BSOD soon after boot. Dump files attached.

[CaptainSEO]

Hi

I have been given a laptop that has never worked correctly. It's pretty much unused, but crashes soon after booting. I have run a CHKDSK and no errors were found.

The dump files are attached - any help will be much appreciated.

 

[Arc]

upload your MSINFO32.nfo file.

1. Click on the start button
2. Type "msinfo32" (without quotes) in the search bar of the start menu, click the resulting link. It will open the System Information window.
3. File>Save. In the "File Name" filed, put "MSINFO32" (without Quote), give the save location to desktop, and click the "save" button.
4. Give the time for processing, it will save a .nfo file on your desktop.
5. Zip it, and upload it following the instruction.

Stop 0x50, Ntfs
​

 

[CaptainSEO]

It has taken me days to get this as it keeps crashing before it's finished.

Anyway, here it is:View attachment 279207

 

[Arc]

A few crash dumps are not executable at all, those are incomplete. The BSODs occurred before you got the desktop.

Those we car read are stop 0x50 with Ntfs.sys as a probable cause.

In this situation, I would suggest you to do some Disc checks. Seatool for dos: SeaTools | Seagate download

• Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.
• You can use Win32 DiscImager to create a bootable USB and run Seatools for DOS. Follow this post to know how to make a bootable Seatools USB.

At the same time, I would suggest you for a few more things.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

Uninstall Kaspersky using Kaspersky Removal Tool. At least as a test. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Let us know the result.
_____________________________________________________________________

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff98113042698, 0, fffff8800162b460, 5}


Could not read faulting driver name
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : Ntfs.sys ( Ntfs!memcpy+250 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff98113042698, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8800162b460, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ebe100
GetUlongFromAddress: unable to read from fffff80002ebe1c0
 fffff98113042698 

FAULTING_IP: 
Ntfs!memcpy+250
fffff880`0162b460 488b440af8      mov     rax,qword ptr [rdx+rcx-8]

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88003784da0 -- (.trap 0xfffff88003784da0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000020 rbx=0000000000000000 rcx=fffff981130426c8
rdx=ffffffffffffffd8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800162b460 rsp=fffff88003784f38 rbp=fffff98013042718
 r8=00000000ffffff68  r9=0000000007fffffb r10=0000000000000001
r11=fffff98013042760 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
Ntfs!memcpy+0x250:
fffff880`0162b460 488b440af8      mov     rax,qword ptr [rdx+rcx-8] ds:fffff981`13042698=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c35f0f to fffff80002c8f1c0

STACK_TEXT:  
fffff880`03784c38 fffff800`02c35f0f : 00000000`00000050 fffff981`13042698 00000000`00000000 fffff880`03784da0 : nt!KeBugCheckEx
fffff880`03784c40 fffff800`02c8d2ee : 00000000`00000000 fffff981`13042698 00000000`00000000 00000000`00000028 : nt! ?? ::FNODOBFM::`string'+0x43d51
fffff880`03784da0 fffff880`0162b460 : fffff880`016b75a8 00000000`00000028 fffff880`03784f90 fffff8a0`00000400 : nt!KiPageFault+0x16e
fffff880`03784f38 fffff880`016b75a8 : 00000000`00000028 fffff880`03784f90 fffff8a0`00000400 00000000`00000001 : Ntfs!memcpy+0x250
fffff880`03784f40 fffff880`016b7740 : fffff8a0`0444fdb0 fffff800`02e2c280 fffff8a0`0444fdb0 fffff980`13042400 : Ntfs!NtfsRestartInsertSimpleRoot+0x50
fffff880`03784f80 fffff880`016dba2f : fffffa80`09110470 fffffa80`099bc180 fffff880`03785118 fffff880`03785150 : Ntfs!InsertSimpleRoot+0xb8
fffff880`03785050 fffff880`01692d3b : 00000000`00000000 fffff8a0`0444fdb0 fffff880`03785118 fffff880`037851a8 : Ntfs!AddToIndex+0xcf
fffff880`037850d0 fffff880`016aeda5 : fffffa80`09110470 fffff8a0`0444fdb0 fffff8a0`040360d8 fffffa80`00000000 : Ntfs!NtOfsAddRecords+0x167
fffff880`037852b0 fffff880`016df520 : fffffa80`09110470 fffff8a0`040360d0 00000000`00038968 00000000`00038970 : Ntfs!GetSecurityIdFromSecurityDescriptorUnsafe+0x1fd
fffff880`03785360 fffff880`0168e532 : fffffa80`09110470 fffffa80`099bc180 00000000`00000000 fffff980`13042d00 : Ntfs!NtfsCacheSharedSecurityByDescriptor+0xa0
fffff880`037853b0 fffff880`016a65ed : fffffa80`09110470 fffffa80`099bc180 fffff800`02e2c280 00000000`00000000 : Ntfs! ?? ::NNGAKEGL::`string'+0x11530
fffff880`03785430 fffff880`01639b0c : fffffa80`09110470 fffff880`01663a00 fffffa80`09110470 fffff8a0`04546680 : Ntfs!NtfsUpdateFcbInfoFromDisk+0x4fe
fffff880`03785580 fffff880`01704592 : fffffa80`09110470 00000000`00000000 00000000`00000000 fffff8a0`04546680 : Ntfs!NtfsInitializeDirectory+0x254
fffff880`03785690 fffff880`016fe3fa : fffffa80`09110470 fffffa80`099bc180 00000000`00000000 fffffa80`099bc180 : Ntfs!NtfsInitializeExtendDirectory+0x3d6
fffff880`03785850 fffff880`0169980d : 00000000`00000000 fffffa80`044bc010 00000000`00000001 00000000`00000000 : Ntfs!NtfsMountVolume+0x1691
fffff880`03785b90 fffff880`01620985 : 00000000`00000000 00000000`00000000 fffffa80`09110470 fffff800`02c967d3 : Ntfs!NtfsCommonFileSystemControl+0x59
fffff880`03785bd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsFspDispatch+0x2ad


