BSOD ntoskrnl.exe and NTFS.sys

[ncsweeney]

here it is

 

[Arc]

Let us check the modules which are making the system crash.

avast! Virtualization Driver

fffff880`099083f8  fffff880`03ca5efaUnable to load image \SystemRoot\System32\Drivers\aswSnx.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=aswSnx.SYS"]aswSnx.SYS[/URL]
*** ERROR: Module load completed but symbols could not be loaded for[URL="http://www.carrona.org/drivers/driver.php?id=aswSnx.SYS"] aswSnx.SYS[/URL]
 aswSnx+0x6efa

Description here: Driver Reference Table - aswSnx.SYS

avast! Self Protection Driver

fffff880`099083e8  fffff880`03f3dcbcUnable to load image \SystemRoot\System32\Drivers\aswSP.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=aswSP.SYS"]aswSP.SYS[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=aswSP.SYS"]aswSP.SYS[/URL]
 aswSP+0x48cbc

Description here: Driver Reference Table - aswSP.SYS

Uninstall Avast using Avast Uninstall Utility. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Let us know the result.
_______________________________________________________________________________
BSOD ANALYSIS:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa802e299010, 2, 1, fffff80003137ca6}

Probably caused by : memory_corruption ( nt!MiReleaseConfirmedPageFileSpace+86 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa802e299010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80003137ca6, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b2100
GetUlongFromAddress: unable to read from fffff800032b21c0
 fffffa802e299010 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiReleaseConfirmedPageFileSpace+86
fffff800`03137ca6 480fb328        btr     qword ptr [rax],rbp

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  WerFault.exe

TRAP_FRAME:  fffff88009908620 -- (.trap 0xfffff88009908620)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800e499010 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003137ca6 rsp=fffff880099087b0 rbp=00000000ff000000
 r8=fffff880099087e0  r9=fffffa80100426c0 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiReleaseConfirmedPageFileSpace+0x86:
fffff800`03137ca6 480fb328        btr     qword ptr [rax],rbp ds:fffffa80`0e499010=0100000000000000
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000307a1a9 to fffff8000307ac00

STACK_TEXT:  
fffff880`099084d8 fffff800`0307a1a9 : 00000000`0000000a fffffa80`2e299010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`099084e0 fffff800`03078e20 : fffff880`09908670 fffff800`03056450 fffffa80`00001000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`09908620 fffff800`03137ca6 : fffffa80`10042a58 00000000`00000000 fffffa80`0e415920 fffff704`4000cc40 : nt!KiPageFault+0x260
fffff880`099087b0 fffff800`030ebbda : 00000000`000000a8 fffff680`00011a00 00000000`02a98000 fffffa80`10042c60 : nt!MiReleaseConfirmedPageFileSpace+0x86
fffff880`09908830 fffff800`030ad7d9 : 00000000`00000000 00000000`02f10fff fffffa80`00000000 fffff880`00000000 : nt! ?? ::FNODOBFM::`string'+0x34f16
fffff880`099089f0 fffff800`033951c1 : fffffa80`0ffc0610 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`09908b10 fffff800`033955c3 : 0000007f`00000000 00000000`02340000 fffffa80`00000001 fffffa80`0f8d8010 : nt!MiUnmapViewOfSection+0x1b1
fffff880`09908bd0 fffff800`03079e93 : 00000000`00000000 00000000`02f10808 fffffa80`100426c0 00000000`00000000 : nt!NtUnmapViewOfSection+0x5f
fffff880`09908c20 00000000`773e15ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0023e098 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x773e15ba


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiReleaseConfirmedPageFileSpace+86
fffff800`03137ca6 480fb328        btr     qword ptr [rax],rbp

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiReleaseConfirmedPageFileSpace+86

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  5147d9c6

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+86

BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+86

Followup: MachineOwner
---------

 

[ncsweeney]

Thanks, I'll try that tonight after work.

 

[ncsweeney]

alrighty, so i uninstalled avast. installed MS security essentials and ran a full scan. no problems there. now installed malware bytes and am running that full scan. ill let you know if i have any problems

 

[Arc]

The scans are for safety reason, as the antivirus was failing and causing BSODs.

Let us know how the system is running without avast.

 

[ncsweeney]

will do. you guys are awesome by the way! =)

 

[ncsweeney]

the joy continues...

 

[Arc]

Your crash dumps are not showing any finite probable cause. In such a situation, it is better to enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[ncsweeney]

so, been running the verifier. have had a couple crashes. not sure if they actually made a dump log because it just froze up into a blurry screen with the speakers buzzing. here is the crash log anyway. oh, and i turned off the verifier now

 

[Arc]

There is no new crash dump after 06/06 ..... so probably we have to wait for another incident.

