Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: BSODs too regular since updating to Win 7.

07 May 2010   #1
bilzmale

Win 7 Home Premium 64 bit
 
 
BSODs too regular since updating to Win 7.

Went from XP to 7 in January and have had numerous crashes since. Have made 2 fresh instals and 2 repair/upgrade instals but still crashing. The events seem random and log files are not helpful although Firefox, Thunderbird and Iolo System Shield crash but do not result in a BSOD.

Have run Seatools on the HDDs and they pass, Memtest86 and Ram passes, CPUStab Test and no errors. Have installed temp monitors and extra HDD fan and thet stay in the 40-50C range.

Unable to gain much from the dump files as I get Symbols errors (they are installed in C:\Symbols). The most common items mentioned are ntfs.sys in the blue screen and ntkrnlpa.exe in the dump files.

The most common situations where a crash occurs in rough order of frequency are:
1. Installing software
2. Processing images in PS CS4 or Faststone Image Viewer
3. Doing nothing in particular
4. While away from the PC.

I have attached most recent dump files - hope they tell someone more than they tell me .

Thanks (i'm new here)

Bill


My System SpecsSystem Spec
.
07 May 2010   #2
Jonathan_King

Windows 7 Professional x64
 
 

Welcome to SF!

It looks as if Acronis and Rollback Rx are causing the issue. Especially the latter, and that may be why ntfs.sys is blamed by Windbg.

Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Jonathan\AppData\Local\Temp\Temp1_Minidump.zip\050710-25022-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82e17000 PsLoadedModuleList = 0x82f5f810
Debug session time: Fri May  7 03:27:10.852 2010 (GMT-4)
System Uptime: 1 days 22:28:43.600
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
.......................
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001904fb
Arg2: be27b350
Arg3: be27af30
Arg4: 8b2187f5

Debugging Details:
------------------

Unable to load image \SystemRoot\system32\DRIVERS\amp.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for amp.sys
*** ERROR: Module load completed but symbols could not be loaded for amp.sys
*** WARNING: Unable to verify timestamp for Shieldf.sys
*** ERROR: Module load completed but symbols could not be loaded for Shieldf.sys
*** WARNING: Unable to verify timestamp for tdrpm258.sys
*** ERROR: Module load completed but symbols could not be loaded for tdrpm258.sys

EXCEPTION_RECORD:  be27b350 -- (.exr 0xffffffffbe27b350)
ExceptionAddress: 8b2187f5 (Ntfs!NtfsDecodeFileObject+0x00000039)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 0000000c
Attempt to read from address 0000000c

CONTEXT:  be27af30 -- (.cxr 0xffffffffbe27af30)
eax=be27b470 ebx=00000000 ecx=00000008 edx=be27b464 esi=be27b460 edi=00000000
eip=8b2187f5 esp=be27b418 ebp=be27b420 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
Ntfs!NtfsDecodeFileObject+0x39:
8b2187f5 8b5104          mov     edx,dword ptr [ecx+4] ds:0023:0000000c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  ZinioReader.ex

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  0000000c

READ_ADDRESS: GetPointerFromAddress: unable to read from 82f7f718
Unable to read MiSystemVaType memory at 82f5f160
 0000000c 

FOLLOWUP_IP: 
Ntfs!NtfsDecodeFileObject+39
8b2187f5 8b5104          mov     edx,dword ptr [ecx+4]

FAULTING_IP: 
Ntfs!NtfsDecodeFileObject+39
8b2187f5 8b5104          mov     edx,dword ptr [ecx+4]

