BSOD 0x0000000a, 0x000000c2, 0x00000019 and the most common 0x00000024

jaine · 11 Aug 2013

Hello,

I have these BSODs that occur frequently, at least once a week, usually more.

The computer I use is a bit old, but it has functioned well until these BSODs started to appear. I have changed the HDDs, first added the SSD, and the computer was fine for weeks with it, then replaced all the other existing HDDs with my HDDs (the computer belonged to my boyfriend). About a week after this the BSODs begun to appear.

The most common of them is 0x00000024 NFTS_FILE_SYSTEM caused by Ntfs.sys (+ntoskrnl.exe+75c00), but I've had at least these three too (as far as I can remember):

BAD_POOL_CALLER caused by fltmgr.sys
BAD_POOL_HEADER caused by Ntfs.sys
IRQL_NOT_LESS_OR_EQUAL caused by ntoskrnl.exe

The BSODs can appear at any time; I was watching videos from my hard drive, I was coding with putty on a remote server, I left my computer idle when I got to sleep or left the apartment... So far I haven't been able to find out a pattern with these BSODs.

Notes for the usual tutorial:

If you are overclocking any hardware, please stop. - I am not overclocking anything
If you have an SSD, make sure the following are up to date:

SSD firmware - Is up to date.

BIOS Version - Is up to date.

Chipset Drivers - As far as I have looked, they are up to date.

Hard disk controller drivers/SATA drivers - As far as I have looked, they are up to date.

Run all but the advanced tests with SeaTools for HDDs. - I did, all ok. I also ran HDDscan for all drives, all ok and chkdsk /r & /f for all drives, all ok.

Use FurMark - I couldn't, too old graphics.

Run the boot version of Memtest86+ - Ran it up to 30 hours, something 20+ passes without errors.

Also sfc /scannow did not find any integrity violations.

The things I haven't yet tried:

Running with only the SSD and the HDD that has the software, taking out the other two
Reinstalling Windows

I you want to contact me personally, I can be found in IRCnet by nick jaine

jaine@IRCnet

Arc · 11 Aug 2013

Hello Jaine.

F-Secure Gatekeeper has something to do with the BSODs.

Code:

fffff880`02fb7c10  fffff880`054fe601Unable to load image fsgk.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for fsgk.sys
*** ERROR: Module load completed but symbols could not be loaded for fsgk.sys
 fsgk+0xb601

Description here: Driver Reference Table - fsgk.sys

Uninstall F-Secure using F-Secure Uninstallation Tool Free Download.
Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Let us know the results.
________________________________________________________________________
BSOD ANALYSIS:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88002fb78d8, fffff88002fb7130, fffff880012a1e27}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonClose+1e7 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88002fb78d8
Arg3: fffff88002fb7130
Arg4: fffff880012a1e27

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88002fb78d8 -- (.exr 0xfffff88002fb78d8)
ExceptionAddress: fffff880012a1e27 (Ntfs!NtfsCommonClose+0x00000000000001e7)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88002fb7130 -- (.cxr 0xfffff88002fb7130)
rax=0200011200000001 rbx=fffffa80080e0a50 rcx=fffffa80088229c8
rdx=fffff8a00fb79c70 rsi=fffff8a00fb79b40 rdi=fffff88002fb7c38
rip=fffff880012a1e27 rsp=fffff88002fb7b10 rbp=fffff80002c32280
 r8=0000000000000000  r9=0000000000000009 r10=0000000000000004
r11=fffff88001262018 r12=fffffa8005be0180 r13=0000000000000000
r14=05c51bcf08000000 r15=0000000000000001
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
Ntfs!NtfsCommonClose+0x1e7:
fffff880`012a1e27 488908          mov     qword ptr [rax],rcx ds:002b:02000112`00000001=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  1

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cc4100
GetUlongFromAddress: unable to read from fffff80002cc41c0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsCommonClose+1e7
fffff880`012a1e27 488908          mov     qword ptr [rax],rcx

FAULTING_IP: 
Ntfs!NtfsCommonClose+1e7
fffff880`012a1e27 488908          mov     qword ptr [rax],rcx

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff8800129132b to fffff880012a1e27

