New
#11
Ok, I wiped the drive and put on a fresh install of Windows 7. It never even touched a mouse before it crashed. (I did install a mouse AFTER it crashed, to facilitate in getting the dump file).
Ok, I wiped the drive and put on a fresh install of Windows 7. It never even touched a mouse before it crashed. (I did install a mouse AFTER it crashed, to facilitate in getting the dump file).
oh right Carl, I jump in :)Others of the BOSD team may well drop by and pick it up.
The stop code is 24, this is usally hard drive issue. Also, ntfs.sys is hard drive controller driver. Therefore I would suggest you to run a disk check and Hard drive diagnostic to find out if there is any problems with the hard drive.
Disk Check
HD Diagnostic
Also, run this free malware check:Code:BugCheck 24, {1904fb, fffff880047f2718, fffff880047f1f70, fffff880012f7c27} Probably caused by : Ntfs.sys ( Ntfs!NtfsFindPrefixHashEntry+1fe ) Followup: MachineOwner ---------
Malwarebytes
Then, system file check
SFC /SCANNOW Command - System File Checker
Regard
Tuấn
Used the SeaTools Utility for Seagate drives. Ran a comprehensive test on the drive, it passed.
Formatted the drive via the utility to ensure everything was o.k. -- threw Windows 7 back on.
No dice, still crashing...
Latest dumps..
The first dmp is a repeat of the stop error 4E; the scond shows stop error 50.
STOP 0x0000004E: PFN_LIST_CORRUPT
Usual causes: Device driver, ?memory
BSOD Index
STOP 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA
Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS
BSOD IndexI found one driver that should be updated:Code:Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\Owner\Downloads\062710-19359-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*Symbol information Executable search path is: Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16539.amd64fre.win7_gdr.100226-1909 Machine Name: Kernel base = 0xfffff800`0285c000 PsLoadedModuleList = 0xfffff800`02a99e50 Debug session time: Sun Jun 27 17:12:43.100 2010 (GMT-4) System Uptime: 0 days 0:28:20.256 Loading Kernel Symbols ............................................................... ................................................................ ...... Loading User Symbols Loading unloaded module list ........ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4E, {99, 422b6, 2, 55675} Probably caused by : memory_corruption ( nt!MiBadShareCount+4c ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 00000000000422b6, page frame number Arg3: 0000000000000002, current page state Arg4: 0000000000055675, 0 Debugging Details: ------------------ BUGCHECK_STR: 0x4E_99 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: mscorsvw.exe CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff8000295c2bc to fffff800028cc600 STACK_TEXT: fffff880`066cd778 fffff800`0295c2bc : 00000000`0000004e 00000000`00000099 00000000`000422b6 00000000`00000002 : nt!KeBugCheckEx fffff880`066cd780 fffff800`0293e5e9 : 00000000`00000000 fffff680`000d8cb8 00000000`00000000 fffffa80`01ae9ad8 : nt!MiBadShareCount+0x4c fffff880`066cd7c0 fffff800`028fd251 : fffff700`01080000 fffff680`000d8cf8 fffffa80`01ae9740 00000000`000006f8 : nt! ?? ::FNODOBFM::`string'+0x31f13 fffff880`066cd970 fffff800`0290dfca : 00000000`00000000 00000000`1b19ffff fffffa80`00000000 fffffa80`00000000 : nt!MiDeleteVirtualAddresses+0x408 fffff880`066cdb30 fffff800`028cb853 : ffffffff`ffffffff 00000000`001aaae8 00000000`001aaae0 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca fffff880`066cdc20 00000000`77a8ff3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`001aaaa8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a8ff3a STACK_COMMAND: kb FOLLOWUP_IP: nt!MiBadShareCount+4c fffff800`0295c2bc cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!MiBadShareCount+4c FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c Followup: MachineOwner --------- Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\Owner\Downloads\062710-14437-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*Symbol information Executable search path is: Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16539.amd64fre.win7_gdr.100226-1909 Machine Name: Kernel base = 0xfffff800`02810000 PsLoadedModuleList = 0xfffff800`02a4de50 Debug session time: Sun Jun 27 17:44:23.852 2010 (GMT-4) System Uptime: 0 days 0:30:50.008 Loading Kernel Symbols ............................................................... ................................................................ ...... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {fffffffffffffbb0, 0, fffff8000289c27c, 0} Could not read faulting driver name Probably caused by : cng.sys ( cng!GatherRandomKey+22c ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffffffffffffbb0, memory referenced. Arg2: 0000000000000000, value 0 = read operation, 1 = write operation. Arg3: fffff8000289c27c, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000000, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ab80e0 fffffffffffffbb0 FAULTING_IP: nt!ObReferenceObjectSafe+c fffff800`0289c27c 498b02 mov rax,qword ptr [r10] MM_INTERNAL_CODE: 0 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: System CURRENT_IRQL: 0 TRAP_FRAME: fffff8800318df90 -- (.trap 0xfffff8800318df90) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffffa800179ff48 rbx=0000000000000000 rcx=fffffffffffffbe0 rdx=fffff80002ab8900 rsi=0000000000000000 