Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Frequent BSOD crashes, by process of elimination likely a driver

09 Jan 2018   #1
akfocus

Window 7 Pro x64
 
 
Frequent BSOD crashes, by process of elimination likely a driver

Hi, and thanks for being here.

I have been having frequent BSODs and sudden reboots for several weeks on a new laptop that has been in service about 6 weeks. It is a Lenovo E560 running Win7-Pro x64, fully updated. A Lenovo utility updated the BIOS after the problems began occurring. I have also taken the following measures:

1. sfc /scannow reported no problems. I also ran ChkDsk in fix mode; no problems found.
2. Seagate SeaTools and Gibon's SpinRite reported no problems on their in-depth tests.
3. I ran the latest version of MemTest86 for 8 cycles, twice, with no errors reported.
4. I ran Prime95 to stress test the CPU. No errors reported.
5. I ran Lenovo diagnostics with no problems reported.
6. Four days ago I ran DriveBooster, which update 15 drivers that the Lenovo utility had said were current. (Risky perhaps, but up for trying anything at this point of frustration.)

Among faults on the BSOD screens have been: bad_pool_header; bad_pool_caller; PFN_List_Corrupt; PRN_list_corrupt; and others I don't have a record of. Crashes have happened: in several programs, twice when opening the laptop's lid (the OS turns off the screen when the lid is closed - it doesn't sleep or hibernate for that); and once when coming out of hibernation.

I ran DM Log Collector, and its output zip file is attached. When the last crash occurred I had Driver Verifier active.


My System SpecsSystem Spec
.
09 Jan 2018   #2
axe0

Windows 10 Pro
 
 

Please do the following
  • Open an admin command prompt
  • Copy & paste the code below in the command prompt
  • Go to your desktop
  • Right click CollectedFiles and choose sent to and select compressed (zipped) folder
  • Upload the zip.

Code:
Quote:
md "%USERPROFILE%\Desktop\CollectedFiles"&wmic /output:"%USERPROFILE%\Desktop\CollectedFiles\hotfix.txt" qfe list full /format:table&copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\CollectedFiles"&dxdiag /t %temp%\dxdiag.txt&copy %temp%\dxdiag.txt "%USERPROFILE%\Desktop\CollectedFiles\dxdiag.txt"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\CollectedFiles\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp"&findstr /v "Owner." "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp" > "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.txt"&del "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp"&driverquery /v > "%USERPROFILE%\Desktop\CollectedFiles\drivers.txt"&msinfo32 /nfo "%USERPROFILE%\Desktop\CollectedFiles\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\CollectedFiles\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\CollectedFiles\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\CollectedFiles\installed.txt"
My System SpecsSystem Spec
09 Jan 2018   #3
akfocus

Window 7 Pro x64
 
 

Here you go. I'm not sure the process completed correctly. It completed in the command window before the "refreshing system information" box completed. On the desktop I got a folder instead of a zip file, and what is attached here is a zip I made of its contents.
My System SpecsSystem Spec
.

09 Jan 2018   #4
akfocus

Window 7 Pro x64
 
 

I just had three BSOD crashes during bootup. One of them was a Bad_Pool_Caller, but the others did not identify a cause. I booted in safe mode and turned the Verifier off, and then was able to get a normal booup. Here is a minidump with Analyze turned on. It identifies NTFS.SYS as the probable cause.

Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\LTE\Desktop\010918-23025-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.24000.amd64fre.win7sp1_ldr.171231-1547
Machine Name:
Kernel base = 0xfffff800`03612000 PsLoadedModuleList = 0xfffff800`03851a90
Debug session time: Tue Jan 9 14:47:20.424 2018 (UTC - 9:00)
System Uptime: 0 days 0:00:19.579
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {b, fffff8a000a80740, a, fffff8a000a81010}

Probably caused by : Ntfs.sys ( Ntfs!NtfsPerformPrefetch+15d )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 000000000000000b, type of pool violation the caller is guilty of.
Arg2: fffff8a000a80740
Arg3: 000000000000000a
Arg4: fffff8a000a81010

