 |  |
| |
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find solutions with any problems, errors or issues you are experiencing with Windows 7. The Windows 7 forum also covers news and updates and has an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.
Windows 7 - Random BSODs related to ntfs.sys and system kernel
| |
| 02-13-2012 | #1 |
| | Random BSODs related to ntfs.sys and system kernel I've had several bsods a day for about a week now. They mostly occur when the system is left alone for even a few minutes, but also when i'm playing a game (mostly DooM 3). Sometimes they are caused by ntfs.sys, sometimes the system kernel itself (ntkrnlmp.exe) crashes. I've attached all the dump files from c:\windows\minidump here. I've recently updated my pc, and before the upgrade it was running fine and stable. I'm guessing it has something to do with the parts i upgraded, which were my graphics card (from VTX3D Radeon HD 5670 to XFX Radeon HD 6850) and my memory (from two A-Data AD2800E001GOU to four A-DATA AD2U800B2G6-B model sticks) System specs: System: Windows 7 Home Premium 64-bit Motherboard: ASUS M2N Processor: AMD Athlon X2 4200+ Memory: 4x A-DATA AD2U800B2G6-B 2GB DDR2 800MHz Graphics Card: XFX Radeon HD 6850 Black Edition HDD: Samsung Spinpoint F3 3,5" 1TB 7200RPM SATA2 Also, here is what windbg found out about my latest ntfs.sys related bsod: Code: MODULE_NAME: Ntfs
FAULTING_MODULE: fffff80003066000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79996d
EXCEPTION_RECORD: fffff880061ea088 -- (.exr 0xfffff880061ea088)
ExceptionAddress: fffff8800141b11d (Ntfs+0x000000000000d11d)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff880061e98f0 -- (.cxr 0xfffff880061e98f0)
rax=0000000000000000 rbx=0000000000000000 rcx=ffdff8a012d477c0
rdx=0000000000000000 rsi=0000000000000000 rdi=fffff8a012d476f0
rip=fffff8800141b11d rsp=fffff880061ea2c0 rbp=fffff880061ea660
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000010 r12=fffffa800b8c1e40 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr ac po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010256
Ntfs+0xd11d:
fffff880`0141b11d 48393408 cmp qword ptr [rax+rcx],rsi ds:002b:ffdff8a0`12d477c0=????????????????
Resetting default scope
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x24
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff88001414b68 to fffff8800141b11d
STACK_TEXT:
fffff880`061ea2c0 fffff880`01414b68 : fffffa80`0b8c1e40 fffff8a0`12d476f0 00000000`00000000 fffff880`061ea4f0 : Ntfs+0xd11d
fffff880`061ea430 fffff880`0141a092 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff8a0`12d476f0 00000000`00000000 : Ntfs+0x6b68
fffff880`061ea5c0 fffff880`0141d2a6 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff8a0`12d476f0 fffff8a0`12d475c0 : Ntfs+0xc092
fffff880`061ea790 fffff880`0141fcf8 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff880`061ea901 fffffa80`079b4801 : Ntfs+0xf2a6
fffff880`061ea930 fffff880`012cb23f : fffffa80`0aa8d7d0 fffffa80`0aa8d430 fffffa80`079b48d0 00000000`00000000 : Ntfs+0x11cf8
fffff880`061ea9e0 fffff880`012c96df : fffffa80`091e42c0 fffffa80`0aa8d430 fffffa80`091e4200 fffffa80`0aa8d430 : fltmgr!FltIsCallbackDataDirty+0xa2f
fffff880`061eaa70 fffff800`030c80c2 : fffffa80`0aa8d450 fffffa80`0b883f20 00000000`00000403 fffff880`009e8180 : fltmgr+0x16df
fffff880`061eaad0 fffff800`03372e37 : fffffa80`0a869000 fffffa80`0a869000 fffffa80`0a8690d1 fffffa80`0a869010 : nt!IoPageRead+0x252
fffff880`061eab60 fffff800`03372f31 : fffffa80`0b8645c0 fffffa80`0aa86760 fffff880`061eac98 00000000`00000004 : nt!RtlCompareUnicodeString+0x677
fffff880`061eabc0 fffff800`0311abed : fffffa80`0b8645c0 00000000`00000000 00000000`00001000 00000000`00000000 : nt!RtlCompareUnicodeString+0x771
fffff880`061eac10 fffff800`033f07fb : 00000000`00000000 00000000`00000000 fffffa80`0b883f20 fffffa80`0b95f5d0 : nt!IoGetAttachedDevice+0x19d
fffff880`061eac70 fffff880`01418d50 : fffff8a0`00000000 fffff800`00000004 fffffa80`00040000 fffff880`0146b001 : nt!CcCopyRead+0x16b
fffff880`061ead30 fffff880`0141d083 : 00000000`00000000 fffff8a0`12d476f0 fffff880`061eaf60 00000000`00000000 : Ntfs+0xad50
fffff880`061ead90 fffff880`0141fcf8 : fffffa80`0b8c7e40 fffffa80`0b32a410 fffff880`061eaf01 fffffa80`0aa85c00 : Ntfs+0xf083
fffff880`061eaf30 fffff880`012cb23f : fffffa80`0b32a7b0 fffffa80`0b32a410 fffffa80`0aa85c30 00000000`00000000 : Ntfs+0x11cf8
fffff880`061eafe0 fffff880`012cd94a : 00000000`00000000 00000000`00000000 fffffa80`09ad1700 fffffa80`0aa85c30 : fltmgr!FltIsCallbackDataDirty+0xa2f
fffff880`061eb070 fffff880`012da204 : fffffa80`084e1c10 00000000`00000019 fffffa80`07cd7510 00000000`00000000 : fltmgr!FltPerformSynchronousIo+0x2ca
fffff880`061eb110 fffff880`06362e25 : 00000000`00000000 fffffa80`07cd7510 00000000`00000000 00000000`00000000 : fltmgr!FltReadFile+0x334
