Random BSODs and applications crashes on a fresh Win7 install

[R4ndom]

Hi all, I can't be more specific as far as the title is concerned, for the simple reason that I can't get my PC to boot,,, thus can't upload dump files and give error number as suggested. I'll try nevertheless describe the symptoms as acurately as possible and recover dump files by connecting the disk to another computer. So there we go: a few days ago I installed Win 7 Home Premium on a brand new platform. The config is the following:

CPU: FX-4100 MB : Asus M5A78L/USB3
Mem: OCZ 4096MB 1600MHz Reaper LV CL8 (2x2048)
PSU: Zalman 500-ST 80 (PSU specs here ::: Zalman, leading the world of Quiet Computing Solutions :::)
Gfx: Evga Gtx 550 Ti
HDD:500GB Samsung HD502HJ
Sound: On-board Realtek
LAN: On-board Realtek

All good so far, apart from the fact that soon after the fresh install I got the 1st BSOD. I updated the MB Bios as the latest one was supposed to improve stability. No change, random BSODs again. In the meantime I installed ATIH 2012, and having read numerous posts about its bugginess and faulty drivers, I thought I had found the culprit, as having run the "Who crashed" app it pointed me to some ATIH driver, namely tdrpman.sys. I uninstalled ATIH, ran their cleanup utility, but there were still residues on my computer.

So I decided to reformat the freshly installed system, this time without ATIH. "Normal" format was not sufficient, I had to do a "full" format from command line to be able to start reinstalling windows. One weird thing though: after finishing the format, I pressed enter to confirm that I don't want to name the volume at that point, and immediately after that I got blue screen, computer rebooted, but I could proceed with Windows installation. I installed all the Windows Update patches, chipset, LAN, audio and video drivers, MSE and a couple of programmes.

It was ok for some time (1 day maybe) until I got another BSOD. I started thinking this could be hardware related, so I checked memories with memtest - 5 hours test showed no errors. Checking HDD neither, HDD Scan reported no bad sectors. CPU and mems tested again with OCCT, without any issues or crashes. Temperatures were a little to high maybe, but during normal operation they never go above 40-45. Disks around 30max and GPU 50-60. App crashes happen without any visible pattern. Nvidia drivers (once only though), skype, firefox, IE, windows explorer, recently it crashed starcraft and as a result install files got corrupted, which couldn't be repaired by blizzard tool. Same happend to files already on the hard drive, when I tried to open some installs I had downloaded previously, they would report that they were corrupted - this is the case of Avira, which I had to download 5 or 6 times (thinking this could be MSE issue and wanting to try another AV).

Finally, after reading some posts here, I started driver verifier, chose standard mode and set it to check all the drivers on the computer. It prompted me to reboot in order to save the changes, and, after the reboot, Windows wouldn't even get to the logon screen, but BSOD just before. It wouldn't even boot into safe mode, giving a message about RPC not being available, the screen would stay black with safe mode headers in the corners and that's it.

So there it is, sorry not to be able to attach dumps at this point, but as you've just read above, at this point I'm not able to boot the PC. Hopefully you can already come up with some ideas, as I've totally ran out of them.

Thanks for sharing your knowledge and sorry for posting in a wrong section, could I ask a mod please to move it to the appropriate section? Thanks!

 

[Solidwave]

You mentioned in your third paragraph that you had a BSOD after you had booted from the Win install DVD and were formatting the hard drive. BSODs at this stage mean you have either a hardware problem or some unfortunate incompatibility between Windows and your hardware. It also sounds like you have an intermittent problem and those are a pain to diagnose.

At this point, it smells like a bad hard drive given that you had a BSOD after formatting the drive and have had file corruption since then. It's hard--but not impossible--to get file corruption involving files already on the disk from other causes.

Do you have a spare hard drive you can test with? If not, can you disconnect the HD and boot from a Linux Live CD (or bootable USB) and run the computer for a few days as a test? If Linux doesn't have a kernel panic (Linux equivalent of a BSOD) during a few days of testing, you can be somewhat confident that the rest of your hardware is OK.

The second thing I'd suspect after the HDD is your power supply.

It wouldn't hurt to check your PSU voltages and clock speed settings in the BIOS.

 

[Julian Strange]

Finally, after reading some posts here, I started driver verifier, chose standard mode and set it to check all the drivers on the computer.

Which is probably your problem. You should choose all drivers NOT by Microsoft.

Insert your Win7 disk and from the options select Repair. Then command prompt. In command prompt enter verifier /reset

If that doen't help you'll probably have to go the same route again to see if you can delete two registry entries as detailed here: http://www.sevenforums.com/crash-lo...ifier-identify-issues-drivers.html#post581811

 

[R4ndom]

Hi Solidwave and Julian, thanks for your advice. I'll reply to both of you concerning matters you raised:

Indeed, I got a BSOD upon completion of the format. But if the HDD was to be the culprit, why HDD scan showed no errors/bad sectors? On the other hand, yesterday, while running chkdisk I also got a BSOD, or actually it didn't even start scanning, just rebooted before it... Unfortunately I have no other HDD to swap with this one, so I suppose Linux Live CD remains my only option.

