Solved blue screen errors "NTFS file system / system service exception

[PartyFerret]

Hello, receiving random different BSODs:

NTFS_FILE_SYSTEM
SYSTEM_SERVICE_EXCEPTION
MEMORY_MANAGEMENT
CRITICAL_STRUCTURE_CORRUPTION



Details:

Sony Vaio VPC-EH3J1E

Intel Core i3 2350M @ 2.30 GHz

4.00 GB RAM

Windows 7 Home Premium x64

So far I have tested the HDD with 3 different testing tools (CrystalDisk, SamsungHDDTool, and ToolstarHDD Test. All passed. RAM Test has also passed on a 5 pass run. Mainboard was changed in the Notebook last week under Guarantee. What else could this be? Any help is appreciated.

Thanks.




Laptop, only the power suppy connected. RAM tested with Memtest86+ (7pass) and it passed. Mainboard replaced, Hard drive tested with CHKDSK, SamsungHDDTool, and Toolstar HDD Test. Recovery of the system is not possible because the device is a guarantee case and the customer does not want to lose his data. I am able to boot to the desktop. The bluescreens are sporadic. No new software or hardware has been added to this laptop in the last 24 hours. The customer says that he does not add any external hardware devices to the laptop when he uses it. The laptop is only 3 months old.

I have downloaded and installed ALL drivers from the Sony Vaio support site. After the first restart, I was thrown another 2 BSODs: SYSTEM_SERVICE_EXCEPTION (0x0000003B) and SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (0x1000007E). So far the following work has been done on this notebook:

1. Mainboard replaced
2. RAM Test with Memtest86+ passed
3. Test RAM used: passed
4. Drivers updated (all)
5. Hard Drive tested with 3 different tools: all passed
6. Test Hard Drive used: passed
7. Drivers updated (all) again

It's still throwing BSODs. There are no open service/problem report bulletins on the Sony Vaio support site about this make and model notebook. Recovery is not possible. We are not authorized to format the hard drive from the customer.

 

[Arc]

Hello PartyFerret.

According to Carrona.org, STOP 0x00000109: CRITICAL_STRUCTURE_CORRUPTIONhttp://www.carrona.org/bsodindx.html#top
Usual causes: Device driver, Breakpoint set with no debugger attached, Hardware (Memory in particular)

Enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

Let us know the results.

 

[PartyFerret]

Memory? I ran Memtest86+ 3 times for 9 passes each time. No errors found. Impossible that Memory is the cause. Even with test stick of the same RAM (same brand, same size, same speed) the BSODs still appeared. RAM can be removed from the list of possible causes. Hard Drive was also tested with 3 different tools multiple times, all passed. I would assume that there is a troublesome driver installed, but this would mean that the drivers provided by Sony are failure-prone. Drivers have been re-installed twice and updated twice, BSODs still remain.

 

[Golden]

crash dump file: E:\Debug4\010213-17908-01.dmp
uptime: 00:05:58
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0) 
Bugcheck code: 0x109 (0xA3A039D895F035F9, 0xB3B7465EE86D054F, 0xFFFFF80002F0FEA0, 0x1)
Error: CRITICAL_STRUCTURE_CORRUPTION
Bug check description: This indicates that the kernel has detected critical kernel code or data corruption.
This might be a case of memory corruption. [B]More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.[/B] 
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

Driver verifier is then your next step, as suggested by Arc.

 

[PartyFerret]

Back to square one again, sadly. Maybe this time since I have more information packed into the Zip file someone can find some kind of resolution. System crashed again with "Modification of system code or a critical data structure was detected." In Whocrashed it says IRQL_NOT_LESS_OR_EQUAL code 0x109.

 

[Arc]

A verifier enabled minidump is also silent about the drivers.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff9800c294ba8, 2, 0, fffff8000376f2b9}

Probably caused by : ntkrnlmp.exe ( nt!ViPendingCompleteAfterWait+49 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff9800c294ba8, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8000376f2b9, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034fd100
GetUlongFromAddress: unable to read from fffff800034fd1c0
 fffff9800c294ba8 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!ViPendingCompleteAfterWait+49
fffff800`0376f2b9 488baeb8000000  mov     rbp,qword ptr [rsi+0B8h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff880035249f0 -- (.trap 0xfffff880035249f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=fffffa8007e72c10
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000376f2b9 rsp=fffff88003524b80 rbp=0000000000000080
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000001
r11=fffffa8003cbafe2 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!ViPendingCompleteAfterWait+0x49:
fffff800`0376f2b9 488baeb8000000  mov     rbp,qword ptr [rsi+0B8h] ds:00000000`000000b8=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032cd569 to fffff800032cdfc0

