Windows 7: Strange BSOD crash

Kaiser · 22 Jun 2010

Hello

I'm suffering from a strange bsod which occurs shortly after windows has loaded and the startup programs are loading on the start screen.

The strange thing is everything boots/pc works fine after I do a hard restart through the power supply. Without a hard restart the pc repeats it's cycle of bsods after each crash and restart.

I have included the dump files below, bluescreen view tells me it's caused by ntoskrnl.exe which is part of windows. I have tested the memory with memtest and get no errors though I'm going to test longer with more passes.

I've done a fresh install twice but get the same problem. I've been told I should install windows 7 (64) without having my secondary drives installed as this can cause a conflict initially.

Any help or a push in the right direction on how to solve this problem would be most appreciated.

Thanks

CarlTR6 · 22 Jun 2010

Hi Kaiser and welcome to the forums. I am looking at the dmps now.

Two of the dumps are very similar with stop errors of 50. The other is a stop error A. All of these point to hardware issues.

Quote:

STOP 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA

Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS

BSOD Index

STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL

Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

BSOD Index

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\Owner\Downloads\062010-18860-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a4b000 PsLoadedModuleList = 0xfffff800`02c88e50
Debug session time: Sun Jun 20 10:02:06.341 2010 (GMT-4)
System Uptime: 0 days 0:01:16.621

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa8084f0925c, 1, fffff8800121780c, 5}


Could not read faulting driver name
Probably caused by : Ntfs.sys ( Ntfs!NtfsDecrementCloseCounts+2c )

Followup: MachineOwner
---------

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa8084f0925c, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff8800121780c, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cf30e0
 fffffa8084f0925c 

FAULTING_IP: 
Ntfs!NtfsDecrementCloseCounts+2c
fffff880`0121780c f08380dc000000ff lock add dword ptr [rax+0DCh],0FFFFFFFFh

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88003185940 -- (.trap 0xfffff88003185940)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8084f09180 rbx=0000000000000000 rcx=fffffa800666b2e0
rdx=fffff8a001d0eba0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800121780c rsp=fffff88003185ad0 rbp=fffff80002c605a0
 r8=fffff8a001d0ee08  r9=0000000000000000 r10=fffff8a001d0ea70
r11=fffff88003185b52 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr ac po cy
Ntfs!NtfsDecrementCloseCounts+0x2c:
fffff880`0121780c f08380dc000000ff lock add dword ptr [rax+0DCh],0FFFFFFFFh ds:e560:fffffa80`84f0925c=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002b3a801 to fffff80002abb600

STACK_TEXT:  
fffff880`031857d8 fffff800`02b3a801 : 00000000`00000050 fffffa80`84f0925c 00000000`00000001 fffff880`03185940 : nt!KeBugCheckEx
fffff880`031857e0 fffff800`02ab96ee : 00000000`00000001 fffffa80`0666b2e0 fffff880`03185900 fffff880`0129c0b8 : nt! ?? ::FNODOBFM::`string'+0x40ecb
fffff880`03185940 fffff880`0121780c : fffffa80`0666b2e0 fffffa80`00000001 fffff8a0`01d0eba0 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`03185ad0 fffff880`012b0813 : fffffa80`0666b2e0 fffff800`02c605a0 fffff8a0`01d0ea70 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0x2c
fffff880`03185b10 fffff880`0128a38f : fffffa80`0666b2e0 fffff8a0`01d0eba0 fffff8a0`01d0ea70 fffffa80`04f09180 : Ntfs!NtfsCommonClose+0x353
fffff880`03185be0 fffff800`02ac8861 : 00000000`00000000 fffff800`02db8800 fffffa80`03d23601 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`03185cb0 fffff800`02d60a86 : 00049ee9`c000000d fffffa80`03d23680 00000000`00000080 fffffa80`03ced890 : nt!ExpWorkerThread+0x111
fffff880`03185d40 fffff800`02a99b06 : fffff880`02f63180 fffffa80`03d23680 fffff880`02f6dfc0 0003fbe9`30247c89 : nt!PspSystemThreadStartup+0x5a
fffff880`03185d80 00000000`00000000 : fffff880`03186000 fffff880`03180000 fffff880`031859f0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsDecrementCloseCounts+2c
fffff880`0121780c f08380dc000000ff lock add dword ptr [rax+0DCh],0FFFFFFFFh

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  Ntfs!NtfsDecrementCloseCounts+2c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

FAILURE_BUCKET_ID:  X64_0x50_Ntfs!NtfsDecrementCloseCounts+2c

BUCKET_ID:  X64_0x50_Ntfs!NtfsDecrementCloseCounts+2c

Followup: MachineOwner
---------

Mini Kernel Dump File: Only registers and stack trace are available

Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a01000 PsLoadedModuleList = 0xfffff800`02c3ee50
Debug session time: Tue Jun 22 08:47:25.942 2010 (GMT-4)
System Uptime: 0 days 0:01:07.848
Loading Kernel Symbols
...............................................................

