Solved Random BSOD once a week

[azaravicius]

Hi,
once a week or so I get BSOD. And I don't know why. It is work computer and here are always open this programs (AutoCAD Civil 3D 2010, Firefox, MS Word 2010, MS Exel 2010). I have used SF Diagnostic Tool and uploaded results.

Also here are times when trying to turn on computer, computer turns on (normal light and fan sounds), but monitor do not respond. But restarting computer by pressing restart button on computer, computer and monitor turns on normally. But I don't know if it is relates to BSOD.

 

[koolkat77]

Welcome to the Forum.

Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (http://www.osr.com)
Online Crash Dump Analysis Service
See http://www.osronline.com for more information
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18229.amd64fre.win7sp1_gdr.130801-1533
Machine Name:
Kernel base = 0xfffff800`03218000 PsLoadedModuleList = 0xfffff800`0345b6d0
Debug session time: Wed Oct  2 08:59:16.380 2013 (UTC - 4:00)
System Uptime: 0 days 7:58:11.176
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800d60e678
Arg3: fffff8800d60ded0
Arg4: fffff880016afdee

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

EXCEPTION_RECORD:  fffff8800d60e678 -- (.exr 0xfffff8800d60e678)
ExceptionAddress: fffff880016afdee (Ntfs!NtOfsFindRecord+0x000000000000016e)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8800d60ded0 -- (.cxr 0xfffff8800d60ded0)
rax=fffff98001394708 rbx=0000000000000000 rcx=fffff8800d60ead8
rdx=fffff8800d60e9c8 rsi=fffffa80136c7500 rdi=0000000000000000
rip=fffff880016afdee rsp=fffff8800d60e8b0 rbp=fffffa8011e26c60
 r8=fffff980013946f8  r9=0000000000000028 r10=fffff980013947f8
r11=fffff8800d60e8a8 r12=fffffa80136c75c0 r13=fffff8800d60ea00
r14=fdfff8800d60eaf8 r15=fffff8a0001e0ca0
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
Ntfs!NtOfsFindRecord+0x16e:
fffff880`016afdee 49894608        mov     qword ptr [r14+8],rax ds:002b:fdfff880`0d60eb00=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  firefox.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034c5100
GetUlongFromAddress: unable to read from fffff800034c51c0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtOfsFindRecord+16e
fffff880`016afdee 49894608        mov     qword ptr [r14+8],rax

FAULTING_IP: 
Ntfs!NtOfsFindRecord+16e
fffff880`016afdee 49894608        mov     qword ptr [r14+8],rax

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff880016b0492 to fffff880016afdee

STACK_TEXT:  
fffff880`0d60e8b0 fffff880`016b0492 : fffffa80`136c75c0 fffffa80`0fc73180 fffff880`0d60eab8 fffffa80`136c75c0 : Ntfs!NtOfsFindRecord+0x16e
fffff880`0d60ea70 fffff880`016b0223 : 00000000`00000000 fffffa80`0fc73180 fffffa80`000004e2 00000000`00000000 : Ntfs!MapSecurityIdToSecurityDescriptorHeaderUnsafe+0x5a
fffff880`0d60eb30 fffff880`016b65dd : fffffa80`136c75c0 fffffa80`0fc73180 fffffa80`11e26c60 00000000`00000000 : Ntfs!NtfsCacheSharedSecurityBySecurityId+0xdb
fffff880`0d60ebb0 fffff880`016aee2f : fffffa80`136c75c0 fffff8a0`148db010 fffffa80`136c7510 fffff8a0`148db010 : Ntfs!NtfsUpdateFcbInfoFromDisk+0x4fe
fffff880`0d60ed00 fffff880`016d2f69 : fffff880`0d60f2a0 fffffa80`11e26c60 fffffa80`136c75c0 00000000`00000000 : Ntfs!NtfsOpenFile+0x2cf
fffff880`0d60eef0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreate+0xc49


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtOfsFindRecord+16e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5167f5fc

STACK_COMMAND:  .cxr 0xfffff8800d60ded0 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtOfsFindRecord+16e

BUCKET_ID:  X64_0x24_Ntfs!NtOfsFindRecord+16e

Followup: MachineOwner
---------

Avira and Comodo are a frequent cause of BSOD's. Please uninstall it.