Debugging Details:
------------------


FAULTING_IP:
Ntfs!NtfsPerformPrefetch+15d
fffff880`01e3574d 8bc3 mov eax,ebx

BUGCHECK_STR: 0xc2_b

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME: System

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

LAST_CONTROL_TRANSFER: from fffff800037f4acf to fffff800036b83a0

STACK_TEXT:
fffff880`03dcf308 fffff800`037f4acf : 00000000`000000c2 00000000`0000000b fffff8a0`00a80740 00000000`0000000a : nt!KeBugCheckEx
fffff880`03dcf310 fffff880`01e3574d : 00000000`00000000 00000000`00000100 fffffa80`0e726f30 00000000`000007ff : nt!ExFreePoolWithTag+0x188f
fffff880`03dcf3c0 fffff880`01efe12e : fffffa80`12e87600 fffff8a0`00a81010 fffffa80`13dfe180 ffffffff`ffffff01 : Ntfs!NtfsPerformPrefetch+0x15d
fffff880`03dcf410 fffff880`01f01c40 : fffffa80`126afe40 fffffa80`13dfe180 fffffa80`00000000 00000000`05ff8000 : Ntfs!NtfsScanEntireBitmap+0x1e3
fffff880`03dcf700 fffff880`01f13d42 : fffffa80`126afe40 fffffa80`13dfe180 00000000`00000000 00000000`00000000 : Ntfs!NtfsInitializeClusterAllocation+0x60
fffff880`03dcf730 fffff880`01eaf7c9 : fffffa80`126afe40 fffff980`05bd06c0 fffff880`03dcfa28 fffff880`03dcfa20 : Ntfs!NtfsMountVolume+0x1aaa
fffff880`03dcf9f0 fffff880`01e3626b : fffffa80`126afe40 fffff800`0364d973 00000000`00000000 fffffa80`10b4d410 : Ntfs!NtfsCommonFileSystemControl+0xc9
fffff880`03dcfaa0 fffff800`0366c281 : fffff800`03828500 fffff800`0391e900 fffffa80`0c7ef600 fffff800`03828501 : Ntfs!NtfsFspDispatch+0x29b
fffff880`03dcfb70 fffff800`0395a284 : 00000000`00000000 fffff880`03bee180 00000000`00000080 fffffa80`0c7d3040 : nt!ExpWorkerThread+0x111
fffff880`03dcfc00 fffff800`036be816 : fffff880`03bee180 fffffa80`0c7ef660 fffff880`03bfb140 00000000`00000000 : nt!PspSystemThreadStartup+0x140
fffff880`03dcfc40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
Ntfs!NtfsPerformPrefetch+15d
fffff880`01e3574d 8bc3 mov eax,ebx

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: Ntfs!NtfsPerformPrefetch+15d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 5a4991dc

IMAGE_VERSION: 6.1.7601.24000

FAILURE_BUCKET_ID: X64_0xc2_b_VRF_Ntfs!NtfsPerformPrefetch+15d

BUCKET_ID: X64_0xc2_b_VRF_Ntfs!NtfsPerformPrefetch+15d

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0xc2_b_vrf_ntfs!ntfsperformprefetch+15d

FAILURE_ID_HASH: {663d2c39-c4ca-ad7c-cddc-b7ae60b30679}

Followup: MachineOwner
---------
My System SpecsSystem Spec
09 Jan 2018   #5
akfocus

Window 7 Pro x64
 
 

I tried to attach a zip of dump files for the above, but consistently get a "404-File or directory not found" error when I try to do the actual upload. I am able to browse to the file, and it shows up on the webpage's menu for upload, but the upload button gives the above error. (Tried it with FireFox and Chrome -- strange because it has worked for me before.)
My System SpecsSystem Spec
10 Jan 2018   #6
axe0

Windows 10 Pro
 
 

NTFS is possibly not the actual cause, it is the Windows NT File System driver.





Frequent BSOD crashes, by process of elimination likely a driver Diagnostics Test Frequent BSOD crashes, by process of elimination likely a driver
 HDD TEST

Note   Note
Please run HDTune first, in the order posted!

