Crash Dmp - 0x...c2 and 0x...24

[beeswax]

I just install my MB and loaded a fresh copy on win7. I have gotten a blue screen each day since. 0x24 first and then 0xc2.

There isn't a pattern to the crahed yet. One happened at boot and one when I was playing wow. I have attached the crash dump files. I have to change the DMP extension to txt in order to upload.

Thank you for any help that can be deciphered for the files.



Win7 Prem Home 64bit
Fresh Retail install 12/19

MB - GA-880GMA-USB3
CPU - Athlon II x4 630
Mem - 8g - pc3-10700
Vid - ATI HD 4250 - onboard
Sound - Realtek - on board
HDD - Seagate Barracuda - ST3750528AS
PSU - HCE hp585D atx12v

 

[writhziden]

Download and run the AVG Removal Tool to uninstall AVG, which can be a source of BSODs. Install Microsoft Security Essentials in its place.

 

[writhziden]

BugCheck 50, {fffffa8005049000, 0, fffff80002ece38a, 0}

Unable to load image \SystemRoot\system32\drivers\copperhd.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for copperhd.sys
*** ERROR: Module load completed but symbols could not be loaded for copperhd.sys

Could not read faulting driver name
Probably caused by : copperhd.sys ( copperhd+16c9 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa8005049000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002ece38a, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310f0e0
 fffffa8005049000 

FAULTING_IP: 
nt!memmove+ca
fffff800`02ece38a 4c8b540af8      mov     r10,qword ptr [rdx+rcx-8]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  razerhid.exe

CURRENT_IRQL:  1

IRP_ADDRESS:  ffffffffffffff88

TRAP_FRAME:  fffff88003a942e0 -- (.trap 0xfffff88003a942e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=02010008fffffa80 rbx=0000000000000000 rcx=000000000018ec60
rdx=fffffa8004eba3a4 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ece38a rsp=fffff88003a94478 rbp=00000000a000000c
 r8=000000000000018c  r9=0000000000000001 r10=046786c0ffff2aa4
r11=000000000018eadc r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!memmove+0xca:
fffff800`02ece38a 4c8b540af8      mov     r10,qword ptr [rdx+rcx-8] ds:0700:fffffa80`05048ffc=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002f57df4 to fffff80002ed75c0

STACK_TEXT:  
fffff880`03a94178 fffff800`02f57df4 : 00000000`00000050 fffffa80`05049000 00000000`00000000 fffff880`03a942e0 : nt!KeBugCheckEx
fffff880`03a94180 fffff800`02ed56ae : 00000000`00000000 fffffa80`046243e0 fffff880`02dddf00 fffff800`02edd982 : nt! ?? ::FNODOBFM::`string'+0x426f7
fffff880`03a942e0 fffff800`02ece38a : fffff800`02ef6bc3 fffff880`009ec560 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`03a94478 fffff800`02ef6bc3 : fffff880`009ec560 00000000`00000000 00000000`00000000 00000000`00000000 : nt!memmove+0xca
fffff880`03a94480 fffff800`02ed9f76 : 00000000`00000000 fffffa80`040f8f10 00000000`00000001 00000000`00000000 : nt!IopCompleteRequest+0x5a3
fffff880`03a94550 fffff880`059df6c9 : 00000000`00000156 00000000`00000000 fffffa80`656e6f4e 00000000`00000000 : nt!IopfCompleteRequest+0x6f6
fffff880`03a94640 00000000`00000156 : 00000000`00000000 fffffa80`656e6f4e 00000000`00000000 00000000`000007ff : copperhd+0x16c9
fffff880`03a94648 00000000`00000000 : fffffa80`656e6f4e 00000000`00000000 00000000`000007ff 00000000`00000440 : 0x156


STACK_COMMAND:  kb

FOLLOWUP_IP: 
copperhd+16c9
fffff880`059df6c9 ??              ???

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  copperhd+16c9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: copperhd

IMAGE_NAME:  copperhd.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4af91b39

FAILURE_BUCKET_ID:  X64_0x50_copperhd+16c9

BUCKET_ID:  X64_0x50_copperhd+16c9

Followup: MachineOwner
---------


BugCheck 24, {70f89, 21, 0, 0}

Unable to load image AVGIDSFilter.Sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for AVGIDSFilter.Sys
*** ERROR: Module load completed but symbols could not be loaded for AVGIDSFilter.Sys
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonCleanup+35ee )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 0000000000070f89
Arg2: 0000000000000021
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x24

PROCESS_NAME:  SearchIndexer.

