Random BSOD daily on my Lenovo Y560P

umc · 09 Jun 2012

My laptop has been having random BSOD for 2 months. At first, it only happens a couple times a week. It's getting worse lately. It happens pretty much every day now. Below is my dump file analysis and I also attached the minidump files. I hope someone can help me. It gets really frustrating.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\Anh Vo\Downloads\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
Machine Name:
Kernel base = 0xfffff800`03406000 PsLoadedModuleList = 0xfffff800`0364a670
Debug session time: Fri Jun 8 23:14:35.403 2012 (UTC - 7:00)
System Uptime: 0 days 0:30:24.309
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols

Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800373f5f8, fffff8800373ee50, fffff88001439f14}

Probably caused by : Ntfs.sys ( Ntfs!NtfsUninitializeNtfsMcb+8c )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800373f5f8
Arg3: fffff8800373ee50
Arg4: fffff88001439f14

Debugging Details:
------------------

EXCEPTION_RECORD: fffff8800373f5f8 -- (.exr 0xfffff8800373f5f8)
ExceptionAddress: fffff88001439f14 (Ntfs!NtfsUninitializeNtfsMcb+0x000000000000008c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT: fffff8800373ee50 -- (.cxr 0xfffff8800373ee50)
rax=0000000000000000 rbx=fffff8a012621cf0 rcx=fffff8800148d980
rdx=0000000000000000 rsi=0000000000000000 rdi=fa8006cf3c9004c0
rip=fffff88001439f14 rsp=fffff8800373f830 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=fffff8800148d980
r11=0000000000000000 r12=0000000000000703 r13=0000000000000000
r14=0000000000000000 r15=fffff8a012621ed0
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
Ntfs!NtfsUninitializeNtfsMcb+0x8c:
fffff880`01439f14 488b4f08 mov rcx,qword ptr [rdi+8] ds:002b:fa8006cf`3c9004c8=????????????????
Resetting default scope

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

READ_ADDRESS: ffffffffffffffff

FOLLOWUP_IP:
Ntfs!NtfsUninitializeNtfsMcb+8c
fffff880`01439f14 488b4f08 mov rcx,qword ptr [rdi+8]

FAULTING_IP:
Ntfs!NtfsUninitializeNtfsMcb+8c
fffff880`01439f14 488b4f08 mov rcx,qword ptr [rdi+8]

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from fffff880014bcb2f to fffff88001439f14

STACK_TEXT:
fffff880`0373f830 fffff880`014bcb2f : fffff880`0373f8e8 00000000`00000130 fffff8a0`12621a90 fffff880`01439972 : Ntfs!NtfsUninitializeNtfsMcb+0x8c
fffff880`0373f860 fffff880`014c1cc1 : 00000000`00000000 00000000`00000000 fffff800`03622200 00000000`00000001 : Ntfs!NtfsDeleteScb+0x8b
fffff880`0373f8a0 fffff880`0143a85c : fffff8a0`12621ac0 fffff8a0`12621bc0 fffff800`03622200 fffff880`0373fa12 : Ntfs!NtfsRemoveScb+0x61
fffff880`0373f8e0 fffff880`014bf64c : fffff8a0`12621a90 fffff800`03622280 fffff880`0373fa12 fffffa80`07e62580 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`0373f910 fffff880`014410e2 : fffffa80`07e62580 fffffa80`07e62580 fffff8a0`12621a90 fffff880`0373fa00 : Ntfs!NtfsTeardownStructures+0xdc
fffff880`0373f990 fffff880`014cf193 : fffffa80`07e62580 fffff800`03622280 fffff8a0`6446744e 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`0373f9d0 fffff880`014be357 : fffffa80`07e62580 fffff8a0`12621bc0 fffff8a0`12621a90 fffffa80`07f7a180 : Ntfs!NtfsCommonClose+0x353
fffff880`0373faa0 fffff800`0348e851 : 00000000`00000000 fffff800`03622200 fffff800`03683801 fffffa80`00000003 : Ntfs!NtfsFspClose+0x15f
fffff880`0373fb70 fffff800`0371be6a : 00000000`00000000 fffffa80`06bddb50 00000000`00000080 fffffa80`06b0d4a0 : nt!ExpWorkerThread+0x111
fffff880`0373fc00 fffff800`03475f06 : fffff880`03589180 fffffa80`06bddb50 fffff880`035940c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0373fc40 00000000`00000000 : fffff880`03740000 fffff880`0373a000 fffff880`0373f8a0 00000000`00000000 : nt!KxStartSystemThread+0x16

SYMBOL_STACK_INDEX: 0

yowanvista · 09 Jun 2012

win32k.sys was involved, this could point to a RAM issue.
Run some diagnostics tests:
RAM - Test with Memtest86+
Disk Check
SFC /SCANNOW Command - System File Checker

Are you using an SSD or a standard Hard Disk?

