BSOD.. RtsUStor.sys missing

budderflynet · 25 Feb 2012

Hopefully this works, I'm ready to let my Pitt eat my laptop!

ePeen · 25 Feb 2012

Memory Corruption and other incorrect process faults (Windows just pointing to a random process as it doesn't know the cause).

Three tests I'd like you to run:

Chkdsk:

Open the "Computer" window
Right-click on the drive in question
Select the "Tools" tab
In the Error-checking area, click <Check Now>.

Memtest:

Read the following to test your memory for errors.

Driver Verifier:

Read the following to enable Driver Verifier. Use Driver Second if Memtest finds nothing, as it's likely a software / driver issue, we just aren't being told what it is, and hopefully Driver Verifier will than force a crash if it finds the violating driver.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: fffff6fc40017d78, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffffc0000185, error status (normally i/o status code)
Arg3: 00000000dd703be0, current process (virtual address for lock type 3, or PTE)
Arg4: fffff88002faf000, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

Debugging Details:
------------------


ERROR_CODE: (NTSTATUS) 0xc0000185 - The I/O device reported an I/O error.

DISK_HARDWARE_ERROR: There was error with disk hardware

BUGCHECK_STR:  0x7a_c0000185

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002ef9b52 to fffff80002e88c40

STACK_TEXT:  
fffff880`03140848 fffff800`02ef9b52 : 00000000`0000007a fffff6fc`40017d78 ffffffff`c0000185 00000000`dd703be0 : nt!KeBugCheckEx
fffff880`03140850 fffff800`02eb06cf : fffffa80`03870bf0 fffff880`031409c0 fffff800`030be500 fffffa80`03870bf0 : nt! ?? ::FNODOBFM::`string'+0x37bba
fffff880`03140930 fffff800`02e96f59 : 00000000`00000000 00000000`00000001 ffffffff`ffffffff fffff800`02ea84d3 : nt!MiIssueHardFault+0x28b
fffff880`03140a00 fffff800`02ebd470 : 00000000`00000001 fffff880`02faf000 fffffa80`055b8b00 fffff6fc`40017d50 : nt!MmAccessFault+0x1399
fffff880`03140b60 fffff800`02ebd660 : fffffa80`033e1b60 fffff880`00000001 00000000`00000000 fffff800`02e46a00 : nt!MiInPageSingleKernelStack+0x134
fffff880`03140c70 fffff800`02ebd5ef : 00000000`00000000 00000000`00000001 fffffa80`033c8b30 00000000`00000080 : nt!MmInPageKernelStack+0x40
fffff880`03140cd0 fffff800`02ebd334 : 00000000`00000000 00000000`00000000 fffffa80`033c8b00 fffffa80`033c8b00 : nt!KiInSwapKernelStacks+0x1f
fffff880`03140d00 fffff800`03123fee : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeSwapProcessOrStack+0x84
fffff880`03140d40 fffff800`02e7a5e6 : fffff800`02ffee80 fffffa80`033ee680 fffffa80`033eeb60 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03140d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+37bba
fffff800`02ef9b52 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+37bba

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x7a_c0000185_nt!_??_::FNODOBFM::_string_+37bba

BUCKET_ID:  X64_0x7a_c0000185_nt!_??_::FNODOBFM::_string_+37bba

Followup: MachineOwner

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7A, {fffff6fc400074e8, ffffffffc0000185, ce654860, fffff88000e9d93c}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
GetPointerFromAddress: unable to read from fffff80003108278
Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: fffff6fc400074e8, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffffc0000185, error status (normally i/o status code)
Arg3: 00000000ce654860, current process (virtual address for lock type 3, or PTE)
Arg4: fffff88000e9d93c, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

Debugging Details:
------------------


ERROR_CODE: (NTSTATUS) 0xc0000185 - The I/O device reported an I/O error.

