Sporadic BSODs, no consistent cause

Page 1 of 2 12 LastLast

  1. Posts : 15
    Windows 7 Home Premium 64bit
       #1

    Sporadic BSODs, no consistent cause


    Hi,

    My computer (Lenovo G570) has had problems with BSODs for basically the whole time that I have owned it. They are extremely sporadic - sometimes it will work fine for a month and the problem appears to have been resolved and sometimes it crashes several times in a few days.

    I had a couple of crashes recently. On the first occasion LibreOffice was the only thing open but I wasn't doing anything on the computer at the time, not even moving the mouse, and I hadn't been for a while. The second time it crashed just after I closed Firefox (which I have had other stability issues with recently).

    I posted about this once before and I thought that I had fixed the issue - Intermittent BSODs, errors 0x0c2, 0x019, 0x05c, 0x00a
    I know the rules about double posting but seeing as that thread has been dead for over a year I thought I had better start again.

    I appreciate any help you can give me with this. I would give more detail if the BSODs correlated with any activity but they don't seem to.

    Thanks.

    UPDATE: I googled some of the BSOD error messages, and the information for BAD_POOL_HEADER suggests a driver issue. I checked the drivers here - http://support.lenovo.com/en_GB/rese...DocID=HT072724 - and the only one which is out of date is the Intel chipset driver. This is weird because I run Intel's driver verifier fairly regularly and it hasn't picked up on it. Should I update from the Lenovo page?
    Last edited by StripyHorse; 26 Sep 2013 at 04:19. Reason: Driver info
      My Computer


  2. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #2

    The BSOD is caused by Lenovo EE Boot Optimizer driver, which is a factory bloatware, and should be remover.
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 24, {1904fb, fffff880089d50d8, fffff880089d4930, fffff80002eaf718}
    
    *** WARNING: Unable to verify timestamp for fbfmon.sys
    *** ERROR: Module load completed but symbols could not be loaded for fbfmon.sys
    Probably caused by : fbfmon.sys ( fbfmon+330f )
    
    Followup: MachineOwner
    ---------
    I'd recommend you to Clean Up Factory Bloatware, with a special reference to Point #13
    13. Consider a Clean Reinstall - Factory OEM Windows 7 which is often better than getting a new computer considering how pre-installed bloatware can corrupt Windows 7 even if it's completely cleaned up.
      My Computer


  3. Posts : 15
    Windows 7 Home Premium 64bit
    Thread Starter
       #3

    Thanks Arc! That was blissfully simple...

    I had a look at that great tutorial and uninstalled Boot Optimiser. It was actually already disabled on startup but it seems it was still interfering. I did a before and after on the drivers folder to make sure that fbfmon.sys had gone (which from some googling and the info on BlueScreenView I think is the driver that you're talking about?) and the uninstall got rid of it.

    I can see that a clean reinstall would be a good idea but I can't face it with all the programs that I have installed and set up. I'll definitely do it whenever I get a new computer though.

    Out of interest, did all the BSODs show up as being caused by fbfmon.sys? On BlueScreenView it only shows up as a problem on a couple of them, but I've heard that BSV can give false leads. Only asking because it would be useful to know what to look for if something similar happens again.

    Thanks again for your help, you've sorted what the others didn't manage to last time!
      My Computer


  4. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #4

    Lenovo EE Boot Optimizer driver was responsible behind those BSODs directlyor indirectly. As now it is uninstalled, let us know how it is going. If it BSODs again, we will do further troubleshooting.
      My Computer


  5. Posts : 15
    Windows 7 Home Premium 64bit
    Thread Starter
       #5

    Just when it looked OK I had another BSOD. This time it was when bringing the computer out of sleep.

    Attached is the new info.

    I had a look at the running drivers from the time of the crash and fbfmon was there again. This is weird because I looked in C:\Windows\System32\drivers after the uninstall and it had gone, and it still isn't there. Is there anywhere else it could be lurking? I did a search on the C: drive which didn't show anything.

    Thanks.
      My Computer


  6. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #6

    It is a stop 0x24, NTFS file system error as pointed out earlier. It is caused by either a corrupted storage device, or anything else affecting file system.

    Seatool for dos: SeaTools | Seagate download

    • Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.
    • You are using AHCI mode of storage controller. If you see that the Seatools for DOS is not detecting any HDD to test, enter into the BIOS. Change the storage controller mode to IDE/SATA, boot into seatools disc, and test it. When the testing is done, enter into BIOS again and set the controller mode back to AHCI, otherwise windows will refuse to boot.

    Let us know the results.
    ______________________________________________________________
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 24, {1904fb, fffff8800913f8b8, fffff8800913f110, fffff8800145028c}
    
    Probably caused by : Ntfs.sys ( Ntfs!NtfsAcquireFcbWithPaging+12c )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    NTFS_FILE_SYSTEM (24)
        If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
        parameters are the exception record and context record. Do a .cxr
        on the 3rd parameter and then kb to obtain a more informative stack
        trace.
    Arguments:
    Arg1: 00000000001904fb
    Arg2: fffff8800913f8b8
    Arg3: fffff8800913f110
    Arg4: fffff8800145028c
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_RECORD:  fffff8800913f8b8 -- (.exr 0xfffff8800913f8b8)
    ExceptionAddress: fffff8800145028c (Ntfs!NtfsAcquireFcbWithPaging+0x000000000000012c)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000058
    Attempt to read from address 0000000000000058
    