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff880012e9d04 to fffff80002e8a5c0

STACK_TEXT:  
fffff880`05e8f108 fffff880`012e9d04 : 00000000`00000024 00000000`00070f89 00000000`00000021 00000000`00000000 : nt!KeBugCheckEx
fffff880`05e8f110 fffff880`01258829 : 00000000`00000000 00000000`00000000 fffff880`05e8f660 fffff880`05e7e000 : Ntfs!NtfsCommonCleanup+0x35ee
fffff880`05e8f520 fffff800`02e99cda : fffff880`05e8f660 00008000`00000001 00000000`00008000 00000000`000f2400 : Ntfs!NtfsCommonCleanupCallout+0x19
fffff880`05e8f550 fffff880`012583e2 : fffff880`01258810 fffff880`05e8f660 fffff880`05e8f900 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xda
fffff880`05e8f630 fffff880`012f7324 : fffff880`05e8f700 fffff880`05e8f700 fffff880`05e8f700 00000000`00000000 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
fffff880`05e8f6a0 fffff880`0103f23f : fffff880`05e8f700 fffffa80`095aa010 fffffa80`095aa3f8 fffffa80`09265c30 : Ntfs!NtfsFsdCleanup+0x144
fffff880`05e8f910 fffff880`0103d6df : fffffa80`0732d9e0 00000000`00000000 fffffa80`071e7c00 fffffa80`095aa010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`05e8f9a0 fffff880`0387465c : fffffa80`095aa010 00000000`00000000 fffffa80`09744060 00000000`00000000 : fltmgr!FltpDispatch+0xcf
fffff880`05e8fa00 fffffa80`095aa010 : 00000000`00000000 fffffa80`09744060 00000000`00000000 fffffa80`0801d4b0 : AVGIDSFilter+0x365c
fffff880`05e8fa08 00000000`00000000 : fffffa80`09744060 00000000`00000000 fffffa80`0801d4b0 fffff800`0319d88f : 0xfffffa80`095aa010


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsCommonCleanup+35ee
fffff880`012e9d04 49837b4000      cmp     qword ptr [r11+40h],0

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  Ntfs!NtfsCommonCleanup+35ee

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79996d

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsCommonCleanup+35ee

BUCKET_ID:  X64_0x24_Ntfs!NtfsCommonCleanup+35ee

Followup: MachineOwner
---------


BugCheck C2, {7, 109b, c0e7110, fffffa8006b34bb8}

GetPointerFromAddress: unable to read from fffff80003317100
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonClose+539 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 000000000000109b, (reserved)
Arg3: 000000000c0e7110, Memory contents of the pool block
Arg4: fffffa8006b34bb8, Address of the block of pool being deallocated

Debugging Details:
------------------


POOL_ADDRESS:  fffffa8006b34bb8 

FREED_POOL_TAG:  ViMm

BUGCHECK_STR:  0xc2_7_ViMm

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003212be9 to fffff800030e4c40

STACK_TEXT:  
fffff880`0317ea58 fffff800`03212be9 : 00000000`000000c2 00000000`00000007 00000000`0000109b 00000000`0c0e7110 : nt!KeBugCheckEx
fffff880`0317ea60 fffff880`012cf379 : fffffa80`074b7180 fffff800`03285260 fffff8a0`0b915b40 00000000`00000009 : nt!ExDeferredFreePool+0x1201
fffff880`0317eb10 fffff880`012be357 : fffffa80`090b2bd0 fffff8a0`0b915c70 fffff8a0`0b915b40 fffffa80`074b7180 : Ntfs!NtfsCommonClose+0x539
fffff880`0317ebe0 fffff800`030ef001 : 00000000`00000000 fffff800`033db900 fffff800`032e6801 00000000`00000020 : Ntfs!NtfsFspClose+0x15f
fffff880`0317ecb0 fffff800`0337ffee : 00000000`00000000 fffffa80`06409680 00000000`00000080 fffffa80`0639d840 : nt!ExpWorkerThread+0x111
fffff880`0317ed40 fffff800`030d65e6 : fffff880`02f64180 fffffa80`06409680 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0317ed80 00000000`00000000 : fffff880`0317f000 fffff880`03179000 fffff880`0317e9e0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsCommonClose+539
fffff880`012cf379 e918fdffff      jmp     Ntfs!NtfsCommonClose+0x256 (fffff880`012cf096)

