Solved BSoD at random times, error 0x000000C4 (STOP): Ntfs.sys

[Berbe]

Hello,

I have been encountering some BSoD trouble in the recent past.
In the most recent crashed, the Ntfs.sys filename appeared on the BSoD (it was previously some other one).

Following, the BSoD Analysis tutorial, I grabbed the following information during the inspection of the most recent DMP file:

1. The initial 'Probably caused by' source was the ntoskrnl.exe binary
2. No analysis was available through '!analysis -v'
3. Having activated the 'Driver verifier', I restarted normally. The login screen appeared, but when I logged in, another BSoD appeared, but the dump didn't work (stuck, I rebooted forcefully). Still the Ntfs.sys file
4. I restarted again in normal mode, letting the system finish to work on the HDD (the little light stopped flashing intensively). When I logged, BSoD as before. Still the Ntfs.sys file
5. I restarted in Safe Mode, then I could log in without problem. No new DMP file existed in the Minidump directory, proof that the dump indeed didn't work at all.
6. I downloaded, burned and rebooted on the MemTest86+ software, making only 1 pass on the whole RAM, without error. I stopped there because I already have enough suspicions about some other hardware component...
7. Having rebooted under normal mode, I am now running Prime95, if by any chance that's useful...

Following what I encountered, I have strong evidence against my filesystem and maybe my HDD:

1. The system's filesystem driver crashes (Ntfs.sys)
2. When the verifier has been activated the system is unable to write to the disk (that's in coherence with a filesystem's crash: no access to it)
3. Filesystem is one of the most immediate thing used, the crash at login time probably means that an early faulty action has been done

I am still unsure about what precisely caused the error. It doesn't appear at boot time, not even at logon but at login. The OS has already made plenty of accesses and loaded a lot of stuff. It would mean something happens/is loaded in user space to trigger the error.


Is the filesystem or one of the HDD the source of the problem? Does a format would be useless/usefull? That's kinda huge thing to do, I do not want to waste time if it doesn't change anything.


In case this comes from the filesystem, here is some new information:
I defragmented my whole disks a few days ago, and I ran a 'chkdsk /f' on them after the first following Ntfs.sys BSoD. It seems some little space were in error, but I never launched that command before.
Would it be more of some faulty system's HDD (or the other one's) segment? Or kind of corrupted files on it?


I'd take any help and carefully weight advice

 

[koolkat77]

Hi.

There are a few tools that can help us see the health status of the hard drive. Please do the following:

Perform a clean boot:

• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Upload a screenshot of your hard disk using CrystalDiskInfo:

• CrystalDiskInfo - Software - Crystal Dew World
• http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

Make a hard drive test from the hard drive manufacturers website:

• Hard Drive Diagnostic Procedure

Hard drive test both short and long with:

• SeaTools for Windows

Seatools for DOS as well:

• SeaTools for DOS
• SeaTools for DOS tutorial

A screenshot of the "Summary" tab of Speccy will also be useful:

• Speccy - System Information - Free Download

:tip:NTFS errors can also be caused by VIRUS and ANTIVIRUS software.

What antivirus do you use?​

Please upload your msinfo32.nfo file. To get this: Start Menu -> Type msinfo32 into the Search programs and files box -> When it opens, go to File, Save -> Save as msinfo32.nfo and save in a place you will remember -> Let it finish the process of gathering and saving the system info -> Right click the .nfo file, click send to compressed (zipped) folder -> Upload the .zip file here.

Please upload your msinfo32.txt file. To get this: Start Menu -> Type msinfo32 into the Search programs and files box -> When it opens, go to File, Export -> Save as msinfo32.txt and save in a place you will remember -> Let it finish the process of gathering and saving the system info -> Right click the .txt file, click send to compressed (zipped) folder -> Upload the .zip file here.

