Another BSOD  

Hi;

I had written a message last week regarding BSOD associated with ntfs.sys and feedback pointed at possibly Diskeeper utility (used for defrag) as a possible cause.


Since then I did a total Windows 7 rebuild of my system (twice) and did not load diskeeper back. However, I have had two BSOD since (including the last minidump - attached).

They seem to come out of nowhere and in both cases corrupted files on my C drive (RAID 0 with two 300 GB 10K RPM drives) and forced a reinitialion of RAID on my large storage drive ( RAID 0 with two 1.5TB 72K RPM drives).

Each time on recovery it forces a check disk on the C drive and finds errors (bad index entries). At the time I was doing large file copies and browsing the Internet.
I use Kalpersky 2010 for security and show no viruses. I also run PC Doctoe 7.5 and detect no hardware issue. I also, checked and mad sure all drivers were up to date.

There seems to be no pattern to the BSOD except random (no warning no nothing).

It would seems since both RAID drive pairs are being affected that it points possible controller or memory issues, but then I really don't know.

I do see a lot of BSOD associated with Windows 7 being posted here, which I did not see with Windows XP ( not enough experience with Vista to see if there was a comparison).

Any help in pin-pointing as to the root cause would be very appreciated.

Regards, Gerry

gkbaldwin3440 said:

Hi;

I had written a message last week regarding BSOD associated with ntfs.sys and feedback pointed at possibly Diskeeper utility (used for defrag) as a possible cause.


Since then I did a total Windows 7 rebuild of my system (twice) and did not load diskeeper back. However, I have had two BSOD since (including the last minidump - attached).

They seem to come out of nowhere and in both cases corrupted files on my C drive (RAID 0 with two 300 GB 10K RPM drives) and forced a reinitialion of RAID on my large storage drive ( RAID 0 with two 1.5TB 72K RPM drives).

Each time on recovery it forces a check disk on the C drive and finds errors (bad index entries). At the time I was doing large file copies and browsing the Internet.
I use Kalpersky 2010 for security and show no viruses. I also run PC Doctoe 7.5 and detect no hardware issue. I also, checked and mad sure all drivers were up to date.

There seems to be no pattern to the BSOD except random (no warning no nothing).

It would seems since both RAID drive pairs are being affected that it points possible controller or memory issues, but then I really don't know.

I do see a lot of BSOD associated with Windows 7 being posted here, which I did not see with Windows XP ( not enough experience with Vista to see if there was a comparison).

Any help in pin-pointing as to the root cause would be very appreciated.

Regards, Gerry

Gerry

Its not attached

Ken

Hmmmmm....try again.

gkbaldwin3440 said:

Hmmmmm....try again.

Hi GKB


These are theUsual causes: Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

Since your anti virus (AVP.exe was involved in the crash I suspect it is actually your problem. First thing I would do is to remove it to see if the problem goes away

To run down all the possible causes would be a waste of time right now but

I would run a chkdsk /r to recover data on bad sectors and mark them as bad.

System file check
type cmd in search>rightclick and run as admin>SFC /SCANNOW

Let us know the results


Ken

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\022010-87828-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02e16000 PsLoadedModuleList = 0xfffff800`03053e50
Debug session time: Sat Feb 20 13:09:00.033 2010 (GMT-5)
System Uptime: 0 days 14:37:59.001
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8801bd64de8, fffff8801bd64640, fffff80002fba90d}

Probably caused by : Ntfs.sys ( Ntfs! ?? ::FNODOBFM::`string'+2cc9 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8801bd64de8
Arg3: fffff8801bd64640
Arg4: fffff80002fba90d

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8801bd64de8 -- (.exr 0xfffff8801bd64de8)
ExceptionAddress: fffff80002fba90d (nt!ExAllocatePoolWithTag+0x000000000000053d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8801bd64640 -- (.cxr 0xfffff8801bd64640)
rax=eefffa801bdf0320 rbx=fffff80003015e40 rcx=fffffa8022e38260
rdx=0000000000000000 rsi=0000000000001000 rdi=0000000000000000
rip=fffff80002fba90d rsp=fffff8801bd65020 rbp=fffff80003015880
 r8=0000000000000000  r9=fffff80003015e40 r10=fffff80003015888
r11=fffffa8012b044c0 r12=0000000000000049 r13=0000000000000000
r14=0000000000000000 r15=0000000020707249
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!ExAllocatePoolWithTag+0x53d:
fffff800`02fba90d 48895808        mov     qword ptr [rax+8],rbx ds:002b:eefffa80`1bdf0328=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  avp.exe

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030be0e0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs! ?? ::FNODOBFM::`string'+2cc9
fffff880`012563d8 cc              int     3

FAULTING_IP: 
nt!ExAllocatePoolWithTag+53d
fffff800`02fba90d 48895808        mov     qword ptr [rax+8],rbx