fffff880`061eb1f0 fffff880`063621f0 : fffffa80`09ad1700 fffffa80`0aa85c30 00000007`00000010 00000002`00000004 : aswMonFlt+0x2e25
fffff880`061eb330 fffff880`0639636d : 00000000`00000000 fffffa80`0782fae0 fffff880`061eb458 fffff880`00000000 : aswMonFlt+0x21f0
fffff880`061eb400 fffff880`012cc242 : 00000000`00000000 00000000`00000000 fffffa80`0b8247d0 00000000`00000000 : aswMonFlt+0x3636d
fffff880`061eb530 fffff880`012cb38b : fffffa80`07cc1030 fffffa80`0782fb80 fffffa80`09ad17b0 fffffa80`09ad19d0 : fltmgr!FltIsCallbackDataDirty+0x1a32
fffff880`061eb600 fffff880`012ea2b9 : fffffa80`0b824430 fffffa80`07cd7510 fffffa80`0b824400 fffffa80`091e42c0 : fltmgr!FltIsCallbackDataDirty+0xb7b
fffff880`061eb690 fffff800`033d6537 : 00000000`00000005 fffff800`033d5f90 fffffa80`0b606a10 00000000`00000000 : fltmgr!FltReadFile+0x103e9
fffff880`061eb740 fffff800`033ccba4 : fffffa80`07c9fad0 00000000`00000000 fffffa80`0b89ab10 00000000`00000701 : nt!SeUnlockSubjectContext+0x647
fffff880`061eb8d0 fffff800`033d1b7d : fffffa80`0b89ab10 fffff880`061eba30 fffffa80`00000040 fffffa80`06d22080 : nt!SeQueryInformationToken+0x2104
fffff880`061eb9d0 fffff800`033d8647 : fffffa80`0add1cd0 00000000`00000001 fffffa80`0b1ab001 fffffa80`099f7570 : nt!ObOpenObjectByName+0x1cd
fffff880`061eba80 fffff800`033e2398 : 00000000`02cd85e8 00000000`00100081 fffffa80`0aa86760 00000000`02cd85f8 : nt!SeUnlockSubjectContext+0x2757
fffff880`061ebb20 fffff800`030d5813 : 00000000`00000000 fffff800`033f0000 fffff880`061ebca0 00000000`00000000 : nt!NtCreateFile+0x78
fffff880`061ebbb0 00000000`777ffc0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeSynchronizeExecution+0x3a43
00000000`02cd8568 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777ffc0a
FOLLOWUP_IP:
Ntfs+d11d
fffff880`0141b11d 48393408 cmp qword ptr [rax+rcx],rsi
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs+d11d
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: Ntfs.sys
STACK_COMMAND: .cxr 0xfffff880061e98f0 ; kb
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
1: kd> .exr 0xfffff880061ea088
ExceptionAddress: fffff8800141b11d (Ntfs+0x000000000000d11d)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
1: kd> lmvm Ntfs
start end module name
fffff880`0140e000 fffff880`015b0000 Ntfs (no symbols)
Loaded symbol image file: Ntfs.sys
Image path: \SystemRoot\System32\Drivers\Ntfs.sys
Image name: Ntfs.sys
Timestamp: Fri Mar 11 05:39:25 2011 (4D79996D)
CheckSum: 00199985
ImageSize: 001A2000
File version: 6.1.7600.16778
Product version: 6.1.7600.16778
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntfs.sys
OriginalFilename: ntfs.sys
ProductVersion: 6.1.7600.16778
FileVersion: 6.1.7600.16778 (win7_gdr.110310-1506)
FileDescription: NT File System Driver
LegalCopyright: © Microsoft Corporation. All rights reserved. Help is much appreciated, I'm getting tired of solving this alone. |
My System Specs |
| 02-13-2012 | #2 |
| | 
Quote: Originally Posted by cvmm69  I've had several bsods a day for about a week now. They mostly occur when the system is left alone for even a few minutes, but also when i'm playing a game (mostly DooM 3). Sometimes they are caused by ntfs.sys, sometimes the system kernel itself (ntkrnlmp.exe) crashes. I've attached all the dump files from c:\windows\minidump here. I've recently updated my pc, and before the upgrade it was running fine and stable. I'm guessing it has something to do with the parts i upgraded, which were my graphics card (from VTX3D Radeon HD 5670 to XFX Radeon HD 6850) and my memory (from two A-Data AD2800E001GOU to four A-DATA AD2U800B2G6-B model sticks) System specs: System: Windows 7 Home Premium 64-bit Motherboard: ASUS M2N Processor: AMD Athlon X2 4200+ Memory: 4x A-DATA AD2U800B2G6-B 2GB DDR2 800MHz Graphics Card: XFX Radeon HD 6850 Black Edition HDD: Samsung Spinpoint F3 3,5" 1TB 7200RPM SATA2 Also, here is what windbg found out about my latest ntfs.sys related bsod: Code: MODULE_NAME: Ntfs
FAULTING_MODULE: fffff80003066000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79996d
EXCEPTION_RECORD: fffff880061ea088 -- (.exr 0xfffff880061ea088)
ExceptionAddress: fffff8800141b11d (Ntfs+0x000000000000d11d)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff880061e98f0 -- (.cxr 0xfffff880061e98f0)
rax=0000000000000000 rbx=0000000000000000 rcx=ffdff8a012d477c0
rdx=0000000000000000 rsi=0000000000000000 rdi=fffff8a012d476f0
rip=fffff8800141b11d rsp=fffff880061ea2c0 rbp=fffff880061ea660
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000010 r12=fffffa800b8c1e40 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr ac po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010256
Ntfs+0xd11d:
fffff880`0141b11d 48393408 cmp qword ptr [rax+rcx],rsi ds:002b:ffdff8a0`12d477c0=????????????????
