BSOD from ntoskrnl when explorer.exe is open

[Coherent]

Hi,

I've been getting some blue screen errors whilst browsing through explorer, i've run chkdsk /f /r on all my hard drives and no errors show.
It seems to have started after installing some windows update, i've rolled back to an earlier backup but my PC still seems slightly unstable.

Any advice is much appreciated!

Thanks
Ben

 

[Arc]

Hi Coherent.

► Make it sure that the OCZ-AGILITY3 SSD is using the up-to date firmware. OCZ Toolbox: Firmware & BIOS Updates

► Uninstall The ISO Mounter. It is a must.

ITEM|VALUE
Name | ISO Mounter
Manufacturer | Native Instruments GmbH
PNP Device ID | ROOT\SCSIADAPTER\0000
Driver | c:\windows\system32\drivers\niwincdemu.sys (, 109.08 KB (111,696 bytes), 26/08/2013 15:32)

It is failing there, as it is supposed to do. You enabled driver verifier which also identified it as the culprit behind the BSODs.

► Also update JMicron JMB36X Controller from ftp://driver.jmicron.com.tw/SATA_Controller/Windows/. It is old, the date goes back to 2010.

Let us know the results.
___________________________________________________________________________
BSOD ANALYSIS:

BugCheck 50, {fffff8a21ba12688, 0, fffff88001306673, 2}


Could not read faulting driver name
Probably caused by : Ntfs.sys ( Ntfs!NtfsFlushUserStream+53 )

Followup: MachineOwner
-------------------------------------------------------------------------------
BugCheck A, {8, 2, 1, fffff80002ad9296}

Probably caused by : ntkrnlmp.exe ( nt!KiInsertTimerTable+c6 )

Followup: MachineOwner
-------------------------------------------------------------------------------
BugCheck C9, {215, fffff880059d6eab, fffff980076c4e10, 0}

*** WARNING: Unable to verify timestamp for NIWinCDEmu.sys
*** ERROR: Module load completed but symbols could not be loaded for NIWinCDEmu.sys
Probably caused by : NIWinCDEmu.sys ( NIWinCDEmu+9eab )

Followup: MachineOwner
---------

 

[Coherent]

Hi Arc,

Thank you for your input!

The firmware for my SSD was up to date but I have uninstalled the ISO mounter and updated the jmicron driver.

My computer has been stable so far! Hopefully it stays this way

Many thanks
Ben

 

[Arc]

That's a good news, Ben

Let us know how it is working, say after a couple of days

 

[Coherent]

Unfortunately i've just experienced another BSOD.

It was running so smoothly!

 

[Arc]

Ben, can you update the BIOS to the version 1402 dated 2012.08.29?
It is available in SABERTOOTH X58 - Motherboards - ASUS

Also, do some hardware tests .....

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

Stress test the Graphics Card using Furmark.
Video Card - Stress Test with Furmark

Let us know the results.
___________________________________________________________________
BSOD ANALYSIS:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002dcf9e2, fffff8800334d448, fffff8800334cca0}

Probably caused by : ntkrnlmp.exe ( nt!FsRtlOplockIsFastIoPossible+a )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002dcf9e2, The address that the exception occurred at
Arg3: fffff8800334d448, Exception Record Address
Arg4: fffff8800334cca0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!FsRtlOplockIsFastIoPossible+a
fffff800`02dcf9e2 f6426840        test    byte ptr [rdx+68h],40h

EXCEPTION_RECORD:  fffff8800334d448 -- (.exr 0xfffff8800334d448)
ExceptionAddress: fffff80002dcf9e2 (nt!FsRtlOplockIsFastIoPossible+0x000000000000000a)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000200000068
Attempt to read from address 0000000200000068

