Solved Random BSODs related to ntfs.sys and system kernel

[cvmm69]

I've had several bsods a day for about a week now. They mostly occur when the system is left alone for even a few minutes, but also when i'm playing a game (mostly DooM 3). Sometimes they are caused by ntfs.sys, sometimes the system kernel itself (ntkrnlmp.exe) crashes. I've attached all the dump files from c:\windows\minidump here.

I've recently updated my pc, and before the upgrade it was running fine and stable. I'm guessing it has something to do with the parts i upgraded, which were my graphics card (from VTX3D Radeon HD 5670 to XFX Radeon HD 6850) and my memory (from two A-Data AD2800E001GOU to four

A-DATA AD2U800B2G6-B model sticks)​

System specs:

System: Windows 7 Home Premium 64-bit

Motherboard: ASUS M2N
Processor: AMD Athlon X2 4200+
Memory: 4x A-DATA AD2U800B2G6-B 2GB DDR2 800MHz
Graphics Card: XFX Radeon HD 6850 Black Edition
HDD: Samsung Spinpoint F3 3,5" 1TB 7200RPM SATA2

Also, here is what windbg found out about my latest ntfs.sys related bsod:​

​

MODULE_NAME: Ntfs

FAULTING_MODULE: fffff80003066000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79996d

EXCEPTION_RECORD:  fffff880061ea088 -- (.exr 0xfffff880061ea088)
ExceptionAddress: fffff8800141b11d (Ntfs+0x000000000000d11d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff880061e98f0 -- (.cxr 0xfffff880061e98f0)
rax=0000000000000000 rbx=0000000000000000 rcx=ffdff8a012d477c0
rdx=0000000000000000 rsi=0000000000000000 rdi=fffff8a012d476f0
rip=fffff8800141b11d rsp=fffff880061ea2c0 rbp=fffff880061ea660
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000010 r12=fffffa800b8c1e40 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr ac po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010256
Ntfs+0xd11d:
fffff880`0141b11d 48393408        cmp     qword ptr [rax+rcx],rsi ds:002b:ffdff8a0`12d477c0=????????????????
Resetting default scope

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x24

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff88001414b68 to fffff8800141b11d

STACK_TEXT:  
fffff880`061ea2c0 fffff880`01414b68 : fffffa80`0b8c1e40 fffff8a0`12d476f0 00000000`00000000 fffff880`061ea4f0 : Ntfs+0xd11d
fffff880`061ea430 fffff880`0141a092 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff8a0`12d476f0 00000000`00000000 : Ntfs+0x6b68
fffff880`061ea5c0 fffff880`0141d2a6 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff8a0`12d476f0 fffff8a0`12d475c0 : Ntfs+0xc092
fffff880`061ea790 fffff880`0141fcf8 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff880`061ea901 fffffa80`079b4801 : Ntfs+0xf2a6
fffff880`061ea930 fffff880`012cb23f : fffffa80`0aa8d7d0 fffffa80`0aa8d430 fffffa80`079b48d0 00000000`00000000 : Ntfs+0x11cf8
fffff880`061ea9e0 fffff880`012c96df : fffffa80`091e42c0 fffffa80`0aa8d430 fffffa80`091e4200 fffffa80`0aa8d430 : fltmgr!FltIsCallbackDataDirty+0xa2f
fffff880`061eaa70 fffff800`030c80c2 : fffffa80`0aa8d450 fffffa80`0b883f20 00000000`00000403 fffff880`009e8180 : fltmgr+0x16df
fffff880`061eaad0 fffff800`03372e37 : fffffa80`0a869000 fffffa80`0a869000 fffffa80`0a8690d1 fffffa80`0a869010 : nt!IoPageRead+0x252
fffff880`061eab60 fffff800`03372f31 : fffffa80`0b8645c0 fffffa80`0aa86760 fffff880`061eac98 00000000`00000004 : nt!RtlCompareUnicodeString+0x677
fffff880`061eabc0 fffff800`0311abed : fffffa80`0b8645c0 00000000`00000000 00000000`00001000 00000000`00000000 : nt!RtlCompareUnicodeString+0x771
fffff880`061eac10 fffff800`033f07fb : 00000000`00000000 00000000`00000000 fffffa80`0b883f20 fffffa80`0b95f5d0 : nt!IoGetAttachedDevice+0x19d
fffff880`061eac70 fffff880`01418d50 : fffff8a0`00000000 fffff800`00000004 fffffa80`00040000 fffff880`0146b001 : nt!CcCopyRead+0x16b
fffff880`061ead30 fffff880`0141d083 : 00000000`00000000 fffff8a0`12d476f0 fffff880`061eaf60 00000000`00000000 : Ntfs+0xad50
fffff880`061ead90 fffff880`0141fcf8 : fffffa80`0b8c7e40 fffffa80`0b32a410 fffff880`061eaf01 fffffa80`0aa85c00 : Ntfs+0xf083
fffff880`061eaf30 fffff880`012cb23f : fffffa80`0b32a7b0 fffffa80`0b32a410 fffffa80`0aa85c30 00000000`00000000 : Ntfs+0x11cf8
fffff880`061eafe0 fffff880`012cd94a : 00000000`00000000 00000000`00000000 fffffa80`09ad1700 fffffa80`0aa85c30 : fltmgr!FltIsCallbackDataDirty+0xa2f
fffff880`061eb070 fffff880`012da204 : fffffa80`084e1c10 00000000`00000019 fffffa80`07cd7510 00000000`00000000 : fltmgr!FltPerformSynchronousIo+0x2ca
fffff880`061eb110 fffff880`06362e25 : 00000000`00000000 fffffa80`07cd7510 00000000`00000000 00000000`00000000 : fltmgr!FltReadFile+0x334
fffff880`061eb1f0 fffff880`063621f0 : fffffa80`09ad1700 fffffa80`0aa85c30 00000007`00000010 00000002`00000004 : aswMonFlt+0x2e25
fffff880`061eb330 fffff880`0639636d : 00000000`00000000 fffffa80`0782fae0 fffff880`061eb458 fffff880`00000000 : aswMonFlt+0x21f0
fffff880`061eb400 fffff880`012cc242 : 00000000`00000000 00000000`00000000 fffffa80`0b8247d0 00000000`00000000 : aswMonFlt+0x3636d
fffff880`061eb530 fffff880`012cb38b : fffffa80`07cc1030 fffffa80`0782fb80 fffffa80`09ad17b0 fffffa80`09ad19d0 : fltmgr!FltIsCallbackDataDirty+0x1a32
fffff880`061eb600 fffff880`012ea2b9 : fffffa80`0b824430 fffffa80`07cd7510 fffffa80`0b824400 fffffa80`091e42c0 : fltmgr!FltIsCallbackDataDirty+0xb7b
fffff880`061eb690 fffff800`033d6537 : 00000000`00000005 fffff800`033d5f90 fffffa80`0b606a10 00000000`00000000 : fltmgr!FltReadFile+0x103e9
fffff880`061eb740 fffff800`033ccba4 : fffffa80`07c9fad0 00000000`00000000 fffffa80`0b89ab10 00000000`00000701 : nt!SeUnlockSubjectContext+0x647
fffff880`061eb8d0 fffff800`033d1b7d : fffffa80`0b89ab10 fffff880`061eba30 fffffa80`00000040 fffffa80`06d22080 : nt!SeQueryInformationToken+0x2104
fffff880`061eb9d0 fffff800`033d8647 : fffffa80`0add1cd0 00000000`00000001 fffffa80`0b1ab001 fffffa80`099f7570 : nt!ObOpenObjectByName+0x1cd
fffff880`061eba80 fffff800`033e2398 : 00000000`02cd85e8 00000000`00100081 fffffa80`0aa86760 00000000`02cd85f8 : nt!SeUnlockSubjectContext+0x2757
fffff880`061ebb20 fffff800`030d5813 : 00000000`00000000 fffff800`033f0000 fffff880`061ebca0 00000000`00000000 : nt!NtCreateFile+0x78
fffff880`061ebbb0 00000000`777ffc0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeSynchronizeExecution+0x3a43
00000000`02cd8568 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777ffc0a


