Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: ntoskrnl.exe, ntfs.sys, etc. - Having BSODs for a year and a half


28 Jan 2012   #1

Windows 7 Home Premium 64-bit
 
 
ntoskrnl.exe, ntfs.sys, etc. - Having BSODs for a year and a half

Hi, I hope someone can help. I have been getting BSODs here and there ever since I put this computer together in August 2010. It's become intolerable and I am just so sick of it...

I am running full retail Home Premium x64 on this platform:

MSI 890GXM-G65 mainboard
AMD Phenom II X4 BE 965 Deneb
4x OCZ AMD Black Edition RAM 2GB (clocked at 1066 with 7-7-7-21 timings (factory default)) 8GB total
XFX 650W PSU
*XFX 5850 GPU (HD-585X-ZNFC, 725mhz/1GB DDR5)
1TB WDC HDD

*Graphics card recently crapped out, system would no longer POST with it hooked in. Running on an ancient PNY NVIDIA 7600GT back-up...

The Windows installation is approximately 7 months old, I have tried reinstalling three times to remedy the situation to no avail. I gave up on re-installation as a cure.

The most common cause seems to be simply being IDLE. As in, I'm not even at the chair interacting with the computer.

Firefox (up-to-date) crashes ALL THE TIME - usually having to do with Flash Player corruption. Reinstalled Flash, reinstalled FF. No difference. IE9 is a bit more stable but also crashes (albeit not fully, so I use it more often than FF).

I don't have dump files that reference it but atikmpag.sys was often the "culprit" of many of my BSODs prior to the card crapping the bed. In fact it even caused a crash after the card was replaced with the old 7600GT, at which point I uninstalled everything ATI. There hasn't been a BSOD pointing to it since.

I get all kinds of Flash corruption, pixelation, and lag when a BSOD is imminent - some of the time. 3D gaming however, is typically stable. Skyrim for instance, ran well until the GPU misfortune.

I have tried lots of RAM manipulation (Timings, Voltage, whatever) and it just makes things worse when I stray away from the factory defaults. I believe there is a limitation with my series of CPU in using 4 DIMMS - the memory controller can't handle speed above 800mhz or 1066mhz or something. I forget exactly what. But I am using 4 modules, so I have gone by what I read and this fixed ATI driver hang-ups (hang -> black screen -> "ATI driver stopped responding and has recovered) I was having in a different game a while back (Vindictus).

Windows Memory Diagnostic has never returned a problem with the RAM. Memtest didn't either the last time I tried. Admittedly this was a while ago, but like my title states, I have been having these problems since basically day one of this build.

Apologies if I have omitted anything that could be of use. I have put this off for a long time and am quite frustrated. I have read about 50 threads with similar BSOD error codes and still haven't gotten anything useful so maybe my problem needs a specific fix that I am currently incapable of wrapping my head around without expert help.

Dump report is attached.

Thanks in advance.


My System SpecsSystem Spec
.

28 Jan 2012   #2

Windows 7 Home Premium 64-bit
 
 

Forgot to add, sometimes the system is completely stable. It seems like turning it ON is like flipping a coin. "Sometimes" feels more like "seldom" for every time it crashes though...
My System SpecsSystem Spec
28 Jan 2012   #3

Windows 7 Home Premium 64-bit
 
 

Any thoughts?
My System SpecsSystem Spec
.


28 Jan 2012   #4

Windows 7 Home Premium 64 Bit
 
 