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  Ntfs!NtfsCommonClose+539

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

FAILURE_BUCKET_ID:  X64_0xc2_7_ViMm_Ntfs!NtfsCommonClose+539

BUCKET_ID:  X64_0xc2_7_ViMm_Ntfs!NtfsCommonClose+539

Followup: MachineOwner
---------

I note that you have Gigabyte EasyTune6 driver (GVTDrv64.sys) installed on your system which has known issues with Windows 7. See Driver Reference. It would be a good idea to remove the software.

Your first blue screen was caused by copperhd.sys by Razer Diamondback. See Driver Reference for updating the driver. Note: this may have been related to EasyTune's incompatibility with Windows 7.

Your other blue screens were NTFS related, possibly due to corruption on the hard drive and possibly due to AVG. Recommend running http://www.sevenforums.com/tutorials/433-disk-check.html on all drives containing system files and program files. Run first with "automatically fix file system errors" checked, and then if the problem persists, run with "Scan for and attempt recovery of bad sectors" checked.

 

[beeswax]

Uninstalled AVG / Razor software / Easy tune.

Installed MS Security Essentials.

Will post back if another crash happens.

 

[writhziden]

Uninstalled AVG / Razor software / Easy tune.

Installed MS Security Essentials.

Will post back if another crash happens.

Alright, good to hear. We're here if you need help with anything.

 

[beeswax]

If easytune is bad, what would you suggest for pcu core temp monitor. Overdrive?

 

[writhziden]

I use HWiNFO64 myself.

 

[beeswax]

just got another bsod - this time on boot up - dump file attached.

 

[writhziden]

The blue screen was caused by readyboost, probably due to the system files being accessed by multiple processes/applications. I wouldn't worry too much about it unless it occurs again. You can try running without ReadyBoost on your system and see if things run more stable.

 

[beeswax]

thank you for your previous help, everything has been good. Until this morning when i blue screened 0...x19. I have attached the dmp file.

 

[writhziden]

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\beeswax\011412-23072-01 - Copy.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03217000 PsLoadedModuleList = 0xfffff800`0345c670
Debug session time: Sat Jan 14 07:01:17.891 2012 (UTC - 7:00)
System Uptime: 0 days 13:52:26.421
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
..........................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, fffffa80091051c0, fffffa8009105950, c792f38}

GetPointerFromAddress: unable to read from fffff800034c6100
GetUlongFromAddress: unable to read from fffff80003434a18
Probably caused by : ntkrnlmp.exe ( nt!FsRtlTeardownPerStreamContexts+e2 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: fffffa80091051c0, The pool entry we were looking for within the page.
Arg3: fffffa8009105950, The next pool entry.
Arg4: 000000000c792f38, (reserved)

Debugging Details:
------------------

GetUlongFromAddress: unable to read from fffff80003434a18

BUGCHECK_STR:  0x19_20

POOL_ADDRESS:  fffffa80091051c0 

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800033c1cae to fffff80003293c40