Start Menu\Programs\Avira	Public:Start Menu\Programs\Avira	Public
Start Menu\Programs\Avira\Avira Desktop	Public:Start Menu\Programs\Avira\Avira Desktop	Public
Start Menu\Programs\Comodo	Public:Start Menu\Programs\Comodo	Public

------------------------
Microsoft Security Essentials & the Free version of Malwarebytes, update and make full scans separately:

• Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase
• Help protect your PC with Microsoft Security Essentials
• Malwarebytes Free

   Note

:info: Do not start the trial version of MalwareBytes

You may also take a look at:

• Good & Free System Security Combination

Gigabyte EasySaver (and EasyTune6 if installed) will cause BSOD's on some Windows 7 systems. Please uninstall it.

Start Menu\Programs\GIGABYTE	Public:Start Menu\Programs\GIGABYTE	Public
Start Menu\Programs\GIGABYTE\ET6	Public:Start Menu\Programs\GIGABYTE\ET6	Public

   Information

Download

and install Revo Uninstaller.

• Opt for "Advanced Mode" and uninstall the software (also delete the leftover registry entries).

------------------------
Daemon Tools (also Alcohol % software) are known to cause BSOD's on some Win7 systems (mostly due to the sptd.sys driver, although we have seen dtsoftbus01.sys blamed on several occasions). Please uninstall Daemon Tools.

Start Menu\Programs\DAEMON Tools Lite	Public:Start Menu\Programs\DAEMON Tools Lite	Public

• DuplexSecure - FAQ

As an alternative:

• We recommend the use of Total Mounter or Magic ISO

------------------------
Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

• Click on the rb:
• Type CMD on Search
• Left click and Run as Administrator
• Type SFC /scannow - read here

------------------------
Run Disk Check on your Hard Drive for file system errors and bad sectors on it - read here
------------------------
Make scans with these tools -

• TDSSKiller Rootkit Removal Utility Free Download | Kaspersky Lab US
• Online Virus Scanner Eset

------------------------
Upload a screenshot using:

• CrystalDiskInfo:tip: For how to upload a screenshot or file, read here

Test your Hard Drive(s) by running:

• Hard Drive Diagnostic Procedure

Let us know the results.

 

[azaravicius]

Thanks, I have uninstalled all programs you asked and installed recommended programs. Right now ESET Online scanner is scanning my computer. Microsoft Security Essentials & the Free version of Malwarebytes did not found any malware. Still need to run Disk Check and test hard drivers. But to know if it helped or not will take few weeks, because BSOD do not happen often.

 

[koolkat77]

Okay, no problem.

 

[muhahaa]

The crash seems to be caused by a flipped bit (r14=fdfff8800d60eaf8, correct: fffff8800d60eaf8, which is a part of the thread's stack), which gives a reason to suspect defective hardware.

Here are some hardware testing guide links:

http://www.sevenforums.com/tutorials/100352-hardware-stress-test-prime95.html

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

 

[azaravicius]

Hi muhahaa,
I have run prime95 Blend test and got this results

[Fri Oct 04 09:20:47 2013]
FATAL ERROR: Rounding was 0.5, expected less than 0.4
Hardware failure detected, consult stress.txt file.
FATAL ERROR: Rounding was 0.4997558594, expected less than 0.4
Hardware failure detected, consult stress.txt file.
FATAL ERROR: Rounding was 0.5, expected less than 0.4
Hardware failure detected, consult stress.txt file.
FATAL ERROR: Rounding was 0.4996337891, expected less than 0.4
Hardware failure detected, consult stress.txt file.

Here are window of other test

 

[azaravicius]

Here are window of Memtest86 test

 

[koolkat77]

Test and Diagnose RAM Issues with Memtest86+:

• RAM - Test with Memtest86+

   Tip

• :info: Pay close attention to Part 3 of the tutorial "If you have errors"
• :tip: Test the RAM with Memtest86+ for at least 7-10 passes. It may take up to 22 passes to find problems. Make sure to run it once after the system has been on for a few hours and is warm, and then also run it again when the system has been off for a few hours and is cold.

 

[azaravicius]

I have run Memtest86 for 8 pass, it took 41:37:33 and here are two errors. So I have decided to take it to warranty repair.