Code:
  1. Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [K:\BSODDmpFiles\HelpComputer\Windows_NT6_BSOD_jcgriff2\012712-14102-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`0300d000 PsLoadedModuleList = 0xfffff800`03252670 Debug session time: Fri Jan 27 18:24:34.368 2012 (GMT-7) System Uptime: 0 days 1:40:55.960 Loading Kernel Symbols ............................................................... ................................................................ ..................... Loading User Symbols Loading unloaded module list ........ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000007E, {ffffffffc0000005, fffff800031b8dd3, fffff880031c48b8, fffff880031c4110} Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+43 ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff800031b8dd3, The address that the exception occurred at Arg3: fffff880031c48b8, Exception Record Address Arg4: fffff880031c4110, Context Record Address Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!ExFreePoolWithTag+43 fffff800`031b8dd3 418b45f0 mov eax,dword ptr [r13-10h] EXCEPTION_RECORD: fffff880031c48b8 -- (.exr 0xfffff880031c48b8) ExceptionAddress: fffff800031b8dd3 (nt!ExFreePoolWithTag+0x0000000000000043) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff880031c4110 -- (.cxr 0xfffff880031c4110) rax=0000000000000000 rbx=fffff8a00b8b2380 rcx=02000000fffffffe rdx=0000000000000000 rsi=0000000000000000 rdi=02000000ffffffff rip=fffff800031b8dd3 rsp=fffff880031c4af0 rbp=00000000ffffffff r8=fffffa800621b040 r9=fffff880031c4c01 r10=fffff8000300d000 r11=fffff880031c4b50 r12=0000000000000000 r13=02000000fffffffe r14=0000000000000000 r15=0000000000000001 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00010202 nt!ExFreePoolWithTag+0x43: fffff800`031b8dd3 418b45f0 mov eax,dword ptr [r13-10h] ds:002b:02000000`ffffffee=???????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032bc100 ffffffffffffffff FOLLOWUP_IP: nt!ExFreePoolWithTag+43 fffff800`031b8dd3 418b45f0 mov eax,dword ptr [r13-10h] BUGCHECK_STR: 0x7E LAST_CONTROL_TRANSFER: from fffff800033bb661 to fffff800031b8dd3 STACK_TEXT: fffff880`031c4af0 fffff800`033bb661 : 00000000`00000000 fffff800`03049b6a fffff880`02f64180 fffff800`0328a700 : nt!ExFreePoolWithTag+0x43 fffff880`031c4ba0 fffff800`0336f66f : fffff8a0`0b8b2380 fffff880`031c4c44 00000000`00000004 00000000`00000001 : nt! ?? ::NNGAKEGL::`string'+0xf471 fffff880`031c4bd0 fffff800`032de90e : fffff8a0`0b8b2380 fffffa80`0621b040 fffff880`031c4ca4 00000000`00000000 : nt!CmpCleanUpKcbCacheWithLock+0x2b fffff880`031c4c00 fffff800`03094001 : fffff800`032de5d4 fffff800`0322a2b8 fffffa80`0621b040 00000000`00000000 : nt!CmpDelayCloseWorker+0x33a fffff880`031c4cb0 fffff800`03324fee : 00000000`00000000 fffffa80`0621b040 00000000`00000080 fffffa80`0610a040 : nt!ExpWorkerThread+0x111 fffff880`031c4d40 fffff800`0307b5e6 : fffff880`02f64180 fffffa80`0621b040 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`031c4d80 00000000`00000000 : fffff880`031c5000 fffff880`031bf000 fffff880`031c4970 00000000`00000000 : nt!KxStartSystemThread+0x16 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!ExFreePoolWithTag+43 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3 STACK_COMMAND: .cxr 0xfffff880031c4110 ; kb FAILURE_BUCKET_ID: X64_0x7E_nt!ExFreePoolWithTag+43 BUCKET_ID: X64_0x7E_nt!ExFreePoolWithTag+43 Followup: MachineOwner ---------
