Solved BSOD twice in 5 days (ntoskrnl.exe/ntkrnlmp.exe and ntfs.sys)

[Akron]

I got a BSOD twice in the last 5 days. According to WhoCrashed, the first one came from ntfs.sys and the next one from ntoskrnl.exe/ntkrnlmp.exe. Apparently most likely a driver/memory error.

The OS is Win7 x64 Ultimate Professional retail. The PC is slightly less than 2 years old and so is the Windows installation (never have reinstalled it). The only newer parts are a PSU and 2 extra RAM sticks (identical to the other two and installed in the correct positions) to go from 4 to 8gb. Both of those came about a month ago.

Any ideas?

 

[writhziden]

Please remove any CD/DVD virtualization software, such as Daemon Tools/Alcohol 120%, as they use a driver called sptd.sys that is known to cause BSODs. Use add/remove programs to remove the software. After removing the software, use the sptd.sys uninstaller to remove sptd.sys from the system.

I prefer TotalMounter as my CD/DVD virtualization software as it allows me to burn images to a virtual CD/DVD if I just want an ISO file instead of a disc, and it is free.

Many use MagicISO - Convert BIN to ISO, Create, Edit, Burn, Extract ISO file, ISO/BIN converter/extractor/editor as well, which is also free.

 

[Akron]

Thanks, I'll try that out, see how it goes.

 

[writhziden]

You're welcome. Look forward to finding out if that resolved it.

 

[Akron]

That wasn't it, got another one today. Apparently win32k.sys has come into play as well.

Adding an updated zip including the newest crash.

 

[writhziden]

Problematic Software:

Start Menu\Programs\ASRock Utility	Public:Start Menu\Programs\ASRock Utility	Public
Start Menu\Programs\ASRock Utility\InstantBoot	Public:Start Menu\Programs\ASRock Utility\InstantBoot	Public
Start Menu\Programs\Spybot - Search & Destroy	Public:Start Menu\Programs\Spybot - Search & Destroy	Public

Remove the above.

• Spybot Search and Destroy is not the best malware/spyware utility. Take a look at http://www.sevenforums.com/system-s...-system-security-combination.html#post1732627 for better options.
  
  
• Recommend removing your ASRock utilities through Start Menu -> Control Panel -> Uninstall a program. They can provide software interfaces with the hardware for overclocking, and even when the overclock is not enabled, that interface can cause instability.

The driver pcouffin.sys should be looked at; yours is from 2006 and may be causing conflicts. That link provides instructions on how to handle problems related to that driver.


Crashes are pointing to memory problems or driver conflicts. If the above steps do not resolve the crashes, proceed through the next steps:

• If you are overclocking any hardware, please stop.
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
     Warning

  Before you proceed with the following, answer these two questions: Are you still under warranty? Does your warranty allow you to open up the machine to check hardware? If you are unsure of the answers to these questions, contact your system manufacturer. :warn:WARNING: The steps that follow can void your warranty!!!
  
  For Part 3: If You Have Errors: If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working. If you do not have an anti-static workbench, desk, or pad, you can use your computer tower/case by finding a metal hold in it, such as a drive bay.
  Once these steps have been followed, it is safe to remove and replace components within your computer.
  
  
• An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
  
  a. Backup your system and user files
  b. Create a system restore point
  c. If you do not have a Windows 7 DVD, Create a system repair disc
  d. In Windows 7:

  • Click the Start Menu
  • Type verifier in Search programs and files (do not hit enter)
  • Right click verifier and click Run as administrator
  • Put a tick in Create custom settings (for code developers) and click next
  • Put a tick in Select individual settings from a full list and click next
  • Set up the individual settings as in the image and click next
    View attachment 218057
  • Put a tick in Select driver names from a list
  • Put a tick next to all non-Microsoft drivers.
  • Click Finish.
  • Restart your computer.

  
  If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using http://www.sevenforums.com/tutorials/700-system-restore.html OPTION TWO.
  
  If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.​
  The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.
  
