Windows 7: BSOD, Dump Provided

telarium · 27 Jun 2010

Ok, I wiped the drive and put on a fresh install of Windows 7. It never even touched a mouse before it crashed. (I did install a mouse AFTER it crashed, to facilitate in getting the dump file).

ttran · 27 Jun 2010

Quote:

Others of the BOSD team may well drop by and pick it up.

oh right Carl, I jump in

The stop code is 24, this is usally hard drive issue. Also, ntfs.sys is hard drive controller driver. Therefore I would suggest you to run a disk check and Hard drive diagnostic to find out if there is any problems with the hard drive.
Disk Check
HD Diagnostic

Code:

BugCheck 24, {1904fb, fffff880047f2718, fffff880047f1f70, fffff880012f7c27}

Probably caused by : Ntfs.sys ( Ntfs!NtfsFindPrefixHashEntry+1fe )

Followup: MachineOwner
---------

Also, run this free malware check:
Malwarebytes
Then, system file check
SFC /SCANNOW Command - System File Checker

Regard
Tuấn

telarium · 27 Jun 2010

Used the SeaTools Utility for Seagate drives. Ran a comprehensive test on the drive, it passed.

Formatted the drive via the utility to ensure everything was o.k. -- threw Windows 7 back on.

No dice, still crashing...

Latest dumps..

CarlTR6 · 27 Jun 2010

The first dmp is a repeat of the stop error 4E; the scond shows stop error 50.

Quote:

STOP 0x0000004E: PFN_LIST_CORRUPT

Usual causes: Device driver, ?memory
BSOD Index

STOP 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA

Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS
BSOD Index

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\Downloads\062710-19359-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`0285c000 PsLoadedModuleList = 0xfffff800`02a99e50
Debug session time: Sun Jun 27 17:12:43.100 2010 (GMT-4)
System Uptime: 0 days 0:28:20.256
Loading Kernel Symbols
...............................................................
................................................................
......
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 422b6, 2, 55675}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000422b6, page frame number
Arg3: 0000000000000002, current page state
Arg4: 0000000000055675, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  mscorsvw.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff8000295c2bc to fffff800028cc600

STACK_TEXT:  
fffff880`066cd778 fffff800`0295c2bc : 00000000`0000004e 00000000`00000099 00000000`000422b6 00000000`00000002 : nt!KeBugCheckEx
fffff880`066cd780 fffff800`0293e5e9 : 00000000`00000000 fffff680`000d8cb8 00000000`00000000 fffffa80`01ae9ad8 : nt!MiBadShareCount+0x4c
fffff880`066cd7c0 fffff800`028fd251 : fffff700`01080000 fffff680`000d8cf8 fffffa80`01ae9740 00000000`000006f8 : nt! ?? ::FNODOBFM::`string'+0x31f13
fffff880`066cd970 fffff800`0290dfca : 00000000`00000000 00000000`1b19ffff fffffa80`00000000 fffffa80`00000000 : nt!MiDeleteVirtualAddresses+0x408
fffff880`066cdb30 fffff800`028cb853 : ffffffff`ffffffff 00000000`001aaae8 00000000`001aaae0 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`066cdc20 00000000`77a8ff3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`001aaaa8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a8ff3a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`0295c2bc cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\Downloads\062710-14437-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02810000 PsLoadedModuleList = 0xfffff800`02a4de50
Debug session time: Sun Jun 27 17:44:23.852 2010 (GMT-4)
System Uptime: 0 days 0:30:50.008
Loading Kernel Symbols
...............................................................
................................................................
......
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffffffffffbb0, 0, fffff8000289c27c, 0}


Could not read faulting driver name
Probably caused by : cng.sys ( cng!GatherRandomKey+22c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffffffffffbb0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8000289c27c, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ab80e0
 fffffffffffffbb0 

FAULTING_IP: 
nt!ObReferenceObjectSafe+c
fffff800`0289c27c 498b02          mov     rax,qword ptr [r10]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800318df90 -- (.trap 0xfffff8800318df90)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800179ff48 rbx=0000000000000000 rcx=fffffffffffffbe0
rdx=fffff80002ab8900 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000289c27c rsp=fffff8800318e120 rbp=fffff8800318e700
 r8=00000000fffffffb  r9=fffffa80017a4090 r10=fffffffffffffbb0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!ObReferenceObjectSafe+0xc:
fffff800`0289c27c 498b02          mov     rax,qword ptr [r10] ds:9e30:ffffffff`fffffbb0=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002900e54 to fffff80002880600

