BSOD probably caused by Ntfs.sys, ntkrnlmp.exe, win32k.sys

[jmt83]

Hello! I'm working with a Dell OptiPlex 580 running 64-bit Windows 7 Professional in a domain environment. This PC is two years old and essentially started to crash out of the box. I put up with it for about a year-and-a-half because the crashes were somewhat infrequent, maybe occuring every two to three weeks.

About three months ago I had become fed up and purchased a software support contract with Dell. Although I had performed multiple diagnostic tests on my own to search for hardware failure (never found any issues), they made me rerun those same tests to prove there were no hardware issues. After the diagnostics came back clean, they told me I would have to reformat the hard drive and reinstall windows (which had come installed OEM). They seemed to think Windows was corrupt and needed to be cleanly reinstalled. Seemed a pain to me since they were the ones who installed Windows in the first place, but I digress...

Despite following their instructions, the PC in question has experienced 6 BSOD since reformatting. So I guess whatever they thought the cause/cure would be, reinstalling Windows did not do the trick. I do not know if this means there is a driver issue or what? I did perform a quick bugcheck and it stated the crashes were probably caused by Ntfs.sys, ntkrnlmp.exe, and win32k.sys.

Any help would be greatly appreciated!

Thanks,
jmt83

 

[Arc]

Hello jmt83.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

[COLOR=Red]BugCheck 3B[/COLOR], {c0000005, fffff96000029db5, fffff88007d811b0, 0}

Probably caused by : win32k.sys ( win32k!bDeleteFont+61 )

Followup: MachineOwner
---------

• Download and install Driver Fusion.
• Reboot the computer in Advanced Boot Options, safe mode. Search Driver Fusion in your start menu, and remove all components of your AMD/ATI display driver.
• Boot normally now. Update your ATI/AMD display driver.
  You can get it from the link in our forum, http://www.sevenforums.com/graphic-...alyst-video-driver-windows-7-a.html#post17671, or you may go to AMD Graphics Driver and Software and opt for Automatically Detect and Install the appropriate driver for your card.
  
  
  
  
  During installation, you may opt for advanced installation, and install the display driver only, not the Catalyst Control Center. ** Install the WHQL drivers only, not any beta.

Let us know the results.

 

[jmt83]

Arc,

Thanks for your help. Sorry for my delay in replying, but I haven't had time to start working on this until today. I followed your instructions and installed Driver Fusion. After attempting to delete all AMD drivers in Safe Mode, the program stated that it could not remove all drivers unless I upgraded to the premium version ($19.99). I wasn't excited about having to buy the software, but I figured if it worked, I could get through this quickly. The problem is, it didn't work. Every time I ran the program and tried to delete all AMD components, the same 111 entries remained after reboot.

The Driver Fusion forum is promising a new version in the next few days that will supposedly fix this. I am hopeful, but not exactly counting on it. Since I had removed only about half of what I was hoping to, I ran a System Restore on the PC to get it back to where it was yesterday. I will be watching the Driver Fusion forum to see when the supposed patch comes through. I've posted a link to the forum discussion below for anyone who might be interested.

Treexy Forum • View topic - Registry entries will not delete

Thanks again,
JMT83

 

[Arc]

As far as it it deleted by driver fusion, that is enough. Install the driver now, and see what happens there, if the crashes continue or not.

 

[jmt83]

OK, so I followed your directions. I used Driver Fusion to remove all the AMD components that I could. I then downloaded a more recent version of the ATI Radeon HD 4200 display driver v 8.970.100.3000, released 7/12 (my previous version was v 8.850.0.0, released 4/11). I deselected everything I could, only wishing to install the display driver and passing on all the extras. I will keep an eye on this and let you know if it crashes again.

Thanks!

 

[Arc]

You are welcome. Let us know the situation.

 

[jmt83]

Uh oh, here we go again...

Well, we had another crash this morning, just two days after running Driver Fusion and installing the video driver on Saturday. On top of that, a large number of e-mails that were moved into a subfolder in Outlook 2010 simply vanished today. Probably an altogether separate issue from these crashes, but just another typical problem with this particular computer. Anyways, the new data is attached. I hope you can see something from it that I cannot.

Thanks!

 

[koolkat77]

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
​

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
​

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
​

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
​

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
​

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

   Information

Errors are sometimes found after 8 passes.

   Tip

Do this test overnight, before going to bed.

