[SOLVED] BSOD Help Needed - Win 7

DarkRawr · 02-07-2010, 09:46 AM

Heya Guys,

I had a bluescreen on my PC last night and would like to know the cause of it, etc. Here are my details:

· OS - Windows 7
· x64
· Age of system - No more than 1 and a half years old
· Age of OS installation - October 1st 2009
· CPU - Intel Core 2 Quad Q9550 Socket 775 2.83GHz 1333FSB 12MB L2 Cache OEM Processor
· Video Card - Sapphire HD 4850 X2 2GB GDDR3 Quad DVI HDTV Out PCI-E Graphics Card
· MotherBoard - ASUS P5QL PRO iP43 Socket 775 8 channel audio ATX Motherboard
· Power Supply - brand & wattage - Corsair 750W TX PSU - 120mm Fan, 80+% Efficiency, Single +12V Rail

I have provided a zip file with the required reports, etc.

On a side note - I have recently copied over recovered files from a broken hard drive, onto my main windows boot drive. I literally copied everything across (so i can go through it and delete it, etc), even the windows folder. Is this a cause of anything, or bad to do? If so, ill get to deleting and cleaning up that old folder ASAP.

Many thanks.

**usasma** · 02-07-2010, 11:12 AM

Copying the Windows folder (and other system folders) isn't a bad thing to do - it's just not very useful and takes up space. If you're getting really low on hard drive space it may cause issues - but otherwise it should be OK.

Interestingly, there's 3 memory dumps (Oct 09; Nov 09; and Feb10) - and they're all essentially the same. This implies that they're related, which means to me that there's something that only goes on every couple of months that causes this (and finding it is gonna be mighty difficult!!!).

All the memory dumps are STOP 0xC2 and blame ntfs.sys - a component of the Windows storage sub-system.

So, let's start with this test:

Quote:

CHKDSK /R /F:
Run CHKDSK /R /F from an elevated (Run as adminstrator) Command Prompt.
When it tells you it can't do it right now - and asks you if you'd like to do it at the next reboot - answer Y (for Yes) and press Enter. Then reboot and let the test run. It may take a while for it to run, but keep an occasional eye on it to see if it generates any errors. See "CHKDSK LogFile" below in order to check the results of the test.

Elevated Command Prompt:
Go to Start and type in "cmd.exe" (without the quotes)
At the top of the Search Box, right click on Cmd.exe and select "Run as administrator"

CHKDSK LogFile:
Go to Start and type in "eventvwr.msc" (without the quotes) and press Enter
Expand the Windows logs heading, then select the Application log file entry.
Double click on the Source column header.
Scroll down the list until you find the Chkdsk entry (wininit for Win7) (winlogon for XP).
Copy/paste the results into your next post.

Then try these free diagnostic tests:

Quote:

H/W Diagnostics:
Please start by running these bootable hardware diagnostics:
http://www.carrona.org/memdiag.html (read the details at the link)
http://www.carrona.org/hddiag.html (read the details at the link)

Also, please run one of these free, independent online malware scans to ensure that your current protection hasn't been compromised: http://www.carrona.org/malware.html (read the details at the link)

Also, please remove these older drivers that were loaded at the time of the crash. Don't use Windows Update or the Update drivers function of Device Manager.
Please use the following instructions to locate the most currently available drivers to replace the one's that you uninstall OR remove:

Quote:

How To Find Drivers:
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- some driver links are on this page: http://www.carrona.org/drvrdown.html

Here's the older drivers. Please pay particular attention to any dated 2007 or earlier:

Code:

adfs.SYS     Thu Jun 26 16:52:37 2008 - Adobe File System filter driver
wacommousefilter.sys Fri Feb 16 13:12:17 2007 - Wacom(tablet) mouse filter driver
WacomVKHid.sys Thu Feb 15 18:10:54 2007 - Wacom(tablet) HID filter driver

Finally, because it's a memory pool error - please run Driver Verifier according to these instructions:

Quote:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line.