FOLLOWUP_IP: 
Ntfs+d11d
fffff880`0141b11d 48393408        cmp     qword ptr [rax+rcx],rsi

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs+d11d

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  Ntfs.sys

STACK_COMMAND:  .cxr 0xfffff880061e98f0 ; kb

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

1: kd> .exr 0xfffff880061ea088
ExceptionAddress: fffff8800141b11d (Ntfs+0x000000000000d11d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
1: kd> lmvm Ntfs
start             end                 module name
fffff880`0140e000 fffff880`015b0000   Ntfs       (no symbols)           
    Loaded symbol image file: Ntfs.sys
    Image path: \SystemRoot\System32\Drivers\Ntfs.sys
    Image name: Ntfs.sys
    Timestamp:        Fri Mar 11 05:39:25 2011 (4D79996D)
    CheckSum:         00199985
    ImageSize:        001A2000
    File version:     6.1.7600.16778
    Product version:  6.1.7600.16778
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntfs.sys
    OriginalFilename: ntfs.sys
    ProductVersion:   6.1.7600.16778
    FileVersion:      6.1.7600.16778 (win7_gdr.110310-1506)
    FileDescription:  NT File System Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

Help is much appreciated, I'm getting tired of solving this alone.
​

 

[zigzag3143]

I've had several bsods a day for about a week now. They mostly occur when the system is left alone for even a few minutes, but also when i'm playing a game (mostly DooM 3). Sometimes they are caused by ntfs.sys, sometimes the system kernel itself (ntkrnlmp.exe) crashes. I've attached all the dump files from c:\windows\minidump here.

I've recently updated my pc, and before the upgrade it was running fine and stable. I'm guessing it has something to do with the parts i upgraded, which were my graphics card (from VTX3D Radeon HD 5670 to XFX Radeon HD 6850) and my memory (from two A-Data AD2800E001GOU to four

A-DATA AD2U800B2G6-B model sticks)​

System specs:

System: Windows 7 Home Premium 64-bit

Motherboard: ASUS M2N
Processor: AMD Athlon X2 4200+
Memory: 4x A-DATA AD2U800B2G6-B 2GB DDR2 800MHz
Graphics Card: XFX Radeon HD 6850 Black Edition
HDD: Samsung Spinpoint F3 3,5" 1TB 7200RPM SATA2

Also, here is what windbg found out about my latest ntfs.sys related bsod:​

​

MODULE_NAME: Ntfs

FAULTING_MODULE: fffff80003066000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79996d

EXCEPTION_RECORD:  fffff880061ea088 -- (.exr 0xfffff880061ea088)
ExceptionAddress: fffff8800141b11d (Ntfs+0x000000000000d11d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff880061e98f0 -- (.cxr 0xfffff880061e98f0)
rax=0000000000000000 rbx=0000000000000000 rcx=ffdff8a012d477c0
rdx=0000000000000000 rsi=0000000000000000 rdi=fffff8a012d476f0
rip=fffff8800141b11d rsp=fffff880061ea2c0 rbp=fffff880061ea660
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000010 r12=fffffa800b8c1e40 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr ac po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010256
Ntfs+0xd11d:
fffff880`0141b11d 48393408        cmp     qword ptr [rax+rcx],rsi ds:002b:ffdff8a0`12d477c0=????????????????
Resetting default scope

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x24

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff88001414b68 to fffff8800141b11d

