Windows 7: BSOD probably caused by Ntfs.sys, ntkrnlmp.exe, win32k.sys

jmt83 · 07 Jan 2013

Hello! I'm working with a Dell OptiPlex 580 running 64-bit Windows 7 Professional in a domain environment. This PC is two years old and essentially started to crash out of the box. I put up with it for about a year-and-a-half because the crashes were somewhat infrequent, maybe occuring every two to three weeks.

About three months ago I had become fed up and purchased a software support contract with Dell. Although I had performed multiple diagnostic tests on my own to search for hardware failure (never found any issues), they made me rerun those same tests to prove there were no hardware issues. After the diagnostics came back clean, they told me I would have to reformat the hard drive and reinstall windows (which had come installed OEM). They seemed to think Windows was corrupt and needed to be cleanly reinstalled. Seemed a pain to me since they were the ones who installed Windows in the first place, but I digress...

Despite following their instructions, the PC in question has experienced 6 BSOD since reformatting. So I guess whatever they thought the cause/cure would be, reinstalling Windows did not do the trick. I do not know if this means there is a driver issue or what? I did perform a quick bugcheck and it stated the crashes were probably caused by Ntfs.sys, ntkrnlmp.exe, and win32k.sys.

Any help would be greatly appreciated!

Thanks,
jmt83

Arc · 09 Jan 2013

Hello jmt83.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff96000029db5, fffff88007d811b0, 0}

Probably caused by : win32k.sys ( win32k!bDeleteFont+61 )

Followup: MachineOwner
---------

Download and install Driver Fusion.
Reboot the computer in Advanced Boot Options, safe mode. Search Driver Fusion in your start menu, and remove all components of your AMD/ATI display driver.
Boot normally now. Update your ATI/AMD display driver.
You can get it from the link in our forum, Latest AMD Catalyst Video Driver for Windows 7, or you may go to AMD Graphics Driver and Software and opt for Automatically Detect and Install the appropriate driver for your card.

During installation, you may opt for advanced installation, and install the display driver only, not the Catalyst Control Center. ** Install the WHQL drivers only, not any beta.

Let us know the results.

jmt83 · 13 Jan 2013

Arc,

Thanks for your help. Sorry for my delay in replying, but I haven't had time to start working on this until today. I followed your instructions and installed Driver Fusion. After attempting to delete all AMD drivers in Safe Mode, the program stated that it could not remove all drivers unless I upgraded to the premium version ($19.99). I wasn't excited about having to buy the software, but I figured if it worked, I could get through this quickly. The problem is, it didn't work. Every time I ran the program and tried to delete all AMD components, the same 111 entries remained after reboot.

The Driver Fusion forum is promising a new version in the next few days that will supposedly fix this. I am hopeful, but not exactly counting on it. Since I had removed only about half of what I was hoping to, I ran a System Restore on the PC to get it back to where it was yesterday. I will be watching the Driver Fusion forum to see when the supposed patch comes through. I've posted a link to the forum discussion below for anyone who might be interested.

Treexy Forum • View topic - Registry entries will not delete

Thanks again,
JMT83

Arc · 14 Jan 2013

As far as it it deleted by driver fusion, that is enough. Install the driver now, and see what happens there, if the crashes continue or not.

jmt83 · 19 Jan 2013

OK, so I followed your directions. I used Driver Fusion to remove all the AMD components that I could. I then downloaded a more recent version of the ATI Radeon HD 4200 display driver v 8.970.100.3000, released 7/12 (my previous version was v 8.850.0.0, released 4/11). I deselected everything I could, only wishing to install the display driver and passing on all the extras. I will keep an eye on this and let you know if it crashes again.

Thanks!

Arc · 19 Jan 2013

You are welcome. Let us know the situation.

jmt83 · 21 Jan 2013

Well, we had another crash this morning, just two days after running Driver Fusion and installing the video driver on Saturday. On top of that, a large number of e-mails that were moved into a subfolder in Outlook 2010 simply vanished today. Probably an altogether separate issue from these crashes, but just another typical problem with this particular computer. Anyways, the new data is attached. I hope you can see something from it that I cannot.

Thanks!

koolkat77 · 21 Jan 2013

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

RAM - Test with Memtest86+

Quote:

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

Information

Errors are sometimes found after 8 passes.

