BSOD While using ftp error 0x0000003b

relaxedcrazyman · 09 Mar 2012

Windows Resource Protection did not find any integrity violations.

Will run the seagate tools tonight.

writhziden · 09 Mar 2012

Good news about the system file check. Let us know the results after SeaTools finishes. :)

relaxedcrazyman · 09 Mar 2012

Ran Short Drive Self Test, Short Generic and Long Generic, none of them said anything about errors.

writhziden · 09 Mar 2012

Alright, the hard disk errors were likely due to the crashes and not due to a faulty drive. That is good news. RAM is good, hard drive is good, network adapter drivers are up to date... so why the issues with ftp... very strange. The only thing left to check is an underlying driver conflict.

Run Driver Verifier to find any issues. To run Driver Verifier, do the following:

a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. Run Driver Verifier and in step 3, only select Standard settings. Do not select the other two settings in the red boxes.

If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.

The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.

relaxedcrazyman · 12 Mar 2012

Will likely be away from being able to test this for about a month, but i will test and post back then.

Could it be the download is too many files going too fast for the drive to record them properly and crashes?

Thanks for all your help so far!

writhziden · 12 Mar 2012

You're welcome. I also changed part of the Verifier steps. A new, very knowledgeable member has brought some new information to our forums for running Verifier.

relaxedcrazyman · 19 Mar 2012

so while waiting to run the driver verifier, i ran into a few more BSOD. a few of them different than the usually 3b.

writhziden · 19 Mar 2012

I'd be happy to take a look if you want to upload the new crash reports and logs.

relaxedcrazyman · 19 Mar 2012

new cluster mess of BSOD.

writhziden · 19 Mar 2012

Security Software:

Code:

msmpeng.exe	c:\program files\microsoft security client\antimalware\msmpeng.exe	920	8	200	1380	3/19/2012 2:25 PM	3.0.8402.0	12.48 KB (12,784 bytes)	4/27/2011 6:21 PM
nissrv.exe	c:\program files\microsoft security client\antimalware\nissrv.exe	3196	8	200	1380	3/19/2012 2:25 PM	3.0.8402.0	281.52 KB (288,272 bytes)	4/27/2011 6:21 PM
msseces.exe	c:\program files\microsoft security client\msseces.exe	3640	8	200	1380	3/19/2012 2:25 PM	2.1.1116.0	1.37 MB (1,436,736 bytes)	6/15/2011 3:35 PM

Code:


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\relaxedcrazyman\Windows_NT6_BSOD_jcgriff2\031912-31184-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02e53000 PsLoadedModuleList = 0xfffff800`03097650
Debug session time: Mon Mar 19 15:24:24.798 2012 (UTC - 6:00)
System Uptime: 0 days 1:27:36.250
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {8, 2, 0, fffff88003c0f43a}

Probably caused by : afd.sys ( afd!AfdTLReleaseIndications+1a )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88003c0f43a, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003101100
 0000000000000008 

CURRENT_IRQL:  2

FAULTING_IP: 
afd!AfdTLReleaseIndications+1a
fffff880`03c0f43a 488b4108        mov     rax,qword ptr [rcx+8]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff800045b5250 -- (.trap 0xfffff800045b5250)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88003c11ba0 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff800045b5400 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88003c0f43a rsp=fffff800045b53e0 rbp=0000000000000000
 r8=fffffa80097d85b0  r9=fffffa8007c50510 r10=fffffa8006e1be70
r11=fffffa800a775670 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
afd!AfdTLReleaseIndications+0x1a:
fffff880`03c0f43a 488b4108        mov     rax,qword ptr [rcx+8] ds:2330:00000000`00000008=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ecf2e9 to fffff80002ecfd40

