Frequent BSOD and rebooting, memory dump?

IronChief · Nov 18, 2012

Keep getting blue screens of death. I think I may have seen the words "memory dump" at one point during a blue screen.

Thanks in advance for any help you have to give.

koolkat77 · Nov 18, 2012

Welcome to SevenForums.

Click on User CP on the top right of this page
Click on Edit System Spec
Fill in your computer specs
- http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html

BugCheck 24 & BugCheck F4

1. Usual causes: Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure
2. Usual causes: None. (But often related to Storage/Hard Drive.)

:tip:If you have a SSD, make sure the firmware is up to date.

Upload a screenshot of your hard disk using crystal disk info:

Run Disk Check on your hard disk for file system errors and bad sectors on it:

http://www.sevenforums.com/tutorials/433-disk-check.html

Test your hard drive:

Hard Drive Diagnostic Procedure

.nfo file:

Please upload your msinfo32.nfo file. To get this: Start Menu -> Type msinfo32 into the Search programs and files box -> When it opens, go to File, Save -> Save as msinfo32.nfo and save in a place you will remember -> Let it finish the process of gathering and saving the system info -> Right click the .nfo file, click send to compressed (zipped) folder -> Upload the .zip file here.

Summary:

Code:

BugCheck 24, {1904fb, fffff8800afd6dd8, fffff8800afd6630, fffff800030f1a30}
Probably caused by : memory_corruption ( nt!MmCheckCachedPageStates+3f0 )
------
BugCheck 24, {1904fb, fffff8800a3bc958, fffff8800a3bc1b0, fffff880012a5f20}
Probably caused by : Ntfs.sys ( Ntfs!NtfsOpenExistingPrefixFcb+70 )
------
BugCheck F4, {3, fffffa8009ffdb30, fffffa8009ffde10, fffff80003381510}
----- ETW minidump data unavailable-----
Probably caused by : wininit.exe
------
BugCheck 24, {1904fb, fffff8800c8381b8, fffff8800c837a10, fffff8800123f2b5}
Probably caused by : Ntfs.sys ( Ntfs!NtfsAcquireExclusiveFcb+65 )
------
BugCheck 24, {1904fb, fffff880067f4ac8, fffff880067f4320, fffff880012f4f20}
Probably caused by : Ntfs.sys ( Ntfs!NtfsOpenExistingPrefixFcb+70 )

IronChief · Nov 18, 2012

View attachment 242115
View attachment 242116

Hmm.. it may seem that there's a problem with my other drive. I tried scanning it and it couldn't complete the scan. (it froze and I had to restart.)

koolkat77 · Nov 18, 2012

No antivirus?

Run these tools and delete anything they find:

Anti-rootkit utility TDSSKiller

ESET online scanner:

Free Online Virus Scanner | ESET

Recommended antivirus program for Windows 7 based on stability compared to others:-

:warn: Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Daemon Tools

Please uninstall DAEMON Tools. It uses a driver called sptd.sys which is known to cause BSODs in Windows 7. Uninstall the software using Add/Remove Programs. Reboot the system. Once the program is uninstalled, run sptd.sys uninstaller to remove the driver from your system.

As an alternative, many people recommend the use of Total Mounter or Magic ISO

Free up the start-up, nothing except the antivirus is usually needed.

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

Click on the rb:
Type CMD on Search
Left click and Run as Administrator
Type SFC /scannow

Full tutorial here:

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

IronChief · Nov 19, 2012

Ran the anti-rootkit. Still scanning my computer, but I uninstalled Daemon Tools and have yet to come across a BSOD, so that might have been the issue. It should be done by tomorrow so I will give you an update then.

koolkat77 · Nov 19, 2012

I see. Thanks for the update.

IronChief · Nov 20, 2012

So I ran ESET and Malwarebytes each separately, and they detected some suspicious programs and cleaned them off my computer. Then I ran CMD with the sfc /scannow command and came up with this:

koolkat77 · Nov 20, 2012

Can you upload the CBS log

IronChief · Nov 20, 2012

Hmm... I can't seem to access it.

koolkat77 · Nov 20, 2012

I'm calling for more help. Please wait.

NoelDP · Nov 20, 2012

You cannot access the CBS.log file directly - copy it to the desktop first, then zip the copy and upload the zipped file (you can delete the copy)

IronChief · Nov 21, 2012

Ah there we go..

NoelDP · Nov 21, 2012

You have a number of failed repairs there - let's see if another tool can fix things...

Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Method 2)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and attach it to your reply.

IronChief · Nov 21, 2012

And... done.