More info on this at this link: http://support.microsoft.com/?kbid=244617&sd=RMVP

Summary of the BSOD's:

Code:

Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Fri Oct 16 20:07:37.190 2009 (GMT-5)
System Uptime: 0 days 9:07:46.288
BugCheck C2, {7, 1097, 51a0303, fffff8a025ded980}
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonCreate+253e )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  System
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Fri Nov 13 06:47:17.017 2009 (GMT-5)
System Uptime: 4 days 23:58:35.904
BugCheck C2, {7, 1097, 5150401, fffff8a0132355d0}
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonCreate+253e )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  System
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Sun Feb  7 01:10:16.429 2010 (GMT-5)
System Uptime: 0 days 21:39:43.285
BugCheck C2, {7, 1097, 51a0307, fffff8a01baf3140}
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonCreate+253e )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  System

DarkRawr · 02-08-2010, 01:01 PM

Heya. Thanks for the reply and help, its great to know you can receive this quality of help around :) So thanks again.

Here are the results you asked for:

CHKDSK

Quote:

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
974336 file records processed. File verification completed.
120 large file records processed. 0 bad file records processed. 2 EA records processed. 44 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
1144390 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
974336 file SDs/SIDs processed. Cleaning up 17 unused index entries from index $SII of file 0x9.
Cleaning up 17 unused index entries from index $SDH of file 0x9.
Cleaning up 17 unused security descriptors.
Security descriptor verification completed.
85028 data files processed. CHKDSK is verifying Usn Journal...
35351800 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
974320 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
126651688 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.

976759807 KB total disk space.
468669140 KB in 844187 files.
377072 KB in 85029 indexes.
0 KB in bad sectors.
1106843 KB in use by the system.
65536 KB occupied by the log file.
506606752 KB available on disk.

4096 bytes in each allocation unit.
244189951 total allocation units on disk.
126651688 allocation units available on disk.

Internal Info:
00 de 0e 00 cb 2d 0e 00 0d c4 16 00 00 00 00 00 .....-..........
35 53 01 00 2c 00 00 00 00 00 00 00 00 00 00 00 5S..,...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

MemTest86

I ran it and left it over night. All passed OK.

HDD Diagnostic

This has been driving me crazy all day and is the reason I've taken so long to reply to you.
For some odd reason, the samsung utility doesn't find my HDD

and I tried everything, different versions, UltimateBootCD, etc, but nothing worked :(
Is this ok?

Malware Tests

I ran malwarebytes for a complete scan and I had 3 files infected which were from my old recovered files i was telling you about. As I said, I didn't even need them so I deleted it all anyways.
I also ran an online scan afterwards which stated I was clean.

Drivers

I had a dodgy copy (kept getting random errors) with my Adobe CS4, so I uninstalled it all and deleted the adfs.SYS file.
Do you think this was the cause of it? As I have researched the net and it seems other have had this problem.

I uninstalled and deleted the wacom software/drivers and have re-installed the software again from the wacom site.
All drivers seem to be good and working and the old copy of WacomVKHid.sys has officially gone.
However, wacommousefilter.sys driver, dated 2007 has installed again with the latest release I just installed, so surely this is ok?

----

Ok so now that i have done this, am i ok to stop and carry on with my computing life? :P I say this, as your last step seems a bit extreme and after seeing the results ect, do you think im ok now?

May thanks!

**DT Roberts** · 02-08-2010, 01:35 PM

It seems to be a hard drive problem most likely because all of the dumps point to Ntfs.sys. This is also from the system event log, and multiple times at that:

Code:

Event[4575]:
  Log Name: System
  Source: Ntfs
  Date: 2010-01-19T11:35:36.479
  Event ID: 55
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DarkSummon-PC
  Description: 
The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.

Event[5284]:
  Log Name: System
  Source: Ntfs
  Date: 2010-01-16T17:52:50.106
  Event ID: 55
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DarkSummon-PC
  Description: 
The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \Device\HarddiskVolume2.

Are you sure that your hard drive is a Samsung? You can check from the Device Manager (a link in my signature may help if you need it). Also, click Start>type Computer Management and select Disk Management. How drives are listed? Take a screenshot and attach it to your next post if possible. Finally, are/were there any USB flash drives or external hard drives connected to your computer?

DarkRawr · 02-08-2010, 01:51 PM

Orite! Hmm, that's not good then :(

Yes I am very sure I have a Samsung HDD as my main boot HDD. I have turned on my 2 external HDD's and took the required screenshots.

Yes I have 4 HDD's in total:

Samsung F1 - 1TB - Internal - [Windows/Boot Drive]
Western Digital - 500GB - Internal
Samsung F3 - 1TB - External
Samsung F1 - 1TB - External

Hope this information helps.

