Crashing

[TruffleSniffer]

Evenin All I was wondering if you could help a struggling noob on the problems I am having with crashes attached a few files after studying Jonathan Kings very good tuition thanks Jonathan.

 

[CarlTR6]

Looks like possible hardware issues.

STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL

Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

STOP 0x00000024: NTFS_FILE_SYSTEM

Usual causes: Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_062410-19422-01.zip\062410-19422-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e61000 PsLoadedModuleList = 0xfffff800`0309ee50
Debug session time: Thu Jun 24 09:23:42.012 2010 (GMT-4)
System Uptime: 0 days 0:24:02.463
...............................................................

Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BugCheck A, {fffffa8013244010, 2, 1, fffff80002f8f9f7}

Probably caused by : memory_corruption ( nt!MiReleaseConfirmedPageFileSpace+87 )

Followup: MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa8013244010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002f8f9f7, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800031090e0
 fffffa8013244010 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiReleaseConfirmedPageFileSpace+87
fffff800`02f8f9f7 480fb328        btr     qword ptr [rax],rbp

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  iexplore.exe

TRAP_FRAME:  fffff88009ee3440 -- (.trap 0xfffff88009ee3440)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8003244010 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002f8f9f7 rsp=fffff88009ee35d0 rbp=0000000080000000
 r8=fffff88009ee3600  r9=fffffa8001f6a060 r10=0000000fffffffff
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiReleaseConfirmedPageFileSpace+0x87:
fffff800`02f8f9f7 480fb328        btr     qword ptr [rax],rbp ds:836b:fffffa80`03244010=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ed0b69 to fffff80002ed1600

STACK_TEXT:  
fffff880`09ee32f8 fffff800`02ed0b69 : 00000000`0000000a fffffa80`13244010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`09ee3300 fffff800`02ecf7e0 : fffffa80`01feb600 fffffa80`01df5b60 fffffa80`01feb600 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`09ee3440 fffff800`02f8f9f7 : fffffa80`02075000 fffffa80`01df5b60 fffffa80`042f0890 00000000`00000702 : nt!KiPageFault+0x260
fffff880`09ee35d0 fffff800`02f44d78 : 80000000`00000000 fffff880`012567b5 00000000`000001a0 00000000`068a2000 : nt!MiReleaseConfirmedPageFileSpace+0x87
fffff880`09ee3650 fffff800`02f12fca : 00000000`00000000 00000000`068dffff fffffa80`00000000 fffffa80`01f6a060 : nt! ?? ::FNODOBFM::`string'+0x337d8
fffff880`09ee3810 fffff800`02ed0853 : ffffffff`ffffffff fffff880`09ee3ad0 fffff880`09ee3ad8 fffff800`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`09ee3900 fffff800`02eccdf0 : fffff800`031628c7 fffffa80`01f6a060 fffffa80`01df5b60 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
fffff880`09ee3a98 fffff800`031628c7 : fffffa80`01f6a060 fffffa80`01df5b60 00000000`00000000 00000000`00000000 : nt!KiServiceLinkage
fffff880`09ee3aa0 fffff800`031b7ace : 00000000`068a0000 00000000`00000000 fffff8a0`0a39ae30 fffffa80`0509ce60 : nt!RtlFreeUserStack+0x27
fffff880`09ee3ad0 fffff800`031bb5c1 : 00000000`00000000 fffff800`031e8500 00000000`7ef6e000 00000000`00000000 : nt!PspExitThread+0x7ae
fffff880`09ee3b90 fffff800`031bb805 : fffffa80`01df5b60 00000000`00000000 fffffa80`01df5b60 00000000`7ef6e000 : nt!PspTerminateThreadByPointer+0x4d
fffff880`09ee3be0 fffff800`02ed0853 : fffffa80`01df5b60 fffff880`09ee3ca0 00000000`7ef6e000 00000000`7ef6e000 : nt!NtTerminateThread+0x45
fffff880`09ee3c20 00000000`7741028a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`068de2c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7741028a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiReleaseConfirmedPageFileSpace+87
fffff800`02f8f9f7 480fb328        btr     qword ptr [rax],rbp

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiReleaseConfirmedPageFileSpace+87

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+87

BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+87

Followup: MachineOwner


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_062310-19437-01.zip\062310-19437-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`0d615000 PsLoadedModuleList = 0xfffff800`0d852e50
Debug session time: Wed Jun 23 15:08:12.855 2010 (GMT-4)
System Uptime: 0 days 3:47:26.322
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BugCheck 24, {1904fb, fffff8800add2478, fffff8800add1ce0, fffff880012f35a9}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCheckExistingFile+f9 )

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_062310-19437-01.zip\062310-19437-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*[URL="http://msdl.microsoft.com/download/symbols"]Symbol information[/URL]
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`0d615000 PsLoadedModuleList = 0xfffff800`0d852e50
Debug session time: Wed Jun 23 15:08:12.855 2010 (GMT-4)
System Uptime: 0 days 3:47:26.322
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BugCheck 24, {1904fb, fffff8800add2478, fffff8800add1ce0, fffff880012f35a9}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCheckExistingFile+f9 )

Followup: MachineOwner
---------

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800add2478
Arg3: fffff8800add1ce0
Arg4: fffff880012f35a9