DISK_HARDWARE_ERROR: There was error with disk hardware

BUGCHECK_STR:  0x7a_c0000185

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88002ff5620 -- (.trap 0xfffff88002ff5620)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88000e95500 rbx=0000000000000000 rcx=fffffa8004265050
rdx=fffffa8004ad76c0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000e9d93c rsp=fffff88002ff57b8 rbp=fffffa80047a9160
 r8=0000000000000007  r9=fffffa80042651a0 r10=0000000000000000
r11=fffffa8004ad7820 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po cy
ataport!ChannelQueryDeviceRelations:
fffff880`00e9d93c 3000            xor     byte ptr [rax],al ds:4000:fffff880`00e95500=??
Resetting default scope

LOCK_ADDRESS:  fffff800030d4b80 -- (!locks fffff800030d4b80)

Resource @ nt!PiEngineLock (0xfffff800030d4b80)    Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE: 
    Lock address  : 0xfffff800030d4b80
    Thread Count  : 0
    Thread address: 0x0000000000000000
    Thread wait   : 0x0

LAST_CONTROL_TRANSFER:  from fffff80002f46b52 to fffff80002ed5c40

STACK_TEXT:  
fffff880`02ff5308 fffff800`02f46b52 : 00000000`0000007a fffff6fc`400074e8 ffffffff`c0000185 00000000`ce654860 : nt!KeBugCheckEx
fffff880`02ff5310 fffff800`02efd6cf : fffffa80`063eb500 fffff880`02ff5480 fffff800`0310b500 fffffa80`063eb500 : nt! ?? ::FNODOBFM::`string'+0x37bba
fffff880`02ff53f0 fffff800`02ee3f59 : 00000000`00000000 00000000`00000008 ffffffff`ffffffff 00000000`00000000 : nt!MiIssueHardFault+0x28b
fffff880`02ff54c0 fffff800`02ed3d6e : 00000000`00000008 fffff880`00e9d93c fffffa80`00000000 fffffa80`04ad76c0 : nt!MmAccessFault+0x1399
fffff880`02ff5620 fffff880`00e9d93c : fffff880`00e9b4ce 00000000`00000000 fffff880`02ff5880 fffff800`02fcffa0 : nt!KiPageFault+0x16e
fffff880`02ff57b8 fffff880`00e9b4ce : 00000000`00000000 fffff880`02ff5880 fffff800`02fcffa0 fffffa80`04262d40 : ataport!ChannelQueryDeviceRelations
fffff880`02ff57c0 fffff800`0328ed6e : 00000000`00000000 00000000`00000000 fffffa80`047a9160 fffff880`009e8180 : ataport!IdePortDispatchPnp+0x22
fffff880`02ff57f0 fffff800`0328f0da : 00000000`00000000 fffffa80`047a9160 fffff800`02fcffa0 00000000`00000000 : nt!PnpAsynchronousCall+0xce
fffff880`02ff5830 fffff800`03291427 : fffff800`030d4940 fffffa80`04264d90 00000000`00000002 00000000`00000538 : nt!PnpQueryDeviceRelations+0xfa
fffff880`02ff58f0 fffff800`032c1a0c : fffffa80`04264d90 fffffa80`04260020 fffffa80`04264d90 00000000`00000002 : nt!PipEnumerateDevice+0x117
fffff880`02ff5950 fffff800`032c2018 : fffff800`030d2500 00000000`00000000 00000000`00000001 fffff800`0313f814 : nt!PipProcessDevNodeTree+0x21c
fffff880`02ff5bc0 fffff800`02fd28e7 : 00000001`00000003 00000000`00000000 00000000`00000001 00000000`00000000 : nt!PiProcessReenumeration+0x98
