New
#21
Ok here are two of them from today.
-EDIT- Added a new one I just had.
Attachment 193477
Due to NTFS.sys, which suggests that your hard drive may have corrupted files. Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer LogCode:Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Fusion22\Windows_NT6_BSOD_jcgriff2\011612-25038-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505 Machine Name: Kernel base = 0x83a18000 PsLoadedModuleList = 0x83b614d0 Debug session time: Sun Jan 15 23:56:51.507 2012 (UTC - 7:00) System Uptime: 0 days 1:31:42.083 Loading Kernel Symbols ............................................................... ................................................................ ................................................ Loading User Symbols Loading unloaded module list ......................... 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 001904fb Arg2: a95b99c0 Arg3: a95b95a0 Arg4: 83adea7a Debugging Details: ------------------ EXCEPTION_RECORD: a95b99c0 -- (.exr 0xffffffffa95b99c0) ExceptionAddress: 83adea7a (nt!RtlDeleteNoSplay+0x0000005e) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000001 Parameter[1]: 00348534 Attempt to write to address 00348534 CONTEXT: a95b95a0 -- (.cxr 0xffffffffa95b95a0) eax=00348534 ebx=00000000 ecx=adbfb8bc edx=00000000 esi=adbfb8bc edi=86754594 eip=83adea7a esp=a95b9a88 ebp=a95b9a94 iopl=0 nv up ei pl zr na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246 nt!RtlDeleteNoSplay+0x5e: 83adea7a 8900 mov dword ptr [eax],eax ds:0023:00348534=???????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 00000001 EXCEPTION_PARAMETER2: 00348534 WRITE_ADDRESS: GetPointerFromAddress: unable to read from 83b81848 Unable to read MiSystemVaType memory at 83b60e20 00348534 FOLLOWUP_IP: Ntfs!NtfsDeleteScb+214 898c28ac 8b06 mov eax,dword ptr [esi] FAULTING_IP: nt!RtlDeleteNoSplay+5e 83adea7a 8900 mov dword ptr [eax],eax BUGCHECK_STR: 0x24 LAST_CONTROL_TRANSFER: from 8940a839 to 83adea7a STACK_TEXT: a95b9a94 8940a839 adbfb8bc 86754594 adbfb8bc nt!RtlDeleteNoSplay+0x5e a95b9aa8 8940aaf4 adbfb8bc 86754590 86754590 fltmgr!TreeUnlinkNoBalance+0x13 a95b9ac0 894145f5 86754594 ffffffff ffffffff fltmgr!TreeUnlinkMulti+0x22 a95b9adc 89421793 86754594 86754590 ffffffff fltmgr!FltpDeleteContextList+0x2f a95b9afc 894219b4 86754568 b33c30f8 00000000 fltmgr!CleanupStreamListCtrl+0x1b a95b9b10 83c972a1 8675456c 8f863cd9 00000000 fltmgr!DeleteStreamListCtrlCallback+0x5a a95b9b50 898c28ac b33c30f8 b33c3008 b33c30f8 nt!FsRtlTeardownPerStreamContexts+0x13a a95b9b6c 898b30b5 00000705 b33c3030 b33c3008 Ntfs!NtfsDeleteScb+0x214 a95b9b84 898369e6 88a0cd70 b33c30f8 00000000 Ntfs!NtfsRemoveScb+0xc5 a95b9ba0 898c22e7 88a0cd70 b33c3008 00000000 Ntfs!NtfsPrepareFcbForRemoval+0x62 a95b9be4 898322cb 88a0cd70 b33c30f8 b33c32a0 Ntfs!NtfsTeardownStructures+0x68 a95b9c0c 898c6341 88a0cd70 b33c30f8 b33c32a0 Ntfs!NtfsDecrementCloseCounts+0xaf a95b9c6c 898ca424 88a0cd70 b33c30f8 b33c3008 Ntfs!NtfsCommonClose+0x4f2 a95b9d00 83a95a6b 00000000 00000000 861f6898 Ntfs!NtfsFspClose+0x118 a95b9d50 83c20fda 80000000 8f863a19 00000000 nt!ExpWorkerThread+0x10d a95b9d90 83ac91f9 83a9595e 80000000 00000000 nt!PspSystemThreadStartup+0x9e 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19 SYMBOL_STACK_INDEX: 7 SYMBOL_NAME: Ntfs!NtfsDeleteScb+214 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4d799527 STACK_COMMAND: .cxr 0xffffffffa95b95a0 ; kb FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsDeleteScb+214 BUCKET_ID: 0x24_Ntfs!NtfsDeleteScb+214 Followup: MachineOwner ---------
Your latest blue screen .dmp file was corrupted, probably due to your hard disk error previous to it.
