Sporadic BSODs, no consistent cause

[StripyHorse]

Hi,

My computer (Lenovo G570) has had problems with BSODs for basically the whole time that I have owned it. They are extremely sporadic - sometimes it will work fine for a month and the problem appears to have been resolved and sometimes it crashes several times in a few days.

I had a couple of crashes recently. On the first occasion LibreOffice was the only thing open but I wasn't doing anything on the computer at the time, not even moving the mouse, and I hadn't been for a while. The second time it crashed just after I closed Firefox (which I have had other stability issues with recently).

I posted about this once before and I thought that I had fixed the issue - http://www.sevenforums.com/bsod-hel...ent-bsods-errors-0x0c2-0x019-0x05c-0x00a.html
I know the rules about double posting but seeing as that thread has been dead for over a year I thought I had better start again.

I appreciate any help you can give me with this. I would give more detail if the BSODs correlated with any activity but they don't seem to.

Thanks.

UPDATE: I googled some of the BSOD error messages, and the information for BAD_POOL_HEADER suggests a driver issue. I checked the drivers here - http://support.lenovo.com/en_GB/research/hints-or-tips/detail.page?DocID=HT072724 - and the only one which is out of date is the Intel chipset driver. This is weird because I run Intel's driver verifier fairly regularly and it hasn't picked up on it. Should I update from the Lenovo page?

 

[Arc]

The BSOD is caused by Lenovo EE Boot Optimizer driver, which is a factory bloatware, and should be remover.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff880089d50d8, fffff880089d4930, fffff80002eaf718}

*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=fbfmon.sys"]fbfmon.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for[URL="http://www.carrona.org/drivers/driver.php?id=fbfmon.sys"] fbfmon.sys[/URL]
Probably caused by : [URL="http://www.carrona.org/drivers/driver.php?id=fbfmon.sys"]fbfmon.sys[/URL] ( fbfmon+330f )

Followup: MachineOwner
---------

I'd recommend you to http://www.sevenforums.com/tutorials/219576-clean-up-factory-bloatware.html, with a special reference to Point #13

13. Consider a Clean Reinstall - Factory OEM Windows 7 which is often better than getting a new computer considering how pre-installed bloatware can corrupt Windows 7 even if it's completely cleaned up.

 

[StripyHorse]

Thanks Arc! That was blissfully simple...

I had a look at that great tutorial and uninstalled Boot Optimiser. It was actually already disabled on startup but it seems it was still interfering. I did a before and after on the drivers folder to make sure that fbfmon.sys had gone (which from some googling and the info on BlueScreenView I think is the driver that you're talking about?) and the uninstall got rid of it.

I can see that a clean reinstall would be a good idea but I can't face it with all the programs that I have installed and set up. I'll definitely do it whenever I get a new computer though.

Out of interest, did all the BSODs show up as being caused by fbfmon.sys? On BlueScreenView it only shows up as a problem on a couple of them, but I've heard that BSV can give false leads. Only asking because it would be useful to know what to look for if something similar happens again.

Thanks again for your help, you've sorted what the others didn't manage to last time!

 

[Arc]

Lenovo EE Boot Optimizer driver was responsible behind those BSODs directlyor indirectly. As now it is uninstalled, let us know how it is going. If it BSODs again, we will do further troubleshooting.

 

[StripyHorse]

Just when it looked OK I had another BSOD. This time it was when bringing the computer out of sleep.

Attached is the new info.

I had a look at the running drivers from the time of the crash and fbfmon was there again. This is weird because I looked in C:\Windows\System32\drivers after the uninstall and it had gone, and it still isn't there. Is there anywhere else it could be lurking? I did a search on the C: drive which didn't show anything.

Thanks.

 

[Arc]

It is a stop 0x24, NTFS file system error as pointed out earlier. It is caused by either a corrupted storage device, or anything else affecting file system.

Seatool for dos: SeaTools | Seagate download

• Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.
• You are using AHCI mode of storage controller. If you see that the Seatools for DOS is not detecting any HDD to test, enter into the BIOS. Change the storage controller mode to IDE/SATA, boot into seatools disc, and test it. When the testing is done, enter into BIOS again and set the controller mode back to AHCI, otherwise windows will refuse to boot.