fffff880`02ff5c10 fffff800`02ee0001 : fffff800`02fd25c0 fffff800`03076201 fffffa80`033ddb00 fffffa80`033ddb60 : nt!PnpDeviceActionWorker+0x327
fffff880`02ff5cb0 fffff800`03170fee : fb99b5ef`ce7fff7f fffffa80`033ddb60 00000000`00000080 fffffa80`033c8b30 : nt!ExpWorkerThread+0x111
fffff880`02ff5d40 fffff800`02ec75e6 : fffff880`009e8180 fffffa80`033ddb60 fffff880`009f2f40 ffbfffbb`ffefffff : nt!PspSystemThreadStartup+0x5a
fffff880`02ff5d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !ataport
    fffff88000e9d000-fffff88000e9d007  8 bytes - ataport!DeviceAtaPassThroughIoctl+1a0
    [ 85 4a 08 75 b3 83 7a 0c:68 62 69 6e 00 80 00 00 ]
    fffff88000e9d009-fffff88000e9d010  8 bytes - ataport!DeviceAtaPassThroughIoctl+1a9 (+0x09)
    [ 74 ad 81 7a 0c e0 a5 01:10 00 00 00 00 00 00 00 ]
    fffff88000e9d012-fffff88000e9d047  54 bytes - ataport!DeviceAtaPassThroughIoctl+1b2 (+0x09)
    [ 77 a4 3b f7 76 10 2b f7:00 00 00 00 00 00 00 00 ]
    fffff88000e9d04b-fffff88000e9d090  70 bytes - ataport!DeviceAtaPassThroughIoctl+1eb (+0x39)
    [ 48 8b d3 e8 2d 50 ff ff:00 ff ff ff ff a0 eb 30 ]
    fffff88000e9d093-fffff88000e9d097  5 bytes - ataport!DeviceAtaPassThroughIoctl+233 (+0x48)
    [ 0f 87 1f ff ff:00 00 00 00 00 ]
    fffff88000e9d099-fffff88000e9d09a  2 bytes - ataport!DeviceAtaPassThroughIoctl+239 (+0x06)
    [ 41 b8:ff ff ]
    fffff88000e9d09c-fffff88000e9d0ac  17 bytes - ataport!DeviceAtaPassThroughIoctl+23c (+0x03)
    [ 0f 00 00 8b c2 c1 ea 0c:ff ff ff ff 02 00 00 00 ]
    fffff88000e9d0ae-fffff88000e9d0af  2 bytes - ataport!DeviceAtaPassThroughIoctl+24e (+0x12)
    [ 0f 00:ff ff ]
    fffff88000e9d0b1-fffff88000e9d0ba  10 bytes - ataport!DeviceAtaPassThroughIoctl+251 (+0x03)
    [ c1 e9 0c 03 ca 41 3b 8e:00 00 00 00 00 00 00 08 ]
    fffff88000e9d0bc-fffff88000e9d0d6  27 bytes - ataport!DeviceAtaPassThroughIoctl+25c (+0x0b)
    [ 00 0f 87 f5 fe ff ff 33:16 00 00 00 00 00 00 00 ]
    fffff88000e9d0d8-fffff88000e9d0db  4 bytes - ataport!DeviceAtaPassThroughIoctl+278 (+0x1c)
    [ 00 c0 e9 55:04 00 00 80 ]
    fffff88000e9d0df-fffff88000e9d0e2  4 bytes - ataport!DeviceAtaPassThroughIoctl+27f (+0x07)
    [ 4c 89 b8 80:00 04 00 00 ]
    fffff88000e9d0e4 - ataport!DeviceAtaPassThroughIoctl+284 (+0x05)
    [ 00:01 ]
    fffff88000e9d0e6-fffff88000e9d15a  117 bytes - ataport!DeviceAtaPassThroughIoctl+286 (+0x02)
    [ 4c 89 70 08 4c 89 70 10:00 00 54 79 70 65 00 00 ]
    fffff88000e9d15c-fffff88000e9d178  29 bytes - ataport!DeviceAtaPassThroughIoctl+2fc (+0x76)
    [ 00 00 48 8b d6 49 8b cf:ff ff ff ff a0 eb 30 00 ]
    fffff88000e9d17b-fffff88000e9d18e  20 bytes - ataport!DeviceAtaPassThroughIoctl+31b (+0x1f)
