Random BSODs related to ntfs.sys and system kernel

cvmm69 · 13 Feb 2012

I've had several bsods a day for about a week now. They mostly occur when the system is left alone for even a few minutes, but also when i'm playing a game (mostly DooM 3). Sometimes they are caused by ntfs.sys, sometimes the system kernel itself (ntkrnlmp.exe) crashes. I've attached all the dump files from c:\windows\minidump here.

I've recently updated my pc, and before the upgrade it was running fine and stable. I'm guessing it has something to do with the parts i upgraded, which were my graphics card (from VTX3D Radeon HD 5670 to XFX Radeon HD 6850) and my memory (from two A-Data AD2800E001GOU to four

A-DATA AD2U800B2G6-B model sticks)

System specs:

System: Windows 7 Home Premium 64-bit

Motherboard: ASUS M2N
Processor: AMD Athlon X2 4200+
Memory: 4x A-DATA AD2U800B2G6-B 2GB DDR2 800MHz
Graphics Card: XFX Radeon HD 6850 Black Edition
HDD: Samsung Spinpoint F3 3,5" 1TB 7200RPM SATA2

Also, here is what windbg found out about my latest ntfs.sys related bsod:

Code:

MODULE_NAME: Ntfs

FAULTING_MODULE: fffff80003066000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79996d

EXCEPTION_RECORD:  fffff880061ea088 -- (.exr 0xfffff880061ea088)
ExceptionAddress: fffff8800141b11d (Ntfs+0x000000000000d11d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff880061e98f0 -- (.cxr 0xfffff880061e98f0)
rax=0000000000000000 rbx=0000000000000000 rcx=ffdff8a012d477c0
rdx=0000000000000000 rsi=0000000000000000 rdi=fffff8a012d476f0
rip=fffff8800141b11d rsp=fffff880061ea2c0 rbp=fffff880061ea660
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000010 r12=fffffa800b8c1e40 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr ac po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010256
Ntfs+0xd11d:
fffff880`0141b11d 48393408        cmp     qword ptr [rax+rcx],rsi ds:002b:ffdff8a0`12d477c0=????????????????
Resetting default scope

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x24

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff88001414b68 to fffff8800141b11d