BUGCHECK_STR:  0x24

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from 8b2a2ef1 to 8b2187f5

STACK_TEXT:  
be27b420 8b2a2ef1 be27b510 906a4260 be27b460 Ntfs!NtfsDecodeFileObject+0x39
be27b498 8b2a8a4d be27b510 ae713b78 35032e72 Ntfs!NtfsCommonQueryInformation+0x56
be27b4fc 8b2b6d53 be27b510 ae713b78 00000001 Ntfs!NtfsFsdDispatchSwitch+0x17b
be27b630 82e534bc 8695a020 ae713b78 ae713b78 Ntfs!NtfsFsdDispatchWait+0x1c
be27b648 8b12120c 00000000 82769508 00000000 nt!IofCallDriver+0x63
be27b66c 8b1220bf be27b68c 86946030 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
be27b6a4 8b136fc3 875c1a80 875c1a80 be27b700 fltmgr!FltPerformSynchronousIo+0xb9
be27b6b4 971eb7cc 875c1a80 82769508 be27b73c fltmgr!FltQueryInformationFile+0x4f
WARNING: Stack unwind information not available. Following frames may be wrong.
be27b700 971e2879 be27b854 be27b7c8 00000001 amp+0x117cc
be27b7fc 971ea826 be27b854 be27b834 00000000 amp+0x8879
be27b87c 8b11daeb 866e4e40 be27b89c be27b8c8 amp+0x10826
be27b8e8 8b1209f0 be27b92c ef636008 00000000 fltmgr!FltpPerformPreCallbacks+0x34d
be27b900 8b1341fe be27b92c 8b137f3c 00000000 fltmgr!FltpPassThroughInternal+0x40
be27b914 8b1348b7 be27b92c ef636008 86953248 fltmgr!FltpCreateInternal+0x24
be27b958 82e534bc 86946030 86959ae0 ef636300 fltmgr!FltpCreate+0x2c9
be27b970 8b184fba 86963890 ef636008 00000000 nt!IofCallDriver+0x63
be27b9c0 8b185198 86953190 ef636008 86963890 Shieldf+0x1fba
be27b9dc 82e534bc 86953190 ef636008 8b524628 Shieldf+0x2198
be27b9f4 8b52d1be 8b54e67c 86953190 ef636008 nt!IofCallDriver+0x63
be27ba88 8305766d 93ab422a be27bc30 00000000 tdrpm258+0xa1be
be27bb60 8303821f 861a0da8 853c9870 86fc3d20 nt!IopParseDevice+0xed7
be27bbdc 8305e28d 00000000 be27bc30 00000040 nt!ObpLookupObjectName+0x4fa
be27bc38 830565eb 0312e838 853c9870 9e565f01 nt!ObOpenObjectByName+0x159
be27bcb4 83061ef6 0312e894 80100080 0312e838 nt!IopCreateFile+0x673
be27bd00 82e5a44a 0312e894 80100080 0312e838 nt!NtCreateFile+0x34
be27bd00 778464f4 0312e894 80100080 0312e838 nt!KiFastCallEntry+0x12a
0312e89c 00000000 00000000 00000000 00000000 0x778464f4


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsDecodeFileObject+39

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bbf45

STACK_COMMAND:  .cxr 0xffffffffbe27af30 ; kb

FAILURE_BUCKET_ID:  0x24_Ntfs!NtfsDecodeFileObject+39

BUCKET_ID:  0x24_Ntfs!NtfsDecodeFileObject+39

Followup: MachineOwner
---------
I recommend uninstalling Rollback completely, and Acronis too, because it was found on the stack at the time of the crash.
My System SpecsSystem Spec
07 May 2010   #3
bilzmale

Win 7 Home Premium 64 bit
 
 

Thanks Jonathan but there must be something else going on. I was trialling RollbackRx as Windows Restore was not working. I uninstalled it well before these crashes. (see screenshot for files found).

I replaced Rollback with Acronis and it is currently installed but have only had it about a forthight. The instability dates back several months.

Over to you.

Bill
My System SpecsSystem Spec
.

07 May 2010   #4
zigzag3143

Win 8 Release candidate 8400
 
 

Quote   Quote: Originally Posted by bilzmale View Post
Went from XP to 7 in January and have had numerous crashes since. Have made 2 fresh instals and 2 repair/upgrade instals but still crashing. The events seem random and log files are not helpful although Firefox, Thunderbird and Iolo System Shield crash but do not result in a BSOD.

