Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Random BSOD's want to figure this out once and for all

08 Apr 2012   #31
obidon

Windows 7 Professional x64
 
 

Quote   Quote: Originally Posted by writhziden View Post
You're welcome for the help.

I am glad you forgot about the blue screens; that means the system must be running stable. I am also happy that you were finally able to get SP1 installed.

Thanks for keeping us updated. I look forward to seeing how the system is responding in a couple weeks.
Alright so it's been almost a week since I did the repair install, and my system's been pretty good for the most part. But yesterday and today I had another BSOD :/

Don't know what caused these. The first one didn't have a lot of relevent information, but the second one said it has caused by the NTFS.sys file.

What should I do from here?


My System SpecsSystem Spec
.
08 Apr 2012   #32
writhziden

Windows 7 Home Premium 64 Bit
 
 

Follow the http://www.sevenforums.com/crashes-d...tructions.html and we'll make a diagnosis. For NTFS.sys crashes, I also recommend a Disk Check.
My System SpecsSystem Spec
14 Apr 2012   #33
obidon

Windows 7 Professional x64
 
 

Ok here are the attachements
My System SpecsSystem Spec
.

15 Apr 2012   #34
writhziden

Windows 7 Home Premium 64 Bit
 
 

Code:
  1. Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [D:\Kingston\BSODDmpFiles\obidon\Windows_NT6_BSOD_jcgriff2\041412-22432-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505 Machine Name: Kernel base = 0xfffff800`03056000 PsLoadedModuleList = 0xfffff800`0329a650 Debug session time: Sat Apr 14 00:06:48.082 2012 (UTC - 6:00) System Uptime: 2 days 0:59:12.908 Loading Kernel Symbols ............................................................... ................................................................ .............................................. Loading User Symbols Loading unloaded module list .................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1A, {5002, fffff780c0000000, 4a4a, 241e2fffffffe} Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+2959c ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* MEMORY_MANAGEMENT (1a) # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 0000000000005002, The subtype of the bugcheck. Arg2: fffff780c0000000 Arg3: 0000000000004a4a Arg4: 000241e2fffffffe Debugging Details: ------------------ BUGCHECK_STR: 0x1a_5002 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: psia.exe CURRENT_IRQL: 0 TRAP_FRAME: fffff8800ab8aa00 -- (.trap 0xfffff8800ab8aa00) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffffa8009749430 rbx=0000000000000000 rcx=0000000000000000 rdx=fffff9802a680000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff800033ce427 rsp=fffff8800ab8ab90 rbp=fffff8a008c2f810 r8=000000000000000f r9=fffff8800ab8a940 r10=0000000000000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz ac po cy nt!CcMapData+0x117: fffff800`033ce427 0fb602 movzx eax,byte ptr [rdx] ds:fffff980`2a680000=?? Resetting default scope LAST_CONTROL_TRANSFER: from fffff8000313cd14 to fffff800030d2c80 STACK_TEXT: fffff880`0ab8a5d8 fffff800`0313cd14 : 00000000`0000001a 00000000`00005002 fffff780`c0000000 00000000`00004a4a : nt!KeBugCheckEx fffff880`0ab8a5e0 fffff800`0310341f : 00000002`49cd88c0 00000002`49cd8921 fffffa80`06dd6880 fffff800`03307b00 : nt! ?? ::FNODOBFM::`string'+0x2959c fffff880`0ab8a670 fffff800`030f0c05 : 00000000`00000000 00000002`49cd88c0 00000000`00000000 fffff800`03307b00 : nt!MiResolveTransitionFault+0x32f fffff880`0ab8a700 fffff800`030ef5c3 : f8a008c4`60100400 fffff980`2a680000 fffff6fc`c0153400 fffff800`03307b00 : nt!MiResolveProtoPteFault+0x325 fffff880`0ab8a790 fffff800`030dfd2b : fffff8a0`104edb00 fffffa80`09a181c0 00000000`00000000 00000000`00000000 : nt!MiDispatchFault+0x1c3 fffff880`0ab8a8a0 fffff800`030d0dae : 00000000`00000000 fffff980`2a680000 00000000`00000000 00000000`0000000e : nt!MmAccessFault+0xe1b fffff880`0ab8aa00 fffff800`033ce427 : fffffa80`00000001 00000000`00000000 fffff880`0ab8ac58 fffff880`0ab8ac50 : nt!KiPageFault+0x16e fffff880`0ab8ab90 fffff880`012d2c85 : fffffa80`00040000 fffffa80`09749430 fffff8a0`08c2f801 fffff8a0`0000000e : nt!CcMapData+0x117 fffff880`0ab8ac50 fffff880`012d6db1 : fffff8a0`08c2f810 00000000`00000000 fffff8a0`0a9fb540 fffffa80`0c7cce40 : Ntfs!FindFirstIndexEntry+0x1fa fffff880`0ab8ace0 fffff880`012cacf5 : fffffa80`0c7cce40 fffffa80`0c7cce40 fffff8a0`0a1eee01 00000000`00000000 : Ntfs!NtfsFindIndexEntry+0x5d fffff880`0ab8ad50 fffff880`01233a3d : fffffa80`0c7cce40 fffffa80`0b13f170 fffff880`0ab91370 fffffa80`0a821b00 : Ntfs!NtfsCommonCreate+0x7c5 fffff880`0ab8af30 fffff800`030ca777 : fffff880`0ab912e0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d fffff880`0ab8af60 fffff800`030ca738 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27 fffff880`0ab911b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue STACK_COMMAND: kb FOLLOWUP_IP: nt! ?? ::FNODOBFM::`string'+2959c fffff800`0313cd14 cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+2959c FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4f558b55 FAILURE_BUCKET_ID: X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+2959c BUCKET_ID: X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+2959c Followup: MachineOwner ---------
  2. Loading Dump File [D:\Kingston\BSODDmpFiles\obidon\Windows_NT6_BSOD_jcgriff2\041212-20560-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505 Machine Name: Kernel base = 0xfffff800`0305c000 PsLoadedModuleList = 0xfffff800`032a0650 Debug session time: Wed Apr 11 23:02:01.708 2012 (UTC - 6:00) System Uptime: 0 days 3:31:20.534 Loading Kernel Symbols ............................................................... ................................................................ ......................................... Loading User Symbols Loading unloaded module list .............. ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1904fb, fffff88009be8f68, fffff88009be87c0, fffff880012d9299} Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteFcb+489 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff88009be8f68 Arg3: fffff88009be87c0 Arg4: fffff880012d9299 Debugging Details: ------------------ EXCEPTION_RECORD: fffff88009be8f68 -- (.exr 0xfffff88009be8f68) ExceptionAddress: fffff880012d9299 (Ntfs!NtfsDeleteFcb+0x0000000000000489) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff88009be87c0 -- (.cxr 0xfffff88009be87c0) rax=fffff8a00b7095c0 rbx=fffff88009be9230 rcx=fffff8a00f94f541 rdx=fffff8a009c61f91 rsi=0002000000000000 rdi=fffffa800990d940 rip=fffff880012d9299 rsp=fffff88009be91a0 rbp=fffff88009be98a0 r8=fffff8a009c61f90 r9=0000000000000040 r10=fffff8000324f420 r11=fffff8a00b7095c0 r12=fffff8a00b748010 r13=fffffa800aa88180 r14=fffff88009be9221 r15=0000000000000000 iopl=0 nv up ei pl nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206 Ntfs!NtfsDeleteFcb+0x489: fffff880`012d9299 488b8e88000000 mov rcx,qword ptr [rsi+88h] ds:002b:00020000`00000088=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: adm.exe CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000330a100 ffffffffffffffff FOLLOWUP_IP: Ntfs!NtfsDeleteFcb+489 fffff880`012d9299 488b8e88000000 mov rcx,qword ptr [rsi+88h] FAULTING_IP: Ntfs!NtfsDeleteFcb+489 fffff880`012d9299 488b8e88000000 mov rcx,qword ptr [rsi+88h] BUGCHECK_STR: 0x24 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff880012d9299 STACK_TEXT: fffff880`09be91a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsDeleteFcb+0x489 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: Ntfs!NtfsDeleteFcb+489 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b STACK_COMMAND: .cxr 0xfffff88009be87c0 ; kb FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteFcb+489 BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteFcb+489 Followup: MachineOwner ---------
  1. The problem seems related to the Secunia PSI Agent (psia.exe). See if removing the Secunia PSI Agent provides more stability.
  2. This problem seems related to the Acronis Drive Monitor. Remove it to test.
My System SpecsSystem Spec
15 Apr 2012   #35
obidon