STACK_TEXT:  
fffff880`0318c898 fffff800`033c1cae : 00000000`00000019 00000000`00000020 fffffa80`091051c0 fffffa80`09105950 : nt!KeBugCheckEx
fffff880`0318c8a0 fffff800`0354c90e : 00000000`00000705 fffff880`012901b3 fffff8a0`7ffffa80 00000000`00000000 : nt!ExDeferredFreePool+0x12da
fffff880`0318c950 fffff880`0128fbac : fffff8a0`15153140 fffffa80`06a1ab60 fffff880`0318ca28 00000000`00000706 : nt!FsRtlTeardownPerStreamContexts+0xe2
fffff880`0318c9a0 fffff880`01294cc1 : 00000000`01000000 00000000`00000000 fffff800`03434200 00000000`00000001 : Ntfs!NtfsDeleteScb+0x108
fffff880`0318c9e0 fffff880`0120d85c : fffff8a0`15153040 fffff8a0`15153140 fffff800`03434200 fffff880`0318cb52 : Ntfs!NtfsRemoveScb+0x61
fffff880`0318ca20 fffff880`0129264c : fffff8a0`15153010 fffff800`03434260 fffff880`0318cb52 fffffa80`0a2b68d0 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`0318ca50 fffff880`012140e2 : fffffa80`0a2b68d0 fffffa80`0a2b68d0 fffff8a0`15153010 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xdc
fffff880`0318cad0 fffff880`012a2193 : fffffa80`0a2b68d0 fffff800`03434260 fffff8a0`15153010 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`0318cb10 fffff880`01291357 : fffffa80`0a2b68d0 fffff8a0`15153140 fffff8a0`15153010 fffffa80`07ba3180 : Ntfs!NtfsCommonClose+0x353
fffff880`0318cbe0 fffff800`0329e001 : 00000000`00000000 fffff800`0358a900 fffff800`03495801 00000000`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`0318ccb0 fffff800`0352efee : 00000000`00000000 fffffa80`06a1ab60 00000000`00000080 fffffa80`069a49e0 : nt!ExpWorkerThread+0x111
fffff880`0318cd40 fffff800`032855e6 : fffff880`02f64180 fffffa80`06a1ab60 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0318cd80 00000000`00000000 : fffff880`0318d000 fffff880`03187000 fffff880`0318c9e0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!FsRtlTeardownPerStreamContexts+e2
fffff800`0354c90e 448a5e07        mov     r11b,byte ptr [rsi+7]

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!FsRtlTeardownPerStreamContexts+e2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x19_20_nt!FsRtlTeardownPerStreamContexts+e2

BUCKET_ID:  X64_0x19_20_nt!FsRtlTeardownPerStreamContexts+e2

Followup: MachineOwner
---------

These types of crashes are usually caused by an underlying driver. The driver was not named in the crash. Recommend running Driver Verifier to determine the driver that is incompatible/conflicting with your system. To run Driver verifier, do the following:

1. Backup your system and user files
2. Create a system restore point
3. If you do not have a Windows 7 DVD, Create a system repair disc
4. Run Driver Verifier
   
   If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using http://www.sevenforums.com/tutorials/700-system-restore.html OPTION TWO.
   
   Thanks to zigzag3143 for contributing to the above steps.
   If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.

 

[beeswax]

I turned on verifier and ran it for 24 hours, without any crashes. Then last night, around 4am, i hear my system fan peak. when i checked it in the morning it was bsod 0x...19.

What program do you use for dmp files? I've tried ms debugging tools, but i can never seem to get the symbols loaded.

DMP file attached

 

[writhziden]

For debugging, we used WinDbg. You can find good information about how to debug in Crash and lockup debug 'How To' - Windows 7 Forums

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\beeswax\Windows_NT6_BSOD_jcgriff2\012212-25833-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0321c000 PsLoadedModuleList = 0xfffff800`03461670
Debug session time: Sun Jan 22 00:31:08.814 2012 (UTC - 7:00)
System Uptime: 2 days 6:46:51.955
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
..............................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {22, 0, 0, 0}

GetPointerFromAddress: unable to read from fffff800034cb100
GetUlongFromAddress: unable to read from fffff80003439a18
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+72d6 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000022, 
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------

GetUlongFromAddress: unable to read from fffff80003439a18

BUGCHECK_STR:  0x19_22

POOL_ADDRESS:  0000000000000000 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800032254ce to fffff80003298c40

