BSOD soon after boot. Dump files attached.

Page 1 of 3 123 LastLast

  1. Posts : 57
    7
       #1

    BSOD soon after boot. Dump files attached.


    Hi

    I have been given a laptop that has never worked correctly. It's pretty much unused, but crashes soon after booting. I have run a CHKDSK and no errors were found.

    The dump files are attached - any help will be much appreciated.
      My Computer


  2. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #2

    upload your MSINFO32.nfo file.

    1. Click on the start button
    2. Type "msinfo32" (without quotes) in the search bar of the start menu, click the resulting link. It will open the System Information window.
    3. File>Save. In the "File Name" filed, put "MSINFO32" (without Quote), give the save location to desktop, and click the "save" button.
    4. Give the time for processing, it will save a .nfo file on your desktop.
    5. Zip it, and upload it following the instruction.

    Stop 0x50, Ntfs
      My Computer


  3. Posts : 57
    7
    Thread Starter
       #3

    It has taken me days to get this as it keeps crashing before it's finished.

    Anyway, here it is:Attachment 279207
      My Computer


  4. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #4

    A few crash dumps are not executable at all, those are incomplete. The BSODs occurred before you got the desktop.

    Those we car read are stop 0x50 with Ntfs.sys as a probable cause.

    In this situation, I would suggest you to do some Disc checks. Seatool for dos: SeaTools | Seagate download

    • Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.
    • You can use Win32 DiscImager to create a bootable USB and run Seatools for DOS. Follow this post to know how to make a bootable Seatools USB.

    At the same time, I would suggest you for a few more things.

    Test your RAM modules for possible errors.
    How to Test and Diagnose RAM Issues with Memtest86+
    Run memtest for at least 8 passes, preferably overnight.

    Uninstall Kaspersky using Kaspersky Removal Tool. At least as a test. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
    Download, install and update those, and then run full system scans with both of them, one by one.

    Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

    1. Click on the Start button
    2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
    3. Select the “Startup” tab.
    4. Deselect all items other than the antivirus.
    5. Apply > OK
    6. Accept then restart.

    Let us know the result.
    _____________________________________________________________________
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 50, {fffff98113042698, 0, fffff8800162b460, 5}
    
    
    Could not read faulting driver name
    *** WARNING: Unable to verify timestamp for win32k.sys
    *** ERROR: Module load completed but symbols could not be loaded for win32k.sys
    Probably caused by : Ntfs.sys ( Ntfs!memcpy+250 )
    
    Followup: MachineOwner
    ---------
    
    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffff98113042698, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff8800162b460, If non-zero, the instruction address which referenced the bad memory
        address.
    Arg4: 0000000000000005, (reserved)
    
    Debugging Details:
    ------------------
    
    
    Could not read faulting driver name
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ebe100
    GetUlongFromAddress: unable to read from fffff80002ebe1c0
     fffff98113042698 
    
    FAULTING_IP: 
    Ntfs!memcpy+250
    fffff880`0162b460 488b440af8      mov     rax,qword ptr [rdx+rcx-8]
    
    MM_INTERNAL_CODE:  5
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    BUGCHECK_STR:  0x50
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    TRAP_FRAME:  fffff88003784da0 -- (.trap 0xfffff88003784da0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000020 rbx=0000000000000000 rcx=fffff981130426c8
    rdx=ffffffffffffffd8 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff8800162b460 rsp=fffff88003784f38 rbp=fffff98013042718
     r8=00000000ffffff68  r9=0000000007fffffb r10=0000000000000001
    r11=fffff98013042760 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    Ntfs!memcpy+0x250:
    fffff880`0162b460 488b440af8      mov     rax,qword ptr [rdx+rcx-8] ds:fffff981`13042698=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80002c35f0f to fffff80002c8f1c0
    