Update your Broadcom Bluetooth Software by download the latest version from your laptop's manufacturer website.

umc · 09 Jun 2012

yowanvista said:

win32k.sys was involved, this could point to a RAM issue.
Run some diagnostics tests:
RAM - Test with Memtest86+
Disk Check
SFC /SCANNOW Command - System File Checker

Are you using an SSD or a standard Hard Disk?

Update your Broadcom Bluetooth Software by download the latest version from your laptop's manufacturer website.

Thanks for your help, yowanvista. I'm running Memtest86 now. I'll report the result after running all the tests you suggested. I'm using a standard hard disk. The BSOD started happening after I upgraded my memory. I upgraded my memory from 4GB to 8GB. I upgraded memory around 2 weeks after I bought it.

umc · 09 Jun 2012

I just finished running Memtest86+. It runs 8 tests and completed with no error. I read somewhere that the test takes about 7-8 hours, but mine only took 1 hour. I am not sure if this is normal.

I ran 3 suggested tests and found no error. I didn't update Broadcom Bluetooth Software because Lenovo's site has the same Broadcom Bluetooth Software as mine. Below is the check disk log.

Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 6/9/2012 10:08:16 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: Anh-NZT
Description:

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 3)...
186112 file records processed.

File verification completed.
801 large file records processed.

0 bad file records processed.

0 EA records processed.

60 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 3)...
252578 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 3)...
186112 file SDs/SIDs processed.

Cleaning up 931 unused index entries from index $SII of file 0x9.
Cleaning up 931 unused index entries from index $SDH of file 0x9.
Cleaning up 931 unused security descriptors.
Security descriptor verification completed.
33234 data files processed.

CHKDSK is verifying Usn Journal...
34520120 USN bytes processed.

Usn Journal verification completed.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

440750079 KB total disk space.
200334032 KB in 146498 files.
83992 KB in 33235 indexes.
0 KB in bad sectors.
301215 KB in use by the system.
65536 KB occupied by the log file.
240030840 KB available on disk.

4096 bytes in each allocation unit.
110187519 total allocation units on disk.
60007710 allocation units available on disk.

Internal Info:
00 d7 02 00 21 be 02 00 c8 f1 04 00 00 00 00 00 ....!...........
bd 09 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 ....<...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2012-06-09T17:08:16.000000000Z" />
<EventRecordID>37465</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Anh-NZT</Computer>
<Security />
</System>
<EventData>
<Data>

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 3)...
186112 file records processed.

File verification completed.
801 large file records processed.

0 bad file records processed.

0 EA records processed.

60 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 3)...
252578 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 3)...
186112 file SDs/SIDs processed.

Cleaning up 931 unused index entries from index $SII of file 0x9.
Cleaning up 931 unused index entries from index $SDH of file 0x9.
Cleaning up 931 unused security descriptors.
Security descriptor verification completed.
33234 data files processed.

CHKDSK is verifying Usn Journal...
34520120 USN bytes processed.

Usn Journal verification completed.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

440750079 KB total disk space.
200334032 KB in 146498 files.
83992 KB in 33235 indexes.
0 KB in bad sectors.
301215 KB in use by the system.
65536 KB occupied by the log file.
240030840 KB available on disk.

4096 bytes in each allocation unit.
110187519 total allocation units on disk.
60007710 allocation units available on disk.

Internal Info:
00 d7 02 00 21 be 02 00 c8 f1 04 00 00 00 00 00 ....!...........
bd 09 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 ....<...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>

yowanvista · 10 Jun 2012

I upgraded my memory from 4GB to 8GB

Remove the additional 4GB sticks and see if your system is stable. This could be memory related.
Reset your RAM settings in your BIOS to their default/Auto values.

umc · 10 Jun 2012

yowanvista said:

I upgraded my memory from 4GB to 8GB

Remove the additional 4GB sticks and see if your system is stable. This could be memory related.
Reset your RAM settings in your BIOS to their default/Auto values.

I removed one stick of RAM and reset the setting in BIOS as you suggested. After a couple hours playing with the laptop, I got another BSOD. Below I attached the new minidump file, and I also ran debugging on the new memory.dmp file. When I first bought the laptop, it has 2x2GB. I sold that pair and got 2x4GB pair.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\Anh Vo\Downloads\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
Machine Name:
Kernel base = 0xfffff800`0345b000 PsLoadedModuleList = 0xfffff800`0369f670
Debug session time: Sun Jun 10 10:12:22.613 2012 (UTC - 7:00)
System Uptime: 0 days 1:17:24.499
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`7efdf018). Type ".hh dbgerr001" for details
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {3452, 6f61d000, fffff70001086ec8, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+356c3 )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000003452, The subtype of the bugcheck.
Arg2: 000000006f61d000
Arg3: fffff70001086ec8
Arg4: 0000000000000000