STACK_TEXT:  
fffff880`0976f9c8 fffff800`032254ce : 00000000`00000019 00000000`00000022 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`0976f9d0 fffff800`033c81fa : 00000000`00000000 fffff880`0976fb20 fffff880`0976faa0 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x72d6
fffff880`0976fa60 fffff880`0129e379 : fffffa80`07abe180 fffff800`03439260 fffff8a0`122819f0 00000000`00000000 : nt!ExFreePoolWithTag+0x46a
fffff880`0976fb10 fffff880`0128d357 : fffffa80`07ce2a30 fffff8a0`12281b20 fffff8a0`122819f0 fffffa80`07abe180 : Ntfs!NtfsCommonClose+0x539
fffff880`0976fbe0 fffff800`032a3001 : 00000000`00000000 fffff800`0358f900 fffffa80`08363b01 fffffa80`00000000 : Ntfs!NtfsFspClose+0x15f
fffff880`0976fcb0 fffff800`03533fee : fffff880`09ffd968 fffffa80`08363b60 00000000`00000080 fffffa80`069a49e0 : nt!ExpWorkerThread+0x111
fffff880`0976fd40 fffff800`0328a5e6 : fffff880`009e9180 fffffa80`08363b60 fffff880`009f3fc0 fffff880`01214384 : nt!PspSystemThreadStartup+0x5a
fffff880`0976fd80 00000000`00000000 : fffff880`09770000 fffff880`0976a000 fffff880`0976f9e0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+72d6
fffff800`032254ce cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+72d6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x19_22_nt!_??_::FNODOBFM::_string_+72d6

BUCKET_ID:  X64_0x19_22_nt!_??_::FNODOBFM::_string_+72d6

Followup: MachineOwner
---------

The latest crash was caused by a driver, but it was inconclusive as to which driver caused it. Keep Verifier running and hopefully subsequent crashes will be more informative.

 

[beeswax]

Verified was running this time. Here is the dmp file. Is there a verifier log somewhere?

 

[writhziden]

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [H:\BSODDmpFiles\beeswax\Windows_NT6_BSOD_jcgriff2\012612-38891-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03216000 PsLoadedModuleList = 0xfffff800`0345b670
Debug session time: Thu Jan 26 13:00:00.771 2012 (UTC - 7:00)
System Uptime: 1 days 19:40:45.316
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff880031938d8, fffff88003193130, fffff880012d70af}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonClose+26f )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880031938d8
Arg3: fffff88003193130
Arg4: fffff880012d70af

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880031938d8 -- (.exr 0xfffff880031938d8)
ExceptionAddress: fffff880012d70af (Ntfs!NtfsCommonClose+0x000000000000026f)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000001
Attempt to write to address 0000000000000001

CONTEXT:  fffff88003193130 -- (.cxr 0xfffff88003193130)
rax=0000000000000001 rbx=fffffa8008994450 rcx=0000000000000000
rdx=0000000000000000 rsi=fffff8a002f93b40 rdi=fffff88003193c38
rip=fffff880012d70af rsp=fffff88003193b10 rbp=fffff80003433260
 r8=fffffa800a182418  r9=0000000000000009 r10=0000000000000004
r11=fffffa80085891b8 r12=fffffa80077fa180 r13=0000000000000000
r14=0000000000000000 r15=0000000000000001
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
Ntfs!NtfsCommonClose+0x26f:
fffff880`012d70af 488908          mov     qword ptr [rax],rcx ds:002b:00000000`00000001=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

CURRENT_IRQL:  1

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000001

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034c5100
 0000000000000001 

FOLLOWUP_IP: 
Ntfs!NtfsCommonClose+26f
fffff880`012d70af 488908          mov     qword ptr [rax],rcx

FAULTING_IP: 
Ntfs!NtfsCommonClose+26f
fffff880`012d70af 488908          mov     qword ptr [rax],rcx

BUGCHECK_STR:  0x24

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from fffff880012c6357 to fffff880012d70af

STACK_TEXT:  
fffff880`03193b10 fffff880`012c6357 : fffffa80`08994450 fffff8a0`02f93c70 fffff8a0`02f93b40 fffffa80`077fa180 : Ntfs!NtfsCommonClose+0x26f
fffff880`03193be0 fffff800`0329d001 : 00000000`00000000 fffff800`03589900 fffffa80`0763a101 fffffa80`00000000 : Ntfs!NtfsFspClose+0x15f
fffff880`03193cb0 fffff800`0352dfee : 00000000`00000000 fffffa80`0763a1a0 00000000`00000080 fffffa80`069fb040 : nt!ExpWorkerThread+0x111
fffff880`03193d40 fffff800`032845e6 : fffff880`02f64180 fffffa80`0763a1a0 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03193d80 00000000`00000000 : fffff880`03194000 fffff880`0318e000 fffff880`031939e0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsCommonClose+26f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

STACK_COMMAND:  .cxr 0xfffff88003193130 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsCommonClose+26f

BUCKET_ID:  X64_0x24_Ntfs!NtfsCommonClose+26f

Followup: MachineOwner
---------

Not a Verifier related crash; points to the hard disk file system. Possible causes are Memory problems... Corrupted hard disk system files... Drivers... corrupted SCSI or IDE Drivers...