    [ 24 5f 3c 03 75 12 8a 86:00 08 00 00 00 30 30 30 ]
    fffff88000e9d190-fffff88000e9d1a2  19 bytes - ataport!DeviceAtaPassThroughIoctl+330 (+0x15)
    [ 88 47 28 48 8b 86 18 04:78 38 6d 00 82 6e c9 6a ]
    fffff88000e9d1a4-fffff88000e9d1ca  39 bytes - ataport!DeviceAtaPassThroughIoctl+344 (+0x14)
    [ 00 10 72 16 48 8b 00 48:84 6e c9 6a 38 3c 6d 00 ]
    fffff88000e9d1cd-fffff88000e9d205  57 bytes - ataport!DeviceAtaPassThroughIoctl+36d (+0x29)
    [ 47 08 41 80 fd 01 74 12:6e c9 6a 78 42 6d 00 95 ]
    fffff88000e9d208-fffff88000e9d20e  7 bytes - ataport!DeviceAtaPassThroughIoctl+3a8 (+0x3b)
    [ 00 48 8b cb e8 6f 4e:ff ff ff ff ff ff ff ]
    fffff88000e9d210-fffff88000e9d292  131 bytes - ataport!DeviceAtaPassThroughIoctl+3b0 (+0x08)
    [ ff 4c 8b 5f 28 4c 89 5b:02 00 00 00 48 88 6a 00 ]
    fffff88000e9d295-fffff88000e9d29f  11 bytes - ataport!IdeInitAtaPassThroughIrb+31 (+0x85)
    [ 8a 81 58 04 00 00 41 88:00 00 00 78 43 6d 00 ff ]
    fffff88000e9d2a2-fffff88000e9d2b6  21 bytes - ataport!IdeInitAtaPassThroughIrb+3e (+0x0d)
    [ 8a 81 59 04 00 00 41 88:00 00 ff ff ff ff a0 eb ]
    fffff88000e9d2b9-fffff88000e9d2c4  12 bytes - ataport!IdeInitAtaPassThroughIrb+55 (+0x17)
    [ f6 42 02 02 74 08 41 83:00 00 00 00 00 00 00 08 ]
    fffff88000e9d2c6-fffff88000e9d2cf  10 bytes - ataport!IdeInitAtaPassThroughIrb+62 (+0x0d)
    [ 40 f6 42 02 04 74 09 41:00 00 30 30 30 30 30 30 ]
    fffff88000e9d2d1-fffff88000e9d2e0  16 bytes - ataport!IdeInitAtaPassThroughIrb+6d (+0x0b)
    [ f8 03 00 00 07 f6 42 02:ff ff ff 6e 6b 20 00 21 ]
    fffff88000e9d2e3-fffff88000e9d2e4  2 bytes - ataport!IdeInitAtaPassThroughIrb+7f (+0x12)
    [ 08 f6:00 78 ]
    fffff88000e9d2e6-fffff88000e9d2ee  9 bytes - ataport!IdeInitAtaPassThroughIrb+82 (+0x03)
    [ 02 20 75 08 41 83 88 f8:6d 00 00 00 00 00 00 00 ]
    fffff88000e9d2f0-fffff88000e9d307  24 bytes - ataport!IdeInitAtaPassThroughIrb+8c (+0x0a)
    [ 00 10 f6 42 02 01 74 0a:ff ff ff ff ff ff ff ff ]
    fffff88000e9d309-fffff88000e9d314  12 bytes - ataport!IdeInitAtaPassThroughIrb+a5 (+0x19)
    [ fe f6 42 02 10 74 08 41:00 00 00 00 00 00 00 08 ]
    fffff88000e9d317-fffff88000e9d31c  6 bytes - ataport!IdeInitAtaPassThroughIrb+b3 (+0x0e)
    [ 02 41 83 88 f8 03:00 00 00 00 00 08 ]
    fffff88000e9d31f-fffff88000e9d349  43 bytes - ataport!IdeInitAtaPassThroughIrb+bb (+0x08)
    [ 20 ba 12 00 00 00 41 c6:00 30 30 30 30 30 30 30 ]
    fffff88000e9d34c-fffff88000e9d34e  3 bytes - ataport!IdeInitAtaPassThroughIrb+e8 (+0x2d)
    [ c0 e9 b1:00 00 00 ]
    fffff88000e9d350-fffff88000e9d358  9 bytes - ataport!IdeInitAtaPassThroughIrb+ec (+0x04)
    [ 00 00 8b 47 28 89 83 30:e0 ff ff ff 76 6b 05 00 ]
    fffff88000e9d35b-fffff88000e9d364  10 bytes - ataport!IdeInitAtaPassThroughIrb+f7 (+0x0b)