Perform a System File Check:

1. Click on the start rb:
2. Type CMD on Search
3. Left click and Run as Administrator
4. Type SFC /scannow

Full tutorial here:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Configure for Small Memory Dumps following this tutorial:

• http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html
  

Make scans with the following:

-Kaspersky TDSSKiller

• Anti-rootkit utility TDSSKiller

-ESET online scanner

• Free Online Virus Scanner | ESET

Look forward to the results.

:warn: If Driver verfier is enabled, please disable it for now.

 

[Berbe]

I took note of all that.

I already tried a few steps:

1. I configured Windows to make a clean boot (without startup software) and I reactivated drivers verifier to check if the BSoD was still happening. Good news: it doesn't. Seems maybe the problem came from somewhere else
2. I downloaded and installed CrystalDiskInfo and exported the informatio nfrom it. Lighter then pictures, I copied data with the provided function (Edit > Copy) to make a text file with all the information. You'll find that as attachement
3. I configured Windows to make small memory dumps and not kernel memory dumps anymore. I'll check information in those dumps at the next occurrence of a BSoD
4. I downloaded the drive testing utility from Seagatefor my HDD. I burned it and I am about to start the test

However, I am a bit reluctant to provide you with my msinfo32.txt file as is, since it contains basically a lot of personal information. Maybe am I paranoid, I have my own reasons. Is there a special part in it that is of your interest and that I could extract for you?


I am using the free Comodo antivirus, shipped with its Defense+ applications monitoring system. It has sometimes proved being a little intrusice, it's one of the leads to follow...
The AV is up-to-date, of course.

 

[koolkat77]

The text file is hard to read. Can you please upload a snip?

As for .nfo. Don't worry there's no personal information there.

I need to see the list of installed programs so I can rule out some problematic ones.

Here's mine.

 

[Berbe]

I have been doing some work

1. I ran the SeaTool's 'Long test' on my Seagate primary drive (where the OS is installed). No error at all.
   Since it took 1h 1/2, I didn't make the check for the other HDD. I install all my applciations on the first one anyway, the second one is storage.
2. I discovered something very interesting about the BSoD on boot with the drivers verifier: if I startup with every application and all services but one, the BSoD disappears. Then I activated that service only and deactivated all startup programs and other services and the BSoD came back.
   The service is called ASLDR and it is the program from ASUS which captures hotkeys. No dump has ever been made with those ones.
3. I then used the whole day to seek on the ASUS support website every last version of every driver (the ones listed for my computer are old, probably the ones available when the model went out).
4. I tried again with the verifier but with the very same service triggers the very same behavior.
   I just can't remove that service, or the vast majority of my keyboard shortcuts (screen luminosity, sound volume, keyboard lightning, diaporama mode, touchpad toggle, etc.) don't work anymore.
   When booting without the service with the verifier, I tried something funny: going in the directory of the service binary and start it manually... Immediate BSoD, the same as before again.

The problem doesn't seem to be hardware anymore, but rather comes from some collision between the driver and something else. More seriously, I am really considering the ASLDR service driver to be crappy-coded...

You'll find the CrytalDiskInfo snapshot and a msinfo32 file attached

 

[Berbe]

Using my computer, I just triggerad a new BSoD, this time generating a small memory dump.

WinDBG says the probable responsible component could be 'GenuineIntel'. :shock:
No analysis available, could tell which driver were the cause, but I don't believe the processor to be responsible for that ;o)

Dumpe + sysinfo (both file generated at crash time) available as attachement.