[Edit]
The forum made my last picture a bit small, so I've attached (hopefully) a better version of it :)

**jcgriff2** · 02-08-2010, 02:04 PM

Quote:

Originally Posted by DarkRawr

I have recently copied over recovered files from a broken hard drive, onto my main windows boot drive. I literally copied everything across (so i can go through it and delete it, etc), even the windows folder. Is this a cause of anything, or bad to do? If so, ill get to deleting and cleaning up that old folder ASAP.

Many thanks.

Re-install the OS onto the new hard drive.

Your 2 hard drives -

Code:

Description	Disk drive
Manufacturer	(Standard disk drives)
Model	SAMSUNG HD103UJ

Code:

Description	Disk drive
Manufacturer	(Standard disk drives)
Model	WDC WD5000AAKS-65YGA0

Regards. . .

jcgriff2

.

DarkRawr · 02-08-2010, 02:07 PM

Sorry, can you explain that a bit better?

Thanks for the quick response and help though :)

**DT Roberts** · 02-08-2010, 02:09 PM

Quote:

Originally Posted by DarkRawr

Orite! Hmm, that's not good then :(

Yes I am very sure I have a Samsung HDD as my main boot HDD. I have turned on my 2 external HDD's and took the required screenshots.

Yes I have 4 HDD's in total:

Samsung F1 - 1TB - Internal - [Windows/Boot Drive]
Western Digital - 500GB - Internal
Samsung F3 - 1TB - External
Samsung F1 - 1TB - External

The only way to ensure that the problems aren't hard drive-related would be to run chkdsk on them all, particularly that Western Digital drive.

DarkRawr · 02-08-2010, 02:18 PM

Right ok. I will do chkdsk on them all and report back. Just curious, but why did you say particularly the WD drive?

**DT Roberts** · 02-08-2010, 02:22 PM

Curiosity is a great thing.

If you look above, where I posted the errors from your system event logs:

Code:

Event[5284]:
  Log Name: System
  Source: Ntfs
  Date: 2010-01-16T17:52:50.106
  Event ID: 55
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DarkSummon-PC
  Description: 
The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume  \Device\HarddiskVolume2.

HarddiskVolume2 is most likely the second hard drive that the system found, which is most likely the Western Digital drive. I recommend you test that one first.

DarkRawr · 02-08-2010, 02:30 PM

Fair enough. I agree with you on that.

Ok, well I'm doing a chkdsk as we speak, so ill post back when it's done :)

**DT Roberts** · 02-08-2010, 02:32 PM

Forgot to mention, I think it's the WD drive because it is internal and the other two are not. Internal drives usually get enumerated first, therefore HarddiskVolume2 is most likely your secondary internal hard drive.

Looking forward to the results. Good luck.

DarkRawr · 02-08-2010, 04:41 PM

ah ok, well that makes sense.

Ok so the chkdsk has finally finished on my WD drive, here are the results:

Code:

Chkdsk was executed in read/write mode.  

Checking file system on D:
Volume dismounted.  All opened handles to this volume are now invalid.
Volume label is WD500GB.

CHKDSK is verifying files (stage 1 of 5)...
  359680 file records processed.                                          File verification completed.
  1 large file records processed.                                      0 bad file records processed.                                        0 EA records processed.                                              0 reparse records processed.                                       CHKDSK is verifying indexes (stage 2 of 5)...
  362438 index entries processed.                                         Index verification completed.


CHKDSK is verifying security descriptors (stage 3 of 5)...
  359680 file SDs/SIDs processed.                                         Cleaning up 67 unused index entries from index $SII of file 0x9.
Cleaning up 67 unused index entries from index $SDH of file 0x9.
Cleaning up 67 unused security descriptors.
Security descriptor verification completed.
  1380 data files processed.                                            CHKDSK is verifying Usn Journal...
  34656784 USN bytes processed.                                             Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
  359664 files processed.                                                 File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
  105740553 free clusters processed.                                         Free space verification is complete.
Windows has checked the file system and found no problems.

 488384000 KB total disk space.
  64937968 KB in 12058 files.
      9244 KB in 1381 indexes.
    474572 KB in use by the system.
     65536 KB occupied by the log file.
 422962216 KB available on disk.

      4096 bytes in each allocation unit.
 122096000 total allocation units on disk.
 105740554 allocation units available on disk.