rdi=0000000000000000 rip=fffff8000289c27c rsp=fffff8800318e120 rbp=fffff8800318e700 r8=00000000fffffffb r9=fffffa80017a4090 r10=fffffffffffffbb0 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na pe nc nt!ObReferenceObjectSafe+0xc: fffff800`0289c27c 498b02 mov rax,qword ptr [r10] ds:9e30:ffffffff`fffffbb0=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002900e54 to fffff80002880600 STACK_TEXT: fffff880`0318de28 fffff800`02900e54 : 00000000`00000050 ffffffff`fffffbb0 00000000`00000000 fffff880`0318df90 : nt!KeBugCheckEx fffff880`0318de30 fffff800`0287e6ee : 00000000`00000000 ffffffff`fffffbe0 00000000`00000000 fffff800`02b29b33 : nt! ?? ::FNODOBFM::`string'+0x42877 fffff880`0318df90 fffff800`0289c27c : 00000000`00000000 fffff8a0`03696778 fffff8a0`03696678 00000000`000099a0 : nt!KiPageFault+0x16e fffff880`0318e120 fffff800`02b18966 : 00000000`00000000 fffffa80`0179ff48 fffffa80`0179ff48 fffff8a0`03696378 : nt!ObReferenceObjectSafe+0xc fffff880`0318e150 fffff800`02b7ed06 : fffff8a0`0368d0a8 fffff800`0001ff58 fffff880`0318e2e0 00000000`00000000 : nt!ExpGetProcessInformation+0x498 fffff880`0318e2a0 fffff800`02b80149 : fffff8a0`0368d0a8 fffffa80`6365734b 00000000`00000000 fffff880`0318ec20 : nt!ExpQuerySystemInformation+0xf14 fffff880`0318e640 fffff800`0287f853 : fffff880`0318e710 fffff800`0287e7fd 00000000`00000001 fffffa80`024ee880 : nt!NtQuerySystemInformation+0x4d fffff880`0318e680 fffff800`0287bdf0 : fffff880`01121a9c fffff8a0`06c60000 fffff880`0318e844 00000000`6365734b : nt!KiSystemServiceCopyEnd+0x13 fffff880`0318e818 fffff880`01121a9c : fffff8a0`06c60000 fffff880`0318e844 00000000`6365734b fffffa80`00000001 : nt!KiServiceLinkage fffff880`0318e820 fffff880`0112156d : fffffa80`024ee880 00000000`00000000 fffff800`20206f49 fffff800`0288b1c1 : cng!GatherRandomKey+0x22c fffff880`0318ebe0 fffff800`02b7d841 : 00000000`00000000 fffffa80`019588a0 fffffa80`019588a0 fffffa80`01734b60 : cng!scavengingWorkItemRoutine+0x3d fffff880`0318ec80 fffff800`0288d861 : fffff800`02a25500 fffff800`02b7d804 fffffa80`01734b60 00000000`00000000 : nt!IopProcessWorkItem+0x3d fffff880`0318ecb0 fffff800`02b25a86 : 00c6054a`40148c0c fffffa80`01734b60 00000000`00000080 fffffa80`016ab9e0 : nt!ExpWorkerThread+0x111 fffff880`0318ed40 fffff800`0285eb06 : fffff880`02fd3180 fffffa80`01734b60 fffff880`02fddfc0 08861204`0040d080 : nt!PspSystemThreadStartup+0x5a fffff880`0318ed80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: cng!GatherRandomKey+22c fffff880`01121a9c 83ff20 cmp edi,20h SYMBOL_STACK_INDEX: 9 SYMBOL_NAME: cng!GatherRandomKey+22c FOLLOWUP_NAME: MachineOwner MODULE_NAME: cng IMAGE_NAME: cng.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc814 FAILURE_BUCKET_ID: X64_0x50_cng!GatherRandomKey+22c BUCKET_ID: X64_0x50_cng!GatherRandomKey+22c Followup: MachineOwner ---------
amdxata.sys Tue May 19 13:56:59 2009 (4A12F2EB)
Amdxata.sys with description Storage Filter Driver is a driver file from company Advanced Micro Devices belonging to product Storage Filter Driver.
You have checked your RAM and you know that it is OK. You have checked your hard drive and you know that is OK. Before we do more hardware testing, I suggest you run Driver Verifier.
Using Driver Verifier to identify issues with Drivers
Please follow these instructions in order to run it:
(quote) Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.
So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Windows 7 Startup Repair feature).
Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.
Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).
Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.
If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line.
More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users
Check your temperatures as well, during heavy usage, with Speedfan.
Thanks again.
Did a format/fresh install once again. I had a suspicion that the Intel HD Graphics drivers are making my system unstable. Therefore, I did not install them -- and let the system run/idle for 2 hours. It hasn't crashed yet. This situation obviously isn't a short, nor long-term solution.
Clearly something in the driver set from Intel is pissing off Windows 7. Or, I could have a faulty i3.
I wish there were a way to check the integrity of the Core i3....
I have been monitoring temps. within the BIOS and with Everest...no issues there. Reseated the processor. Checked the HD, RAM.
It's gotta be the drivers/processor...
Wait a day or two and see if it crashes without the Intel drivers loaded - then you will know for sure whether you have a hardware problem or not.
Nope, it went down again, sans Intel drivers...
This BSOD did not tell us much
Run the driver verifier that Carl mentions down the bottom of his post: https://www.sevenforums.com/crashes-d...tml#post811395Code:BugCheck 1A, {5003, fffff780c0000000, 2f9c, 2f9a00005738} Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+2a1ef ) ииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииии
You still have the out of date mouse driver:
Regards,Code:dadder.sys Thu Aug 02 21:33:03 2007
Reventon
Replaced the RAM. Hasn't crashed yet.
Bad RAM, undoubtedly. Surprised memtest didn't catch it.
This should be a great HTPC, if it keeps cooperating :). Updated my system profile to show the main PC...
I appreciate ALL the help, particularly Reventon, Ttran and Carl.
Now I have to see if OCZ will take this RAM back....