BSODs too regular since updating to Win 7.

[bilzmale]

Went from XP to 7 in January and have had numerous crashes since. Have made 2 fresh instals and 2 repair/upgrade instals but still crashing. The events seem random and log files are not helpful although Firefox, Thunderbird and Iolo System Shield crash but do not result in a BSOD.

Have run Seatools on the HDDs and they pass, Memtest86 and Ram passes, CPUStab Test and no errors. Have installed temp monitors and extra HDD fan and thet stay in the 40-50C range.

Unable to gain much from the dump files as I get Symbols errors (they are installed in C:\Symbols). The most common items mentioned are ntfs.sys in the blue screen and ntkrnlpa.exe in the dump files.

The most common situations where a crash occurs in rough order of frequency are:
1. Installing software
2. Processing images in PS CS4 or Faststone Image Viewer
3. Doing nothing in particular
4. While away from the PC.

I have attached most recent dump files - hope they tell someone more than they tell me .

Thanks (i'm new here)

Bill

 

[Jonathan_King]

Welcome to SF!

It looks as if Acronis and Rollback Rx are causing the issue. Especially the latter, and that may be why ntfs.sys is blamed by Windbg.

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Jonathan\AppData\Local\Temp\Temp1_Minidump.zip\050710-25022-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82e17000 PsLoadedModuleList = 0x82f5f810
Debug session time: Fri May  7 03:27:10.852 2010 (GMT-4)
System Uptime: 1 days 22:28:43.600
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
.......................
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001904fb
Arg2: be27b350
Arg3: be27af30
Arg4: 8b2187f5

Debugging Details:
------------------

Unable to load image \SystemRoot\system32\DRIVERS\amp.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for amp.sys
*** ERROR: Module load completed but symbols could not be loaded for amp.sys
*** WARNING: Unable to verify timestamp for Shieldf.sys
*** ERROR: Module load completed but symbols could not be loaded for Shieldf.sys
*** WARNING: Unable to verify timestamp for tdrpm258.sys
*** ERROR: Module load completed but symbols could not be loaded for tdrpm258.sys

EXCEPTION_RECORD:  be27b350 -- (.exr 0xffffffffbe27b350)
ExceptionAddress: 8b2187f5 (Ntfs!NtfsDecodeFileObject+0x00000039)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 0000000c
Attempt to read from address 0000000c

CONTEXT:  be27af30 -- (.cxr 0xffffffffbe27af30)
eax=be27b470 ebx=00000000 ecx=00000008 edx=be27b464 esi=be27b460 edi=00000000
eip=8b2187f5 esp=be27b418 ebp=be27b420 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
Ntfs!NtfsDecodeFileObject+0x39:
8b2187f5 8b5104          mov     edx,dword ptr [ecx+4] ds:0023:0000000c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  ZinioReader.ex

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  0000000c

READ_ADDRESS: GetPointerFromAddress: unable to read from 82f7f718
Unable to read MiSystemVaType memory at 82f5f160
 0000000c 

FOLLOWUP_IP: 
Ntfs!NtfsDecodeFileObject+39
8b2187f5 8b5104          mov     edx,dword ptr [ecx+4]

FAULTING_IP: 
Ntfs!NtfsDecodeFileObject+39
8b2187f5 8b5104          mov     edx,dword ptr [ecx+4]

