Random BSOD's want to figure this out once and for all

writhziden said:

You're welcome for the help.

I am glad you forgot about the blue screens; that means the system must be running stable. I am also happy that you were finally able to get SP1 installed. :)

Thanks for keeping us updated. I look forward to seeing how the system is responding in a couple weeks.

Alright so it's been almost a week since I did the repair install, and my system's been pretty good for the most part. But yesterday and today I had another BSOD :/

Don't know what caused these. The first one didn't have a lot of relevent information, but the second one said it has caused by the NTFS.sys file.

What should I do from here?

Follow the https://www.sevenforums.com/crashes-d...tructions.html and we'll make a diagnosis. For NTFS.sys crashes, I also recommend a Disk Check.

Ok here are the attachements

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\obidon\Windows_NT6_BSOD_jcgriff2\041412-22432-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505
Machine Name:
Kernel base = 0xfffff800`03056000 PsLoadedModuleList = 0xfffff800`0329a650
Debug session time: Sat Apr 14 00:06:48.082 2012 (UTC - 6:00)
System Uptime: 2 days 0:59:12.908
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
....................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5002, fffff780c0000000, 4a4a, 241e2fffffffe}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+2959c )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005002, The subtype of the bugcheck.
Arg2: fffff780c0000000
Arg3: 0000000000004a4a
Arg4: 000241e2fffffffe

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_5002

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  psia.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800ab8aa00 -- (.trap 0xfffff8800ab8aa00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8009749430 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff9802a680000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800033ce427 rsp=fffff8800ab8ab90 rbp=fffff8a008c2f810
 r8=000000000000000f  r9=fffff8800ab8a940 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po cy
nt!CcMapData+0x117:
fffff800`033ce427 0fb602          movzx   eax,byte ptr [rdx] ds:fffff980`2a680000=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000313cd14 to fffff800030d2c80

STACK_TEXT:  
fffff880`0ab8a5d8 fffff800`0313cd14 : 00000000`0000001a 00000000`00005002 fffff780`c0000000 00000000`00004a4a : nt!KeBugCheckEx
fffff880`0ab8a5e0 fffff800`0310341f : 00000002`49cd88c0 00000002`49cd8921 fffffa80`06dd6880 fffff800`03307b00 : nt! ?? ::FNODOBFM::`string'+0x2959c
fffff880`0ab8a670 fffff800`030f0c05 : 00000000`00000000 00000002`49cd88c0 00000000`00000000 fffff800`03307b00 : nt!MiResolveTransitionFault+0x32f
fffff880`0ab8a700 fffff800`030ef5c3 : f8a008c4`60100400 fffff980`2a680000 fffff6fc`c0153400 fffff800`03307b00 : nt!MiResolveProtoPteFault+0x325
fffff880`0ab8a790 fffff800`030dfd2b : fffff8a0`104edb00 fffffa80`09a181c0 00000000`00000000 00000000`00000000 : nt!MiDispatchFault+0x1c3
fffff880`0ab8a8a0 fffff800`030d0dae : 00000000`00000000 fffff980`2a680000 00000000`00000000 00000000`0000000e : nt!MmAccessFault+0xe1b
fffff880`0ab8aa00 fffff800`033ce427 : fffffa80`00000001 00000000`00000000 fffff880`0ab8ac58 fffff880`0ab8ac50 : nt!KiPageFault+0x16e
fffff880`0ab8ab90 fffff880`012d2c85 : fffffa80`00040000 fffffa80`09749430 fffff8a0`08c2f801 fffff8a0`0000000e : nt!CcMapData+0x117
fffff880`0ab8ac50 fffff880`012d6db1 : fffff8a0`08c2f810 00000000`00000000 fffff8a0`0a9fb540 fffffa80`0c7cce40 : Ntfs!FindFirstIndexEntry+0x1fa
fffff880`0ab8ace0 fffff880`012cacf5 : fffffa80`0c7cce40 fffffa80`0c7cce40 fffff8a0`0a1eee01 00000000`00000000 : Ntfs!NtfsFindIndexEntry+0x5d
fffff880`0ab8ad50 fffff880`01233a3d : fffffa80`0c7cce40 fffffa80`0b13f170 fffff880`0ab91370 fffffa80`0a821b00 : Ntfs!NtfsCommonCreate+0x7c5
fffff880`0ab8af30 fffff800`030ca777 : fffff880`0ab912e0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0ab8af60 fffff800`030ca738 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27
fffff880`0ab911b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+2959c
fffff800`0313cd14 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+2959c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4f558b55