CONTEXT:  fffff8800334cca0 -- (.cxr 0xfffff8800334cca0)
rax=fffffa80062d1101 rbx=0000000000000000 rcx=fffff8a004fea7d0
rdx=0000000200000000 rsi=0000000000000001 rdi=fffff8800334d910
rip=fffff80002dcf9e2 rsp=fffff8800334d688 rbp=0000000000000001
 r8=0000000000000000  r9=0000000000000001 r10=fffff8800334d720
r11=fffff8800334d640 r12=fffff8a004fea610 r13=fffff8a004fea690
r14=fffffa80062d1370 r15=fffffa80062d1180
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
nt!FsRtlOplockIsFastIoPossible+0xa:
fffff800`02dcf9e2 f6426840        test    byte ptr [rdx+68h],40h ds:002b:00000002`00000068=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000200000068

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cfc100
GetUlongFromAddress: unable to read from fffff80002cfc1c0
 0000000200000068 Nonpaged pool

FOLLOWUP_IP: 
nt!FsRtlOplockIsFastIoPossible+a
fffff800`02dcf9e2 f6426840        test    byte ptr [rdx+68h],40h

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff880012d3e33 to fffff80002dcf9e2

STACK_TEXT:  
fffff880`0334d688 fffff880`012d3e33 : 00000000`00000000 00000000`00000001 00000000`00000001 fffff880`0334d910 : nt!FsRtlOplockIsFastIoPossible+0xa
fffff880`0334d690 fffff880`013ccac3 : fffff880`0334d910 fffffa80`062d1180 fffffa80`062d1100 fffffa80`062d1100 : Ntfs!NtfsFlushVolume+0xc13
fffff880`0334d7c0 fffff880`0131f03f : fffff880`0334d910 fffffa80`062d1180 fffffa80`09f0fc60 fffffa80`062d1188 : Ntfs!NtfsShutdownVolume+0xd3
fffff880`0334d840 fffff880`013d4e95 : fffff880`0334d910 00000000`00000000 fffff880`013ce9b0 00000000`00000000 : Ntfs!NtfsForEachVcb+0x167
fffff880`0334d8e0 fffff880`011056af : fffffa80`05b3db70 fffff800`02c6a280 fffff800`02cc9990 fffffa80`09f0fc60 : Ntfs!NtfsFsdShutdown+0x145
fffff880`0334db10 fffff800`02d1447c : fffffa80`05b36890 fffff800`02c74640 00000000`00000001 00000000`00000000 : fltmgr!FltpDispatch+0x9f
fffff880`0334db70 fffff800`02d14612 : 00000000`00000001 00000000`00000001 fffff800`02c6a280 00000000`00000000 : nt!IopShutdownBaseFileSystems+0xac
fffff880`0334dbf0 fffff800`02d152d6 : fffff800`02d150f0 fffff800`02c6a280 00000000`00000001 00000000`00000001 : nt!IoShutdownSystem+0x122
fffff880`0334dc70 fffff800`02ace251 : fffff800`02d150f0 fffff800`02dbcd01 fffffa80`05589900 fffffa80`00000000 : nt!PopGracefulShutdown+0x1e6
fffff880`0334dcb0 fffff800`02d62ede : 99569956`754e754e fffffa80`055899d0 00000000`00000080 fffffa80`054ed040 : nt!ExpWorkerThread+0x111
fffff880`0334dd40 fffff800`02ab5906 : fffff880`0316a180 fffffa80`055899d0 fffff880`031750c0 29912991`1f741f74 : nt!PspSystemThreadStartup+0x5a
fffff880`0334dd80 00000000`00000000 : fffff880`0334e000 fffff880`03348000 fffff880`0334c5b0 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!FsRtlOplockIsFastIoPossible+a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5147d9c6

STACK_COMMAND:  .cxr 0xfffff8800334cca0 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_nt!FsRtlOplockIsFastIoPossible+a

BUCKET_ID:  X64_0x7E_nt!FsRtlOplockIsFastIoPossible+a

Followup: MachineOwner
---------

 

[Coherent]

Hi Arc,

BIOS has been updated and i've run test on my memory and GPU with no errors.

Ill monitor and post back in a few days with the results.

Thank you again!

Ben

 

[Coherent]

Sorry, forgot to update!!

I've not had a BSOD since updating my BIOS.

Thank you Arc!!!

 

[Arc]

You are welcome, Ben

Let us know for any further issue.