The PSU had been functioning without issues with my previous rig, much less power consuming, this is true, but the current one shouldn't be a problem either, as I calculated some 150W power security marge.

I will have a look at PSU voltages and clocks in the BIOS ***Note: system IS NOT overclocked

If I manage to get to windows by repairing it (already tried that yesterday, but without success, I'll repeat the procedure). Then I'll reset the driver verifier and choose drivers not by Microsoft.

Hopefully I will also be able to upload BSOD dumps....

Thanks to the mod for moving the thread.

 

[R4ndom]

Update:
I tried reverting windows to an earlier point in time - it failed, giving a BSOD.
I then run the repair which came up with a message "could not automatically solve the problem"
I ran now memory tests again - this time with windows tool and left it for a couple of hours to see what it gives.
Later I'll try to reset as suggested the verifier tool, as well as check BIOS for voltages and clocks.
And if I manage to boot to windows, I'll try to apply steps as described here

 

[R4ndom]

Windows tool for memory testing showed no errors after 56 passes completed.

Temperatures CPU 43C (have just one probe on my MB) MB temp 28C

Vcore 1.44V
3.3V voltage 3.304V
5v voltage 5.07V
12v voltage 11.951V

I managed to boot in safe mode, reset the verifier tool and copied dumps onto a usb drive.

And then, as if during the past few days Armageddon didn't happen, after reboot, I managed to get to normal mode.

I ran the recommended utilites and attach results; they include only the latest dumps, from yesterday those from 4.01 as well as 6.01 aren't there due to subsequent hdisk reformat. I have them in raw form in case they were needed.

Just one issue, reports are not in EN, obviously will help with translation if needed.

Another strange thing: System health report reports that AV is not present, but Windows control centre shows its as active and the umbrella is open - realtime protection active. I don't get alerts in the tray.

Thanks again for help.

Edit: Exiting a programme a while ago with "your installation files are damaged"

 

[writhziden]

Glad to see you got the system to startup again by following the instructions to turn off Verifier. I will take a look at your minidumps.

 

[writhziden]

[list=1]
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\R4ndom\Windows_NT6_BSOD_jcgriff2\010912-19952-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e04000 PsLoadedModuleList = 0xfffff800`03049670
Debug session time: Mon Jan  9 11:42:47.193 2012 (UTC - 7:00)
System Uptime: 0 days 7:15:06.365
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, 109b, 310033, fffff8a006f92620}

GetPointerFromAddress: unable to read from fffff800030b3100
Probably caused by : ntkrnlmp.exe ( nt!HvFreeHive+24b )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 000000000000109b, (reserved)
Arg3: 0000000000310033, Memory contents of the pool block
Arg4: fffff8a006f92620, Address of the block of pool being deallocated

Debugging Details:
------------------


POOL_ADDRESS:  fffff8a006f92620 

FREED_POOL_TAG:  NtFs

BUGCHECK_STR:  0xc2_7_NtFs

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  TrustedInstall

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002faebe9 to fffff80002e80c40

STACK_TEXT:  
fffff880`09f587b8 fffff800`02faebe9 : 00000000`000000c2 00000000`00000007 00000000`0000109b 00000000`00310033 : nt!KeBugCheckEx
fffff880`09f587c0 fffff800`03104e7f : fffff8a0`02e050e0 00000000`01408000 fffff8a0`20374d43 00000000`00000633 : nt!ExDeferredFreePool+0x1201
fffff880`09f58870 fffff800`031044d0 : fffff8a0`00000000 fffff880`09f58901 fffff8a0`00000001 fffff880`029d5000 : nt!HvFreeHive+0x24b
fffff880`09f588f0 fffff800`03104199 : fffff8a0`0247dfa0 fffff880`09f58b60 00000000`00000000 00000000`00000006 : nt!CmUnloadKey+0x190
fffff880`09f58930 fffff800`02e7fed3 : fffffa80`03c17b60 000007fe`ff113110 00000000`00000001 00000000`00000001 : nt!NtUnloadKey2+0x4e4
fffff880`09f58ae0 00000000`771b2b9a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00f8f788 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771b2b9a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!HvFreeHive+24b
fffff800`03104e7f 4533f6          xor     r14d,r14d

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!HvFreeHive+24b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0xc2_7_NtFs_nt!HvFreeHive+24b

BUCKET_ID:  X64_0xc2_7_NtFs_nt!HvFreeHive+24b

Followup: MachineOwner
---------

[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\R4ndom\Windows_NT6_BSOD_jcgriff2\010912-17721-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e4a000 PsLoadedModuleList = 0xfffff800`0308f670
Debug session time: Mon Jan  9 11:59:08.958 2012 (UTC - 7:00)
System Uptime: 0 days 0:11:05.535
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800317e618, fffff8800317de70, fffff80002ed919a}

Probably caused by : Ntfs.sys ( Ntfs!NtfsTeardownFromLcb+fb )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800317e618
Arg3: fffff8800317de70
Arg4: fffff80002ed919a