STACK_TEXT:  
fffff800`045b5108 fffff800`02ecf2e9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`045b5110 fffff800`02ecdf60 : fffffa80`08ce5ba0 fffffa80`06ed51a0 00000000`00000000 fffffa80`03eec718 : nt!KiBugCheckDispatch+0x69
fffff800`045b5250 fffff880`03c0f43a : fffffa80`03eec718 fffffa80`03e6f6a0 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
fffff800`045b53e0 fffff880`03c4e0cd : fffffa80`042d2950 fffff800`045b5528 00000000`00000000 fffffa80`03d3e930 : afd!AfdTLReleaseIndications+0x1a
fffff800`045b5430 fffff880`03c10c11 : fffffa80`000005b4 fffffa80`03eec718 fffffa80`03eec6d0 fffffa80`03e957b0 : afd!AfdReturnBuffer+0xbd
fffff800`045b5470 fffff880`03c0e1e3 : 00000000`000003e8 00000000`000005b4 fffffa80`03eec7b8 00000000`0050343a : afd!AfdUpdateConnectionForTimerWheel+0x1d1
fffff800`045b54f0 fffff800`02edaa6c : fffff800`045b5600 00000000`00000000 00000000`00000001 00000000`00000005 : afd!AfdTimerWheelHandler+0x1d7
fffff800`045b5570 fffff800`02eda906 : fffffa80`07190168 fffffa80`07190168 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
fffff800`045b55e0 fffff800`02eda7ee : 0000000c`3cf81e8e fffff800`045b5c58 00000000`00052428 fffff800`03047788 : nt!KiProcessExpiredTimerList+0xc6
fffff800`045b5c30 fffff800`02eda5d7 : 00000003`0532d3c2 00000003`00052428 00000003`0532d3fc 00000000`00000028 : nt!KiTimerExpiration+0x1be
fffff800`045b5cd0 fffff800`02ec7a6a : fffff800`03044e80 fffff800`03052cc0 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`045b5d80 00000000`00000000 : fffff800`045b6000 fffff800`045b0000 fffff800`045b5d40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
afd!AfdTLReleaseIndications+1a
fffff880`03c0f43a 488b4108        mov     rax,qword ptr [rcx+8]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  afd!AfdTLReleaseIndications+1a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: afd

IMAGE_NAME:  afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4efa9418

FAILURE_BUCKET_ID:  X64_0xD1_afd!AfdTLReleaseIndications+1a

BUCKET_ID:  X64_0xD1_afd!AfdTLReleaseIndications+1a

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\relaxedcrazyman\Windows_NT6_BSOD_jcgriff2\031912-21122-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02e68000 PsLoadedModuleList = 0xfffff800`030ac650
Debug session time: Mon Mar 19 13:52:06.559 2012 (UTC - 6:00)
System Uptime: 0 days 0:41:12.307
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff8800434b43a, fffff8800abb3a50, 0}

Probably caused by : afd.sys ( afd!AfdTLReleaseIndications+1a )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8800434b43a, Address of the instruction which caused the bugcheck
Arg3: fffff8800abb3a50, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
afd!AfdTLReleaseIndications+1a
fffff880`0434b43a 488b4108        mov     rax,qword ptr [rcx+8]

CONTEXT:  fffff8800abb3a50 -- (.cxr 0xfffff8800abb3a50)
rax=fffff8800434dba0 rbx=fffff8800abb4790 rcx=0000000000000000
rdx=fffff8800abb4450 rsi=fffffa8004011980 rdi=fffffa8009b4d510
rip=fffff8800434b43a rsp=fffff8800abb4430 rbp=fffff8800abb4ca0
 r8=0000000000000000  r9=0000000000000000 r10=fffffa8009153c20
r11=000000000028aad0 r12=0000000000000000 r13=0000000000000000
r14=00000000ffffffff r15=fffff8800abb4a88
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
afd!AfdTLReleaseIndications+0x1a:
fffff880`0434b43a 488b4108        mov     rax,qword ptr [rcx+8] ds:002b:00000000`00000008=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  fzsftp.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff8800434b43a

STACK_TEXT:  
fffff880`0abb4430 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : afd!AfdTLReleaseIndications+0x1a


FOLLOWUP_IP: 
afd!AfdTLReleaseIndications+1a
fffff880`0434b43a 488b4108        mov     rax,qword ptr [rcx+8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  afd!AfdTLReleaseIndications+1a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: afd