FAILURE_BUCKET_ID:  X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+2959c

BUCKET_ID:  X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+2959c

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\obidon\Windows_NT6_BSOD_jcgriff2\041212-20560-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505
Machine Name:
Kernel base = 0xfffff800`0305c000 PsLoadedModuleList = 0xfffff800`032a0650
Debug session time: Wed Apr 11 23:02:01.708 2012 (UTC - 6:00)
System Uptime: 0 days 3:31:20.534
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88009be8f68, fffff88009be87c0, fffff880012d9299}

Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteFcb+489 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88009be8f68
Arg3: fffff88009be87c0
Arg4: fffff880012d9299

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88009be8f68 -- (.exr 0xfffff88009be8f68)
ExceptionAddress: fffff880012d9299 (Ntfs!NtfsDeleteFcb+0x0000000000000489)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88009be87c0 -- (.cxr 0xfffff88009be87c0)
rax=fffff8a00b7095c0 rbx=fffff88009be9230 rcx=fffff8a00f94f541
rdx=fffff8a009c61f91 rsi=0002000000000000 rdi=fffffa800990d940
rip=fffff880012d9299 rsp=fffff88009be91a0 rbp=fffff88009be98a0
 r8=fffff8a009c61f90  r9=0000000000000040 r10=fffff8000324f420
r11=fffff8a00b7095c0 r12=fffff8a00b748010 r13=fffffa800aa88180
r14=fffff88009be9221 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
Ntfs!NtfsDeleteFcb+0x489:
fffff880`012d9299 488b8e88000000  mov     rcx,qword ptr [rsi+88h] ds:002b:00020000`00000088=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  adm.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000330a100
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsDeleteFcb+489
fffff880`012d9299 488b8e88000000  mov     rcx,qword ptr [rsi+88h]

FAULTING_IP: 
Ntfs!NtfsDeleteFcb+489
fffff880`012d9299 488b8e88000000  mov     rcx,qword ptr [rsi+88h]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff880012d9299

STACK_TEXT:  
fffff880`09be91a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsDeleteFcb+0x489


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsDeleteFcb+489

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

STACK_COMMAND:  .cxr 0xfffff88009be87c0 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsDeleteFcb+489

BUCKET_ID:  X64_0x24_Ntfs!NtfsDeleteFcb+489

Followup: MachineOwner
---------

1. The problem seems related to the Secunia PSI Agent (psia.exe). See if removing the Secunia PSI Agent provides more stability.
2. This problem seems related to the Acronis Drive Monitor. Remove it to test.

writhziden said:

[/list][/code]

1. The problem seems related to the Secunia PSI Agent (psia.exe). See if removing the Secunia PSI Agent provides more stability.
2. This problem seems related to the Acronis Drive Monitor. Remove it to test.

Ok I'll remove them but how can I test afterwards? And do you think these were causing the BSOD's or some other system unstability? Or was it affecting my Hard Disk Drive perhaps?

It appears to me that they were affecting how Windows utilizes the hard disk and NTFS. To test, just do your normal routine and see if Windows is stable.

Well I got another BSOD with the error code as SYSTEM_SERVICE_EXCEPTION. What does this mean? So random I don't understand.

Should I attach anything else that would be of use? A System Reliability History Report perhaps? Thanks for continuing to help diagnose my system.

That is a new crash that you had not had yet from what I see in the thread. It usually indicates graphics card issues with either the drivers or the hardware itself.

Can you please upload the latest crash reports for analysis?

writhziden said:

That is a new crash that you had not had yet from what I see in the thread. It usually indicates graphics card issues with either the drivers or the hardware itself.

Can you please upload the latest crash reports for analysis?

Ok what crash reports do you want exactly? Is it best to give a Reliability Monitor Report exported as an HTML, or the folder generated by the BSOD Dump & System File Collection application? Or something else?

Given the time in between, it probably would be best to follow the https://www.sevenforums.com/crashes-d...tructions.html and provide the full set of logs and reports.