Solved ntoskrnl.exe 0x0000001E BSOD

[justinbronze]

Another BSOD. The USB thing must have been some part of the problem, since it was a longer interval between BSODs.

NTFS_File_System.

*Note: I do still have Verifier running. I am going to be turning it off today.

 

[writhziden]

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\justinbronze\Windows_NT6_BSOD_jcgriff2\012212-42993-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c57000 PsLoadedModuleList = 0xfffff800`02e9c670
Debug session time: Sun Jan 22 03:38:43.091 2012 (UTC - 7:00)
System Uptime: 6 days 7:29:15.636
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
........................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {190477, fffff880097490e8, fffff88009748940, fffff8800125d138}

Probably caused by : Ntfs.sys ( Ntfs!NtfsMapUserBuffer+28 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 0000000000190477
Arg2: fffff880097490e8
Arg3: fffff88009748940
Arg4: fffff8800125d138

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880097490e8 -- (.exr 0xfffff880097490e8)
ExceptionAddress: fffff8800125d138 (Ntfs!NtfsMapUserBuffer+0x0000000000000028)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88009748940 -- (.cxr 0xfffff88009748940)
rax=fffff9808bb80c60 rbx=000000035c3ea900 rcx=fffa8006a269f000
rdx=0000000000000020 rsi=0000000000000001 rdi=0000000000000000
rip=fffff8800125d138 rsp=fffff88009749320 rbp=fffff88009749800
 r8=fffff880097493b8  r9=fffff88009749480 r10=fffff88009749478
r11=fffff8a0001556d0 r12=fffff8a0002c5140 r13=fffffa8004e87b70
r14=fffff9808bb80c60 r15=fffff9808bb80f70
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
Ntfs!NtfsMapUserBuffer+0x28:
fffff880`0125d138 f6410a05        test    byte ptr [rcx+0Ah],5 ds:002b:fffa8006`a269f00a=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  MsMpEng.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f06100
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsMapUserBuffer+28
fffff880`0125d138 f6410a05        test    byte ptr [rcx+0Ah],5

FAULTING_IP: 
Ntfs!NtfsMapUserBuffer+28
fffff880`0125d138 f6410a05        test    byte ptr [rcx+0Ah],5

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff8800130eb05 to fffff8800125d138

STACK_TEXT:  
fffff880`09749320 fffff880`0130eb05 : fffff880`097493d0 fffffa80`04e87b70 fffff8a0`1a872b40 fffffa80`04e87b70 : Ntfs!NtfsMapUserBuffer+0x28
fffff880`09749360 fffff880`0130d754 : fffffa80`04e87b70 fffff980`8bb80c60 00000000`00000003 00000000`ffffff40 : Ntfs!NtfsReadUsnJournal+0xb5
fffff880`097494d0 fffff880`012fb88a : fffffa80`04e87b70 fffff8a0`002c5140 00000003`5c3ea900 fffff880`00000101 : Ntfs!NtOfsPostNewLength+0xc8
fffff880`09749560 fffff880`0130e203 : 00000000`00000001 fffff880`09749800 fffffa80`04e87b70 00000000`00000000 : Ntfs!NtfsCommitCurrentTransaction+0x22a
fffff880`097495f0 fffff880`0126411e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCheckpointCurrentTransaction+0x27
fffff880`09749620 fffff880`012651a3 : fffffa80`04e87b70 fffff980`8ddb8c60 fffff880`09749801 fffff880`09749800 : Ntfs!NtfsCommonWrite+0x28b8
fffff880`097497d0 fffff800`03179c16 : fffff980`8ddb8c60 fffff980`8ddb8c60 fffffa80`0545c030 fffffa80`067942e0 : Ntfs!NtfsFsdWrite+0x1c3
fffff880`09749890 fffff880`0115fbcf : fffff980`8ddb8fb8 fffff880`09749940 fffffa80`05dd9360 fffffa80`067942e0 : nt!IovCallDriver+0x566
fffff880`097498f0 fffff880`0115e6df : fffffa80`05121de0 fffffa80`05121de0 fffffa80`05121d00 fffff980`8ddb8c60 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`09749980 fffff800`03179c16 : fffff980`8ddb8c60 00000000`00000002 fffff980`8ddb8c60 00000000`00000000 : fltmgr!FltpDispatch+0xcf
fffff880`097499e0 fffff800`02fdc21b : 00000000`00000001 fffffa80`04c0bb60 00000000`00000001 fffffa80`094f96f0 : nt!IovCallDriver+0x566
fffff880`09749a40 fffff800`02fe6c83 : fffff980`8ddb9000 fffff880`09749ca0 fffffa80`04c0bb60 00000000`00000000 : nt!IopSynchronousServiceTail+0xfb
fffff880`09749ab0 fffff800`02cd2ed3 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x7e2
fffff880`09749bb0 00000000`7708139a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`020ef5e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7708139a