  When you are ready to disable Verifier: Start Menu -> All Programs -> Accessories -> Right click Command Prompt -> Run as administrator -> Type the following command and then Enter:
  verifier /reset​
  -> Restart your computer.

 

[Akron]

Alright, I got rid of pcouffin.sys and the related software, as well as ASRock's InstantBoot and Spybot. I updated my security according to that post and am running scans right now.

Also, I actually ran Memtest86+ yesterday, since I noticed that the trend was either memory or driver issue, on which you seem to agree. I left it on overnight and for a bit today, 10 passes later, no errors found. I'll run the Windows Memory diagnostic tonight and report back on that too, then use the PC normally for a week or so and see how it goes.

Since you mentioned ASRock's overclocking utilities, I actually do have Turbo UCC enabled (which takes my 1055T's 6 cores from 2.6 to 3.2GHz, but I'm not really sure if it actually is responsible for any software/driver within Windows). It feels silly that I forgot to mention that earlier. Anyway, I kinda like it, so I'll try all other things first, but if I still get BSOD's then that's the next one to go.

Driver Verifier is the last resort, I guess.

Thanks again for being so helpful.

 

[writhziden]

You're welcome.

The problem with software based overclocking is the voltages are not properly set up to handle the overclock. It is much safer/more stable to apply overclocking via the BIOS. If you want steps for how to do so from experts who can give you specific information: Overclocking and Case Mods - Windows 7 Forums

Make sure if you start a thread in the overclocking forum that the person answering is a Seven Guru or that the person is backed up by a Seven Guru. Overclocking is not something you want to get wrong because it can damage hardware, so you need someone who has the experience to do it right.

 

[Akron]

...and 2 weeks later we have another one. I uploaded the new report just in case someone can figure something out while I'm following this thread, trying to fix that same error so I can do a backup and proceed with the verifier.

 

[writhziden]

Backup Error 0x81000019:

http://www.sevenforums.com/tutorials/230477-backup-error-0x81000019-fix.html may help with the backup issue.​

Analysis:

Your most recent crash indicates hard disk problems. This could mean hard disk corruption, bad sectors, a failing hard disk, Windows files or registry corruption, viruses, or memory problems.

• If you are overclocking any hardware, please stop.
  
  
• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html (you may need to search for wininit instead of chkdsk).
  For any drives that do not give the message:
  Windows has checked the file system and found no problems
  run disk check again as above. In other words, if it says:
  Windows has made corrections to the file system
  after running the disk check, run the disk check again.
  
  
• Run all Basic tests with SeaTools: S.M.A.R.T. Check, Short Drive Self Test, Drive Information, Short Generic, and Long Generic. Run the tests for all HDDs.
  SeaTools for Windows
  
  SeaTools for DOS​
  
  
• If you have an SSD, make sure the following are up to date:
  • SSD firmware
  • BIOS Version
  • Chipset Drivers
  • Hard disk controller drivers/SATA drivers
  • If you have a Marvell IDE ATA/ATAPI device, make sure the drivers are up to date from the Intel site or Marvell site and not from your motherboard/vendor support site.
  
  
• Check Windows for corruption. Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations. Use OPTION THREE of http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html to provide us with the sfcdetails.txt file if errors occur.
  
  
• Download and install Malwarebytes, update it, do not start the free trial, and then run a full scan. Also run a full scan with your antivirus software installed on your system. If you do not have antivirus software installed, see the http://www.sevenforums.com/system-s...-system-security-combination.html#post1732627 for better security steps and scanning tools. Make sure to update the security software before running the full scan.
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
     Warning

  Before you proceed with the following, answer these two questions: Are you still under warranty? Does your warranty allow you to open up the machine to check hardware? If you are unsure of the answers to these questions, contact your system manufacturer. :warn:WARNING: The steps that follow can void your warranty!!!
  
  For Part 3: If You Have Errors: If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working. If you do not have an anti-static workbench, desk, or pad, you can use your computer tower/case by finding a metal hold in it, such as a drive bay.
  Once these steps have been followed, it is safe to remove and replace components within your computer.