BUGCHECK_STR:  0x24

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from 8b2a2ef1 to 8b2187f5

STACK_TEXT:  
be27b420 8b2a2ef1 be27b510 906a4260 be27b460 Ntfs!NtfsDecodeFileObject+0x39
be27b498 8b2a8a4d be27b510 ae713b78 35032e72 Ntfs!NtfsCommonQueryInformation+0x56
be27b4fc 8b2b6d53 be27b510 ae713b78 00000001 Ntfs!NtfsFsdDispatchSwitch+0x17b
be27b630 82e534bc 8695a020 ae713b78 ae713b78 Ntfs!NtfsFsdDispatchWait+0x1c
be27b648 8b12120c 00000000 82769508 00000000 nt!IofCallDriver+0x63
be27b66c 8b1220bf be27b68c 86946030 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
be27b6a4 8b136fc3 875c1a80 875c1a80 be27b700 fltmgr!FltPerformSynchronousIo+0xb9
be27b6b4 971eb7cc 875c1a80 82769508 be27b73c fltmgr!FltQueryInformationFile+0x4f
WARNING: Stack unwind information not available. Following frames may be wrong.
be27b700 971e2879 be27b854 be27b7c8 00000001 amp+0x117cc
be27b7fc 971ea826 be27b854 be27b834 00000000 amp+0x8879
be27b87c 8b11daeb 866e4e40 be27b89c be27b8c8 amp+0x10826
be27b8e8 8b1209f0 be27b92c ef636008 00000000 fltmgr!FltpPerformPreCallbacks+0x34d
be27b900 8b1341fe be27b92c 8b137f3c 00000000 fltmgr!FltpPassThroughInternal+0x40
be27b914 8b1348b7 be27b92c ef636008 86953248 fltmgr!FltpCreateInternal+0x24
be27b958 82e534bc 86946030 86959ae0 ef636300 fltmgr!FltpCreate+0x2c9
be27b970 8b184fba 86963890 ef636008 00000000 nt!IofCallDriver+0x63
be27b9c0 8b185198 86953190 ef636008 86963890 Shieldf+0x1fba
be27b9dc 82e534bc 86953190 ef636008 8b524628 Shieldf+0x2198
be27b9f4 8b52d1be 8b54e67c 86953190 ef636008 nt!IofCallDriver+0x63
be27ba88 8305766d 93ab422a be27bc30 00000000 tdrpm258+0xa1be
be27bb60 8303821f 861a0da8 853c9870 86fc3d20 nt!IopParseDevice+0xed7
be27bbdc 8305e28d 00000000 be27bc30 00000040 nt!ObpLookupObjectName+0x4fa
be27bc38 830565eb 0312e838 853c9870 9e565f01 nt!ObOpenObjectByName+0x159
be27bcb4 83061ef6 0312e894 80100080 0312e838 nt!IopCreateFile+0x673
be27bd00 82e5a44a 0312e894 80100080 0312e838 nt!NtCreateFile+0x34
be27bd00 778464f4 0312e894 80100080 0312e838 nt!KiFastCallEntry+0x12a
0312e89c 00000000 00000000 00000000 00000000 0x778464f4


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsDecodeFileObject+39

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bbf45

STACK_COMMAND:  .cxr 0xffffffffbe27af30 ; kb

FAILURE_BUCKET_ID:  0x24_Ntfs!NtfsDecodeFileObject+39

BUCKET_ID:  0x24_Ntfs!NtfsDecodeFileObject+39

Followup: MachineOwner
---------

I recommend uninstalling Rollback completely, and Acronis too, because it was found on the stack at the time of the crash.

 

[bilzmale]

Thanks Jonathan but there must be something else going on. I was trialling RollbackRx as Windows Restore was not working. I uninstalled it well before these crashes. (see screenshot for files found).

I replaced Rollback with Acronis and it is currently installed but have only had it about a forthight. The instability dates back several months.

Over to you.

Bill

 

[zigzag3143]

Went from XP to 7 in January and have had numerous crashes since. Have made 2 fresh instals and 2 repair/upgrade instals but still crashing. The events seem random and log files are not helpful although Firefox, Thunderbird and Iolo System Shield crash but do not result in a BSOD.

Have run Seatools on the HDDs and they pass, Memtest86 and Ram passes, CPUStab Test and no errors. Have installed temp monitors and extra HDD fan and thet stay in the 40-50C range.

Unable to gain much from the dump files as I get Symbols errors (they are installed in C:\Symbols). The most common items mentioned are ntfs.sys in the blue screen and ntkrnlpa.exe in the dump files.

The most common situations where a crash occurs in rough order of frequency are:
1. Installing software
2. Processing images in PS CS4 or Faststone Image Viewer
3. Doing nothing in particular
4. While away from the PC.

I have attached most recent dump files - hope they tell someone more than they tell me .

Thanks (i'm new here)

Bill

Bill

Jonathan_king is correct. The rollback drivers are still installed and loading. Besides that you have drivers from as far back as 2004. They by themselves could be casuing these.

ASACPI.sys        0x91559000    0x9155a420    0x00001420    0x411c2d04    8/12/2004 10:52:52 PM                        
ULCDRHlp.sys        0x915e8000    0x915eeb00    0x00006b00    0x41c9dd4d    12/22/2004 4:47:09 PM                        
dvd43llh.sys        0x915ef000    0x915f3980    0x00004980    0x4207b091    2/7/2005 2:16:49 PM                        
FileDisk.SYS        0x914c4000    0x914c6440    0x00002440    0x43cec168    1/18/2006 6:30:00 PM                        
PhysMem.sys        0x91502000    0x91502e00    0x00000e00    0x44e04ad5    8/14/2006 6:05:09 AM                        
secdrv.SYS        0xac8d6000    0xac8e0000    0x0000a000    0x45080528    9/13/2006 9:18:32 AM                        
elrawdsk.sys        0x914c7000    0x914ca600    0x00003600    0x488b65e1    7/26/2008 1:58:57 PM                        
adfs.SYS        0x9ae77000    0x9ae87e80    0x00010e80    0x48a447cb    8/14/2008 10:57:15 AM                        
nvm62x32.sys        0x91a1e000    0x91a72c80    0x00054c80    0x48f8fcf7    10/17/2008 5:00:39 PM

These need to be updated.


I also note that your ZinioReader is loaded in at least two of these crashes

Ken

 

[bilzmale]

Thanks for that Ken. You are right about Zineo Reader. I was running beta 4 and it froze when I ran it today. Have uninstalled and gone back to ver 3.7.

