Random BSODs, 100% Utilization, and Driver Issues

[iXneonXi]

Hello everyone. I've had a great experience with this site. The How-Tos and Tutorials have been more than helpful numerous times I've had to diagnose and fix system issues. However, this time, things seem to have got out of hand and are beyond my area of expertise. Instead of breaking something, I have decided it would be best to have more experienced users take a look. I have attached the appropriate information requested, along with the following (which includes memory timings, CPU-Z reports, etc..: Lots of system info via Imgur
Note I am NOT overclocked. Also included in the attachment is an excerpt from a string dump (produced with process explorer) of ntoskernel.exe that is riddled with errors.

Symptoms:

• Seemingly Random BSODs (rare)
• BSODs able to be reproduced: Format SD card using SDFormatter (near 100% chance)
• Random intense CPU utilization and subsequent freezes and lock-ups

Notes:

• Appears to be driver related.
• The system never hangs and requires a restart, if I wait it will resolve. Lag spikes are typically 1-2s, a few seconds max.
• Hamachi Driver reports an error but Hamachi seems to function fine.
• If it means anything, I have two stuck core temp sensors (DTS) at 56C. I am working on diagnosing and repairing this in a separate thread elsewhere.
• Process Explorer shows "TID 64, CPU 48.65, CSwitch Delta 458, Start Address 'ntoskrnl.exe!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x1e0'" as the thread which uses large amounts of resources.

Thanks in advance and I am more than willing to provide any more information if necessary.

 

[richc46]

Welcome

 Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
Loading Dump File [C:\Users\richc46\AppData\Local\Temp\Temp1_reports.zip\Windows_NT6_BSOD_jcgriff2\060311-18735-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`02e1d000 PsLoadedModuleList = 0xfffff800`03062e90
Debug session time: Fri Jun  3 16:10:14.837 2011 (GMT-4)
System Uptime: 0 days 2:33:23.538
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 23, {110136, 0, 0, 0}
Probably caused by : fastfat.SYS ( fastfat!FatDecodeFileObject+6a )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
FAT_FILE_SYSTEM (23)
    If you see FatExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 0000000000110136
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
 
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x23
PROCESS_NAME:  SDFormatter.ex
CURRENT_IRQL:  0
LAST_CONTROL_TRANSFER:  from fffff88006aa8746 to fffff80002e9d640
STACK_TEXT:  
fffff880`06ce58c8 fffff880`06aa8746 : 00000000`00000023 00000000`00110136 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`06ce58d0 fffff880`06a97216 : fffff800`0300fe80 00000000`00000000 fffff800`03024c30 00000000`00000000 : fastfat!FatDecodeFileObject+0x6a
fffff880`06ce5910 fffff880`06a9711d : fffffa80`0619a420 fffffa80`06de7700 00000000`00000000 fffffa80`0390e200 : fastfat!FatCommonCleanup+0x92
fffff880`06ce59f0 fffff800`031a4f0f : 00000000`00000001 fffffa80`06de7700 fffffa80`06de7700 fffffa80`0390e2c0 : fastfat!FatFsdCleanup+0x59
fffff880`06ce5a30 fffff800`031946b4 : 00000000`00000000 fffffa80`03beb850 00000000`00000000 fffff800`02ea751c : nt!IopCloseFile+0x11f
fffff880`06ce5ac0 fffff800`03194471 : fffffa80`03beb850 fffffa80`00000001 fffff8a0`0310b450 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4
fffff880`06ce5b40 fffff800`03194a34 : 00000000`00000118 fffffa80`03beb850 fffff8a0`0310b450 00000000`00000118 : nt!ObpCloseHandleTableEntry+0xb1
fffff880`06ce5bd0 fffff800`02e9c8d3 : fffffa80`03ba0060 fffff880`06ce5ca0 00000000`7efdb000 00000000`0018ec94 : nt!ObpCloseHandle+0x94
fffff880`06ce5c20 00000000`77b7140a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0008e318 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b7140a
 
STACK_COMMAND:  kb
FOLLOWUP_IP: 
fastfat!FatDecodeFileObject+6a
fffff880`06aa8746 cc              int     3
SYMBOL_STACK_INDEX:  1
SYMBOL_NAME:  fastfat!FatDecodeFileObject+6a
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: fastfat
IMAGE_NAME:  fastfat.SYS
DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc1f0
FAILURE_BUCKET_ID:  X64_0x23_fastfat!FatDecodeFileObject+6a
BUCKET_ID:  X64_0x23_fastfat!FatDecodeFileObject+6a
Followup: MachineOwner
---------

A memory test is called for here.
http://www.geekstogo.com/forum/topic/246994-guide-to-using-memtest86/
If you pass this test, it is probably a driver, fastfact.sys.
Right now I think memory is the most likely candidate.

 

[iXneonXi]

A few questions.
I ran a MemTest much earlier in the year overnight and everything checked out. How long do you recommend I run it for this time? Any specific program options or should defaults be fine? Should I test a single module at a time or both? Would it be best to modify any BIOS settings such as loading Optimized Defaults or Fail Safe Defaults prior to the testing or is my current setup fine?