    STACK_TEXT:  
    fffff880`03784c38 fffff800`02c35f0f : 00000000`00000050 fffff981`13042698 00000000`00000000 fffff880`03784da0 : nt!KeBugCheckEx
    fffff880`03784c40 fffff800`02c8d2ee : 00000000`00000000 fffff981`13042698 00000000`00000000 00000000`00000028 : nt! ?? ::FNODOBFM::`string'+0x43d51
    fffff880`03784da0 fffff880`0162b460 : fffff880`016b75a8 00000000`00000028 fffff880`03784f90 fffff8a0`00000400 : nt!KiPageFault+0x16e
    fffff880`03784f38 fffff880`016b75a8 : 00000000`00000028 fffff880`03784f90 fffff8a0`00000400 00000000`00000001 : Ntfs!memcpy+0x250
    fffff880`03784f40 fffff880`016b7740 : fffff8a0`0444fdb0 fffff800`02e2c280 fffff8a0`0444fdb0 fffff980`13042400 : Ntfs!NtfsRestartInsertSimpleRoot+0x50
    fffff880`03784f80 fffff880`016dba2f : fffffa80`09110470 fffffa80`099bc180 fffff880`03785118 fffff880`03785150 : Ntfs!InsertSimpleRoot+0xb8
    fffff880`03785050 fffff880`01692d3b : 00000000`00000000 fffff8a0`0444fdb0 fffff880`03785118 fffff880`037851a8 : Ntfs!AddToIndex+0xcf
    fffff880`037850d0 fffff880`016aeda5 : fffffa80`09110470 fffff8a0`0444fdb0 fffff8a0`040360d8 fffffa80`00000000 : Ntfs!NtOfsAddRecords+0x167
    fffff880`037852b0 fffff880`016df520 : fffffa80`09110470 fffff8a0`040360d0 00000000`00038968 00000000`00038970 : Ntfs!GetSecurityIdFromSecurityDescriptorUnsafe+0x1fd
    fffff880`03785360 fffff880`0168e532 : fffffa80`09110470 fffffa80`099bc180 00000000`00000000 fffff980`13042d00 : Ntfs!NtfsCacheSharedSecurityByDescriptor+0xa0
    fffff880`037853b0 fffff880`016a65ed : fffffa80`09110470 fffffa80`099bc180 fffff800`02e2c280 00000000`00000000 : Ntfs! ?? ::NNGAKEGL::`string'+0x11530
    fffff880`03785430 fffff880`01639b0c : fffffa80`09110470 fffff880`01663a00 fffffa80`09110470 fffff8a0`04546680 : Ntfs!NtfsUpdateFcbInfoFromDisk+0x4fe
    fffff880`03785580 fffff880`01704592 : fffffa80`09110470 00000000`00000000 00000000`00000000 fffff8a0`04546680 : Ntfs!NtfsInitializeDirectory+0x254
    fffff880`03785690 fffff880`016fe3fa : fffffa80`09110470 fffffa80`099bc180 00000000`00000000 fffffa80`099bc180 : Ntfs!NtfsInitializeExtendDirectory+0x3d6
    fffff880`03785850 fffff880`0169980d : 00000000`00000000 fffffa80`044bc010 00000000`00000001 00000000`00000000 : Ntfs!NtfsMountVolume+0x1691
    fffff880`03785b90 fffff880`01620985 : 00000000`00000000 00000000`00000000 fffffa80`09110470 fffff800`02c967d3 : Ntfs!NtfsCommonFileSystemControl+0x59
    fffff880`03785bd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsFspDispatch+0x2ad
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    Ntfs!memcpy+250
    fffff880`0162b460 488b440af8      mov     rax,qword ptr [rdx+rcx-8]
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  Ntfs!memcpy+250
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: Ntfs
    
    IMAGE_NAME:  Ntfs.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b
    
    FAILURE_BUCKET_ID:  X64_0x50_Ntfs!memcpy+250
    
    BUCKET_ID:  X64_0x50_Ntfs!memcpy+250
    
    Followup: MachineOwner
    ---------
    
    2: kd> lmvm Ntfs
    start             end                 module name
    fffff880`0161d000 fffff880`017c0000   Ntfs       (pdb symbols)          c:\symbols\ntfs.pdb\D51347AE03CB4523A2844EA865BA0BE92\ntfs.pdb
        Loaded symbol image file: Ntfs.sys
        Mapped memory image file: c:\symbols\Ntfs.sys\4D79997B1a3000\Ntfs.sys
        Image path: \SystemRoot\System32\Drivers\Ntfs.sys
        Image name: Ntfs.sys
        Timestamp:        Fri Mar 11 09:09:39 2011 (4D79997B)
        CheckSum:         0019968A
        ImageSize:        001A3000
        File version:     6.1.7601.17577
        Product version:  6.1.7601.17577
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        3.7 Driver
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     ntfs.sys
        OriginalFilename: ntfs.sys
        ProductVersion:   6.1.7601.17577
        FileVersion:      6.1.7601.17577 (win7sp1_gdr.110310-1504)
        FileDescription:  NT File System Driver
        LegalCopyright:   © Microsoft Corporation. All rights reserved.
      My Computer


  5. Posts : 57
    7
    Thread Starter
       #5

    Thanks for your help!
      My Computer


  6. Posts : 57
    7
    Thread Starter
       #6

    Hi again.

    I'm running into problems trying to do this with Windows 8.

    IU have downloaded the SeaTools for DOS ISO and installed Win32 DiscImager. When I run DiscImager, it doesn't see the ISO in the Downloads folder or the copy of it on the desktop.

    Windows 8 can burn ISOs natively so I double clicked SeaTools and copied all files to disc, but it doesn't appear to be bootable. I have set the laptop to boot from DVD, but it boots straight to Windows 7.

    What am I doing wrong?
      My Computer


  7. Posts : 57
    7
    Thread Starter
       #7

    Aha - I see Win32 DiscImager is looking for .img files and doesn't appear to be able to use ISO files.
      My Computer


  8. Posts : 57
    7
    Thread Starter
       #8

    OK - read the documentation for SeaTools and am now burning through WIn* explorer.

    I'll let you know if I run into more problems (and I'm sure I will).
      My Computer


  9. Posts : 57
    7
    Thread Starter
       #9

    Results:

    SeaTools finished with no errors.
    Memtestx86. See attached image - I don't know how to save the results.

    BTW - Anti-virus was Norton and removed through control panel.
      My Computer


  10. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #10

    So it appears that teh RAM/s is/are faulty. You may either go to the part three of the tutorial How to Test and Diagnose RAM Issues with Memtest86+ to check which module is failing actually.

    Errors/red lines means one or more RAM is faulty. But the fault may occur due to a faulty DIMM slot, too, which is a motherboard component. Using memtest86+, you can discriminate between a faulty RAM and a faulty motherboard.

    How? Say you have two RAM sticks and two DIMM slots. You obtained errors at the test with all RAM sticks installed. Now, remove all the sticks but one. Test it in all the available slots, one by one. Continue the same procedure for all the available sticks.
    How to make the inference that is it a RAM issue or it is a motherboard issue? Suppose you have got the result like that:
    No code has to be inserted here. It is a RAM, a bad RAM.

    But if you have got a result like that:
    No code has to be inserted here. It is a motherboard issue. The particular slot is bad.

    Or, change the RAM if it is within warranty.

    Let us know the results.
      My Computer


 
Page 1 of 3 123 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 10:51.
Find Us