Resetting default scope
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x24
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff88001414b68 to fffff8800141b11d
STACK_TEXT:
fffff880`061ea2c0 fffff880`01414b68 : fffffa80`0b8c1e40 fffff8a0`12d476f0 00000000`00000000 fffff880`061ea4f0 : Ntfs+0xd11d
fffff880`061ea430 fffff880`0141a092 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff8a0`12d476f0 00000000`00000000 : Ntfs+0x6b68
fffff880`061ea5c0 fffff880`0141d2a6 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff8a0`12d476f0 fffff8a0`12d475c0 : Ntfs+0xc092
fffff880`061ea790 fffff880`0141fcf8 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff880`061ea901 fffffa80`079b4801 : Ntfs+0xf2a6
fffff880`061ea930 fffff880`012cb23f : fffffa80`0aa8d7d0 fffffa80`0aa8d430 fffffa80`079b48d0 00000000`00000000 : Ntfs+0x11cf8
fffff880`061ea9e0 fffff880`012c96df : fffffa80`091e42c0 fffffa80`0aa8d430 fffffa80`091e4200 fffffa80`0aa8d430 : fltmgr!FltIsCallbackDataDirty+0xa2f
fffff880`061eaa70 fffff800`030c80c2 : fffffa80`0aa8d450 fffffa80`0b883f20 00000000`00000403 fffff880`009e8180 : fltmgr+0x16df
fffff880`061eaad0 fffff800`03372e37 : fffffa80`0a869000 fffffa80`0a869000 fffffa80`0a8690d1 fffffa80`0a869010 : nt!IoPageRead+0x252
fffff880`061eab60 fffff800`03372f31 : fffffa80`0b8645c0 fffffa80`0aa86760 fffff880`061eac98 00000000`00000004 : nt!RtlCompareUnicodeString+0x677
fffff880`061eabc0 fffff800`0311abed : fffffa80`0b8645c0 00000000`00000000 00000000`00001000 00000000`00000000 : nt!RtlCompareUnicodeString+0x771
fffff880`061eac10 fffff800`033f07fb : 00000000`00000000 00000000`00000000 fffffa80`0b883f20 fffffa80`0b95f5d0 : nt!IoGetAttachedDevice+0x19d
fffff880`061eac70 fffff880`01418d50 : fffff8a0`00000000 fffff800`00000004 fffffa80`00040000 fffff880`0146b001 : nt!CcCopyRead+0x16b
fffff880`061ead30 fffff880`0141d083 : 00000000`00000000 fffff8a0`12d476f0 fffff880`061eaf60 00000000`00000000 : Ntfs+0xad50
fffff880`061ead90 fffff880`0141fcf8 : fffffa80`0b8c7e40 fffffa80`0b32a410 fffff880`061eaf01 fffffa80`0aa85c00 : Ntfs+0xf083
fffff880`061eaf30 fffff880`012cb23f : fffffa80`0b32a7b0 fffffa80`0b32a410 fffffa80`0aa85c30 00000000`00000000 : Ntfs+0x11cf8
fffff880`061eafe0 fffff880`012cd94a : 00000000`00000000 00000000`00000000 fffffa80`09ad1700 fffffa80`0aa85c30 : fltmgr!FltIsCallbackDataDirty+0xa2f
fffff880`061eb070 fffff880`012da204 : fffffa80`084e1c10 00000000`00000019 fffffa80`07cd7510 00000000`00000000 : fltmgr!FltPerformSynchronousIo+0x2ca
fffff880`061eb110 fffff880`06362e25 : 00000000`00000000 fffffa80`07cd7510 00000000`00000000 00000000`00000000 : fltmgr!FltReadFile+0x334
fffff880`061eb1f0 fffff880`063621f0 : fffffa80`09ad1700 fffffa80`0aa85c30 00000007`00000010 00000002`00000004 : aswMonFlt+0x2e25
fffff880`061eb330 fffff880`0639636d : 00000000`00000000 fffffa80`0782fae0 fffff880`061eb458 fffff880`00000000 : aswMonFlt+0x21f0
fffff880`061eb400 fffff880`012cc242 : 00000000`00000000 00000000`00000000 fffffa80`0b8247d0 00000000`00000000 : aswMonFlt+0x3636d
fffff880`061eb530 fffff880`012cb38b : fffffa80`07cc1030 fffffa80`0782fb80 fffffa80`09ad17b0 fffffa80`09ad19d0 : fltmgr!FltIsCallbackDataDirty+0x1a32
fffff880`061eb600 fffff880`012ea2b9 : fffffa80`0b824430 fffffa80`07cd7510 fffffa80`0b824400 fffffa80`091e42c0 : fltmgr!FltIsCallbackDataDirty+0xb7b
fffff880`061eb690 fffff800`033d6537 : 00000000`00000005 fffff800`033d5f90 fffffa80`0b606a10 00000000`00000000 : fltmgr!FltReadFile+0x103e9
fffff880`061eb740 fffff800`033ccba4 : fffffa80`07c9fad0 00000000`00000000 fffffa80`0b89ab10 00000000`00000701 : nt!SeUnlockSubjectContext+0x647