  2. Loading Dump File [K:\BSODDmpFiles\HelpComputer\Windows_NT6_BSOD_jcgriff2\012712-16754-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`03017000 PsLoadedModuleList = 0xfffff800`0325c670 Debug session time: Fri Jan 27 16:41:15.800 2012 (GMT-7) System Uptime: 0 days 3:21:02.002 Loading Kernel Symbols ............................................................... ................................................................ ....................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1E, {ffffffffc0000005, fffff8000307fcc1, 0, ffffffffffffffff} Probably caused by : ntkrnlmp.exe ( nt!NtWaitForWorkViaWorkerFactory+410 ) Followup: MachineOwner --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KMODE_EXCEPTION_NOT_HANDLED (1e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff8000307fcc1, The address that the exception occurred at Arg3: 0000000000000000, Parameter 0 of the exception Arg4: ffffffffffffffff, Parameter 1 of the exception Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!NtWaitForWorkViaWorkerFactory+410 fffff800`0307fcc1 c3 ret EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c6100 ffffffffffffffff CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x1E PROCESS_NAME: services.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff800030df588 to fffff80003093c40 STACK_TEXT: fffff880`091861f8 fffff800`030df588 : 00000000`0000001e ffffffff`c0000005 fffff800`0307fcc1 00000000`00000000 : nt!KeBugCheckEx fffff880`09186200 fffff800`030932c2 : fffff880`091869d8 fffffa80`0916cb60 fffff880`09186a80 00000000`776f45c0 : nt! ?? ::FNODOBFM::`string'+0x4977d fffff880`091868a0 fffff800`03091bca : fffff880`09186ca0 fffff800`0337c647 fffff8a0`00000000 00000000`00000001 : nt!KiExceptionDispatch+0xc2 fffff880`09186a80 fffff800`0307fcc1 : ffdff800`03092ed3 fffffa80`0916cb60 00000000`776f45c0 00000000`00000102 : nt!KiGeneralProtectionFault+0x10a fffff880`09186c18 ffdff800`03092ed3 : fffffa80`0916cb60 00000000`776f45c0 00000000`00000102 00000000`00000000 : nt!NtWaitForWorkViaWorkerFactory+0x410 fffff880`09186c20 fffffa80`0916cb60 : 00000000`776f45c0 00000000`00000102 00000000`00000000 00000000`00000000 : 0xffdff800`03092ed3 fffff880`09186c28 00000000`776f45c0 : 00000000`00000102 00000000`00000000 00000000`00000000 00001f80`02010000 : 0xfffffa80`0916cb60 fffff880`09186c30 00000000`00000102 : 00000000`00000000 00000000`00000000 00001f80`02010000 00000000`00000000 : 0x776f45c0 fffff880`09186c38 00000000`00000000 : 00000000`00000000 00001f80`02010000 00000000`00000000 00000000`7760fbc0 : 0x102 STACK_COMMAND: kb FOLLOWUP_IP: nt!NtWaitForWorkViaWorkerFactory+410 fffff800`0307fcc1 c3 ret SYMBOL_STACK_INDEX: 4 SYMBOL_NAME: nt!NtWaitForWorkViaWorkerFactory+410 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3 FAILURE_BUCKET_ID: X64_0x1E_nt!NtWaitForWorkViaWorkerFactory+410 BUCKET_ID: X64_0x1E_nt!NtWaitForWorkViaWorkerFactory+410 Followup: MachineOwner ---------
  3. Loading Dump File [K:\BSODDmpFiles\HelpComputer\Windows_NT6_BSOD_jcgriff2\012112-16052-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`0301e000 PsLoadedModuleList = 0xfffff800`03263670 Debug session time: Sat Jan 21 13:29:10.151 2012 (GMT-7) System Uptime: 0 days 3:24:39.743 Loading Kernel Symbols ............................................................... ................................................................ ....................... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 19, {22, 200000000000000, 0, 0} GetPointerFromAddress: unable to read from fffff800032cd100 GetUlongFromAddress: unable to read from fffff8000323ba18 Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+72d6 ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* BAD_POOL_HEADER (19) The pool is already corrupt at the time of the current request. This may or may not be due to the caller. The internal pool links must be walked to figure out a possible cause of the problem, and then special pool applied to the suspect tags or the driver verifier to a suspect driver. Arguments: Arg1: 0000000000000022, Arg2: 0200000000000000 Arg3: 0000000000000000 Arg4: 0000000000000000 Debugging Details: ------------------ GetUlongFromAddress: unable to read from fffff8000323ba18 BUGCHECK_STR: 0x19_22 POOL_ADDRESS: 0200000000000000 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff800030274ce to