 

[jmt83]

koolkat77,

Thanks for your reply! May I ask, are you seeing something in the error codes that points towards bad RAM/motherboard, or is the Memtest86+ recommendation more a general suggestion that works as a good starting point for most BSOD issues? The reason I ask is that I took this PC home one weekend this summer and ran Memtest86+ for nearly the entire weekend with no failures. Of course, RAM that was good six months ago isn’t necessarily good now, so I am OK with running the program again to be sure. Just curious if you saw something in the logs that pointed towards bad memory.

I won’t have the time to dedicate to multiple runs until this weekend, but will do so then. And of course, I’m willing to test other things as well prior to this. Thanks again for replying!

JMT83

 

[Arc]

I guess so.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

[COLOR=Red][B]MEMORY_MANAGEMENT (1a)[/B][/COLOR]
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: fffff98010c85001
Arg3: 0000000000000000
Arg4: fffff780c0000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41284

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000293aa37 to fffff800028e3fc0

STACK_TEXT:  
fffff880`02faf428 fffff800`0293aa37 : 00000000`0000001a 00000000`00041284 fffff980`10c85001 00000000`00000000 : nt!KeBugCheckEx
fffff880`02faf430 fffff800`0289449e : 00000000`0000a881 fffff880`02faf528 00000000`00000000 fffff800`00000001 : nt! ?? ::FNODOBFM::`string'+0x4ac3
fffff880`02faf470 fffff800`02bf0819 : fffff980`10c85000 fffff8a0`152441e0 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x2b7bf
fffff880`02faf750 fffff800`02906a1b : 00000000`00140000 fffffa80`036c10f0 00000000`00000000 00000000`00200000 : nt!CcUnmapVacb+0x5d
fffff880`02faf790 fffff800`02927f14 : fffff8a0`11206001 fffffa80`03f72a00 fffffa80`039ce600 00000000`00000000 : nt!CcUnmapVacbArray+0x1bb
fffff880`02faf820 fffff800`028fcf39 : fffffa80`039ce6c0 fffffa80`039b55b0 fffffa80`03f72a00 00000000`00000000 : nt!CcDeleteSharedCacheMap+0x154
fffff880`02faf880 fffff880`012d520a : fffffa80`038ea180 fffff8a0`1455e140 00000000`00000001 00000000`00000000 : nt!CcUninitializeCacheMap+0x389
fffff880`02faf900 fffff880`012a5dc6 : 00000000`00000000 fffff800`02a81200 00000000`00000001 fffff8a0`1455e140 : Ntfs!NtfsDeleteInternalAttributeStream+0xea
fffff880`02faf950 fffff880`0121e7d0 : fffff8a0`1455e040 fffff8a0`1455e140 fffff800`02a81200 fffff8a0`0eae4b70 : Ntfs!NtfsRemoveScb+0xe2
fffff880`02faf990 fffff880`0121da7f : fffff8a0`1455e010 fffff800`02a81280 fffff880`02fafb01 fffffa80`06a185b0 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`02faf9c0 fffff880`012a36bc : fffffa80`06a185b0 fffffa80`038ea180 fffff8a0`0eae4b40 fffff8a0`0eae4ed8 : Ntfs!NtfsTeardownFromLcb+0x2af
fffff880`02fafa50 fffff880`012250b2 : fffffa80`06a185b0 fffffa80`06a185b0 fffff8a0`0eae4b40 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xcc
fffff880`02fafad0 fffff880`012b3223 : fffffa80`06a185b0 fffff800`02a81280 fffff8a0`0eae4b40 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`02fafb10 fffff880`012a23c7 : fffffa80`06a185b0 fffff8a0`0eae4c70 fffff8a0`0eae4b40 fffffa80`038ea180 : Ntfs!NtfsCommonClose+0x353
fffff880`02fafbe0 fffff800`028ed641 : 00000000`00000000 fffff800`02bd6500 fffffa80`037eb001 00000000`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`02fafcb0 fffff800`02b7ae5a : 00000000`00000000 fffffa80`037eb040 00000000`00000080 fffffa80`036d1040 : nt!ExpWorkerThread+0x111
fffff880`02fafd40 fffff800`028d4d26 : fffff880`009ec180 fffffa80`037eb040 fffff880`009f6f40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`02fafd80 00000000`00000000 : fffff880`02fb0000 fffff880`02faa000 fffff880`02faf7d0 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4ac3
fffff800`0293aa37 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4ac3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

FAILURE_BUCKET_ID:  X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4ac3

BUCKET_ID:  X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4ac3

Followup: MachineOwner
---------

 

[jmt83]

OK, thanks!