STACK_TEXT:  
fffff880`061ea2c0 fffff880`01414b68 : fffffa80`0b8c1e40 fffff8a0`12d476f0 00000000`00000000 fffff880`061ea4f0 : Ntfs+0xd11d
fffff880`061ea430 fffff880`0141a092 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff8a0`12d476f0 00000000`00000000 : Ntfs+0x6b68
fffff880`061ea5c0 fffff880`0141d2a6 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff8a0`12d476f0 fffff8a0`12d475c0 : Ntfs+0xc092
fffff880`061ea790 fffff880`0141fcf8 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff880`061ea901 fffffa80`079b4801 : Ntfs+0xf2a6
fffff880`061ea930 fffff880`012cb23f : fffffa80`0aa8d7d0 fffffa80`0aa8d430 fffffa80`079b48d0 00000000`00000000 : Ntfs+0x11cf8
fffff880`061ea9e0 fffff880`012c96df : fffffa80`091e42c0 fffffa80`0aa8d430 fffffa80`091e4200 fffffa80`0aa8d430 : fltmgr!FltIsCallbackDataDirty+0xa2f
fffff880`061eaa70 fffff800`030c80c2 : fffffa80`0aa8d450 fffffa80`0b883f20 00000000`00000403 fffff880`009e8180 : fltmgr+0x16df
fffff880`061eaad0 fffff800`03372e37 : fffffa80`0a869000 fffffa80`0a869000 fffffa80`0a8690d1 fffffa80`0a869010 : nt!IoPageRead+0x252
fffff880`061eab60 fffff800`03372f31 : fffffa80`0b8645c0 fffffa80`0aa86760 fffff880`061eac98 00000000`00000004 : nt!RtlCompareUnicodeString+0x677
fffff880`061eabc0 fffff800`0311abed : fffffa80`0b8645c0 00000000`00000000 00000000`00001000 00000000`00000000 : nt!RtlCompareUnicodeString+0x771
fffff880`061eac10 fffff800`033f07fb : 00000000`00000000 00000000`00000000 fffffa80`0b883f20 fffffa80`0b95f5d0 : nt!IoGetAttachedDevice+0x19d
fffff880`061eac70 fffff880`01418d50 : fffff8a0`00000000 fffff800`00000004 fffffa80`00040000 fffff880`0146b001 : nt!CcCopyRead+0x16b
fffff880`061ead30 fffff880`0141d083 : 00000000`00000000 fffff8a0`12d476f0 fffff880`061eaf60 00000000`00000000 : Ntfs+0xad50
fffff880`061ead90 fffff880`0141fcf8 : fffffa80`0b8c7e40 fffffa80`0b32a410 fffff880`061eaf01 fffffa80`0aa85c00 : Ntfs+0xf083
fffff880`061eaf30 fffff880`012cb23f : fffffa80`0b32a7b0 fffffa80`0b32a410 fffffa80`0aa85c30 00000000`00000000 : Ntfs+0x11cf8
fffff880`061eafe0 fffff880`012cd94a : 00000000`00000000 00000000`00000000 fffffa80`09ad1700 fffffa80`0aa85c30 : fltmgr!FltIsCallbackDataDirty+0xa2f
fffff880`061eb070 fffff880`012da204 : fffffa80`084e1c10 00000000`00000019 fffffa80`07cd7510 00000000`00000000 : fltmgr!FltPerformSynchronousIo+0x2ca
fffff880`061eb110 fffff880`06362e25 : 00000000`00000000 fffffa80`07cd7510 00000000`00000000 00000000`00000000 : fltmgr!FltReadFile+0x334
fffff880`061eb1f0 fffff880`063621f0 : fffffa80`09ad1700 fffffa80`0aa85c30 00000007`00000010 00000002`00000004 : aswMonFlt+0x2e25
fffff880`061eb330 fffff880`0639636d : 00000000`00000000 fffffa80`0782fae0 fffff880`061eb458 fffff880`00000000 : aswMonFlt+0x21f0
fffff880`061eb400 fffff880`012cc242 : 00000000`00000000 00000000`00000000 fffffa80`0b8247d0 00000000`00000000 : aswMonFlt+0x3636d
fffff880`061eb530 fffff880`012cb38b : fffffa80`07cc1030 fffffa80`0782fb80 fffffa80`09ad17b0 fffffa80`09ad19d0 : fltmgr!FltIsCallbackDataDirty+0x1a32
fffff880`061eb600 fffff880`012ea2b9 : fffffa80`0b824430 fffffa80`07cd7510 fffffa80`0b824400 fffffa80`091e42c0 : fltmgr!FltIsCallbackDataDirty+0xb7b
fffff880`061eb690 fffff800`033d6537 : 00000000`00000005 fffff800`033d5f90 fffffa80`0b606a10 00000000`00000000 : fltmgr!FltReadFile+0x103e9
fffff880`061eb740 fffff800`033ccba4 : fffffa80`07c9fad0 00000000`00000000 fffffa80`0b89ab10 00000000`00000701 : nt!SeUnlockSubjectContext+0x647
fffff880`061eb8d0 fffff800`033d1b7d : fffffa80`0b89ab10 fffff880`061eba30 fffffa80`00000040 fffffa80`06d22080 : nt!SeQueryInformationToken+0x2104
fffff880`061eb9d0 fffff800`033d8647 : fffffa80`0add1cd0 00000000`00000001 fffffa80`0b1ab001 fffffa80`099f7570 : nt!ObOpenObjectByName+0x1cd
fffff880`061eba80 fffff800`033e2398 : 00000000`02cd85e8 00000000`00100081 fffffa80`0aa86760 00000000`02cd85f8 : nt!SeUnlockSubjectContext+0x2757
fffff880`061ebb20 fffff800`030d5813 : 00000000`00000000 fffff800`033f0000 fffff880`061ebca0 00000000`00000000 : nt!NtCreateFile+0x78
fffff880`061ebbb0 00000000`777ffc0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeSynchronizeExecution+0x3a43
00000000`02cd8568 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777ffc0a


FOLLOWUP_IP: 
Ntfs+d11d
fffff880`0141b11d 48393408        cmp     qword ptr [rax+rcx],rsi

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs+d11d

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  Ntfs.sys

STACK_COMMAND:  .cxr 0xfffff880061e98f0 ; kb

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

1: kd> .exr 0xfffff880061ea088
ExceptionAddress: fffff8800141b11d (Ntfs+0x000000000000d11d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
1: kd> lmvm Ntfs
start             end                 module name
fffff880`0140e000 fffff880`015b0000   Ntfs       (no symbols)           
    Loaded symbol image file: Ntfs.sys
    Image path: \SystemRoot\System32\Drivers\Ntfs.sys
    Image name: Ntfs.sys
    Timestamp:        Fri Mar 11 05:39:25 2011 (4D79996D)
    CheckSum:         00199985
    ImageSize:        001A2000
    File version:     6.1.7600.16778
    Product version:  6.1.7600.16778
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntfs.sys
    OriginalFilename: ntfs.sys
    ProductVersion:   6.1.7600.16778
    FileVersion:      6.1.7600.16778 (win7_gdr.110310-1506)
    FileDescription:  NT File System Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

Help is much appreciated, I'm getting tired of solving this alone.

zigzag3143 · 13 Feb 2012

cvmm69 said:

I've had several bsods a day for about a week now. They mostly occur when the system is left alone for even a few minutes, but also when i'm playing a game (mostly DooM 3). Sometimes they are caused by ntfs.sys, sometimes the system kernel itself (ntkrnlmp.exe) crashes. I've attached all the dump files from c:\windows\minidump here.

