BSOD, random bugs - Ntoskrnl.exe

[PJM]

All details listed below and in attached.zip as advised.

Thank you for taking the time to assist with my issue.


072115-42822-01.dmp 21/07/2015 07:55:52 SYSTEM_THREAD_EXCEPTION_NOT_HANDLED 0x1000007e ffffffff`c0000005 fffff800`02ffcc7c fffff880`03784f78 fffff880`037847d0 ntoskrnl.exe ntoskrnl.exe+394c7c NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7601.17944 (win7sp1_gdr.120830-0333) x64 ntoskrnl.exe+394c7c C:\Windows\Minidump\072115-42822-01.dmp 8 15 7601 282,112 21/07/2015 07:57:30


072015-47190-01.dmp 20/07/2015 16:17:54 PAGE_FAULT_IN_NONPAGED_AREA 0x00000050 fffff6af`428000a0 00000000`00000000 fffff800`02d98817 00000000`00000005 ntoskrnl.exe ntoskrnl.exe+7efc0 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7601.17944 (win7sp1_gdr.120830-0333) x64 ntoskrnl.exe+7efc0 C:\Windows\Minidump\072015-47190-01.dmp 8 15 7601 282,112 20/07/2015 16:21:31


072015-27846-01.dmp 20/07/2015 07:56:21 KMODE_EXCEPTION_NOT_HANDLED 0x0000001e 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 Ntfs.sys Ntfs.sys+c41a NT File System Driver Microsoft® Windows® Operating System Microsoft Corporation 6.1.7600.16385 (win7_rtm.090713-1255) x64 ntoskrnl.exe+7ef90 C:\Windows\Minidump\072015-27846-01.dmp 8 15 7601 282,112 20/07/2015 08:02:17


072015-33711-01.dmp 20/07/2015 07:54:07 BAD_POOL_CALLER 0x000000c2 00000000`00000007 00000000`0000109b 00000000`00520054 fffff8a0`03677e4c ntoskrnl.exe ntoskrnl.exe+7efc0 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7601.17944 (win7sp1_gdr.120830-0333) x64 ntoskrnl.exe+7efc0 C:\Windows\Minidump\072015-33711-01.dmp 8 15 7601 282,112 20/07/2015 07:55:31


071715-26707-01.dmp 17/07/2015 08:18:11 MEMORY_MANAGEMENT 0x0000001a 00000000`00003452 00000000`759e8000 fffff700`01081528 21400001`d32bd00c ntoskrnl.exe ntoskrnl.exe+7efc0 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7601.17944 (win7sp1_gdr.120830-0333) x64 ntoskrnl.exe+7efc0 C:\Windows\Minidump\071715-26707-01.dmp 8 15 7601 282,056 17/07/2015 08:19:39

 

[PJM]

In addition tothe above, I have also experienced recently.

Crash List



Created by using BlueScreenView

Dump File Crash Time Bug Check String Bug Check Code Parameter 1 Parameter 2 Parameter 3 Parameter 4 Caused By Driver Caused By Address File Description Product Name Company File Version Processor Crash Address Stack Address 1 Stack Address 2 Stack Address 3 Computer Name Full Path Processors Count Major Version Minor Version Dump File Size Dump File Time 072315-27346-01.dmp 23/07/2015 07:56:38 NTFS_FILE_SYSTEM 0x00000024 00000000`001904fb fffff880`03738718 fffff880`03737f70 fffff800`02cf86de Ntfs.sys Ntfs.sys+48d8 NT File System Driver Microsoft® Windows® Operating System Microsoft Corporation 6.1.7600.16385 (win7_rtm.090713-1255) x64 ntoskrnl.exe+7efc0 C:\Windows\Minidump\072315-27346-01.dmp 8 15 7601 282,112 23/07/2015 07:58:30

 

[PJM]

Hi,

A further observation of this fail.

Initial boot bluescreens before I get the opportunity to log in to Windows. When I hard power cycle, Windows loads everytime on that second attempt.

I am then prompted with the bluescreen notification with option to check for a solution

 

[Laith]

Hiya and welcome to SevenForums!rb:

BugCheck 1000007E, {ffffffffc0000005, fffff80002ffcc7c, fffff88003784f78, fffff880037847d0}

Probably caused by : ntkrnlmp.exe ( nt!NtQueryDirectoryObject+238 )

BugCheck 24, {1904fb, fffff88003738718, fffff88003737f70, fffff80002cf86de}

Probably caused by : Ntfs.sys ( Ntfs+11eda8 )

Run SeaTools http://www.sevenforums.com/tutorials/313457-seatools-dos-windows-how-use.html

Run MemTest86+, It must be MemTest86+. http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Run sfc /scannow and chkdsk /r.
Install the latest updates from Windows Update.

Do the exact same steps for chkdsk /r but instead of typing in sfc /scannow type chkdsk /r.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Snap a picture when the BSOD occurs.