STACK_TEXT:  
fffff880`061ea2c0 fffff880`01414b68 : fffffa80`0b8c1e40 fffff8a0`12d476f0 00000000`00000000 fffff880`061ea4f0 : Ntfs+0xd11d
fffff880`061ea430 fffff880`0141a092 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff8a0`12d476f0 00000000`00000000 : Ntfs+0x6b68
fffff880`061ea5c0 fffff880`0141d2a6 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff8a0`12d476f0 fffff8a0`12d475c0 : Ntfs+0xc092
fffff880`061ea790 fffff880`0141fcf8 : fffffa80`0b8c1e40 fffffa80`0aa8d430 fffff880`061ea901 fffffa80`079b4801 : Ntfs+0xf2a6
fffff880`061ea930 fffff880`012cb23f : fffffa80`0aa8d7d0 fffffa80`0aa8d430 fffffa80`079b48d0 00000000`00000000 : Ntfs+0x11cf8
fffff880`061ea9e0 fffff880`012c96df : fffffa80`091e42c0 fffffa80`0aa8d430 fffffa80`091e4200 fffffa80`0aa8d430 : fltmgr!FltIsCallbackDataDirty+0xa2f
fffff880`061eaa70 fffff800`030c80c2 : fffffa80`0aa8d450 fffffa80`0b883f20 00000000`00000403 fffff880`009e8180 : fltmgr+0x16df
fffff880`061eaad0 fffff800`03372e37 : fffffa80`0a869000 fffffa80`0a869000 fffffa80`0a8690d1 fffffa80`0a869010 : nt!IoPageRead+0x252
fffff880`061eab60 fffff800`03372f31 : fffffa80`0b8645c0 fffffa80`0aa86760 fffff880`061eac98 00000000`00000004 : nt!RtlCompareUnicodeString+0x677
fffff880`061eabc0 fffff800`0311abed : fffffa80`0b8645c0 00000000`00000000 00000000`00001000 00000000`00000000 : nt!RtlCompareUnicodeString+0x771
fffff880`061eac10 fffff800`033f07fb : 00000000`00000000 00000000`00000000 fffffa80`0b883f20 fffffa80`0b95f5d0 : nt!IoGetAttachedDevice+0x19d
fffff880`061eac70 fffff880`01418d50 : fffff8a0`00000000 fffff800`00000004 fffffa80`00040000 fffff880`0146b001 : nt!CcCopyRead+0x16b
fffff880`061ead30 fffff880`0141d083 : 00000000`00000000 fffff8a0`12d476f0 fffff880`061eaf60 00000000`00000000 : Ntfs+0xad50
fffff880`061ead90 fffff880`0141fcf8 : fffffa80`0b8c7e40 fffffa80`0b32a410 fffff880`061eaf01 fffffa80`0aa85c00 : Ntfs+0xf083
fffff880`061eaf30 fffff880`012cb23f : fffffa80`0b32a7b0 fffffa80`0b32a410 fffffa80`0aa85c30 00000000`00000000 : Ntfs+0x11cf8
fffff880`061eafe0 fffff880`012cd94a : 00000000`00000000 00000000`00000000 fffffa80`09ad1700 fffffa80`0aa85c30 : fltmgr!FltIsCallbackDataDirty+0xa2f
fffff880`061eb070 fffff880`012da204 : fffffa80`084e1c10 00000000`00000019 fffffa80`07cd7510 00000000`00000000 : fltmgr!FltPerformSynchronousIo+0x2ca
fffff880`061eb110 fffff880`06362e25 : 00000000`00000000 fffffa80`07cd7510 00000000`00000000 00000000`00000000 : fltmgr!FltReadFile+0x334
fffff880`061eb1f0 fffff880`063621f0 : fffffa80`09ad1700 fffffa80`0aa85c30 00000007`00000010 00000002`00000004 : aswMonFlt+0x2e25
fffff880`061eb330 fffff880`0639636d : 00000000`00000000 fffffa80`0782fae0 fffff880`061eb458 fffff880`00000000 : aswMonFlt+0x21f0
fffff880`061eb400 fffff880`012cc242 : 00000000`00000000 00000000`00000000 fffffa80`0b8247d0 00000000`00000000 : aswMonFlt+0x3636d
fffff880`061eb530 fffff880`012cb38b : fffffa80`07cc1030 fffffa80`0782fb80 fffffa80`09ad17b0 fffffa80`09ad19d0 : fltmgr!FltIsCallbackDataDirty+0x1a32
fffff880`061eb600 fffff880`012ea2b9 : fffffa80`0b824430 fffffa80`07cd7510 fffffa80`0b824400 fffffa80`091e42c0 : fltmgr!FltIsCallbackDataDirty+0xb7b
fffff880`061eb690 fffff800`033d6537 : 00000000`00000005 fffff800`033d5f90 fffffa80`0b606a10 00000000`00000000 : fltmgr!FltReadFile+0x103e9
fffff880`061eb740 fffff800`033ccba4 : fffffa80`07c9fad0 00000000`00000000 fffffa80`0b89ab10 00000000`00000701 : nt!SeUnlockSubjectContext+0x647
fffff880`061eb8d0 fffff800`033d1b7d : fffffa80`0b89ab10 fffff880`061eba30 fffffa80`00000040 fffffa80`06d22080 : nt!SeQueryInformationToken+0x2104
fffff880`061eb9d0 fffff800`033d8647 : fffffa80`0add1cd0 00000000`00000001 fffffa80`0b1ab001 fffffa80`099f7570 : nt!ObOpenObjectByName+0x1cd
fffff880`061eba80 fffff800`033e2398 : 00000000`02cd85e8 00000000`00100081 fffffa80`0aa86760 00000000`02cd85f8 : nt!SeUnlockSubjectContext+0x2757
fffff880`061ebb20 fffff800`030d5813 : 00000000`00000000 fffff800`033f0000 fffff880`061ebca0 00000000`00000000 : nt!NtCreateFile+0x78
fffff880`061ebbb0 00000000`777ffc0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeSynchronizeExecution+0x3a43
00000000`02cd8568 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777ffc0a


FOLLOWUP_IP: 
Ntfs+d11d
fffff880`0141b11d 48393408        cmp     qword ptr [rax+rcx],rsi

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs+d11d

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  Ntfs.sys

STACK_COMMAND:  .cxr 0xfffff880061e98f0 ; kb

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

1: kd> .exr 0xfffff880061ea088
ExceptionAddress: fffff8800141b11d (Ntfs+0x000000000000d11d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
1: kd> lmvm Ntfs
start             end                 module name
fffff880`0140e000 fffff880`015b0000   Ntfs       (no symbols)           
    Loaded symbol image file: Ntfs.sys
    Image path: \SystemRoot\System32\Drivers\Ntfs.sys
    Image name: Ntfs.sys
    Timestamp:        Fri Mar 11 05:39:25 2011 (4D79996D)
    CheckSum:         00199985
    ImageSize:        001A2000
    File version:     6.1.7600.16778
    Product version:  6.1.7600.16778
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntfs.sys
    OriginalFilename: ntfs.sys
    ProductVersion:   6.1.7600.16778
    FileVersion:      6.1.7600.16778 (win7_gdr.110310-1506)
    FileDescription:  NT File System Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

Help is much appreciated, I'm getting tired of solving this alone.
​

Quite a few issues here.


