Random BSOD's want to figure this out once and for all

[obidon]

And that was only about 10% of the corruption that is occurring on your system. I strongly advise that you http://www.sevenforums.com/tutorials/3413-repair-install.html Windows 7 ASAP.

Yeah I'm afraid that that looks like that's the only option for me.

How much of my OS will this change? I read in the guide that if I do it right it will preserve my user accounts, data, programs, and system drivers, but I'm still a little worried.

Will I have to redo my settings over such as the color scheme, wall paper, pinned taskbar icons, control panel settings, etc?

I'd prefer not to if I'm gonna have to redo a lot of modifications, but if it will definitely make my system errors go away then it looks like my only choice.

 

[writhziden]

The only thing that will definitely make the errors go away (assuming they are Windows based and not hardware based) is to http://www.sevenforums.com/tutorials/1649-clean-install-windows-7-a.html. That will require more work and time on your part, so I usually leave that as a last resort. You will lose your theme with a repair install; I cannot recall about pinned taskbar items...

You can backup your theme, though. We can walk you through it if you wish, or you can follow the tutorial: http://www.sevenforums.com/tutorials/280-theme-change-save.html

For the pinned taskbar items: http://www.sevenforums.com/tutorials/212923-taskbar-backup-restore-pinned-items-windows-7-a.html

What changes did you make in Control Panel?

 

[obidon]

The only thing that will definitely make the errors go away (assuming they are Windows based and not hardware based) is to http://www.sevenforums.com/tutorials/1649-clean-install-windows-7-a.html. That will require more work and time on your part, so I usually leave that as a last resort. You will lose your theme with a repair install; I cannot recall about pinned taskbar items...

You can backup your theme, though. We can walk you through it if you wish, or you can follow the tutorial: http://www.sevenforums.com/tutorials/280-theme-change-save.html

For the pinned taskbar items: http://www.sevenforums.com/tutorials/212923-taskbar-backup-restore-pinned-items-windows-7-a.html

What changes did you make in Control Panel?

You don't have to walk me through it haha, I'm not a total noob when it comes to computing. But thanks though. I followed the links and backed up my theme and taskbar items.

When I said the changes in Control Panel what I was referring to was the settings of the Control Panel sub-categories. Such as for the Taskbar and Start Menu Properties changing the Taskbar buttons to Never Combine and Using small icons. Also such as in the System sub-category changing the Performance Options to disable Animating windows when minimizing and maximizing. I don't know why anyone would want this enabled. It just slows down the system with eyecandy that does look good, but allows your system to seem a lot faster and makes you more productive when turned off.

So basically I mean just the small changes to settings I've made throughout the Win7 OS. Another example being changes in the Folder Options (to show hidden folders, unhide file type extensions, etc.)

With a repair install will I have to redo these small changes to system settings as well?

 

[writhziden]

The performance changes will be saved with your theme. Other small settings might, as well. You will have to change your folder options.

Just so you know I understand what you're saying: I recently did a clean install, so I understand the hassle of having to set things up as I like it, but it can be worth it to have a working system again.

 

[obidon]

Yeah that's true it is definitely worth it having a working system again. I just hope that I seriously don't get any more BSOD's after the repair install and that SP1 will install nice and smoothly so I won't have to worry about ANY of those things anymore.

I just have one more question before I do the repair install however.

What if I get a BSOD during the repair install? Then will my data and Program Files get messed up in the copy over?

I just thought of this just now and so I'm kinda worried. Some times I like thinking about worst case scenarios.

 

[writhziden]

It is possible that could happen, so I am glad you thought ahead. I usually advise that people backup any important data before doing the repair install. For some reason, that was an oversight on my part in this thread. My apologies. Backup any important data before starting the repair install.

 

[obidon]

Alright so I did the repair install and a couple things happened.