NoelDP · Nov 21, 2012

At least there's nothing new there

I'm a bit backlogged at the moment - so it may be late today before I can get back with a fix protocol for you - If you haven't heard by this time tomorrow, Shout!!

IronChief · Nov 22, 2012

Hmm, just got bluescreened again while watching a youtube video.

Arc · Nov 22, 2012

Code:

[FONT=Tahoma]fffff880`09855868  fffff880`012334d0 Ntfs!NtfsLookupAllocation+0x1f0
fffff880`09855870  fffffa80`0778ea30
fffff880`09855878  fffff880`012d5e69 Ntfs!LfsWriteLogRecordIntoLogPage+0x329
fffff880`09855880  00000000`00003e2a
fffff880`09855888  fffffa80`0778e940
fffff880`09855890  00001f80`00000000
fffff880`09855898  00000000`00000010
fffff880`098558a0  00010202`0018e940
fffff880`098558a8  fffff880`012334d0 Ntfs!NtfsLookupAllocation+0x1f0
fffff880`098558b0  fffffa80`0778ea30
fffff880`098558b8  fffff880`012d5e69 Ntfs!LfsWriteLogRecordIntoLogPage+0x329[/FONT]

Update your SSD's Firmware (Skip it, if it is not a SSD)
Re-seat the sata and power.
Run chkdsk /f/r, following the option two of the tutorial Disk Check
Seatool for dos: SeaTools | Seagate download
Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

NoelDP · Nov 22, 2012

Thanks for the prompt - I'd lost the thread in the backlog!

(Top of the list!)
For reference (and in case I lose it again....
)

Code:

(f) CSI Payload File Missing 0x00000000 bthpanapi.dll amd64_microsoft-windows-bluetoothpanapi_31bf3856ad364e35_6.1.7600.16385_none_3e799a0c613390f2 
(f) CSI Payload File Missing 0x00000000 BthpanContextHandler.dll amd64_microsoft-windows-bthpancontexthandler_31bf3856ad364e35_6.1.7600.16385_none_27477e7fc95c1d8d 
(f) CSI Payload File Missing 0x00000000 bthprops.cpl amd64_microsoft-windows-bth-user_31bf3856ad364e35_6.1.7601.17514_none_c33f455aebcd9dbb 
(f) CSI Payload File Missing 0x00000000 bthserv.dll amd64_microsoft.windows.h..uetooth-driverclass_31bf3856ad364e35_6.1.7600.16385_none_e0d9dbec7c8df8b9

Code:

 Line 21578: 2012-11-20 04:27:38, Info                  CSI    00000344 [SR] Cannot repair member file [l:48{24}]"BthpanContextHandler.dll" of Microsoft-Windows-BthpanContextHandler, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
 Line 21579: 2012-11-20 04:27:38, Info                  CSI    00000345 [SR] Cannot repair member file [l:26{13}]"bthpanapi.dll" of Microsoft-Windows-BluetoothPanAPI, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
 Line 21580: 2012-11-20 04:27:38, Info                  CSI    00000346 [SR] Cannot repair member file [l:24{12}]"bthprops.cpl" of Microsoft-Windows-BTH-USER, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
 Line 21583: 2012-11-20 04:27:39, Info                  CSI    00000348 [SR] Cannot repair member file [l:22{11}]"ShvlRes.dll" of Microsoft-Windows-Shell-MultiplayerInboxGames-Spades, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 21584: 2012-11-20 04:27:39, Info                  CSI    00000349 [SR] Cannot repair member file [l:22{11}]"bthserv.dll" of Microsoft.Windows.Hardware.Devices.ClassInstaller.BLUETOOTH-DriverClass, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
 Line 21587: 2012-11-20 04:27:39, Info                  CSI    0000034b [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:26{13}]"systemcpl.dll" from store
 Line 21588: 2012-11-20 04:27:39, Info                  CSI    0000034c [SR] Repairing corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:18{9}]"slmgr.vbs" from store
 Line 21589: 2012-11-20 04:27:39, Info                  CSI    0000034d [SR] Cannot repair member file [l:24{12}]"bthprops.cpl" of Microsoft-Windows-BTH-USER, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
 Line 21590: 2012-11-20 04:27:39, Info                  CSI    0000034e [SR] This component was referenced by [l:242{121}]"Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.Microsoft-Windows-Client-Features-Update"
 Line 21591: 2012-11-20 04:27:39, Info                  CSI    0000034f [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:24{12}]"bthprops.cpl"; source file in store is also corrupted
 Line 21592: 2012-11-20 04:27:39, Info                  CSI    00000350 [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:18{9}]"slmgr.vbs" from store
 Line 21595: 2012-11-20 04:27:39, Info                  CSI    00000352 [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:20{10}]"user32.dll" from store
 Line 21598: 2012-11-20 04:27:40, Info                  CSI    00000354 [SR] Cannot repair member file [l:22{11}]"ShvlRes.dll" of Microsoft-Windows-Shell-MultiplayerInboxGames-Spades, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 21599: 2012-11-20 04:27:40, Info                  CSI    00000355 [SR] This component was referenced by [l:216{108}]"Microsoft-Windows-Shell-MultiplayerInboxGames-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.Internet Spades"
 Line 21604: 2012-11-20 04:27:41, Info                  CSI    00000358 [SR] Could not reproject corrupted file [ml:520{260},l:110{55}]"\??\C:\Program Files\Microsoft Games\Multiplayer\Spades"\[l:22{11}]"ShvlRes.dll"; source file in store is also corrupted
 Line 21607: 2012-11-20 04:27:41, Info                  CSI    0000035a [SR] Repairing corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:20{10}]"user32.dll" from store
 Line 21610: 2012-11-20 04:27:41, Info                  CSI    0000035c [SR] Repairing corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:18{9}]"slwga.dll" from store
 Line 21613: 2012-11-20 04:27:41, Info                  CSI    0000035e [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:18{9}]"slwga.dll" from store
 Line 21614: 2012-11-20 04:27:41, Info                  CSI    0000035f [SR] Cannot repair member file [l:22{11}]"bthserv.dll" of Microsoft.Windows.Hardware.Devices.ClassInstaller.BLUETOOTH-DriverClass, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
 Line 21615: 2012-11-20 04:27:41, Info                  CSI    00000360 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
 Line 21616: 2012-11-20 04:27:41, Info                  CSI    00000361 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"bthserv.dll"; source file in store is also corrupted
 Line 21617: 2012-11-20 04:27:41, Info                  CSI    00000362 [SR] Cannot repair member file [l:48{24}]"BthpanContextHandler.dll" of Microsoft-Windows-BthpanContextHandler, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
 Line 21618: 2012-11-20 04:27:41, Info                  CSI    00000363 [SR] This component was referenced by [l:242{121}]"Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.Microsoft-Windows-Client-Features-Update"
 Line 21619: 2012-11-20 04:27:41, Info                  CSI    00000364 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:48{24}]"BthpanContextHandler.dll"; source file in store is also corrupted
 Line 21620: 2012-11-20 04:27:41, Info                  CSI    00000365 [SR] Cannot repair member file [l:26{13}]"bthpanapi.dll" of Microsoft-Windows-BluetoothPanAPI, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
 Line 21621: 2012-11-20 04:27:41, Info                  CSI    00000366 [SR] This component was referenced by [l:242{121}]"Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.Microsoft-Windows-Client-Features-Update"
 Line 21622: 2012-11-20 04:27:41, Info                  CSI    00000367 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:26{13}]"bthpanapi.dll"; source file in store is also corrupted

- then I don't need to go hunting again!

NoelDP · Nov 22, 2012

..OK - it wasn't as bad as it looked at first glance.... only 5 files needed work.

I've uploaded a file - ichief.zip - to my SkyDrive at https://skydrive.live.com/#cid=936736BB8FCEB92F&id=936736BB8FCEB92F%21526
Please download and save it.
Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
This should create a folder C:\ichief
Close all windows (it would be a good idea to print these instructions!)
Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.
Pick the option to use a Command Prompt
At the prompt type
DIR C:\ichief
hit the enter key - if you get a 'Not Found' error try
DIR D:\ichief
or
DIR E:\ichief

The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...

XCOPY <drive>:\ichief <drive>:\windows\winsxs /y /i /s /v /h

run the command (it should take almost no time)and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.
Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and attch the new CBS.log file to your response

Also run a new CheckSUR, and post the new CheckSUR.log file.

IronChief · Nov 24, 2012

I can't seem to get into the repair computer option. When I restart and press F8, and select repair computer, it comes up with :

status: 0xc000000f

Info: The boot selection failed because a required device is inaccessible.

=/

Frequent BSOD and rebooting, memory dump?

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

Three-Toed Sloth

My Computer

New member

My Computer

Three-Toed Sloth

My Computer

New member

My Computer

Three-Toed Sloth

My Computer

New member

My Computer

New member

My Computer

Three-Toed Sloth

My Computer

Three-Toed Sloth

My Computer

New member

My Computer