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800317e618 -- (.exr 0xfffff8800317e618)
ExceptionAddress: fffff80002ed919a (nt!ExAcquireFastMutex+0x000000000000001a)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8800317de70 -- (.cxr 0xfffff8800317de70)
rax=0000000000000001 rbx=6e664d460041031c rcx=6e664d460041031c
rdx=fffffa8003ad5b60 rsi=fffff8800317ea01 rdi=0000000000000000
rip=fffff80002ed919a rsp=fffff8800317e850 rbp=fffff80003067260
 r8=0000000000000000  r9=0000000000000000 r10=fffff80002e4a000
r11=fffff8800317e850 r12=fffff8a007f2a010 r13=fffff8a008256bc0
r14=fffff8a007f2a300 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!ExAcquireFastMutex+0x1a:
fffff800`02ed919a f00fba3100      lock btr dword ptr [rcx],0 ds:002b:6e664d46`0041031c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  1

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030f9100
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsTeardownFromLcb+fb
fffff880`0102c88b 83bfc000000000  cmp     dword ptr [rdi+0C0h],0

FAULTING_IP: 
nt!ExAcquireFastMutex+1a
fffff800`02ed919a f00fba3100      lock btr dword ptr [rcx],0

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff8800102c88b to fffff80002ed919a

STACK_TEXT:  
fffff880`0317e850 fffff880`0102c88b : fffff8a0`07f2a010 fffff800`03067260 fffff880`0317ea01 fffff880`010b4cc1 : nt!ExAcquireFastMutex+0x1a
fffff880`0317e880 fffff880`010b263c : fffffa80`03bfb770 fffffa80`0498a180 fffff8a0`07f2a010 fffff8a0`07f2a3a8 : Ntfs!NtfsTeardownFromLcb+0xfb
fffff880`0317e910 fffff880`010340e2 : fffffa80`03bfb770 fffffa80`03bfb770 fffff8a0`07f2a010 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xcc
fffff880`0317e990 fffff880`010c2193 : fffffa80`03bfb770 fffff800`03067260 fffff8a0`07f2a010 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`0317e9d0 fffff880`010b1357 : fffffa80`03bfb770 fffff8a0`07f2a140 fffff8a0`07f2a010 fffffa80`0498a180 : Ntfs!NtfsCommonClose+0x353
fffff880`0317eaa0 fffff800`02ed1001 : 00000000`00000000 fffff800`031bd900 fffffa80`03ad5b01 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`0317eb70 fffff800`03161fee : 00000000`00000000 fffffa80`03ad5b60 00000000`00000080 fffffa80`039a4040 : nt!ExpWorkerThread+0x111
fffff880`0317ec00 fffff800`02eb85e6 : fffff880`02f64180 fffffa80`03ad5b60 fffff880`02f6efc0 00010000`01000001 : nt!PspSystemThreadStartup+0x5a
fffff880`0317ec40 00000000`00000000 : fffff880`0317f000 fffff880`03179000 fffff880`0317e8a0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  Ntfs!NtfsTeardownFromLcb+fb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

STACK_COMMAND:  .cxr 0xfffff8800317de70 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsTeardownFromLcb+fb

BUCKET_ID:  X64_0x24_Ntfs!NtfsTeardownFromLcb+fb

Followup: MachineOwner
---------

[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\R4ndom\Windows_NT6_BSOD_jcgriff2\010912-16317-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e4b000 PsLoadedModuleList = 0xfffff800`03090670
Debug session time: Mon Jan  9 12:30:10.220 2012 (UTC - 7:00)
System Uptime: 0 days 0:30:24.780
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 233cb, 2, 670a3}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000233cb, page frame number
Arg3: 0000000000000002, current page state
Arg4: 00000000000670a3, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  SC2.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002f50d7c to fffff80002ec7c40

