Ntfs.sys BSOD

I keep getting a constant BSOD and after looking at the dmp file it keeps showing the same culprit... ntfs.sys+d7f5 and ntoskrnl.exe+68902... It seems to happen when I try to open certain programs, like itunes, winrar, etc... It never happens when I leave the computer alone... I am including a dmp file as an example, because all of them are basically the same ... I have a homebrew system with a AMD Phenom 2 cpu, 4 gigs of ram, a nvidia geforce 8800 gtx video card and a creative sound card. I appreciate all the help that I can get!

Thanks!

garmaiz

garmaiz said:

I keep getting a constant BSOD and after looking at the dmp file it keeps showing the same culprit... ntfs.sys+d7f5 and ntoskrnl.exe+68902... It seems to happen when I try to open certain programs, like itunes, winrar, etc... It never happens when I leave the computer alone... I am including a dmp file as an example, because all of them are basically the same ... I have a homebrew system with a AMD Phenom 2 cpu, 4 gigs of ram, a nvidia geforce 8800 gtx video card and a creative sound card. I appreciate all the help that I can get!

Thanks!

garmaiz

this crash was caused by memory corruption. I would test it by downloading memtestx86 and running for 5 passes.

Let us know the results
Ken

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\New folder (3)\032710-16504-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*F:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`0281f000 PsLoadedModuleList = 0xfffff800`02a5ce50
Debug session time: Sat Mar 27 23:55:00.129 2010 (GMT-4)
System Uptime: 0 days 0:44:02.159
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
.................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 86a97, 2, 84816}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000086a97, page frame number
Arg3: 0000000000000002, current page state
Arg4: 0000000000084816, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff8000291f32c to fffff80002890f00

STACK_TEXT:  
fffff880`0781e838 fffff800`0291f32c : 00000000`0000004e 00000000`00000099 00000000`00086a97 00000000`00000002 : nt!KeBugCheckEx
fffff880`0781e840 fffff800`02846209 : 00000000`00000000 fffff680`0006d678 00000000`00000000 00000000`000006f8 : nt!MiBadShareCount+0x4c
fffff880`0781e880 fffff800`028c1b51 : 00000000`00000000 fffff680`0006dff8 fffffa80`03fc7b30 00000000`00000050 : nt! ?? ::FNODOBFM::`string'+0x31f53
fffff880`0781ea30 fffff800`028d2c4a : 00000000`00000000 00000000`0dda4fff fffffa80`00000000 fffffa80`03fc7b30 : nt!MiDeleteVirtualAddresses+0x408
fffff880`0781ebf0 fffff800`02890153 : ffffffff`ffffffff 00000000`0769e640 00000000`0769e608 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`0781ece0 00000000`7750009a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0769e578 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7750009a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`0291f32c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

thank you for your response! I will do that and post the results later today.

so this is what i get after trying to run memtestx86: if i select the one cpu option it runs for 10 seconds and then the system restarts. If i select the multiple cpu option then it enters the program and it seems stuck on the first test without any progress being made... Hope that helps!

any thoughts?

please help!

garmaiz said:

so this is what i get after trying to run memtestx86: if i select the one cpu option it runs for 10 seconds and then the system restarts. If i select the multiple cpu option then it enters the program and it seems stuck on the first test without any progress being made... Hope that helps!

If you cant complete the memtest there is either a problem with the ram or the mobo. I would try running memtest with just one stick. Keep changing sticks untill yuo find the one that is giving you grief.

Ken