BSOD Troubleshooting

[lcpc78]

I have been experiencing several BSOD's over the last month or two. Initially I thought my video card was to blame but now I'm not so sure. Most of my dumps pointed to a bad image or seemed to be memory corruption. I've run memtest86 several times on the memory and no errors have come back. I also was running AVG 2011 and removed it believing it was the culprit. I've had two so far occur today. The earlier one pointed to the following devices as being the cause:

ntoskrnl.exe    ntoskrnl.exe+29ef0    fffff800`02c10000    fffff800`031f9000    0x005e9000    0x4d9fdd5b    4/8/2011 11:15:23 PM    Microsoft® Windows® Operating System    NT Kernel & System    6.1.7601.17592 (win7sp1_gdr.110408-1631)    Microsoft Corporation    C:\Windows\system32\ntoskrnl.exe

The second one I just got showed:

 ataport.SYS    ataport.SYS+e788    fffff880`00fbd000    fffff880`00fe7000    0x0002a000    0x00000000                            
tcpip.sys    tcpip.sys+7c0c1    fffff880`0167d000    fffff880`01881000    0x00204000    0x00000000                            
Unknown_Module_fffffa80`06ea7ca8    Unknown_Module_fffffa80`06ea7ca8+686a98    fffffa80`06ea7ca8    fffffa80`0dd4fa10    0x06ea7d68    0x00000000

So I am not sure what the unknown module's are. I am also attaching the minidump files to assist with the analysis.

 

[mgorman87]

Looks like you've got some serious OS corruption going on here.

Run a disk check first - http://www.sevenforums.com/tutorials/433-disk-check.html

and then run a system file check - http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

BSOD BUGCHECK SUMMARY

[font=lucida console]
Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631
Debug session time: Thu Jun 23 11:34:18.140 2011 (UTC - 4:00)
System Uptime: 0 days 0:38:18.670
*** WARNING: Unable to verify timestamp for tcpip.sys
*** ERROR: Module load completed but symbols could not be loaded for tcpip.sys
Probably caused by : tcpip.sys ( tcpip+7c0c1 )
EXCEPTION_CODE: (NTSTATUS) 0xc0000096 - {EXCEPTION}  Privileged instruction.
BUGCHECK_STR:  0x3B
FAILURE_BUCKET_ID:  X64_0x3B_tcpip+7c0c1
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631
Debug session time: Thu Jun 23 10:11:35.319 2011 (UTC - 4:00)
System Uptime: 0 days 12:25:54.833
Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )
BUGCHECK_STR:  0xD1
PROCESS_NAME:  EverQuest2.exe
FAILURE_BUCKET_ID:  X64_0xD1_nt!KiPageFault+260
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  
[/font]

 

[lcpc78]

I'm afraid it may be due to the large number of BSOD's I was receiving before removing AVG 2011. I'll run a Disk Check and SFC to see if I can find any errors.

Thanks!

 

[lcpc78]

So ran a chkdsk and didn't have any errors come back. Ran a SFC /ScanNow and there were some corruption that is said it could not repair. I checked the log and it didn't show anything it couldn't repair. It listed chkdsk.chm as the file that needed repair. Decided to run another SFC /scannow and it blue screened again. I'll post what the BSOD is once I get it back up.

 

[lcpc78]

Ok finally got the system back up. I'm attaching the minidump. It is saying it faulted on:

"The driver probably at fault is: fltmgr.sys"

I have also run SRC /SCANNOW several times and it keeps saying it runs across files it can't repair. I looked in the log and this is what I get:

 2011-06-23 13:22:42, Info                  CSI    00000999 [SR] Repairing 1 components
2011-06-23 13:22:42, Info                  CSI    0000099a [SR] Beginning Verify and Repair transaction
2011-06-23 13:22:42, Info                  CSI    0000099c [SR] Repairing corrupted file [ml:520{260},l:56{28}]"\??\C:\Windows\Help\mui\0409"\[l:22{11}]"diskmgt.CHM" from store
2011-06-23 13:22:42, Info                  CSI    0000099f [SR] Repair complete
2011-06-23 13:22:42, Info                  CSI    000009a0 [SR] Committing transaction
2011-06-23 13:22:42, Info                  CSI    000009a4 [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction  have been successfully repaired

 

[mgorman87]

The dump shows a lot of corruption. All you your drivers say Unavailable when they should show dates. I would try doing a http://www.sevenforums.com/tutorials/3413-repair-install.html

BSOD BUGCHECK SUMMARY

[FONT=lucida console]
Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631
Debug session time: Thu Jun 23 13:34:18.950 2011 (UTC - 4:00)
System Uptime: 0 days 0:25:10.089
*** WARNING: Unable to verify timestamp for fltmgr.sys
*** ERROR: Module load completed but symbols could not be loaded for fltmgr.sys
Probably caused by : fltmgr.sys ( fltmgr+6879 )
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR:  0x1E_c0000005
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_0x1E_c0000005_fltmgr+6879
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  
[/FONT]

