Multiple crashes and BSODs with random messages and filenames in them.

[solshine2510]

Hello, my computer began having problems a few weeks ago. It either crashes with BSOD, or just goes down with black screen, not shutting off, I can hear it's on, but screen is black, so I have to manually shut it off. It happens several times a day.
Sometimes after restart (either by itself or by myself) Windows wont boot due to something crucial corrupted aparently. Ive seen this twice:
Error 15: File not found. Press any key.
or
Bootmgr image is corrupt. The system cannot boot.

Most of the time, I must wait 1-2 minutes before starting it again, otherwise it just won't start - again, I can hear it's on, but screen is black. After 1-2 minutes, computer starts OK.

As for BSODs. I've seen numerous error messages and file names. I started noting them down at some point to see if they repeat. I will list them at the bottom, so maybe it's of any help to you because I have realised that not every crash or BSOD results in minidump file for some reason.

I have already ran MEMTEST86 as advised on this forum, for 8 runs overnight with no errors.
I reinstalled windows with formatting system partition. Crashes and BSODs kept coming.

At some point I was advised to use Driver Sweeper. I cleaned everything it would show and installed drivers from the 1,5 year old CDs that were attached to the computer when I bought it. Havent updated anything from that point and - to my surprise - after only two more BSODs, computer ran with no crashes whatsoever for almost whole week!
Unfortunately, today it has started crashing again. I restored the system image I created 2 days ago, when everything seemed fine. I cleaned the drivers with Driver Sweeper again. But this time it does not help. It has been crashing whole day today. Unfortunately I only can see two mini dump files with today date, but there definitely have been more crashes than two today.

Crashes happen 99% of the time when playing World of Warcraft, but this computer is used mostly for this purpose, so WoW is running most of the time computer is on. It also happened with only browser opened a few times, once when watching youtube movie.

I will appreciate any help on this.
Below are the error messages and file names from the BSODs.

usbehci.sys
(?)N_LIST_CORRUPT
k.sys
VIDEO_MEMORY_MANAGER_ENCOUNTERED_FATAL_ERROR
amdppm.sys
atikmpag.sys (x2)
atikmdag.sys (x4)
ksaud.sys
BAD_POOL_CALLER
tcpip.sys
SYSTEM SERVICE EXCEPTION (x3)
bugcode_usb_driver
dxgmms1.sys (x2)
MEMORY_MANAGEMENT
BAD_POOL_HEADER
REFERENCE_BY_POINTER
ATTEMPT WAS TO WRITE TO READ ONLY MEMORY
BAD_POOL_HEADER
atikmdag.sys
PAGEFILE FAULT IN NONPAGED AREA
ntfs.sys
APC_INDEX- (?)
usbport.sys

 

[Arc]

Welcome aboard.

You are having various bugchecks, with various probable causes.

So, it is very difficult to find the real reason out.

► First, enable Driver Verifier
http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

► Update the following drivers:

• AMD High Definition Audio Device Driver: AMD Support & Drivers
• Radeon HD 6800 Series Driver: AMD Support & Drivers
• Realtek PCIe GBE Family Controller : Realtek

► Uninstall the following programs:

• HD Tune Pro
• ASRock Utility

► Do the following tests:

• http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html
• http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html
• http://www.sevenforums.com/tutorials/100356-video-card-stress-test-furmark.html

Let us know how it went.

 

[solshine2510]

Arc, thank you for the response.

I had to leave for a few weeks, but now I'm back and here is how I managed to follow instructions in your post.

1. I installed the Realtek LAN driver.
2. I installed the graphics driver.
3. I couldn't locate the audio drivers on the AMD site, so I went to the motherboard manufacturer site (ASRock > 870iCafe) and downloaded AMD all in 1 driver ver:8.71_WHQL driver.
4. Then I double checked at AMD site with their Autodetect/autodowlnoad app to see if it finds anything, but it only mentioned I had latest available graphic card driver already installed.
5. I uninstalled HD Tune.
6. I ran MemTest86 before the first post, as I mentioned there, for 8 runs, no errors.

7. FuMark test. Temperature went up to 91-93 degrees and was stable from that point on with Fps being 15-17. I didn't notice any artifacts. The test went up to roughly 70 (perhaps 80) percent and then the screen went black as if there was no signal or display was turned off due to inactivity. Computer was still on as I heard the fan still running loud. After hard reboot system wouldn't start so I waited a few more minutes for it to apparently cool down.

8. Check Disk. I assume you can see the results in the logs within the attached zip file? Anyway, there were no bad sectors in all 3 partitions, only on C some corrections were made to allocations (?). I believe that is due to several crashes that happened before running the Check Disk today.