Tip

Do this test overnight, before going to bed.

jmt83 · 21 Jan 2013

koolkat77,

Thanks for your reply! May I ask, are you seeing something in the error codes that points towards bad RAM/motherboard, or is the Memtest86+ recommendation more a general suggestion that works as a good starting point for most BSOD issues? The reason I ask is that I took this PC home one weekend this summer and ran Memtest86+ for nearly the entire weekend with no failures. Of course, RAM that was good six months ago isn’t necessarily good now, so I am OK with running the program again to be sure. Just curious if you saw something in the logs that pointed towards bad memory.

I won’t have the time to dedicate to multiple runs until this weekend, but will do so then. And of course, I’m willing to test other things as well prior to this. Thanks again for replying!

JMT83

Arc · 22 Jan 2013

I guess so.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: fffff98010c85001
Arg3: 0000000000000000
Arg4: fffff780c0000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41284

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000293aa37 to fffff800028e3fc0

STACK_TEXT:  
fffff880`02faf428 fffff800`0293aa37 : 00000000`0000001a 00000000`00041284 fffff980`10c85001 00000000`00000000 : nt!KeBugCheckEx
fffff880`02faf430 fffff800`0289449e : 00000000`0000a881 fffff880`02faf528 00000000`00000000 fffff800`00000001 : nt! ?? ::FNODOBFM::`string'+0x4ac3
fffff880`02faf470 fffff800`02bf0819 : fffff980`10c85000 fffff8a0`152441e0 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x2b7bf
fffff880`02faf750 fffff800`02906a1b : 00000000`00140000 fffffa80`036c10f0 00000000`00000000 00000000`00200000 : nt!CcUnmapVacb+0x5d
fffff880`02faf790 fffff800`02927f14 : fffff8a0`11206001 fffffa80`03f72a00 fffffa80`039ce600 00000000`00000000 : nt!CcUnmapVacbArray+0x1bb
fffff880`02faf820 fffff800`028fcf39 : fffffa80`039ce6c0 fffffa80`039b55b0 fffffa80`03f72a00 00000000`00000000 : nt!CcDeleteSharedCacheMap+0x154
fffff880`02faf880 fffff880`012d520a : fffffa80`038ea180 fffff8a0`1455e140 00000000`00000001 00000000`00000000 : nt!CcUninitializeCacheMap+0x389
fffff880`02faf900 fffff880`012a5dc6 : 00000000`00000000 fffff800`02a81200 00000000`00000001 fffff8a0`1455e140 : Ntfs!NtfsDeleteInternalAttributeStream+0xea
fffff880`02faf950 fffff880`0121e7d0 : fffff8a0`1455e040 fffff8a0`1455e140 fffff800`02a81200 fffff8a0`0eae4b70 : Ntfs!NtfsRemoveScb+0xe2
fffff880`02faf990 fffff880`0121da7f : fffff8a0`1455e010 fffff800`02a81280 fffff880`02fafb01 fffffa80`06a185b0 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`02faf9c0 fffff880`012a36bc : fffffa80`06a185b0 fffffa80`038ea180 fffff8a0`0eae4b40 fffff8a0`0eae4ed8 : Ntfs!NtfsTeardownFromLcb+0x2af
fffff880`02fafa50 fffff880`012250b2 : fffffa80`06a185b0 fffffa80`06a185b0 fffff8a0`0eae4b40 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xcc
fffff880`02fafad0 fffff880`012b3223 : fffffa80`06a185b0 fffff800`02a81280 fffff8a0`0eae4b40 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`02fafb10 fffff880`012a23c7 : fffffa80`06a185b0 fffff8a0`0eae4c70 fffff8a0`0eae4b40 fffffa80`038ea180 : Ntfs!NtfsCommonClose+0x353
fffff880`02fafbe0 fffff800`028ed641 : 00000000`00000000 fffff800`02bd6500 fffffa80`037eb001 00000000`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`02fafcb0 fffff800`02b7ae5a : 00000000`00000000 fffffa80`037eb040 00000000`00000080 fffffa80`036d1040 : nt!ExpWorkerThread+0x111
fffff880`02fafd40 fffff800`028d4d26 : fffff880`009ec180 fffffa80`037eb040 fffff880`009f6f40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`02fafd80 00000000`00000000 : fffff880`02fb0000 fffff880`02faa000 fffff880`02faf7d0 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4ac3
fffff800`0293aa37 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4ac3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

FAILURE_BUCKET_ID:  X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4ac3

BUCKET_ID:  X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4ac3

Followup: MachineOwner
---------

Windows 7: BSOD probably caused by Ntfs.sys, ntkrnlmp.exe, win32k.sys

BSOD probably caused by Ntfs.sys, ntkrnlmp.exe, win32k.sys problems?