BSODs (0x50 and 0x18) in random situations even logon screen

Apocaer · 09 Sep 2013

Hi
For about three days I keep getting BSODs: mainly PAGE_FAULT_IN_NONPAGED_AREA and REFERENCE_BY_POINTER. It happens in random moments: on logon screen, after login, with opened Opera or not and so on.
Please give me any advice what is causing errors. (zip file in attachment)
Best regards,
Apo

YoYo155 · 09 Sep 2013

Welcome to SF :) .

Two out of three bugchecks didn't hold much information at all, but one of them did offer some insight.

The RAW stack reveals a lot of disk activity, both Ntfs and ataport are very active.

Code:

fffff880`08513830  fffff880`01247412 Ntfs!NtfsCommonCreateCallout+0x22
fffff880`08513858  fffff880`01287e6c Ntfs!NtfsStatusQueue+0x66c
fffff880`08513860  fffff880`01287e6c Ntfs!NtfsStatusQueue+0x66c
fffff880`08513868  fffff880`01239000 Ntfs!NtfsGetNextChildLcb <PERF> (Ntfs+0x0)
fffff880`08513898  fffff880`01239000 Ntfs!NtfsGetNextChildLcb <PERF> (Ntfs+0x0)
fffff880`085138d0  fffff880`0124c024 Ntfs!NtfsStorageDriverCallout
fffff880`08513918  fffff880`0124885c Ntfs!NtfsExtendedCompleteRequestInternal+0x11c
fffff880`08513b18  fffff880`01248e80 Ntfs!NtfsLookupAllocation+0x1f0
fffff880`08513c40  fffff880`0124c024 Ntfs!NtfsStorageDriverCallout
fffff880`08513c88  fffff880`0124ac1d Ntfs!NtfsPrepareSimpleBuffers+0x6ad
fffff880`08513cd8  fffff880`00dc0000 ataport!ChannelSyncAcpiEvalMethod <PERF> (ataport+0x0)
fffff880`08513ce0  fffff880`00dd7060 ataport!__PchSym_ <PERF> (ataport+0x17060)
fffff880`08513ce8  fffff880`00dc0000 ataport!ChannelSyncAcpiEvalMethod <PERF> (ataport+0x0)
fffff880`08513cf0  fffff880`00dd769c ataport!__PchSym_ <PERF> (ataport+0x1769c)
fffff880`08513cf8  fffff880`00dc0000 ataport!ChannelSyncAcpiEvalMethod <PERF> (ataport+0x0)
fffff880`08513d00  fffff880`00dd7654 ataport!__PchSym_ <PERF> (ataport+0x17654)
fffff880`08513d08  fffff880`00dc0000 ataport!ChannelSyncAcpiEvalMethod <PERF> (ataport+0x0)
fffff880`08513d10  fffff880`00dd7648 ataport!__PchSym_ <PERF> (ataport+0x17648)
fffff880`08513d18  fffff880`00dc0000 ataport!ChannelSyncAcpiEvalMethod <PERF> (ataport+0x0)
fffff880`08513d20  fffff880`00dd763c ataport!__PchSym_ <PERF> (ataport+0x1763c)
fffff880`08513d28  fffff880`00dc0000 ataport!ChannelSyncAcpiEvalMethod <PERF> (ataport+0x0)
fffff880`08513d30  fffff880`00dd7918 ataport!__PchSym_ <PERF> (ataport+0x17918)
fffff880`08513d38  fffff880`00dc0000 ataport!ChannelSyncAcpiEvalMethod <PERF> (ataport+0x0)
fffff880`08513f48  fffff880`0124885c Ntfs!NtfsExtendedCompleteRequestInternal+0x11c
fffff880`08513fa8  fffff880`00dcf591 ataport!IdeProcessPortNotification+0x16d
fffff880`085140d8  fffff880`00eb001c atapi!AtapiSendAtaCommand
fffff880`085140f8  fffff880`00dd61a0 ataport!WPP_MAIN_CB
fffff880`08514118  fffff880`00eafee1 atapi!AtapiHandleAtaCommand+0x45
fffff880`08514148  fffff880`00eaf656 atapi!AtapiHwStartIo+0x66
fffff880`08514178  fffff880`00dcbf4f ataport!IdeStartCrbSynchronized+0x7b
fffff880`085142f8  fffff880`00dc5fd8 ataport!AtaPortGetPhysicalAddress+0x2c
fffff880`08514358  fffff880`00dc5dbe ataport!AtaPortWritePortUchar+0x6
fffff880`08514388  fffff880`00eb05c9 atapi!AtapiProgramTaskFile+0x75
fffff880`08514398  fffff880`00dd61a0 ataport!WPP_MAIN_CB
fffff880`085143b8  fffff880`00eb017a atapi!AtapiSendAtaCommand+0x15e
fffff880`085143e8  fffff880`00eb001c atapi!AtapiSendAtaCommand
fffff880`08514408  fffff880`00dd61a0 ataport!WPP_MAIN_CB
fffff880`08514428  fffff880`00eafee1 atapi!AtapiHandleAtaCommand+0x45
fffff880`085145f8  fffff880`00dca668 ataport!IdeStartDeviceRequest+0x2c4
fffff880`08514628  fffff880`00dc799a ataport!AtaBuildCrb+0x6a

