Strange BSOD crash

[Kaiser]

Hello

I'm suffering from a strange bsod which occurs shortly after windows has loaded and the startup programs are loading on the start screen.

The strange thing is everything boots/pc works fine after I do a hard restart through the power supply. Without a hard restart the pc repeats it's cycle of bsods after each crash and restart.

I have included the dump files below, bluescreen view tells me it's caused by ntoskrnl.exe which is part of windows. I have tested the memory with memtest and get no errors though I'm going to test longer with more passes.

I've done a fresh install twice but get the same problem. I've been told I should install windows 7 (64) without having my secondary drives installed as this can cause a conflict initially.

Any help or a push in the right direction on how to solve this problem would be most appreciated.

Thanks

 

[CarlTR6]

Hi Kaiser and welcome to the forums. I am looking at the dmps now.

Two of the dumps are very similar with stop errors of 50. The other is a stop error A. All of these point to hardware issues.

STOP 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA

Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS

BSOD Index


STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL

Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

BSOD Index

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\Owner\Downloads\062010-18860-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a4b000 PsLoadedModuleList = 0xfffff800`02c88e50
Debug session time: Sun Jun 20 10:02:06.341 2010 (GMT-4)
System Uptime: 0 days 0:01:16.621

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa8084f0925c, 1, fffff8800121780c, 5}


Could not read faulting driver name
Probably caused by : Ntfs.sys ( Ntfs!NtfsDecrementCloseCounts+2c )

Followup: MachineOwner
---------

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa8084f0925c, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff8800121780c, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cf30e0
 fffffa8084f0925c 

FAULTING_IP: 
Ntfs!NtfsDecrementCloseCounts+2c
fffff880`0121780c f08380dc000000ff lock add dword ptr [rax+0DCh],0FFFFFFFFh

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88003185940 -- (.trap 0xfffff88003185940)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8084f09180 rbx=0000000000000000 rcx=fffffa800666b2e0
rdx=fffff8a001d0eba0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800121780c rsp=fffff88003185ad0 rbp=fffff80002c605a0
 r8=fffff8a001d0ee08  r9=0000000000000000 r10=fffff8a001d0ea70
r11=fffff88003185b52 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr ac po cy
Ntfs!NtfsDecrementCloseCounts+0x2c:
fffff880`0121780c f08380dc000000ff lock add dword ptr [rax+0DCh],0FFFFFFFFh ds:e560:fffffa80`84f0925c=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002b3a801 to fffff80002abb600

STACK_TEXT:  
fffff880`031857d8 fffff800`02b3a801 : 00000000`00000050 fffffa80`84f0925c 00000000`00000001 fffff880`03185940 : nt!KeBugCheckEx
fffff880`031857e0 fffff800`02ab96ee : 00000000`00000001 fffffa80`0666b2e0 fffff880`03185900 fffff880`0129c0b8 : nt! ?? ::FNODOBFM::`string'+0x40ecb
fffff880`03185940 fffff880`0121780c : fffffa80`0666b2e0 fffffa80`00000001 fffff8a0`01d0eba0 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`03185ad0 fffff880`012b0813 : fffffa80`0666b2e0 fffff800`02c605a0 fffff8a0`01d0ea70 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0x2c
fffff880`03185b10 fffff880`0128a38f : fffffa80`0666b2e0 fffff8a0`01d0eba0 fffff8a0`01d0ea70 fffffa80`04f09180 : Ntfs!NtfsCommonClose+0x353
fffff880`03185be0 fffff800`02ac8861 : 00000000`00000000 fffff800`02db8800 fffffa80`03d23601 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`03185cb0 fffff800`02d60a86 : 00049ee9`c000000d fffffa80`03d23680 00000000`00000080 fffffa80`03ced890 : nt!ExpWorkerThread+0x111
fffff880`03185d40 fffff800`02a99b06 : fffff880`02f63180 fffffa80`03d23680 fffff880`02f6dfc0 0003fbe9`30247c89 : nt!PspSystemThreadStartup+0x5a
fffff880`03185d80 00000000`00000000 : fffff880`03186000 fffff880`03180000 fffff880`031859f0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsDecrementCloseCounts+2c
fffff880`0121780c f08380dc000000ff lock add dword ptr [rax+0DCh],0FFFFFFFFh

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  Ntfs!NtfsDecrementCloseCounts+2c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

FAILURE_BUCKET_ID:  X64_0x50_Ntfs!NtfsDecrementCloseCounts+2c

BUCKET_ID:  X64_0x50_Ntfs!NtfsDecrementCloseCounts+2c

Followup: MachineOwner
---------

Mini Kernel Dump File: Only registers and stack trace are available

Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a01000 PsLoadedModuleList = 0xfffff800`02c3ee50
Debug session time: Tue Jun 22 08:47:25.942 2010 (GMT-4)
System Uptime: 0 days 0:01:07.848
Loading Kernel Symbols
...............................................................

