Multiple BSOD New Computer Windows 7 64Bit

tktk88 · 18 Aug 2010

I would also add that the computer appears to perform just fine no matter what amount of ram is detected and I am expereinceing no BSOD's

CarlTR6 · 18 Aug 2010

We have some experts with RAM here. I am not one of them. I suggest you start a new thread in Performance and Maintenance Section and post there what you posted here. They can most likely help you solve it.

Sure am glad to hear you are still BSOD free!!!

tktk88 · 18 Aug 2010

Thanks Carl will do...................yes this issue is more of an annoyance than the frustration of the BSOD thing.....

tktk88 · 24 Aug 2010

Well I guess it was too good to be true another BSOD today any thoughts???

CarlTR6 · 24 Aug 2010

This one is an error code 24, NTFS_FILE_SYSTEM. Usual causes are Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_Minidump(2).zip\Minidump\082410-13244-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e15000 PsLoadedModuleList = 0xfffff800`03052e50
Debug session time: Tue Aug 24 18:02:15.777 2010 (GMT-4)
System Uptime: 0 days 1:21:12.775
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff880085738a8, fffff88008573110, fffff880012f7b76}

Probably caused by : Ntfs.sys ( Ntfs!NtfsOpenAttribute+326 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880085738a8
Arg3: fffff88008573110
Arg4: fffff880012f7b76

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880085738a8 -- (.exr 0xfffff880085738a8)
ExceptionAddress: fffff880012f7b76 (Ntfs!NtfsOpenAttribute+0x0000000000000326)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88008573110 -- (.cxr 0xfffff88008573110)
rax=fffef8a00952e888 rbx=fffffa80073cb4c0 rcx=fffff8a009e2bba0
rdx=0000000000000000 rsi=fffffa8006f6a368 rdi=fffff8a00bf8e100
rip=fffff880012f7b76 rsp=fffff88008573ae0 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=fffff880012a2380
r11=fffff8a00bf8e128 r12=fffff88008574420 r13=fffff8a009e2b8f0
r14=0000000000000002 r15=fffff880085743b0
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
Ntfs!NtfsOpenAttribute+0x326:
fffff880`012f7b76 4c8918          mov     qword ptr [rax],r11 ds:002b:fffef8a0`0952e888=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  rundll32.exe

CURRENT_IRQL:  1

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030bd0e0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsOpenAttribute+326
fffff880`012f7b76 4c8918          mov     qword ptr [rax],r11

FAULTING_IP: 
Ntfs!NtfsOpenAttribute+326
fffff880`012f7b76 4c8918          mov     qword ptr [rax],r11

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff880012e5e45 to fffff880012f7b76

STACK_TEXT:  
fffff880`08573ae0 fffff880`012e5e45 : fffffa80`07330970 fffffa80`06f6a368 fffffa80`07ec5180 fffff8a0`09e2bc88 : Ntfs!NtfsOpenAttribute+0x326
fffff880`08573bf0 fffff880`012e278b : fffff880`085743b0 fffffa80`07330970 fffff8a0`09e2bc88 fffff8a0`0000006e : Ntfs!NtfsOpenExistingAttr+0x145
fffff880`08573cb0 fffff880`012e2eff : fffffa80`07330970 fffffa80`06f6a010 fffff8a0`09e2bc88 fffff880`0000006e : Ntfs!NtfsOpenAttributeInExistingFile+0x5ab
fffff880`08573e40 fffff880`012f3e76 : fffffa80`07330970 fffffa80`06f6a010 fffff8a0`09e2bc88 00000000`0009e001 : Ntfs!NtfsOpenExistingPrefixFcb+0x1ef
fffff880`08573f30 fffff880`012ee28d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsFindStartingNode+0x5e6
fffff880`08574000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreate+0x3dd


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsOpenAttribute+326

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

STACK_COMMAND:  .cxr 0xfffff88008573110 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsOpenAttribute+326

BUCKET_ID:  X64_0x24_Ntfs!NtfsOpenAttribute+326

Followup: MachineOwner
---------

Let's check your hard drive.