 

[Akron]

Quick update:
Chkdsk yielded no result, although the test for drive C: (the Windows installation, which I had to schedule for the next restart) didn't seem to do anything. All it said after detecting the drive and file system was something along the lines of "Drive is clean".

I went for Seatools afterwards, which did find something in drive F: the external 1.5TB Seagate FreeAgent I've got.

08/07/2012 03:55:27
Unit Serial: 2GEX6TKT
Unit Model: Seagate FreeAgent
Model: ST31500341AS
Serial Number: 9VS1DRE9
Firmware Revision: CC3H
Short DST - Started 08/07/2012 03:55:27
Short DST - Pass 08/07/2012 03:56:32
Identify - Started 08/07/2012 03:59:45
Short Generic - Started 08/07/2012 03:59:59
Short Generic - FAIL 08/07/2012 04:00:03
SeaTools Test Code: A6D2D9C4
Short Generic - Started 08/07/2012 04:01:56
Short Generic - FAIL 08/07/2012 04:02:00
SeaTools Test Code: A6D2D9C4
Long Generic - Started 08/07/2012 04:02:47
Bad LBA: 120 Not Repaired
Bad LBA: 228628921 Not Repaired
Bad LBA: 228629042 Not Repaired
Long Generic - FAIL 08/07/2012 08:21:29
SeaTools Test Code: A6D2D9D4
Long Generic - Started 08/07/2012 13:18:23
Bad LBA: 0 Not Repaired
Bad LBA: 121 Not Repaired
Long Generic - FAIL 08/07/2012 17:25:29
SeaTools Test Code: A6D2D9D4

Could the external drive be the reason for the problems? I'd disconnect it just to make sure, but seeing as sometimes I can go 10 days without a BSOD, I'm not sure how reliable that would be.

edit: Also, here are the reports of 2 new crashes. Second one happened while I was running sfc /scannow, it was in the verification stage. After that I disconnected the external HDD just in case. I'll restart sfc /scannow now. Not attaching a health report as I figure those are getting redundant. Tell me if I should keep posting them.

edit2: Alright, I got chkdsk to run for C: on my second attempt, this is what I got from Event Viewer:

CHKDSK is verifying files (stage 1 of 5)...
Cleaning up instance tags for file 0x1ad73.
887552 file records processed. File verification completed.
1291 large file records processed. 0 bad file records processed. 2 EA records processed. 74 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
981396 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
887552 file SDs/SIDs processed. CHKDSK is compacting the security descriptor stream
Cleaning up 2719 unused security descriptors.
46923 data files processed. CHKDSK is verifying Usn Journal...
37571664 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
887536 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
127439054 free clusters processed. Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

976657407 KB total disk space.
465693176 KB in 383035 files.
186116 KB in 46926 indexes.
0 KB in bad sectors.
1021899 KB in use by the system.
65536 KB occupied by the log file.
509756216 KB available on disk.

4096 bytes in each allocation unit.
244164351 total allocation units on disk.
127439054 allocation units available on disk.

Internal Info:
00 8b 0d 00 90 8f 06 00 4b 60 0b 00 00 00 00 00 ........K`......
10 37 00 00 4a 00 00 00 00 00 00 00 00 00 00 00 .7..J...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

Finally, some test turns up something. After that was done, I woke up to find an error waiting for me:

Faulting application name: sdiagnhost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc3d4
Faulting module name: mscorwks.dll, version: 2.0.50727.5456, time stamp: 0x4ef6c091
Exception code: 0x80000003
Fault offset: 0x000000000018a6e8
Faulting process id: 0x%9
Faulting application start time: 0x%10
Faulting application path: %11
Faulting module path: %12
Report Id: %13

Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: sdiagnhost.exe
P2: 6.1.7600.16385
P3: 4a5bc3d4
P4: mscorwks.dll
P5: 2.0.50727.5456
P6: 4ef6c091
P7: 80000003
P8: 000000000018a6e8
P9:
P10:

Attached files:

These files may be available here:
C:\Users\user\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_sdiagnhost.exe_babb8fffddf9ba44901a5d8b5c9a63362eb3f12_120d6126

Analysis symbol:
Rechecking for solution: 0
Report Id: 91ef884a-c945-11e1-9e5d-00252246893b

The PC seems fully functional though. I suppose from now on, I keep running Chkdsk till it stops turning up errors, then fix that stuff with sfc?