Let us know the results.
______________________________________________________________

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800913f8b8, fffff8800913f110, fffff8800145028c}

Probably caused by : Ntfs.sys ( Ntfs!NtfsAcquireFcbWithPaging+12c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800913f8b8
Arg3: fffff8800913f110
Arg4: fffff8800145028c

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800913f8b8 -- (.exr 0xfffff8800913f8b8)
ExceptionAddress: fffff8800145028c (Ntfs!NtfsAcquireFcbWithPaging+0x000000000000012c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000058
Attempt to read from address 0000000000000058

CONTEXT:  fffff8800913f110 -- (.cxr 0xfffff8800913f110)
rax=0000000000000000 rbx=0000000000000003 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000002 rdi=fffffa8008c23e40
rip=fffff8800145028c rsp=fffff8800913faf0 rbp=0000000000000002
 r8=0000000000000000  r9=0000000000000002 r10=fffffa8008c23e40
r11=fffff8a00b89c312 r12=fffff8a00b837010 r13=00000000c00000d8
r14=0000000000000300 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
Ntfs!NtfsAcquireFcbWithPaging+0x12c:
fffff880`0145028c 488b4958        mov     rcx,qword ptr [rcx+58h] ds:002b:00000000`00000058=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000058

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c4100
GetUlongFromAddress: unable to read from fffff800030c41c0
 0000000000000058 Nonpaged pool

FOLLOWUP_IP: 
Ntfs!NtfsAcquireFcbWithPaging+12c
fffff880`0145028c 488b4958        mov     rcx,qword ptr [rcx+58h]

FAULTING_IP: 
Ntfs!NtfsAcquireFcbWithPaging+12c
fffff880`0145028c 488b4958        mov     rcx,qword ptr [rcx+58h]

BUGCHECK_STR:  0x24

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from fffff880014ea567 to fffff8800145028c

STACK_TEXT:  
fffff880`0913faf0 fffff880`014ea567 : 00000000`00000000 fffff8a0`0b837450 fffff8a0`0b89c3a6 00000000`00000000 : Ntfs!NtfsAcquireFcbWithPaging+0x12c
fffff880`0913fb50 fffff880`014e8dc2 : fffffa80`08c23e40 fffffa80`066e9350 fffff8a0`001da770 00000000`00000701 : Ntfs!NtfsFindPrefixHashEntry+0x44e
fffff880`0913fc80 fffff880`014e6701 : fffffa80`08c23e40 fffffa80`04792b80 fffff880`0913fe50 fffff880`0913fea0 : Ntfs!NtfsFindStartingNode+0x452
fffff880`0913fd50 fffff880`0145040d : fffffa80`08c23e40 fffffa80`04792b80 fffff880`06afda30 fffffa80`08906000 : Ntfs!NtfsCommonCreate+0x3e1
fffff880`0913ff30 fffff800`02e84677 : fffff880`06afd9a0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0913ff60 fffff800`02e84638 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27
fffff880`06afd870 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsAcquireFcbWithPaging+12c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5167f5fc

STACK_COMMAND:  .cxr 0xfffff8800913f110 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsAcquireFcbWithPaging+12c

BUCKET_ID:  X64_0x24_Ntfs!NtfsAcquireFcbWithPaging+12c

Followup: MachineOwner
---------

 

[StripyHorse]

Hi Arc,

I ran SeaTools last night and the drive passed. Something else happened, and it's probably unrelated - when I tried to access the BIOS to turn my HD back to ACHI I ended up with just a black screen. I had to Ctrl-Alt-Del out of it to reboot and it worked second time.

I'm going to be without my computer this weekend so it might take a few days for me to complete the next step.

 

[Arc]

Its ok Report back when you can.

And, as the computer booted properly, there is nothing to be worried.

 

[StripyHorse]

Hi again,

The hard drive passed SeaTools with no errors.

What should I try next?

Thanks

 

[Arc]

Thats good and relieving

Now, do two more things.

Get rid of intel rapid storage. First uninstall it from Control Panel > Programs and Features. Then Uninstall the driver from device manager.

1. Right click on "my computer" icon and click "manage" on the context menu.
2. It will open the "computer management" window.
3. Select "Device Manager" in the left pane, It will list all the existing devices up.
4. Expand "IDE ATA/ATAPI controllers" by clicking on the triangle in front of it.
5. Select one Intel device item under it, right click, uninstall.
6. Continue the process for all Intel items under "IDE ATA/ATAPI controllers"
7. Now restart the computer. At restart, windows will auto configure the appropriate native system driver.

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus, MSC and the touchpad driver, SynTP.
5. Apply > OK
6. Accept then restart.

Let us know the results.

If the BSOD occurs even after doing all those, we will accept the fact as a NTFS file system corruption. Formatting the HDD and reinstalling windows will be able to recover the corrupted file system on the disc. But dont go for it without consulting with us please.

 

[StripyHorse]

Thanks Arc, I've done all of that.

I didn't actually need to uninstall the driver from device manager - it had already gone after I uninstalled rapid storage.

The only exception that I left running at startup is IDrive, which I use for automated online backups of key data. If I get another BSOD I'll disable it and run the backups manually for a bit to see if that helps.

I'll let you know how it goes.