Run CHKDSK /R /F from an elevated (Run as adminstrator) Command Prompt. Please do this for each hard drive on your system.
When it tells you it can't do it right now - and asks you if you'd like to do it at the next reboot - answer Y (for Yes) and press Enter. Then reboot and let the test run. It may take a while for it to run, but keep an occasional eye on it to see if it generates any errors. See "CHKDSK LogFile" below in order to check the results of the test.

Elevated Command Prompt:
Go to Start and type in "cmd.exe" (without the quotes)
At the top of the Search Box, right click on Cmd.exe and select "Run as administrator"

CHKDSK LogFile:
Go to Start and type in "eventvwr.msc" (without the quotes) and press Enter
Expand the Windows logs heading, then select the Application log file entry.
Double click on the Source column header.
Scroll down the list until you find the Chkdsk entry (wininit for Windows 7) (winlogon for XP)

Copy/paste your results into you next post.

Next use the diagnosing tool from your hard drive manufacturer and diagnose your hard drive. Post back with those results.

tktk88 · 28 Aug 2010

I ran the CHKDSK/R/F now I am having trouble finding the results file........In the meantime today yet another BSOD here are the files.............

tktk88 · 29 Aug 2010

A new day and yet another BSOD............hopefully between these files and yesterdays file you find something we can fix.........

CarlTR6 · 29 Aug 2010

tktk88 said:

I ran the CHKDSK/R/F now I am having trouble finding the results file........In the meantime today yet another BSOD here are the files.............

tktk88 said:

A new day and yet another BSOD............hopefully between these files and yesterdays file you find something we can fix.........

Were you able to find your check disk log?

Both of these dumps are error code 3B, SYSTEM_SERVICE_EXCEPTION - usual causes are system service, Device driver, graphics driver, ?memory.

Code:

Kernel base = 0xfffff800`02e68000 PsLoadedModuleList = 0xfffff800`030a5e50
Debug session time: Sat Aug 28 14:04:58.630 2010 (GMT-4)
System Uptime: 0 days 0:16:06.832
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff800031d4c0b, fffff8800a0a91d0, 0}

Probably caused by : ntkrnlmp.exe ( nt!NtWaitForMultipleObjects+fe )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800031d4c0b, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800a0a91d0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!NtWaitForMultipleObjects+fe
fffff800`031d4c0b c3              ret

CONTEXT:  fffff8800a0a91d0 -- (.cxr 0xfffff8800a0a91d0)
rax=0000000000000000 rbx=fffffa8008991660 rcx=fffffa8009a96be0
rdx=00000000000007ff rsi=000000000205f5d8 rdi=fffff8800a0a9bc8
rip=fffff800031d4c0b rsp=fffff8800a0a9ba8 rbp=fffff8800a0a9ca0
 r8=fffffa8009338618  r9=0000000000000000 r10=ffffffffffffffef
r11=fffff8800a0a9ba0 r12=0000000000000000 r13=000000000205f660
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
nt!NtWaitForMultipleObjects+0xfe:
fffff800`031d4c0b c3              ret
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  audiodg.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffef80002ed7993 to fffff800031d4c0b

STACK_TEXT:  
fffff880`0a0a9ba8 fffef800`02ed7993 : fffffa80`08991660 00000000`0205f5d8 fffff880`0a0a9bc8 fffff800`031ee3f0 : nt!NtWaitForMultipleObjects+0xfe
fffff880`0a0a9bb0 fffffa80`08991660 : 00000000`0205f5d8 fffff880`0a0a9bc8 fffff800`031ee3f0 00000000`00000000 : 0xfffef800`02ed7993
fffff880`0a0a9bb8 00000000`0205f5d8 : fffff880`0a0a9bc8 fffff800`031ee3f0 00000000`00000000 ffffdbb0`198c312c : 0xfffffa80`08991660
fffff880`0a0a9bc0 fffff880`0a0a9bc8 : fffff800`031ee3f0 00000000`00000000 ffffdbb0`198c312c 00000000`00000000 : 0x205f5d8
fffff880`0a0a9bc8 fffff800`031ee3f0 : 00000000`00000000 ffffdbb0`198c312c 00000000`00000000 00000000`00000000 : 0xfffff880`0a0a9bc8
fffff880`0a0a9bd0 fffff800`02ed7993 : fffffa80`08991660 fffff880`0a0a9ca0 00000000`0205f490 00000000`00000000 : nt!ObpCloseHandle+0x70
fffff880`0a0a9c20 00000000`77cd030a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0205f5b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77cd030a