I've recently updated my pc, and before the upgrade it was running fine and stable. I'm guessing it has something to do with the parts i upgraded, which were my graphics card (from VTX3D Radeon HD 5670 to XFX Radeon HD 6850) and my memory (from two A-Data AD2800E001GOU to four

A-DATA AD2U800B2G6-B model sticks)

System specs:

System: Windows 7 Home Premium 64-bit

Motherboard: ASUS M2N
Processor: AMD Athlon X2 4200+
Memory: 4x A-DATA AD2U800B2G6-B 2GB DDR2 800MHz
Graphics Card: XFX Radeon HD 6850 Black Edition
HDD: Samsung Spinpoint F3 3,5" 1TB 7200RPM SATA2

Also, here is what windbg found out about my latest ntfs.sys related bsod:

Code:

MODULE_NAME: Ntfs

FAULTING_MODULE: fffff80003066000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79996d

EXCEPTION_RECORD:  fffff880061ea088 -- (.exr 0xfffff880061ea088)
ExceptionAddress: fffff8800141b11d (Ntfs+0x000000000000d11d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff880061e98f0 -- (.cxr 0xfffff880061e98f0)
rax=0000000000000000 rbx=0000000000000000 rcx=ffdff8a012d477c0
rdx=0000000000000000 rsi=0000000000000000 rdi=fffff8a012d476f0
rip=fffff8800141b11d rsp=fffff880061ea2c0 rbp=fffff880061ea660
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000010 r12=fffffa800b8c1e40 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr ac po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010256
Ntfs+0xd11d:
fffff880`0141b11d 48393408        cmp     qword ptr [rax+rcx],rsi ds:002b:ffdff8a0`12d477c0=????????????????
Resetting default scope

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x24

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff88001414b68 to fffff8800141b11d

STACK_TEXT:  
fffff880`061ea2c0 fffff880`01414b68 : fffffa80`0b8c1e40 fffff8a0`12d476f0 00000000`00000000 fffff880`061ea4f0 : Ntfs+0xd11d
fffff880`061ea430 fffff880`0141a092 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff8a0`12d476f0 00000000`00000000 : Ntfs+0x6b68
fffff880`061ea5c0 fffff880`0141d2a6 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff8a0`12d476f0 fffff8a0`12d475c0 : Ntfs+0xc092
fffff880`061ea790 fffff880`0141fcf8 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff880`061ea901 fffffa80`079b4801 : Ntfs+0xf2a6
fffff880`061ea930 fffff880`012cb23f : fffffa80`0aa8d7d0 fffffa80`0aa8d430 fffffa80`079b48d0 00000000`00000000 : Ntfs+0x11cf8
fffff880`061ea9e0 fffff880`012c96df : fffffa80`091e42c0 fffffa80`0aa8d430 fffffa80`091e4200 fffffa80`0aa8d430 : fltmgr!FltIsCallbackDataDirty+0xa2f
fffff880`061eaa70 fffff800`030c80c2 : fffffa80`0aa8d450 fffffa80`0b883f20 00000000`00000403 fffff880`009e8180 : fltmgr+0x16df
fffff880`061eaad0 fffff800`03372e37 : fffffa80`0a869000 fffffa80`0a869000 fffffa80`0a8690d1 fffffa80`0a869010 : nt!IoPageRead+0x252
fffff880`061eab60 fffff800`03372f31 : fffffa80`0b8645c0 fffffa80`0aa86760 fffff880`061eac98 00000000`00000004 : nt!RtlCompareUnicodeString+0x677
fffff880`061eabc0 fffff800`0311abed : fffffa80`0b8645c0 00000000`00000000 00000000`00001000 00000000`00000000 : nt!RtlCompareUnicodeString+0x771
fffff880`061eac10 fffff800`033f07fb : 00000000`00000000 00000000`00000000 fffffa80`0b883f20 fffffa80`0b95f5d0 : nt!IoGetAttachedDevice+0x19d
fffff880`061eac70 fffff880`01418d50 : fffff8a0`00000000 fffff800`00000004 fffffa80`00040000 fffff880`0146b001 : nt!CcCopyRead+0x16b
fffff880`061ead30 fffff880`0141d083 : 00000000`00000000 fffff8a0`12d476f0 fffff880`061eaf60 00000000`00000000 : Ntfs+0xad50
fffff880`061ead90 fffff880`0141fcf8 : fffffa80`0b8c7e40 fffffa80`0b32a410 fffff880`061eaf01 fffffa80`0aa85c00 : Ntfs+0xf083
fffff880`061eaf30 fffff880`012cb23f : fffffa80`0b32a7b0 fffffa80`0b32a410 fffffa80`0aa85c30 00000000`00000000 : Ntfs+0x11cf8
fffff880`061eafe0 fffff880`012cd94a : 00000000`00000000 00000000`00000000 fffffa80`09ad1700 fffffa80`0aa85c30 : fltmgr!FltIsCallbackDataDirty+0xa2f
fffff880`061eb070 fffff880`012da204 : fffffa80`084e1c10 00000000`00000019 fffffa80`07cd7510 00000000`00000000 : fltmgr!FltPerformSynchronousIo+0x2ca
fffff880`061eb110 fffff880`06362e25 : 00000000`00000000 fffffa80`07cd7510 00000000`00000000 00000000`00000000 : fltmgr!FltReadFile+0x334
fffff880`061eb1f0 fffff880`063621f0 : fffffa80`09ad1700 fffffa80`0aa85c30 00000007`00000010 00000002`00000004 : aswMonFlt+0x2e25
fffff880`061eb330 fffff880`0639636d : 00000000`00000000 fffffa80`0782fae0 fffff880`061eb458 fffff880`00000000 : aswMonFlt+0x21f0
fffff880`061eb400 fffff880`012cc242 : 00000000`00000000 00000000`00000000 fffffa80`0b8247d0 00000000`00000000 : aswMonFlt+0x3636d
fffff880`061eb530 fffff880`012cb38b : fffffa80`07cc1030 fffffa80`0782fb80 fffffa80`09ad17b0 fffffa80`09ad19d0 : fltmgr!FltIsCallbackDataDirty+0x1a32
fffff880`061eb600 fffff880`012ea2b9 : fffffa80`0b824430 fffffa80`07cd7510 fffffa80`0b824400 fffffa80`091e42c0 : fltmgr!FltIsCallbackDataDirty+0xb7b
fffff880`061eb690 fffff800`033d6537 : 00000000`00000005 fffff800`033d5f90 fffffa80`0b606a10 00000000`00000000 : fltmgr!FltReadFile+0x103e9
fffff880`061eb740 fffff800`033ccba4 : fffffa80`07c9fad0 00000000`00000000 fffffa80`0b89ab10 00000000`00000701 : nt!SeUnlockSubjectContext+0x647
fffff880`061eb8d0 fffff800`033d1b7d : fffffa80`0b89ab10 fffff880`061eba30 fffffa80`00000040 fffffa80`06d22080 : nt!SeQueryInformationToken+0x2104
fffff880`061eb9d0 fffff800`033d8647 : fffffa80`0add1cd0 00000000`00000001 fffffa80`0b1ab001 fffffa80`099f7570 : nt!ObOpenObjectByName+0x1cd
fffff880`061eba80 fffff800`033e2398 : 00000000`02cd85e8 00000000`00100081 fffffa80`0aa86760 00000000`02cd85f8 : nt!SeUnlockSubjectContext+0x2757
fffff880`061ebb20 fffff800`030d5813 : 00000000`00000000 fffff800`033f0000 fffff880`061ebca0 00000000`00000000 : nt!NtCreateFile+0x78
fffff880`061ebbb0 00000000`777ffc0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeSynchronizeExecution+0x3a43
00000000`02cd8568 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777ffc0a


