I'm still fighting a problem with unexpected shutdowns related to the computer sleeping (thread here) but while just using the system this morning I ran into a BSOD with a BAD_POOL_CALLER error while using the WHS 2011 Dashboard. No idea if that's related to the problem or not.
Is the firmware for your SSD up to date?Code:Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\admin\Downloads\TAURUS-Sun_11_02_2014__73002_78\110214-15178-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144 Machine Name: Kernel base = 0xfffff800`01c66000 PsLoadedModuleList = 0xfffff800`01ea9890 Debug session time: Sun Nov 2 18:27:44.258 2014 (UTC + 6:00) System Uptime: 1 days 0:23:09.898 Loading Kernel Symbols ............................................................... ................................................................ .................. Loading User Symbols Loading unloaded module list .............. ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck C2, {7, 109b, 0, fffff8a0170d0c78} GetPointerFromAddress: unable to read from fffff80001f13100 GetUlongFromAddress: unable to read from fffff80001f131c0 Probably caused by : Ntfs.sys ( Ntfs!NtfsFullDeleteLcb+122 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* BAD_POOL_CALLER (c2) The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc. Arguments: Arg1: 0000000000000007, Attempt to free pool which was already freed Arg2: 000000000000109b, (reserved) Arg3: 0000000000000000, Memory contents of the pool block Arg4: fffff8a0170d0c78, Address of the block of pool being deallocated Debugging Details: ------------------ POOL_ADDRESS: fffff8a0170d0c78 Paged pool FREED_POOL_TAG: FMfn BUGCHECK_STR: 0xc2_7_FMfn CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 1 LAST_CONTROL_TRANSFER: from fffff80001e0ebe9 to fffff80001cdbbc0 STACK_TEXT: fffff880`01fc0898 fffff800`01e0ebe9 : 00000000`000000c2 00000000`00000007 00000000`0000109b 00000000`00000000 : nt!KeBugCheckEx fffff880`01fc08a0 fffff880`012a0a12 : fffff8a0`171d0840 fffff8a0`171d0b00 fffff8a0`171ed710 fffff8a0`171d0840 : nt!ExDeferredFreePool+0x1201 fffff880`01fc0950 fffff880`0121c279 : fffff8a0`171d0840 fffff800`01e81280 fffff880`01fc0b01 fffff880`012a3cdb : Ntfs!NtfsFullDeleteLcb+0x122 fffff880`01fc0980 fffff880`012a1a2c : fffffa80`079777d0 fffffa80`06eb5180 fffff8a0`171d0840 fffff8a0`171d0bd8 : Ntfs!NtfsTeardownFromLcb+0x129 fffff880`01fc0a10 fffff880`01224a52 : fffffa80`079777d0 fffffa80`079777d0 fffff8a0`171d0840 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xcc fffff880`01fc0a90 fffff880`012b12d3 : fffffa80`079777d0 fffff800`01e81280 fffff8a0`171d0840 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2 fffff880`01fc0ad0 fffff880`01303d32 : fffffa80`079777d0 fffff8a0`171d0970 fffff8a0`171d0840 fffffa80`06eb5180 : Ntfs!NtfsCommonClose+0x353 fffff880`01fc0ba0 fffff800`01ce5261 : 00000000`00000000 fffff800`01e81201 fffffa80`06706000 00000000`00000002 : Ntfs!NtfsFspCloseInternal+0x186 fffff880`01fc0c70 fffff800`01f7773a : a8f8e383`4807e083 fffffa80`06706040 00000000`00000080 fffffa80`066f8740 : nt!ExpWorkerThread+0x111 fffff880`01fc0d00 fffff800`01ccc8e6 : fffff880`009ed180 fffffa80`06706040 fffff880`009f7f40 043fdbe8`20244489 : nt!PspSystemThreadStartup+0x5a fffff880`01fc0d40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: Ntfs!NtfsFullDeleteLcb+122 fffff880`012a0a12 ebb5 jmp Ntfs!NtfsFullDeleteLcb+0xd9 (fffff880`012a09c9) SYMBOL_STACK_INDEX: 2 SYMBOL_NAME: Ntfs!NtfsFullDeleteLcb+122 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 52e1be8a FAILURE_BUCKET_ID: X64_0xc2_7_FMfn_Ntfs!NtfsFullDeleteLcb+122 BUCKET_ID: X64_0xc2_7_FMfn_Ntfs!NtfsFullDeleteLcb+122 Followup: MachineOwner ---------
According the the last time I had Samsung Magician loaded, yes. I just looked at the Samsung download site and there's nothing newer.
Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:
- Click on the
- Type CMD on Search
- Left click and Run as Administrator
- Type SFC /scannow
Full tutorial here:
Run Disk Check on your Hard Drive for file system errors and bad sectors on it.
Upload a screenshot of your hard disk using Crystal Disk Info.
Check for heating issues using Speccy or HWMonitor. Upload a screen shot with either of the tools:
Both SFC and CHKDSK came up clean as expected. I checked temps when running Prime95 and BurnInTest and they never got very high (40-42 was the highest I recall) so I'm pretty sure that's not it.
I also just completed another 9 passes of memtest86+ with no errors.
I'm pretty sure it's a SW induced problem but really have no idea where to look as I've exhausted my search capability.
