ntoskrnl.exe+75bc0 Causing multiple BSOD

Johnksvo · 24 Dec 2014

This is a 4 month old build, that has been plagued by this kernel. 16BG of Kingston extreme ram, Intel I7 4790K processor, Gigabyte Motherboard and a later added EVGA 4GB video card. All inside of a corsair 750 case and 750W PS.

I do have an Associates in Networking and computer tech but I have never diagnosed a blue screen problem before so this is all new to me.

As stated in the thread title it is the ntoskrnl.exe+75bc0 kernel that is causing the blue screens and I am not sure what to make of it. I used blue screen view and from the help of the board here I used the windows debugging tool and that also pointed to the same ntoskrnl.exe+75bc0 kernel.

I downloaded the windows 7 diagnostic tool and hopefully that was done right and properly uploaded because I could use the help. I did run memtest86 and was given a clean bill of health but I might run it again just to be on the safe side.

I would greatly appreciate any help! And merry Christmas!

John

koolkat77 · 29 Dec 2014

Code:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\USER\Downloads\Compressed\SF_24-12-2014\SF_24-12-2014\122314-21231-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`0344c000 PsLoadedModuleList = 0xfffff800`0368f890
Debug session time: Tue Dec 23 11:32:05.166 2014 (UTC + 6:00)
System Uptime: 0 days 2:26:31.040
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa800a7ff910, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
	contains the address of the PFN for the corrupted page table page.
	On a 32 bit OS, parameter 2 contains a pointer to the number of used
	PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa800a7ff910
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  rundll32.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003532d50 to fffff800034c1bc0

STACK_TEXT:  
fffff880`0e6776e8 fffff800`03532d50 : 00000000`0000001a 00000000`00041790 fffffa80`0a7ff910 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0e6776f0 fffff800`034f47d9 : 00000000`00000000 00000000`739affff fffffa80`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x35084
fffff880`0e6778b0 fffff800`037db0f1 : fffffa80`106b7cd0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`0e6779d0 fffff800`037db4f3 : 00000000`00000000 00000000`73950000 fffffa80`00000001 fffffa80`10fd8e60 : nt!MiUnmapViewOfSection+0x1b1
fffff880`0e677a90 fffff800`034c0e53 : fffffa80`0d16e060 fffff880`0e677b60 fffffa80`0de3e790 00000000`00000026 : nt!NtUnmapViewOfSection+0x5f
fffff880`0e677ae0 00000000`76ea155a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0014ad38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76ea155a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+35084
fffff800`03532d50 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+35084

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  531590fb

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+35084

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+35084

Followup: MachineOwner
---------

Code:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\USER\Downloads\Compressed\SF_24-12-2014\SF_24-12-2014\122314-20607-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`03452000 PsLoadedModuleList = 0xfffff800`03695890
Debug session time: Tue Dec 23 15:01:26.330 2014 (UTC + 6:00)
System Uptime: 0 days 3:28:34.205
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8a204298248, 1, fffff880012ab506, 5}


Could not read faulting driver name
Probably caused by : Ntfs.sys ( Ntfs!NtfsOpenAttribute+326 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a204298248, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff880012ab506, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800036ff100
GetUlongFromAddress: unable to read from fffff800036ff1c0
 fffff8a204298248 Paged pool

FAULTING_IP: 
Ntfs!NtfsOpenAttribute+326
fffff880`012ab506 4c8918          mov     qword ptr [rax],r11

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffff8800d2d86b0 -- (.trap 0xfffff8800d2d86b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a204298248 rbx=0000000000000000 rcx=fffff8a0043008b0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880012ab506 rsp=fffff8800d2d8840 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=fffff8a0002a9001
r11=fffff8a004300948 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
Ntfs!NtfsOpenAttribute+0x326:
fffff880`012ab506 4c8918          mov     qword ptr [rax],r11 ds:fffff8a2`04298248=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800035445b3 to fffff800034c7bc0

STACK_TEXT:  
fffff880`0d2d8548 fffff800`035445b3 : 00000000`00000050 fffff8a2`04298248 00000000`00000001 fffff880`0d2d86b0 : nt!KeBugCheckEx
fffff880`0d2d8550 fffff800`034c5cee : 00000000`00000001 fffff8a2`04298248 fffffa80`12486000 fffffa80`1296c4b0 : nt! ?? ::FNODOBFM::`string'+0x43801
fffff880`0d2d86b0 fffff880`012ab506 : fffffa80`1296c4b0 fffff880`0effda00 fffff8a0`00000002 fffff8a0`04300998 : nt!KiPageFault+0x16e
fffff880`0d2d8840 fffff880`0129a115 : fffffa80`0d00b700 fffffa80`0ddfdf70 fffffa80`13890180 fffff8a0`04300998 : Ntfs!NtfsOpenAttribute+0x326
fffff880`0d2d8950 fffff880`01295f5b : fffff880`0effdae0 fffffa80`0d00b700 fffff8a0`04300998 fffff8a0`00000024 : Ntfs!NtfsOpenExistingAttr+0x145
fffff880`0d2d8a10 fffff880`012991cf : fffffa80`0d00b700 fffffa80`0ddfdc60 fffff8a0`04300998 fffff880`00000024 : Ntfs!NtfsOpenAttributeInExistingFile+0x5ab
fffff880`0d2d8ba0 fffff880`012a9306 : fffffa80`0d00b700 fffffa80`0ddfdc60 fffff8a0`04300998 00000000`00000701 : Ntfs!NtfsOpenExistingPrefixFcb+0x1ef
fffff880`0d2d8c90 fffff880`012a6af3 : fffffa80`0d00b700 fffffa80`0ddfdc60 fffff880`0d2d8e70 fffff880`0d2d8ea8 : Ntfs!NtfsFindStartingNode+0x5e6
fffff880`0d2d8d60 fffff880`012113ad : fffffa80`0d00b700 fffffa80`0ddfdc60 fffff880`0effdae0 fffffa80`0dcb7100 : Ntfs!NtfsCommonCreate+0x3d3
fffff880`0d2d8f30 fffff800`034bf6b7 : fffff880`0effda50 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0d2d8f60 fffff800`034bf678 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x27
fffff880`0effd920 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsOpenAttribute+326
fffff880`012ab506 4c8918          mov     qword ptr [rax],r11

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  Ntfs!NtfsOpenAttribute+326

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  52e1be8a

FAILURE_BUCKET_ID:  X64_0x50_Ntfs!NtfsOpenAttribute+326

BUCKET_ID:  X64_0x50_Ntfs!NtfsOpenAttribute+326

Followup: MachineOwner
---------

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

RAM - Test with Memtest86+

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

Information

Errors are sometimes found after 8 passes.

Tip

Memtest should be done overnight.