Since you have had multiple crashes like this: Are you using any defragmenting software other than that provided by Windows? Are you using backup software provided by another company?

Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html

Uninstall and re-install all hard drive devices in Device Manager within the IDE ATA/ATAPI devices section. If you need help with this step, let us know.

 

[beeswax]

I only am running the built-in defragmenter

I have not uninstalled/reinstalled ide yet. I just want to mak sure i understand first.
go into device mangr - expand ide controllers
i have listed 6 items - ata channel 0/0/1/1, standard dual channel controler x2
right click each item and uninstall
reboot

　
Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
410624 file records processed. File verification completed.
1647 large file records processed. 0 bad file records processed. 0 EA records processed. 104 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
530436 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
410624 file SDs/SIDs processed. Cleaning up 301 unused index entries from index $SII of file 0x9.
Cleaning up 301 unused index entries from index $SDH of file 0x9.
Cleaning up 301 unused security descriptors.
Security descriptor verification completed.
59907 data files processed. CHKDSK is verifying Usn Journal...
34955440 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
410608 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
144969948 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.
732469247 KB total disk space.
151861836 KB in 307347 files.
191624 KB in 59908 indexes.
0 KB in bad sectors.
535991 KB in use by the system.
65536 KB occupied by the log file.
579879796 KB available on disk.
4096 bytes in each allocation unit.
183117311 total allocation units on disk.
144969949 allocation units available on disk.
Internal Info:
00 44 06 00 a3 9a 05 00 f9 38 0a 00 00 00 00 00 .D.......8......
98 cf 00 00 68 00 00 00 00 00 00 00 00 00 00 00 ....h...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.

 

[writhziden]

I only am running the built-in defragmenter

Good, that rules that out as a possible reason for the crash.

I have not uninstalled/reinstalled ide yet. I just want to mak sure i understand first.
go into device mangr - expand ide controllers
i have listed 6 items - ata channel 0/0/1/1, standard dual channel controler x2
right click each item and uninstall
reboot

Correct; right click each item, click uninstall, if the dialog box has a box to tick for deleting driver software for the device, tick it, and hit ok. Then restart your computer once you have done so for all devices in the list.
　

Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
410624 file records processed. File verification completed.
1647 large file records processed. 0 bad file records processed. 0 EA records processed. 104 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
530436 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
410624 file SDs/SIDs processed. Cleaning up 301 unused index entries from index $SII of file 0x9.
Cleaning up 301 unused index entries from index $SDH of file 0x9.
Cleaning up 301 unused security descriptors.
Security descriptor verification completed.
59907 data files processed. CHKDSK is verifying Usn Journal...
34955440 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
410608 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
144969948 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.
732469247 KB total disk space.
151861836 KB in 307347 files.
191624 KB in 59908 indexes.
0 KB in bad sectors.
535991 KB in use by the system.
65536 KB occupied by the log file.
579879796 KB available on disk.
4096 bytes in each allocation unit.
183117311 total allocation units on disk.
144969949 allocation units available on disk.
Internal Info:
00 44 06 00 a3 9a 05 00 f9 38 0a 00 00 00 00 00 .D.......8......
98 cf 00 00 68 00 00 00 00 00 00 00 00 00 00 00 ....h...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.

File system came back clean. That means it was probably a corrupted driver, but it could still be an underlying driver that we have not yet discovered.

Remove the following from your computer: AMD Overdrive; also in EasyTune6 for Gigabyte motherboard. This is known to cause blue screen crashes in some systems.

 

[beeswax]

I removed easytune and overdrive back in december, but i went thru and doubled checked for them anyhow.

Uninstalled and rebooted for the IDE controllers.

fingers are crossed again.

 

[writhziden]

AODDriver2.sys is still on your system and loaded. Try renaming it in C:\Windows\System32\Drivers to AODDriver2.sys.bak and see if it provides more stability.

 

[beeswax]

i looked is sys32 and didn;t see the driver in there. I also did two searches, one for AODDriver2 and one for AOD*. I didn;t not receive results for either.