FOLLOWUP_IP: 
Ntfs+d11d
fffff880`0141b11d 48393408        cmp     qword ptr [rax+rcx],rsi

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs+d11d

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  Ntfs.sys

STACK_COMMAND:  .cxr 0xfffff880061e98f0 ; kb

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

1: kd> .exr 0xfffff880061ea088
ExceptionAddress: fffff8800141b11d (Ntfs+0x000000000000d11d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
1: kd> lmvm Ntfs
start             end                 module name
fffff880`0140e000 fffff880`015b0000   Ntfs       (no symbols)           
    Loaded symbol image file: Ntfs.sys
    Image path: \SystemRoot\System32\Drivers\Ntfs.sys
    Image name: Ntfs.sys
    Timestamp:        Fri Mar 11 05:39:25 2011 (4D79996D)
    CheckSum:         00199985
    ImageSize:        001A2000
    File version:     6.1.7600.16778
    Product version:  6.1.7600.16778
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntfs.sys
    OriginalFilename: ntfs.sys
    ProductVersion:   6.1.7600.16778
    FileVersion:      6.1.7600.16778 (win7_gdr.110310-1506)
    FileDescription:  NT File System Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

Help is much appreciated, I'm getting tired of solving this alone.

Quite a few issues here.

1-ASACPI.SYS. the 2005 version (yours) crashes.

Asacpi.sys

The pre 2009 version of this driver is a known bsod cause.

Please visit this link: Asus tek computer inc. -support- drivers and download p7p55d le

ASUSTeK Computer Inc. -Support- Drivers and Download P7P55D LE
ASUSTeK Computer Inc. - Motherboards- ASUS P5K-VM

Scroll down to the utilities category, then scroll down to the "atk0110 driver for windowsxp/vista/windows 7 32&64-bit" (it's about the 12th item down).

Download and install it.

Go to c:\windows\system32\drivers to check and make sure that the asacpi.sys file is date stamped from 2009 or 2010 (notbefore).

2-Old drivers

Code:

ASACPI.sys    3/27/2005 9:30:36 PM    fffff880`04139000    fffff880`04141000            0x00008000    0x42476c4c                    
SynUSB64.sys    10/24/2007 3:38:29 AM    fffff880`03fe6000    fffff880`03ff1000            0x0000b000    0x471f0485                                                       
nvstor64.sys    8/18/2008 8:53:39 PM    fffff880`00dc0000    fffff880`00dec000            0x0002c000    0x48aa27a3                    
hamachi.sys    2/19/2009 5:36:41 AM    fffff880`045ea000    fffff880`045f5000            0x0000b000    0x499d3639                                     
L8042Kbd.sys    6/17/2009 11:50:43 AM    fffff880`0415f000    fffff880`0416a000            0x0000b000    0x4a391ee3

How To Find Drivers:

- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

3-SPTD.SYS

Please remove any CD visualization programs such as Daemon Tools and Alcohol 120%.