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002fba90d

STACK_TEXT:  
fffff880`1bd63dd8 fffff880`012563d8 : 00000000`00000024 00000000`001904fb fffff880`1bd64de8 fffff880`1bd64640 : nt!KeBugCheckEx
fffff880`1bd63de0 fffff880`0124e951 : fffff880`01282148 fffff880`1bd65600 fffff880`1bd655d0 44443e49`47484744 : Ntfs! ?? ::FNODOBFM::`string'+0x2cc9
fffff880`1bd63e20 fffff800`02eb64dc : 4d4c4343`42434944 4d5a5959`58585247 48484848`48485252 44444848`48504040 : Ntfs! ?? ::FNODOBFM::`string'+0x1446
fffff880`1bd63e60 fffff880`0124e775 : fffff880`01282150 fffff880`1bd655d0 fffff880`1bd64de8 fffff880`1bd655d0 : nt!_C_specific_handler+0x8c
fffff880`1bd63ed0 fffff800`02eadbed : fffff880`0128213c 00000000`00000000 fffff880`01235000 00000000`00000000 : Ntfs!_GSHandlerCheck_SEH+0x75
fffff880`1bd63f00 fffff800`02eb5250 : fffff880`0128213c fffff880`1bd63f78 fffff880`1bd64de8 fffff880`01235000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`1bd63f30 fffff800`02ec21b5 : fffff880`1bd64de8 fffff880`1bd64640 fffff880`00000000 00000000`00000000 : nt!RtlDispatchException+0x410
fffff880`1bd64610 fffff800`02e87542 : fffff880`1bd64de8 fffff800`03015e40 fffff880`1bd64e90 00000000`00001000 : nt!KiDispatchException+0x135
fffff880`1bd64cb0 fffff800`02e85e4a : fffffa80`1b473740 00000000`00000000 0000007f`fffffff8 fffff8a0`13471000 : nt!KiExceptionDispatch+0xc2
fffff880`1bd64e90 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a


STACK_COMMAND:  kb

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  Ntfs! ?? ::FNODOBFM::`string'+2cc9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!_??_::FNODOBFM::_string_+2cc9

BUCKET_ID:  X64_0x24_Ntfs!_??_::FNODOBFM::_string_+2cc9

Followup: MachineOwner
---------

OLD DRIVERS NEEDING UPDATE\

Code:

ASACPI.sys        fffff880`04fe0000    fffff880`04fe8000    0x00008000    0x42476c4c    3/27/2005 9:30:36 PM                        
secdrv.SYS        fffff880`0f8ee000    fffff880`0f8f9000    0x0000b000    0x4508052e    9/13/2006 8:18:38 AM                        
tifsfilt.sys        fffff880`0145f000    fffff880`01476000    0x00017000    0x46d56889    8/29/2007 7:37:29 AM                        
timntr.sys        fffff880`01ab4000    fffff880`01b64000    0x000b0000    0x46d568bf    8/29/2007 7:38:23 AM                        
000.fcl        fffff880`0f938000    fffff880`0f95d000    0x00025000    0x479872ae    1/24/2008 6:12:46 AM                        
PxHlpa64.sys        fffff880`011bc000    fffff880`011c7d00    0x0000bd00    0x47d88a39    3/12/2008 8:58:17 PM

Will do on the next one if someone can say how. Does print screen work here?

I guess I am not sure how one goes about capturing the blue screen. I thought the minidump contained that information, but again I have no way of reading the dump.

Gerry

Thanks, Ken!

I will remove my Kalpersky anti virus software and run check disk /r on both C and D drives.

I did run SFC /SCANNOW and it showed that no issue were found.

Where would i find updates for the listed old drivers? I will search the internet, but if there is a good place to go that would help.

Gerry

gkbaldwin3440 said:

Thanks, Ken!

I will remove my Kalpersky anti virus software and run check disk /r on both C and D drives.

I did run SFC /SCANNOW and it showed that no issue were found.

Where would i find updates for the listed old drivers? I will search the internet, but if there is a good place to go that would help.

Gerry

Hi Gerry

The best way to get the most up to date driver is to put the driver into google and it will tell you who the manufacturer is then go to the mfr.

Its a bit annoying to do it this way but you do get the best results.

Memory. Obviously thats not the problem

Im betting its the anti-virus so lets wait on anything else.

Ken

Hi;

Well, after yet another rebuild, checking sytem integrity and hardware sweep showing all okay, I installed minimal softwre and started several copy jobs to begin the data restore process.

I was out of the room for 15 minutes and on my return the system showed that it had experience another BSOD and recovery. I have attached the associated minidump, but did not capture the bluescreen info as I was not present at the time.

I did run another SCF scannow and it showed to be clean. However on running chkdsk /r on C drive i did get 2048 journal entry errors, but system did say all was recovered. The larged D drive (1.5 TB) mirrored array went into initialization mode and data on the drive also, showed signs of corruption.

I am still not sure whether I have a hardware issue (I already swapped out the large storage drives) or software, driver or OS issue.

Is it maybe that Windows 7 doesn't like RAID configurations?

Regards, Gerry