    [ 0f b7 47 2c 66 89 83 34:00 38 44 6d 00 01 00 00 ]
    fffff88000e9d366-fffff88000e9d36c  7 bytes - ataport!IdeInitAtaPassThroughIrb+102 (+0x0b)
    [ 8a 47 2e 88 83 36 04:00 00 47 72 6f 75 70 ]
    fffff88000e9d36f-fffff88000e9d372  4 bytes - ataport!IdeInitAtaPassThroughIrb+10b (+0x09)
    [ 80 a3 35 04:00 08 00 00 ]
    fffff88000e9d375-fffff88000e9d38e  26 bytes - ataport!IdeInitAtaPassThroughIrb+111 (+0x06)
    [ 4f 80 bd 58 04 00 00 01:00 00 00 f0 ff ff ff 6c ]
    fffff88000e9d390-fffff88000e9d397  8 bytes - ataport!IdeInitAtaPassThroughIrb+12c (+0x1b)
    [ 00 8b 47 20 89 83 38 04:21 6f d9 29 32 d1 cb 01 ]
    fffff88000e9d39a-fffff88000e9d3a2  9 bytes - ataport!IdeInitAtaPassThroughIrb+136 (+0x0a)
    [ 0f b7 47 24 66 89 83 3c:00 00 e8 37 6d 00 01 00 ]
    fffff88000e9d3a5-fffff88000e9d3a7  3 bytes - ataport!IdeInitAtaPassThroughIrb+141 (+0x0b)
    [ 8a 47 26:00 00 00 ]
    fffff88000e9d3a9-fffff88000e9d3b2  10 bytes - ataport!IdeInitAtaPassThroughIrb+145 (+0x04)
    [ 83 3e 04 00 00 0f b6 8b:44 6d 00 ff ff ff ff 00 ]
    fffff88000e9d3b4-fffff88000e9d3c0  13 bytes - ataport!IdeInitAtaPassThroughIrb+150 (+0x0b)
    [ 00 b8 c4 00 00 00 3b c8:ff ff ff ff a0 eb 30 00 ]
    fffff88000e9d3c4-fffff88000e9d3d4  17 bytes - ataport!IdeInitAtaPassThroughIrb+160 (+0x10)
    [ 83 f9 35 7f 51 83 f9 34:00 00 00 00 00 00 00 00 ]
    fffff88000e9d3d7-fffff88000e9d3e6  16 bytes - ataport!IdeInitAtaPassThroughIrb+173 (+0x13)
    [ 83 f9 23 0f 8e 80 00 00:00 30 30 30 30 30 30 31 ]
    fffff88000e9d3e8-fffff88000e9d3ea  3 bytes - ataport!IdeInitAtaPassThroughIrb+184 (+0x11)
    [ 00 83 f9:21 6f d9 ]
    fffff88000e9d3ec-fffff88000e9d3ef  4 bytes - ataport!IdeInitAtaPassThroughIrb+188 (+0x04)
    [ 0f 84 83 00:32 d1 cb 01 ]
    fffff88000e9d3f2-fffff88000e9d3f9  8 bytes - ataport!IdeInitAtaPassThroughIrb+18e (+0x06)
    [ 83 f9 30 75 69 b8 03 01:00 00 88 43 6d 00 00 00 ]
    fffff88000e9d3fc-fffff88000e9d453  88 bytes - ataport!IdeInitAtaPassThroughIrb+198 (+0x0a)
    [ 66 89 83 e8 03 00 00 48:00 00 00 00 ff ff ff ff ]
    fffff88000e9d455-fffff88000e9d460  12 bytes - ataport!IdeInitAtaPassThroughIrb+1f1 (+0x59)
    [ 18 83 e9 03 74 13 83 f9:00 00 00 d8 ff ff ff 76 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.
3861 errors : !ataport (fffff88000e9d000-fffff88000e9dfff)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  LARGE_4096

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE_4096

BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE_4096

Followup: memory_corruption

budderflynet · 25 Feb 2012

I'm not sure which drive to check it wont let me check the C drive says its in use.. and no problems were found on the D drive