So it seems its ok, yea?

**DT Roberts** · 02-08-2010, 04:53 PM

Yep, looks clean to me. I'm actually very surprised. You should definitely let it run the other two as well.

DarkRawr · 02-09-2010, 08:12 AM

Ok well the other 2 are being scanned so ill respond with those reports ASAP.

However, surely this has got nothing to do with those 2 drives, seeing as I just bought one of them like 2 weeks ago, and both of them are not turned on 98% of the time/when the crash happened.

Either way, ill post back soon.

DarkRawr · 02-09-2010, 11:44 AM

Ok, so the first out of the two external drives results are here:

Code:

Chkdsk was executed in read/write mode.  

Checking file system on I:
Volume label is SamsungF1 1TB.

CHKDSK is verifying files (stage 1 of 5)...
  127488 file records processed.                                          File verification completed.
  0 large file records processed.                                      0 bad file records processed.                                        0 EA records processed.                                              0 reparse records processed.                                       CHKDSK is verifying indexes (stage 2 of 5)...
  128002 index entries processed.                                         Index verification completed.


CHKDSK is verifying security descriptors (stage 3 of 5)...
  127488 file SDs/SIDs processed.                                         Cleaning up 28 unused index entries from index $SII of file 0x9.
Cleaning up 28 unused index entries from index $SDH of file 0x9.
Cleaning up 28 unused security descriptors.
Security descriptor verification completed.
  258 data files processed.                                            CHKDSK is verifying Usn Journal...
  9253744 USN bytes processed.                                             Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
  127472 files processed.                                                 File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
  15438019 free clusters processed.                                         Free space verification is complete.
Windows has checked the file system and found no problems.

 976759807 KB total disk space.
 914770428 KB in 4287 files.
      4816 KB in 259 indexes.
    232483 KB in use by the system.
     65536 KB occupied by the log file.
  61752080 KB available on disk.

      4096 bytes in each allocation unit.
 244189951 total allocation units on disk.
  15438020 allocation units available on disk.

Looks all good to me. I'll do the other one now just to be safe.

Any comments from you experts? I seem to be awaiting a couple of replies.

Thanks :)

**usasma** · 02-09-2010, 02:05 PM

You have hard drive issues - exactly what's causing them is uncertain at this time.
Chkdsk doesn't find any problems, even though Event Viewer says there are problems.
In particular, one of the errors points to C: yet chkdsk doesn't find issues on it.

Significant is the fact that you can't find your hard drives with the Samsung utility.
I'd suggest trying the Hitachi DFT and the Seagate Seatools for DOS to see if they can identify the hard drives.

Also, I'd post over in the PSU forums ( http://www.techsupportforum.com/f210/ ) in order to see if they think 750 watts is enough for 4 hard drives and 2 video cards.

Then, if the drives still aren't being recognized, I'd suggest disconnecting all but the OS drive and seeing if the test recognizes it. If it does, then test each of the drives individually.

What I'm thinking is that this is either a power problem, or that you're having issues with the hard drive controller on your motherboard.

Running Driver Verifier isn't essential at this point - but I'd keep it ready "just in case".
Just continue the attempts to test the hard drives and wait for the next BSOD to see what results we get.

DarkRawr · 02-10-2010, 08:41 AM

I managed to get the Seagate HDD utility to see my HDD's and scan them, easily. Both of them passed. So what does this mean, since every scan is saying pass?

Well this PSU got recommended to me when I bought all of my PC parts, so it should be fine. Also, my 2 external drives have their own power supply, so its really just 2 HDD's and 1 GFX card (with 2 GPUs) and from my own knowledge, that should be more than enough to power with 750w.

I'm not sure whether this is anything, but when starting up my PC a minute ago, Windows 7 Action Center asked to resolve a problem, I clicked ok and then it came back with this (see attachment 1). Is this referring to the 3 BSOD's, etc?

Do you need the 3 files that it shows (see attachment 2)?

Thanks.

**DT Roberts** · 02-10-2010, 11:46 AM

...Why is the timestamp on those files 7/02/2010? Yes, please upload them.

DarkRawr · 02-10-2010, 11:59 AM

Because that's when the blue screen happened..I'm confused why you ask. Or do you mean the format? Its the 7th of Feb 2010..

Ok here are the files :)

Our Communities

Automotive Communities

RV & Travel Trailer Communities

Marine Communities