They use a driver, found in your dmp, called sptd.sys, that is notorious for causing BSODs.

Use this SPTD uninstaller DuplexSecure - Downloads DuplexSecure - FAQ

when you're done you can use this Freeware:

MagicISO Virtual CD/DVD-ROM (MagicDisc) in its place

Using MagicISO to create ISO image files

4-Avast

Avast can be a contributing cause of BSOD'S . Please remove and replace with Microsoft Security Essentials AT LEAST TO TEST

http://files.avast.com/files/eng/aswclear5.exe

Microsoft Security Essentials - Free Antivirus for Windows

cvmm69 · 15 Feb 2012

Thank you for your response.

I did most the things you instructed me to do, but in some cases I could not fix the problem, so it is highly understandable that the bsods still continue to occur.

Here's a list of things I did:

1: ASACPI.SYS - replaced the old 2005 version with a newer version dated 5.14.2009 - downloaded from ASUS website.

2: Outdated Drivers

I found out the purposes of these drivers and took proper actions to fix all error related to these drivers and the software that uses them.

SynUSB64.sys - Synchrosoft eLicenser driver - Newer version is available, but inaccessible due to the Syncrosoft website being down, and alternate download at Syncrosoft License Control Software Informer: Latest version download, news and info about this SIA Syncrosoft program. is unavailable. If someone manages to locate this file, I'm thankful.

nvstor64.sys - NVIDIA NForce SATA driver, replaced old 2008 driver with a never version dated 6.30.2009 - downloaded from nvstor64.sys free download - Sysfiles-download.com

hamachi.sys - Hamachi VPN Software driver - removed the software for a test period of 2-3 months.

L8042kbd.sys - Logitech SetPoint software driver - software removed because no longer needed

3. SPTD.SYS
Removed Daemon Tools Lite and all other virtual disk software - sptd.sys removed using driver installer program downloaded from http://www.duplexsecure.com/download...t-v180-x64.exe. Will install alternate virtual disk software if needed.

4. Avast
Software removed and installed Microsoft Security Essentials to test for a maximum period of 2 months.

After all installations I wiped off the traces of the installations using CCleaner, also ran a test for registery errors several times.

Also, a new kind of bsod occurred today: it was caused by atikmdag.sys, which is the kernel of my graphics card software. AMD Driver Updater and Steam both confirm that my driver is up to date (version 8.1.1.1223, 12.6.2011), so it is highly likely that it was not caused by the driver itself. I hope it comes up in the dump files.
Attached are not only my latest minidump files but also the information recovered using windbg from the newest atikmdag.sys bsod.

Code:

FAULTING_MODULE: fffff80003052000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4edd8367

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
atikmdag+3fa9f9
fffff880`04bfe9f9 488b5108        mov     rdx,qword ptr [rcx+8]

EXCEPTION_RECORD:  fffff88004754fc8 -- (.exr 0xfffff88004754fc8)
ExceptionAddress: fffff88004bfe9f9 (atikmdag+0x00000000003fa9f9)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88004754830 -- (.cxr 0xfffff88004754830)
rax=fffff8a00f6b6108 rbx=0000000f10ef8000 rcx=ffdff8a00f6b6128
rdx=fffff8a00f6b6010 rsi=fffff880047553f0 rdi=fffffa800931bac0
rip=fffff88004bfe9f9 rsp=fffff88004755200 rbp=00000000003ffc00
 r8=0000000000000000  r9=0000000000001000 r10=0000000000000000
r11=fffff88004755308 r12=0000000000000000 r13=fffff8a00f6b6010
r14=fffff88007e50000 r15=0000000000000003
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
atikmdag+0x3fa9f9:
fffff880`04bfe9f9 488b5108        mov     rdx,qword ptr [rcx+8] ds:002b:ffdff8a0`0f6b6130=????????????????
Resetting default scope

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x7E

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff88004bff8d8 to fffff88004bfe9f9