1-ASACPI.SYS. the 2005 version (yours) crashes.

Asacpi.sys

The pre 2009 version of this driver is a known bsod cause.

Please visit this link: Asus tek computer inc. -support- drivers and download p7p55d le

ASUSTeK Computer Inc. -Support- Drivers and Download P7P55D LE
ASUSTeK Computer Inc. - Motherboards- ASUS P5K-VM

Scroll down to the utilities category, then scroll down to the "atk0110 driver for windowsxp/vista/windows 7 32&64-bit" (it's about the 12th item down).

Download and install it.

Go to c:\windows\system32\drivers to check and make sure that the asacpi.sys file is date stamped from 2009 or 2010 (notbefore).

2-Old drivers

[COLOR=Red]ASACPI.sys    3/27/2005 9:30:36 PM    fffff880`04139000    fffff880`04141000            0x00008000    0x42476c4c[/COLOR]                    
SynUSB64.sys    10/24/2007 3:38:29 AM    fffff880`03fe6000    fffff880`03ff1000            0x0000b000    0x471f0485                                                       
nvstor64.sys    8/18/2008 8:53:39 PM    fffff880`00dc0000    fffff880`00dec000            0x0002c000    0x48aa27a3                    
hamachi.sys    2/19/2009 5:36:41 AM    fffff880`045ea000    fffff880`045f5000            0x0000b000    0x499d3639                                     
L8042Kbd.sys    6/17/2009 11:50:43 AM    fffff880`0415f000    fffff880`0416a000            0x0000b000    0x4a391ee3

How To Find Drivers:

- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

3-SPTD.SYS

Please remove any CD visualization programs such as Daemon Tools and Alcohol 120%.

They use a driver, found in your dmp, called sptd.sys, that is notorious for causing BSODs.

Use this SPTD uninstaller DuplexSecure - Downloads DuplexSecure - FAQ

when you're done you can use this Freeware:

MagicISO Virtual CD/DVD-ROM (MagicDisc) in its place

Using MagicISO to create ISO image files

4-Avast

Avast can be a contributing cause of BSOD'S . Please remove and replace with Microsoft Security Essentials AT LEAST TO TEST


http://files.avast.com/files/eng/aswclear5.exe

Microsoft Security Essentials - Free Antivirus for Windows

 

[cvmm69]

Thank you for your response.

I did most the things you instructed me to do, but in some cases I could not fix the problem, so it is highly understandable that the bsods still continue to occur.

Here's a list of things I did:

1: ASACPI.SYS - replaced the old 2005 version with a newer version dated 5.14.2009 - downloaded from ASUS website.

2: Outdated Drivers

I found out the purposes of these drivers and took proper actions to fix all error related to these drivers and the software that uses them.

SynUSB64.sys - Synchrosoft eLicenser driver - Newer version is available, but inaccessible due to the Syncrosoft website being down, and alternate download at Syncrosoft License Control Software Informer: Latest version download, news and info about this SIA Syncrosoft program. is unavailable. If someone manages to locate this file, I'm thankful.

nvstor64.sys - NVIDIA NForce SATA driver, replaced old 2008 driver with a never version dated 6.30.2009 - downloaded from nvstor64.sys free download - Sysfiles-download.com

hamachi.sys - Hamachi VPN Software driver - removed the software for a test period of 2-3 months.

L8042kbd.sys - Logitech SetPoint software driver - software removed because no longer needed

3. SPTD.SYS
Removed Daemon Tools Lite and all other virtual disk software - sptd.sys removed using driver installer program downloaded from http://www.duplexsecure.com/download/SPTDinst-v180-x64.exe. Will install alternate virtual disk software if needed.

4. Avast
Software removed and installed Microsoft Security Essentials to test for a maximum period of 2 months.


After all installations I wiped off the traces of the installations using CCleaner, also ran a test for registery errors several times.

Also, a new kind of bsod occurred today: it was caused by atikmdag.sys, which is the kernel of my graphics card software. AMD Driver Updater and Steam both confirm that my driver is up to date (version 8.1.1.1223, 12.6.2011), so it is highly likely that it was not caused by the driver itself. I hope it comes up in the dump files.
Attached are not only my latest minidump files but also the information recovered using windbg from the newest atikmdag.sys bsod.

FAULTING_MODULE: fffff80003052000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4edd8367

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
atikmdag+3fa9f9
fffff880`04bfe9f9 488b5108        mov     rdx,qword ptr [rcx+8]

EXCEPTION_RECORD:  fffff88004754fc8 -- (.exr 0xfffff88004754fc8)
ExceptionAddress: fffff88004bfe9f9 (atikmdag+0x00000000003fa9f9)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88004754830 -- (.cxr 0xfffff88004754830)
rax=fffff8a00f6b6108 rbx=0000000f10ef8000 rcx=ffdff8a00f6b6128
rdx=fffff8a00f6b6010 rsi=fffff880047553f0 rdi=fffffa800931bac0
rip=fffff88004bfe9f9 rsp=fffff88004755200 rbp=00000000003ffc00
 r8=0000000000000000  r9=0000000000001000 r10=0000000000000000
r11=fffff88004755308 r12=0000000000000000 r13=fffff8a00f6b6010
r14=fffff88007e50000 r15=0000000000000003
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
atikmdag+0x3fa9f9:
fffff880`04bfe9f9 488b5108        mov     rdx,qword ptr [rcx+8] ds:002b:ffdff8a0`0f6b6130=????????????????
Resetting default scope

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x7E

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff88004bff8d8 to fffff88004bfe9f9