STACK_TEXT:  
fffff880`0318de28 fffff800`02900e54 : 00000000`00000050 ffffffff`fffffbb0 00000000`00000000 fffff880`0318df90 : nt!KeBugCheckEx
fffff880`0318de30 fffff800`0287e6ee : 00000000`00000000 ffffffff`fffffbe0 00000000`00000000 fffff800`02b29b33 : nt! ?? ::FNODOBFM::`string'+0x42877
fffff880`0318df90 fffff800`0289c27c : 00000000`00000000 fffff8a0`03696778 fffff8a0`03696678 00000000`000099a0 : nt!KiPageFault+0x16e
fffff880`0318e120 fffff800`02b18966 : 00000000`00000000 fffffa80`0179ff48 fffffa80`0179ff48 fffff8a0`03696378 : nt!ObReferenceObjectSafe+0xc
fffff880`0318e150 fffff800`02b7ed06 : fffff8a0`0368d0a8 fffff800`0001ff58 fffff880`0318e2e0 00000000`00000000 : nt!ExpGetProcessInformation+0x498
fffff880`0318e2a0 fffff800`02b80149 : fffff8a0`0368d0a8 fffffa80`6365734b 00000000`00000000 fffff880`0318ec20 : nt!ExpQuerySystemInformation+0xf14
fffff880`0318e640 fffff800`0287f853 : fffff880`0318e710 fffff800`0287e7fd 00000000`00000001 fffffa80`024ee880 : nt!NtQuerySystemInformation+0x4d
fffff880`0318e680 fffff800`0287bdf0 : fffff880`01121a9c fffff8a0`06c60000 fffff880`0318e844 00000000`6365734b : nt!KiSystemServiceCopyEnd+0x13
fffff880`0318e818 fffff880`01121a9c : fffff8a0`06c60000 fffff880`0318e844 00000000`6365734b fffffa80`00000001 : nt!KiServiceLinkage
fffff880`0318e820 fffff880`0112156d : fffffa80`024ee880 00000000`00000000 fffff800`20206f49 fffff800`0288b1c1 : cng!GatherRandomKey+0x22c
fffff880`0318ebe0 fffff800`02b7d841 : 00000000`00000000 fffffa80`019588a0 fffffa80`019588a0 fffffa80`01734b60 : cng!scavengingWorkItemRoutine+0x3d
fffff880`0318ec80 fffff800`0288d861 : fffff800`02a25500 fffff800`02b7d804 fffffa80`01734b60 00000000`00000000 : nt!IopProcessWorkItem+0x3d
fffff880`0318ecb0 fffff800`02b25a86 : 00c6054a`40148c0c fffffa80`01734b60 00000000`00000080 fffffa80`016ab9e0 : nt!ExpWorkerThread+0x111
fffff880`0318ed40 fffff800`0285eb06 : fffff880`02fd3180 fffffa80`01734b60 fffff880`02fddfc0 08861204`0040d080 : nt!PspSystemThreadStartup+0x5a
fffff880`0318ed80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
cng!GatherRandomKey+22c
fffff880`01121a9c 83ff20          cmp     edi,20h

SYMBOL_STACK_INDEX:  9

SYMBOL_NAME:  cng!GatherRandomKey+22c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: cng

IMAGE_NAME:  cng.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc814

FAILURE_BUCKET_ID:  X64_0x50_cng!GatherRandomKey+22c

BUCKET_ID:  X64_0x50_cng!GatherRandomKey+22c

Followup: MachineOwner
---------

I found one driver that should be updated:

amdxata.sys Tue May 19 13:56:59 2009 (4A12F2EB)

Amdxata.sys with description Storage Filter Driver is a driver file from company Advanced Micro Devices belonging to product Storage Filter Driver.

You have checked your RAM and you know that it is OK. You have checked your hard drive and you know that is OK. Before we do more hardware testing, I suggest you run Driver Verifier.

Quote:

Using Driver Verifier to identify issues with Drivers
Please follow these instructions in order to run it:
(quote) Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Windows 7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line.

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users

Check your temperatures as well, during heavy usage, with Speedfan.

telarium · 27 Jun 2010

Thanks again.

Did a format/fresh install once again. I had a suspicion that the Intel HD Graphics drivers are making my system unstable. Therefore, I did not install them -- and let the system run/idle for 2 hours. It hasn't crashed yet. This situation obviously isn't a short, nor long-term solution.

Clearly something in the driver set from Intel is pissing off Windows 7. Or, I could have a faulty i3.

I wish there were a way to check the integrity of the Core i3....

I have been monitoring temps. within the BIOS and with Everest...no issues there. Reseated the processor. Checked the HD, RAM.

It's gotta be the drivers/processor...

reventon · 28 Jun 2010

Wait a day or two and see if it crashes without the Intel drivers loaded - then you will know for sure whether you have a hardware problem or not.

telarium · 28 Jun 2010

Nope, it went down again, sans Intel drivers...

reventon · 28 Jun 2010

This BSOD did not tell us much

Code:


BugCheck 1A, {5003, fffff780c0000000, 2f9c, 2f9a00005738}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+2a1ef )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨

Run the driver verifier that Carl mentions down the bottom of his post: http://www.sevenforums.com/crashes-d...tml#post811395

You still have the out of date mouse driver:

Code:


 dadder.sys   Thu Aug 02 21:33:03 2007

Regards,
Reventon

telarium · 28 Jun 2010

Replaced the RAM. Hasn't crashed yet.

Bad RAM, undoubtedly. Surprised memtest didn't catch it.

This should be a great HTPC, if it keeps cooperating

. Updated my system profile to show the main PC...

I appreciate ALL the help, particularly Reventon, Ttran and Carl.

Now I have to see if OCZ will take this RAM back....

reventon · 28 Jun 2010

Quote: Originally Posted by telarium

Replaced the RAM. Hasn't crashed yet.

Bad RAM, undoubtedly. Surprised memtest didn't catch it.

This should be a great HTPC, if it keeps cooperating

. Updated my system profile to show the main PC...

I appreciate ALL the help, particularly Reventon, Ttran and Carl.

Now I have to see if OCZ will take this RAM back....

Wait a day or so just to be sure it was the RAM, it will take that long anyway to try and get OCZ to RMA it.

Windows 7: BSOD, Dump Provided

BSOD, Dump Provided problems?