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsMapUserBuffer+28

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

STACK_COMMAND:  .cxr 0xfffff88009748940 ; kb

FAILURE_BUCKET_ID:  X64_0x24_VRF_Ntfs!NtfsMapUserBuffer+28

BUCKET_ID:  X64_0x24_VRF_Ntfs!NtfsMapUserBuffer+28

Followup: MachineOwner
---------

Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html

Also, since you keep getting disk related crashes, check for an update to your IDE ATA/ATAPI controllers devices in Device Manager. If no updates exist, the drivers for them may be corrupted. Uninstall each of those devices through right clicking each of them in device manager, clicking uninstall, putting a tick in "Delete the driver software for this device", and then hitting OK. Restart the computer after uninstalling drivers for all devices and install the latest driver for each of the devices.

 

[justinbronze]

Okay. Disk check is scheduled. I just finished uninstalling the devices (four of them, no updates for any). Had to restart three times, one to finish uninstalling, and twice to "apply changes". It now shows that I have 10 IDE controller devices, and one I had previously is gone.

So three of the four controller devices are still present in the current 10 (The one missing had AMD in the name. But everything seems to be running fine and opening fine.)

 

[writhziden]

Okay. Disk check is scheduled. I just finished uninstalling the devices (four of them, no updates for any). Had to restart three times, one to finish uninstalling, and twice to "apply changes". It now shows that I have 10 IDE controller devices, and one I had previously is gone.

So three of the four controller devices are still present in the current 10 (The one missing had AMD in the name. But everything seems to be running fine and opening fine.)

Any exclamation marks indicating a device is unknown?

 

[justinbronze]

Nope. And since there nothing indicating a device is unknown, and nothing seems affected negatively, I'd say the removal of whatever it was was for the better.

 

[writhziden]

Hopefully. Go ahead and disable Verifier and see how the stability is. If you continue to have problems, I would highly recommend considering at least a repair install if not a clean install.

 

[justinbronze]

I will do the repair install if there are anymore BSODs.

And I would like to thank you VERY VERY much for helping so much this past month or so. I greatly appreciate you sticking with me and helping me.

 

[writhziden]

You are welcome. I will stick through until we get it resolved, no doubt about that.

 

[justinbronze]

Here's the Disk Check.

 

[justinbronze]

Weirdest thing just happened. As soon as I clicked 'submit post' on here to send the chkdsk file, I got an IRQL Blue screen. So here's a zip file.

I've turned verifier back on to prevent BSODs.

 

[writhziden]

Loading Dump File [J:\BSODDmpFiles\justinbronze\Windows_NT6_BSOD_jcgriff2\012312-45989-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c19000 PsLoadedModuleList = 0xfffff800`02e5e670
Debug session time: Mon Jan 23 04:04:05.073 2012 (UTC - 7:00)
System Uptime: 0 days 4:17:52.603
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {9, 2, 1, fffff80002cb0ce8}

Unable to load image \SystemRoot\system32\DRIVERS\usbfilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for usbfilter.sys
*** ERROR: Module load completed but symbols could not be loaded for usbfilter.sys
Probably caused by : usbfilter.sys ( usbfilter+1bf5 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000009, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cb0ce8, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec8100
 0000000000000009 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IoAllocateMdl+118
fffff800`02cb0ce8 48894108        mov     qword ptr [rcx+8],rax

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff88002ffb220 -- (.trap 0xfffff88002ffb220)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80055c4e80 rbx=0000000000000000 rcx=0000000000000001
rdx=fffffa80055c4e81 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cb0ce8 rsp=fffff88002ffb3b0 rbp=0000000000000008
 r8=fffffa80055c4e80  r9=0000000000000000 r10=fffffa8003ba9470
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!IoAllocateMdl+0x118:
fffff800`02cb0ce8 48894108        mov     qword ptr [rcx+8],rax ds:7010:00000000`00000009=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c951e9 to fffff80002c95c40