fffff8000309ac40 STACK_TEXT: fffff880`031a8a88 fffff800`030274ce : 00000000`00000019 00000000`00000022 02000000`00000000 00000000`00000000 : nt!KeBugCheckEx fffff880`031a8a90 fffff800`031ca1fa : 00000000`00000000 fffff880`031a8be0 fffff880`031a8b60 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x72d6 fffff880`031a8b20 fffff800`033cb75a : 00000000`00000000 00000000`00000004 00000000`00000004 00000000`00000000 : nt!ExFreePoolWithTag+0x46a fffff880`031a8bd0 fffff800`032ef972 : fffff8a0`119f9948 fffff880`031a8c44 00000000`00000004 fffff880`0161ebb4 : nt! ?? ::NNGAKEGL::`string'+0xbe1a fffff880`031a8c00 fffff800`030a5001 : fffff800`032ef5d4 fffff800`0323b2b8 fffffa80`061b0040 00000000`00000000 : nt!CmpDelayCloseWorker+0x39e fffff880`031a8cb0 fffff800`03335fee : 00000000`00000000 fffffa80`061b0040 00000000`00000080 fffffa80`06101040 : nt!ExpWorkerThread+0x111 fffff880`031a8d40 fffff800`0308c5e6 : fffff880`02f64180 fffffa80`061b0040 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`031a8d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: nt! ?? ::FNODOBFM::`string'+72d6 fffff800`030274ce cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+72d6 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3 FAILURE_BUCKET_ID: X64_0x19_22_nt!_??_::FNODOBFM::_string_+72d6 BUCKET_ID: X64_0x19_22_nt!_??_::FNODOBFM::_string_+72d6 Followup: MachineOwner ---------
  4. Loading Dump File [K:\BSODDmpFiles\HelpComputer\Windows_NT6_BSOD_jcgriff2\012012-19390-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`03065000 PsLoadedModuleList = 0xfffff800`032aa670 Debug session time: Fri Jan 20 20:08:54.533 2012 (GMT-7) System Uptime: 0 days 9:13:45.735 Loading Kernel Symbols ............................................................... ................................................................ ........................ Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1A, {41790, fffffa80034847a0, ffff, 0} Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+36024 ) Followup: MachineOwner --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* MEMORY_MANAGEMENT (1a) # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 0000000000041790, The subtype of the bugcheck. Arg2: fffffa80034847a0 Arg3: 000000000000ffff Arg4: 0000000000000000 Debugging Details: ------------------ BUGCHECK_STR: 0x1a_41790 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: audiodg.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80003151150 to fffff800030e1c40 STACK_TEXT: fffff880`095bb768 fffff800`03151150 : 00000000`0000001a 00000000`00041790 fffffa80`034847a0 00000000`0000ffff : nt!KeBugCheckEx fffff880`095bb770 fffff800`03115569 : fffffa80`00000000 000007fe`fd286fff 00000000`00000000 fffffa80`07a72648 : nt! ?? ::FNODOBFM::`string'+0x36024 fffff880`095bb930 fffff800`030b3728 : ffffffff`ffffffff 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9 fffff880`095bba50 fffff800`033b7b1a : fffff8a0`1118b940 00000000`00000001 00000000`00000000 fffffa80`09d58840 : nt!MmCleanProcessAddressSpace+0x228 fffff880`095bbaa0 fffff800`0339948c : 00000000`c000004b 00000000`00000001 000007ff`fffde000 00000000`00000000 : nt!PspExitThread+0x56a fffff880`095bbba0 fffff800`030e0ed3 : fffffa80`09e97a10 fffff880`c000004b fffffa80`09d58840 00000000`00000001 : nt!NtTerminateProcess+0x138 fffff880`095bbc20 00000000`775915da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`000df5e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x775915da STACK_COMMAND: kb FOLLOWUP_IP: nt! ?? ::FNODOBFM::`string'+36024 fffff800`03151150 cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+36024 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3 FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024 BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024 Followup: MachineOwner ---------