 

[PJM]

I will get on to that, in the meanwhile I ran Windbg against some of my dumps, I'll post the outputs I have.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
Loading Dump File [C:\Windows\Minidump\080715-31527-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\Symbols;srv*
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff800`02c4b000 PsLoadedModuleList = 0xfffff800`02e8f670
Debug session time: Fri Aug 7 08:02:04.448 2015 (UTC + 1:00)
System Uptime: 0 days 0:01:54.447
Loading Kernel Symbols
...............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41284, 60ac001, 0, fffff70001080000}
Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3c8 )
Followup: MachineOwner
---------
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: 00000000060ac001
Arg3: 0000000000000000
Arg4: fffff70001080000
Debugging Details:
------------------
 
OVERLAPPED_MODULE: Address regions for 'nwifi' and 'RtsUVStor.sy' overlap
BUGCHECK_STR: 0x1a_41284
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: Bginfo.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002d20a37 to fffff80002cc9fc0
STACK_TEXT: 
fffff880`09559f38 fffff800`02d20a37 : 00000000`0000001a 00000000`00041284 00000000`060ac001 00000000`00000000 : nt!KeBugCheckEx
fffff880`09559f40 fffff800`02cfb280 : fffff700`01080000 d5500001`7ba4f867 e0300001`7b57ec66 fffffa80`00000001 : nt! ?? ::FNODOBFM::`string'+0x4ac3
fffff880`09559f80 fffff800`02cb681f : fffffa80`00000000 00000000`0bbeffff 00000000`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x4e8
fffff880`0955a140 fffff800`02cc9253 : ffffffff`ffffffff fffff880`0955a410 fffff880`0955a478 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`0955a240 fffff800`02cc5810 : fffff960`000d7110 00000000`00000001 fffff900`c00f8010 fffff900`c1a84010 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0955a3d8 fffff960`000d7110 : 00000000`00000001 fffff900`c00f8010 fffff900`c1a84010 00000000`00000000 : nt!KiServiceLinkage
fffff880`0955a3e0 fffff960`000d7460 : 00000000`00000000 fffff880`00000000 fffff900`c1a84010 00000000`00000000 : win32k!SURFACE::bDeleteSurface+0x3c8
fffff880`0955a530 fffff960`0009800d : 00000000`05050245 fffff900`c1a84010 00000000`00000245 00000000`05050245 : win32k!bDeleteSurface+0x34
fffff880`0955a560 fffff800`02cc9253 : fffffa80`0aa88b50 00000000`767a37e0 00000000`00000001 00000000`00050000 : win32k!NtGdiDeleteObjectApp+0xd5
fffff880`0955a590 00000000`74952e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0008d448 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74952e09
 
STACK_COMMAND: kb
FOLLOWUP_IP: 
win32k!SURFACE::bDeleteSurface+3c8
fffff960`000d7110 e9b0010000 jmp win32k!SURFACE::bDeleteSurface+0x57d (fffff960`000d72c5)
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: win32k!SURFACE::bDeleteSurface+3c8
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 50ad9b54
FAILURE_BUCKET_ID: X64_0x1a_41284_win32k!SURFACE::bDeleteSurface+3c8
BUCKET_ID: X64_0x1a_41284_win32k!SURFACE::bDeleteSurface+3c8
Followup: MachineOwner

Loading Dump File [C:\Windows\Minidump\080515-32151-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\Symbols;srv*
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff800`02c61000 PsLoadedModuleList = 0xfffff800`02ea5670
Debug session time: Wed Aug 5 07:57:42.231 2015 (UTC + 1:00)
System Uptime: 0 days 0:01:06.199
Loading Kernel Symbols
...............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {31, fffffa800d7c8dc0, fffff880075b8000, fffff8a002961f02}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+7271 )
Followup: MachineOwner
---------
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000031, The subtype of the bugcheck.
Arg2: fffffa800d7c8dc0
Arg3: fffff880075b8000
Arg4: fffff8a002961f02
Debugging Details:
------------------
 
OVERLAPPED_MODULE: Address regions for 'nwifi' and 'RtsUVStor.sy' overlap
BUGCHECK_STR: 0x1a_31
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: WerFault.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002f38915 to fffff80002cdffc0
STACK_TEXT: 
fffff880`07ca7748 fffff800`02f38915 : 00000000`0000001a 00000000`00000031 fffffa80`0d7c8dc0 fffff880`075b8000 : nt!KeBugCheckEx
fffff880`07ca7750 fffff800`02fb3797 : fffffa80`00000000 fffffa80`0d3e9760 00000000`000000bd fffff8a0`02958000 : nt! ?? ::NNGAKEGL::`string'+0x7271
fffff880`07ca77b0 fffff800`02d0eceb : ffffffff`ffffffff fffff880`07ca7938 00000000`00008000 fffffa80`0db4b500 : nt!MiRelocateImagePfn+0xf7
fffff880`07ca7810 fffff800`02d06cbf : fffffa80`0d1ced40 fffff880`07ca7940 fffffa80`0db386e8 00000000`80100080 : nt!MiWaitForInPageComplete+0x7ef
fffff880`07ca78f0 fffff800`02ced65a : 00000000`00000000 00000000`00000000 ffffffff`ffffffff fffffa80`00000000 : nt!MiIssueHardFault+0x28b
fffff880`07ca7980 fffff800`02cde0ee : 00000000`00000000 000007fe`f651ae80 00000000`001dc601 00000000`004d67b0 : nt!MmAccessFault+0x146a
fffff880`07ca7ae0 000007fe`fde344fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`001dcdd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fde344fd
 