fffff880`00e53000 fffff880`00eaa000   ACPI     ACPI.sys     unavailable (00000000)
fffff880`00e47000 fffff880`00e52000   amdxata  amdxata.sys  unavailable (00000000)
fffff880`00e14000 fffff880`00e1d000   atapi    atapi.sys    unavailable (00000000)
fffff880`00e1d000 fffff880`00e47000   ataport  ataport.SYS  unavailable (00000000)
fffff880`00c7f000 fffff880`00d3f000   CI       CI.dll       unavailable (00000000)
fffff880`01659000 fffff880`01689000   CLASSPNP CLASSPNP.SYS unavailable (00000000)
fffff880`00c21000 fffff880`00c7f000   CLFS     CLFS.SYS     unavailable (00000000)
fffff880`01175000 fffff880`011e7000   cng      cng.sys      unavailable (00000000)
fffff880`01643000 fffff880`01659000   disk     disk.sys     unavailable (00000000)
fffff880`01103000 fffff880`01117000   fileinfo fileinfo.sys unavailable (00000000)
fffff880`010b7000 fffff880`01103000   fltmgr   fltmgr.sys   unavailable (00000000)
fffff880`0122c000 fffff880`01236000   Fs_Rec   Fs_Rec.sys   unavailable (00000000)
fffff880`01609000 fffff880`01643000   fvevol   fvevol.sys   unavailable (00000000)
fffff880`01900000 fffff880`0194a000   fwpkclnt fwpkclnt.sys unavailable (00000000)
fffff800`02c09000 fffff800`02c52000   hal      hal.dll      Sat Nov 20 08:00:25 2010 (4CE7C669)
fffff880`01600000 fffff880`01609000   hwpolicy hwpolicy.sys unavailable (00000000)
fffff800`00bd3000 fffff800`00bdd000   kdcom    kdcom.dll    Sat Feb 05 11:52:49 2011 (4D4D8061)
fffff880`01200000 fffff880`0121b000   ksecdd   ksecdd.sys   unavailable (00000000)
fffff880`01460000 fffff880`0148b000   ksecpkg  ksecpkg.sys  unavailable (00000000)
fffff880`00c00000 fffff880`00c0d000   mcupdate mcupdate.dll unavailable (00000000)
fffff880`00f9a000 fffff880`00fb4000   mountmgr mountmgr.sys unavailable (00000000)
fffff880`00eb3000 fffff880`00ebd000   msisadrv msisadrv.sys unavailable (00000000)
fffff880`01117000 fffff880`01175000   msrpc    msrpc.sys    unavailable (00000000)
fffff880`019e8000 fffff880`019fa000   mup      mup.sys      unavailable (00000000)
fffff880`014e4000 fffff880`015d7000   ndis     ndis.sys     unavailable (00000000)
fffff880`01400000 fffff880`01460000   NETIO    NETIO.SYS    unavailable (00000000)
fffff800`02c52000 fffff800`0323b000   nt       ntkrnlmp.exe Sat Apr 09 00:15:23 2011 (4D9FDD5B)
fffff880`01254000 fffff880`013f7000   Ntfs     Ntfs.sys     unavailable (00000000)
fffff880`00efd000 fffff880`00f12000   partmgr  partmgr.sys  unavailable (00000000)
fffff880`00ebd000 fffff880`00ef0000   pci      pci.sys      unavailable (00000000)
fffff880`00f83000 fffff880`00f8a000   pciide   pciide.sys   unavailable (00000000)
fffff880`00f8a000 fffff880`00f9a000   PCIIDEX  PCIIDEX.SYS  unavailable (00000000)
fffff880`0121b000 fffff880`0122c000   pcw      pcw.sys      unavailable (00000000)
fffff880`00c0d000 fffff880`00c21000   PSHED    PSHED.dll    unavailable (00000000)
fffff880`019ae000 fffff880`019e8000   rdyboost rdyboost.sys unavailable (00000000)
fffff880`019a6000 fffff880`019ae000   spldr    spldr.sys    unavailable (00000000)
fffff880`016fc000 fffff880`01900000   tcpip    tcpip.sys    unavailable (00000000)
32e02ae9`2c0b682c 32e02aea`0e224bad   Unknown_Module_32e02ae9_2c0b682c Unknown_Module_32e02ae9`2c0b682c unavailable (00000000)
fffff880`00ef0000 fffff880`00efd000   vdrvroot vdrvroot.sys unavailable (00000000)
fffff880`00fb4000 fffff880`00ff0000   vmbus    vmbus.sys    unavailable (00000000)
fffff880`0194a000 fffff880`0195a000   vmstorfl vmstorfl.sys unavailable (00000000)
fffff880`00f12000 fffff880`00f27000   volmgr   volmgr.sys   unavailable (00000000)
fffff880`00f27000 fffff880`00f83000   volmgrx  volmgrx.sys  unavailable (00000000)
fffff880`0195a000 fffff880`019a6000   volsnap  volsnap.sys  unavailable (00000000)
fffff880`00d3f000 fffff880`00de3000   Wdf01000 Wdf01000.sys unavailable (00000000)
fffff880`00de3000 fffff880`00df2000   WDFLDR   WDFLDR.SYS   unavailable (00000000)
fffff880`00e00000 fffff880`00e14000   winhv    winhv.sys    unavailable (00000000)
fffff880`00eaa000 fffff880`00eb3000   WMILIB   WMILIB.SYS   unavailable (00000000)