Run HDTune to
  • check the health,
  • scan for errors, no quick scan but full scan
  • run a benchmark.
It may take some time, but please take the time you need to perform it properly.
When above is done please make screenshots of the following
  • the health,
  • the error scan,
  • the benchmark incl. following
    • transfer rate,
    • access time,
    • burst rate,
    • cpu usage.

Run SeaTools DOS to check the integrity of your HDD. SeaTools for DOS and Windows - How to Use - Windows 7 Help Forums
Run the long test.
Note   Note
Do not run SeaTools on an SSD as the results will be invalid.

Make a photo of the result and post it.

Run chkdsk
Disk Check - Windows 7 Help Forums
Use option TWO with parameter /r
Upload the chkdsk log Check Disk (chkdsk) - Read Event Viewer Log - Windows 7 Help Forums
My System SpecsSystem Spec
10 Jan 2018   #7
akfocus

Window 7 Pro x64
 
 

I have run the tests under HD Tune, and have attached the screen shots from that since they may tell you something while the other tests are in process. I ran the benchmark test 3 times, with somewhat different results (esp. for the first run).

I am presently doing a back up (lots of data on my 2 TB drive, long process), and the SeaTools test will take awhile to run. So it will be awhile before I have more to send.
My System SpecsSystem Spec
16 Jan 2018   #8
axe0

Windows 10 Pro
 
 

Hi akfocus,

How's the progress?
My System SpecsSystem Spec
16 Jan 2018   #9
akfocus

Window 7 Pro x64
 
 

I am unable to run the SeaTools test because it doesn't recognize my drive (even though it is a Seagate). I need to set the the BIOS to ATA/IDE for that, but my BIOS doesn't have a setting for doing that. ChkDsk finds no problems. As mentioned earlier, I had already run SpinRite (GRC), which does much the same as SeaTools. Like SeaTools it runs from a bootable disk. SpinRite ran for many hours (much longer than HDTune), deep testing one sector at a time. It can correct problems, but found none.

I continue to have BSODs, but haven't seen the NTFS.sys one again.
My System SpecsSystem Spec
17 Jan 2018   #10
axe0

Windows 10 Pro
 
 

If there are problems with SeaTools DOS, you could also run SeaTools for Windows.

Do you mean the final message with chkdsk or the actual report?
My System SpecsSystem Spec
Reply

 Frequent BSOD crashes, by process of elimination likely a driver




Thread Tools




Similar help and support threads
Thread Forum
Frequent BSOD (050,f7,fc,3b,1e), frequent service and chrome crashes
Dear Seven Forums, I'm looking for help regarding my pc that I built 3 months ago. I am having random crashes of all types: - 99% of the games crash to desktop after 10-15 minutes (Overwatch,Eu4,Hoi4, CIV V is OK,Witcher 3) - can't use chrome / firefox for more than 1-2 minutes because...
BSOD Help and Support
Frequent crashes after installing graphics driver.
Note: The system that I will be referring to in this thread is not the one listed in my profile, it is a much older system. I am currently using it because the system listed in my profile is being fixed after an unfortunate incident. But worry not, I shall be listing the specifications of this...
Graphic Cards
Frequent, Sporadic AMD Driver Crashes: Intel Z97, Win7 x64, R9 270X
I have been having issues with my AMD display driver crashing. Initially, I was convinced it was Google Chrome crashing it but, after problems continued when disabling hardware acceleration in Chrome or even when the process was not running, I decided it must be something else. I used DDU to...
Graphic Cards
Frequent BSOD Crashes
Hi there. I bought my system about 7 weeks ago and have had around 25 BSOD crashes since then. I have been searching the internet in an attempt to figure out what is causing this, which led me to this forum. I called the shop from which I bought the system, and the service department told me to run...
BSOD Help and Support
BSOD Crashes more frequent than I like
Hi Guys, My first post, so be gentle. Relatively new build has had more than a few bsod crashes....frequently when idle for 10min with no open programs. The new bsod that has arrived is during normal program use and is a Memory Management crash. Windows 7 Ultimate 64 bit That is...
BSOD Help and Support


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 19:40.
Twitter Facebook Google+