STACK_TEXT:  
fffff880`04755200 fffff880`04bff8d8 : fffffa80`0931bac0 00000000`00000000 00000000`00000000 00000000`00001000 : atikmdag+0x3fa9f9
fffff880`04755310 fffff880`048425fe : fffffa80`0931bae0 0000000f`10ef8000 00000000`00001000 0000000f`00150000 : atikmdag+0x3fb8d8
fffff880`047553c0 fffff880`0413545b : 00000000`00001000 fffff8a0`10de4620 ffffffff`c01e0001 ffffffff`ffffffff : atikmdag+0x3e5fe
fffff880`04755520 fffff880`052929ac : 00000000`00001000 fffff8a0`10de4620 fffff880`c0000001 fffff8a0`10de4620 : atikmpag+0x745b
fffff880`047555a0 fffff880`053a5c9d : fffff8a0`10de4620 fffff8a0`10de4620 00000000`00000000 fffffa80`09691000 : dxgkrnl+0x39ac
fffff880`047555d0 fffff880`053a5b88 : fffff8a0`10de4620 00000000`00000000 00000000`00000000 00000000`00106101 : dxgmms1!VidMmInterface+0x113dd
fffff880`04755760 fffff880`053b2029 : 00000000`00000000 fffffa80`0ae29730 00000000`00000000 00000000`00000000 : dxgmms1!VidMmInterface+0x112c8
fffff880`047557d0 fffff880`053a4af3 : fffffa80`0969ad70 fffff8a0`10de4620 fffffa80`09691000 fffff880`053a4600 : dxgmms1!VidMmInterface+0x1d769
fffff880`047558b0 fffff880`053a1763 : 00000000`00000000 fffffa80`078b8000 00000000`00000000 fffffa80`09b7a270 : dxgmms1!VidMmInterface+0x10233
fffff880`04755910 fffff880`053bb65d : 00000000`00000000 fffff8a0`108ecb10 fffffa80`00000000 fffffa80`07845470 : dxgmms1!VidMmInterface+0xcea3
fffff880`04755ae0 fffff880`053bb398 : fffff880`009ecec0 fffff880`053bad00 fffffa80`00000000 fffffa80`00000000 : dxgmms1!VidMmInterface+0x26d9d
fffff880`04755cd0 fffff880`053bae96 : 00000000`00000000 fffffa80`09470550 00000000`00000080 fffffa80`06d73410 : dxgmms1!VidMmInterface+0x26ad8
fffff880`04755d00 fffff800`033626fa : 00000000`278b0252 fffffa80`06da1b60 fffffa80`06d23040 fffffa80`06da1b60 : dxgmms1!VidMmInterface+0x265d6
fffff880`04755d40 fffff800`030a0b46 : fffff880`009e8180 fffffa80`06da1b60 fffff880`009f2f40 fffff880`01224810 : nt!PsCreateSystemThread+0x6d6
fffff880`04755d80 00000000`00000000 : fffff880`04756000 fffff880`04750000 fffff880`04754d80 00000000`00000000 : nt!KeTestAlertThread+0x93a


FOLLOWUP_IP: 
atikmdag+3fa9f9
fffff880`04bfe9f9 488b5108        mov     rdx,qword ptr [rcx+8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  atikmdag+3fa9f9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME:  atikmdag.sys

STACK_COMMAND:  .cxr 0xfffff88004754830 ; kb

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

0: kd> lmvm atikmdag
start             end                 module name
fffff880`04804000 fffff880`0528f000   atikmdag   (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Tue Dec 06 04:52:23 2011 (4EDD8367)
    CheckSum:         00A43704
    ImageSize:        00A8B000
    File version:     8.1.1.1223
    Product version:  8.1.1.1223
    File flags:       8 (Mask 3F) Private
    File OS:          40004 NT Win32
    File type:        3.4 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Advanced Micro Devices, Inc.
    ProductName:      ATI Radeon Family
    InternalName:     atikmdag.sys
    OriginalFilename: atikmdag.sys
    ProductVersion:   8.01.01.1223
    FileVersion:      8.01.01.1223
    FileDescription:  ATI Radeon Kernel Mode Driver
    LegalCopyright:   Copyright (C) 1998-2011 Advanced Micro Devices, Inc.
0: kd> lmvm nt
start             end                 module name
fffff800`03052000 fffff800`0362e000   nt         (export symbols)       ntkrnlmp.exe
    Loaded symbol image file: ntkrnlmp.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Timestamp:        Thu Jun 23 05:51:48 2011 (4E02AA44)
    CheckSum:         00542941
    ImageSize:        005DC000
    File version:     6.1.7600.16841
    Product version:  6.1.7600.16841
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntkrnlmp.exe
    OriginalFilename: ntkrnlmp.exe
    ProductVersion:   6.1.7600.16841
    FileVersion:      6.1.7600.16841 (win7_gdr.110622-1503)
    FileDescription:  NT Kernel & System
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

All help is much appreciated.

GianniDPC · 15 Feb 2012

cvmm69 said:

Thank you for your response.

I did most the things you instructed me to do, but in some cases I could not fix the problem, so it is highly understandable that the bsods still continue to occur.

Here's a list of things I did:

1: ASACPI.SYS - replaced the old 2005 version with a newer version dated 5.14.2009 - downloaded from ASUS website.

2: Outdated Drivers

I found out the purposes of these drivers and took proper actions to fix all error related to these drivers and the software that uses them.

SynUSB64.sys - Synchrosoft eLicenser driver - Newer version is available, but inaccessible due to the Syncrosoft website being down, and alternate download at Syncrosoft License Control Software Informer: Latest version download, news and info about this SIA Syncrosoft program. is unavailable. If someone manages to locate this file, I'm thankful.

nvstor64.sys - NVIDIA NForce SATA driver, replaced old 2008 driver with a never version dated 6.30.2009 - downloaded from nvstor64.sys free download - Sysfiles-download.com

hamachi.sys - Hamachi VPN Software driver - removed the software for a test period of 2-3 months.