9. Driver Verifier. Starting Driver Verifier resulted in immediate BSoD even before Windows was fully started, and repeated for 3 consecutive reboots untill disabling it during repair mode by restoring to earlier point.

Lots of BSoDs happened later on as well. Also while collecting data for this thread with the Diagnostic Tool. Often after reboot the only available choice was repair mode, so the system was restored to some earlier point several times.

I reinstalled newest graphic drivers from the AMD site and the Realtek LAN driver prior to this post. You might want to check other drivers again because after all those BSoDs, and repair startups, the drivers may be all messy again.

I forgot to mention the AS Rock utility. Oddly enough, all the AS Rock components had their uninstallers missing, so I got rid of them with Revo Uninstaller. I did that like 3 times because of the system rolling back to earlier point so they were reappearing back before being gone for good. The folders are still in the Start Menu group though for some reason.

While it all may seem as faulty driver related, I had a Problem Reporting popup two days ago mention "Video Hardware Error" and the associated dump file: WD-20120912-1056.dmp.

I'm eagerly awaiting some response from you guys. I'm also attaching the newest zip file with system data.

 

[Arc]

Well, there are various problems apparently. Let us start from a particular point.

► ATI display driver. Uninstall it using driver fusion and reinstall the older version (the April one maybe) that worked rightly there without any trouble.

fffff880`07ab2b08  fffff880`056f58b1Unable to load image \SystemRoot\system32\DRIVERS\atikmdag.sys, Win32 error 0n2
*** [COLOR=Red]WARNING: Unable to verify timestamp for atikmdag.sys[/COLOR]
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
 atikmdag+0x9e8b1
fffff880`07ab2b10  fffffa80`00000002
fffff880`07ab2b18  fffff880`048fd345*** [COLOR=Red]WARNING: Unable to verify timestamp for atikmpag.sys[/COLOR]
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys
 atikmpag+0x6345

it is a recurring failure there.

► Another thing is NTFS.sys

......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800a7db6e8, fffff8800a7daf40, fffff80002acd0c5}

[COLOR=Red]Probably caused by : Ntfs.sys[/COLOR] ( Ntfs!NtfsCreateFcb+23c )

Followup: MachineOwner
---------

To solve it, you are to do the following:

1. Reseat the sata and power.
2. Run chkdsk /f/r, following the option two of the tutorial Disk Check
3. Seatool for dos: SeaTools | Seagate download
   Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

► Avast is a big problem for you.

ffff880`0a32c0a8  fffff880`046458d9Unable to load image \SystemRoot\System32\Drivers\aswSP.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSP.SYS
***[COLOR=Red] ERROR: Module load completed but symbols could not be loaded for aswSP.SYS[/COLOR]
 aswSP+0x128d9
=====================================================
fffff880`0a32c3b8  fffff880`025cc980Unable to load image \??\C:\Windows\system32\drivers\aswMonFlt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswMonFlt.sys
*** [COLOR=Red]ERROR: Module load completed but symbols could not be loaded for aswMonFlt.sys[/COLOR]
 aswMonFlt+0x8980
=======================================================
fffff880`0a32c2b8  fffff880`02a6a599 [COLOR=Red]aswSnx+0x22599[/COLOR]
fffff880`0a32c2c0  00000000`0000008c
fffff880`0a32c2c8  00000000`82ac8004
fffff880`0a32c2d0  fffffa80`04415440
fffff880`0a32c2d8  00000000`001fdee8
fffff880`0a32c2e0  00000000`00000000
fffff880`0a32c2e8  00000000`00000000
fffff880`0a32c2f0  00000000`00000000
fffff880`0a32c2f8  fffff880`02a6d001 [COLOR=Red]aswSnx+0x25001[/COLOR]

All those are Avast elements. Uninstall it, and use Microsoft Security Essentials - Free Antivirus for Windows.


Apply the changes and let us know the results.

 

[solshine2510]

Thanks for fast reply. But before I can continue, what does that mean: "Reseat the sata and power." ?

 

[Arc]

View attachment 233743

Where those are connected with the HDD, open those, clean the dust and plug those in again.

 

[solshine2510]

So much better now, yet not all is perfect.

After performing recommended steps from your last post, I have been enjoying using my computer without any errors or BSoDs whatsoever for the past days (except one crash when electricity went down for a few mins).
1. Switched from Avast to Microsoft Security essentials and replaced AMD display drivers with the April version you mentioned. The display drivers must have been the key, because I still had BSoD after uninstalling Avast and before replacing the drivers.
2. Chkdsk performed on all 3 partitions ended each time with "Windows has checked the file system and found no problems".
3. Seagate Tools provided results displayed on screen only: (screenshot under this imgur link). What's the deal with SMART disabled? Should it be enabled?