STACK_TEXT:  
fffff880`04755200 fffff880`04bff8d8 : fffffa80`0931bac0 00000000`00000000 00000000`00000000 00000000`00001000 : atikmdag+0x3fa9f9
fffff880`04755310 fffff880`048425fe : fffffa80`0931bae0 0000000f`10ef8000 00000000`00001000 0000000f`00150000 : atikmdag+0x3fb8d8
fffff880`047553c0 fffff880`0413545b : 00000000`00001000 fffff8a0`10de4620 ffffffff`c01e0001 ffffffff`ffffffff : atikmdag+0x3e5fe
fffff880`04755520 fffff880`052929ac : 00000000`00001000 fffff8a0`10de4620 fffff880`c0000001 fffff8a0`10de4620 : atikmpag+0x745b
fffff880`047555a0 fffff880`053a5c9d : fffff8a0`10de4620 fffff8a0`10de4620 00000000`00000000 fffffa80`09691000 : dxgkrnl+0x39ac
fffff880`047555d0 fffff880`053a5b88 : fffff8a0`10de4620 00000000`00000000 00000000`00000000 00000000`00106101 : dxgmms1!VidMmInterface+0x113dd
fffff880`04755760 fffff880`053b2029 : 00000000`00000000 fffffa80`0ae29730 00000000`00000000 00000000`00000000 : dxgmms1!VidMmInterface+0x112c8
fffff880`047557d0 fffff880`053a4af3 : fffffa80`0969ad70 fffff8a0`10de4620 fffffa80`09691000 fffff880`053a4600 : dxgmms1!VidMmInterface+0x1d769
fffff880`047558b0 fffff880`053a1763 : 00000000`00000000 fffffa80`078b8000 00000000`00000000 fffffa80`09b7a270 : dxgmms1!VidMmInterface+0x10233
fffff880`04755910 fffff880`053bb65d : 00000000`00000000 fffff8a0`108ecb10 fffffa80`00000000 fffffa80`07845470 : dxgmms1!VidMmInterface+0xcea3
fffff880`04755ae0 fffff880`053bb398 : fffff880`009ecec0 fffff880`053bad00 fffffa80`00000000 fffffa80`00000000 : dxgmms1!VidMmInterface+0x26d9d
fffff880`04755cd0 fffff880`053bae96 : 00000000`00000000 fffffa80`09470550 00000000`00000080 fffffa80`06d73410 : dxgmms1!VidMmInterface+0x26ad8
fffff880`04755d00 fffff800`033626fa : 00000000`278b0252 fffffa80`06da1b60 fffffa80`06d23040 fffffa80`06da1b60 : dxgmms1!VidMmInterface+0x265d6
fffff880`04755d40 fffff800`030a0b46 : fffff880`009e8180 fffffa80`06da1b60 fffff880`009f2f40 fffff880`01224810 : nt!PsCreateSystemThread+0x6d6
fffff880`04755d80 00000000`00000000 : fffff880`04756000 fffff880`04750000 fffff880`04754d80 00000000`00000000 : nt!KeTestAlertThread+0x93a


FOLLOWUP_IP: 
atikmdag+3fa9f9
fffff880`04bfe9f9 488b5108        mov     rdx,qword ptr [rcx+8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  atikmdag+3fa9f9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME:  atikmdag.sys

STACK_COMMAND:  .cxr 0xfffff88004754830 ; kb

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

0: kd> lmvm atikmdag
start             end                 module name
fffff880`04804000 fffff880`0528f000   atikmdag   (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Tue Dec 06 04:52:23 2011 (4EDD8367)
    CheckSum:         00A43704
    ImageSize:        00A8B000
    File version:     8.1.1.1223
    Product version:  8.1.1.1223
    File flags:       8 (Mask 3F) Private
    File OS:          40004 NT Win32
    File type:        3.4 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Advanced Micro Devices, Inc.
    ProductName:      ATI Radeon Family
    InternalName:     atikmdag.sys
    OriginalFilename: atikmdag.sys
    ProductVersion:   8.01.01.1223
    FileVersion:      8.01.01.1223
    FileDescription:  ATI Radeon Kernel Mode Driver
    LegalCopyright:   Copyright (C) 1998-2011 Advanced Micro Devices, Inc.
0: kd> lmvm nt
start             end                 module name
fffff800`03052000 fffff800`0362e000   nt         (export symbols)       ntkrnlmp.exe
    Loaded symbol image file: ntkrnlmp.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Timestamp:        Thu Jun 23 05:51:48 2011 (4E02AA44)
    CheckSum:         00542941
    ImageSize:        005DC000
    File version:     6.1.7600.16841
    Product version:  6.1.7600.16841
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntkrnlmp.exe
    OriginalFilename: ntkrnlmp.exe
    ProductVersion:   6.1.7600.16841
    FileVersion:      6.1.7600.16841 (win7_gdr.110622-1503)
    FileDescription:  NT Kernel & System
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

All help is much appreciated.

 

[GianniDPC]

Thank you for your response.

I did most the things you instructed me to do, but in some cases I could not fix the problem, so it is highly understandable that the bsods still continue to occur.

Here's a list of things I did:

1: ASACPI.SYS - replaced the old 2005 version with a newer version dated 5.14.2009 - downloaded from ASUS website.

2: Outdated Drivers

I found out the purposes of these drivers and took proper actions to fix all error related to these drivers and the software that uses them.

SynUSB64.sys - Synchrosoft eLicenser driver - Newer version is available, but inaccessible due to the Syncrosoft website being down, and alternate download at Syncrosoft License Control Software Informer: Latest version download, news and info about this SIA Syncrosoft program. is unavailable. If someone manages to locate this file, I'm thankful.

nvstor64.sys - NVIDIA NForce SATA driver, replaced old 2008 driver with a never version dated 6.30.2009 - downloaded from nvstor64.sys free download - Sysfiles-download.com

hamachi.sys - Hamachi VPN Software driver - removed the software for a test period of 2-3 months.

L8042kbd.sys - Logitech SetPoint software driver - software removed because no longer needed

3. SPTD.SYS
Removed Daemon Tools Lite and all other virtual disk software - sptd.sys removed using driver installer program downloaded from http://www.duplexsecure.com/download/SPTDinst-v180-x64.exe. Will install alternate virtual disk software if needed.

4. Avast
Software removed and installed Microsoft Security Essentials to test for a maximum period of 2 months.


After all installations I wiped off the traces of the installations using CCleaner, also ran a test for registery errors several times.

Also, a new kind of bsod occurred today: it was caused by atikmdag.sys, which is the kernel of my graphics card software. AMD Driver Updater and Steam both confirm that my driver is up to date (version 8.1.1.1223, 12.6.2011), so it is highly likely that it was not caused by the driver itself. I hope it comes up in the dump files.
Attached are not only my latest minidump files but also the information recovered using windbg from the newest atikmdag.sys bsod.

