Blue screens

DavidP · 22 Jan 2011

Hello,
Alright I recently won an AMD proc from a contest on twitter and as a result decided to purchase a new mobo/memory (I was upgrading from Intel/ddr2 to AMD/ddr3). Originally, after performing the swap, I noticed some instability; some programs and games would crash for no apparent reason, and I received a BSOD once or twice before deciding I should reinstall.

I had thought it was a driver conflict seeing as how I performed a pretty serious change on hardware but:

I reformatted and reinstalled Windows, yet the problem persists. Attached is the requested information. Please provide any guidance you can. Thanks in advance.

fimble · 22 Jan 2011

Hi DavidP,

Norton is known to be a cause of BSOD's on some Win 7 systems. I suggest that you uninstall Norton using the Norton Removal Tool in Safe Mode until your issue is resolved. Download Blue Screen friendly Microsoft Security Essentials as its replacement. Make sure Windows firewall is enabled!

More driver updates to follow..................

fimble · 22 Jan 2011

Updates Available:

Rt64win7.sys Wed Jun 23 10:10:45 2010 Realtek LAN RTL811 v7.034

RTKVHD64.sys Tue Jul 06 11:05:16 2010 Realtek HD Audio

Please post back with new dump files as and when BSOD's happen. You can delete the contents of your C:\Windows\Minidump folder now they've been uploaded.

DavidP · 23 Jan 2011

Alright, downloaded/installed both drivers from the links provided, I don't think they were much newer, but I gave it a shot.

Also rebooted in safe/ran the Norton Removal Tool.

Blue screened today about an hour or so ago. Please advise on what to do next.
Thanks in advance!

Also, I realize that the perfmon states a usb device isn't working properly. Please disregard as this was not a symptom of the previous crash, I plugged this in later.

CarlTR6 · 23 Jan 2011

David, I looked at all four of your dumps. All four of them indicate memory corruption. two of them blame a Windows system core file, which is highly unlikely to be the real cause. The other two of them blame NTFS.sys, which is your file system. I suggest you run CheckDisk -

Run CHKDSK /R /F from an elevated (Run as adminstrator) Command Prompt. Please do this for each hard drive on your system.
When it tells you it can't do it right now - and asks you if you'd like to do it at the next reboot - answer Y (for Yes) and press Enter. Then reboot and let the test run. It may take a while for it to run, but keep an occasional eye on it to see if it generates any errors. See "CHKDSK LogFile" below in order to check the results of the test.

Elevated Command Prompt:
Go to Start and type in "cmd.exe" (without the quotes)
At the top of the Search Box, right click on Cmd.exe and select "Run as administrator"

CHKDSK LogFile:
Go to Start and type in "eventvwr.msc" (without the quotes) and press Enter
Expand the Windows logs heading, then select the Application log file entry.
Double click on the Source column header.
Scroll down the list until you find the Chkdsk entry (wininit for Windows 7).

Copy/paste the results into your next post.

I notice that you are running a RAID array. Win 7 can be really finicky about RAID.

I suggest that while you are troubleshooting you uninstall PCTools startup and shutdown monitor. Sometimes this 3rd party utilities create conflicts with Win 7.

Code:

Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a04000 PsLoadedModuleList = 0xfffff800`02c41e50
Debug session time: Sat Jan 22 18:44:23.346 2011 (GMT-5)
System Uptime: 0 days 0:15:29.406
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002a79105, fffff880067febd0, 0}

Probably caused by : ntkrnlmp.exe ( nt!ExpInterlockedPopEntrySListFault16+0 )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002a79105, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff880067febd0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`02a79105 498b08          mov     rcx,qword ptr [r8]

CONTEXT:  fffff880067febd0 -- (.cxr 0xfffff880067febd0)
rax=00000002ce640004 rbx=fffff900c22c0b60 rcx=fffffa8005fa0ef0
rdx=ff7ff900c22bf741 rsi=fffffa8005fa0ef0 rdi=0000000000000200
rip=fffff80002a79105 rsp=fffff880067ff5b0 rbp=fffff900c22c0b60
 r8=ff7ff900c22bf740  r9=0000000000000000 r10=fffffa8005fa0ef0
r11=fffff900c2a42c30 r12=0000000000000000 r13=0000000000000000
r14=00000000010c014a r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00210282
nt!ExpInterlockedPopEntrySListFault16:
fffff800`02a79105 498b08          mov     rcx,qword ptr [r8] ds:002b:ff7ff900`c22bf740=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  League of Lege

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002a79105

STACK_TEXT:  
fffff880`067ff5b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExpInterlockedPopEntrySListFault16


FOLLOWUP_IP: 
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`02a79105 498b08          mov     rcx,qword ptr [r8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExpInterlockedPopEntrySListFault16+0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

STACK_COMMAND:  .cxr 0xfffff880067febd0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!ExpInterlockedPopEntrySListFault16+0

BUCKET_ID:  X64_0x3B_nt!ExpInterlockedPopEntrySListFault16+0

Followup: MachineOwner
---------

Debug session time: Sat Jan 22 21:24:07.040 2011 (GMT-5)
System Uptime: 0 days 0:49:47.006
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88008a41718, fffff88008a40f80, fffff880012dac50}

Probably caused by : Ntfs.sys ( Ntfs!NtfsFindPrefixHashEntry+227 )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88008a41718
Arg3: fffff88008a40f80
Arg4: fffff880012dac50

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88008a41718 -- (.exr 0xfffff88008a41718)
ExceptionAddress: fffff880012dac50 (Ntfs!NtfsFindPrefixHashEntry+0x0000000000000227)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88008a40f80 -- (.cxr 0xfffff88008a40f80)
rax=00000000000000b0 rbx=fffff8a00988f7f0 rcx=0000000000000612
rdx=0000000000000001 rsi=fffff8a0002b1bc0 rdi=fffffa8007a2c350
rip=fffff880012dac50 rsp=fffff88008a41950 rbp=0000000000006480
 r8=0000000005894309  r9=0000000000000000 r10=0000000000000000
r11=fffff88008a41998 r12=ff7ff8a00986d450 r13=fffff88002b13bf0
r14=0000000000000309 r15=0000000000000309
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
Ntfs!NtfsFindPrefixHashEntry+0x227:
fffff880`012dac50 498b7c2418      mov     rdi,qword ptr [r12+18h] ds:002b:ff7ff8a0`0986d468=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cfe0e0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsFindPrefixHashEntry+227
fffff880`012dac50 498b7c2418      mov     rdi,qword ptr [r12+18h]

FAULTING_IP: 
Ntfs!NtfsFindPrefixHashEntry+227
fffff880`012dac50 498b7c2418      mov     rdi,qword ptr [r12+18h]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff880012dbce2 to fffff880012dac50

STACK_TEXT:  
fffff880`08a41950 fffff880`012dbce2 : fffffa80`0800b010 fffffa80`07a2c350 fffff8a0`002b1bc0 00000000`00000701 : Ntfs!NtfsFindPrefixHashEntry+0x227
fffff880`08a41a80 fffff880`012d628d : fffffa80`0800b010 fffffa80`06dc54b0 fffff880`08a41c60 fffff880`08a41ca8 : Ntfs!NtfsFindStartingNode+0x452
fffff880`08a41b50 fffff880`0123fc0d : fffffa80`0800b010 fffffa80`06dc54b0 fffff880`02b13bf0 fffffa80`08c60000 : Ntfs!NtfsCommonCreate+0x3dd
fffff880`08a41d30 fffff800`02abe5c7 : fffff880`02b13b60 00000000`003ee1a0 00000000`77584270 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`08a41d60 fffff800`02abe581 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27
fffff880`02b13a30 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsFindPrefixHashEntry+227

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

STACK_COMMAND:  .cxr 0xfffff88008a40f80 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsFindPrefixHashEntry+227

BUCKET_ID:  X64_0x24_Ntfs!NtfsFindPrefixHashEntry+227

Followup: MachineOwner
---------

Debug session time: Sun Jan 23 20:57:05.434 2011 (GMT-5)
System Uptime: 0 days 0:38:03.400
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.

FAULTING_IP: 
+513e952f00dbdcec
00000000`00000000 ??              ???

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  System

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff80000b9c328 -- (.exr 0xfffff80000b9c328)
ExceptionAddress: fffff80002ad83c5 (nt!KiTimerWaitTest+0x00000000000002a5)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: ffffffffffffffff
   Parameter[1]: 0000000000000000
Attempt to execute non-executable address 0000000000000000

TRAP_FRAME:  fffff80000b9c3d0 -- (.trap 0xfffff80000b9c3d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000000
rdx=ff7ffa8007fc66e8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ad83c5 rsp=fffff80000b9c560 rbp=ff7ffa8007fc66e8
 r8=fffffa8007fc6700  r9=00000000000000c9 r10=fffff80002c48e80
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
nt!KiTimerWaitTest+0x2a5:
fffff800`02ad83c5 488b6d00        mov     rbp,qword ptr [rbp] ss:0018:ff7ffa80`07fc66e8=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ac646e to fffff80002ace710