 

[writhziden]

Yes, the external drive could be the cause of problems if it was connected at the time of each incident. Also, the corrupted file system could also have caused issues. I had some problems over the weekend due to a corrupted file system that was resolved with a disk check.

Did SFC /SCANNOW find anything? sdiagnhost.exe is a system process, so that is concerning. It may indicate Windows corruption, a damaged registry, or even malware/viruses on the system.

WARNING: Do not try to repair the registry with a registry cleaner. They do more harm to the registry than they actually repair. CCleaner is the only one that I somewhat trust, and even that should be used sparingly.​

 

[Akron]

I did a second Disk Check in the meantime, which turned up clean, so that's something. SFC /SCANNOW found nothing, but the problem with sdiagnhost.exe hasn't reappeared after a couple of restarts. I did get a "Desktop Window Manager has stopped working." message at some point which seemed to affect nothing at all, but random Windows errors are this stage are still cause for concern I guess.

edit: Another crash, a newer, more specific error this time.
According to the internet a 0xD1 dxgmms1.sys error is notoriously a driver problem with nVidia. It does make sense, come to think of it, I hadn't updated my drivers in some time and the timing after I did isn't that far off. I'll reinstall directX, rollback the drivers and take it from there.

Is there a recommended way to reinstall directX? I'm not too sure about all those programs circulating the web. Installed an older version of the nVidia drivers for now.

Attaching the latest dump files.

 

[Akron]

...and another one. Nothing so far seems to have helped, I'm contemplating just formatting the thing. I suppose the ISOs from digitalrivercontent.net are the way to go? I have an original key, but not the installation disc.

edit: Another one with a new error this time, 0x7E, cdd.dll

 

[writhziden]

In regards to DirectX: Download: DirectX SDK - (June 2010) - Microsoft Download Center - Download Details

For the clean re-install: http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

Before you do the clean re-install, please download and install CPU-Z and Upload screenshots of the CPU, Mainboard, Memory, and SPD tabs. In the SPD tab, upload an image of each slot.

 

[Akron]

Here you go.
Possibly off-topic: I notice in the screenshots the ram frequency is listed at 668mhz, that's low compared to what it should be according to Corsair.

 

[writhziden]

Those are slightly off from what is recommended for your processor, but they should be fine.

Also, the 1333 given for the RAM means when they are in dual mode. They operate at 667 MHz as single modules and 1333 in Dual. CPU-Z picks up what they run at in single and does not multiply for Dual, but it shows that they are operating in Dual, so they are running at 1333. Your processor cannot handle anything over that:
AMD Phenom

System Building and Compatibility

AMD Memory for Systems

 

[Akron]

Well, there's something I learned today. Anyway, now what? I guess I'll prepare my backups and stuff for formatting, then throw a last ditch effort with driver verifier?

 

[writhziden]

Yes, now we test the drivers to see if they are causing any problems. Let Verifier run for 24-36 hours and then upload any new crash reports at that time.

 

[Akron]

Alright, let the verifier run for ~30 hours, got 5 crashes to report. Attaching as usual.


edit: Actually, I think I've found the culprit. When I rolled back the nVidia drivers previously, I skipped installing the audio component, seeing as I wasn't using it anyway. It looks like Windows Update had a different idea, so it updated the drivers for it, to the newest, suspected faulty, version. I have since done another clean reinstall, including the audio component for the old drivers. The PC seems to be stable. I left it running all night and day with Windows Media Player playing music (though turned off speakers) and Media Player Classic running videos, which seemed to be its favorite activity during which to crash (although it might be coincidental, I do watch a lot of stuff) and ~24 hours later, I have no crashes or other errors of any kind to report.

I'm saying all this with restrained confidence, of course. Would running driver verifier for another 24 hours or so be guaranteed to not crash the PC if all problems are resolved? I might do just that, to make sure.