Anyway, the improvement is HUGE after BsoDs coming every several minutes before.. Yet today I've encountered a new problem.
Computer wouldn't boot from sleep mode this morning. After 2 or 3 unsuccesful reboots I had to use 'clear restoration data' option and do fresh boot. I had used sleep mode often before the whole crashing began, so it's something new.
I enabled Driver Verifier and BSoD happened immediately before Windows was even fully started so I disabled it in safe mode. During blue screen I only managed to notice (something?).sys was mentioned on screen.

I'm attaching new system data in the zipped file and awaiting your words of wisdom on this

 

[Arc]

Your latest crash is caused by NetLimiter.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {f6, 1a0, fffffa8006927620, fffff88003e4bd86}

Unable to load image \??\C:\Program Files\NetLimiter 3\nltdi.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nltdi.sys
*** ERROR: Module load completed but symbols could not be loaded for nltdi.sys
[COLOR=Red]Probably caused by : nltdi.sys[/COLOR] ( nltdi+1d86 )

Followup: MachineOwner
---------

The version you are using is somehow old.

 lmvm nltdi
start             end                 module name
fffff880`03e4a000 fffff880`043ba000   nltdi    T (no symbols)           
    Loaded symbol image file: nltdi.sys
    Image path: \??\C:\Program Files\NetLimiter 3\nltdi.sys
   [COLOR=Red] Image name: nltdi.sys
    Timestamp:        Mon Feb 14 03:37:35 2011[/COLOR] (4D585627)
    CheckSum:         0001E622
    ImageSize:        00570000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

You may search for an update in NetLimiter - The Ultimate Bandwidth Shaper.

 

[solshine2510]

Unfortunately I must refresh the thread. After 3 weeks of peace I've had series of BSODs since yesterday. I can't remember installing anything new recently.
What is causing those BSODs?
I'm uploading new system data in a zipped file.

 

[Arc]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffffa800422f1b0, fffff8a003293240, fffffa800422f1b0}
[COLOR=Red]
Probably caused by : Pool_Corruption[/COLOR] ( nt!ExDeferredFreePool+c96 )

Followup: Pool_corruption
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, [COLOR=Red]and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.[/COLOR]
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffffa800422f1b0, the pool entry being checked.
Arg3: fffff8a003293240, the read back flink freelist value (should be the same as 2).
Arg4: fffffa800422f1b0, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------


BUGCHECK_STR:  0x19_3

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002c0e6ea to fffff80002ae3fc0

STACK_TEXT:  
fffff880`08392958 fffff800`02c0e6ea : 00000000`00000019 00000000`00000003 fffffa80`0422f1b0 fffff8a0`03293240 : nt!KeBugCheckEx
fffff880`08392960 fffff800`02c101a1 : 00000000`00000000 fffffa80`04a37ce0 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0xc96
fffff880`083929f0 fffff800`02d7f101 : 00000000`00000000 fffffa80`03fbd711 fffffa80`61436d4d 00000000`00080000 : nt!ExFreePoolWithTag+0x411
fffff880`08392aa0 fffff800`02aed1d4 : 00000000`00000000 fffffa80`03fbd780 fffffa80`03c477a0 fffffa80`03c477a0 : nt!MiSegmentDelete+0xb1
fffff880`08392ae0 fffff800`02dd6ae4 : fffffa80`03fbd780 00000000`00000000 fffffa80`03f85b50 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`08392b40 fffff800`02dd7094 : 00000000`0000089c fffffa80`03fbd780 fffff8a0`02c421b0 00000000`0000089c : nt!ObpCloseHandleTableEntry+0xc4
fffff880`08392bd0 fffff800`02ae3253 : fffffa80`03f85b50 fffff880`08392ca0 00000000`7efdb000 00000000`03da7260 : nt!ObpCloseHandle+0x94
fffff880`08392c20 00000000`770b140a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000fe318 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770b140a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExDeferredFreePool+c96
fffff800`02c0e6ea cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExDeferredFreePool+c96

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  X64_0x19_3_nt!ExDeferredFreePool+c96

BUCKET_ID:  X64_0x19_3_nt!ExDeferredFreePool+c96

Followup: Pool_corruption
---------

In such a situation, it is better to enable Driver Verifier to monitor the drivers.

Driver Verifier - Enable and Disable

Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[solshine2510]

Ive already had a few BSODs today since your last reply.
Immediate BSOD after starting Driver Verifier this morning displayed ksaud.sys error. I had read about Creative drivers conflicting with Windows 7 before, so I decided to get rid of it. I uinstalled software with Revo uninstaller and used Driver Fusion which you recommended earlier in this thread to delete any Creative related files (ksaud.sys still shows in drivers list when engabling Driver Verifier though).
After that I started Driver Verifier again and just had another two more consecutive BSODs after few hours.
I'm attaching new zipped file.