fffff880`061eb8d0 fffff800`033d1b7d : fffffa80`0b89ab10 fffff880`061eba30 fffffa80`00000040 fffffa80`06d22080 : nt!SeQueryInformationToken+0x2104
fffff880`061eb9d0 fffff800`033d8647 : fffffa80`0add1cd0 00000000`00000001 fffffa80`0b1ab001 fffffa80`099f7570 : nt!ObOpenObjectByName+0x1cd
fffff880`061eba80 fffff800`033e2398 : 00000000`02cd85e8 00000000`00100081 fffffa80`0aa86760 00000000`02cd85f8 : nt!SeUnlockSubjectContext+0x2757
fffff880`061ebb20 fffff800`030d5813 : 00000000`00000000 fffff800`033f0000 fffff880`061ebca0 00000000`00000000 : nt!NtCreateFile+0x78
fffff880`061ebbb0 00000000`777ffc0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeSynchronizeExecution+0x3a43
00000000`02cd8568 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777ffc0a
FOLLOWUP_IP:
Ntfs+d11d
fffff880`0141b11d 48393408 cmp qword ptr [rax+rcx],rsi
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs+d11d
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: Ntfs.sys
STACK_COMMAND: .cxr 0xfffff880061e98f0 ; kb
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
1: kd> .exr 0xfffff880061ea088
ExceptionAddress: fffff8800141b11d (Ntfs+0x000000000000d11d)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
1: kd> lmvm Ntfs
start end module name
fffff880`0140e000 fffff880`015b0000 Ntfs (no symbols)
Loaded symbol image file: Ntfs.sys
Image path: \SystemRoot\System32\Drivers\Ntfs.sys
Image name: Ntfs.sys
Timestamp: Fri Mar 11 05:39:25 2011 (4D79996D)
CheckSum: 00199985
ImageSize: 001A2000
File version: 6.1.7600.16778
Product version: 6.1.7600.16778
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntfs.sys
OriginalFilename: ntfs.sys
ProductVersion: 6.1.7600.16778
FileVersion: 6.1.7600.16778 (win7_gdr.110310-1506)
FileDescription: NT File System Driver
LegalCopyright: © Microsoft Corporation. All rights reserved. Help is much appreciated, I'm getting tired of solving this alone. 1-ASACPI.SYS. the 2005 version (yours) crashes. Asacpi.sys The pre 2009 version of this driver is a known bsod cause. Quote: Please visit this link: Asus tek computer inc. -support- drivers and download p7p55d le ASUSTeK Computer Inc. -Support- Drivers and Download P7P55D LE ASUSTeK Computer Inc. - Motherboards- ASUS P5K-VM Scroll down to the utilities category, then scroll down to the "atk0110 driver for windowsxp/vista/windows 7 32&64-bit" (it's about the 12th item down). Download and install it. Go to c:\windows\system32\drivers to check and make sure that the asacpi.sys file is date stamped from 2009 or 2010 (notbefore). 2-Old drivers Code: ASACPI.sys 3/27/2005 9:30:36 PM fffff880`04139000 fffff880`04141000 0x00008000 0x42476c4c SynUSB64.sys 10/24/2007 3:38:29 AM fffff880`03fe6000 fffff880`03ff1000 0x0000b000 0x471f0485 nvstor64.sys 8/18/2008 8:53:39 PM fffff880`00dc0000 fffff880`00dec000 0x0002c000 0x48aa27a3 hamachi.sys 2/19/2009 5:36:41 AM fffff880`045ea000 fffff880`045f5000 0x0000b000 0x499d3639 L8042Kbd.sys 6/17/2009 11:50:43 AM fffff880`0415f000 fffff880`0416a000 0x0000b000 0x4a391ee3 Quote: - search Google for the name of the driver - compare the Google results with what's installed on your system to figure out which device/program it belongs to - visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager). - if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program. - - Driver manufacturer links are on this page: Drivers and Downloads 3-SPTD.SYS Please remove any CD visualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, called sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller DuplexSecure - Downloads DuplexSecure - FAQ when you're done you can use this Freeware: MagicISO Virtual CD/DVD-ROM (MagicDisc) in its place Using MagicISO to create ISO image files 4-Avast Avast can be a contributing cause of BSOD'S . Please remove and replace with Microsoft Security Essentials AT LEAST TO TEST http://files.avast.com/files/eng/aswclear5.exe Microsoft Security Essentials - Free Antivirus for Windows |