First of all, the first time I attempted the Repair Install it went through copying the files and restarting. But then after it rebooted and started to finish copying files or whatever it gave an error and said "Cannot finish repair install. Restoring your previous Windows version" or something of the likes.

So then it rebooted and my files were restored. Kinda a waste of time since it took a couple hours but oh well. So I tried the Repair Install again, this time falling asleep. And I assume it went successfully since when I woke up it was on the Activation Screen where it told you to enter your product key.

So I did this and rebooted and now my system is working and everything, but I'm not exactly sure if it completed all the way because of two reasons.

First my desktop didn't look like the desktop image from Brink's Repair Install tutorial after it finished. I still had my programs pinned to the taskbar which I thought were supposed to disappear.

Second, when installing some updates I kept getting the WerFault.exe process to come up saying that the .NET Framework has stopped working unexpectedly. I just kept hitting cancel on this and then the updates seemed to install fine after that but it is still pretty sketchy you know? I have no clue if these updates failed or not, all I know is that something had to cause that to happen.

The differences with this new Repaired Install I'm on right now however, are that some device drivers got reset since my graphics card was displaying the wrong resolution at startup and my Aero theme right now is the default Aero Basic theme where everything looks visually terrible. I knew this was supposed to happen and I'm pretty sure it did but I'm still not 100%. Also my Recycle bin got emptied for some reason.

I'm also downloading a bunch of updates (there were like 87) along with SP1 which isn't installed yet. So I'll let you know if that gets to finally install with no issues.

So with all these things being said, I'm still kinda confused if my Repair Install worked or not. Do you know if there is a sure way to check? Thanks a lot.

 

[writhziden]

The fact that you have so many updates means it probably went through fine. I would have to do a repair install to check for you to see if I end up with the same scenario. If you want me to do so, I can. It's been a while since I did a repair install with Windows 7, so I do not remember exactly how things end up in the end.

To check if updates installed or if there are still some failed updates, you can view your update history through Start Menu -> Control Panel -> System and Security -> Windows Update -> View update history

 

[obidon]

Well I installed all the updates and to my surprise they all installed successfully!!

Even SP1, which I've been trying to get all along! I'm pretty happy that this finally finished but man did it take a lot of work lol. I've been trying for a couple weeks now.

Well haven't gotten a BSOD since the Repair Install so maybe this did it. I know SP1 fixes a lot of things in Win7 so hopefully it will fix whatever was giving me those BSOD's.

I kinda forget that I made this thread for Blue Screens in general and not just installing SP1 but who knows, maybe they go hand in hand. If I happen to get another BSOD for some reason I will report back here but for now hopefully this should be good.

Thanks for all your help Writhziden. I appreciate you willing to do a Repair Install just for me haha, that's too kind. You will definitely get some rep for this.

I won't mark this thread as solved just yet in case I get another but if all looks good in a couple weeks then I will come back to do so. Thanks again for the help.

 

[writhziden]

You're welcome for the help.

I am glad you forgot about the blue screens; that means the system must be running stable. I am also happy that you were finally able to get SP1 installed.

Thanks for keeping us updated. I look forward to seeing how the system is responding in a couple weeks.

 

[obidon]

You're welcome for the help.

I am glad you forgot about the blue screens; that means the system must be running stable. I am also happy that you were finally able to get SP1 installed.

Thanks for keeping us updated. I look forward to seeing how the system is responding in a couple weeks.

Alright so it's been almost a week since I did the repair install, and my system's been pretty good for the most part. But yesterday and today I had another BSOD :/

Don't know what caused these. The first one didn't have a lot of relevent information, but the second one said it has caused by the NTFS.sys file.

What should I do from here?

 

[writhziden]

Follow the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html and we'll make a diagnosis. For NTFS.sys crashes, I also recommend a http://www.sevenforums.com/tutorials/433-disk-check.html.