STACK_TEXT:  
fffff880`035248a8 fffff800`032cd569 : 00000000`0000000a fffff980`0c294ba8 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`035248b0 fffff800`032cc1e0 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`07e72c10 : nt!KiBugCheckDispatch+0x69
fffff880`035249f0 fffff800`0376f2b9 : 00000000`00000000 fffffa80`07e72c10 00000000`00000080 00000000`00000000 : nt!KiPageFault+0x260
fffff880`03524b80 fffff800`0376f36c : fffff800`03473d60 00000000`00000080 fffffa80`03cf6740 59eadb49`00000000 : nt!ViPendingCompleteAfterWait+0x49
fffff880`03524bc0 fffff800`03564e5a : 00000000`ffffffff cd21544c`00000004 fffff8a0`00021c10 fffff8a0`00021c10 : nt!ViPendingWorkerThread+0x2c
fffff880`03524c00 fffff800`032bed26 : fffff880`009ea180 fffffa80`03d21660 fffff880`009f4fc0 fffff8a0`03d79420 : nt!PspSystemThreadStartup+0x5a
fffff880`03524c40 00000000`00000000 : fffff880`03525000 fffff880`0351f000 fffff880`035248d0 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ViPendingCompleteAfterWait+49
fffff800`0376f2b9 488baeb8000000  mov     rbp,qword ptr [rsi+0B8h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!ViPendingCompleteAfterWait+49

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

FAILURE_BUCKET_ID:  X64_0xA_VRF_nt!ViPendingCompleteAfterWait+49

BUCKET_ID:  X64_0xA_VRF_nt!ViPendingCompleteAfterWait+49

Followup: MachineOwner
---------

Scan the system for possible virus infection.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight. We need the report that it is clean. Also I am asking the hardware experts to see if your hardware is compatible are not. Fill up your system specs.
See your system specs and fill it up here.

Run SFC /SCANNOW Command - System File Checker

Let us know the results.

 

[PartyFerret]

Memtest: Done three times more than 7 passes each time, no errors

System File Checker: Done twice, no integrity violations found.

I will test the Anti-rootkit software from Kaspersky and see what it turns up.

 

[PartyFerret]

Windows Defender offline: Nothing found
Kaspersky Rootkit checker: nothing found

System file checker: nothing found

 

[Golden]

I'm taking a guess here, but could this be CPU - related???

Have you tried stress testing the CPU?
http://www.sevenforums.com/tutorials/220743-cpu-stress-test-using-intelburntest.html

 

[PartyFerret]

Ran Prime95 with CoreTemp open yesterday for 5 hours. Temps were excellent. Also as a second test, I ran Intel's Processor Diagnostic Utility and it turned up perfect.

 

[Arc]

OK. Disable verifier now, and use the computer normally. If you get one more crash, let us see it.

 

[PartyFerret]

So I tested the CPU with the IntelBurn test and it passed. Did exactly as in the link to restart into verifier mode. After the restart, Windows hangs at the "Starting Windows" screen where it has been for the last 30-45 minutes and does nothing.

 

[PartyFerret]

new crash:IRQL_NOT_LESS_OR_EQUAL 0x0000000a. Working on getting the crash dump packed into a zip.

 

[PartyFerret]

Couldn't get the thing to start in normal mode, but at least got into safe mode to get the minidump. Anything else with the minidump tool I was unable to get because of the lack of the Netframework.

 

[Arc]

Disable Driver verifier as stated earlier. It is not of any more help as it is seen.

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  [COLOR=Red]VERIFIER_ENABLED_VISTA_MINIDUMP[/COLOR]

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

Try to update the following drivers:
Atheros network adapter driver: ATHEROS drivers for Microsoft Windows (Atheros?????)
Atheros Bluetooth Driver: ATHEROS drivers for Microsoft Windows (Atheros?????)
Conexant High Definition SmartAudio: Conexant - Support
Intel Management Engine Interface: Intel Download Center
Intel rapid Storage driver: http://downloadcenter.intel.com/Detail_Desc.aspx?agr=Y&ProdId=2101&DwnldID=21730&ProductFamily=Software+Products&ProductLine=Chipset+Software&ProductProduct=Intel%C2%AE+Rapid+Storage+Technology+%28Intel%C2%AE+RST%29&lang=eng
nVidia Video drivers: Drivers - Download NVIDIA Drivers
Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC: Realtek
Microsoft Application Virtualization (App-V) driver: Application Virtualization by Microsoft | Windows 8 Enterprise

 

[Pauly]

Does machine BSOD in safe mode ?
if not you could try a clean boot http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html to remove all startup items and all non MS services, its a long shot but worth a try IMO

Also you have stressed cpu how about gfx and that has ram too ?
http://www.sevenforums.com/tutorials/100356-video-card-stress-test-furmark.html

 

[Dave76]

Looks like a stubborn one.

Blue Screen of Death (BSOD) Posting Instructions
When posting a new crash dump, include all System File Collection and health reports. They contain valuable information that we can use to find the cause of the crashes. Each crash report will contain new information that will be useful.

Run the OCCT stability test, at the end it will produce graphs that may give some clues .
OCCT stability checking tool
Run the CPU:OCCT test for at least 30 minutes, be sure to monitor your CPU and GPU temps.
Set the time before you start.
When its done, pass or fail, it will make some graphs. Post these here as they are useful for analyses.