STACK_TEXT:  
fffff880`02fb7b10 fffff880`0129132b : fffffa80`080e0a50 fffff8a0`0fb79c70 fffff8a0`0fb79b40 fffffa80`05be0180 : Ntfs!NtfsCommonClose+0x1e7
fffff880`02fb7be0 fffff800`02a96251 : 00000000`00000000 fffff800`02d84d00 fffff800`02c93801 0000059a`0000000d : Ntfs!NtfsFspClose+0x15f
fffff880`02fb7cb0 fffff800`02d2aede : 0000059a`00000000 fffffa80`054fe660 00000000`00000080 fffffa80`0548a890 : nt!ExpWorkerThread+0x111
fffff880`02fb7d40 fffff800`02a7d906 : fffff880`009e8180 fffffa80`054fe660 fffff880`009f2f40 0000059a`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`02fb7d80 00000000`00000000 : fffff880`02fb8000 fffff880`02fb2000 fffff880`02fb79e0 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsCommonClose+1e7

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5167f5fc

STACK_COMMAND:  .cxr 0xfffff88002fb7130 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsCommonClose+1e7

BUCKET_ID:  X64_0x24_Ntfs!NtfsCommonClose+1e7

Followup: MachineOwner
---------

jaine · 11 Aug 2013

Arc,
thanks for your advice!
I removed F-secure and installed Security Essentials and MBAM. So far, Security Essentials scan finished and found two threats; TrojanDownloader:ASX/Wimad.AS and TrojanClicker:ASX/Wimad.CS.
Now scanning with MBAM to see if it finds anything else.
I hope that this solves the problem, I will report later, but thanks in advance!

jaine · 11 Aug 2013

MBAM found Trojan.MSIL.Injector, which was also removed.
Any suggestions, what should I do next or do I just wait if a BSOD appears again?

VistaKing · 11 Aug 2013

jaine

If I were you I'd open a thread inside the System Security section of the forum .

jaine · 11 Aug 2013

Did what VistaKing said, opened a new thread: BSODs maybe caused by Trojans

jaine · 11 Aug 2013

Got another BSOD while running TDSSKiller, see attachments.

Arc · 12 Aug 2013

The problem appears to be with your motherboard-BIOS-Chipset environment.

The BSOD is caused by Ntfs.sys.

Code:

BugCheck 24, {1904fb, fffff88002fb08d8, fffff88002fb0130, fffff880012dce27}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonClose+1e7 )

Followup: MachineOwner
---------

It depends highly on storage controllers. And in your case, the storage controller is failing.

Code:

fffff880`02faf998  fffff880`00e33374Unable to load image nvstor.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvstor.sys
*** ERROR: Module load completed but symbols could not be loaded for nvstor.sys
 nvstor+0x19374

And those are real outdated.

Code:

fffff880`00e1a000 fffff880`00e45000   nvstor   T (no symbols)           
    Loaded symbol image file: nvstor.sys
    Image path: nvstor.sys
    Image name: nvstor.sys
    Timestamp:        Sat Mar 20 02:15:11 2010 (4BA3E257)
    CheckSum:         000291A5
    ImageSize:        0002B000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

No feasible update in http://www.asus.com/Motherboards/M2N...rt_Download_25

And, No Feasible BIOS update, too. Your BIOS ....

Code:

BiosMajorRelease = 8
BiosMinorRelease = 12
BiosVendor = American Megatrends Inc.
BiosVersion = 0807   
BiosReleaseDate = 03/27/2008
SystemManufacturer = System manufacturer
SystemProductName = System Product Name
SystemFamily = To Be Filled By O.E.M.
SystemVersion = System Version
SystemSKU = To Be Filled By O.E.M.
BaseBoardManufacturer = ASUSTeK Computer INC.
BaseBoardProduct = M2N DH
BaseBoardVersion = Rev 1.xx

..... is the latest as per Asus.

So, a feasible solution would be to replace the motherboard. So let us know about your windows version (is it really OEM or not).

jaine · 12 Aug 2013

Okay, thank you for the information.
My Windows 7 Professional x64 is from Dreamspark, paid by my school, so it is genuine.

jaine · 25 Aug 2013

BSOD once again, attached the SF Diagnostics zip. Found something suspicious with malwarebytes, and removed them. After that all has worked well, but I would like to know what info can you get from the dump files.