STACK_COMMAND: kb
FOLLOWUP_IP: 
nt! ?? ::NNGAKEGL::`string'+7271
fffff800`02f38915 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+7271
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 503f82be
FAILURE_BUCKET_ID: X64_0x1a_31_nt!_??_::NNGAKEGL::_string_+7271
BUCKET_ID: X64_0x1a_31_nt!_??_::NNGAKEGL::_string_+7271
Followup: MachineOwner

Loading Dump File [C:\Windows\Minidump\080415-24538-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\Symbols;srv*
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff800`02c08000 PsLoadedModuleList = 0xfffff800`02e4c670
Debug session time: Tue Aug 4 07:59:58.955 2015 (UTC + 1:00)
System Uptime: 0 days 0:01:47.775
Loading Kernel Symbols
...............................................................
................................................................
.................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41284, 9d7a001, 3d50, fffff70001080000}
Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3c8 )
Followup: MachineOwner
---------
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: 0000000009d7a001
Arg3: 0000000000003d50
Arg4: fffff70001080000
Debugging Details:
------------------
 
BUGCHECK_STR: 0x1a_41284
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: Bginfo.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002cdda37 to fffff80002c86fc0
STACK_TEXT: 
fffff880`02a2bf38 fffff800`02cdda37 : 00000000`0000001a 00000000`00041284 00000000`09d7a001 00000000`00003d50 : nt!KeBugCheckEx
fffff880`02a2bf40 fffff800`02cb8280 : fffff700`01080000 d5000001`4439e867 ed000001`44a9fc66 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4ac3
fffff880`02a2bf80 fffff800`02c7381f : fffffa80`00000000 00000000`0c1dffff 00000000`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x4e8
fffff880`02a2c140 fffff800`02c86253 : ffffffff`ffffffff fffff880`02a2c410 fffff880`02a2c478 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`02a2c240 fffff800`02c82810 : fffff960`000c7110 00000000`00000001 fffff900`c00bf010 fffff900`c3637010 : nt!KiSystemServiceCopyEnd+0x13
fffff880`02a2c3d8 fffff960`000c7110 : 00000000`00000001 fffff900`c00bf010 fffff900`c3637010 00000000`00000000 : nt!KiServiceLinkage
fffff880`02a2c3e0 fffff960`000c7460 : 00000000`00000000 fffff880`00000000 fffff900`c3637010 00000000`00000000 : win32k!SURFACE::bDeleteSurface+0x3c8
fffff880`02a2c530 fffff960`0008800d : 00000000`0905029b fffff900`c3637010 00000000`0000029b 00000000`0905029b : win32k!bDeleteSurface+0x34
fffff880`02a2c560 fffff800`02c86253 : fffffa80`0c1e6060 00000000`74e337e0 00000000`00000001 00000000`00050000 : win32k!NtGdiDeleteObjectApp+0xd5
fffff880`02a2c590 00000000`74bb2e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0008d448 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74bb2e09
 
STACK_COMMAND: kb
FOLLOWUP_IP: 
win32k!SURFACE::bDeleteSurface+3c8
fffff960`000c7110 e9b0010000 jmp win32k!SURFACE::bDeleteSurface+0x57d (fffff960`000c72c5)
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: win32k!SURFACE::bDeleteSurface+3c8
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 50ad9b54
FAILURE_BUCKET_ID: X64_0x1a_41284_win32k!SURFACE::bDeleteSurface+3c8
BUCKET_ID: X64_0x1a_41284_win32k!SURFACE::bDeleteSurface+3c8
Followup: MachineOwner
---------

Thanks for the welcome and thanks for the reply. Since I first posted I've been researching debug when I've had the time, I'm picking up as much as I can, I'm just as keen to learn as I am to repair my fault(s)

 

[Laith]

No problem! Well i couldn't analyze those 2 specific dumps as i got an symbol error.

 

[PJM]

No problem! Well i couldn't analyze those 2 specific dumps as i got an symbol error.

I had the same issue, used !symfix which loaded the correct symbol set as I apparently had downloaded the wrong set locally.

 

[Laith]

Oh, it mentioned that while analyzing. Thanks i'll use that next time wrong symbols are loaded.