 

[koolkat77]

Well. That is a hardware error and I'd suggest you to go through this thread:

• http://www.sevenforums.com/crash-lockup-debug-how/35349-stop-0x124-what-means-what-try.html

Will be getting back with a few steps.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 124, {4, fffffa80041a0038, 0, 0}

Probably caused by : GenuineIntel

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 0000000000000004, PCI Express Error
Arg2: fffffa80041a0038, Address of the WHEA_ERROR_RECORD structure.
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x124_GenuineIntel

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  b

STACK_TEXT:  
fffff880`033fba78 fffff800`03615a3b : 00000000`00000124 00000000`00000004 fffffa80`041a0038 00000000`00000000 : nt!KeBugCheckEx
fffff880`033fba80 fffff800`031a7b13 : 00000000`00000001 fffffa80`0417cb10 00000000`00000000 fffffa80`0417c1b0 : hal!HalBugCheckSystem+0x1e3
fffff880`033fbac0 fffff880`0119dbcf : fffffa80`00000750 fffffa80`0417cb10 00000000`00000000 fffffa80`0419f010 : nt!WheaReportHwError+0x263
fffff880`033fbb20 fffff880`0119d5f6 : 00000000`00000000 fffff880`033fbc70 fffffa80`04161d80 fffff980`09641000 : pci!ExpressRootPortAerInterruptRoutine+0x27f
fffff880`033fbb80 fffff800`03095e1c : fffff880`033d3180 fffff880`033fbc70 fffffa80`04161d80 00000690`4ecbec01 : pci!ExpressRootPortInterruptRoutine+0x36
fffff880`033fbbf0 fffff800`03091ca2 : fffff880`033d3180 fffff880`00000001 00000000`00000001 fffff880`00000000 : nt!KiInterruptDispatch+0x16c
fffff880`033fbd80 00000000`00000000 : fffff880`033fc000 fffff880`033f6000 fffff880`033fbd40 00000000`00000000 : nt!KiIdleLoop+0x32


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: GenuineIntel

IMAGE_NAME:  GenuineIntel

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  X64_0x124_GenuineIntel_PCIEXPRESS

BUCKET_ID:  X64_0x124_GenuineIntel_PCIEXPRESS

Followup: MachineOwner
---------

 

[koolkat77]

So here are a few:

Uninstall the following software:

[LIST=1]
[*]Start Menu\Programs\COMODO	Public:Start Menu\Programs\COMODO	Public
[*]Start Menu\Programs\COMODO\COMODO Antivirus	Public:Start Menu\Programs\COMODO\COMODO Antivirus	Public
[/LIST]

Comodo Internet Security is not the best protection software.

Please uninstall it with Revo Uninstaller Free (In advanced mode so you can delete leftover registry entries)

• Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

Daemon Tools:

[LIST]
[*]Start Menu\Programs\DAEMON Tools Lite	Public:Start Menu\Programs\DAEMON Tools Lite	Public
[/LIST]

Please uninstall DAEMON Tools. It uses a driver called sptd.sys which is known to cause BSODs in Windows 7. Uninstall the software using Add/Remove Programs. Reboot the system. Once the program is uninstalled, run sptd.sys uninstaller to remove the driver from your system.

As an alternative, many people recommend the use of Total Mounter or Magic ISO

Microsoft Security Essentials.

Recommended from a strict BSOD perspective, compatibility & stability compared to other antiviruses/internet security software. It is free and lightweight:-
​

• Microsoft Security Essentials - Free Antivirus for Windows
  
  • Malwarebytes : Malwarebytes Anti-Malware removes malware including viruses, spyware, worms and trojans, plus it protects your computer
    • http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

   Warning

:ar: Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Reduce items at start-up. Nothing except anti-virus is required:

• http://www.sevenforums.com/tutorials/1401-startup-programs-change.html
• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

I hope you have already started following steps in the 124 thread, you will also have to check for a BIOS update:

Version du BIOS/Date	American Megatrends Inc. 207, 25/12/2009

A "stop 0x124" is fundamentally different to many other types of bluescreens because it stems from a hardware complaint.

Stop 0x124 minidumps contain very little practical information, and it is therefore necessary to approach the problem as a case of hardware in an unknown state of distress.

You can read more on this error and what to try here... Stop 0x124 - what it means and what to try http://www.sevenforums.com/crash-lockup-debug-how/35349-stop-0x124-what-means-what-try.html

Let us know your feedback.