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa8002e07010, 2, 1, fffff80002a876e1}

Probably caused by : memory_corruption ( nt!MmCreateKernelStack+e6 )

Followup: MachineOwner
---------

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa8002e07010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002a876e1, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ca90e0
 fffffa8002e07010 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MmCreateKernelStack+e6
fffff800`02a876e1 49891cd2        mov     qword ptr [r10+rdx*8],rbx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  TrustedInstall

TRAP_FRAME:  fffff88009506490 -- (.trap 0xfffff88009506490)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff980059db400 rbx=0000000000000000 rcx=0000000000000000
rdx=000000000000007c rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002d788f1 rsp=fffff88009506620 rbp=0000000000000000
 r8=0000000000000012  r9=0000000000000000 r10=00000000fffffff9
r11=0000000001f1b400 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po cy
nt!CcMapData+0x111:
fffff800`02d788f1 0fb600          movzx   eax,byte ptr [rax] ds:fffff980`059db400=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002a70b69 to fffff80002a71600

STACK_TEXT:  
fffff880`095056a8 fffff800`02a70b69 : 00000000`0000000a fffffa80`02e07010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`095056b0 fffff800`02a6f7e0 : 00000000`00000000 fffffa80`071bb691 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`095057f0 fffff800`02a876e1 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`04ead180 : nt!KiPageFault+0x260
fffff880`09505980 fffff800`02a80eb4 : fffff880`09505c00 fffffa80`071bb690 fffff880`09505f50 fffffa80`04cf2900 : nt!MmCreateKernelStack+0xe6
fffff880`09505a60 fffff880`01231b69 : fffff880`01233534 fffff880`09505b78 00000000`00001000 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0x244
fffff880`09505b40 fffff880`01231036 : fffffa80`04cf1d80 00000000`00000000 fffffa80`04cf2900 00000000`00000000 : Ntfs!NtfsMultipleAsync+0xa9
fffff880`09505bb0 fffff880`01234526 : fffff880`09505f50 fffffa80`073a0890 fffffa80`04cf2900 00000000`00000000 : Ntfs!NtfsNonCachedIo+0x216
fffff880`09505d80 fffff880`01236f78 : fffff880`09505f50 fffffa80`073a0890 fffff880`09506001 fffffa80`0739a001 : Ntfs!NtfsCommonRead+0x7a6
fffff880`09505f20 fffff880`00d8223f : fffffa80`073a0c30 fffffa80`073a0890 fffffa80`0739a010 00000000`00000001 : Ntfs!NtfsFsdRead+0x1b8
fffff880`09506120 fffff880`00d806df : fffffa80`04cff8e0 fffffa80`073a0890 fffffa80`04cff800 fffffa80`073a0890 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`095061b0 fffff800`02a630f2 : fffffa80`073a08b0 fffffa80`04cf5d50 00000000`00000043 fffff980`059db400 : fltmgr!FltpDispatch+0xcf
fffff880`09506210 fffff800`02a633f5 : fffff6fc`00100000 fffff6fc`00100000 fffff880`095062d0 fffff800`02d67c90 : nt!IoPageRead+0x252
fffff880`095062a0 fffff800`02a8c4a4 : 00000000`00000000 00000000`00000000 ffffffff`ffffffff fffff8a0`07452900 : nt!MiIssueHardFault+0x255
fffff880`09506330 fffff800`02a6f6ee : 00000000`00000000 00000000`0000000e 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0x11c4
fffff880`09506490 fffff800`02d788f1 : 00000000`03f00000 00000000`03f1b400 fffff880`095066e8 fffff880`095066e0 : nt!KiPageFault+0x16e
fffff880`09506620 fffff880`012e2522 : fffffa80`00024c00 fffffa80`03d556e0 fffff880`09506700 fffffa80`0000000e : nt!CcMapData+0x111
fffff880`095066e0 fffff880`012d84dc : fffffa80`06076e40 fffffa80`04ead180 fffff8a0`07458018 00000000`00000801 : Ntfs!NtfsReadMftRecord+0xb2
fffff880`09506790 fffff880`012a74aa : fffffa80`04eae858 fffff8a0`07458000 fffffa80`0569c800 00000000`00000000 : Ntfs!NtfsLookupInFileRecord+0x6c
fffff880`09506820 fffff880`012a9df2 : fffffa80`06076e40 fffff8a0`07458014 fffffa80`06076e40 fffff8a0`07458010 : Ntfs!NtfsUpdateFcbInfoFromDisk+0xaa
fffff880`09506970 fffff880`012cdb04 : fffff880`09445ad0 fffffa80`0569c800 fffffa80`06076e40 00000000`00000000 : Ntfs!NtfsOpenFile+0x2c6
fffff880`09506b50 fffff880`01236c0d : fffffa80`06076e40 fffffa80`0569c800 fffff880`09445ad0 fffffa80`071bb600 : Ntfs!NtfsCommonCreate+0xc54
fffff880`09506d30 fffff800`02a69487 : fffff880`09445a40 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`09506d60 fffff800`02a69441 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27
fffff880`09445910 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MmCreateKernelStack+e6
fffff800`02a876e1 49891cd2        mov     qword ptr [r10+rdx*8],rbx

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MmCreateKernelStack+e6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MmCreateKernelStack+e6

BUCKET_ID:  X64_0xA_nt!MmCreateKernelStack+e6

Followup: MachineOwner
---------

JMH · 22 Jun 2010

Quote: Originally Posted by Kaiser

Hello

I'm suffering from a strange bsod which occurs shortly after windows has loaded and the startup programs are loading on the start screen.