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa8002e07010, 2, 1, fffff80002a876e1}

Probably caused by : memory_corruption ( nt!MmCreateKernelStack+e6 )

Followup: MachineOwner
---------

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa8002e07010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002a876e1, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ca90e0
 fffffa8002e07010 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MmCreateKernelStack+e6
fffff800`02a876e1 49891cd2        mov     qword ptr [r10+rdx*8],rbx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  TrustedInstall

TRAP_FRAME:  fffff88009506490 -- (.trap 0xfffff88009506490)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff980059db400 rbx=0000000000000000 rcx=0000000000000000
rdx=000000000000007c rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002d788f1 rsp=fffff88009506620 rbp=0000000000000000
 r8=0000000000000012  r9=0000000000000000 r10=00000000fffffff9
r11=0000000001f1b400 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po cy
nt!CcMapData+0x111:
fffff800`02d788f1 0fb600          movzx   eax,byte ptr [rax] ds:fffff980`059db400=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002a70b69 to fffff80002a71600

STACK_TEXT:  
fffff880`095056a8 fffff800`02a70b69 : 00000000`0000000a fffffa80`02e07010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`095056b0 fffff800`02a6f7e0 : 00000000`00000000 fffffa80`071bb691 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`095057f0 fffff800`02a876e1 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`04ead180 : nt!KiPageFault+0x260
fffff880`09505980 fffff800`02a80eb4 : fffff880`09505c00 fffffa80`071bb690 fffff880`09505f50 fffffa80`04cf2900 : nt!MmCreateKernelStack+0xe6
fffff880`09505a60 fffff880`01231b69 : fffff880`01233534 fffff880`09505b78 00000000`00001000 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0x244
fffff880`09505b40 fffff880`01231036 : fffffa80`04cf1d80 00000000`00000000 fffffa80`04cf2900 00000000`00000000 : Ntfs!NtfsMultipleAsync+0xa9
fffff880`09505bb0 fffff880`01234526 : fffff880`09505f50 fffffa80`073a0890 fffffa80`04cf2900 00000000`00000000 : Ntfs!NtfsNonCachedIo+0x216
fffff880`09505d80 fffff880`01236f78 : fffff880`09505f50 fffffa80`073a0890 fffff880`09506001 fffffa80`0739a001 : Ntfs!NtfsCommonRead+0x7a6
fffff880`09505f20 fffff880`00d8223f : fffffa80`073a0c30 fffffa80`073a0890 fffffa80`0739a010 00000000`00000001 : Ntfs!NtfsFsdRead+0x1b8
fffff880`09506120 fffff880`00d806df : fffffa80`04cff8e0 fffffa80`073a0890 fffffa80`04cff800 fffffa80`073a0890 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`095061b0 fffff800`02a630f2 : fffffa80`073a08b0 fffffa80`04cf5d50 00000000`00000043 fffff980`059db400 : fltmgr!FltpDispatch+0xcf
fffff880`09506210 fffff800`02a633f5 : fffff6fc`00100000 fffff6fc`00100000 fffff880`095062d0 fffff800`02d67c90 : nt!IoPageRead+0x252
fffff880`095062a0 fffff800`02a8c4a4 : 00000000`00000000 00000000`00000000 ffffffff`ffffffff fffff8a0`07452900 : nt!MiIssueHardFault+0x255
fffff880`09506330 fffff800`02a6f6ee : 00000000`00000000 00000000`0000000e 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0x11c4
fffff880`09506490 fffff800`02d788f1 : 00000000`03f00000 00000000`03f1b400 fffff880`095066e8 fffff880`095066e0 : nt!KiPageFault+0x16e
fffff880`09506620 fffff880`012e2522 : fffffa80`00024c00 fffffa80`03d556e0 fffff880`09506700 fffffa80`0000000e : nt!CcMapData+0x111
fffff880`095066e0 fffff880`012d84dc : fffffa80`06076e40 fffffa80`04ead180 fffff8a0`07458018 00000000`00000801 : Ntfs!NtfsReadMftRecord+0xb2
fffff880`09506790 fffff880`012a74aa : fffffa80`04eae858 fffff8a0`07458000 fffffa80`0569c800 00000000`00000000 : Ntfs!NtfsLookupInFileRecord+0x6c
fffff880`09506820 fffff880`012a9df2 : fffffa80`06076e40 fffff8a0`07458014 fffffa80`06076e40 fffff8a0`07458010 : Ntfs!NtfsUpdateFcbInfoFromDisk+0xaa
fffff880`09506970 fffff880`012cdb04 : fffff880`09445ad0 fffffa80`0569c800 fffffa80`06076e40 00000000`00000000 : Ntfs!NtfsOpenFile+0x2c6
fffff880`09506b50 fffff880`01236c0d : fffffa80`06076e40 fffffa80`0569c800 fffff880`09445ad0 fffffa80`071bb600 : Ntfs!NtfsCommonCreate+0xc54
fffff880`09506d30 fffff800`02a69487 : fffff880`09445a40 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`09506d60 fffff800`02a69441 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27
fffff880`09445910 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MmCreateKernelStack+e6
fffff800`02a876e1 49891cd2        mov     qword ptr [r10+rdx*8],rbx

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MmCreateKernelStack+e6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MmCreateKernelStack+e6

BUCKET_ID:  X64_0xA_nt!MmCreateKernelStack+e6

Followup: MachineOwner
---------

 

[JMH]

Hello

I'm suffering from a strange bsod which occurs shortly after windows has loaded and the startup programs are loading on the start screen.