 

[ncsweeney]

back again... been crashing a bunch lately. heres the new dump file. hope something stands out, because i am sick of this crap

 

[Arc]

Is the firmware of the Corsier SSD up to date? Check it.

Seeing some stroage related errors there in the dumps.

fffff880`031521f8 fffff880`01219688 nt!KeBugCheckEx
fffff880`03152200 fffff880`01308387 Ntfs! ?? ::FNODOBFM::`string'+0x2899
fffff880`03152240 fffff800`030accdc Ntfs! ?? ::NNGAKEGL::`string'+0x821c
fffff880`03152290 fffff800`030ac75d nt!_C_specific_handler+0x8c
fffff880`03152300 fffff800`030ab535 nt!RtlpExecuteHandlerForException+0xd
fffff880`03152330 fffff800`030bc4d1 nt!RtlDispatchException+0x415
fffff880`03152a10 fffff800`03081282 nt!KiDispatchException+0x135
fffff880`031530b0 fffff800`0307fb8a nt!KiExceptionDispatch+0xc2
fffff880`03153290 fffff800`0306574a nt!KiGeneralProtectionFault+0x10a
fffff880`03153420 fffff880`0107c633 nt!RtlDeleteNoSplay+0x2a
fffff880`03153450 fffff880`0107a2c8 fltmgr!TreeUnlinkNoBalance+0x13
fffff880`03153480 fffff880`010982af fltmgr!TreeUnlinkMulti+0x148
fffff880`031534d0 fffff880`0109a35c fltmgr!DeleteNameCacheNodes+0x9f
fffff880`03153510 fffff880`0109a3fb fltmgr!CleanupStreamListCtrl+0x6c
fffff880`03153550 fffff800`0333d62e fltmgr!DeleteStreamListCtrlCallback+0x6b
fffff880`03153580 fffff880`0129eb8c nt!FsRtlTeardownPerStreamContexts+0xe2
fffff880`031535d0 fffff880`012a3bb1 Ntfs!NtfsDeleteScb+0x108
fffff880`03153610 fffff880`0121d620 Ntfs!NtfsRemoveScb+0x61
fffff880`03153650 fffff880`012a162c Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`03153680 fffff880`01223ab2 Ntfs!NtfsTeardownStructures+0xdc
fffff880`03153700 fffff880`012b0f93 Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`03153740 fffff880`012b841c Ntfs!NtfsCommonClose+0x353
fffff880`03153810 fffff880`01077bcf Ntfs!NtfsFsdClose+0x2dc
fffff880`03153910 fffff880`010766df fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`031539a0 fffff800`033804ae fltmgr!FltpDispatch+0xcf
fffff880`03153a00 fffff800`0308ae44 nt!IopDeleteFile+0x11e
fffff880`03153a90 fffff800`030c5c94 nt!ObfDereferenceObject+0xd4
fffff880`03153af0 fffff800`030c64be nt!CcDeleteSharedCacheMap+0x224
fffff880`03153b50 fffff800`030c6af8 nt!CcWriteBehind+0x54e
fffff880`03153c00 fffff800`0308b251 nt!CcWorkerThread+0x1c8
fffff880`03153cb0 fffff800`0331fede nt!ExpWorkerThread+0x111
fffff880`03153d40 fffff800`03072906 nt!PspSystemThreadStartup+0x5a
fffff880`03153d80 00000000`00000000 nt!KiStartSystemThread+0x16

I think formatting the primary disc (the SSD) may help here.

 

[ncsweeney]

How do I go about checking/updating the ssd firmware?

 

[Arc]

See here: Corsair

Does Corsair provide firmware updates for SSDs? You will find download links and firmware update instructions posted in our forum. Not all drives will have a firmware update and in most cases your drive should have the latest firmware available at the time of production.
SSD Firmware Update - The Corsair Support Forums

 

[ncsweeney]

ok so according to the Corsair forum, i do have the latest firmware, which is vbm19c1q.

i was having crashing issues several months back, so i wiped everything clean and started fresh. so i dont think formatting is going to help.

 

[Arc]

Those errors, as shown in my list post, are storage related errors. Those may be caused by either a virus, or an antivirus blocking storage functions, or a failing storage device.

MSE does not cause any blockage there. So we may nullify this option.

Take the second chance, scan the system for possible virus infection with the following programs only.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Otherwise, we have to concentrate on storage device. SSD's cannot be tested, so the formatting is the only way left then, to say that the SSD is failing itself.