The strange thing is everything boots/pc works fine after I do a hard restart through the power supply. Without a hard restart the pc repeats it's cycle of bsods after each crash and restart.

I have included the dump files below, bluescreen view tells me it's caused by ntoskrnl.exe which is part of windows. I have tested the memory with memtest and get no errors though I'm going to test longer with more passes.

I've done a fresh install twice but get the same problem. I've been told I should install windows 7 (64) without having my secondary drives installed as this can cause a conflict initially.

Any help or a push in the right direction on how to solve this problem would be most appreciated.

Thanks

Hi Kaiser and welocme

These three crashes appear to have 2 different causes but both relate back to memory. In one memory was the direct cause. In the other two win OS files were implicated. I believe the debugger just pointed incorrectly to the OS. The usual cause of the last two are
Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS

Because memory was listed as one of the usual causes I would run memtest for at least 7 passes

In the interim I would also run a system file check to verify and repair any OS problems.

Let us know if you need assistance

Jan

Code:

Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Tue Jun 22 08:47:25.942 2010 (GMT-4)
System Uptime: 0 days 0:01:07.848
BugCheck A, {fffffa8002e07010, 2, 1, fffff80002a876e1}
Probably caused by : memory_corruption ( nt!MmCreateKernelStack+e6 )
BUGCHECK_STR:  0xA
PROCESS_NAME:  TrustedInstall
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Mon Jun 21 08:23:09.997 2010 (GMT-4)
System Uptime: 0 days 0:00:49.902
BugCheck 50, {fffff8a0827a8a30, 0, fffff880012f4173, 5}
Probably caused by : Ntfs.sys ( Ntfs!NtfsFcbTableCompare+3 )
BUGCHECK_STR:  0x50
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sun Jun 20 10:02:06.341 2010 (GMT-4)
System Uptime: 0 days 0:01:16.621
BugCheck 50, {fffffa8084f0925c, 1, fffff8800121780c, 5}
Probably caused by : Ntfs.sys ( Ntfs!NtfsDecrementCloseCounts+2c )
BUGCHECK_STR:  0x50
PROCESS_NAME:  System

CarlTR6 · 22 Jun 2010

You have one very old driver that can well be causing problems. it is a know cause of BSOD's:

ASACPI.sys Mar 27 2005

After you test your memory as JMH suggested, update this Asus driver and reboot. You may find your problem is solved. Try this link - Asus Support - ASUSTeK Computer Inc.-Support-

Please post back with the results of the memory test and with your results after you update this driver.

Jonathan_King · 22 Jun 2010

I suspect the problem is with ASACPI.sys. Please read this post for instructions on updating it: BSOD + Minidumps, please help

Code:

ASACPI.sys   Sun Mar 27 22:30:36 2005

EDIT: Sorry Carl, I left the tab open and posted w/o refreshing.

CarlTR6 · 22 Jun 2010

No problem, Jonathan; I did the same thing to Jan.

zigzag3143 · 22 Jun 2010

And I was about to do the same thing to you both nice teamwork

CarlTR6 · 22 Jun 2010

Thank you, ZigZag. It is nice to see that we are all on the same page.

Kaiser · 23 Jun 2010

Hi

I ran system file check and it repaired what files it could and provided a list of one's it couldn't.

Ran memtest for 7 passes which gave no errors, I replaced ASACPI.sys with the updated version.

So I booted today and It seemed to get rid of the bsod i was suffering at startup, though a few startup programs did not load and shutdown. (Java and Steam).
Unfortunately after a hour or so I suffered another BSOD, after restart windows automatically ran CHKDSK which repaired a few files, after windows loaded I ran into a host of errors, windows explorer stopped working/shutdown, ATI catalyst etc...

Bluescreen showed the bsod to be Memory Management so I ran memtest without doing a hard restart from the power supply and this time I received red errors. So I'm back to doing to doing a hard restart from the PS to get the PC working in a usable state. I have included the latest dump below, I think my next step is to return my memory to the vendor.

I don't get why after a hard restart everything seems rock stable/loads/no errors, it's only after I shutdown for the day and cold boot the following day do I get problems. I will do another round of memtest to see if I get errors after a hard restart following the earlier errors.

Thanks

Kaiser

Jonathan_King · 23 Jun 2010

Try shutting down your computer, leaving it off for several hours, and then immediately running Memtest on it.

You may try increasing your RAM voltage slightly.

Windows 7: Strange BSOD crash

Strange BSOD crash problems?