STACK_TEXT:  
fffff880`07b61c38 fffff800`02f50d7c : 00000000`0000004e 00000000`00000099 00000000`000233cb 00000000`00000002 : nt!KeBugCheckEx
fffff880`07b61c40 fffff800`02e6f3d7 : 00000000`00000000 fffff680`00180038 00000000`00000000 fffff700`012e7ff8 : nt!MiBadShareCount+0x4c
fffff880`07b61c80 fffff800`02ef9bb7 : 00000000`00000000 fffff680`00180df8 fffffa80`0446c5e0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x3309d
fffff880`07b61e30 fffff800`02eb50ff : fffffa80`00000000 00000000`301bffff 00000000`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x41f
fffff880`07b61ff0 fffff800`02ec6ed3 : ffffffff`ffffffff fffff8a0`0a3e4268 fffff8a0`0a3e4290 fffffa80`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`07b620f0 fffff800`02ec3470 : fffff880`11da94b2 fffff8a0`07599930 fffffa80`0446c5e0 fffffa80`04083db0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`07b62288 fffff880`11da94b2 : fffff8a0`07599930 fffffa80`0446c5e0 fffffa80`04083db0 fffff8a0`0a3e4260 : nt!KiServiceLinkage
fffff880`07b62290 fffff880`11d94b5a : fffff880`07b622b8 fffff8a0`08ca3ac0 00000000`00000001 00000000`00000000 : dxgmms1!VIDMM_PROCESS_HEAP::Free+0xa2
fffff880`07b622c0 fffff880`11d8f523 : fffffa80`063c5010 00000000`00000000 fffff8a0`07599930 00000000`00000000 : dxgmms1!VIDMM_GLOBAL::CloseLocalAllocation+0x112
fffff880`07b62370 fffff880`11d75ecc : fffff8a0`00000000 fffffa80`00000000 00000000`00000000 00000000`00000000 : dxgmms1!VIDMM_GLOBAL::CloseOneAllocation+0x19b
fffff880`07b62440 fffff880`11037ccc : 00000000`00000000 fffff8a0`015fc000 fffff8a0`015fc000 00000000`00000001 : dxgmms1!VidMmCloseAllocation+0x44
fffff880`07b62470 fffff880`1104a784 : 00000000`00000001 00000000`00000000 00000000`00000000 fffff8a0`00000799 : dxgkrnl!DXGDEVICE::DestroyAllocations+0x248
fffff880`07b62560 fffff880`1102f815 : 00000000`fffffeda fffff8a0`079d10e0 fffff8a0`015fc000 fffffa80`05c5c000 : dxgkrnl!DXGDEVICE::~DXGDEVICE+0x19c
fffff880`07b625d0 fffff880`1106de4a : 00000000`00000010 fffffa80`05c5c000 fffff8a0`079d10e0 fffff8a0`079d1160 : dxgkrnl!DXGADAPTER::DestroyDevice+0x1c9
fffff880`07b62600 fffff880`1106d7e0 : fffff900`c077cce0 00000000`00000000 00000000`00000001 fffff900`c077cce0 : dxgkrnl!DXGPROCESS::Destroy+0xba
fffff880`07b626b0 fffff960`00165ec4 : 00000000`000001b0 fffff900`c077cce0 00000000`00000000 fffff900`c077cce0 : dxgkrnl!DxgkProcessCallout+0x268
fffff880`07b62740 fffff960`001655af : 00000000`00000000 fffff880`07b62ae0 fffffa80`0442bb60 00000000`00000000 : win32k!GdiProcessCallout+0x244
fffff880`07b627c0 fffff800`0319da81 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`0442bb00 : win32k!W32pProcessCallout+0x6b
fffff880`07b627f0 fffff800`0318109d : 00000000`20010000 00000000`20010001 fffffa80`78457300 fffffa80`05eecb60 : nt!PspExitThread+0x4d1
fffff880`07b628f0 fffff800`02ebb3fa : 00000000`00000100 fffffa80`0442bc20 00000000`00000001 fffff800`02ecd13d : nt!PsExitSpecialApc+0x1d
fffff880`07b62920 fffff800`02ebb740 : 00000000`00000246 fffff880`07b629a0 fffff800`03181010 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`07b629a0 fffff800`02ec6f77 : fffffa80`0442bb60 00000000`0000041c 00000000`00000000 fffffa80`04626ee0 : nt!KiInitiateUserApc+0x70
fffff880`07b62ae0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`02f50d7c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\R4ndom\Windows_NT6_BSOD_jcgriff2\010912-23493-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e5b000 PsLoadedModuleList = 0xfffff800`030a0670
Debug session time: Mon Jan  9 12:37:21.523 2012 (UTC - 7:00)
System Uptime: 0 days 0:06:37.100
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {31, fffffa8003ba3500, fffff88005550000, fffff8a0070d0afd}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+7271 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000031, The subtype of the bugcheck.
Arg2: fffffa8003ba3500
Arg3: fffff88005550000
Arg4: fffff8a0070d0afd

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_31

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003134b25 to fffff80002ed7c40

STACK_TEXT:  
fffff880`093f1398 fffff800`03134b25 : 00000000`0000001a 00000000`00000031 fffffa80`03ba3500 fffff880`05550000 : nt!KeBugCheckEx
fffff880`093f13a0 fffff800`031afc37 : 00000000`00000000 fffffa80`03d3e660 00000000`0000002d fffff8a0`070d0580 : nt! ?? ::NNGAKEGL::`string'+0x7271
fffff880`093f1400 fffff800`02f076eb : ffffffff`ffffffff fffff880`093f1570 00000000`00001800 00000000`00000000 : nt!MiRelocateImagePfn+0xf7
fffff880`093f1460 fffff800`02e72b64 : fffffa80`04be9ad0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiWaitForInPageComplete+0x7ef
fffff880`093f1540 fffff800`03131e7a : 00000000`00000000 fffffa80`061d2900 00000000`00000001 fffffa80`061d2900 : nt!MiPfCompletePrefetchIos+0x54
fffff880`093f1570 fffff800`0333504d : 00000000`00000005 00000000`00000005 fffffa80`061d2900 fffff880`093f1638 : nt!MmPrefetchPages+0x13a
fffff880`093f15d0 fffff800`0333d06e : fffff8a0`00000000 fffff8a0`00000000 fffff8a0`000001af 00000000`00000000 : nt!PfpPrefetchFilesTrickle+0x21d
fffff880`093f16d0 fffff800`0333dc07 : 00000000`00000000 fffff880`093f1b60 fffff880`093f18c8 fffff8a0`01a956c0 : nt!PfpPrefetchRequestPerform+0x30e
fffff880`093f1820 fffff800`0334a1de : fffff880`093f18c8 00000000`00000001 fffffa80`064f2240 00000000`00000000 : nt!PfpPrefetchRequest+0x176
fffff880`093f1890 fffff800`0334ea0a : 00000000`00000000 00000000`0000004f 00000000`00000000 fffffa80`063b7b01 : nt!PfSetSuperfetchInformation+0x1ad
fffff880`093f1970 fffff800`02ed6ed3 : fffffa80`03d3e660 00000000`00000000 00000000`00000001 00000000`00000001 : nt!NtSetSystemInformation+0xc8d
fffff880`093f1ae0 00000000`77c72a0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00cef668 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c72a0a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::NNGAKEGL::`string'+7271
fffff800`03134b25 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::NNGAKEGL::`string'+7271