STACK_TEXT:  
fffff800`00b9b418 fffff800`02ac646e : 00000000`00000002 00000000`00000001 fffff800`00b9bb90 fffff800`02afb668 : nt!KeBugCheck
fffff800`00b9b420 fffff800`02af440d : fffff800`02cdcb7c fffff800`02c16e84 fffff800`02a5e000 fffff800`00b9c328 : nt!KiKernelCalloutExceptionHandler+0xe
fffff800`00b9b450 fffff800`02afba90 : fffff800`02c1db14 fffff800`00b9b4c8 fffff800`00b9c328 fffff800`02a5e000 : nt!RtlpExecuteHandlerForException+0xd
fffff800`00b9b480 fffff800`02b089ef : fffff800`00b9c328 fffff800`00b9bb90 fffff800`00000000 fffffa80`07fc66e0 : nt!RtlDispatchException+0x410
fffff800`00b9bb60 fffff800`02acdd82 : fffff800`00b9c328 fffffa80`07fc66e8 fffff800`00b9c3d0 fffffa80`07fc6720 : nt!KiDispatchException+0x16f
fffff800`00b9c1f0 fffff800`02acc552 : fffff800`02c56c40 fffff800`02c56c40 fffff800`00b9d000 fffff800`02adade0 : nt!KiExceptionDispatch+0xc2
fffff800`00b9c3d0 fffff800`02ad83c5 : ffffffff`fff0bdc0 fffff800`02ada29e fffff800`00b9c600 fffff800`00000000 : nt!KiStackFault+0x112
fffff800`00b9c560 fffff800`02ad9d7d : fffffa80`07fc66e0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiTimerWaitTest+0x2a5
fffff800`00b9c5e0 fffff800`02ada4be : 00000005`5103542e fffff800`00b9cc58 00000000`00023bc2 fffff800`02c4cac8 : nt!KiProcessExpiredTimerList+0x6d
fffff800`00b9cc30 fffff800`02ad9cb7 : 00000001`ab6ca2c3 00000001`00023bc2 00000001`ab6ca219 00000000`000000c2 : nt!KiTimerExpiration+0x1be
fffff800`00b9ccd0 fffff800`02ad6eea : fffff800`02c48e80 fffff800`02c56c40 00000000`00000000 fffff880`01457c50 : nt!KiRetireDpcList+0x277
fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiKernelCalloutExceptionHandler+e
fffff800`02ac646e 90              nop

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!KiKernelCalloutExceptionHandler+e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1E_nt!KiKernelCalloutExceptionHandler+e

BUCKET_ID:  X64_0x1E_nt!KiKernelCalloutExceptionHandler+e

Followup: MachineOwner
---------

DavidP · 24 Jan 2011

Alrighty, went ahead and ran chkdsk. Not sure if it relevant, but upon trying to reboot, the computer would POST beep, but no display appeared. After a few resets, I eventually powered down, hit the power supply, then did a cold boot. This time, everything started as normal, and the check disk ran as directed. Here are the results (appears no errors).

Checking file system on C: The type of the file system is NTFS. A disk check has been scheduled. Windows will now check the disk. CHKDSK is verifying files (stage 1 of 5)... 89088 file records processed. File verification completed. 500 large file records processed. 0 bad file records processed. 0 EA records processed. 44 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)... 124376 index entries processed. Index verification completed. 0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)... 89088 file SDs/SIDs processed. Security descriptor verification completed. 17645 data files processed. CHKDSK is verifying Usn Journal... 36680216 USN bytes processed. Usn Journal verification completed. CHKDSK is verifying file data (stage 4 of 5)... 89072 files processed. File data verification completed. CHKDSK is verifying free space (stage 5 of 5)... 63778309 free clusters processed. Free space verification is complete. Windows has checked the file system and found no problems. 312568831 KB total disk space. 57206024 KB in 70516 files. 48544 KB in 17646 indexes. 0 KB in bad sectors. 201023 KB in use by the system. 65536 KB occupied by the log file. 255113240 KB available on disk. 4096 bytes in each allocation unit. 78142207 total allocation units on disk. 63778310 allocation units available on disk. Internal Info: 00 5c 01 00 6d 58 01 00 2d 97 02 00 00 00 00 00 .\..mX..-....... 0d 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 ....,........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Windows has finished checking your disk. Please wait while your computer restarts.

CarlTR6 · 25 Jan 2011

Your hard drive seems to be OK and your file system is good. The post beep indicates a problem, probably hardware. Do you know the beep codes for your your BIOS? Do yo remember the beep sequence you heard?