    CONTEXT:  fffff8800913f110 -- (.cxr 0xfffff8800913f110)
    rax=0000000000000000 rbx=0000000000000003 rcx=0000000000000000
    rdx=0000000000000000 rsi=0000000000000002 rdi=fffffa8008c23e40
    rip=fffff8800145028c rsp=fffff8800913faf0 rbp=0000000000000002
     r8=0000000000000000  r9=0000000000000002 r10=fffffa8008c23e40
    r11=fffff8a00b89c312 r12=fffff8a00b837010 r13=00000000c00000d8
    r14=0000000000000300 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
    Ntfs!NtfsAcquireFcbWithPaging+0x12c:
    fffff880`0145028c 488b4958        mov     rcx,qword ptr [rcx+58h] ds:002b:00000000`00000058=????????????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    PROCESS_NAME:  svchost.exe
    
    CURRENT_IRQL:  0
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  0000000000000058
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c4100
    GetUlongFromAddress: unable to read from fffff800030c41c0
     0000000000000058 Nonpaged pool
    
    FOLLOWUP_IP: 
    Ntfs!NtfsAcquireFcbWithPaging+12c
    fffff880`0145028c 488b4958        mov     rcx,qword ptr [rcx+58h]
    
    FAULTING_IP: 
    Ntfs!NtfsAcquireFcbWithPaging+12c
    fffff880`0145028c 488b4958        mov     rcx,qword ptr [rcx+58h]
    
    BUGCHECK_STR:  0x24
    
    DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE
    
    LAST_CONTROL_TRANSFER:  from fffff880014ea567 to fffff8800145028c
    
    STACK_TEXT:  
    fffff880`0913faf0 fffff880`014ea567 : 00000000`00000000 fffff8a0`0b837450 fffff8a0`0b89c3a6 00000000`00000000 : Ntfs!NtfsAcquireFcbWithPaging+0x12c
    fffff880`0913fb50 fffff880`014e8dc2 : fffffa80`08c23e40 fffffa80`066e9350 fffff8a0`001da770 00000000`00000701 : Ntfs!NtfsFindPrefixHashEntry+0x44e
    fffff880`0913fc80 fffff880`014e6701 : fffffa80`08c23e40 fffffa80`04792b80 fffff880`0913fe50 fffff880`0913fea0 : Ntfs!NtfsFindStartingNode+0x452
    fffff880`0913fd50 fffff880`0145040d : fffffa80`08c23e40 fffffa80`04792b80 fffff880`06afda30 fffffa80`08906000 : Ntfs!NtfsCommonCreate+0x3e1
    fffff880`0913ff30 fffff800`02e84677 : fffff880`06afd9a0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
    fffff880`0913ff60 fffff800`02e84638 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27
    fffff880`06afd870 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue
    
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  Ntfs!NtfsAcquireFcbWithPaging+12c
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: Ntfs
    
    IMAGE_NAME:  Ntfs.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  5167f5fc
    
    STACK_COMMAND:  .cxr 0xfffff8800913f110 ; kb
    
    FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsAcquireFcbWithPaging+12c
    
    BUCKET_ID:  X64_0x24_Ntfs!NtfsAcquireFcbWithPaging+12c
    
    Followup: MachineOwner
    ---------
      My Computer


  7. Posts : 15
    Windows 7 Home Premium 64bit
    Thread Starter
       #7

    Hi Arc,

    I ran SeaTools last night and the drive passed. Something else happened, and it's probably unrelated - when I tried to access the BIOS to turn my HD back to ACHI I ended up with just a black screen. I had to Ctrl-Alt-Del out of it to reboot and it worked second time.

    I'm going to be without my computer this weekend so it might take a few days for me to complete the next step.
    Last edited by StripyHorse; 28 Sep 2013 at 03:13. Reason: mistake
      My Computer


  8. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #8

    Its ok :) Report back when you can.

    And, as the computer booted properly, there is nothing to be worried.
      My Computer


  9. Posts : 15
    Windows 7 Home Premium 64bit
    Thread Starter
       #9

    Hi again,

    The hard drive passed SeaTools with no errors.

    What should I try next?

    Thanks
      My Computer


  10. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #10

    Thats good and relieving :)

    Now, do two more things.

    Get rid of intel rapid storage. First uninstall it from Control Panel > Programs and Features. Then Uninstall the driver from device manager.

    1. Right click on "my computer" icon and click "manage" on the context menu.
    2. It will open the "computer management" window.
    3. Select "Device Manager" in the left pane, It will list all the existing devices up.
    4. Expand "IDE ATA/ATAPI controllers" by clicking on the triangle in front of it.
    5. Select one Intel device item under it, right click, uninstall.
    6. Continue the process for all Intel items under "IDE ATA/ATAPI controllers"
    7. Now restart the computer. At restart, windows will auto configure the appropriate native system driver.

    Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

    1. Click on the Start button
    2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
    3. Select the “Startup” tab.
    4. Deselect all items other than the antivirus, MSC and the touchpad driver, SynTP.
    5. Apply > OK
    6. Accept then restart.

    Let us know the results.

    If the BSOD occurs even after doing all those, we will accept the fact as a NTFS file system corruption. Formatting the HDD and reinstalling windows will be able to recover the corrupted file system on the disc. But dont go for it without consulting with us please.
      My Computer


 
Page 1 of 2 12 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 00:03.
Find Us