IMAGE_NAME:  afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4efa9418

STACK_COMMAND:  .cxr 0xfffff8800abb3a50 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_afd!AfdTLReleaseIndications+1a

BUCKET_ID:  X64_0x3B_afd!AfdTLReleaseIndications+1a

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\relaxedcrazyman\Windows_NT6_BSOD_jcgriff2\031312-23899-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e61000 PsLoadedModuleList = 0xfffff800`030a6670
Debug session time: Tue Mar 13 13:22:15.112 2012 (UTC - 6:00)
System Uptime: 0 days 0:43:01.189
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8800b202ff8, 1, fffff8800580d3f3, 0}

Unable to load image \SystemRoot\system32\DRIVERS\L1C62x64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for L1C62x64.sys
*** ERROR: Module load completed but symbols could not be loaded for L1C62x64.sys

Could not read faulting driver name
Probably caused by : L1C62x64.sys ( L1C62x64+d3f3 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8800b202ff8, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff8800580d3f3, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003110100
 fffff8800b202ff8 

FAULTING_IP: 
L1C62x64+d3f3
fffff880`0580d3f3 c7040100000000  mov     dword ptr [rcx+rax],0

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880071b0840 -- (.trap 0xfffff880071b0840)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800b17b000 rbx=0000000000000000 rcx=0000000000087ff8
rdx=0000000000087ff8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800580d3f3 rsp=fffff880071b09d0 rbp=0000000000000002
 r8=0000000000000100  r9=0000000000000000 r10=00000000ffffffff
r11=00000000ffffffff r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
L1C62x64+0xd3f3:
fffff880`0580d3f3 c7040100000000  mov     dword ptr [rcx+rax],0 ds:0980:fffff880`0b202ff8=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e899fc to fffff80002eddc40

STACK_TEXT:  
fffff880`071b06d8 fffff800`02e899fc : 00000000`00000050 fffff880`0b202ff8 00000000`00000001 fffff880`071b0840 : nt!KeBugCheckEx
fffff880`071b06e0 fffff800`02edbd6e : 00000000`00000001 fffff880`0b202ff8 00000005`e23d3a00 fffffa80`07964000 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`071b0840 fffff880`0580d3f3 : 00000000`0000003b fffff800`02e27a7b 00000000`0000000a fffffa80`07964000 : nt!KiPageFault+0x16e
fffff880`071b09d0 00000000`0000003b : fffff800`02e27a7b 00000000`0000000a fffffa80`07964000 00000000`00000000 : L1C62x64+0xd3f3
fffff880`071b09d8 fffff800`02e27a7b : 00000000`0000000a fffffa80`07964000 00000000`00000000 00000000`00000000 : 0x3b
fffff880`071b09e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : hal!KeStallExecutionProcessor+0x183


STACK_COMMAND:  kb

FOLLOWUP_IP: 
L1C62x64+d3f3
fffff880`0580d3f3 c7040100000000  mov     dword ptr [rcx+rax],0

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  L1C62x64+d3f3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: L1C62x64

IMAGE_NAME:  L1C62x64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec0d2ed

FAILURE_BUCKET_ID:  X64_0x50_L1C62x64+d3f3

BUCKET_ID:  X64_0x50_L1C62x64+d3f3

Followup: MachineOwner
---------

Typical cause of this crash with afd.sys to blame is network adapter drivers being out of date or corrupted. Could also be audio drivers that are out of date or corrupted since they share the same resources.
Same as 1. Other possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... Graphics Driver... Drivers...
Caused by Atheros AR8131 PCI-E Gigabit Ethernet Controller (NDIS 6.20); I am guessing you were connected via Ethernet during this ftp operation...

Alright, we have gone through the driver dance with network drivers already in the past if memory serves. Try re-installing your audio drivers.

If that does not resolve it, I suspect an application conflict at work. It may be as simple as SFTP and filezilla not liking each other. To see if it is other applications/services causing the issue: Troubleshoot Application Conflicts by Performing a Clean Startup