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x1a_31_nt!_??_::NNGAKEGL::_string_+7271

BUCKET_ID:  X64_0x1a_31_nt!_??_::NNGAKEGL::_string_+7271

Followup: MachineOwner
---------

[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\R4ndom\Windows_NT6_BSOD_jcgriff2\010912-18252-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e52000 PsLoadedModuleList = 0xfffff800`03097670
Debug session time: Mon Jan  9 14:54:22.826 2012 (UTC - 7:00)
System Uptime: 0 days 0:24:34.387
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800b4b7b18, fffff8800b4b7370, fffff8800104f8ad}

Probably caused by : Ntfs.sys ( Ntfs!NtfsAcquireFcbWithPaging+12d )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800b4b7b18
Arg3: fffff8800b4b7370
Arg4: fffff8800104f8ad

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800b4b7b18 -- (.exr 0xfffff8800b4b7b18)
ExceptionAddress: fffff8800104f8ad (Ntfs!NtfsAcquireFcbWithPaging+0x000000000000012d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8800b4b7370 -- (.cxr 0xfffff8800b4b7370)
rax=0000000000000000 rbx=0000000000000003 rcx=01ca044465b3f749
rdx=0000000000000000 rsi=0000000000000002 rdi=fffffa8003fe32b0
rip=fffff8800104f8ad rsp=fffff8800b4b7d50 rbp=0000000000000002
 r8=0000000000000702  r9=0000000000000002 r10=fffffa8003fe32b0
r11=fffff8a002d00172 r12=fffff8a00c75e5c0 r13=00000000c00000d8
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010287
Ntfs!NtfsAcquireFcbWithPaging+0x12d:
fffff880`0104f8ad 488b4958        mov     rcx,qword ptr [rcx+58h] ds:002b:01ca0444`65b3f7a1=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  rstrui.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003101100
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsAcquireFcbWithPaging+12d
fffff880`0104f8ad 488b4958        mov     rcx,qword ptr [rcx+58h]

FAULTING_IP: 
Ntfs!NtfsAcquireFcbWithPaging+12d
fffff880`0104f8ad 488b4958        mov     rcx,qword ptr [rcx+58h]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff880010ea777 to fffff8800104f8ad

STACK_TEXT:  
fffff880`0b4b7d50 fffff880`010ea777 : 00000000`00000000 fffff8a0`0c75ea00 fffff8a0`02d0022c 00000000`00000000 : Ntfs!NtfsAcquireFcbWithPaging+0x12d
fffff880`0b4b7db0 fffff880`010e8fd2 : fffffa80`03fe32b0 fffffa80`0495b350 fffff8a0`00157bc0 00000000`00000701 : Ntfs!NtfsFindPrefixHashEntry+0x44e
fffff880`0b4b7ee0 fffff880`010e6911 : fffffa80`03fe32b0 fffffa80`04285c10 fffff880`0b4b80b0 fffff880`0b4b8100 : Ntfs!NtfsFindStartingNode+0x452
fffff880`0b4b7fb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreate+0x3e1


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsAcquireFcbWithPaging+12d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

STACK_COMMAND:  .cxr 0xfffff8800b4b7370 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsAcquireFcbWithPaging+12d

BUCKET_ID:  X64_0x24_Ntfs!NtfsAcquireFcbWithPaging+12d

Followup: MachineOwner
---------


[/list]

Start by running a http://www.sevenforums.com/tutorials/433-disk-check.html with both boxes checked.

Tonight, an hour before bed, run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. This is in case Windows memory diagnostics missed anything. Check it just before you go to sleep to make sure there are no errors and it is still running. Then let it run overnight. Post back your results.

 

[R4ndom]

Thanks writhziden for having a look at the dumps. So you see nothing driver-related there, a hardware issue being more probable?

I will re-run the memtest86+ tests as suggested as well as chkdisk following your links.

As for chkdisk, shall I check all the three partitions that I have, or just the system one?

Thanks, will post results tomorrow, as I didn't read your message last night

 

[writhziden]

Thanks writhziden for having a look at the dumps. So you see nothing driver-related there, a hardware issue being more probable?