| My System Specs |
| 02-15-2012 | #3 |
| | Thank you for your response. I did most the things you instructed me to do, but in some cases I could not fix the problem, so it is highly understandable that the bsods still continue to occur. Here's a list of things I did: 1: ASACPI.SYS - replaced the old 2005 version with a newer version dated 5.14.2009 - downloaded from ASUS website. 2: Outdated Drivers I found out the purposes of these drivers and took proper actions to fix all error related to these drivers and the software that uses them. SynUSB64.sys - Synchrosoft eLicenser driver - Newer version is available, but inaccessible due to the Syncrosoft website being down, and alternate download at Syncrosoft License Control Software Informer: Latest version download, news and info about this SIA Syncrosoft program. is unavailable. If someone manages to locate this file, I'm thankful. nvstor64.sys - NVIDIA NForce SATA driver, replaced old 2008 driver with a never version dated 6.30.2009 - downloaded from nvstor64.sys free download - Sysfiles-download.com hamachi.sys - Hamachi VPN Software driver - removed the software for a test period of 2-3 months. L8042kbd.sys - Logitech SetPoint software driver - software removed because no longer needed 3. SPTD.SYS Removed Daemon Tools Lite and all other virtual disk software - sptd.sys removed using driver installer program downloaded from http://www.duplexsecure.com/download...t-v180-x64.exe. Will install alternate virtual disk software if needed. 4. Avast Software removed and installed Microsoft Security Essentials to test for a maximum period of 2 months. After all installations I wiped off the traces of the installations using CCleaner, also ran a test for registery errors several times. Also, a new kind of bsod occurred today: it was caused by atikmdag.sys, which is the kernel of my graphics card software. AMD Driver Updater and Steam both confirm that my driver is up to date (version 8.1.1.1223, 12.6.2011), so it is highly likely that it was not caused by the driver itself. I hope it comes up in the dump files. Attached are not only my latest minidump files but also the information recovered using windbg from the newest atikmdag.sys bsod. Code: FAULTING_MODULE: fffff80003052000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4edd8367
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
atikmdag+3fa9f9
fffff880`04bfe9f9 488b5108 mov rdx,qword ptr [rcx+8]
EXCEPTION_RECORD: fffff88004754fc8 -- (.exr 0xfffff88004754fc8)
ExceptionAddress: fffff88004bfe9f9 (atikmdag+0x00000000003fa9f9)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff88004754830 -- (.cxr 0xfffff88004754830)
rax=fffff8a00f6b6108 rbx=0000000f10ef8000 rcx=ffdff8a00f6b6128
rdx=fffff8a00f6b6010 rsi=fffff880047553f0 rdi=fffffa800931bac0
rip=fffff88004bfe9f9 rsp=fffff88004755200 rbp=00000000003ffc00
r8=0000000000000000 r9=0000000000001000 r10=0000000000000000
r11=fffff88004755308 r12=0000000000000000 r13=fffff8a00f6b6010
r14=fffff88007e50000 r15=0000000000000003
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
atikmdag+0x3fa9f9:
fffff880`04bfe9f9 488b5108 mov rdx,qword ptr [rcx+8] ds:002b:ffdff8a0`0f6b6130=????????????????