STACK_TEXT:  
fffff880`02ffb0d8 fffff800`02c951e9 : 00000000`0000000a 00000000`00000009 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`02ffb0e0 fffff800`02c93e60 : 00000000`00000000 fffff880`03f4056a 00000000`00000000 00000000`00000030 : nt!KiBugCheckDispatch+0x69
fffff880`02ffb220 fffff800`02cb0ce8 : fffffa80`04705300 fffff880`03f5363c 00000000`000003ed fffff880`03f35f5d : nt!KiPageFault+0x260
fffff880`02ffb3b0 fffff880`03f51252 : fffffa80`053b9750 00000000`c000000d fffffa80`047a4000 fffffa80`04705300 : nt!IoAllocateMdl+0x118
fffff880`02ffb400 fffff880`03f59e74 : fffffa80`04630c60 fffffa80`04c00009 fffffa80`04630c60 fffffa80`053b9750 : USBPORT!USBPORT_ProcessURB+0x8de
fffff880`02ffb4b0 fffff880`03f33af4 : 00000000`00000000 fffffa80`04c08050 fffffa80`056431f0 fffffa80`04630c60 : USBPORT!USBPORT_PdoInternalDeviceControlIrp+0x138
fffff880`02ffb4f0 fffff880`03f86bf5 : fffffa80`04c0c050 fffffa80`03b60060 fffffa80`04630c60 fffffa80`04c0c1a0 : USBPORT!USBPORT_Dispatch+0x1dc
fffff880`02ffb530 fffffa80`04c0c050 : fffffa80`03b60060 fffffa80`04630c60 fffffa80`04c0c1a0 fffffa80`04c09d40 : usbfilter+0x1bf5
fffff880`02ffb538 fffffa80`03b60060 : fffffa80`04630c60 fffffa80`04c0c1a0 fffffa80`04c09d40 fffff800`02dc4100 : 0xfffffa80`04c0c050
fffff880`02ffb540 fffffa80`04630c60 : fffffa80`04c0c1a0 fffffa80`04c09d40 fffff800`02dc4100 fffffa80`04630e98 : 0xfffffa80`03b60060
fffff880`02ffb548 fffffa80`04c0c1a0 : fffffa80`04c09d40 fffff800`02dc4100 fffffa80`04630e98 fffffa80`04c09d40 : 0xfffffa80`04630c60
fffff880`02ffb550 fffffa80`04c09d40 : fffff800`02dc4100 fffffa80`04630e98 fffffa80`04c09d40 fffffa80`04630c60 : 0xfffffa80`04c0c1a0
fffff880`02ffb558 fffff800`02dc4100 : fffffa80`04630e98 fffffa80`04c09d40 fffffa80`04630c60 fffffa80`047a2490 : 0xfffffa80`04c09d40
fffff880`02ffb560 fffff880`040fc2b2 : fffffa80`04c09d40 fffffa80`04630e98 fffffa80`00000000 00000000`000007ff : nt!ExAllocatePoolWithTag+0x20
fffff880`02ffb650 fffff880`040fcd8f : 00000000`00000000 00000000`00000000 fffffa80`03b60060 00000000`00000000 : usbhub!UsbhIncPdoIoCount+0xda
fffff880`02ffb6b0 fffff880`040cafb7 : fffffa80`04630c60 fffffa80`048088b0 fffffa80`04808c88 fffffa80`053b9750 : usbhub!UsbhPdoInternalDeviceControl+0x373
fffff880`02ffb700 fffff880`03f86bf5 : fffffa80`046cbb00 00000000`00000000 fffffa80`03b60de0 fffff880`041b9e82 : usbhub!UsbhGenDispatch+0x57
fffff880`02ffb730 fffffa80`046cbb00 : 00000000`00000000 fffffa80`03b60de0 fffff880`041b9e82 fffffa80`046cbc50 : usbfilter+0x1bf5
fffff880`02ffb738 00000000`00000000 : fffffa80`03b60de0 fffff880`041b9e82 fffffa80`046cbc50 fffffa80`03bcc600 : 0xfffffa80`046cbb00


STACK_COMMAND:  kb

FOLLOWUP_IP: 
usbfilter+1bf5
fffff880`03f86bf5 ??              ???

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  usbfilter+1bf5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: usbfilter

IMAGE_NAME:  usbfilter.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d0899c9

FAILURE_BUCKET_ID:  X64_0xA_usbfilter+1bf5

BUCKET_ID:  X64_0xA_usbfilter+1bf5

Followup: MachineOwner
---------

It is blaming your usbfilter.sys again. Probably something plugged into your usb hub that Windows is not liking. Repair install time?