FAULTING_MODULE: fffff80003052000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4edd8367

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
atikmdag+3fa9f9
fffff880`04bfe9f9 488b5108        mov     rdx,qword ptr [rcx+8]

EXCEPTION_RECORD:  fffff88004754fc8 -- (.exr 0xfffff88004754fc8)
ExceptionAddress: fffff88004bfe9f9 (atikmdag+0x00000000003fa9f9)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88004754830 -- (.cxr 0xfffff88004754830)
rax=fffff8a00f6b6108 rbx=0000000f10ef8000 rcx=ffdff8a00f6b6128
rdx=fffff8a00f6b6010 rsi=fffff880047553f0 rdi=fffffa800931bac0
rip=fffff88004bfe9f9 rsp=fffff88004755200 rbp=00000000003ffc00
 r8=0000000000000000  r9=0000000000001000 r10=0000000000000000
r11=fffff88004755308 r12=0000000000000000 r13=fffff8a00f6b6010
r14=fffff88007e50000 r15=0000000000000003
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
atikmdag+0x3fa9f9:
fffff880`04bfe9f9 488b5108        mov     rdx,qword ptr [rcx+8] ds:002b:ffdff8a0`0f6b6130=????????????????
Resetting default scope

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x7E

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff88004bff8d8 to fffff88004bfe9f9

STACK_TEXT:  
fffff880`04755200 fffff880`04bff8d8 : fffffa80`0931bac0 00000000`00000000 00000000`00000000 00000000`00001000 : atikmdag+0x3fa9f9
fffff880`04755310 fffff880`048425fe : fffffa80`0931bae0 0000000f`10ef8000 00000000`00001000 0000000f`00150000 : atikmdag+0x3fb8d8
fffff880`047553c0 fffff880`0413545b : 00000000`00001000 fffff8a0`10de4620 ffffffff`c01e0001 ffffffff`ffffffff : atikmdag+0x3e5fe
fffff880`04755520 fffff880`052929ac : 00000000`00001000 fffff8a0`10de4620 fffff880`c0000001 fffff8a0`10de4620 : atikmpag+0x745b
fffff880`047555a0 fffff880`053a5c9d : fffff8a0`10de4620 fffff8a0`10de4620 00000000`00000000 fffffa80`09691000 : dxgkrnl+0x39ac
fffff880`047555d0 fffff880`053a5b88 : fffff8a0`10de4620 00000000`00000000 00000000`00000000 00000000`00106101 : dxgmms1!VidMmInterface+0x113dd
fffff880`04755760 fffff880`053b2029 : 00000000`00000000 fffffa80`0ae29730 00000000`00000000 00000000`00000000 : dxgmms1!VidMmInterface+0x112c8
fffff880`047557d0 fffff880`053a4af3 : fffffa80`0969ad70 fffff8a0`10de4620 fffffa80`09691000 fffff880`053a4600 : dxgmms1!VidMmInterface+0x1d769
fffff880`047558b0 fffff880`053a1763 : 00000000`00000000 fffffa80`078b8000 00000000`00000000 fffffa80`09b7a270 : dxgmms1!VidMmInterface+0x10233
fffff880`04755910 fffff880`053bb65d : 00000000`00000000 fffff8a0`108ecb10 fffffa80`00000000 fffffa80`07845470 : dxgmms1!VidMmInterface+0xcea3
fffff880`04755ae0 fffff880`053bb398 : fffff880`009ecec0 fffff880`053bad00 fffffa80`00000000 fffffa80`00000000 : dxgmms1!VidMmInterface+0x26d9d
fffff880`04755cd0 fffff880`053bae96 : 00000000`00000000 fffffa80`09470550 00000000`00000080 fffffa80`06d73410 : dxgmms1!VidMmInterface+0x26ad8
fffff880`04755d00 fffff800`033626fa : 00000000`278b0252 fffffa80`06da1b60 fffffa80`06d23040 fffffa80`06da1b60 : dxgmms1!VidMmInterface+0x265d6
fffff880`04755d40 fffff800`030a0b46 : fffff880`009e8180 fffffa80`06da1b60 fffff880`009f2f40 fffff880`01224810 : nt!PsCreateSystemThread+0x6d6
fffff880`04755d80 00000000`00000000 : fffff880`04756000 fffff880`04750000 fffff880`04754d80 00000000`00000000 : nt!KeTestAlertThread+0x93a


FOLLOWUP_IP: 
atikmdag+3fa9f9
fffff880`04bfe9f9 488b5108        mov     rdx,qword ptr [rcx+8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  atikmdag+3fa9f9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME:  atikmdag.sys

STACK_COMMAND:  .cxr 0xfffff88004754830 ; kb

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

0: kd> lmvm atikmdag
start             end                 module name
fffff880`04804000 fffff880`0528f000   atikmdag   (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Tue Dec 06 04:52:23 2011 (4EDD8367)
    CheckSum:         00A43704
    ImageSize:        00A8B000
    File version:     8.1.1.1223
    Product version:  8.1.1.1223
    File flags:       8 (Mask 3F) Private
    File OS:          40004 NT Win32
    File type:        3.4 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Advanced Micro Devices, Inc.
    ProductName:      ATI Radeon Family
    InternalName:     atikmdag.sys
    OriginalFilename: atikmdag.sys
    ProductVersion:   8.01.01.1223
    FileVersion:      8.01.01.1223
    FileDescription:  ATI Radeon Kernel Mode Driver
    LegalCopyright:   Copyright (C) 1998-2011 Advanced Micro Devices, Inc.
0: kd> lmvm nt
start             end                 module name
fffff800`03052000 fffff800`0362e000   nt         (export symbols)       ntkrnlmp.exe
    Loaded symbol image file: ntkrnlmp.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Timestamp:        Thu Jun 23 05:51:48 2011 (4E02AA44)
    CheckSum:         00542941
    ImageSize:        005DC000
    File version:     6.1.7600.16841
    Product version:  6.1.7600.16841
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntkrnlmp.exe
    OriginalFilename: ntkrnlmp.exe
    ProductVersion:   6.1.7600.16841
    FileVersion:      6.1.7600.16841 (win7_gdr.110622-1503)
    FileDescription:  NT Kernel & System
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

All help is much appreciated.