Have run Seatools on the HDDs and they pass, Memtest86 and Ram passes, CPUStab Test and no errors. Have installed temp monitors and extra HDD fan and thet stay in the 40-50C range.

Unable to gain much from the dump files as I get Symbols errors (they are installed in C:\Symbols). The most common items mentioned are ntfs.sys in the blue screen and ntkrnlpa.exe in the dump files.

The most common situations where a crash occurs in rough order of frequency are:
1. Installing software
2. Processing images in PS CS4 or Faststone Image Viewer
3. Doing nothing in particular
4. While away from the PC.

I have attached most recent dump files - hope they tell someone more than they tell me .

Thanks (i'm new here)

Bill

Bill

Jonathan_king is correct. The rollback drivers are still installed and loading. Besides that you have drivers from as far back as 2004. They by themselves could be casuing these.

Code:
ASACPI.sys        0x91559000    0x9155a420    0x00001420    0x411c2d04    8/12/2004 10:52:52 PM                        
ULCDRHlp.sys        0x915e8000    0x915eeb00    0x00006b00    0x41c9dd4d    12/22/2004 4:47:09 PM                        
dvd43llh.sys        0x915ef000    0x915f3980    0x00004980    0x4207b091    2/7/2005 2:16:49 PM                        
FileDisk.SYS        0x914c4000    0x914c6440    0x00002440    0x43cec168    1/18/2006 6:30:00 PM                        
PhysMem.sys        0x91502000    0x91502e00    0x00000e00    0x44e04ad5    8/14/2006 6:05:09 AM                        
secdrv.SYS        0xac8d6000    0xac8e0000    0x0000a000    0x45080528    9/13/2006 9:18:32 AM                        
elrawdsk.sys        0x914c7000    0x914ca600    0x00003600    0x488b65e1    7/26/2008 1:58:57 PM                        
adfs.SYS        0x9ae77000    0x9ae87e80    0x00010e80    0x48a447cb    8/14/2008 10:57:15 AM                        
nvm62x32.sys        0x91a1e000    0x91a72c80    0x00054c80    0x48f8fcf7    10/17/2008 5:00:39 PM
These need to be updated.


I also note that your ZinioReader is loaded in at least two of these crashes

Ken
My System SpecsSystem Spec
07 May 2010   #5
bilzmale

Win 7 Home Premium 64 bit
 
 

Thanks for that Ken. You are right about Zineo Reader. I was running beta 4 and it froze when I ran it today. Have uninstalled and gone back to ver 3.7.

I have Windows Update on automatic - how do I force an update on these old drivers?

OK did some more digging on those drivers.

ASACPI.sys
ASAS Motherboard

ULCDRHlp.sys Ulead CD Burner - will uninstall (or delete) as no longer use Ulead prog.

dvd43llh.sys DVD Copier - will uninstall and delete.

FileDisk.SYS Part of iolo System Mechanic which has a crash history. Possible incompatability with Prevx A/V also installed. Will uninstall Sys Mech.

PhysMem.sys Web search did not turn up anything??

secdrv.SYS Safe Disk CD protection - may be incompatilble with dvd43

elrawdsk.sys System Mechanic RAW Disk writer - sound suspicious to me.

adfs.SYS Web search did not turn up anything??

nvm62x32.sys nVidia motherboard (Ethernet driver perhaps??)
My System SpecsSystem Spec
07 May 2010   #6
Jonathan_King

Windows 7 Professional x64
 
 

I don't think Windows will automatically install driver updates, but you can check this setting if you're nervous.

Attachment 71521

Please be sure to upload any new dmp files.
My System SpecsSystem Spec
07 May 2010   #7
bilzmale

Win 7 Home Premium 64 bit
 
 

Jonathan I have uninstalled iolo System Mechanic and the PC seems more responsive when loading progs and surfing. Too bad I have 3 years of subscriptions!! Will look for updates to the Asus and nVidia drivers.

How can I identify the RollbackRx drivers that are still loading?