  5. Loading Dump File [K:\BSODDmpFiles\HelpComputer\Windows_NT6_BSOD_jcgriff2\011712-26317-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`03053000 PsLoadedModuleList = 0xfffff800`03298670 Debug session time: Tue Jan 17 19:08:50.752 2012 (GMT-7) System Uptime: 0 days 9:10:18.344 Loading Kernel Symbols ............................................................... ................................................................ .......................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff88006c595f9, fffff88009755ec0, 0} Probably caused by : dxgkrnl.sys ( dxgkrnl!DXGDEVICE::DestroyAllocation+2a5 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff88006c595f9, Address of the exception record for the exception that caused the bugcheck Arg3: fffff88009755ec0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: dxgkrnl!DXGDEVICE::DestroyAllocation+2a5 fffff880`06c595f9 f6400401 test byte ptr [rax+4],1 CONTEXT: fffff88009755ec0 -- (.cxr 0xfffff88009755ec0) rax=0200000000000000 rbx=fffff8a011898b00 rcx=0000000000000020 rdx=0000000000000062 rsi=0000000000000000 rdi=0000000000000000 rip=fffff88006c595f9 rsp=fffff880097568a0 rbp=fffff88009756ca0 r8=fffff8a00f400000 r9=000000007c90a025 r10=fffff8a00ce06000 r11=fffff8a00f400000 r12=fffff8a01191e000 r13=fffff8a011898b40 r14=0000000000000003 r15=ffffffffc000000d iopl=0 nv up ei pl nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206 dxgkrnl!DXGDEVICE::DestroyAllocation+0x2a5: fffff880`06c595f9 f6400401 test byte ptr [rax+4],1 ds:002b:02000000`00000004=?? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: iexplore.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff88006c595f9 STACK_TEXT: fffff880`097568a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : dxgkrnl!DXGDEVICE::DestroyAllocation+0x2a5 FOLLOWUP_IP: dxgkrnl!DXGDEVICE::DestroyAllocation+2a5 fffff880`06c595f9 f6400401 test byte ptr [rax+4],1 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: dxgkrnl!DXGDEVICE::DestroyAllocation+2a5 FOLLOWUP_NAME: MachineOwner MODULE_NAME: dxgkrnl IMAGE_NAME: dxgkrnl.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4ce799fa STACK_COMMAND: .cxr 0xfffff88009755ec0 ; kb FAILURE_BUCKET_ID: X64_0x3B_dxgkrnl!DXGDEVICE::DestroyAllocation+2a5 BUCKET_ID: X64_0x3B_dxgkrnl!DXGDEVICE::DestroyAllocation+2a5 Followup: MachineOwner ---------
  6. Loading Dump File [K:\BSODDmpFiles\HelpComputer\Windows_NT6_BSOD_jcgriff2\011712-19000-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`03066000 PsLoadedModuleList = 0xfffff800`032ab670 Debug session time: Mon Jan 16 21:08:42.927 2012 (GMT-7) System Uptime: 0 days 12:59:31.519 Loading Kernel Symbols ............................................................... ................................................................ .......................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1904fb, fffff8800318c5c8, fffff8800318be20, fffff800030c74db} Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteScb+108 ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff8800318c5c8 Arg3: fffff8800318be20 Arg4: fffff800030c74db Debugging Details: ------------------ EXCEPTION_RECORD: fffff8800318c5c8 -- (.exr 0xfffff8800318c5c8) ExceptionAddress: fffff800030c74db (nt!RtlDeleteNoSplay+0x0000000000000093) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff8800318be20 -- (.cxr 0xfffff8800318be20) rax=fffff8a010781b58 rbx=fffffa8006443fa0 rcx=0200000000000000 rdx=fffffa8006443fa0 rsi=ffffffffffffffff rdi=0000000000000000 rip=fffff800030c74db rsp=fffff8800318c800 rbp=fffffa8006443fa0 r8=ffffffffffffffff r9=ffffffffffffffff r10=fffff8a00b130010 r11=fffff8a010781b58 r12=0000000000000705 r13=0000000000000000 r14=fffffa8006443f58 r15=fffff8a00b1303a8 iopl=0 nv up ei pl zr na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246 nt!RtlDeleteNoSplay+0x93: fffff800`030c74db 488909 mov qword ptr [rcx],rcx ds:002b:02000000`00000000=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003315100 