Update your graphics card drivers to the lasted one avaible: http://support.amd.com/us/gpudownload

Also isn't your card overheating please monitor your temps using GPU-Z: GPU-Z Video card GPU Information Utility

Also are you Overclocking ???

 

[cvmm69]

Thanks for contibuting in this thread.

As I said, I am running the latest version of the driver software available for my card. I did reinstall them, just to be sure, though.
I am using a free desktop widget that monitors my card's clocks and temperature, and it is running at 45-50'c on normal desktop use and 65-70'c while running furmark. My card is not overclocked or flashed, and my enclosure is properly ventilated. I see no reason for overheating to cause this.

 

[GianniDPC]

Thanks for contibuting in this thread.

As I said, I am running the latest version of the driver software available for my card. I did reinstall them, just to be sure, though.
I am using a free desktop widget that monitors my card's clocks and temperature, and it is running at 45-50'c on normal desktop use and 65-70'c while running furmark. My card is not overclocked or flashed, and my enclosure is properly ventilated. I see no reason for overheating to cause this.

I saw at your last dump that these drivers are really outdated:

SynUSB64.sys (24/10/2007)

teamviewervpn.sys (13/12/2007)

Please update it if possible

 

[cvmm69]

I also explained in my last reply that i am aware of synusb64.sys being outdated because the newest version is currently available only in the newest version of Cubase, which i cannot aquire in a legitimate way. But I had no idea of Teamviewer being outdated, will uprgade that asap.

 

[zigzag3143]

Thanks for contibuting in this thread.

As I said, I am running the latest version of the driver software available for my card. I did reinstall them, just to be sure, though.
I am using a free desktop widget that monitors my card's clocks and temperature, and it is running at 45-50'c on normal desktop use and 65-70'c while running furmark. My card is not overclocked or flashed, and my enclosure is properly ventilated. I see no reason for overheating to cause this.

I saw at your last dump that these drivers are really outdated:

SynUSB64.sys (24/10/2007)

teamviewervpn.sys (13/12/2007)

Please update it if possible

I am afraid the Team Viewer is the most current. Works in win 7 32 & 64 and in Win 8 32 & 64 with no reports of trouble. (I beta test for them)

 

[cvmm69]

So the only thing left to do is to locate the newest version of the Syncrosoft driver. If someone knows how, I will try it, because it seems to be the only troublemaker left unless there is a problem with the graphics driver.

 

[zigzag3143]

So the only thing left to do is to locate the newest version of the Syncrosoft driver. If someone knows how, I will try it, because it seems to be the only troublemaker left unless there is a problem with the graphics driver.

You may be able to use that one if you re-install in "compatibility" mode


(right click the installer>run as admin>properties>Compatibility>chose Vista)

Good luck

 

[cvmm69]

Tried it, didn't work. Removing the driver did help a bit, though. Now they occur much less often, but they still continue to come. That means that there is still something causing them. Latest dumps included. I really hope the reason is found, I keep losing my work.

MODULE_NAME: nt

FAULTING_MODULE: fffff80003008000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aa44

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!NtSetInformationThread+e94
fffff800`03346034 80be380b000001  cmp     byte ptr [rsi+0B38h],1

CONTEXT:  fffff8800843c040 -- (.cxr 0xfffff8800843c040)
rax=fffff8a01c144700 rbx=fffff8a01c144700 rcx=fffff8a01f01c6f8
rdx=0000000000000000 rsi=ffdff8a00b62a010 rdi=fffff8a01f01c6f8
rip=fffff80003346034 rsp=fffff8800843ca10 rbp=fffffa800a1de000
 r8=0000000000000000  r9=00000000ffffffff r10=000000000000000e
r11=0000000000000011 r12=fffff8a01c1446d0 r13=fffffa800a1de060
r14=0000000000000000 r15=fffff8a011319a80
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!NtSetInformationThread+0xe94:
fffff800`03346034 80be380b000001  cmp     byte ptr [rsi+0B38h],1 ds:002b:ffdff8a0`0b62ab48=??
Resetting default scope

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000307d754 to fffff80003346034

STACK_TEXT:  
fffff880`0843ca10 fffff800`0307d754 : 00000000`00000000 fffffa80`0a1de060 fffffa80`06d44510 fffff8a0`1c1446d0 : nt!NtSetInformationThread+0xe94
fffff880`0843cae0 fffff800`0338b394 : fffffa80`0a1de060 00000000`00000000 fffffa80`0be46950 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`0843cb40 fffff800`0338b294 : 00000000`00000340 fffffa80`0a1de060 fffff8a0`11319a80 00000000`00000340 : nt!SeAssignSecurityEx+0x754
fffff880`0843cbd0 fffff800`03077813 : fffffa80`0be46950 fffff880`0843cca0 00000000`00000000 00000000`00000001 : nt!SeAssignSecurityEx+0x654
fffff880`0843cc20 00000000`7700f7aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeSynchronizeExecution+0x3a43
00000000`0261d1c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7700f7aa


FOLLOWUP_IP: 
nt!NtSetInformationThread+e94
fffff800`03346034 80be380b000001  cmp     byte ptr [rsi+0B38h],1

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!NtSetInformationThread+e94

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntkrnlmp.exe

STACK_COMMAND:  .cxr 0xfffff8800843c040 ; kb

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

1: kd> lmvm nt
start             end                 module name
fffff800`03008000 fffff800`035e4000   nt         (export symbols)       ntkrnlmp.exe
    Loaded symbol image file: ntkrnlmp.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Timestamp:        Thu Jun 23 05:51:48 2011 (4E02AA44)
    CheckSum:         00542941
    ImageSize:        005DC000
    File version:     6.1.7600.16841
    Product version:  6.1.7600.16841
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntkrnlmp.exe
    OriginalFilename: ntkrnlmp.exe
    ProductVersion:   6.1.7600.16841
    FileVersion:      6.1.7600.16841 (win7_gdr.110622-1503)
    FileDescription:  NT Kernel & System
    LegalCopyright:   © Microsoft Corporation. All rights reserved.
1: kd> .cxr 0xfffff8800843c040
rax=fffff8a01c144700 rbx=fffff8a01c144700 rcx=fffff8a01f01c6f8
rdx=0000000000000000 rsi=ffdff8a00b62a010 rdi=fffff8a01f01c6f8
rip=fffff80003346034 rsp=fffff8800843ca10 rbp=fffffa800a1de000
 r8=0000000000000000  r9=00000000ffffffff r10=000000000000000e
r11=0000000000000011 r12=fffff8a01c1446d0 r13=fffffa800a1de060
r14=0000000000000000 r15=fffff8a011319a80
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!NtSetInformationThread+0xe94:
fffff800`03346034 80be380b000001  cmp     byte ptr [rsi+0B38h],1 ds:002b:ffdff8a0`0b62ab48=??