I will re-run the memtest86+ tests as suggested as well as chkdisk following your links.

As for chkdisk, shall I check all the three partitions that I have, or just the system one?

Thanks, will post results tomorrow, as I didn't read your message last night

No regular drivers showed up; all faults were blamed on system drivers, and the ones you received were hard disk related which usually means a hard disk with file corruption or bad sectors. There are other possible causes, but we should rule that one out first.

Run disk check on all drives that have the Windows folder, a Program Files folder, or a Users folder on them. Any drives containing the Windows layout, basically.

 

[R4ndom]

Ran on partition D: so far (programmes installed directly in d: root folder, instead of Program Files as by default) and c: as well.

The problem was the C: partition as I couldn't ran chdkisk in windows, because the drive is locked, I chose the option to do it at the next reboot, rebooted and left it run.

The issue was though that this way I couldn't really check what actually happened. After searching I found out that logs are possible to find in the event viewer thanks to http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html

D: scan was without problems, 0 bad sectors or errors of the file system.

C: scan - I will have to translate it to EN, which will take some time

E: scan - in progress

Thanks again writhziden for your time.

 

[writhziden]

Ran on partition D: so far (programmes installed directly in d: root folder, instead of Program Files as by default) and c: as well.

The problem is the C: partition as I cannot do it in windows, because the drive is locked, so I chose the option to do it at the next reboot, rebooted and left it run.

The issue is though that this way I cannot really check what actually happened. After googling I found out that logs are possible to find in the event viewer following the last post from this thread [Solved] Win7 chkdsk log file location - config-customize - windows-7 but I can only see the results of D: scan in my logs, which was without problems, 0 bad sectors or errors of the file system.

Nothing was logged about the C: system drive and as I wasn't in front of the computer when it rebooted (or crashed, as I described before during chkdisk) I cannot tell whether something was repaired, or if everything was ok. I read that when ran on corrupted disks, the logs are not written.... so is my only solution to stay in front of the screen all the time as it scans c: and wait for a report or BSOD?

Thanks!

Edit: I found the C: log as well, under winninit entry in the same location, I simply started searching by time stamp following the D: disk check, as I ran the C: check immediately after. From the log results for me that Windows adjusted some big files records, I will proceed to the scanning of the last partition and will post full results for all the 3 partitions.

Alright, sounds good. For anyone having similar problems who stumble into this thread, you can get the disk check logs using the following tutorial. http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html

Thanks for posting back that you found them and will post them. I'll let you know what I recommend next once I read through them.

 

[R4ndom]

Hello

Here are the (not-google) translated logs from the 3 partitions. I run chkdisk on C: twice. Do you see anything abnormal apart from disk C:? Strange that no errors showed on D: while Starcraft is installed precisely there and it had reported corrupted installation files, which was unable to repair. Anyway, in your opinion, should the drive be RMA or can it be trusted? I always thought that only bad sectors could cause such mayhem.

Would you think useful uploading previous dumps (from 5-7 days ago), or there's no more sense in analyzing them? Would you still recommend testing memories overnight? Where all these corrupted file system problems could actually have come from in a 2-days fresh OS?

Thanks a bunch for your help!

[B]PARTITION C: 1st pass[/B]

Log name:Application
Source:        Microsoft-Windows-Wininit
Date:          2012-01-11 13:44:51
Event ID:1001
Event Category: N/A
Stage/Level:        Information
Keywords: Classic
User:    N/A
Computer:      FX-4100
Description:


Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.                         

CHKDSK is veryfing files (stage 1 of 5)
  File records processed: 108544.                                   

File verification completed.
  Large file records processed: 139.                            

  Damaged file records processed: 0.                      

  EA records processed: 0.                  

  Reparse records processed: 64.                         

CHKDSK is veryfing indexes (stage 2 of 5)
  Index entries processed: 155546.                                    

Index verification completed.
  Unindexed files scanned: 0.                            

  Unindexed files recovered: 0.                                

CHKDSK is veryfing security descriptors/file IDs (stage 3 of 5)
  SDs/SIDs file processed: 108544.   

Cleaning up 232 index entries from index $SII of file 0x9.
Cleaning up 146 entries from index $SDH of file 0x9.
Cleaning up 146 unused security descriptors.
Security descriptors verification complete.
  Data files processed: 23502.                                     
Veryfing USN log...

  USN numbers bytes processed: 35380592.                                
Checking usn log ***integrity***? completed.

CHKDSK is veryfing file data (stage 4 of 5)
  Files processed: 108528.                                            

Checking file data completed.
CHKDSK is veryfing free space (stage 5 of 5)
  Free clusters processed: 10404672.                                        

Free space verification completed.
CHKDSK has detected unallocated space marked as allocated in the main
bitmap of the MFT (Main File Table??) - hope I got the translation correctly
Windows applied corrections to the file system.

  67379199 KB total disk space.
  25487992 KB in 84775 files.
     60832 KB in 23503 indexes.
         0 KB in bad sectors.
    211687 KB in use by the system.
     65536 KB occupied by the log file.
  41618688 KB available on disk.