Check Disc: Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 1/16/2012 11:40:23 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: Sean-PC
Description:
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
336384 file records processed.
File verification completed.
414 large file records processed.
0 bad file records processed.
2 EA records processed.
78 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 5)...
415966 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 5)...
336384 file SDs/SIDs processed.
CHKDSK is compacting the security descriptor stream
Cleaning up 2252 unused security descriptors.
39792 data files processed.
CHKDSK is verifying Usn Journal...
35856040 USN bytes processed.
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
336368 files processed.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
51473890 free clusters processed.
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.
312560608 KB total disk space.
106120064 KB in 184393 files.
96836 KB in 39795 indexes.
0 KB in bad sectors.
448144 KB in use by the system.
65536 KB occupied by the log file.
205895564 KB available on disk.
4096 bytes in each allocation unit.
78140152 total allocation units on disk.
51473891 allocation units available on disk.
Internal Info:
00 22 05 00 c4 6b 03 00 ab 0a 06 00 00 00 00 00 ."...k..........
d2 02 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 ....N...........
c8 8e 1d 00 50 01 1c 00 e0 1c 1c 00 00 00 1c 00 ....P...........
Windows has finished checking your disk.
Please wait while your computer restarts.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2012-01-16T18:40:23.000000000Z" />
<EventRecordID>52965</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Sean-PC</Computer>
<Security />
</System>
<EventData>
<Data>
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
336384 file records processed.
File verification completed.
414 large file records processed.
0 bad file records processed.
2 EA records processed.
78 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 5)...
415966 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 5)...
336384 file SDs/SIDs processed.
CHKDSK is compacting the security descriptor stream
Cleaning up 2252 unused security descriptors.
39792 data files processed.
CHKDSK is verifying Usn Journal...
35856040 USN bytes processed.
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
336368 files processed.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
51473890 free clusters processed.
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.
312560608 KB total disk space.
106120064 KB in 184393 files.
96836 KB in 39795 indexes.
0 KB in bad sectors.
448144 KB in use by the system.
65536 KB occupied by the log file.
205895564 KB available on disk.
4096 bytes in each allocation unit.
78140152 total allocation units on disk.
51473891 allocation units available on disk.
Internal Info:
00 22 05 00 c4 6b 03 00 ab 0a 06 00 00 00 00 00 ."...k..........
d2 02 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 ....N...........
c8 8e 1d 00 50 01 1c 00 e0 1c 1c 00 00 00 1c 00 ....P...........
Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>
Thats what you need right?
It crashed again. After it said no files were changed.
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
336384 file records processed. File verification completed.
408 large file records processed. 0 bad file records processed. 2 EA records processed. 78 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
415974 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
336384 file SDs/SIDs processed. Cleaning up 16 unused index entries from index $SII of file 0x9.
Cleaning up 16 unused index entries from index $SDH of file 0x9.
Cleaning up 16 unused security descriptors.
Security descriptor verification completed.
39796 data files processed. CHKDSK is verifying Usn Journal...
34352200 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
336368 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
51432357 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.