 

[obidon]

Ok here are the attachements

 

[writhziden]

[list=1][*]Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\obidon\Windows_NT6_BSOD_jcgriff2\041412-22432-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505
Machine Name:
Kernel base = 0xfffff800`03056000 PsLoadedModuleList = 0xfffff800`0329a650
Debug session time: Sat Apr 14 00:06:48.082 2012 (UTC - 6:00)
System Uptime: 2 days 0:59:12.908
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
....................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5002, fffff780c0000000, 4a4a, 241e2fffffffe}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+2959c )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005002, The subtype of the bugcheck.
Arg2: fffff780c0000000
Arg3: 0000000000004a4a
Arg4: 000241e2fffffffe

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_5002

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  psia.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800ab8aa00 -- (.trap 0xfffff8800ab8aa00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8009749430 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff9802a680000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800033ce427 rsp=fffff8800ab8ab90 rbp=fffff8a008c2f810
 r8=000000000000000f  r9=fffff8800ab8a940 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po cy
nt!CcMapData+0x117:
fffff800`033ce427 0fb602          movzx   eax,byte ptr [rdx] ds:fffff980`2a680000=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000313cd14 to fffff800030d2c80

STACK_TEXT:  
fffff880`0ab8a5d8 fffff800`0313cd14 : 00000000`0000001a 00000000`00005002 fffff780`c0000000 00000000`00004a4a : nt!KeBugCheckEx
fffff880`0ab8a5e0 fffff800`0310341f : 00000002`49cd88c0 00000002`49cd8921 fffffa80`06dd6880 fffff800`03307b00 : nt! ?? ::FNODOBFM::`string'+0x2959c
fffff880`0ab8a670 fffff800`030f0c05 : 00000000`00000000 00000002`49cd88c0 00000000`00000000 fffff800`03307b00 : nt!MiResolveTransitionFault+0x32f
fffff880`0ab8a700 fffff800`030ef5c3 : f8a008c4`60100400 fffff980`2a680000 fffff6fc`c0153400 fffff800`03307b00 : nt!MiResolveProtoPteFault+0x325
fffff880`0ab8a790 fffff800`030dfd2b : fffff8a0`104edb00 fffffa80`09a181c0 00000000`00000000 00000000`00000000 : nt!MiDispatchFault+0x1c3
fffff880`0ab8a8a0 fffff800`030d0dae : 00000000`00000000 fffff980`2a680000 00000000`00000000 00000000`0000000e : nt!MmAccessFault+0xe1b
fffff880`0ab8aa00 fffff800`033ce427 : fffffa80`00000001 00000000`00000000 fffff880`0ab8ac58 fffff880`0ab8ac50 : nt!KiPageFault+0x16e
fffff880`0ab8ab90 fffff880`012d2c85 : fffffa80`00040000 fffffa80`09749430 fffff8a0`08c2f801 fffff8a0`0000000e : nt!CcMapData+0x117
fffff880`0ab8ac50 fffff880`012d6db1 : fffff8a0`08c2f810 00000000`00000000 fffff8a0`0a9fb540 fffffa80`0c7cce40 : Ntfs!FindFirstIndexEntry+0x1fa
fffff880`0ab8ace0 fffff880`012cacf5 : fffffa80`0c7cce40 fffffa80`0c7cce40 fffff8a0`0a1eee01 00000000`00000000 : Ntfs!NtfsFindIndexEntry+0x5d
fffff880`0ab8ad50 fffff880`01233a3d : fffffa80`0c7cce40 fffffa80`0b13f170 fffff880`0ab91370 fffffa80`0a821b00 : Ntfs!NtfsCommonCreate+0x7c5
fffff880`0ab8af30 fffff800`030ca777 : fffff880`0ab912e0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0ab8af60 fffff800`030ca738 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27
fffff880`0ab911b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+2959c
fffff800`0313cd14 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+2959c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4f558b55