Resetting default scope
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x7E
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff88004bff8d8 to fffff88004bfe9f9
STACK_TEXT:
fffff880`04755200 fffff880`04bff8d8 : fffffa80`0931bac0 00000000`00000000 00000000`00000000 00000000`00001000 : atikmdag+0x3fa9f9
fffff880`04755310 fffff880`048425fe : fffffa80`0931bae0 0000000f`10ef8000 00000000`00001000 0000000f`00150000 : atikmdag+0x3fb8d8
fffff880`047553c0 fffff880`0413545b : 00000000`00001000 fffff8a0`10de4620 ffffffff`c01e0001 ffffffff`ffffffff : atikmdag+0x3e5fe
fffff880`04755520 fffff880`052929ac : 00000000`00001000 fffff8a0`10de4620 fffff880`c0000001 fffff8a0`10de4620 : atikmpag+0x745b
fffff880`047555a0 fffff880`053a5c9d : fffff8a0`10de4620 fffff8a0`10de4620 00000000`00000000 fffffa80`09691000 : dxgkrnl+0x39ac
fffff880`047555d0 fffff880`053a5b88 : fffff8a0`10de4620 00000000`00000000 00000000`00000000 00000000`00106101 : dxgmms1!VidMmInterface+0x113dd
fffff880`04755760 fffff880`053b2029 : 00000000`00000000 fffffa80`0ae29730 00000000`00000000 00000000`00000000 : dxgmms1!VidMmInterface+0x112c8
fffff880`047557d0 fffff880`053a4af3 : fffffa80`0969ad70 fffff8a0`10de4620 fffffa80`09691000 fffff880`053a4600 : dxgmms1!VidMmInterface+0x1d769
fffff880`047558b0 fffff880`053a1763 : 00000000`00000000 fffffa80`078b8000 00000000`00000000 fffffa80`09b7a270 : dxgmms1!VidMmInterface+0x10233
fffff880`04755910 fffff880`053bb65d : 00000000`00000000 fffff8a0`108ecb10 fffffa80`00000000 fffffa80`07845470 : dxgmms1!VidMmInterface+0xcea3
fffff880`04755ae0 fffff880`053bb398 : fffff880`009ecec0 fffff880`053bad00 fffffa80`00000000 fffffa80`00000000 : dxgmms1!VidMmInterface+0x26d9d
fffff880`04755cd0 fffff880`053bae96 : 00000000`00000000 fffffa80`09470550 00000000`00000080 fffffa80`06d73410 : dxgmms1!VidMmInterface+0x26ad8
fffff880`04755d00 fffff800`033626fa : 00000000`278b0252 fffffa80`06da1b60 fffffa80`06d23040 fffffa80`06da1b60 : dxgmms1!VidMmInterface+0x265d6
fffff880`04755d40 fffff800`030a0b46 : fffff880`009e8180 fffffa80`06da1b60 fffff880`009f2f40 fffff880`01224810 : nt!PsCreateSystemThread+0x6d6
fffff880`04755d80 00000000`00000000 : fffff880`04756000 fffff880`04750000 fffff880`04754d80 00000000`00000000 : nt!KeTestAlertThread+0x93a
FOLLOWUP_IP:
atikmdag+3fa9f9
fffff880`04bfe9f9 488b5108 mov rdx,qword ptr [rcx+8]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: atikmdag+3fa9f9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: atikmdag
IMAGE_NAME: atikmdag.sys
STACK_COMMAND: .cxr 0xfffff88004754830 ; kb
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
0: kd> lmvm atikmdag
start end module name
fffff880`04804000 fffff880`0528f000 atikmdag (no symbols)
Loaded symbol image file: atikmdag.sys
Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
Image name: atikmdag.sys
Timestamp: Tue Dec 06 04:52:23 2011 (4EDD8367)
CheckSum: 00A43704
ImageSize: 00A8B000
File version: 8.1.1.1223
Product version: 8.1.1.1223
File flags: 8 (Mask 3F) Private
File OS: 40004 NT Win32
File type: 3.4 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Advanced Micro Devices, Inc.
ProductName: ATI Radeon Family
InternalName: atikmdag.sys
OriginalFilename: atikmdag.sys
ProductVersion: 8.01.01.1223
FileVersion: 8.01.01.1223
FileDescription: ATI Radeon Kernel Mode Driver
LegalCopyright: Copyright (C) 1998-2011 Advanced Micro Devices, Inc.
0: kd> lmvm nt
start end module name
fffff800`03052000 fffff800`0362e000 nt (export symbols) ntkrnlmp.exe
Loaded symbol image file: ntkrnlmp.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Timestamp: Thu Jun 23 05:51:48 2011 (4E02AA44)
CheckSum: 00542941
ImageSize: 005DC000
File version: 6.1.7600.16841
Product version: 6.1.7600.16841
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 6.1.7600.16841
FileVersion: 6.1.7600.16841 (win7_gdr.110622-1503)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved. |
| My System Specs |
| . |
| |
| 02-15-2012 | #4 |
| |
Quote: Originally Posted by cvmm69 Thank you for your response. I did most the things you instructed me to do, but in some cases I could not fix the problem, so it is highly understandable that the bsods still continue to occur. Here's a list of things I did: 1: ASACPI.SYS - replaced the old 2005 version with a newer version dated 5.14.2009 - downloaded from ASUS website. 2: Outdated Drivers I found out the purposes of these drivers and took proper actions to fix all error related to these drivers and the software that uses them. SynUSB64.sys - Synchrosoft eLicenser driver - Newer version is available, but inaccessible due to the Syncrosoft website being down, and alternate download at Syncrosoft License Control Software Informer: Latest version download, news and info about this SIA Syncrosoft program. is unavailable. If someone manages to locate this file, I'm thankful. nvstor64.sys - NVIDIA NForce SATA driver, replaced old 2008 driver with a never version dated 6.30.2009 - downloaded from nvstor64.sys free download - Sysfiles-download.com hamachi.sys - Hamachi VPN Software driver - removed the software for a test period of 2-3 months. L8042kbd.sys - Logitech SetPoint software driver - software removed because no longer needed 3. SPTD.SYS Removed Daemon Tools Lite and all other virtual disk software - sptd.sys removed using driver installer program downloaded from http://www.duplexsecure.com/download...t-v180-x64.exe. Will install alternate virtual disk software if needed. 