Crash Dmp - 0x...c2 and 0x...24

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\beeswax\011412-23072-01 - Copy.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03217000 PsLoadedModuleList = 0xfffff800`0345c670
Debug session time: Sat Jan 14 07:01:17.891 2012 (UTC - 7:00)
System Uptime: 0 days 13:52:26.421
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
..........................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, fffffa80091051c0, fffffa8009105950, c792f38}

GetPointerFromAddress: unable to read from fffff800034c6100
GetUlongFromAddress: unable to read from fffff80003434a18
Probably caused by : ntkrnlmp.exe ( nt!FsRtlTeardownPerStreamContexts+e2 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: fffffa80091051c0, The pool entry we were looking for within the page.
Arg3: fffffa8009105950, The next pool entry.
Arg4: 000000000c792f38, (reserved)

Debugging Details:
------------------

GetUlongFromAddress: unable to read from fffff80003434a18

BUGCHECK_STR:  0x19_20

POOL_ADDRESS:  fffffa80091051c0 

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800033c1cae to fffff80003293c40

STACK_TEXT:  
fffff880`0318c898 fffff800`033c1cae : 00000000`00000019 00000000`00000020 fffffa80`091051c0 fffffa80`09105950 : nt!KeBugCheckEx
fffff880`0318c8a0 fffff800`0354c90e : 00000000`00000705 fffff880`012901b3 fffff8a0`7ffffa80 00000000`00000000 : nt!ExDeferredFreePool+0x12da
fffff880`0318c950 fffff880`0128fbac : fffff8a0`15153140 fffffa80`06a1ab60 fffff880`0318ca28 00000000`00000706 : nt!FsRtlTeardownPerStreamContexts+0xe2
fffff880`0318c9a0 fffff880`01294cc1 : 00000000`01000000 00000000`00000000 fffff800`03434200 00000000`00000001 : Ntfs!NtfsDeleteScb+0x108
fffff880`0318c9e0 fffff880`0120d85c : fffff8a0`15153040 fffff8a0`15153140 fffff800`03434200 fffff880`0318cb52 : Ntfs!NtfsRemoveScb+0x61
fffff880`0318ca20 fffff880`0129264c : fffff8a0`15153010 fffff800`03434260 fffff880`0318cb52 fffffa80`0a2b68d0 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`0318ca50 fffff880`012140e2 : fffffa80`0a2b68d0 fffffa80`0a2b68d0 fffff8a0`15153010 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xdc
fffff880`0318cad0 fffff880`012a2193 : fffffa80`0a2b68d0 fffff800`03434260 fffff8a0`15153010 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`0318cb10 fffff880`01291357 : fffffa80`0a2b68d0 fffff8a0`15153140 fffff8a0`15153010 fffffa80`07ba3180 : Ntfs!NtfsCommonClose+0x353
fffff880`0318cbe0 fffff800`0329e001 : 00000000`00000000 fffff800`0358a900 fffff800`03495801 00000000`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`0318ccb0 fffff800`0352efee : 00000000`00000000 fffffa80`06a1ab60 00000000`00000080 fffffa80`069a49e0 : nt!ExpWorkerThread+0x111
fffff880`0318cd40 fffff800`032855e6 : fffff880`02f64180 fffffa80`06a1ab60 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0318cd80 00000000`00000000 : fffff880`0318d000 fffff880`03187000 fffff880`0318c9e0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!FsRtlTeardownPerStreamContexts+e2
fffff800`0354c90e 448a5e07        mov     r11b,byte ptr [rsi+7]

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!FsRtlTeardownPerStreamContexts+e2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x19_20_nt!FsRtlTeardownPerStreamContexts+e2

BUCKET_ID:  X64_0x19_20_nt!FsRtlTeardownPerStreamContexts+e2

Followup: MachineOwner
---------

These types of crashes are usually caused by an underlying driver. The driver was not named in the crash. Recommend running Driver Verifier to determine the driver that is incompatible/conflicting with your system. To run Driver verifier, do the following:

1. Backup your system and user files
2. Create a system restore point
3. If you do not have a Windows 7 DVD, Create a system repair disc
4. Run Driver Verifier
   
   If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.
   
   Thanks to zigzag3143 for contributing to the above steps.
   If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.

I turned on verifier and ran it for 24 hours, without any crashes. Then last night, around 4am, i hear my system fan peak. when i checked it in the morning it was bsod 0x...19.

What program do you use for dmp files? I've tried ms debugging tools, but i can never seem to get the symbols loaded.