The strange thing is everything boots/pc works fine after I do a hard restart through the power supply. Without a hard restart the pc repeats it's cycle of bsods after each crash and restart.

I have included the dump files below, bluescreen view tells me it's caused by ntoskrnl.exe which is part of windows. I have tested the memory with memtest and get no errors though I'm going to test longer with more passes.

I've done a fresh install twice but get the same problem. I've been told I should install windows 7 (64) without having my secondary drives installed as this can cause a conflict initially.

Any help or a push in the right direction on how to solve this problem would be most appreciated.

Thanks

Hi Kaiser and welocme

These three crashes appear to have 2 different causes but both relate back to memory. In one memory was the direct cause. In the other two win OS files were implicated. I believe the debugger just pointed incorrectly to the OS. The usual cause of the last two are
Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS

Because memory was listed as one of the usual causes I would run memtest for at least 7 passes

In the interim I would also run a system file check to verify and repair any OS problems.


Let us know if you need assistance

Jan

Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Tue Jun 22 08:47:25.942 2010 (GMT-4)
System Uptime: 0 days 0:01:07.848
BugCheck A, {fffffa8002e07010, 2, 1, fffff80002a876e1}
Probably caused by : memory_corruption ( nt!MmCreateKernelStack+e6 )
BUGCHECK_STR:  0xA
PROCESS_NAME:  TrustedInstall
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Mon Jun 21 08:23:09.997 2010 (GMT-4)
System Uptime: 0 days 0:00:49.902
BugCheck 50, {fffff8a0827a8a30, 0, fffff880012f4173, 5}
Probably caused by : Ntfs.sys ( Ntfs!NtfsFcbTableCompare+3 )
BUGCHECK_STR:  0x50
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sun Jun 20 10:02:06.341 2010 (GMT-4)
System Uptime: 0 days 0:01:16.621
BugCheck 50, {fffffa8084f0925c, 1, fffff8800121780c, 5}
Probably caused by : Ntfs.sys ( Ntfs!NtfsDecrementCloseCounts+2c )
BUGCHECK_STR:  0x50
PROCESS_NAME:  System

 

[CarlTR6]

You have one very old driver that can well be causing problems. it is a know cause of BSOD's:

ASACPI.sys Mar 27 2005

After you test your memory as JMH suggested, update this Asus driver and reboot. You may find your problem is solved. Try this link - Asus Support - ASUSTeK Computer Inc.-Support-

Please post back with the results of the memory test and with your results after you update this driver.

 

[Jonathan_King]

I suspect the problem is with ASACPI.sys. Please read this post for instructions on updating it: http://www.sevenforums.com/787431-post2.html

ASACPI.sys   Sun Mar 27 22:30:36 2005

EDIT: Sorry Carl, I left the tab open and posted w/o refreshing.

 

[CarlTR6]

No problem, Jonathan; I did the same thing to Jan.

 

[zigzag3143]

And I was about to do the same thing to you both nice teamwork

 

[CarlTR6]

Thank you, ZigZag. It is nice to see that we are all on the same page.

 

[Kaiser]

Hi

I ran system file check and it repaired what files it could and provided a list of one's it couldn't.

Ran memtest for 7 passes which gave no errors, I replaced ASACPI.sys with the updated version.

So I booted today and It seemed to get rid of the bsod i was suffering at startup, though a few startup programs did not load and shutdown. (Java and Steam).
Unfortunately after a hour or so I suffered another BSOD, after restart windows automatically ran CHKDSK which repaired a few files, after windows loaded I ran into a host of errors, windows explorer stopped working/shutdown, ATI catalyst etc...

Bluescreen showed the bsod to be Memory Management so I ran memtest without doing a hard restart from the power supply and this time I received red errors. So I'm back to doing to doing a hard restart from the PS to get the PC working in a usable state. I have included the latest dump below, I think my next step is to return my memory to the vendor.

I don't get why after a hard restart everything seems rock stable/loads/no errors, it's only after I shutdown for the day and cold boot the following day do I get problems. I will do another round of memtest to see if I get errors after a hard restart following the earlier errors.

Thanks

Kaiser

 

[Jonathan_King]

Try shutting down your computer, leaving it off for several hours, and then immediately running Memtest on it.

You may try increasing your RAM voltage slightly.