L8042kbd.sys - Logitech SetPoint software driver - software removed because no longer needed

3. SPTD.SYS
Removed Daemon Tools Lite and all other virtual disk software - sptd.sys removed using driver installer program downloaded from http://www.duplexsecure.com/download...t-v180-x64.exe. Will install alternate virtual disk software if needed.

4. Avast
Software removed and installed Microsoft Security Essentials to test for a maximum period of 2 months.

After all installations I wiped off the traces of the installations using CCleaner, also ran a test for registery errors several times.

Also, a new kind of bsod occurred today: it was caused by atikmdag.sys, which is the kernel of my graphics card software. AMD Driver Updater and Steam both confirm that my driver is up to date (version 8.1.1.1223, 12.6.2011), so it is highly likely that it was not caused by the driver itself. I hope it comes up in the dump files.
Attached are not only my latest minidump files but also the information recovered using windbg from the newest atikmdag.sys bsod.

Code:

FAULTING_MODULE: fffff80003052000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4edd8367

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
atikmdag+3fa9f9
fffff880`04bfe9f9 488b5108        mov     rdx,qword ptr [rcx+8]

EXCEPTION_RECORD:  fffff88004754fc8 -- (.exr 0xfffff88004754fc8)
ExceptionAddress: fffff88004bfe9f9 (atikmdag+0x00000000003fa9f9)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88004754830 -- (.cxr 0xfffff88004754830)
rax=fffff8a00f6b6108 rbx=0000000f10ef8000 rcx=ffdff8a00f6b6128
rdx=fffff8a00f6b6010 rsi=fffff880047553f0 rdi=fffffa800931bac0
rip=fffff88004bfe9f9 rsp=fffff88004755200 rbp=00000000003ffc00
 r8=0000000000000000  r9=0000000000001000 r10=0000000000000000
r11=fffff88004755308 r12=0000000000000000 r13=fffff8a00f6b6010
r14=fffff88007e50000 r15=0000000000000003
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
atikmdag+0x3fa9f9:
fffff880`04bfe9f9 488b5108        mov     rdx,qword ptr [rcx+8] ds:002b:ffdff8a0`0f6b6130=????????????????
Resetting default scope

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x7E

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff88004bff8d8 to fffff88004bfe9f9

STACK_TEXT:  
fffff880`04755200 fffff880`04bff8d8 : fffffa80`0931bac0 00000000`00000000 00000000`00000000 00000000`00001000 : atikmdag+0x3fa9f9
fffff880`04755310 fffff880`048425fe : fffffa80`0931bae0 0000000f`10ef8000 00000000`00001000 0000000f`00150000 : atikmdag+0x3fb8d8
fffff880`047553c0 fffff880`0413545b : 00000000`00001000 fffff8a0`10de4620 ffffffff`c01e0001 ffffffff`ffffffff : atikmdag+0x3e5fe
fffff880`04755520 fffff880`052929ac : 00000000`00001000 fffff8a0`10de4620 fffff880`c0000001 fffff8a0`10de4620 : atikmpag+0x745b
fffff880`047555a0 fffff880`053a5c9d : fffff8a0`10de4620 fffff8a0`10de4620 00000000`00000000 fffffa80`09691000 : dxgkrnl+0x39ac
fffff880`047555d0 fffff880`053a5b88 : fffff8a0`10de4620 00000000`00000000 00000000`00000000 00000000`00106101 : dxgmms1!VidMmInterface+0x113dd
fffff880`04755760 fffff880`053b2029 : 00000000`00000000 fffffa80`0ae29730 00000000`00000000 00000000`00000000 : dxgmms1!VidMmInterface+0x112c8
fffff880`047557d0 fffff880`053a4af3 : fffffa80`0969ad70 fffff8a0`10de4620 fffffa80`09691000 fffff880`053a4600 : dxgmms1!VidMmInterface+0x1d769
fffff880`047558b0 fffff880`053a1763 : 00000000`00000000 fffffa80`078b8000 00000000`00000000 fffffa80`09b7a270 : dxgmms1!VidMmInterface+0x10233
fffff880`04755910 fffff880`053bb65d : 00000000`00000000 fffff8a0`108ecb10 fffffa80`00000000 fffffa80`07845470 : dxgmms1!VidMmInterface+0xcea3
fffff880`04755ae0 fffff880`053bb398 : fffff880`009ecec0 fffff880`053bad00 fffffa80`00000000 fffffa80`00000000 : dxgmms1!VidMmInterface+0x26d9d
fffff880`04755cd0 fffff880`053bae96 : 00000000`00000000 fffffa80`09470550 00000000`00000080 fffffa80`06d73410 : dxgmms1!VidMmInterface+0x26ad8
fffff880`04755d00 fffff800`033626fa : 00000000`278b0252 fffffa80`06da1b60 fffffa80`06d23040 fffffa80`06da1b60 : dxgmms1!VidMmInterface+0x265d6
fffff880`04755d40 fffff800`030a0b46 : fffff880`009e8180 fffffa80`06da1b60 fffff880`009f2f40 fffff880`01224810 : nt!PsCreateSystemThread+0x6d6
fffff880`04755d80 00000000`00000000 : fffff880`04756000 fffff880`04750000 fffff880`04754d80 00000000`00000000 : nt!KeTestAlertThread+0x93a