312560608 KB total disk space.
106287504 KB in 184879 files.
97064 KB in 39797 indexes.
0 KB in bad sectors.
446612 KB in use by the system.
65536 KB occupied by the log file.
205729428 KB available on disk.
4096 bytes in each allocation unit.
78140152 total allocation units on disk.
51432357 allocation units available on disk.
Internal Info:
00 22 05 00 ae 6d 03 00 78 0e 06 00 00 00 00 00 ."...m..x.......
d2 02 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 ....N...........
c8 8e 08 00 50 01 07 00 e0 1c 07 00 00 00 07 00 ....P...........
Windows has finished checking your disk.
Please wait while your computer restarts.
last dmp:
Appears to be due to your display card again. Do you happen to have another display card you can run with to determine if the card is bad?Code:Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Fusion22\Windows_NT6_BSOD_jcgriff2\011612-23758-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505 Machine Name: Kernel base = 0x83a48000 PsLoadedModuleList = 0x83b914d0 Debug session time: Mon Jan 16 14:27:48.713 2012 (UTC - 7:00) System Uptime: 0 days 0:07:36.164 Loading Kernel Symbols ............................................................... ................................................................ ............................................... Loading User Symbols Loading unloaded module list ..... Unable to load image \SystemRoot\system32\DRIVERS\atikmpag.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for atikmpag.sys *** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000008E, {c0000005, 9158d9c8, a7f9c8f4, 0} Probably caused by : hardware ( atikmpag+c9c8 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: 9158d9c8, The address that the exception occurred at Arg3: a7f9c8f4, Trap Frame Arg4: 00000000 Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: atikmpag+c9c8 9158d9c8 108b550c8d75 adc byte ptr [ebx+758D0C55h],cl TRAP_FRAME: a7f9c8f4 -- (.trap 0xffffffffa7f9c8f4) ErrCode = 00000002 eax=8596b040 ebx=a7f9cb58 ecx=00000001 edx=00000000 esi=a7f9c9d4 edi=85962400 eip=9158d9c8 esp=a7f9c968 ebp=a7f9c998 iopl=0 nv up ei ng nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282 atikmpag+0xc9c8: 9158d9c8 108b550c8d75 adc byte ptr [ebx+758D0C55h],cl ds:0023:1d86d7ad=?? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x8E PROCESS_NAME: hl2.exe CURRENT_IRQL: 0 MISALIGNED_IP: atikmpag+c9c8 9158d9c8 108b550c8d75 adc byte ptr [ebx+758D0C55h],cl LAST_CONTROL_TRANSFER: from 9158d3c8 to 9158d9c8 STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. a7f9c998 9158d3c8 85962400 a7f9c9d4 00000000 atikmpag+0xc9c8 a7f9c9b8 915a5179 a7f9c9d4 00000000 83a166ee atikmpag+0xc3c8 a7f9ca04 928af09b 00c83180 a7f9ca60 88738000 atikmpag+0x24179 a7f9ca2c 928aeab0 a7f9ca60 357c9937 153bf5b8 dxgkrnl!DXGADAPTER::DdiEscape+0x46 a7f9cd28 83a8621a 153bf5b8 153bf5d4 77657094 dxgkrnl!DxgkEscape+0x4c8 a7f9cd28 77657094 153bf5b8 153bf5d4 77657094 nt!KiFastCallEntry+0x12a 153bf5d4 00000000 00000000 00000000 00000000 0x77657094 STACK_COMMAND: kb FOLLOWUP_IP: atikmpag+c9c8 9158d9c8 108b550c8d75 adc byte ptr [ebx+758D0C55h],cl SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: atikmpag+c9c8 FOLLOWUP_NAME: MachineOwner MODULE_NAME: hardware IMAGE_NAME: hardware DEBUG_FLR_IMAGE_TIMESTAMP: 0 FAILURE_BUCKET_ID: IP_MISALIGNED_atikmpag.sys BUCKET_ID: IP_MISALIGNED_atikmpag.sys Followup: MachineOwner ---------