Code:BugCheck C2, {7, 109b, 0, fffff8a0170d0c78} GetPointerFromAddress: unable to read from fffff80001f13100 GetUlongFromAddress: unable to read from fffff80001f131c0 Probably caused by : Ntfs.sys ( Ntfs!NtfsFullDeleteLcb+122 ) Followup: MachineOwner ---------OK, now test your RAM modules for possible errors. Run memtest86+ for at least 8 consecutive passes.
If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.
If it does not show any error, enable Driver Verifier to monitor the drivers. Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.
InformationWhy Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.
How Can we know that DV is enabled:
It will make the system bit of slow, laggy.
WarningBefore enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.
If there is no points, make a System Restore Point manually before enabling DV.
Let us know the results, with the subsequent crash dumps, if any.Tip
- If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
- If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.
You must have missed the bit about me saying I'd just completed another 9 passes without errors using memtest86+[v5.01] in my prior posting :)
I'll enable DV again but so far it's not found anything wrong.
I woke the computer this morning to a BSOD (related to igdkmd64.sys) and the event log shows an unexpected shutdown. A bit more unnerving is the event log has a couple of errors (399/474) related to "C:\Windows\SoftwareDistribution\DataStore\DataStore.edb" which happened during the nightly backup.
I've included the dump and I'm also downloading the graphics driver as Intel said it was newer than what I currently had - even though it was only by a couple of days.
Proper step as per the crash dump.
Code:******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {fffffa7f9122cc52, 1, fffff880032bda9c, 7} *** WARNING: Unable to verify timestamp for igdkmd64.sys *** ERROR: Module load completed but symbols could not be loaded for igdkmd64.sys Could not read faulting driver name Probably caused by : igdkmd64.sys ( igdkmd64+b9a9c ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffffa7f9122cc52, memory referenced. Arg2: 0000000000000001, value 0 = read operation, 1 = write operation. Arg3: fffff880032bda9c, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000007, (reserved) Debugging Details: ------------------ Could not read faulting driver name WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80001eb2100 GetUlongFromAddress: unable to read from fffff80001eb21c0 fffffa7f9122cc52 FAULTING_IP: igdkmd64+b9a9c fffff880`032bda9c 008b521c4889 add byte ptr [rbx-76B7E3AEh],cl MM_INTERNAL_CODE: 7 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP BUGCHECK_STR: 0x50 PROCESS_NAME: csrss.exe CURRENT_IRQL: 0 ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre TRAP_FRAME: fffff88015811ae0 -- (.trap 0xfffff88015811ae0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8007dab000 rdx=fffffa800785e000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff880032bda9c rsp=fffff88015811c70 rbp=fffff88015811d00 r8=fffff88015811d00 r9=0000000000000001 r10=fffffa800785e000 r11=0000000003260b00 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc igdkmd64+0xb9a9c: fffff880`032bda9c 008b521c4889 add byte ptr [rbx-76B7E3AEh],cl ds:ffffffff`89481c52=?? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80001cf753b to fffff80001c7abc0 STACK_TEXT: fffff880`15811978 fffff800`01cf753b : 00000000`00000050 fffffa7f`9122cc52 00000000`00000001 fffff880`15811ae0 : nt!KeBugCheckEx fffff880`15811980 fffff800`01c78cee : 00000000`00000001 fffffa7f`9122cc52 00000000`00000000 fffffa80`07dab000 : nt! ?? ::FNODOBFM::`string'+0x43781 fffff880`15811ae0 fffff880`032bda9c : 00000000`00000000 00000000`00000000 00000001`03260b00 00000000`00000000 : nt!KiPageFault+0x16e fffff880`15811c70 00000000`00000000 : 00000000`00000000 00000001`03260b00 00000000`00000000 fffff880`15811d00 : igdkmd64+0xb9a9c STACK_COMMAND: kb FOLLOWUP_IP: igdkmd64+b9a9c fffff880`032bda9c 008b521c4889 add byte ptr [rbx-76B7E3AEh],cl SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: igdkmd64+b9a9c FOLLOWUP_NAME: MachineOwner MODULE_NAME: igdkmd64 IMAGE_NAME: igdkmd64.sys DEBUG_FLR_IMAGE_TIMESTAMP: 54256d2c FAILURE_BUCKET_ID: X64_0x50_VRF_igdkmd64+b9a9c BUCKET_ID: X64_0x50_VRF_igdkmd64+b9a9c ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:x64_0x50_vrf_igdkmd64+b9a9c FAILURE_ID_HASH: {7df16549-a1dd-9e00-f159-51df1b0af16f} Followup: MachineOwner --------- 1: kd> lmvm igdkmd64 start end module name fffff880`03204000 fffff880`035c3000 igdkmd64 T (no symbols) Loaded symbol image file: igdkmd64.sys Image path: \SystemRoot\system32\DRIVERS\igdkmd64.sys Image name: igdkmd64.sys Timestamp: Fri Sep 26 19:12:04 2014 (54256D2C) CheckSum: 003B14CE ImageSize: 003BF000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Agreed, but I'm concerned about the 399/474 errors as well as the unexpected shutdown. The 399/474 errors happened in the early morning - probably as part of the backup - whereas the unexpected shutdown/BSOD happened when waking the computer several hours later.
Quote