New
#21
There were two BSODs while verifier was running, and those both happened while trying to start the computer in safe mode.
There were two BSODs while verifier was running, and those both happened while trying to start the computer in safe mode.
To answer Koolkat's inquiry about the CompositeBus.sys item she found, CompositeBus.sys is the Multi-Transport Composite Bus Enumerator - kinda odd that it's named that since Multi-Transport and Composite are synonymous so it's redundant (like called a car "quick and fast"). Anyways, it's designed for external devices that interface with the system in more than one way. An example is a camera that connects either via Bluetooth or USB, or an external drive that uses eSATA or USB. Windows 7 apparently tries to resolve an issue with device recognition by using this driver, since there's times when there could be conflicts (see this article).
It's unfortunate this minidump failed to store the IRP related to this crashing thread, since that will give us a good solid amount of clues to what device we're actually dealing with here. Nothing else we can go on with this little of info. It's evident though when looking at the callstack that it involved just starting up the device (must've been recently hooked or during Windows startup it's now this device's turn to initialize).
I'm personally curious on the other crashdumps, like the two that crashed during NTFS ops, and one of them involving a single bit of code in RAM getting corrupted. I'd recommend the client do the usual Memtest run for 7+ hours and follow that up with all basic Seatools tests besides the Long Generic, and disconnect any external device besides keyboard and mouse. May wanna run Seatools in DOS, which will mean putting it on a USB drive or a CD/DVD.
Code:0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 001904fb Arg2: 94bea9ac Arg3: 94bea590 Arg4: 828e7653 Debugging Details: ------------------ TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2 EXCEPTION_RECORD: 94bea9ac -- (.exr 0xffffffff94bea9ac) ExceptionAddress: 828e7653 (nt!FsRtlInsertPerFileObjectContext+0x00000125) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000001 Parameter[1]: 5b5fc033 Attempt to write to address 5b5fc033 CONTEXT: 94bea590 -- (.cxr 0xffffffff94bea590) eax=850b4794 ebx=00000001 ecx=850b45e0 edx=00000000 esi=98125238 edi=00000000 eip=828e7653 esp=94beaa74 ebp=94beaa94 iopl=0 nv up ei pl nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206 nt!FsRtlInsertPerFileObjectContext+0x125: 828e7653 838233c05f5b5e add dword ptr [edx+5B5FC033h],5Eh ds:0023:5b5fc033=???????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION PROCESS_NAME: svchost.exe CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 00000001 EXCEPTION_PARAMETER2: 5b5fc033 WRITE_ADDRESS: GetPointerFromAddress: unable to read from 829a7848 Unable to read MiSystemVaType memory at 82986e20 5b5fc033 FOLLOWUP_IP: nt!FsRtlInsertPerFileObjectContext+125 828e7653 838233c05f5b5e add dword ptr [edx+5B5FC033h],5Eh FAULTING_IP: nt!FsRtlInsertPerFileObjectContext+125 828e7653 838233c05f5b5e add dword ptr [edx+5B5FC033h],5Eh BUGCHECK_STR: 0x24 MISALIGNED_IP: nt!FsRtlInsertPerFileObjectContext+125 828e7653 838233c05f5b5e add dword ptr [edx+5B5FC033h],5Eh LAST_CONTROL_TRANSFER: from 8a820f2c to 828e7653 STACK_TEXT: 94beaa94 8a820f2c 98125238 850b45e0 853dc428 nt!FsRtlInsertPerFileObjectContext+0x125 94beab60 8a822d7a 853dc428 850b45e0 1e3a7151 Ntfs!NtfsCommonRead+0x944 94beabd0 82873c29 85f26020 850b45e0 850b45e0 Ntfs!NtfsFsdRead+0x279 94beabe8 82fc320c 864e8268 850b45e0 00000000 nt!IofCallDriver+0x63 94beac0c 82fc33cb 94beac2c 864e8268 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa 94beac44 82873c29 864e8268 850b45e0 850b45e0 fltmgr!FltpDispatch+0xc5 94beac5c 82a68b29 850b45e0 850b47b8 87384380 nt!IofCallDriver+0x63 94beac7c 82aa1516 864e8268 87384380 00000001 nt!IopSynchronousServiceTail+0x1f8 94bead08 8287a8fa 864e8268 850b45e0 00000000 nt!NtReadFile+0x644 94bead08 77a47094 864e8268 850b45e0 00000000 nt!KiFastCallEntry+0x12a WARNING: Frame IP not in any known module. Following frames may be wrong. 01d5e350 00000000 00000000 00000000 00000000 0x77a47094 CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt 828e7168 - nt!FsRtlCheckOplock+4f [ f7:e7 ] 1 error : !nt (828e7168) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT STACK_COMMAND: .cxr 0xffffffff94bea590 ; kb FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
Update:
I ran memtest on all of the RAM sticks individually with no errors. The hard drive passed the Seatools tests. Also haven't had a BSOD for a while. Anything else I can try?
Thanks for the responses.
You may wanna be leery of any USB or other external device you connect to your system. Find software/firmware updates for em if available to ensure that everything's ok. Otherwise, guess we'll just have to wait in case it bugs out again.