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800add2478 -- (.exr 0xfffff8800add2478)
ExceptionAddress: fffff880012f35a9 (Ntfs!NtfsCheckExistingFile+0x00000000000000f9)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8800add1ce0 -- (.cxr 0xfffff8800add1ce0)
rax=fffff8a01143d040 rbx=7ffff8a01143cfe0 rcx=0000000000000080
rdx=fffffa8006c0f060 rsi=0000000000000000 rdi=fffff8a01143d010
rip=fffff880012f35a9 rsp=fffff8800add26b0 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=fffff8a0114a2060
r11=fffffa8006c0f060 r12=fffffa8006c25010 r13=fffffa8002001610
r14=fffff8800acf2390 r15=fffffa8006f7bad8
iopl=0         nv up ei pl nz na pe cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010203
Ntfs!NtfsCheckExistingFile+0xf9:
fffff880`012f35a9 8b8bac000000    mov     ecx,dword ptr [rbx+0ACh] ds:002b:7ffff8a0`1143d08c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  services.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000d8bd0e0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsCheckExistingFile+f9
fffff880`012f35a9 8b8bac000000    mov     ecx,dword ptr [rbx+0ACh]

FAULTING_IP: 
Ntfs!NtfsCheckExistingFile+f9
fffff880`012f35a9 8b8bac000000    mov     ecx,dword ptr [rbx+0ACh]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff880012f3f0f to fffff880012f35a9

STACK_TEXT:  
fffff880`0add26b0 fffff880`012f3f0f : 00000000`00000000 fffff8a0`1143d010 00000000`00000002 fffff8a0`1142de00 : Ntfs!NtfsCheckExistingFile+0xf9
fffff880`0add2740 fffff880`012f078b : fffff880`0acf2390 fffffa80`06c25010 fffff8a0`1143d3a8 fffff8a0`00000024 : Ntfs!NtfsOpenExistingAttr+0x20f
fffff880`0add2800 fffff880`012f0eff : fffffa80`06c25010 fffffa80`06f7b780 fffff8a0`1143d3a8 fffff880`00000024 : Ntfs!NtfsOpenAttributeInExistingFile+0x5ab
fffff880`0add2990 fffff880`01301e76 : fffffa80`06c25010 fffffa80`06f7b780 fffff8a0`1143d3a8 00000000`00000701 : Ntfs!NtfsOpenExistingPrefixFcb+0x1ef
fffff880`0add2a80 fffff880`012fc28d : fffffa80`06c25010 fffffa80`06f7b780 fffff880`0add2c60 fffff880`0add2ca8 : Ntfs!NtfsFindStartingNode+0x5e6
fffff880`0add2b50 fffff880`01265c0d : fffffa80`06c25010 fffffa80`06f7b780 fffff880`0acf2390 fffffa80`06c0f000 : Ntfs!NtfsCommonCreate+0x3dd
fffff880`0add2d30 fffff800`0d67d487 : fffff880`0acf2300 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0add2d60 fffff800`0d67d441 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27
fffff880`0acf21d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsCheckExistingFile+f9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

STACK_COMMAND:  .cxr 0xfffff8800add1ce0 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsCheckExistingFile+f9

BUCKET_ID:  X64_0x24_Ntfs!NtfsCheckExistingFile+f9

Followup: MachineOwner
---------

I found the driver, sptd.sys, at the time of the crash. Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use the driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads

After you have uninstalled the program associated with this driver, reboot and let's see what happens. Please post back after you have uninstalled it. We will go from there.

 

[TruffleSniffer]

Thank Carl

 

[CarlTR6]

Be sure to refresh your page as I edited my post.

 

[TruffleSniffer]

Carl Thanks for the speedy reply I had deamon lite installed so I have removed that nothing else of that elk on my comp I think lol I have downloaded the file you suggested so I will see what crops up in the next few days. Thanks again for your help.

 

[CarlTR6]

You are very welcome. I hope your problem is solved that easily! SPTD.sys definitely causes BSOD's with Windows 7. We see it almost daily.

 

[TruffleSniffer]

Had a few more crashes which always seemed to happened when I was on Internet Exp.8 so I have switched to Google Chrome not had a crash since fingers crossed yet again.

 

[CarlTR6]

That is interesting, a definitely conflict somewhere. Keep us updated. I'm glad you are running smoothly.

If you want to upload those latest dumps, we will take a look at them.

 

[TruffleSniffer]

Spoke to soon Back to crashing again attached a few files to see if its same problem thanks in anticipation,

 

[richc46]

Welcome

Since, Carl was off line, I just wanted to take a look at a few files and see if I agreed. I was not able to open any files. Your files are uploaded as a short cut, not like your first files, which I could open.

 

[TruffleSniffer]

Sorry Richc I screwed up somehow

 

[richc46]

No problem, just repost. Unless Carl has software that I do not, he cannot open it either.

 

[TruffleSniffer]

Think I got it right this time.

 

[CarlTR6]

I can't open them either. Richard thanks for steeping in and trying to have a look. I appreciate it.

 

[richc46]

I looked at them quickly, different than the last batch.

 

[CarlTR6]

Run with it. I have to go bail my truck out of the shop. $$

 

[richc46]

The problem with these dumps is that they are only helpful and not definitive. Carl was correct in his analyis, but this group is different. Some lead toward memory while others do not. When there is such a large variance of causes hardware can be suspect.

Download this and report your findings.
Beep Codes Viewer - Quickly Look Up What Beep Codes Mean | Technibble

 

[TruffleSniffer]

Thanks richc I downloaded beep prog. rebooted all I heard was 1 short beep nothing else. I have not added any additional memory to my comp whats inside been in since bought in April this year.

 

[richc46]

You have to look at the chart, that is part of the download, and see what one short beep means. Usually it means ok, but check on the download to be sure. If that is OK, we can concentrate on other areas.

 

[TruffleSniffer]

Checked out the chart richc .1 short on AMI says recent hardware added may be cause Award says same for 1 beep IBM says 1 beep all ok Phoneix nothing listed for 1 beep. Tell you what it dont half get on your nerves when it keeps going down.