DMP file attached

For debugging, we used WinDbg. You can find good information about how to debug in Crash and lockup debug 'How To' - Windows 7 Forums

Code:

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\beeswax\Windows_NT6_BSOD_jcgriff2\012212-25833-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0321c000 PsLoadedModuleList = 0xfffff800`03461670
Debug session time: Sun Jan 22 00:31:08.814 2012 (UTC - 7:00)
System Uptime: 2 days 6:46:51.955
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
..............................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {22, 0, 0, 0}

GetPointerFromAddress: unable to read from fffff800034cb100
GetUlongFromAddress: unable to read from fffff80003439a18
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+72d6 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000022, 
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------

GetUlongFromAddress: unable to read from fffff80003439a18

BUGCHECK_STR:  0x19_22

POOL_ADDRESS:  0000000000000000 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800032254ce to fffff80003298c40

STACK_TEXT:  
fffff880`0976f9c8 fffff800`032254ce : 00000000`00000019 00000000`00000022 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`0976f9d0 fffff800`033c81fa : 00000000`00000000 fffff880`0976fb20 fffff880`0976faa0 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x72d6
fffff880`0976fa60 fffff880`0129e379 : fffffa80`07abe180 fffff800`03439260 fffff8a0`122819f0 00000000`00000000 : nt!ExFreePoolWithTag+0x46a
fffff880`0976fb10 fffff880`0128d357 : fffffa80`07ce2a30 fffff8a0`12281b20 fffff8a0`122819f0 fffffa80`07abe180 : Ntfs!NtfsCommonClose+0x539
fffff880`0976fbe0 fffff800`032a3001 : 00000000`00000000 fffff800`0358f900 fffffa80`08363b01 fffffa80`00000000 : Ntfs!NtfsFspClose+0x15f
fffff880`0976fcb0 fffff800`03533fee : fffff880`09ffd968 fffffa80`08363b60 00000000`00000080 fffffa80`069a49e0 : nt!ExpWorkerThread+0x111
fffff880`0976fd40 fffff800`0328a5e6 : fffff880`009e9180 fffffa80`08363b60 fffff880`009f3fc0 fffff880`01214384 : nt!PspSystemThreadStartup+0x5a
fffff880`0976fd80 00000000`00000000 : fffff880`09770000 fffff880`0976a000 fffff880`0976f9e0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+72d6
fffff800`032254ce cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+72d6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x19_22_nt!_??_::FNODOBFM::_string_+72d6

BUCKET_ID:  X64_0x19_22_nt!_??_::FNODOBFM::_string_+72d6

Followup: MachineOwner
---------

The latest crash was caused by a driver, but it was inconclusive as to which driver caused it. Keep Verifier running and hopefully subsequent crashes will be more informative.

Verified was running this time. Here is the dmp file. Is there a verifier log somewhere?

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [H:\BSODDmpFiles\beeswax\Windows_NT6_BSOD_jcgriff2\012612-38891-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03216000 PsLoadedModuleList = 0xfffff800`0345b670
Debug session time: Thu Jan 26 13:00:00.771 2012 (UTC - 7:00)
System Uptime: 1 days 19:40:45.316
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff880031938d8, fffff88003193130, fffff880012d70af}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonClose+26f )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880031938d8
Arg3: fffff88003193130
Arg4: fffff880012d70af

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880031938d8 -- (.exr 0xfffff880031938d8)
ExceptionAddress: fffff880012d70af (Ntfs!NtfsCommonClose+0x000000000000026f)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000001
Attempt to write to address 0000000000000001

CONTEXT:  fffff88003193130 -- (.cxr 0xfffff88003193130)
rax=0000000000000001 rbx=fffffa8008994450 rcx=0000000000000000
rdx=0000000000000000 rsi=fffff8a002f93b40 rdi=fffff88003193c38
rip=fffff880012d70af rsp=fffff88003193b10 rbp=fffff80003433260
 r8=fffffa800a182418  r9=0000000000000009 r10=0000000000000004
r11=fffffa80085891b8 r12=fffffa80077fa180 r13=0000000000000000
r14=0000000000000000 r15=0000000000000001
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
Ntfs!NtfsCommonClose+0x26f:
fffff880`012d70af 488908          mov     qword ptr [rax],rcx ds:002b:00000000`00000001=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

CURRENT_IRQL:  1

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000001

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034c5100
 0000000000000001 

FOLLOWUP_IP: 
Ntfs!NtfsCommonClose+26f
fffff880`012d70af 488908          mov     qword ptr [rax],rcx

FAULTING_IP: 
Ntfs!NtfsCommonClose+26f
fffff880`012d70af 488908          mov     qword ptr [rax],rcx

BUGCHECK_STR:  0x24

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from fffff880012c6357 to fffff880012d70af