FOLLOWUP_IP: 
atikmdag+3fa9f9
fffff880`04bfe9f9 488b5108        mov     rdx,qword ptr [rcx+8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  atikmdag+3fa9f9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME:  atikmdag.sys

STACK_COMMAND:  .cxr 0xfffff88004754830 ; kb

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

0: kd> lmvm atikmdag
start             end                 module name
fffff880`04804000 fffff880`0528f000   atikmdag   (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Tue Dec 06 04:52:23 2011 (4EDD8367)
    CheckSum:         00A43704
    ImageSize:        00A8B000
    File version:     8.1.1.1223
    Product version:  8.1.1.1223
    File flags:       8 (Mask 3F) Private
    File OS:          40004 NT Win32
    File type:        3.4 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Advanced Micro Devices, Inc.
    ProductName:      ATI Radeon Family
    InternalName:     atikmdag.sys
    OriginalFilename: atikmdag.sys
    ProductVersion:   8.01.01.1223
    FileVersion:      8.01.01.1223
    FileDescription:  ATI Radeon Kernel Mode Driver
    LegalCopyright:   Copyright (C) 1998-2011 Advanced Micro Devices, Inc.
0: kd> lmvm nt
start             end                 module name
fffff800`03052000 fffff800`0362e000   nt         (export symbols)       ntkrnlmp.exe
    Loaded symbol image file: ntkrnlmp.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Timestamp:        Thu Jun 23 05:51:48 2011 (4E02AA44)
    CheckSum:         00542941
    ImageSize:        005DC000
    File version:     6.1.7600.16841
    Product version:  6.1.7600.16841
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntkrnlmp.exe
    OriginalFilename: ntkrnlmp.exe
    ProductVersion:   6.1.7600.16841
    FileVersion:      6.1.7600.16841 (win7_gdr.110622-1503)
    FileDescription:  NT Kernel & System
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

All help is much appreciated.

Update your graphics card drivers to the lasted one avaible: http://support.amd.com/us/gpudownload

Also isn't your card overheating please monitor your temps using GPU-Z: GPU-Z Video card GPU Information Utility

Also are you Overclocking ???

cvmm69 · 15 Feb 2012

Thanks for contibuting in this thread.

As I said, I am running the latest version of the driver software available for my card. I did reinstall them, just to be sure, though.
I am using a free desktop widget that monitors my card's clocks and temperature, and it is running at 45-50'c on normal desktop use and 65-70'c while running furmark. My card is not overclocked or flashed, and my enclosure is properly ventilated. I see no reason for overheating to cause this.

GianniDPC · 15 Feb 2012

cvmm69 said:

Thanks for contibuting in this thread.

As I said, I am running the latest version of the driver software available for my card. I did reinstall them, just to be sure, though.
I am using a free desktop widget that monitors my card's clocks and temperature, and it is running at 45-50'c on normal desktop use and 65-70'c while running furmark. My card is not overclocked or flashed, and my enclosure is properly ventilated. I see no reason for overheating to cause this.

I saw at your last dump that these drivers are really outdated:

SynUSB64.sys (24/10/2007)

teamviewervpn.sys (13/12/2007)

Please update it if possible

cvmm69 · 15 Feb 2012

I also explained in my last reply that i am aware of synusb64.sys being outdated because the newest version is currently available only in the newest version of Cubase, which i cannot aquire in a legitimate way. But I had no idea of Teamviewer being outdated, will uprgade that asap.

zigzag3143 · 15 Feb 2012

GianniDPC said:

cvmm69 said:

Thanks for contibuting in this thread.

As I said, I am running the latest version of the driver software available for my card. I did reinstall them, just to be sure, though.
I am using a free desktop widget that monitors my card's clocks and temperature, and it is running at 45-50'c on normal desktop use and 65-70'c while running furmark. My card is not overclocked or flashed, and my enclosure is properly ventilated. I see no reason for overheating to cause this.

I saw at your last dump that these drivers are really outdated:

SynUSB64.sys (24/10/2007)

teamviewervpn.sys (13/12/2007)

Please update it if possible

I am afraid the Team Viewer is the most current. Works in win 7 32 & 64 and in Win 8 32 & 64 with no reports of trouble. (I beta test for them)

cvmm69 · 15 Feb 2012

So the only thing left to do is to locate the newest version of the Syncrosoft driver. If someone knows how, I will try it, because it seems to be the only troublemaker left unless there is a problem with the graphics driver.

zigzag3143 · 15 Feb 2012

cvmm69 said:

So the only thing left to do is to locate the newest version of the Syncrosoft driver. If someone knows how, I will try it, because it seems to be the only troublemaker left unless there is a problem with the graphics driver.

You may be able to use that one if you re-install in "compatibility" mode

(right click the installer>run as admin>properties>Compatibility>chose Vista)

Good luck