      4096 bytes in each allocation unit.
  16844799 total allocation units on disk.
  10404672 allocation units available on disk.

Internal information:
00 a8 01 00 02 a7 01 00 be 3d 03 00 00 00 00 00  .........=......
b2 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00  ....@...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Windows has completed disk check.
Wait for the system to restart.

XML event code:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-01-11T12:44:51.000000000Z" />
    <EventRecordID>1419</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>FX-4100</Computer>
    <Security />
  </System>
  <EventData>
    <Data>

[B]Partition C: 2nd pass

[/B]Log name:Application
Source:        Microsoft-Windows-Wininit
Date:          2012-01-11 18:50:07
Event ID:1001
Event Category: N/A
Stage/Level:        Information
Keywords: Classic
User:    N/A
Computer:      FX-4100
Description:


Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.                         

CHKDSK is veryfing files (stage 1 of 5)
  File records processed: 108544.                                   

File verification completed.
  Large file records processed: 138.  .                            

  Damaged file records processed: 0.                      

  EA records processed: 0.                  

  Reparse records processed: 64.                         

CHKDSK is veryfing indexes (stage 2 of 5)
  Index entries processed: 155544.                                    

Index verification completed.

  Unindexed files scanned: 0.                            

  Unindexed files recovered: 0.                                

CHKDSK is veryfing security descriptors/file IDs (stage 3 of 5)
   SDs/SIDs file processed: 108544.   

Cleaning up 2 index entries from index $SII of file 0x9.
Cleaning up 2 entries from index $SDH of file 0x9.
Cleaning up 2 unused security descriptors.
Security descriptors verification complete.
  Data files processed: 23501.                                     
Veryfing USN log...

  USN numbers bytes processed: 35676496.                                

Checking usn log ***integrity***? completed.
CHKDSK is veryfing file data (stage 4 of 5)
  Files processed: 108528.                                            

Checking file data completed.
CHKDSK is veryfing free space (stage 5 of 5)
  Free clusters processed: 10406483.                                        

Free space verification completed..
Windows has verified the file system and didn't find any problems.

  67379199 KB total disk space.
  25480228 KB in 84759 files.
     60840 KB in 23502 indexes.
         0 KB in bad sectors.
    212199 KB in use by the system.
     65536 KB occupied by the log file.
  41625932 KB available on disk.

      4096 bytes in each allocation unit.
  16844799 total allocation units on disk.
  10406483 allocation units available on disk.

Internal information:
00 a8 01 00 f1 a6 01 00 99 3d 03 00 00 00 00 00  .........=......
b2 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00  ....@...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Windows has completed disk check.
Wait for the system to restart.

Kod XML zdarzenia:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-01-11T17:50:07.000000000Z" />
    <EventRecordID>1466</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>FX-4100</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
</Data>
  </EventData>
</Event>

[B]Partition D:

[/B]Log name:Application
Source:        Chkdsk
Dat:          2012-01-11 13:06:41
Event ID:26214
Event Category: N/A
Stage/Level:        Information
Keywords: Classic
User:    N/A
Computer:      FX-4100
Description:
Chkdsk has been launched in read/write mode.  

Checking file system on D:
Volume has been unmounted. All open entries to this volume are now invalid/incorrect.
Volume name: Programmes.

CHKDSK is veryfing files (stage 1 of 5)
  File records processed: 21504.                                   

File verification completed.
  Large file records processed: 1.                            

  Damaged file records processed: 0                            

  Bad file records processed: 0.                      

  EA records processed: 0.                                

CHKDSK is veryfing indexes (stage 2 of 5)
  Index entries processed: 23914.                                    

Index verification completed.


CHKDSK is veryfing security descriptors/file IDs (stage 3 of 5)
   SDs/SIDs file processed: 21504.   

Cleaning up 2 index entries from index $SII of file 0x9.
Cleaning up 2 entries from index $SDH of file 0x9.
Cleaning up 2 unused index descriptors.
Security descriptors verification complete.
  Data files processed: 1206.                                     

Veryfing USN log...
  USN numbers bytes processed: 1186432.                                

Checking usn log ***integrity***? completed.
CHKDSK is veryfing file data (stage 4 of 5)
  Files processed: 21488.                                            

Checking file data completed.
CHKDSK is veryfing free space (stage 5 of 5)
  Free clusters processed: 33143508.                                        

Free space verification completed..
Windows has verified the file system and didn't find any problems.

 155135999 KB total disk space.
  22464344 KB in 10191 files.
      4076 KB in 1207 indexes.
     93543 KB in use by the system.
     65536 KB occupied by the log file.
 132574036 KB available on disk.

      4096 bytes in each allocation unit.
  38783999 total allocation units on disk.
  33143509 allocation units available on disk.