ffffffffffffffff FOLLOWUP_IP: Ntfs!NtfsDeleteScb+108 fffff880`01295bac 488b03 mov rax,qword ptr [rbx] FAULTING_IP: nt!RtlDeleteNoSplay+93 fffff800`030c74db 488909 mov qword ptr [rcx],rcx BUGCHECK_STR: 0x24 LAST_CONTROL_TRANSFER: from fffff88001025633 to fffff800030c74db STACK_TEXT: fffff880`0318c800 fffff880`01025633 : 00000000`00000000 00000000`000007ff fffff8a0`02bd2548 fffff880`010232c8 : nt!RtlDeleteNoSplay+0x93 fffff880`0318c830 fffff880`010232c8 : fffff8a0`037eaa08 00000000`00008000 fffffa80`071fc668 fffffa80`09aed6c0 : fltmgr!TreeUnlinkNoBalance+0x13 fffff880`0318c860 fffff880`0104114c : fffff8a0`0b8c7200 00000000`00000040 00000000`00000000 fffff880`0318c9e1 : fltmgr!TreeUnlinkMulti+0x148 fffff880`0318c8b0 fffff880`01043311 : fffffa80`071fc010 00000000`00000130 fffff8a0`0b130140 00000000`00000000 : fltmgr!FltpDeleteContextList+0x3c fffff880`0318c8e0 fffff880`010433fb : fffffa80`071fc010 fffff8a0`0b1303a8 fffffa80`071fc010 fffff8a0`037ea670 : fltmgr!CleanupStreamListCtrl+0x21 fffff880`0318c920 fffff800`0339b90e : 00000000`00000001 fffff880`012961b3 fffff8a0`037ea670 00000000`00000000 : fltmgr!DeleteStreamListCtrlCallback+0x6b fffff880`0318c950 fffff880`01295bac : fffff8a0`0b130140 fffffa80`061e8040 fffff880`0318ca28 00000000`00000706 : nt!FsRtlTeardownPerStreamContexts+0xe2 fffff880`0318c9a0 fffff880`0129acc1 : 00000000`01000000 00000000`00000000 fffff800`03283200 00000000`00000001 : Ntfs!NtfsDeleteScb+0x108 fffff880`0318c9e0 fffff880`0121385c : fffff8a0`0b130040 fffff8a0`0b130140 fffff800`03283200 fffff880`0318cb52 : Ntfs!NtfsRemoveScb+0x61 fffff880`0318ca20 fffff880`0129864c : fffff8a0`0b130010 fffff800`03283260 fffff880`0318cb52 fffffa80`0a1e7640 : Ntfs!NtfsPrepareFcbForRemoval+0x50 fffff880`0318ca50 fffff880`0121a0e2 : fffffa80`0a1e7640 fffffa80`0a1e7640 fffff8a0`0b130010 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xdc fffff880`0318cad0 fffff880`012a8193 : fffffa80`0a1e7640 fffff800`03283260 fffff8a0`0b130010 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2 fffff880`0318cb10 fffff880`01297357 : fffffa80`0a1e7640 fffff8a0`0b130140 fffff8a0`0b130010 fffffa80`07203180 : Ntfs!NtfsCommonClose+0x353 fffff880`0318cbe0 fffff800`030ed001 : 00000000`00000000 fffff800`033d9900 fffff800`032e4801 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15f fffff880`0318ccb0 fffff800`0337dfee : 00000000`00000000 fffffa80`061e8040 00000000`00000080 fffffa80`06101040 : nt!ExpWorkerThread+0x111 fffff880`0318cd40 fffff800`030d45e6 : fffff880`02f64180 fffffa80`061e8040 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`0318cd80 00000000`00000000 : fffff880`0318d000 fffff880`03187000 fffff880`0318c9e0 00000000`00000000 : nt!KxStartSystemThread+0x16 SYMBOL_STACK_INDEX: 7 SYMBOL_NAME: Ntfs!NtfsDeleteScb+108 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b STACK_COMMAND: .cxr 0xfffff8800318be20 ; kb FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteScb+108 BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteScb+108 Followup: MachineOwner ---------
  1. Possible causes are Memory problems... Corrupted hard disk system files... Corrupted System Files... Lack of Windows updates... Drivers...
  2. Possible causes are Memory problems... Viruses... Corrupted hard disk system files... Corrupted System Files... Lack of Windows updates... Drivers...
    Thanks to JMH for helping with my understanding of this crash.
  3. Possible cause is Drivers...
  4. Possible causes are Memory problems... Drivers...
  5. Caused by DirectX or your graphics driver. Possible other causes are Memory problems... Corrupted hard disk system files... Corrupted System Files... Graphics Driver...
  6. Possible causes are Memory problems... Corrupted hard disk system files... Drivers... corrupted SCSI or IDE Drivers...
Thanks to Dave76 for help understanding possible causes.