 

[cvmm69]

Ok, just got a different kind of bsod. It had something to do with "Memory Management". Could it be that the new memory I installed is incompitable with my system? If so, then what should I do? Please help.
Dump included.

MODULE_NAME: nt

FAULTING_MODULE: fffff8000304a000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aa44

BUGCHECK_STR:  0x1a_41284

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000310f2e3 to fffff800030ba5c0

STACK_TEXT:  
fffff880`0b82c048 fffff800`0310f2e3 : 00000000`0000001a 00000000`00041284 fffff6fb`40003001 00000000`00000010 : nt!KeBugCheckEx
fffff880`0b82c050 fffff800`030ed249 : fffffa80`0acb5ec8 00000000`00000001 00000000`00000000 00000000`00000002 : nt!wcsncat_s+0x61cb
fffff880`0b82c090 fffff800`030ed4da : fffffa80`04e98d60 fffffa80`0acb5b30 00000000`00000001 fffff6fb`40003000 : nt!PsReturnProcessNonPagedPoolQuota+0xf8d
fffff880`0b82c0d0 fffff800`0308eca6 : fffff700`01080520 fffffa80`0acb5ec8 fffff700`01080000 fffff8a0`054241d0 : nt!PsReturnProcessNonPagedPoolQuota+0x121e
fffff880`0b82c1e0 fffff800`0308d60e : fffffa80`0acb5b30 fffffa80`00000008 fffff8a0`000000dd 00000000`00000000 : nt!PsGetProcessSessionIdEx+0x173a
fffff880`0b82ca90 fffff800`0339ca8b : fffff8a0`1298f480 00000000`00000001 00000000`00000000 fffffa80`0aea9b60 : nt!PsGetProcessSessionIdEx+0xa2
fffff880`0b82cae0 fffff800`0337435b : 00000000`00000000 00000000`00000001 000007ff`fffde000 00000000`00000000 : nt!NtFsControlFile+0x1307
fffff880`0b82cba0 fffff800`030b9813 : fffffa80`0acb5b30 fffff880`00000000 00000000`00394150 fffffa80`0aea9b60 : nt!MmUnmapViewOfSection+0x26b
fffff880`0b82cc20 00000000`7724f97a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeSynchronizeExecution+0x3a43
00000000`0021fbf8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7724f97a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!wcsncat_s+61cb
fffff800`0310f2e3 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!wcsncat_s+61cb

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntkrnlmp.exe

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

0: kd> lmvm nt
start             end                 module name
fffff800`0304a000 fffff800`03626000   nt         (export symbols)       ntkrnlmp.exe
    Loaded symbol image file: ntkrnlmp.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Timestamp:        Thu Jun 23 05:51:48 2011 (4E02AA44)
    CheckSum:         00542941
    ImageSize:        005DC000
    File version:     6.1.7600.16841
    Product version:  6.1.7600.16841
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntkrnlmp.exe
    OriginalFilename: ntkrnlmp.exe
    ProductVersion:   6.1.7600.16841
    FileVersion:      6.1.7600.16841 (win7_gdr.110622-1503)
    FileDescription:  NT Kernel & System
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

 

[writhziden]

Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

If you swap any memory components, follow these steps for ESD safety:

1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.

Once these steps have been followed, it is safe to remove and replace components within your computer.



Download and install CPU-Z and Upload screenshots of the CPU, Mainboard, Memory, and SPD tabs. In the SPD tab, upload an image of each slot.

Also, go into your BIOS and post all Voltages (CPU, RAM, NB, IMC, etc.) and all RAM settings (timings, frequency, etc.)

Thanks to Dave76 for help learning RAM Stability

 

[cvmm69]

I ran Memtest as instructed, and ended up with over 9 million errors. The old sticks are running clear in every slot, so the new memory sticks cause this. Screencaps of CPU-Z included, and this is what I could dig out from my BIOS:

CPU Temp: 45'C
MB Temp: 31'C

Cpu Fan: 3534 rpm
VCORE Voltage: 1,312v
3,3v Voltage: 3,360v
5v Voltage: 4,977v
12v Voltage: 12,233v
Memory Voltage: 1,900v

All clock and voltage settings are set to AUTO.

 

[writhziden]

Proceed to part three of that tutorial for Memtest86+. Any errors in Memtest86+ are too many, and you are getting more than your fair share. Also, make sure to use the safe ESD steps.

 

[cvmm69]

Problem solved. I tested all the sticks and all the slots, and have indefinied the cause of the problem. All slots were tested with my old sticks, and proved all fully operational. The faulting memory stick, which was stick #2, had over nine thousand errors at the very start of the test, which is enough proof to prove the stick corrupted. I'll finish the test on stick #4 and run extended stick pair tests tomorrow.

#######MEMTEST x86 Testing Log#######

Stick information:
Manufacturer: A-DATA
Model: ADU800B2G6-B 2GB DDR2 800mHz PC6400
Total Sticks: 4

######Individual stick testing#######

stick    slot    pass    errors
1        1       4 + 3    no
------------------------------
2        1       0         yes    
2        2       0         yes
2        3       0         yes
2        4       0         yes
------------------------------
3        1       7         no
------------------------------
4        1       1         no


#######Stick Status#######

Stick 1: 3+4=7 Passes, OK
Stick 2: 0 Passes, Failed
Stick 3: 7 Passes, OK
Stick 4: 1 Passes, OK


#######Slot Status#######

Slot 1: OK
Slot 2: OK
Slot 3: OK
Slot 4: OK

Thanks to everyone for helping me indenify and fix these problems that have cost me over two weeks of hard work.

 

[writhziden]

Glad you finally have it narrowed down. Let us know the results and how the system responds. Best of luck!