XML event code:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Chkdsk" />
    <EventID Qualifiers="0">26214</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-01-11T12:06:41.000000000Z" />
    <EventRecordID>1412</EventRecordID>
    <Channel>Application</Channel>
    <Computer>FX-4100</Computer>
    <Security />
  </System>
  <EventData>
    <Data>

</Data>
    <Binary>00540000922C0000B7450000000000001D000000000000000000000000000000</Binary>
  </EventData>
</Event>

[B]Partition E:

[/B]Log name:Application
Source:        Chkdsk
Date:          2012-01-11 19:51:19
Event ID:26214
Event Category: N/A
Stage/Level:        Information
Keywords: Classic
User:    N/A
Computer:      FX-4100
Description:
Chkdsk has been launched in read/write mode.    

Checking file system on E:
Volume has been unmounted. All open entries to this volume are now invalid/incorrect.
Volume name: Data.

CHKDSK is veryfing files (stage 1 of 5)
  File records processed: 14592.                                   

File verification completed.
  Large file records processed: 4.                            

  Damaged file records processed: 0                            

  Bad file records processed: 0.                      

  EA records processed: 0.                           

CHKDSK is veryfing indexes (stage 2 of 5)
  Index entries processed: 16472.                                    

Index verification completed.


CHKDSK is veryfing security descriptors/file IDs (stage 3 of 5)
   SDs/SIDs file processed: 14592.   

Cleaning up 75 index entries from index $SII of file 0x9.
Cleaning up 75 entries from index $SDH of file 0x9.
Cleaning up 75 unused index descriptors.
Security descriptors verification complete.
  Data files processed: 941.                                     

Veryfing USN log...
  USN numbers bytes processed: 25280104.                                

Checking usn log ***integrity***? completed.
CHKDSK is veryfing file data (stage 4 of 5)
  Files processed: 14576.                                            

Checking file data completed.
CHKDSK is veryfing free space (stage 5 of 5)
  Free clusters processed: 63756623.                                        

Free space verification completed..
Windows has verified the file system and didn't find any problems.

 265870335 KB total disk space.
  10728208 KB in 5381 files.
      1992 KB in 942 indexes.
    113639 KB in use by the system.
     65536 KB occupied by the log file.
 255026496 KB available on disk.

      4096 bytes in each allocation unit.
  66467583 total allocation units on disk.
  63756624 allocation units available on disk.

XML event code:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Chkdsk" />
    <EventID Qualifiers="0">26214</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-01-11T18:51:19.000000000Z" />
    <EventRecordID>1476</EventRecordID>
    <Channel>Application</Channel>
    <Computer>FX-4100</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
</Data>
    <Binary>00390000BF1800003D22000000000000C6000000000000000000000000000000</Binary>
  </EventData>
</Event>

 

[writhziden]

Looks like C: was cleaned up. See how it runs and whether you continue to have hard disk related problems.

I would still recommend running the memory tests overnight. Just start Memtest86+ an hour before bed tonight so you can make sure it hasn't stopped before you go to sleep. Then do the Windows memory diagnostics tomorrow night with the same procedure if Memtest86+ comes back clean. If it does not, we will provide further instructions.

Good luck!

 

[R4ndom]

Thanks, will repeat the memory test then and report back. Hopefully hard drive will stop crashing, I'm just wondering if it can still be trusted, I hesitate a bit. We'll see thanks again for help.

 

[writhziden]

Thanks, will repeat the memory test then and report back. Hopefully hard drive will stop crashing, I'm just wondering if it can still be trusted, I hesitate a bit. We'll see thanks again for help.

Hard drive errors are difficult to diagnose. I just had one myself a few days ago, and it came back clean. They can occur on good drives just as easily on bad drives, but they will reoccur on bad drives. Just let it run for a week or two, and if the crashes occur due to NTFS.SYS and you continue to find hard disk errors, the drive is failing.

Best wishes the drive is good and just needed some cleaning.

 

[R4ndom]

Thanks writhziden does that mean I'd better run chkdsk every now and then during the 2 weeks? Or just leave it run and once problems reoccur return the disk? Would it make any sense to image the current c: partition should another disaster come to preserve my system image and user files or the risk would be to image a corrupted partition?

As for memories, so far, after 8hrs of memtest86+ tests no errors found, I'll let it run until tonight and then repeat with Win7 utility.

All the best.

 

[writhziden]

Thanks writhziden does that mean I'd better run chkdsk every now and then during the 2 weeks? Or just leave it run and once problems reoccur return the disk? Would it make any sense to image the current c: partition should another disaster come to preserve my system image and user files or the risk would be to image a corrupted partition?

As for memories, so far, after 8hrs of memtest86+ tests no errors found, I'll let it run until tonight and then repeat with Win7 utility.

All the best.

I would just run normally for a week, then run chkdsk once a week or after any problems seem to have developed again. As for backing up your system and important files, we recommend doing this on a regular basis whether you have a good or a bad hard drive since computers can be unpredictable at times. Better to have a backup when something unexpected happens (hard drive crash, hard drive corruption, virus, etc.) than lose all your files.

Glad to see you are still going through the steps. Keep us updated. Best wishes!

 

[R4ndom]

Thanks for advice writhziden. Memtest86+ for 19hrs standard test with 19 passes completed and no errors. Will do the same with the windows one and post results.

 

[writhziden]

Glad to see no errors in Memtest86+. Best wishes with the Windows Memory Diagnostic tool.