We will start with the common problems first (see bold possible causes). Do the following steps and test after each to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.
  • If you are overclocking anything, please stop.


  • Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).


  • Use FurMark: VGA Stress Test, Graphics Card and GPU Stability Test, Burn-in Test, OpenGL Benchmark and GPU Temperature | oZone3D.Net to test the graphics card GPU. Then use the |MG| Video Memory Stress Test 1.7.116 Download to test your graphics card memory.


  • Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log


  • Follow the steps for Diagnosing basic problems with DirectX. To re-install your display card drivers as outlined in the DirectX link, use the following steps.
    1. Download the latest drivers for your display card(s)
    2. Click Start Menu
    3. Right Click My Computer/Computer
    4. Click Manage
    5. Click Device Manager from the list on the left
    6. Expand Display adapters
    7. Do the following for each adapter (in case you have multiple display cards)
      • Right click the adapter
      • Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
      • Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
    8. Restart your computer after uninstalling drivers for all display cards
    9. Install the latest driver for the display cards once Windows starts

    Alternatively:
    1. Login as an adminstrative user
    2. Download the latest drivers for your display card(s)
    3. Click Start Menu
    4. Click Control Panel
    5. Click Hardware and Sound
    6. Click Device Manager (the last link under Devices and Printers)
    7. Expand Display adapters
    8. Do the following for each adapter (in case you have multiple display cards)
      • Right click the adapter
      • Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
      • Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
    9. Restart your computer after uninstalling drivers for all display cards
    10. Install the latest driver for the display cards once Windows starts


  • Please remove Daemon Tools, as it uses a driver called dtsoftbus01.sys that is known to cause BSODs.

    I prefer TotalMounter as my CD/DVD virtualization software as it allows me to burn images to a virtual CD/DVD if I just want an ISO file instead of a disc, and it is free.

    Many use MagicISO - Convert BIN to ISO, Create, Edit, Burn, Extract ISO file, ISO/BIN converter/extractor/editor as well, which is also free.


  • An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
    a. Backup your system and user files
    b. Create a system restore point
    c. If you do not have a Windows 7 DVD, Create a system repair disc
    d. Run Driver Verifier

    If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

    Thanks to zigzag3143 for contributing to the Verifier steps.
    If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
My System SpecsSystem Spec
29 Jan 2012   #5

Windows 7 Home Premium 64-bit
 
 

Actions taken thus far:
  • Turning CPU clock back to 3.4ghz from 3.6ghz...
  • See no way or point in trying to stress test my primary video card as the system will not POST with the card hooked in.
  • Ran Chkdsk with both boxes checked on startup, reported the drive as Clean. Attaching in-windows read-only log also clearing the HDD of culpability.
  • Uninstalled D.T. Lite.
Results:

Two NEW BSODS and Windows is now refusing to accept itself as "Genuine". This has happened before, but this time the popup that requests my product key DOES NOT ACCEPT THE PRODUCT KEY, correctly entered and triple-checked. I paid for THIS? Really now. What a sad joke.

