9=fffff8800233b3d0 r10=fffff880075ec870
r11=fffff8800233b710 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
Ntfs!TxfLookupAclForTransaction+0x26:
fffff880`01224d16 488b8988000000  mov     rcx,qword ptr [rcx+88h] ds:c123:7b8948cd`8b490083=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800036aaa39 to fffff80003670740

STACK_TEXT:  
fffff880`0233a928 fffff800`036aaa39 : 00000000`0000001e ffffffff`c0000005 fffff880`01224d16 00000000`00000000 : nt!KeBugCheckEx
fffff880`0233a930 fffff800`0366fd82 : fffff880`0233b0f8 fffffa80`03f1f9c0 fffff880`0233b1a0 00000000`00000000 : nt!KiDispatchException+0x1b9
fffff880`0233afc0 fffff800`0366e68a : fffffa80`03f1bb68 fffffa80`047fe1b0 fffffa80`03f1b780 fffff880`00fd3f37 : nt!KiExceptionDispatch+0xc2
fffff880`0233b1a0 fffff880`01224d16 : fffff8a0`0027c5c0 fffff880`075ec870 fffff880`0233b710 fffff8a0`0b9216a0 : nt!KiGeneralProtectionFault+0x10a
fffff880`0233b330 fffff880`012cad6b : fffffa80`03f1f9c0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!TxfLookupAclForTransaction+0x26
fffff880`0233b360 fffff880`012cc9e7 : fffffa80`03f1f9c0 00000000`00000000 fffff8a0`00000200 00000000`00100021 : Ntfs!TxfAccessCheck+0x5b
fffff880`0233b4d0 fffff880`012bb573 : fffffa80`01ea1c80 fffff880`075ec1e0 fffff8a0`00000200 fffff8a0`0027c5c0 : Ntfs!NtfsAccessCheck+0x1b7
fffff880`0233b6b0 00000000`00000000 : 00000000`00000000 fffff8a0`0b310000 00000000`00000002 00000000`00000000 : Ntfs!NtfsCheckExistingFile+0xc3


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!TxfLookupAclForTransaction+26
fffff880`01224d16 488b8988000000  mov     rcx,qword ptr [rcx+88h]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  Ntfs!TxfLookupAclForTransaction+26

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

FAILURE_BUCKET_ID:  X64_0x1E_Ntfs!TxfLookupAclForTransaction+26

BUCKET_ID:  X64_0x1E_Ntfs!TxfLookupAclForTransaction+26

Followup: MachineOwner
---------

1: kd> lmvm Ntfs
start             end                 module name
fffff880`0121c000 fffff880`013bf000   Ntfs       (pdb symbols)          c:\windows\symbols\ntfs.pdb\A3FA3C11632A4FC09223AB611D6EFF7F2\ntfs.pdb
    Loaded symbol image file: Ntfs.sys
    Mapped memory image file: C:\Windows\Symbols\Ntfs.sys\4A5BC14F1a3000\Ntfs.sys
    Image path: \SystemRoot\System32\Drivers\Ntfs.sys
    Image name: Ntfs.sys
    Timestamp:        Mon Jul 13 16:20:47 2009 (4A5BC14F)
    CheckSum:         00195F88
    ImageSize:        001A3000
    File version:     6.1.7600.16385
    Product version:  6.1.7600.16385
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntfs.sys
    OriginalFilename: ntfs.sys
    ProductVersion:   6.1.7600.16385
    FileVersion:      6.1.7600.16385 (win7_rtm.090713-1255)
    FileDescription:  NT File System Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

Brosekai · 01 Feb 2011

Thank you for your help Wish.

I'll uninstall McAfee and replace it with MSE; also run the check disk.
Is updating the drivers necessary because my internet has been slowed to 60kbps atm and it would take forever? I also don't know what the second code there is for?

Brosekai · 01 Feb 2011

Ok, so I've removed McAfee. Haven't installed MSE. Tried to run normally, but crashed/froze with the screen displaying only horizontal lines, not a BSOD. This has happened before. Started again in safemode with cmd prompt. Tried to run check disk but it keeps telling me it cannot run because the volume is in use by another process.

Please help!

wish · 01 Feb 2011

Hi,
Updating drivers is necessary , especially for the old driver below 2009 time stamp.

Then for checkdisk while ".. cannot run because the volume is in use by another process."
you should type Y then follow by enter.
So the checkdisk would run automatically in the next reboot.

Brosekai · 01 Feb 2011

Ah, ok. Check disk said that the volume is clean and it started normally which is good. I'll have to update the drivers in a few days when my internet returns to normal speed. Thank you very much for your help.

allgama · 11 Mar 2011

Any news on this issue? I also have an Aspire 5536 with the same problem. I have installed Xp 32-64 bits, Vista 32-64 bits and Windows 7 32-64 bits. Got different results with each one of them but they all end up with a BSOD or Windows explorer and applications errors. I even performed a deep hardware maintenance (took out the motherboard and processor) to the laptop with no luck. I tried RAM modules on different slots and it worked for a while but so far I still facing the same problem.

Any help will be deeply appreciated!

Allan

Windows 7: Please help, BSOD killing me.

Please help, BSOD killing me. problems?