 

[Berbe]

Comodo Internet Security is not the best protection software.

I wonder where you get that assumption from...

Basically, antivirus can't work by design, and if you ever got interested in the internals, in the constraints under which antivirus must work, you'd probably come to the same conclusion.

Comodo is actually a nice one, the best I ever used so far.
It is not magical, but I am satisfied with its efficiency, and it has a nice feature called Defense+, making premptive check on applications access requests and asking for your decision when its heuristics find those suspicious.
It's well balanced between intrusiveness and efficiency, as opposed to other AV I tested in the past, either useless (Avast, Symantec), heavy/slow/unefficient (Kaspersky), etc.

Plus, I don't believe Microsoft is a reference in the virus fight, it needs special skills and a high level of technicity. That's just not their field of expertise.
You'd think their major advantage is to comply perfectly to the specifications on the drivers level, but sometimes... you could be surprised.

=====

I reached another milestone in the trouble tracking.

I removed Comodo/Daemon Tools, I made sure the SPTD driver was removed by using the official SPTD driver tool to uninstall it and I rebooted.
I then triggered again the BSoD by starting the game I used to force the BSoD appearance (always happens in the following minutes). I am 'lucky' to be able to trigger it 'not that randomly'.
It crashed again.

I hope you have already started following steps in the 124 thread, you will also have to check for a BIOS update:

Version du BIOS/Date    American Megatrends Inc. 207, 25/12/2009

You were right. I thought I had the last version, but I had 207, the latest was 208.
I updated my BIOS, made a complete power discharge (removed battery, emptied condensator, waiting a bit).

I then rebooted and tried that game... Haven't crashed so far. I'll try it a bit later to see if I can trigger the BSoD again. If I can't, I'll reinstall removed software and continue to test regularly. I'll keep you posted of the evolution on that point.

I also tried the verifier again. The ASLDR drive still produces a BSoD at login, one without any dump at all (that I told you about before). But when I start without that driver or without the verifier running, everything runs fine.
I can't remove it because that's the interface managing my Fn+* keys and it's already up-to-date. I guess we're stuck here.

Thanks for your help koolkat77, it has been appreciated very much.
I hope I'll be able to avoid seing that frightening screen in the near future.

 

[koolkat77]

I hope I'll be able to avoid seing that frightening screen in the near future.

Lets hope so.

 

[Vir Gnarus]

Just to add, the WHEA crashdump said it was a PCI-E bus issue:

Use !analyze -v to get detailed debugging information.

BugCheck 124, {4, [COLOR=Green]fffffa80041a0038[/COLOR], 0, 0}

TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
Probably caused by : GenuineIntel

Followup: MachineOwner
---------

3: kd> [COLOR=Blue]!errrec[/COLOR] [COLOR=Green]fffffa80041a0038[/COLOR]
===============================================================================
Common Platform Error Record @ fffffa80041a0038
-------------------------------------------------------------------------------
Record Id     : 01cdeb974d9c14a6
Severity      : Fatal (1)
Length        : 672
Creator       : Microsoft
Notify Type   : [COLOR=Red]PCI Express Error[/COLOR]
Timestamp     : 1/6/2013 0:07:22 (UTC)
Flags         : 0x00000000

===============================================================================
Section 0     : PCI Express
-------------------------------------------------------------------------------
Descriptor    @ fffffa80041a00b8
Section       @ fffffa80041a0148
Offset        : 272
Length        : 208
Flags         : 0x00000001 Primary
Severity      : Recoverable

Port Type     : Root Port
Version       : 1.1
Command/Status: 0x0010/0x0407
Device Id     :
  VenId:DevId : 8086:d138
  Class code  : 030400
  Function No : 0x00
  Device No   : 0x03
  Segment     : 0x0000
  Primary Bus : 0x00
  Second. Bus : 0x00
  Slot        : 0x0000
Dev. Serial # : 0000000000000000
Express Capability Information @ fffffa80041a017c
  Device Caps : 00008021 Role-Based Error Reporting: 1
  Device Ctl  : 0107 ur FE NF CE
  Dev Status  : 0003 ur fe NF CE
   Root Ctl   : 0008 fs nfs cs