UPDATE:

Turned Driver Verifier on, so far 4 crashes following bootup.

Shall I turn Verifier off and upload these crash reports or leave it on?
My System SpecsSystem Spec
29 Jan 2012   #6

Windows 7 Home Premium 64 Bit
 
 

Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors. If you get the message that no integrity violations were found, post back. If you continue to have errors after the fourth run, see OPTION THREE of that tutorial and the tip enclosed in that option.

The system file check should resolve the genuineness of your OS. If not, you will need to do a Repair Install



Were you able to resolve the genuineness of Windows? Any luck determining what caused the problems to begin with?
My System SpecsSystem Spec
19 Feb 2012   #7

Windows 7 Home Premium 64-bit
 
 

I've resolved it but not to full satisfaction:

Running 4 RAM sticks all at once seems to have been the problem. I have been using two of four at any given time for the last week or so, and have yet to experience a single BSOD. I am very happy that I am not having BSODs anymore, and my RAM is running at its factory-recommended OC settings of 8-8-8-24 @ 1600 mhz. But I really would like to be able to use all 4 sticks and get the 8GB I paid for... maybe this is a pipe dream though.

Ran SFC /scannow about five times and it reported that it found and fixed errors, but these fixes didn't seem to include a resolution to the genuineness problem.

I tried to let Windows auto-repair (popped DVD in, booted from disk) but it couldn't fix the issue either; I let it try this from boot-up so maybe I am overlooking some other procedure?

I am waiting on my Radeon HD5850 to return from its RMA journey, XFX has notified me that it is in the mail; I don't expect any issues to occur with it once it comes back.
My System SpecsSystem Spec
19 Feb 2012   #8

Windows 7 Home Premium 64 Bit
 
 

Running the RAM at 1600 may be the problem. AMD processors often have issues with frequencies over 1333 MHz. If you'd like help setting up the four sticks at 1333 MHz, let us know.

I should also mention that sometimes you need an NB voltage bump of +0.1 Volts to run over 4 GB of RAM.
My System SpecsSystem Spec
19 Feb 2012   #9

Windows 7 Home Premium 64-bit
 
 

In the past I've tried to run it (all 4 sticks) as low as 800mhz and the problems were not abated. Not sure if in that case I had upped the NB voltage though. I remember reading somewhere that indeed my particular processor (or was it motherboard?) doesn't like to run 4 sticks any higher than 800mhz because of the memory controller's particular limitations.

I'd take any help available with properly configuring these sticks to work as a stable foursome.

I was thinking of just getting a set of two 4GB GSkill sticks @ 1333mhz so I could bypass the OC and 4-DIMM issues that are the root of all this evil.
My System SpecsSystem Spec
19 Feb 2012   #10

Windows 7 Home Premium 64 Bit
 
 

Download and install CPUZ and Upload screenshots of the CPU, Mainboard, Memory, and SPD tabs. In the SPD tab, upload an image of each slot.

Also, go into your BIOS and post all RAM and CPU Voltages and all RAM settings (timings, frequency, etc.)

Thanks to Dave76 for help learning RAM Stability
My System SpecsSystem Spec
Reply

 ntoskrnl.exe, ntfs.sys, etc. - Having BSODs for a year and a half




Thread Tools



Similar help and support threads for2: ntoskrnl.exe, ntfs.sys, etc. - Having BSODs for a year and a half
Thread Forum
BSOD ntoskrnl.exe and NTFS.sys BSOD Help and Support
1E, Ntfs.sys, ntoskrnl.exe and more... Require some assistance BSOD Help and Support
Solved Repeated BSODs from ntfs.sys, ntoskrnl.exe, and fltmgr.sys BSOD Help and Support
BSOD - ntoskrnl.exe and ntfs.sys BSOD Help and Support
many BSOD's when on the web, ntoskrnl.exe, SYMEFA64.SYS, and ntfs.sys BSOD Help and Support
Secunia's Half Year Report for 2011 Security News
Unable to install/play Half-Life Game of the Year Edition Gaming

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 09:00 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33