 

[jmt83]

Hey, everyone. Right now I'm 13 hours and counting running memtest86+ with no errors. Right now I am 4 passes into testing the last DIMM slot (so far I have run every test to at least 8 passes). The PC has 2 RAM sticks and 4 slots, and I have tested each stick individually accross the slots and have yet to experienced an issue.

Are there any other tests or reports I can provide to help out?

Thanks,

JMT83

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
​

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
​

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
​

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
​

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
​

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

   Information

Errors are sometimes found after 8 passes.

   Tip

Do this test overnight, before going to bed.

 

[Arc]

In such a situation, it is better to enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[jmt83]

Archie,

I logged in this morning to run Driver Verifier, but the computer crashed before I even got started. Here is the latest info attached. I will go ahead and run Driver Verifier now to see if it will crash while the program is running. Thanks!

 

[Arc]

There is one new crash dump, but the is not with DV enabled, and equally silent. In the next try of enabling DV, make it sure that you are not checking any of the "microsoft" and "unknown" provided drivers. Hopefully it will work.

 

[jmt83]

Archie,

I've been running DV for about 12 hours, but need to shut down the computer to take it back to the office. Just my luck; the computer crashed 3 times Sunday before I started to run DV, but did not crash afterwards. I will continue to run DV and provide you with any new info I receive, but I have attached another zip folder, just in case there is anything inside that might be helpful. Thanks!

 

[Arc]

We need the verifier enabled dumps to see.

Make it user that crash dump recording is properly configured. Follow it: http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html
Go to Option Two, Point 2. Download the .reg file and merge it in registry by double clicking it.

Search the .dmp files manually in the default path: C:\Windows\Minidump or %SystemRoot%\Minidump. Post it following the Blue Screen of Death (BSOD) Posting Instructions.

Also test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

 

[jmt83]

The PC has been running since AM Monday and after 4.5 straight days of running DV, the system finally crashed earlier this afternoon. I am crossing my fingers that enough information has been collected to figure out what is wrong. I have attached the latest zip.

Also, please note from my earlier posts that I ran memtest86+ last weekend for about 16 hours, alternating each stick for 8+ passes in each slot. This yielded no errors.

Thanks in advance for looking into this. Best of luck trying to decode the answer!

JMT83

We need the verifier enabled dumps to see.

Make it user that crash dump recording is properly configured. Follow it: http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html
Go to Option Two, Point 2. Download the .reg file and merge it in registry by double clicking it.

Search the .dmp files manually in the default path: C:\Windows\Minidump or %SystemRoot%\Minidump. Post it following the Blue Screen of Death (BSOD) Posting Instructions.

Also test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

 

[Arc]

Do some disc checks.

1. Update your SSD's Firmware
2. Reseat the sata and power.
   
   
3. Run chkdsk /f/r, following the option two of the tutorial Disk Check
4. Seatool for dos: SeaTools | Seagate download
   Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

If any component of the hardware is overclocked, stop overclocking.

And, try to dismantle the computer and reassamble it.

BTW, there is no new crash dump in the zip.

 

[jmt83]

HDD

I follwed the instructions with these resuls:

1. To my knowledge, there is not a firmware update available for my HDD. The model number is
WDC WD2500AAJS-75M0A0 and the firmware version is 02.03E02.

2. I reseated the SATA and power.

3. Last night I ran SFC /SCANNOW and CHKDSK /F /R. SCANNOW showed errors the first time I ran it and said they were corrected. I ran SCANNOW again and the message said it could not fix the errors. Results attached.

4. I ran the SeaTools Long Test this morning and it passed.

Just an FYI, I also applied some Windows Updates and updated the PC's network drivers.

Thanks!
JMT83

Do some disc checks.

1. Update your SSD's Firmware
2. Reseat the sata and power.
   
   
3. Run chkdsk /f/r, following the option two of the tutorial Disk Check
4. Seatool for dos: SeaTools | Seagate download
   Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

If any component of the hardware is overclocked, stop overclocking.

And, try to dismantle the computer and reassamble it.

BTW, there is no new crash dump in the zip.