Which Intel RST driver are you using?
If it's not v11.2.0.1006 or earlier, install v11.2.0.1006. there have been known issues with drivers after that version.
Intel Rapid Storage Technology 11.2.0.1006

Hardware can be very fickle, it does happen that a component will pass tests several times and then fail, especially RAM and to a lesser extent hard drives.
If the RST driver doesn't help, you may consider installing a different HDD and testing the system. That way the clients HDD and programs won't be disturbed.

If allowed, remove all Sony utilities, these types of programs are known to crash systems.

From old System Events logs:

Event[34981]:
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: [COLOR="Red"]2012-12-06[/COLOR]T14:55:40.622
  Event ID: 26
  Task: N/A
  Level: Informationen
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT-AUTORITÄT\SYSTEM
  Computer: Henning-VAIO
  Description: 
Prozessor 3 in Gruppe 0 weist Folgendes auf:

2 inaktive Zustände
7 Leistungszustände
[COLOR="red"]8 Drosselungszustände[/COLOR]

Event[34982]:
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2012-12-06T14:55:41.590
  Event ID: 89
  Task: N/A
  Level: Informationen
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT-AUTORITÄT\SYSTEM
  Computer: Henning-VAIO
  Description: 
[COLOR="red"]Die ACPI-Thermozone ACPI\ThermalZone\THRM wurde aufgelistet. [/COLOR]            
_PSV = 374K             
_TC1 = 2             
_TC2 = 5             
_TSP = 1000ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 357K             
_HOT = 0K             
_PSL - siehe Ereignisdaten.

Need the current System Event Logs to confirm.
This system has been overheating in the past.

The last Event Log entry was 2012-12-06, check setting, Clear Log if no new event are recorded.
To check the System Event Log settings.
1. Start Event Viewer.
2. In the console tree, expand Windows Logs and select System.
3. On the Action menu, click Properties.
4. In the General Tab, ensure 'Enable logging' is checked.
Maximum log size should be 20480
Under 'When maximum event log size is reached': select 'Overwrite events as needed (oldest events first)'
Click OK.

If you are still not getting new System Event Logs, you can 'Clear Log' on the same page.

Can you translate this Critical Event:

Event[34976]:
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2012-12-06T14:55:39.671
  Event ID: 41
  Task: N/A
  Level: Kritisch
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT-AUTORITÄT\SYSTEM
  Computer: Henning-VAIO
  Description: 
Das System wurde neu gestartet, ohne dass es zuvor ordnungsgemäß heruntergefahren wurde. Dieser Fehler kann auftreten, wenn das System nicht mehr reagiert hat oder abgestürzt ist oder die Stromzufuhr unerwartet unterbrochen wurde.

There are 48 items in the Start Menu, you should remove most of these and/or have them start at login.

Uninstall McAfee, it is known to cause crashes in Windows 7. Use MSE for testing.

Event[34726]:
  Log Name: System
  Source: Service Control Manager
  Date: 2012-12-06T11:17:51.889
  Event ID: 7036
  Task: N/A
  Level: Informationen
  Opcode: N/A
  Keyword: Klassisch
  User: N/A
  User Name: N/A
  Computer: Henning-VAIO
  Description: 
Dienst "[COLOR="Red"]McAfee Scanner[/COLOR]" befindet sich jetzt im Status "Beendet".

From your App Event Log (which are up to date):
This is a CPU error, usually caused by overheating.
A lot of these.

Event[18373]:
  Log Name: Application
  Source: Microsoft-Windows-WMI
  Date: 2013-01-17T09:31:51.000
  Event ID: 10
  Task: N/A
  Level: Fehler
  Opcode: N/A
  Keyword: Klassisch
  User: N/A
  User Name: N/A
  Computer: Henning-VAIO
  Description: 
Ereignisfilter mit Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" nicht reaktiviert werden aufgrund des Fehlers 0x80041003. Ereignisse können nicht durch diesen Filter geschickt werden, bis dieses Problem gelöst ist.

 

[PartyFerret]

New BSOD: 0x0000000A MEMORY_MANAGEMENT. I could not get the Seven Forums Diagnostic Tool to get all of the logs on my Desktop. I don't know why. I started it as Administrator, but it does not post the logs to the desktop. I got the new minidump and zipped it. OCCT is on a 30 minute test. I'll post results afterwards.

 

[Dave76]

Give the Seven Forums Diagnostic Tool more time to run.

Change the Intel RST driver to v11.2.0.1006.

Last crash:
Not much info to go on.

STOP 0x0000001A: MEMORY_MANAGEMENT
Usual causes:  Device driver, memory, kernel
BUGCHECK_STR:  0x1a_5100
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+aec7
FAILURE_BUCKET_ID:  X64_0x1a_5100_nt!_??_::FNODOBFM::_string_+aec7

Need the Event Logs.

 

[PartyFerret]

Done. Here are the OCCT results: