I'm sorry to say that not much has changed in terms of the bugcheck / stack.
What we are seeing is similar to before (even most of the same routines are being called):
Code:
Debug session time: Tue Oct 22 20:27:25.242 2013 (UTC + 3:00)
Code:
BugCheck 50, {fffff8a009245000, 0, fffff800033aa0d3, 0}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!FsRtlNotifyFilterReportChange+3c7 )
Code:
2: kd> !procdumpext.dpx
Start memory scan : 0xfffff8800967ee18 ($csp)
End memory scan : 0xfffff88009680000 (Stack Base)
0xfffff8800967ee78 : 0xfffff80003391bc2 : nt!CcMapData+0xd2
0xfffff8800967ef38 : 0xfffff88001713383 : Ntfs!NtfsReadUsnJournal+0xb52
0xfffff8800967ef78 : 0xfffff80003092cee : nt!KiPageFault+0x16e
0xfffff8800967ef80 : 0x0000000000000000 : Trap @ fffff8800967ef80
0xfffff8800967f0a8 : 0xfffff800030b0318 : nt!KeReleaseSemaphore+0x228
0xfffff8800967f0e8 : 0xfffff800033aa0d3 : nt!FsRtlNotifyFilterReportChange+0x3c7
0xfffff8800967f128 : 0xfffff8000308a28d : nt!ExpReleaseResourceForThreadLite+0x33d
0xfffff8800967f1b8 : 0xfffff880016cb5e1 : Ntfs!NtfsRenameLcb+0xed
0xfffff8800967f1f8 : 0xfffff880016cb0f0 : Ntfs!NtfsRenameLinkInDir+0xd4
0xfffff8800967f238 : 0xfffff8800166aad9 : Ntfs!NtfsReportDirNotify+0xe5
0xfffff8800967f2c8 : 0xfffff880016c2539 : Ntfs!NtfsUpdateFcbFromLinkRemoval+0x29
0xfffff8800967f308 : 0xfffff880016c98e9 : Ntfs!NtfsSetRenameInfo+0xb59
0xfffff8800967f578 : 0xfffff8800967f590 : !du "ORIG_H~1.LOCORIG_HEAD.lock"
0xfffff8800967f588 : 0xfffff8800967f5a8 : !du "ORIG_HEAD.lock"
0xfffff8800967f590 : 0x004700490052004f : !du "ORIG_H~1.LOCORIG_HEAD.lock"
0xfffff8800967f598 : 0x0031007e0048005f : !du "_H~1.LOCORIG_HEAD.lock"
0xfffff8800967f5a0 : 0x0043004f004c002e : !du ".LOCORIG_HEAD.lock"
0xfffff8800967f5a8 : 0x004700490052004f : !du "ORIG_HEAD.lock"
0xfffff8800967f5b0 : 0x004100450048005f : !du "_HEAD.lock"
0xfffff8800967f5f8 : 0xfffff800030ac891 : nt!FsRtlCheckOplockEx+0x5b1
0xfffff8800967f608 : 0xfffff800031c8e80 : nt!ExAllocatePoolWithTag+0x270
Unable to load image \SystemRoot\system32\DRIVERS\DamageGuardX64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for DamageGuardX64.sys
*** ERROR: Module load completed but symbols could not be loaded for DamageGuardX64.sys
0xfffff8800967f698 : 0xfffff88001660000 : Ntfs!NtfsFsdSetInformation+0x198
0xfffff8800967f6f8 : 0xfffff880016ed985 : Ntfs!NtfsCommonSetInformation+0x7d5
0xfffff8800967f798 : 0xfffff8800166227e : Ntfs!NtfsInitializeTopLevelIrp+0x3e
0xfffff8800967f7d8 : 0xfffff8800165ff84 : Ntfs!NtfsFsdSetInformation+0x11c
0xfffff8800967f858 : 0xfffff880014eebcf : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
0xfffff8800967f8e8 : 0xfffff880014ed6df : fltmgr!FltpDispatch+0xcf
0xfffff8800967f948 : 0xfffff80003372e03 : nt!NtSetInformationFile+0x91f
0xfffff8800967f9f8 : 0xfffff8800150eb00 : fltmgr!FltpFastIoQueryStandardInfo
0xfffff8800967fa68 : 0xfffff80003093e53 : nt!KiSystemServiceCopyEnd+0x13
0xfffff8800967fad8 : 0xfffff80003093e53 : nt!KiSystemServiceCopyEnd+0x13
We can see that one of the fore mentioned drivers are still present, and is appearing
on the stack, a different driver on the loaded modules list is I think what is using
fltmgr which is normally
being used by an antivirus software,
which I don't see you're using?.
Code:
lmDvmdgFltrX64
Browse full module list
start end module name
fffff880`03083000 fffff880`0308c000 dgFltrX64 (deferred)
Image path: \SystemRoot\system32\drivers\dgFltrX64.sys
Image name: dgFltrX64.sys
Browse all global symbols functions data
Timestamp: Mon Dec 12 10:48:49 2011 (4EE5BFF1)
CheckSum: 000150A8
ImageSize: 00009000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
2: kd> lmDvmDamageGuardX64
Browse full module list
start end module name
fffff880`01d37000 fffff880`01d6e000 DamageGuardX64 T (no symbols)
Loaded symbol image file: DamageGuardX64.sys
Image path: \SystemRoot\system32\DRIVERS\DamageGuardX64.sys
Image name: DamageGuardX64.sys
Browse all global symbols functions data
Timestamp: Thu Feb 09 07:36:21 2012 (4F335B55)
CheckSum: 00041E45
ImageSize: 00037000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Apart from on bugcheck that occurred when removing / using the Bluetooth module,
are the bugchecks onlyhappening when you're using Unity / Git?
I would like to run some tests if you were to comply.
Warning
The Following Method Should NOT Be Performed On An SSD!
Testing the HDD:
- Perform a Disk Check | Disk Check
- Then Post the results following | THIS METHOD
- Download SeaTools for DOS if you don't want to use a CD to test the HDD you can use YUMI – Multiboot USB Creator to create a bootable USB (instructions are found at the bottom of both pages).
- If SeaTools for Windows is unable to recognize your HDD visit HDDdiag and follow the instructions.
If SeaTools For DOS does not recognize the drive;
Boot into the BIOS using the
*Fxkey.
Look for an entry called
SATA Mode (or something similar), it should be set to
IDE / AHCI.
It's probably set to
AHCI which is why SeaTools doesn't recognize them in the DOS environment.
Set it to
IDE then save and exit usually by pressing the
F10 key.
Now boot into SeaTools and it should detect the drives.
Start the
Long Test and let it run.
Upon completion don't try to boot into Windows as it will only result in a BSOD, go back into the BIOS
and change the SATA setting back to what it was in the first place.
Please scan for possible infection and file corruption.
(*Kaspersky Rescue CD from a USB thumbdrive)
Keep us posted
.
Running Unity/Chrome/Skype/Notepad++. I've attached the latest dump files.
.