This sort of activity by ataport is usually indicative of a sneaky kind of software called a rootkit.

Download TDSS-Killer and scan for rootkits.

By looking at you system event log I see many reports of bad blocks found on the HDD.

Code:

Event[27737]:
  Log Name: System
  Source: Disk
  Date: 2013-09-09T23:21:36.313
  Event ID: 7
  Task: N/A
  Level: B³ךdy
  Opcode: N/A
  Keyword: Klasyczny
  User: N/A
  User Name: N/A
  Computer: Apocaer-PC
  Description: 
W urz¹dzeniu \Device\Harddisk1\DR1 wyst¹pi³ z³y blok.

Event[27738]:
  Log Name: System
  Source: Disk
  Date: 2013-09-09T23:21:36.355
  Event ID: 7
  Task: N/A
  Level: B³ךdy
  Opcode: N/A
  Keyword: Klasyczny
  User: N/A
  User Name: N/A
  Computer: Apocaer-PC
  Description: 
W urz¹dzeniu \Device\Harddisk1\DR1 wyst¹pi³ z³y blok.

Event[27739]:
  Log Name: System
  Source: Disk
  Date: 2013-09-09T23:21:36.403
  Event ID: 7
  Task: N/A
  Level: B³ךdy
  Opcode: N/A
  Keyword: Klasyczny
  User: N/A
  User Name: N/A
  Computer: Apocaer-PC
  Description: 
W urz¹dzeniu \Device\Harddisk1\DR1 wyst¹pi³ z³y blok.

Event[27740]:
  Log Name: System
  Source: Disk
  Date: 2013-09-09T23:21:36.445
  Event ID: 7
  Task: N/A
  Level: B³ךdy
  Opcode: N/A
  Keyword: Klasyczny
  User: N/A
  User Name: N/A
  Computer: Apocaer-PC
  Description: 
W urz¹dzeniu \Device\Harddisk1\DR1 wyst¹pi³ z³y blok.

Event[27741]:
  Log Name: System
  Source: Disk
  Date: 2013-09-09T23:21:36.486
  Event ID: 7
  Task: N/A
  Level: B³ךdy
  Opcode: N/A
  Keyword: Klasyczny
  User: N/A
  User Name: N/A
  Computer: Apocaer-PC
  Description: 
W urz¹dzeniu \Device\Harddisk1\DR1 wyst¹pi³ z³y blok.

Testing the HDD:

Perform a Disk Check | Disk Check
Then Post the results following | THIS METHOD
Download SeaTools for Windows if you don't want to use a CD to test the HDD you can use YUMI – Multiboot USB Creator to create a bootable USB (instructions are found at the bottom of both pages).
If SeaTools for Windows is unable to recognize your HDD visit HDDdiag and follow the instructions.

If the HDD is OK clear some space:

Code:

Wolne miejsce    7,18 GB (7 709 057 024 bajtów)

Post back with the results!