Bill
My System SpecsSystem Spec
08 May 2010   #8
zigzag3143

Win 8 Release candidate 8400
 
 

Quote   Quote: Originally Posted by bilzmale View Post
Jonathan I have uninstalled iolo System Mechanic and the PC seems more responsive when loading progs and surfing. Too bad I have 3 years of subscriptions!! Will look for updates to the Asus and nVidia drivers.

How can I identify the RollbackRx drivers that are still loading?

Bill
With the nvidia driver you need to completely un-install the current one (nvidia makes an uninstall tool) and then install the new version.


Let me find out about rollback drivers.

Ken

One thing you can do is search C:\windows\system32 (or 64) for the rollback driver that JK named. Shieldf.sys is the rollback driver being loaded, and it is 32 bit so should be in the 32 bit folder


I will examine the memory stack to see where it is loaded
My System SpecsSystem Spec
08 May 2010   #9
bilzmale

Win 7 Home Premium 64 bit
 
 

Found 4 drivers with same Modify date and time:- shield.sys; shieldf.sys; shieldm.sys and shdbus.sys

Are these doing any harm or am i just better without them?

Bill
My System SpecsSystem Spec
08 May 2010   #10
jcgriff2

Windows 7 - Vista
 
 

Quote   Quote: Originally Posted by bilzmale View Post
Found 4 drivers with same Modify date and time:- shield.sys; shieldf.sys; shieldm.sys and shdbus.sys

Are these doing any harm or am i just better without them?

Bill
They belong to Horizon Datasys, Inc., Rollback Rx

Is the app completely uninstalled?

Use Revo --> Download Revo Uninstaller Freeware - Free and Full Download

Be sure the asacpi.sys driver is updated - Asus mobo utility ATK0110 driver.

See SlideShow for download; however, please note the download in screen #4 is for Asus "Cool 'n' Quiet". Look in same area for ATK0110 AI Suite mobo driver.

SlideShow --> Asus mobo utility driver updates - Windows Live

Asus Drivers --> ASUSTeK Computer Inc.-Support-

Run Windows 7 Upgrade Advisor --> Windows 7 Upgrade Advisor

Regards. . .

jcgriff2

.
My System SpecsSystem Spec
Reply

 BSODs too regular since updating to Win 7.




Thread Tools




Similar help and support threads
Thread Forum
Regular BSODs
Hello I am getting a lot of BSOD's and would like someone with expertise to look at it for me. Hope someone can help. Thanks.
BSOD Help and Support
Regular BSODs, at least two a day
Hey guys, My PC (the one in the specs) is getting regular BSODs, the error codes haven't really been any use as they're all saying different things. I've tried the following things to try and fix the problem: Reinstall Windows 7 Remove the graphics card, made no difference Ran CHKDSK, came...
BSOD Help and Support
Regular BSODS - During regular use and gaming
Hi, im new here and have abit of a dilemma. I'm not much of a computer wiz so please bear with me, I've been recently getting BSODs following getting a new hard drive and a new case for my computer. The hard drive replacement and transferring of parts to the new case was done at a professional...
BSOD Help and Support
Regular BSODS
My laptop had been running windows 7 ultimate x64 for a while now without problems. But last month or so I get regular BSODS, all with different codes. BIOS updates and driver updates has not fixed the problem. Even updating Windows with SP1 didn't have the desired effect. Running Windows 7...
BSOD Help and Support
Regular BSODs 7f
Problem signature: Problem Event Name: BlueScreen OS Version: 6.1.7600.2.0.0.768.3 Locale ID: 3081 Additional information about the problem: BCCode: 7f BCP1: 0000000000000008 BCP2: 0000000080050031 BCP3: 00000000000406F8
BSOD Help and Support
Almost regular BSODs
Hi community, after looking for solutions on my own and searching the internet without result I hope you can help me somehow: Since I installed Windows 7 x64 on a new system (I had tried Vista x64 before but I don't like that OS), it keeps annoying me with random BSODs. Meanwhile, I have...
BSOD Help and Support


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 06:01.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App