4. Avast Software removed and installed Microsoft Security Essentials to test for a maximum period of 2 months. After all installations I wiped off the traces of the installations using CCleaner, also ran a test for registery errors several times. Also, a new kind of bsod occurred today: it was caused by atikmdag.sys, which is the kernel of my graphics card software. AMD Driver Updater and Steam both confirm that my driver is up to date (version 8.1.1.1223, 12.6.2011), so it is highly likely that it was not caused by the driver itself. I hope it comes up in the dump files. Attached are not only my latest minidump files but also the information recovered using windbg from the newest atikmdag.sys bsod. Code: FAULTING_MODULE: fffff80003052000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4edd8367
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
atikmdag+3fa9f9
fffff880`04bfe9f9 488b5108 mov rdx,qword ptr [rcx+8]
EXCEPTION_RECORD: fffff88004754fc8 -- (.exr 0xfffff88004754fc8)
ExceptionAddress: fffff88004bfe9f9 (atikmdag+0x00000000003fa9f9)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff88004754830 -- (.cxr 0xfffff88004754830)
rax=fffff8a00f6b6108 rbx=0000000f10ef8000 rcx=ffdff8a00f6b6128
rdx=fffff8a00f6b6010 rsi=fffff880047553f0 rdi=fffffa800931bac0
rip=fffff88004bfe9f9 rsp=fffff88004755200 rbp=00000000003ffc00
r8=0000000000000000 r9=0000000000001000 r10=0000000000000000
r11=fffff88004755308 r12=0000000000000000 r13=fffff8a00f6b6010
r14=fffff88007e50000 r15=0000000000000003
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
atikmdag+0x3fa9f9:
fffff880`04bfe9f9 488b5108 mov rdx,qword ptr [rcx+8] ds:002b:ffdff8a0`0f6b6130=????????????????
Resetting default scope
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x7E
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff88004bff8d8 to fffff88004bfe9f9
STACK_TEXT:
fffff880`04755200 fffff880`04bff8d8 : fffffa80`0931bac0 00000000`00000000 00000000`00000000 00000000`00001000 : atikmdag+0x3fa9f9
fffff880`04755310 fffff880`048425fe : fffffa80`0931bae0 0000000f`10ef8000 00000000`00001000 0000000f`00150000 : atikmdag+0x3fb8d8
fffff880`047553c0 fffff880`0413545b : 00000000`00001000 fffff8a0`10de4620 ffffffff`c01e0001 ffffffff`ffffffff : atikmdag+0x3e5fe
fffff880`04755520 fffff880`052929ac : 00000000`00001000 fffff8a0`10de4620 fffff880`c0000001 fffff8a0`10de4620 : atikmpag+0x745b
fffff880`047555a0 fffff880`053a5c9d : fffff8a0`10de4620 fffff8a0`10de4620 00000000`00000000 fffffa80`09691000 : dxgkrnl+0x39ac
fffff880`047555d0 fffff880`053a5b88 : fffff8a0`10de4620 00000000`00000000 00000000`00000000 00000000`00106101 : dxgmms1!VidMmInterface+0x113dd
fffff880`04755760 fffff880`053b2029 : 00000000`00000000 fffffa80`0ae29730 00000000`00000000 00000000`00000000 : dxgmms1!VidMmInterface+0x112c8
fffff880`047557d0 fffff880`053a4af3 : fffffa80`0969ad70 fffff8a0`10de4620 fffffa80`09691000 fffff880`053a4600 : dxgmms1!VidMmInterface+0x1d769
fffff880`047558b0 fffff880`053a1763 : 00000000`00000000 fffffa80`078b8000 00000000`00000000 fffffa80`09b7a270 : dxgmms1!VidMmInterface+0x10233
fffff880`04755910 fffff880`053bb65d : 00000000`00000000 fffff8a0`108ecb10 fffffa80`00000000 fffffa80`07845470 : dxgmms1!VidMmInterface+0xcea3
fffff880`04755ae0 fffff880`053bb398 : fffff880`009ecec0 fffff880`053bad00 fffffa80`00000000 fffffa80`00000000 : dxgmms1!VidMmInterface+0x26d9d
fffff880`04755cd0 fffff880`053bae96 : 00000000`00000000 fffffa80`09470550 00000000`00000080 fffffa80`06d73410 : dxgmms1!VidMmInterface+0x26ad8
fffff880`04755d00 fffff800`033626fa : 00000000`278b0252 fffffa80`06da1b60 fffffa80`06d23040 fffffa80`06da1b60 : dxgmms1!VidMmInterface+0x265d6
fffff880`04755d40 fffff800`030a0b46 : fffff880`009e8180 fffffa80`06da1b60 fffff880`009f2f40 fffff880`01224810 : nt!PsCreateSystemThread+0x6d6
fffff880`04755d80 00000000`00000000 : fffff880`04756000 fffff880`04750000 fffff880`04754d80 00000000`00000000 : nt!KeTestAlertThread+0x93a
FOLLOWUP_IP:
atikmdag+3fa9f9
fffff880`04bfe9f9 488b5108 mov rdx,qword ptr [rcx+8]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: atikmdag+3fa9f9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: atikmdag
IMAGE_NAME: atikmdag.sys
STACK_COMMAND: .cxr 0xfffff88004754830 ; kb
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
0: kd> lmvm atikmdag
start end module name
fffff880`04804000 fffff880`0528f000 atikmdag (no symbols)
Loaded symbol image file: atikmdag.sys
Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
Image name: atikmdag.sys
Timestamp: Tue Dec 06 04:52:23 2011 (4EDD8367)
CheckSum: 00A43704
ImageSize: 00A8B000
File version: 8.1.1.1223
Product version: 8.1.1.1223
File flags: 8 (Mask 3F) Private
File OS: 40004 NT Win32
File type: 3.4 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Advanced Micro Devices, Inc.