Debugging Details:
------------------

BUGCHECK_STR: 0x1a_3452

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: idman.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff80003545c63 to fffff800034da1c0

STACK_TEXT:
fffff880`0c2b1ee8 fffff800`03545c63 : 00000000`0000001a 00000000`00003452 00000000`6f61d000 fffff700`01086ec8 : nt!KeBugCheckEx
fffff880`0c2b1ef0 fffff800`034aae42 : fffffa80`09073060 fffffa80`00000000 fffff8a0`00000354 fffff880`00000000 : nt! ?? ::FNODOBFM::`string'+0x356c3
fffff880`0c2b27a0 fffff800`037ab6da : fffff8a0`047d1a10 fffff880`0c2b2ae0 00000000`00000000 fffffa80`09073640 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0c2b27f0 fffff800`0378ebdd : 00000000`40010004 00000000`00000001 00000000`7efdb000 00000000`00000000 : nt!PspExitThread+0x56a
fffff880`0c2b28f0 fffff800`034ccd1a : fffff880`009b2180 00000000`00000000 00000000`00000000 fffffa80`09073640 : nt!PsExitSpecialApc+0x1d
fffff880`0c2b2920 fffff800`034cd060 : 00000000`00c7e8c0 fffff880`0c2b29a0 fffff800`0378eb50 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`0c2b29a0 fffff800`034ccefb : 00000000`00c7e8c0 00000000`00000000 fffff800`0378eb50 00000000`00000000 : nt!KiInitiateUserApc+0x70
fffff880`0c2b2ae0 00000000`76705da2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiApcInterrupt+0x10b
00000000`0018fd3c 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76705da2

STACK_COMMAND: kb

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+356c3
fffff800`03545c63 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+356c3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4f76721c

FAILURE_BUCKET_ID: X64_0x1a_3452_nt!_??_::FNODOBFM::_string_+356c3

BUCKET_ID: X64_0x1a_3452_nt!_??_::FNODOBFM::_string_+356c3

Followup: MachineOwner

umc · 10 Jun 2012

I just have two more BSODs today. I attached 2 new minidump files and pasted the debugging analysis for the new memory.dmp file.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\Anh Vo\Downloads\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
Machine Name:
Kernel base = 0xfffff800`03412000 PsLoadedModuleList = 0xfffff800`03656670
Debug session time: Sun Jun 10 18:02:41.937 2012 (UTC - 7:00)
System Uptime: 0 days 0:08:34.999
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffde018). Type ".hh dbgerr001" for details
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 128b18, 2, 128b15}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000128b18, page frame number
Arg3: 0000000000000002, current page state
Arg4: 0000000000128b15, 0

Debugging Details:
------------------

BUGCHECK_STR: 0x4E_99

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: SearchIndexer.

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from fffff8000351710c to fffff800034911c0

STACK_TEXT:
fffff880`02d29e18 fffff800`0351710c : 00000000`0000004e 00000000`00000099 00000000`00128b18 00000000`00000002 : nt!KeBugCheckEx
fffff880`02d29e20 fffff800`03435230 : 00000000`00000000 fffff680`00023e70 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`02d29e60 fffff800`03460d73 : fffffa80`090b7750 fffff700`00001a5b 0000007f`fffffff8 fffff8a0`0c238390 : nt! ?? ::FNODOBFM::`string'+0x32978
fffff880`02d29ef0 fffff800`03461e42 : fffffa80`090b7750 fffffa80`00000000 fffff8a0`00001169 fffff880`00000000 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`02d2a7a0 fffff800`037626da : fffff8a0`044895a0 fffff880`02d2aae0 00000000`00000000 fffffa80`08f9c710 : nt!MmCleanProcessAddressSpace+0x96
fffff880`02d2a7f0 fffff800`03745bdd : 00000000`000000ff fffff880`02d2aa01 000007ff`fffd6000 fffffa80`08badb50 : nt!PspExitThread+0x56a
fffff880`02d2a8f0 fffff800`03483d1a : 00000000`00000001 fffff880`02d2aa68 00000000`0591fae0 fffff880`02d2aaa0 : nt!PsExitSpecialApc+0x1d
fffff880`02d2a920 fffff800`03484060 : 00000000`76e945e8 fffff880`02d2a9a0 fffff800`03745b50 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`02d2a9a0 fffff800`034904f7 : fffffa80`08f9c710 00000000`76e945c0 00000000`000000c0 00000000`00345498 : nt!KiInitiateUserApc+0x70
fffff880`02d2aae0 00000000`76de2c1a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0591f8f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76de2c1a

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`0351710c cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiBadShareCount+4c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4f76721c

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

yowanvista · 11 Jun 2012

Your Internet download manager (IDM) was invloved in the first crash. You should disable it for the time being. Other dumps still point to a memory issue. Possibly the RAM itself.