FAILURE_BUCKET_ID:  X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+2959c

BUCKET_ID:  X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+2959c

Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\obidon\Windows_NT6_BSOD_jcgriff2\041212-20560-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505
Machine Name:
Kernel base = 0xfffff800`0305c000 PsLoadedModuleList = 0xfffff800`032a0650
Debug session time: Wed Apr 11 23:02:01.708 2012 (UTC - 6:00)
System Uptime: 0 days 3:31:20.534
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88009be8f68, fffff88009be87c0, fffff880012d9299}

Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteFcb+489 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88009be8f68
Arg3: fffff88009be87c0
Arg4: fffff880012d9299

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88009be8f68 -- (.exr 0xfffff88009be8f68)
ExceptionAddress: fffff880012d9299 (Ntfs!NtfsDeleteFcb+0x0000000000000489)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88009be87c0 -- (.cxr 0xfffff88009be87c0)
rax=fffff8a00b7095c0 rbx=fffff88009be9230 rcx=fffff8a00f94f541
rdx=fffff8a009c61f91 rsi=0002000000000000 rdi=fffffa800990d940
rip=fffff880012d9299 rsp=fffff88009be91a0 rbp=fffff88009be98a0
 r8=fffff8a009c61f90  r9=0000000000000040 r10=fffff8000324f420
r11=fffff8a00b7095c0 r12=fffff8a00b748010 r13=fffffa800aa88180
r14=fffff88009be9221 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
Ntfs!NtfsDeleteFcb+0x489:
fffff880`012d9299 488b8e88000000  mov     rcx,qword ptr [rsi+88h] ds:002b:00020000`00000088=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  adm.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000330a100
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsDeleteFcb+489
fffff880`012d9299 488b8e88000000  mov     rcx,qword ptr [rsi+88h]

FAULTING_IP: 
Ntfs!NtfsDeleteFcb+489
fffff880`012d9299 488b8e88000000  mov     rcx,qword ptr [rsi+88h]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff880012d9299

STACK_TEXT:  
fffff880`09be91a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsDeleteFcb+0x489


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsDeleteFcb+489

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

STACK_COMMAND:  .cxr 0xfffff88009be87c0 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsDeleteFcb+489

BUCKET_ID:  X64_0x24_Ntfs!NtfsDeleteFcb+489

Followup: MachineOwner
---------

[/list]

1. The problem seems related to the Secunia PSI Agent (psia.exe). See if removing the Secunia PSI Agent provides more stability.
2. This problem seems related to the Acronis Drive Monitor. Remove it to test.

 

[obidon]

[/list][/code]

1. The problem seems related to the Secunia PSI Agent (psia.exe). See if removing the Secunia PSI Agent provides more stability.
2. This problem seems related to the Acronis Drive Monitor. Remove it to test.

Ok I'll remove them but how can I test afterwards? And do you think these were causing the BSOD's or some other system unstability? Or was it affecting my Hard Disk Drive perhaps?

 

[writhziden]

It appears to me that they were affecting how Windows utilizes the hard disk and NTFS. To test, just do your normal routine and see if Windows is stable.

 

[obidon]

Well I got another BSOD with the error code as SYSTEM_SERVICE_EXCEPTION. What does this mean? So random I don't understand.

Should I attach anything else that would be of use? A System Reliability History Report perhaps? Thanks for continuing to help diagnose my system.

 

[writhziden]

That is a new crash that you had not had yet from what I see in the thread. It usually indicates graphics card issues with either the drivers or the hardware itself.

Can you please upload the latest crash reports for analysis?

 

[obidon]

That is a new crash that you had not had yet from what I see in the thread. It usually indicates graphics card issues with either the drivers or the hardware itself.

Can you please upload the latest crash reports for analysis?

Ok what crash reports do you want exactly? Is it best to give a Reliability Monitor Report exported as an HTML, or the folder generated by the BSOD Dump & System File Collection application? Or something else?

 

[writhziden]

Given the time in between, it probably would be best to follow the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html and provide the full set of logs and reports.