[SOLVED] Windows 7 System Random BSOD

blueelvis

blueelvis

BSOD Kernel Dump Senior Analyst
Joined
Apr 14, 2014
Posts
970
Location
India
Hi Everyone,

So, here I am with my sister's desktop doing constant random BSOD. The BSOD's occurred while installing the NVIDIA Drivers. Furthermore, this system has problems since ages and I have even changed the motherboard but there was no effect. Below is the SF Diagnostic folder consisting of the dump files. I have changed the power supply as well to a coolermaster 460w. Furthermore, the system runs extremely stable on bare minimum hardware i.e. 2-3 GB RAM and without the GPU. I am willing to get the required info for you for necessary analysis as well. Below is the SF Diagnostic Report.

View attachment PC-Sun_06_22_2014_191707_82.zip
 
Hi,

Three bug checks:

NTFS_FILE_SYSTEM (24)

This indicates a problem occurred in ntfs.sys, the driver file that allows the system to read and write to NTFS drives.

One possible cause of this bug check is disk corruption. Corruption in the NTFS file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the system's ability to read and write to disk, thus causing the error.

Another possible cause is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

Code: 
1: kd> .exr 0xfffff88005045388
ExceptionAddress: fffff8800129a999 ([COLOR=#4b0082]Ntfs!NtfsFullDeleteLcb+0x00000000000000a9[/COLOR])
   ExceptionCode: [COLOR=#ff0000]c0000005 (Access violation)[/COLOR]

Code: 
1: kd> k
Child-SP          RetAddr           Call Site
fffff880`05044398 fffff880`01213211 nt!KeBugCheckEx
fffff880`050443a0 fffff880`013049af Ntfs! ?? ::FNODOBFM::`string'+0x299d
fffff880`050443e0 fffff800`028fccdc Ntfs! ?? ::NNGAKEGL::`string'+0x850c
fffff880`05044430 fffff800`028fc75d nt!_C_specific_handler+0x8c
fffff880`050444a0 fffff800`028fb535 nt!RtlpExecuteHandlerForException+0xd
fffff880`050444d0 fffff800`0290c4c1 nt!RtlDispatchException+0x415
fffff880`05044bb0 fffff800`028d1242 nt!KiDispatchException+0x135
fffff880`05045250 fffff800`028cfb4a nt!KiExceptionDispatch+0xc2
fffff880`05045430 fffff880`0129a999 nt!KiGeneralProtectionFault+0x10a
fffff880`050455c0 fffff880`01216279 Ntfs!NtfsFullDeleteLcb+0xa9
fffff880`050455f0 fffff880`0129ba2c Ntfs!NtfsTeardownFromLcb+0x129
fffff880`05045680 fffff880`0121ea52 Ntfs!NtfsTeardownStructures+0xcc
fffff880`05045700 fffff880`012ab2d3 Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`05045740 fffff880`012b281c Ntfs!NtfsCommonClose+0x353
fffff880`05045810 fffff880`010a7bcf Ntfs!NtfsFsdClose+0x2dc
fffff880`05045910 fffff880`010a66df fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`050459a0 fffff800`02bcf3ce fltmgr!FltpDispatch+0xcf
fffff880`05045a00 fffff800`028dae54 nt!IopDeleteFile+0x11e
fffff880`05045a90 fffff800`02915c94 nt!ObfDereferenceObject+0xd4
fffff880`05045af0 fffff800`029164be nt!CcDeleteSharedCacheMap+0x224
fffff880`05045b50 fffff800`02916af8 nt!CcWriteBehind+0x54e
fffff880`05045c00 fffff800`028db261 nt!CcWorkerThread+0x1c8
fffff880`05045cb0 fffff800`02b6d73a nt!ExpWorkerThread+0x111
fffff880`05045d40 fffff800`028c28e6 nt!PspSystemThreadStartup+0x5a
fffff880`05045d80 00000000`00000000 nt!KxStartSystemThread+0x16

At the time of the crash, the NT File System driver is doing a teardown/deletion of the LCB.

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high. This bug check is usually caused by drivers that have used improper addresses.

Code: 
0: kd> k
Child-SP          RetAddr           Call Site
fffff880`06356f68 fffff800`02883169 nt!KeBugCheckEx
fffff880`06356f70 fffff800`02881de0 nt!KiBugCheckDispatch+0x69
fffff880`063570b0 fffff880`012f668c nt!KiPageFault+0x260
fffff880`06357248 fffff800`028aecdc Ntfs! ?? ::NNGAKEGL::`string'+0x6f60
fffff880`06357250 fffff800`028ae75d nt!_C_specific_handler+0x8c
fffff880`063572c0 fffff800`028ad535 nt!RtlpExecuteHandlerForException+0xd
fffff880`063572f0 fffff800`028be4c1 nt!RtlDispatchException+0x415
fffff880`063579d0 fffff800`02883242 nt!KiDispatchException+0x135
fffff880`06358070 fffff800`02881b4a nt!KiExceptionDispatch+0xc2
fffff880`06358250 fffff800`028c430e nt!KiGeneralProtectionFault+0x10a
fffff880`063583e0 fffff880`012872e7 nt!CcFlushCache+0x11e
fffff880`063584e0 fffff880`0127d137 Ntfs!NtfsFlushUserStream+0xb7
fffff880`06358560 fffff880`012207c8 Ntfs!NtfsFlushVolume+0x2a7
fffff880`06358690 fffff880`0120db9f Ntfs!NtfsVolumeDasdIo+0x1b8
fffff880`06358740 fffff880`0120f398 Ntfs!NtfsCommonRead+0x5bf
fffff880`063588b0 fffff880`0115abcf Ntfs!NtfsFsdRead+0x1b8
fffff880`06358960 fffff880`011596df fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`063589f0 fffff800`02b8dc3b fltmgr!FltpDispatch+0xcf
fffff880`06358a50 fffff800`02b6dd53 nt!IopSynchronousServiceTail+0xfb
fffff880`06358ac0 fffff800`02882e53 nt!NtReadFile+0x631
fffff880`06358bb0 00000000`74ad2e09 nt!KiSystemServiceCopyEnd+0x13
00000000`0862e958 00000000`00000000 0x74ad2e09

More NT File System stuff, flushing a volume/user stream at the time of the crash.