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!memcpy+250
fffff880`0162b460 488b440af8      mov     rax,qword ptr [rdx+rcx-8]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  Ntfs!memcpy+250

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

FAILURE_BUCKET_ID:  X64_0x50_Ntfs!memcpy+250

BUCKET_ID:  X64_0x50_Ntfs!memcpy+250

Followup: MachineOwner
---------

2: kd> lmvm Ntfs
start             end                 module name
fffff880`0161d000 fffff880`017c0000   Ntfs       (pdb symbols)          c:\symbols\ntfs.pdb\D51347AE03CB4523A2844EA865BA0BE92\ntfs.pdb
    Loaded symbol image file: Ntfs.sys
    Mapped memory image file: c:\symbols\Ntfs.sys\4D79997B1a3000\Ntfs.sys
    Image path: \SystemRoot\System32\Drivers\Ntfs.sys
    Image name: Ntfs.sys
    Timestamp:        Fri Mar 11 09:09:39 2011 (4D79997B)
    CheckSum:         0019968A
    ImageSize:        001A3000
    File version:     6.1.7601.17577
    Product version:  6.1.7601.17577
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntfs.sys
    OriginalFilename: ntfs.sys
    ProductVersion:   6.1.7601.17577
    FileVersion:      6.1.7601.17577 (win7sp1_gdr.110310-1504)
    FileDescription:  NT File System Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

 

[CaptainSEO]

Thanks for your help!

 

[CaptainSEO]

Hi again.

I'm running into problems trying to do this with Windows 8.

IU have downloaded the SeaTools for DOS ISO and installed Win32 DiscImager. When I run DiscImager, it doesn't see the ISO in the Downloads folder or the copy of it on the desktop.

Windows 8 can burn ISOs natively so I double clicked SeaTools and copied all files to disc, but it doesn't appear to be bootable. I have set the laptop to boot from DVD, but it boots straight to Windows 7.

What am I doing wrong?

 

[CaptainSEO]

Aha - I see Win32 DiscImager is looking for .img files and doesn't appear to be able to use ISO files.

 

[CaptainSEO]

OK - read the documentation for SeaTools and am now burning through WIn* explorer.

I'll let you know if I run into more problems (and I'm sure I will).

 

[CaptainSEO]

Results:

SeaTools finished with no errors.
Memtestx86. See attached image - I don't know how to save the results.

BTW - Anti-virus was Norton and removed through control panel.

 

[Arc]

So it appears that teh RAM/s is/are faulty. You may either go to the part three of the tutorial How to Test and Diagnose RAM Issues with Memtest86+ to check which module is failing actually.

Errors/red lines means one or more RAM is faulty. But the fault may occur due to a faulty DIMM slot, too, which is a motherboard component. Using memtest86+, you can discriminate between a faulty RAM and a faulty motherboard.

How? Say you have two RAM sticks and two DIMM slots. You obtained errors at the test with all RAM sticks installed. Now, remove all the sticks but one. Test it in all the available slots, one by one. Continue the same procedure for all the available sticks.
How to make the inference that is it a RAM issue or it is a motherboard issue? Suppose you have got the result like that:

test|Slot1|Slot2
RAM1| Error | Error
RAM2|Good|Good

It is a RAM, a bad RAM.

But if you have got a result like that:

test|Slot1|Slot2
RAM1| Error |Good
RAM2| Error |Good

It is a motherboard issue. The particular slot is bad.

Or, change the RAM if it is within warranty.

Let us know the results.

 

[CaptainSEO]

It has 1 chip, so I swapped slots and got BSOD.

New chip ordered.

 

[Arc]

Let us know how it is running with the replacement RAM

 

[CaptainSEO]

Hmm. just put the new chip in and it's still BSOD.

What's my next step?

 

[Arc]

Upload it? May be some new results are available there.

 

[CaptainSEO]

Here's the latest dump files.

Any ideas?

 

[Arc]

It is the exactly same BSOD continuing.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

[COLOR=Red]BugCheck 50[/COLOR], {fffff98121142698, 0, fffff8800142d460, 5}

Could not read faulting driver name
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
[COLOR=Red]Probably caused by : Ntfs.sys [/COLOR]( Ntfs!memcpy+250 )

Followup: MachineOwner
---------

A deeper search indicates that Atheros AR5B97 Wireless Network Adapter driver is failing.

fffff880`0486daf8  fffff880`05975eeaUnable to load image \SystemRoot\system32\DRIVERS\[URL="http://www.carrona.org/drivers/driver.php?id=athrx.sys"]athrx.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=athrx.sys"]athrx.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=athrx.sys"]athrx.sys[/URL]
 athrx+0xfceea

And the driver is truly old.

fffff880`05879000 fffff880`05b1f000   athrx    T (no symbols)           
    Loaded symbol image file: athrx.sys
    Image path: \SystemRoot\system32\DRIVERS\athrx.sys
[COLOR=Red]    Image name: athrx.sys
    Timestamp:        Tue May 24 12:54:19 2011[/COLOR] (4DDB5D23)
    CheckSum:         002A98B1
    ImageSize:        002A6000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it from Drivers for Atheros AR5B97 and Windows 7 ... the latest version is

Version: 10.0.0.251, Release: 2013-05-27. Follow http://www.sevenforums.com/tutorials/97061-driver-install-device-manager.html to install the driver.

Also, some predominant Ntfs errors are also there.

fffff880`0486cf38 fffff880`014b95a8 Ntfs!memcpy+0x250
fffff880`0486cf40 fffff880`014b9740 Ntfs!NtfsRestartInsertSimpleRoot+0x50
fffff880`0486cf80 fffff880`014dda2f Ntfs!InsertSimpleRoot+0xb8
fffff880`0486d050 fffff880`01494d3b Ntfs!AddToIndex+0xcf
fffff880`0486d0d0 fffff880`014b0da5 Ntfs!NtOfsAddRecords+0x167
fffff880`0486d2b0 fffff880`014e1520 Ntfs!GetSecurityIdFromSecurityDescriptorUnsafe+0x1fd
fffff880`0486d360 fffff880`01490532 Ntfs!NtfsCacheSharedSecurityByDescriptor+0xa0
fffff880`0486d3b0 fffff880`014a85ed Ntfs! ?? ::NNGAKEGL::`string'+0x11530
fffff880`0486d430 fffff880`0143bb0c Ntfs!NtfsUpdateFcbInfoFromDisk+0x4fe
fffff880`0486d580 fffff880`01506592 Ntfs!NtfsInitializeDirectory+0x254
fffff880`0486d690 fffff880`015003fa Ntfs!NtfsInitializeExtendDirectory+0x3d6
fffff880`0486d850 fffff880`0149b80d Ntfs!NtfsMountVolume+0x1691
fffff880`0486db90 fffff880`01422985 Ntfs!NtfsCommonFileSystemControl+0x59
fffff880`0486dbd0 00000000`00000000 Ntfs!NtfsFspDispatch+0x2ad

Seatool for dos: SeaTools | Seagate download

• Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

Get rid of intel rapid storage. First uninstall it from Control Panel > Programs and Features. Then Uninstall the driver from device manager.

1. Right click on "my computer" icon and click "manage" on the context menu.
2. It will open the "computer management" window.
3. Select "Device Manager" in the left pane, It will list all the existing devices up.
4. Expand "IDE ATA/ATAPI controllers" by clicking on the triangle in front of it.
5. Select one Intel device item under it, right click, uninstall.
6. Continue the process for all Intel items under "IDE ATA/ATAPI controllers"
7. Now restart the computer. At restart, windows will auto configure the appropriate native system driver.

When all is done, upload your MSINFO32.nfo file so that we can check some further things.

1. Click on the start button
2. Type "msinfo32" (without quotes) in the search bar of the start menu, click the resulting link. It will open the System Information window.
3. File>Save. In the "File Name" filed, put "MSINFO32" (without Quote), give the save location to desktop, and click the "save" button.
4. Give the time for processing, it will save a .nfo file on your desktop.
5. Zip it, and upload it following the instruction.

Also, let us know the results.

​

 

[CaptainSEO]

I'm having real trouble here. I'm trying to update the Atheros driver and I'm getting BSOD before I get chance to finish the task.

On the BSOD, the bottom line states that it is NTFS.sys causing the error. Should we concentrate on that or on trying to update the driver?

 

[CaptainSEO]

Where I am now:

Started in safe mode and removed the Atheros device and drivers from the device manager. Windows attempts and fails to install the driver on reboot. Still BSOD in normal mode - now running Seatools, long test.

 

[Arc]

OK ... let us know the result.
Windows may not auto-configure the driver at restart if it is not available via windows update. In that case you have to need to install the driver manually following Driver Install - Device Manager.

 

[CaptainSEO]

I haven't been able to get the laptop running long enough to run the msinfo32, so did it in safe mode.

Hope that's OK.

It's attached here.