I have Windows Update on automatic - how do I force an update on these old drivers?

OK did some more digging on those drivers.

ASACPI.sys ASAS Motherboard

ULCDRHlp.sys Ulead CD Burner - will uninstall (or delete) as no longer use Ulead prog.

dvd43llh.sys DVD Copier - will uninstall and delete.

FileDisk.SYS Part of iolo System Mechanic which has a crash history. Possible incompatability with Prevx A/V also installed. Will uninstall Sys Mech.

PhysMem.sys Web search did not turn up anything??

secdrv.SYS Safe Disk CD protection - may be incompatilble with dvd43

elrawdsk.sys System Mechanic RAW Disk writer - sound suspicious to me.

adfs.SYS Web search did not turn up anything??

nvm62x32.sys nVidia motherboard (Ethernet driver perhaps??)

 

[Jonathan_King]

I don't think Windows will automatically install driver updates, but you can check this setting if you're nervous.

View attachment 71521

Please be sure to upload any new dmp files.

 

[bilzmale]

Jonathan I have uninstalled iolo System Mechanic and the PC seems more responsive when loading progs and surfing. Too bad I have 3 years of subscriptions!! Will look for updates to the Asus and nVidia drivers.

How can I identify the RollbackRx drivers that are still loading?

Bill

 

[zigzag3143]

Jonathan I have uninstalled iolo System Mechanic and the PC seems more responsive when loading progs and surfing. Too bad I have 3 years of subscriptions!! Will look for updates to the Asus and nVidia drivers.

How can I identify the RollbackRx drivers that are still loading?

Bill

With the nvidia driver you need to completely un-install the current one (nvidia makes an uninstall tool) and then install the new version.


Let me find out about rollback drivers.

Ken

One thing you can do is search C:\windows\system32 (or 64) for the rollback driver that JK named. Shieldf.sys is the rollback driver being loaded, and it is 32 bit so should be in the 32 bit folder


I will examine the memory stack to see where it is loaded

 

[bilzmale]

Found 4 drivers with same Modify date and time:- shield.sys; shieldf.sys; shieldm.sys and shdbus.sys

Are these doing any harm or am i just better without them?

Bill

 

[jcgriff2]

Found 4 drivers with same Modify date and time:- shield.sys; shieldf.sys; shieldm.sys and shdbus.sys

Are these doing any harm or am i just better without them?

Bill

They belong to Horizon Datasys, Inc., Rollback Rx

Is the app completely uninstalled?

Use Revo --> Download Revo Uninstaller Freeware - Free and Full Download

Be sure the asacpi.sys driver is updated - Asus mobo utility ATK0110 driver.

See SlideShow for download; however, please note the download in screen #4 is for Asus "Cool 'n' Quiet". Look in same area for ATK0110 AI Suite mobo driver.

SlideShow --> Asus mobo utility driver updates - Windows Live

Asus Drivers --> ASUSTeK Computer Inc.-Support-

Run Windows 7 Upgrade Advisor --> Windows 7 Upgrade Advisor

Regards. . .

jcgriff2

.

 

[bilzmale]

Hello JC and thanks for your reply. RollbackRx was a trial and the uninstall did not go well (I have Revo Pro) - deleted the drivers manually. Have also updated the MB, LAN and Audio from ASUS. Used Driver Robot which is pretty hopeless - it downloaded Intel drivers for my AMD setup.

Will now download and run Upgrade Adviser.

Also am trialling the new MS Security Suite http://www.microsoft.com/security_essentials/
to see if it runs better alongside Prevx.

Bill

 

[Jonathan_King]

Hello JC and thanks for your reply. RollbackRx was a trial and the uninstall did not go well (I have Revo Pro) - deleted the drivers manually. Have also updated the MB, LAN and Audio from ASUS. Used Driver Robot which is pretty hopeless - it downloaded Intel drivers for my AMD setup.

Will now download and run Upgrade Adviser.

Also am trialling the new MS Security Suite http://www.microsoft.com/security_essentials/
to see if it runs better alongside Prevx.

Bill

You are aware it is not recommended at all to run multiple AV's at the same time?

 

[bilzmale]

I queried this when I bought Prevx and they assured me it would coexist with other AV progs. That seems not to have been the case with iolo Sys Mech tho. You are right - I don't need both but can't resist trialling new software.

Btw ran Windows Update Advisor and got a clean bill of health.

Must say I'm impressed with the support on this forum - might hang around even if my PC is stable. Thanks to all who responded.

 

[bilzmale]

OK uninstalled Microsoft Security using Revo Pro. Did a restart and Win crashed on startup. Win went into startup repair and ended up doing a restore. Interesting. Have about 50 RAW image files to process so that should be a good test.

Will stay with Windows Firewall for now and if everything stays stable will reinstall Online Armour.