BSODs during windows update

[RobertTo]

Hello, I had some BSODs during windows update today. I ran memtest, everything is fine. I attach minidumps. Please let me know, what´s the problem.

Thank you

 

[usasma]

How long did you run Memtest for? It should be run for a minimum of 3 passes - while overnight is better.

Lot's of STOP 0x24 errors (the NTFS file system on your hard drive) - so let's start with these diagnostics:
1 - HD Diagnostic (read the details at the link)

2 -

CHKDSK /R /F:
Run CHKDSK /R /F from an elevated (Run as adminstrator) Command Prompt. Please do this for each hard drive on your system.
When it tells you it can't do it right now - and asks you if you'd like to do it at the next reboot - answer Y (for Yes) and press Enter. Then reboot and let the test run. It may take a while for it to run, but keep an occasional eye on it to see if it generates any errors. See "CHKDSK LogFile" below in order to check the results of the test.

Elevated Command Prompt:
Go to Start and type in "cmd.exe" (without the quotes)
At the top of the Search Box, right click on Cmd.exe and select "Run as administrator"

CHKDSK LogFile:
Go to Start and type in "eventvwr.msc" (without the quotes) and press Enter
Expand the Windows logs heading, then select the Application log file entry.
Double click on the Source column header.
Scroll down the list until you find the Chkdsk entry (wininit for Win7) (winlogon for XP).
Copy/paste the results into your next post.

After all that is done, please run Driver Verifier according to these settings (it's recommended for STOP 0x4E errors here: The Basics:Bugchecks Explained: PFN_LIST_CORRUPT ):

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line.

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users

Summary of the BSOD's:

Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Wed Jun  2 04:37:37.918 2010 (GMT-4)
System Uptime: 0 days 0:02:42.964
BugCheck 24, {1904fb, fffff880072eb6e8, fffff880072eaf50, fffff880012a6c7c}
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonCleanup+2649 )
PROCESS_NAME:  TrustedInstall
BUGCHECK_STR:  0x24
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Wed Jun  2 04:34:08.062 2010 (GMT-4)
System Uptime: 0 days 0:05:23.108
BugCheck 1A, {41790, fffffa8004b71370, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  WerFault.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Wed Jun  2 04:28:06.195 2010 (GMT-4)
System Uptime: 0 days 0:08:21.241
BugCheck 1A, {41790, fffffa8004bd1c70, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  svchost.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Wed Jun  2 04:19:04.064 2010 (GMT-4)
System Uptime: 0 days 0:19:12.110
BugCheck 24, {1904fb, fffff8800317e768, fffff8800317dfd0, fffff880012b4fb4}
Probably caused by : Ntfs.sys ( Ntfs! ?? ::NNGAKEGL::`string'+c97e )
PROCESS_NAME:  System
BUGCHECK_STR:  0x24
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Wed Jun  2 03:59:18.301 2010 (GMT-4)
System Uptime: 0 days 0:03:40.347
BugCheck 4E, {99, 1b92c9, 0, 1b9e49}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
BUGCHECK_STR:  0x4E_99
PROCESS_NAME:  Mobile Partner
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Wed Jun  2 03:55:01.775 2010 (GMT-4)
System Uptime: 0 days 0:04:01.211
BugCheck 1A, {41201, fffff6800001fef0, bdf0000190a28867, fffffa80091cca00}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+13bb2 )
BUGCHECK_STR:  0x1a_41201
PROCESS_NAME:  svchost.exe

 

[RobertTo]

Thank you.

I just ran chkdsk, l´ll post the log file. Then I´ll do the HD diagnostics outside the windows. In my minidump you posted, I see others files that can propably cause BSODs, what are these for? That ntfs.sys crashed some other programs? If yes, which ones?

I ran 7 passes in memtest, found no errors. Do you think it can be a memory fault?

Thanks.

EDIT: I can´t find my todays lof from chkdsk. There is only log from about month ago. What could cause this?

 

[usasma]

Did the chkdsk show any errors? I don't know why the log file wouldn't show up.
Run the HD diagnostics. Then run the chkdsk to see if you get any errors.
The log file isn't needed if you can see that there's no errors (and we can't do much with the log file even if there are errors).

Probably caused by : ntkrnlmp.exe

This file is the kernel (core) of the Windows operating system. If it was a problem, you'd see many more issues than just the occasional BSOD (and Windows has a built-in mechanism that helps to ensure it doesn't get corrupted).

Probably caused by : memory_corruption

This is a corruption of the structures (bits and bytes) in virtual memory.
The Windows Memory Manager manages the translation from physical memory (RAM) to virtual memory
It is possible for issues with RAM to cause this - that's why we asked you to run Memtest (to rule that out).
But it's much more likely that a misbehaving driver caused this.

7 passes of Memtest effectively rules out most memory problems.

If NTFS.sys is corrupted, then there will be issues with other programs also. But, in analyzing BSOD's we discount errors in Windows files (of which NTFS.sys is one), because of the System File Checker protecting them, and the fact that errors in them will cause widespread problems in most systems.

So, we proceed this way:
- first we suspect 3rd party (non-Microsoft drivers) - most errors are caused by this
- then we suspect hardware/compatibility issues
- then we suspect Windows issues (very unlikely to happen).

 

[RobertTo]

Thank you.

I ran chkdsk with no errors, both long and short HDD diagnostics tests outside the windows passed...everything OK. The weird thing is, the BSODs occurs just about one hour from cold boot, doesn´t matter if I do something on my PC or not. I ran memtest yesterday afternoon + night for 10 passes, everything was ok. Today, I decided do run memtest on a cold boot and after one pass, I have more than 10000 errors. What this fact could mean? PC crashes once in the morning, and for rest of the day it´s stable. I can´t even imagine where is the problem.

Thanks

 

[usasma]

It's most likely that there's a broken trace (the little solder lines on printed circuits that conduct electricity). It's most likely on the motherboard or the memory. The memory is cheaper and easier to replace, so start with that.

In this case, you have to run the tests when the system is cold. Any test after the system has run will be suspect - so if you get a test to pass (after the first one), you'll have to wait for hours until the system has cooled sufficiently.

So, test each RAM stick individually in the first slot - while the system is cold.
If all sticks fail, then the slot is bad. If only one fails, then it's the stick that's bad.

Once you find a good stick, then test it in each slot (when the system is cold) to make sure all the slots are OK.