 

[JMH]

I have been watching {with fascination} this thread since the start.
The patience you both display amazes me.
I agree it is time to move on.
Well done both of you!

 

[writhziden]

I have been watching {with fascination} this thread since the start.
The patience you both display amazes me.
I agree it is time to move on.
Well done both of you!

Lol, thanks Jan. Appreciate the idle curiosity. Hopefully a repair install will fix the problem, and if not, we can move to the clean install. At least that will determine whether it is software or hardware in the end.

 

[justinbronze]

I just looked at device manager and found two more grey unused USB things. I don't know how they got there, and I uninstalled them.

I am really thinking about a repair install. If I get a one more problem, I will be doing a repair install.

 

[writhziden]

I just looked at device manager and found two more grey unused USB things. I don't know how they got there, and I uninstalled them.

I am really thinking about a repair install. If I get a one more problem, I will be doing a repair install.

Good plan. Let us know if you need help with the repair.

 

[justinbronze]

So I've deleted the INFCACHE.1 file. Rebooted, replugged in USB cables. It has yet to recreate itself. I don't see any problems though, no unknown or unworking devices.

 

[Dave76]

I have not run any registry cleaning tools on my computer. I'm well aware of the damage they can cause, and refuse to use them in fear they might cause the problem I'm having now.

I also ran Memtest86 last night. No errors found. So it looks that so far all the tests show no problems.

Next step?

How many passes did memtest86+ make?

Since you keep getting possible memory related crashes let's take a look at the memory settings.

I have seen RAM pass several tests and still be the cause of crashes.

D/L CPUZ and post a snip of the CPU, Mainboard, Memory, and SPD tabs.
For posting the information , enter 'Snipping tool' in the Start button > Search box, hit enter. Select the area you want to post and save to a convenient place.
How to Post a Screenshot in Seven Forums

Have you been checking your temperatures?
Use Core Temp, to check the CPU temps when at idle, under load and/or testing.
Let us know the minimum and maximum temps you get.

Go to your BIOS and tell us what the CPU, RAM and the CPU integrated memory controller voltages are.

It's worth taking a closer look since nothing has been discovered yet.

Do you have iTunes installed?
This out of date driver, used by iTunes, may be causing issues.

GEARAspiWDM GEARAspiWDM.sys Mon May 18 20:17:04 2009 - CD-ROM Class Filter Driver by Gear Software Also comes with iTunes

Un-install iTunes if you have it, it's known to cause crashes on some systems, for testing purposes.

Have you ran Western Digital Lifeguard – Extended Test on your WD HDD?
If not then run the test, the Crystal Disk info on it looks a bit questionable.

What motherboard do you have?
Have you updated the drivers recently?
Which BIOS version are you running?

 

[justinbronze]

Snips:

View attachment 194685

View attachment 194686

View attachment 194687

View attachment 194688

CoreTemp:

Idle:
Min: 43 Degree Celsius
Max:46 Degrees Celsius

Load (I opened a few or more programs right after startup):
Min: 43 Degrees Celsius
Max (gradually increased): 45-48 Degrees Celsius

At time of posting:
Min: 41 Degrees Celsius
Max: 48 Degrees Celsius

I will have the voltages for you later today.

 

[Dave76]

What is your ambient temperature?
Your idle temps are high, you should check your CPU thermal paste.

There is a known issue with AMD IMC (Integrated Memory Controller) running RAM above 1333MHz.
VERY IMPORTANT INFORMATION REGARDING AMD AM3 CPU's and RAM SPEEDS
Q&A for the topic VERY IMPORTANT INFORMATION REGARDING AMD AM3 CPU's & RAM....

This is a Gigabyte site but the information is the same for any motherboard with an AMD CPU.

Set your RAM frequency to 666MHz (will be 1333MHz) and the first 4 timings manually to 9-9-9-25, Command rate to 2T.
Run your system and try to re-create the crash senerio.

Let me know the voltage settings requested previously, they might need an adjustment.

BIOS version looks ok, only one newer version, nothing mentioned that may help your situation so not worth updating.

 

[justinbronze]

Been about a month without a blue screen. Must have been the usb filter thing. I'll keep an eye on it to make sure it stays away.

Thanks all of your for your help. If I have any more problems...or any that decide to rear their ugly head, I'll return.

Thanks so much.