FOLLOWUP_IP: 
nt!NtWaitForMultipleObjects+fe
fffff800`031d4c0b c3              ret

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!NtWaitForMultipleObjects+fe

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

STACK_COMMAND:  .cxr 0xfffff8800a0a91d0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!NtWaitForMultipleObjects+fe

BUCKET_ID:  X64_0x3B_nt!NtWaitForMultipleObjects+fe

Followup: MachineOwner
---------

Kernel base = 0xfffff800`02e5b000 PsLoadedModuleList = 0xfffff800`03098e50
Debug session time: Sun Aug 29 08:01:21.342 2010 (GMT-4)
System Uptime: 0 days 0:16:39.545
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff800031c7c0b, fffff880062071d0, 0}

Probably caused by : ntkrnlmp.exe ( nt!NtWaitForMultipleObjects+fe )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800031c7c0b, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff880062071d0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!NtWaitForMultipleObjects+fe
fffff800`031c7c0b c3              ret

CONTEXT:  fffff880062071d0 -- (.cxr 0xfffff880062071d0)
rax=0000000000000102 rbx=fffffa8008d98960 rcx=fffffa8008dc6690
rdx=00000000000007ff rsi=000000000ac5f768 rdi=fffff88006207bc8
rip=fffff800031c7c0b rsp=fffff88006207ba8 rbp=fffff88006207ca0
 r8=fffffa80080f8a58  r9=0000000000000000 r10=ffffffffffffffef
r11=fffff88006207ba0 r12=000000000ac5f798 r13=000000000ac5f7f0
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
nt!NtWaitForMultipleObjects+0xfe:
fffff800`031c7c0b c3              ret
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffef80002eca993 to fffff800031c7c0b

STACK_TEXT:  
fffff880`06207ba8 fffef800`02eca993 : fffffa80`08d98960 00000000`0ac5f768 fffff880`06207bc8 00000000`00000000 : nt!NtWaitForMultipleObjects+0xfe
fffff880`06207bb0 fffffa80`08d98960 : 00000000`0ac5f768 fffff880`06207bc8 00000000`00000000 fffff880`06207990 : 0xfffef800`02eca993
fffff880`06207bb8 00000000`0ac5f768 : fffff880`06207bc8 00000000`00000000 fffff880`06207990 fffffa80`080f89d0 : 0xfffffa80`08d98960
fffff880`06207bc0 fffff880`06207bc8 : 00000000`00000000 fffff880`06207990 fffffa80`080f89d0 00000000`0000002a : 0xac5f768
fffff880`06207bc8 00000000`00000000 : fffff880`06207990 fffffa80`080f89d0 00000000`0000002a fffff960`00133dd6 : 0xfffff880`06207bc8


FOLLOWUP_IP: 
nt!NtWaitForMultipleObjects+fe
fffff800`031c7c0b c3              ret

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!NtWaitForMultipleObjects+fe

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

STACK_COMMAND:  .cxr 0xfffff880062071d0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!NtWaitForMultipleObjects+fe

BUCKET_ID:  X64_0x3B_nt!NtWaitForMultipleObjects+fe

Followup: MachineOwner
---------

The dumps indicate corrupt memory, 0xc0000005. First, lets test your RAM using Memtest 86+. This will take some time. Follow the instructions in this tutorial:

RAM - Test with Memtest86+

Post back with the results.

The next step will be to enable Driver Verifier. Read this tutorial. Upload any dumps generated by Driver Verifier.

Driver Verifier - Enable and Disable

tktk88 · 31 Aug 2010

Ok the new motherboard and ram arrived this afternoon It is installed and up and running all is good so far keeping my fingers crossed

CarlTR6 · 31 Aug 2010

Thank you for the update. My fingers are crossed to. Let us know. :)