BTW. Does Driver Verifier actually continue to run between computer restarts? There is no similarly named process in the Task Manager.

 

[Arc]

It is Creative Technology Sound Blaster USB Audio

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D5, {fffff980086b0d20, 0, fffff880072d3503, 0}

*** WARNING: Unable to verify timestamp for ksaud.sys
*** ERROR: Module load completed but symbols could not be loaded for ksaud.sys

Could not read faulting driver name
[COLOR=Red]Probably caused by : ksaud.sys [/COLOR]( ksaud+4503 )

Followup: MachineOwner
---------

And it is very old.

lmvm ksaud
start             end                 module name
fffff880`072cf000 fffff880`073e7580   ksaud    T (no symbols)           
    Loaded symbol image file: ksaud.sys
    Image path: \SystemRoot\system32\drivers\ksaud.sys
   [COLOR=Red] Image name: ksaud.sys
    Timestamp:        Tue Dec 15 07:54:18 2009 [/COLOR](4B26F352)
    CheckSum:         0011ACFA
    ImageSize:        00118580
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it from Creative Worldwide Support

 

[solshine2510]

BSODs still happen, not only ksaud.sys related. I saw usbport.sys once, memory management error as well, and something else.
Details: I updated the driver. The file I downloaded at Creative site was dated 2011. I enabled Driver Verifier and bam - immediate blue screen with ksaud.sys. So I cleared once again all occurences of Creative software with Driver Fusion and Revo uninstaller, this time in Safe mode to make sure I actually clear things. I downloaded new driver from Creative to make fresh installation. Enabled Driver Verifier. Next BSOD was not immediate, but after several minutes after starting computer.

 

[Arc]

........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {2558002b, 2, 0, fffff88004277dee}

[COLOR=Red]Probably caused by : USBPORT.SYS[/COLOR] ( USBPORT!USBPORT_Xdpc_Worker+3e )

Followup: MachineOwner
---------

What are the USB devices you use? Are the drivers of hose devices up to date? Let us know.
And, disable USB Selective Suspense : http://www.sevenforums.com/tutorials/147369-usb-selective-suspend-turn-off.html.

 

[solshine2510]

I have disabled the USB Selective Suspend.
I have 4 devices connected via USB ports: mouse, keyboard, speakers and that Creative Soundblaster card. Except the audio card, none of the devices had manually installed drivers, they always worked as plug and play.
Drivers available on manufacturers' sites are very old: Mouse driver is from 2008 (A4Tech SWOP-80). Keyboard Logitech ULTRAX Premium Keyboard driver is from 2009. The 2.0 speakers are poor noname quality as I mostly use headphones, and came with no drivers. Should I install those old mouse and keyboard drivers?
I also have "USB 2.0 PCI HOST ADAPTER 4 PORTS"' installed just in case I have to connect something extra via USB (it's not used right now). This card came with drivers on CD and it says only 2.0 driver on them.

Im attaching new file with more recent data after latest BSODs. One crash had no blue screen visible, just blank screen as if suddenly unplugged, without the usual half a sec freeze.

 

[Arc]

Your crash dumps are not showing any finite probable cause. In such a situation, it is better to enable Driver Verifier to monitor the drivers.

Driver Verifier - Enable and Disable

Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[solshine2510]

I ran Driver verifier since 28 Oct. Crashes that happened that day:

17:50 (time roughly) Memory Management BSOD
20:45 Memory Management followed immediately by ksaud.sys BSOD after restart
21:04 Memory Management again followed by ksaud.sys after restart.

After that I definitively removed Sound Blaster X-FI external card - unplugged and uninstalled software/drivers. That last crash forced system restore and unfortunately I forgot to turn on Driver Verifier back, so the next BSOD (30 Oct, 00:46) was without Driver Verifier running (it stated: System Service Exception).

Then I reenabled Driver Verifier and next BSOD happened today at 16:17 - Memory Management.

 

[Arc]

That's the better idea, as the crashes without DV is not providing any information at all.

 

[solshine2510]

That's the better idea, as the crashes without DV is not providing any information at all.

The attached file does contain the DV evoked BSODs I mentioned eaerlier (28 Oct & 31 Oct). What do you make of them, or at least the last one, after removing the sound card? Anyhow, if it doesn't say much, I'll continue having DV on so I'll post new data should any more BSODs happen.

 

[Arc]

The dumps those are after removing the sound card, not showing any viable cause at all, and that is why I told that DV will be a better idea again.