 

[richc46]

Run it for at least 8 passes.
If fails take a good stick and test each slot for 8 passes
If passes, take a good stick and test each slot for 4 passes
Thats all you need to do.

 

[iXneonXi]

While I'm sure it isn't 100% guaranteed, it looks like my memory is fine. 12 Passes Dual Channel Interleaved. 9 Pass single module #1. 5 Pass Single Module #2 (both were tested in first slot). Will provide screen shots but I don't think it matters all that much since it's passed. Let it run for a while since I had loads of other tasks to tend to today, anyway.

 

[richc46]

If your RAM check out ok and you are sure that you did the test correctly:
Update the driver that was mentioned. If you still have problems, I feel that the BSOD is still memory related.
YOu have high usage:
Run a full anti virus scan
Download and run malwarebytes. Make a full scan and be sure that it is upadated.
When you have the high usage, bring up task manager (process) and see what is using the resources.

 

[iXneonXi]

In response to the above I should be virus & malware free as I have Microsoft Security Essentials and perform regular scans. Before posting here I ran both Kaspersky AV 10 Rescue Disk (updated), MB Anti-Malware, Super Antispyware, and BitDefender Rescue Disk (updated) just to be sure.

I have brought up Process Explorer and as I stated in the original post, it is PID 4 System: "TID 64, CPU 48.65, CSwitch Delta 458, Start Address 'ntoskrnl.exe!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x1e0'" as the thread which uses large amounts of resources. Image attached.

As for the fastfat.sys driver, which site(s) do you recommend me to find the most current stable version for Windows 7 Ultimate x64 SP1? A quick search for it results in multitudes of sites with versions for multiple OS, some riddled with advertising and asking for registration, etc.

Thanks for your assistance, this issue has been frustrating me for quite some time and at least it appears we're making headway.

Memtest86+ v4.20 Results (Imgur)

 

[iXneonXi]

Would the 32 bit version fastfat.sys work with a 64 bit computer? I have a 32 Bit Windows 7 Enterprise running SP1 I could copy from but not another SP1 64 bit. The download sites online don't seem to list versions and someone suggested running Reimage Windows Repair but it looked sketchy.

Any word on the process explorer report?

 

[richc46]

In response to the above I should be virus & malware free as I have Microsoft Security Essentials and perform regular scans. Before posting here I ran both Kaspersky AV 10 Rescue Disk (updated), MB Anti-Malware, Super Antispyware, and BitDefender Rescue Disk (updated) just to be sure.

I have brought up Process Explorer and as I stated in the original post, it is PID 4 System: "TID 64, CPU 48.65, CSwitch Delta 458, Start Address 'ntoskrnl.exe!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x1e0'" as the thread which uses large amounts of resources. Image attached.

As for the fastfat.sys driver, which site(s) do you recommend me to find the most current stable version for Windows 7 Ultimate x64 SP1? A quick search for it results in multitudes of sites with versions for multiple OS, some riddled with advertising and asking for registration, etc.

Thanks for your assistance, this issue has been frustrating me for quite some time and at least it appears we're making headway.

Memtest86+ v4.20 Results (Imgur)[/QUOT

Lets start with the easy way first.
run 3 times if errors are found and are not repaired.
http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html
Dont know of a site to get fastfat. Its a MS driver. Since the driver is part of the OS there may be other ways to get it. Try the above first.

 

[iXneonXi]

Results:

C:\Users\Neon>sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\Users\Neon>

 

[richc46]

Do you have a Seven install DVD. Not one that came with the computer, but a DVD that you purchased.

 

[iXneonXi]

Having built the computer I have my USB Installer produced with (the original MS version) Windows 7 USB/DVD Download Tool from the Retail DVD.

 

[richc46]

Can you do this to get the file that you need?
http://www.sevenforums.com/tutorials/42776-extract-files-windows-7-installation-dvd-3.html

 

[iXneonXi]

The DVD is original retail not SP1, is this OK?

 

[richc46]

Be sure that your windows updater is set to download drivers.

 

[iXneonXi]

I have microsoft update with no advanced settings changed, just to let it download and allow me to choose when to install. I'll get all the remaining updates now. I signed into the download center where I got my original disc from and the Windows 7 Link now says SP1. I'll use Daemon Tools and 7-zip to get fastfat.sys.

 

[iXneonXi]

I was able to copy fastfat.sys from the Install DVD to my system folder after changing permissions. I will reboot and await instructions. The two files have the same time stamp so I am unsure if they are identical. I created a backup of the original.

[Update]Windows is updated and the system has rebooted since copying the replacement fastfat.sys

 

[richc46]

Yes, the time stamps would be the same, they came from the same place. Possibly the first is corrupt.

 

[iXneonXi]

Well here's the reports after windows update and replacing the file.

 

[richc46]

If you think that all the suggestions were taken care of. Use the computer and give us the new bsod reports if you get any.