ProductName: ATI Radeon Family
InternalName: atikmdag.sys
OriginalFilename: atikmdag.sys
ProductVersion: 8.01.01.1223
FileVersion: 8.01.01.1223
FileDescription: ATI Radeon Kernel Mode Driver
LegalCopyright: Copyright (C) 1998-2011 Advanced Micro Devices, Inc.
0: kd> lmvm nt
start end module name
fffff800`03052000 fffff800`0362e000 nt (export symbols) ntkrnlmp.exe
Loaded symbol image file: ntkrnlmp.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Timestamp: Thu Jun 23 05:51:48 2011 (4E02AA44)
CheckSum: 00542941
ImageSize: 005DC000
File version: 6.1.7600.16841
Product version: 6.1.7600.16841
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 6.1.7600.16841
FileVersion: 6.1.7600.16841 (win7_gdr.110622-1503)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved. Also isn't your card overheating please monitor your temps using GPU-Z: GPU-Z Video card GPU Information Utility Also are you Overclocking ??? |
| My System Specs |
| 02-15-2012 | #5 |
| | Thanks for contibuting in this thread. As I said, I am running the latest version of the driver software available for my card. I did reinstall them, just to be sure, though. I am using a free desktop widget that monitors my card's clocks and temperature, and it is running at 45-50'c on normal desktop use and 65-70'c while running furmark. My card is not overclocked or flashed, and my enclosure is properly ventilated. I see no reason for overheating to cause this. |
| My System Specs |
| 02-15-2012 | #6 |
| |
Quote: Originally Posted by cvmm69 Thanks for contibuting in this thread. As I said, I am running the latest version of the driver software available for my card. I did reinstall them, just to be sure, though. I am using a free desktop widget that monitors my card's clocks and temperature, and it is running at 45-50'c on normal desktop use and 65-70'c while running furmark. My card is not overclocked or flashed, and my enclosure is properly ventilated. I see no reason for overheating to cause this. SynUSB64.sys (24/10/2007) teamviewervpn.sys (13/12/2007) Please update it if possible Last edited by GianniDPC; 02-15-2012 at 03:25 PM.. Reason: Updated post |
| My System Specs |
| 02-15-2012 | #7 |
| | I also explained in my last reply that i am aware of synusb64.sys being outdated because the newest version is currently available only in the newest version of Cubase, which i cannot aquire in a legitimate way. But I had no idea of Teamviewer being outdated, will uprgade that asap. |
| My System Specs |
| 02-15-2012 | #8 |
| |
Quote: Originally Posted by GianniDPC
Quote: Originally Posted by cvmm69 Thanks for contibuting in this thread. As I said, I am running the latest version of the driver software available for my card. I did reinstall them, just to be sure, though. I am using a free desktop widget that monitors my card's clocks and temperature, and it is running at 45-50'c on normal desktop use and 65-70'c while running furmark. My card is not overclocked or flashed, and my enclosure is properly ventilated. I see no reason for overheating to cause this. SynUSB64.sys (24/10/2007) teamviewervpn.sys (13/12/2007) Please update it if possible |
| My System Specs |
| 02-15-2012 | #9 |
| | So the only thing left to do is to locate the newest version of the Syncrosoft driver. If someone knows how, I will try it, because it seems to be the only troublemaker left unless there is a problem with the graphics driver. |
| My System Specs |
| 02-15-2012 | #10 |
| |
Quote: Originally Posted by cvmm69 So the only thing left to do is to locate the newest version of the Syncrosoft driver. If someone knows how, I will try it, because it seems to be the only troublemaker left unless there is a problem with the graphics driver. You may be able to use that one if you re-install in "compatibility" mode (right click the installer>run as admin>properties>Compatibility>chose Vista) Good luck |
| My System Specs |
 |
Random BSODs related to ntfs.sys and system kernel problems?
| Thread Tools | |
| Similar Threads for: Random BSODs related to ntfs.sys and system kernel | ||||
| Thread | Forum | |||
| Random USB Related BSODs, minidump included | Crashes and Debugging | |||
 random BSODs with new build - error related to "ntoskrnl.exe+7cc40"? | Crashes and Debugging | |||
| Random BSODs - RAM related probably | Crashes and Debugging | |||
| Random BSODs related to NetIO.sys | Crashes and Debugging | |||
| Random system freezes (possibly browser related) | Crashes and Debugging | |||
All times are GMT -5. The time now is 12:37 AM.