Windows 7 Professional x64
 
 

Quote   Quote: Originally Posted by writhziden View Post
[/list][/code]
  1. The problem seems related to the Secunia PSI Agent (psia.exe). See if removing the Secunia PSI Agent provides more stability.
  2. This problem seems related to the Acronis Drive Monitor. Remove it to test.
Ok I'll remove them but how can I test afterwards? And do you think these were causing the BSOD's or some other system unstability? Or was it affecting my Hard Disk Drive perhaps?
My System SpecsSystem Spec
15 Apr 2012   #36
writhziden

Windows 7 Home Premium 64 Bit
 
 

It appears to me that they were affecting how Windows utilizes the hard disk and NTFS. To test, just do your normal routine and see if Windows is stable.
My System SpecsSystem Spec
25 Apr 2012   #37
obidon

Windows 7 Professional x64
 
 

Well I got another BSOD with the error code as SYSTEM_SERVICE_EXCEPTION. What does this mean? So random I don't understand.

Should I attach anything else that would be of use? A System Reliability History Report perhaps? Thanks for continuing to help diagnose my system.
My System SpecsSystem Spec
25 Apr 2012   #38
writhziden

Windows 7 Home Premium 64 Bit
 
 

That is a new crash that you had not had yet from what I see in the thread. It usually indicates graphics card issues with either the drivers or the hardware itself.

Can you please upload the latest crash reports for analysis?
My System SpecsSystem Spec
26 Apr 2012   #39
obidon

Windows 7 Professional x64
 
 

Quote   Quote: Originally Posted by writhziden View Post
That is a new crash that you had not had yet from what I see in the thread. It usually indicates graphics card issues with either the drivers or the hardware itself.

Can you please upload the latest crash reports for analysis?
Ok what crash reports do you want exactly? Is it best to give a Reliability Monitor Report exported as an HTML, or the folder generated by the BSOD Dump & System File Collection application? Or something else?
My System SpecsSystem Spec
26 Apr 2012   #40
writhziden

Windows 7 Home Premium 64 Bit
 
 

Given the time in between, it probably would be best to follow the http://www.sevenforums.com/crashes-d...tructions.html and provide the full set of logs and reports.
My System SpecsSystem Spec
Reply

 Random BSOD's want to figure this out once and for all




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
bsod cant figure this one out
Hi and hello all, nice to be here. I'm getting blue screens on my newish pc, 2-3 months old and self built. I've built over 200 pc's but this is beating me so any help would be appreciated. OS is windows 7 x 64 enterprise edition. Looking at the dump files (which I'm no expert at) is...
BSOD Help and Support
Random shutdowns playing Mass Effect 2 (need to figure out what from)
Hi everyone, I recently reformatted my laptop and did the necessary steps in order to ensure everything was back on track. Unfortunately, yesterday when I tried to play Mass Effect 2 on Steam, my computer shut down without a BSOD or any other error message. I thought it might have been an...
BSOD Help and Support
Trying to figure out this BSOD
Please advise The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x0000000000000000, 0x0000000000000002, 0x0000000000000000, 0xfffff80003604477). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 082811-29499-01.
BSOD Help and Support
BSOD i cant figure out
Hi there, first time poster long time problem, i've been having BSOD for a few months now and it got to the point where i wiped my computer and everything seemed find for a few weeks until about an hour ago i got the same BSOD error from a few months ago i figure enough is enough its time for so...
BSOD Help and Support
Random BSOD can't figure it out! Been happening for a couple weeks now
I have had this computer, which I built myself, 2 years ago. I purchased and have been using the GPU for about 6 months i had a Sapphire Radeon HD4670 previously I purchased and have been using the CPU for 2 months I had an Athlon II 425 x3 (unlocked to a phenom II x4 from day one)...
BSOD Help and Support
BSOD help i cant figure it out HELP!!!
Hey guys i'm just recently getting a BSOD, it just began recently after i formatted (quick format it said it was recommended for windows )my hard drive with DBAN ( Dariks Nuke and Boot), possibly before i dont recall i was having some other problems before so i decided to do a quick format on...
BSOD Help and Support


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 05:38.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App