AER Information @ fffffa80041a01b8
  Uncorrectable Error Status    : 00014000 ur ecrc mtlp rof [COLOR=Red]UC [/COLOR]ca [COLOR=Red]CTO [/COLOR]fcp ptlp sd dlp und
  Uncorrectable Error Mask      : 00000000 ur ecrc mtlp rof uc ca cto fcp ptlp sd dlp und
  Uncorrectable Error Severity  : 00062010 ur ecrc MTLP ROF uc ca cto FCP ptlp sd DLP und
  Correctable Error Status      : 00002000 ADV rtto rnro dllp tlp re
  Correctable Error Mask        : 00000000 adv rtto rnro dllp tlp re
  Caps & Control                : 0000000e ecrcchken ecrcchkcap ecrcgenen ecrcgencap FEP
  Header Log                    : 00000000 00000000 00000000 00000000
  Root Error Command            : 00000000 fen nfen cen
  Root Error Status             : 00000000 MSG# 00 fer nfer fuf mur ur mcr cer
  Correctable Error Source ID   : 00,00,00
  Correctable Error Source ID   : 00,00,00

===============================================================================
Section 1     : Processor Generic
-------------------------------------------------------------------------------
Descriptor    @ fffffa80041a0100
Section       @ fffffa80041a0218
Offset        : 480
Length        : 192
Flags         : 0x00000000
Severity      : Informational

Proc. Type    : x86/x64
Instr. Set    : x64
CPU Version   : 0x00000000000106e5
Processor ID  : 0x0000000000000003

This is a typical hardware problem. UC means Unexpected Completion caused by the CTO - Completion Timed Out. It means a communication completion got timed out for some reason, most likely because it didn't reach its destination. I've seen this happen from dust and other debris inside PCI/PCI-E ports, cards not sitting properly in their port, PSU problems, a bad PCI/PCI-E card, or a bad motherboard. Unfortunately, it cannot - or at least I can't decipher from it - what device(s) were involved. If you still end up experiencing issues with this, you can try considering fixing any of the aforementioned causes listed. Otherwise, hope everything turns out well for ya.

 

[Dave76]

Just a quick suggestion, you have found a driver fault, ASLDR, which is a driver for your keyboard F functions.
The windows debugger usually can't find the exact (pinpoint) problem, you have to use it to explore the direction it is indicating. It gives you hints as where to look, which is where the analyses comes in.
As Vir Gnarus has found, it's a hardware problem. This type of cause is very difficult for the debugger to locate, as it's better at finding software and driver issues.
There is a possibility that the keyboard is causing the crashes.
Easy to test on a desktop and very difficult on a laptop, an external keyboard won't disable the laptop keyboard.

Whenever I see a laptop with an i7 CPU and discrete graphics card, you have to look into CPU/system overheating, which is the number 1 cause of crashes on these laptops.
Use Real Temp , to check the CPU temps when at idle, under load and/or testing.
Let us know the minimum and maximum temps you get.

Since you didn't give us your System Event Logs, you can look through them for any CPU thermal issues. This is the best way to determine if they are involved in your crashes.

 

[Vir Gnarus]

Yes, this doesn't rule out the keyboard for sure and may implicate it, or at least the USB port it's connected too, since USB commonly runs through the PCI-E bus on OEM systems, especially on laptops.

 

[Berbe]

A few days went by, I reinstalled Deamon Tools and my antivirus.
I am stil lable to run the 'problem-triggering' game without any BSoD anymore...

So all that for a BIOS update. That's a bit disappointing though :huh:

Thanks a lot for your help, again
Problem solved

 

[Dave76]

Glad to hear your system is stable.

Thanks for letting us know.