STACK_TEXT:  
fffff880`03193b10 fffff880`012c6357 : fffffa80`08994450 fffff8a0`02f93c70 fffff8a0`02f93b40 fffffa80`077fa180 : Ntfs!NtfsCommonClose+0x26f
fffff880`03193be0 fffff800`0329d001 : 00000000`00000000 fffff800`03589900 fffffa80`0763a101 fffffa80`00000000 : Ntfs!NtfsFspClose+0x15f
fffff880`03193cb0 fffff800`0352dfee : 00000000`00000000 fffffa80`0763a1a0 00000000`00000080 fffffa80`069fb040 : nt!ExpWorkerThread+0x111
fffff880`03193d40 fffff800`032845e6 : fffff880`02f64180 fffffa80`0763a1a0 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03193d80 00000000`00000000 : fffff880`03194000 fffff880`0318e000 fffff880`031939e0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsCommonClose+26f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

STACK_COMMAND:  .cxr 0xfffff88003193130 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsCommonClose+26f

BUCKET_ID:  X64_0x24_Ntfs!NtfsCommonClose+26f

Followup: MachineOwner
---------

Not a Verifier related crash; points to the hard disk file system. Possible causes are Memory problems... Corrupted hard disk system files... Drivers... corrupted SCSI or IDE Drivers...

Since you have had multiple crashes like this: Are you using any defragmenting software other than that provided by Windows? Are you using backup software provided by another company?

Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log

Uninstall and re-install all hard drive devices in Device Manager within the IDE ATA/ATAPI devices section. If you need help with this step, let us know.

I only am running the built-in defragmenter

I have not uninstalled/reinstalled ide yet. I just want to mak sure i understand first.
go into device mangr - expand ide controllers
i have listed 6 items - ata channel 0/0/1/1, standard dual channel controler x2
right click each item and uninstall
reboot

　
Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
410624 file records processed. File verification completed.
1647 large file records processed. 0 bad file records processed. 0 EA records processed. 104 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
530436 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
410624 file SDs/SIDs processed. Cleaning up 301 unused index entries from index $SII of file 0x9.
Cleaning up 301 unused index entries from index $SDH of file 0x9.
Cleaning up 301 unused security descriptors.
Security descriptor verification completed.
59907 data files processed. CHKDSK is verifying Usn Journal...
34955440 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
410608 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
144969948 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.
732469247 KB total disk space.
151861836 KB in 307347 files.
191624 KB in 59908 indexes.
0 KB in bad sectors.
535991 KB in use by the system.
65536 KB occupied by the log file.
579879796 KB available on disk.
4096 bytes in each allocation unit.
183117311 total allocation units on disk.
144969949 allocation units available on disk.
Internal Info:
00 44 06 00 a3 9a 05 00 f9 38 0a 00 00 00 00 00 .D.......8......
98 cf 00 00 68 00 00 00 00 00 00 00 00 00 00 00 ....h...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.

beeswax said:

I only am running the built-in defragmenter

Good, that rules that out as a possible reason for the crash.

beeswax said:

I have not uninstalled/reinstalled ide yet. I just want to mak sure i understand first.
go into device mangr - expand ide controllers
i have listed 6 items - ata channel 0/0/1/1, standard dual channel controler x2
right click each item and uninstall
reboot

Correct; right click each item, click uninstall, if the dialog box has a box to tick for deleting driver software for the device, tick it, and hit ok. Then restart your computer once you have done so for all devices in the list.
　

beeswax said:

Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
410624 file records processed. File verification completed.
1647 large file records processed. 0 bad file records processed. 0 EA records processed. 104 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
530436 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
410624 file SDs/SIDs processed. Cleaning up 301 unused index entries from index $SII of file 0x9.
Cleaning up 301 unused index entries from index $SDH of file 0x9.
Cleaning up 301 unused security descriptors.
Security descriptor verification completed.
59907 data files processed. CHKDSK is verifying Usn Journal...
34955440 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
410608 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
144969948 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.
732469247 KB total disk space.
151861836 KB in 307347 files.
191624 KB in 59908 indexes.
0 KB in bad sectors.
535991 KB in use by the system.
65536 KB occupied by the log file.
579879796 KB available on disk.
4096 bytes in each allocation unit.
183117311 total allocation units on disk.
144969949 allocation units available on disk.
Internal Info:
00 44 06 00 a3 9a 05 00 f9 38 0a 00 00 00 00 00 .D.......8......
98 cf 00 00 68 00 00 00 00 00 00 00 00 00 00 00 ....h...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.

File system came back clean. That means it was probably a corrupted driver, but it could still be an underlying driver that we have not yet discovered.

Remove the following from your computer: AMD Overdrive; also in EasyTune6 for Gigabyte motherboard. This is known to cause blue screen crashes in some systems.

I removed easytune and overdrive back in december, but i went thru and doubled checked for them anyhow.

Uninstalled and rebooted for the IDE controllers.

fingers are crossed again.

AODDriver2.sys is still on your system and loaded. Try renaming it in C:\Windows\System32\Drivers to AODDriver2.sys.bak and see if it provides more stability.

i looked is sys32 and didn;t see the driver in there. I also did two searches, one for AODDriver2 and one for AOD*. I didn;t not receive results for either.