 

[Coherent]

Unfortunatley I've been having a few issues again.
Was so smooth for a while!!!!
I've attached all the dumps and stuff, any advice is appreciate. As always!!

Gonna check for new drivers in the meantime.

 

[Arc]

Update the display driver to the latest.

And, Stress test the Graphics Card using Furmark.
Video Card - Stress Test with Furmark

 

[Coherent]

PC's recently started doing crazy things again!

I've got the most recent driver and stress testing seems to be ok.
I thought it coincided with installed IE11 but I've been using chrome recently and it still seems to have issues.

Many thanks for any advice as always!

Ben

 

[Arc]

Various different BSODs head to head.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

If memtest does not show any error, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.
________________________________________________

BugCheck 1A, {41284, 7379001, 5469, fffff70001080000}

Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3c8 )

Followup: MachineOwner
---------------------------------------------------------
BugCheck 24, {1904fb, fffff8800db19ce8, fffff8800db19540, fffff880012a8317}

Probably caused by : Ntfs.sys ( Ntfs!NtfsFindPrefixHashEntry+1fe )

Followup: MachineOwner
---------------------------------------------------------
BugCheck 3B, {c0000005, fffff960002ff016, fffff88009847c90, 0}

Probably caused by : win32k.sys ( win32k!RBRUSH::vRemoveRef+12 )

Followup: MachineOwner
---------

 

[Coherent]

Right, my PC's been doing some odd things which seem to coincide with turning driver verifier on. (been on for a while now because I forgot it was on!! )
Hopefully it will point to the culprate!!!
I've got a feeling it will point to the graphics card again though, the errors don't cause a BSOD but the effect is similar, that horrible glitchy audio of a PC in pain but my screen goes unreadable and wont reset until I restart.

Many thanks for any advice (as always!).
Ben

 

[Arc]

Before checking the dumps, I will ask for the result of memtest 86+.

Because DV applies here only if memtest did not show any error.

 

[Coherent]

Hi arc,

I ran memtest a few time and it didn't show any errors.

Thanks
Ben

 

[Arc]

Checked the BSODs of 17/02 .... they all nor not providing any sufficient information, rather than some hints of memory corruption. Though the memory corruption can be caused by some misbehaving drivers too.

Enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[Coherent]

Ran verifier for a few days and got the same weird glitch screen but without the crash dumps.
Had a couple of crashes this evening which I think point to graphics again, I've double check and the drivers are definitely up to date.
There's one that looks like it may be caused by my work VPN software so I've now uninstalled that.
Not sure what else to try.
Could this be faulty/incompatible hardware?

 

[Thedoctor44]

I very much doubt it's hardware from what you and Arc have described; it sound like a driver related issue. Mainly because when you've changed a driver version or any other software change it seems to fix it for a while. If it was hardware related it then software changes wouldn't really help, it would also be fairly consistent.
I'm not saying it's definitely not hardware but it seems unlikely.

 

[Arc]

So when you enabled Driver Verifier, it did not cause any BSOD at all? And you noticed screen glitches only?

Your last three crash dumps are all different within a very small period.

BugCheck 4E, {99, 35b4aa, 0, fffffa800a11dfe0}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

BugCheck 1000007E, {ffffffffc0000005, fffff8800f1ab151, fffff880059b3ef8, fffff880059b3750}

Probably caused by : atikmdag.sys ( atikmdag+110151 )

Followup: MachineOwner
---------

BugCheck 1A, {41284, ef20001, 1d669, fffff70001080000}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4ad3 )

Followup: MachineOwner
---------

Uninstall your installed latest version of the display driver.

• How-To Uninstall AMD Catalyst Drivers From A Windows Based System

Then clean up any possible leftover.

• http://www.sevenforums.com/tutorials/83814-drivers-clean-left-over-files-after-uninstalling.html

Then install version 13.9 WHQL only.

• Previous AMD Catalyst? Display Drivers

Stress test the Graphics Card using Furmark.
Video Card - Stress Test with Furmark

How many passes you ran memtest? Run memtest again. Let us see a camera snap of the computer screen when it is completing 8 passes.