IRQL_NOT_LESS_OR_EQUAL (a)

This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.

This bug check is issued if paged memory (or invalid memory) is accessed when the IRQL is too high. The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS.


Remove and replace avast! with Microsoft Security Essentials for temporary troubleshooting purposes as it's likely causing file system conflicts:

avast! removal - avast! Uninstall Utility | Download aswClear for avast! Removal

MSE - Microsoft Security Essentials - Microsoft Windows

Regards,

Patrick
 
Hi Patrick,

I have uninstalled the Avast! Antivirus, during that process it gave me BSOD 2 times but now it is running stable atm. I even managed to install fully the NVIDIA Drivers. I will wait for some time before marking this solved and which means that the new PSU is working good. This machine has a history of BSOD of over 3 years btw :P
 
Whilst Patrick isn't here I'll see if I can be of some help.

Code: 
BugCheck 1A, {[COLOR=#ff0000]41287[/COLOR], [COLOR=#0000ff]0[/COLOR], 0, 0}

This bugcheck indicates an illegal page fault occurred, more specifically a null memory address was referenced.
This isn't allowed under any circumstances hence the illegal page fault.

I decided to look at the raw stack for any signs of driver issues.

Code: 
Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
 [COLOR=#ff0000]nvlddmkm+0xc7a4d[/COLOR]

Your Nvidia driver is causing problems, I've just had similar problems with my Nvidia drivers.

Except mine was a 0xD1 but it was using a null pointer.

I rolled back to 320.18 and so far that has worked so I recommend giving it a try.
 
Hi Jared,

Thanks for helping me out ^_^. I have implemented your advice and waiting if the crashes occur or not. Before following your advice, I got another BSOD APC_Index_Mismatch. I have attached the dump file. Furthermore, whenever I am trying to install some game, it is coming up as Setup files have become corrupted, even though I am sure they are not as they are working fine on another laptop.

View attachment Desktop.rar
 
Hi people, the system has no BSOD since the 2 days but all of my applications are crashing. Heck, even extracting from Winrar, it is saying that the file has become corrupt even though there is no problem with the same file on my laptop.

Any advices on this one?
 
There's a lot of memory corruption, have you run a Memtest yet just to be sure?

Not going to bother with the canned reply, you know the drill. I'd give it a run for no less than ~8 passes.
 
Patrick said:
There's a lot of memory corruption, have you run a Memtest yet just to be sure?

Not going to bother with the canned reply, you know the drill. I'd give it a run for no less than ~8 passes.
Click to expand...

Just updated the MBAM, it is doing it's scan now. I also tested for Rootkit using GMER and it did not find any violations. I have downloaded the Memtest and will be starting that soon. I think one of the Ram DIMM slots is damaged. But, lets see what happens.
 
MalwareBytes came clean. Just started the Memtest+ and in the first test itself, errors are there. I will try now the usual procedure on the RAM Swapping to detect the faulty module or slot and keep you guys updated ^_^
 
Patrick said:
Just started the Memtest+ and in the first test itself, errors are there.
Click to expand...

Ah-ha! Hopefully it's just a bad stick and not the board.
Click to expand...

Hi Patrick,

Sorry for the late reply. Just completed the memtest+ for the Kingston 2GB RAM and there were around 10 errors in the first 10 seconds on every slot of the Motherboard. I am running the other RAM's to see if the problem is still occurring or not and will report back ^_^.

Btw, this mobo has got 4 sockets for RAM and two of them are blue and two of them are black. Does this different colouring mean something?
 
The colours are the way channels work with RAM, I believe blue is Channel 1 and White is channel 2.
For better performance you should use the same channel unless you have 3+ sticks of ram.

But yes try the other RAM sticks, it sounds like bad RAM.
 
Jared said:
The colours are the way channels work with RAM, I believe blue is Channel 1 and White is channel 2.
For better performance you should use the same channel unless you have 3+ sticks of ram.

But yes try the other RAM sticks, it sounds like bad RAM.
Click to expand...
Since it is an old desktop, there are 3 sticks of 1GB each and I have tested the other RAM's on a single slot and they all are passing the tests. I will post back once I do some more testing and make sure that the system is not BSOD.
 
And the issue seems to be solved ^_^. Thanks for the help Jared and Patrick :D. I will mark this as solved. The system is now able to stay up without BSOD's. Btw, any idea how do these RAM chips fail? o.O
 
Glad to hear.

As with practically all hardware, it's pretty simple.

- Age; wears out from constantly contracting and expanding from heating up/cooling down. In a laptop scenario, this is much worse given everything is so compact and it's much warmer.

- Branching off above, heat and dust. Heat and dust are the #1 hardware/component killer (aside from over-voltage).

- ESD from a power surge and/or misuse when installing/reinstalling the DIMMs.

...etc
 
Hmm. The module which failed was a Kingston 2GB Module which is has been around 3 years I think. I would be getting it replaced with warranty if it is still applicable. The thing to wonder is that the pre-installed Hynix RAM is working absolutely fine and this turned out like this.

I have ordered a Corsair RAM for my laptop, would make sure to test it first using Memtest ^_^.
 
Back
Top