User Tag List

bsod problem

This is a discussion on bsod problem within the BSOD, App Crashes And Hangs forums, part of the Tech Support Forum category. i hope this works i attached the file in a zip folder as per instruction


Closed Thread
 
Thread Tools Search this Thread
Old 03-31-2011, 07:30 PM   #1
Registered Member
 
Join Date: Mar 2011
Posts: 2
OS: windows vista service pack 1



i hope this works i attached the file in a zip folder as per instruction
Attached Files
File Type: zip Windows7_Vista_jcgriff2.zip (1.11 MB, 41 views)
kamish4 is offline  
Sponsored Links
Advertisement
 
Old 04-01-2011, 07:15 AM   #2
TSF Enthusiast
 
Join Date: Jun 2010
Posts: 2,210
OS: Windows 7 SP1



Good news/bad news time. Good news is you got a crash dump that blatantly says it's a hardware problem. The bad news is, well, it's a hardware problem.

The behavior of this, however, is original to me. The first thing I'll want to regard as being problematic is memory, since of a lot of it seems to point to that as cause. You may wanna do some testing with Memtest86+ (run full tests overnight, at least 7 passes total). I'm confident you got a region of memory on one of your sticks of RAM that just puttered out. Since this relates to a system file, you may wanna check the memory sticks on the last one/two slots in your motherboard. Those surely will have the problems.


Analysts:

The older two crashdumps aren't very unusual. However, the newest one (dated "Thu Mar 31 21:27:58.156 2011") shows up something peculiar:



NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001904aa
Arg2: a5f50a90
Arg3: a5f5078c
Arg4: 89a990f2

Debugging Details:
------------------


EXCEPTION_RECORD: a5f50a90 -- (.exr 0xffffffffa5f50a90)
ExceptionAddress: 89a990f2 (Ntfs!NtfsLockHashBucket+0x00000017)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 67398db0
Attempt to write to address 67398db0

CONTEXT: a5f5078c -- (.cxr 0xffffffffa5f5078c)
eax=a5f50bb4 ebx=00000e69 ecx=000003b4 edx=864867c8 esi=a5e86324 edi=a5f50c8c
eip=89a990f2 esp=a5f50b58 ebp=a5f50b5c iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
Ntfs!NtfsLockHashBucket+0x17:
89a990f2 56 push esi
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: CODE_CORRUPTION

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1: 00000001

EXCEPTION_PARAMETER2: 67398db0

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 81f6f868
Unable to read MiSystemVaType memory at 81f4f420
67398db0

FOLLOWUP_IP:
Ntfs!NtfsLockHashBucket+17
89a990f2 56 push esi

FAULTING_IP:
Ntfs!NtfsLockHashBucket+17
89a990f2 56 push esi

BUGCHECK_STR: 0x24

EXCEPTION_DOESNOT_MATCH_CODE: This indicates a hardware error.
Instruction at 89a990f2 does not read/write to 67398db0

LAST_CONTROL_TRANSFER: from 89a98ca2 to 89a990f2

STACK_TEXT:
a5f50b5c 89a98ca2 864867c8 00000e69 a5f50b7c Ntfs!NtfsLockHashBucket+0x17
a5f50bb4 89a97c20 849fa008 864867c8 8bf3bd08 Ntfs!NtfsFindPrefixHashEntry+0x12b
a5f50c10 89a9667f 849fa008 847b27a8 8bf3bd08 Ntfs!NtfsFindStartingNode+0x73b
a5f50cec 89a1c2aa 849fa008 847b27a8 a5e86324 Ntfs!NtfsCommonCreate+0x620
a5f50d2c 81ef12e8 a5e862bc 00000000 ffffffff Ntfs!NtfsCommonCreateCallout+0x20
a5f50d2c 81ef13e1 a5e862bc 00000000 ffffffff nt!KiSwapKernelStackAndExit+0x118
a5e8624c 00000000 00000000 00000000 00000000 nt!KiSwitchKernelStackAndCallout+0x31


CHKIMG_EXTENSION: !chkimg -lo 50 -db !Ntfs
57 errors : !Ntfs (89a99202-89a9943a)
89a99200 55 0c *00 da 1b d2 83 e2 08 83 *00 04 23 c2 74 1f U...........#.t.
89a99210 66 83 *00 3a 74 19 66 83 fb 5c *00 13 66 83 fb 2e f..:t.f..\..f...
89a99220 74 04 *00 45 fe 00 47 46 46 3b *00 72 b5 eb 04 c6 t..E..GFF;.r....
89a99230 45 ff 00 80 7d fe 00 5e 5b 74 *00 83 f9 01 74 05 E...}..^[t....t.
89a99240 83 f9 *00 75 04 c6 45 ff 00 8a *00 ff 5f c9 c2 08 ...u..E....._...
89a99250 00 90 *00 90 90 90 6a 58 68 f8 *00 a3 89 e8 66 ca ......jXh.....f.
89a99260 f7 ff *00 45 e7 00 33 f6 89 75 *00 89 75 d8 89 75 ...E..3..u..u..u
89a99270 d0 39 *00 24 75 06 8d 45 e6 89 *00 24 8b 45 14 89 .9.$u..E...$.E..
89a99280 45 a4 *00 45 18 89 45 a8 33 ff *00 7d e0 8b 45 0c E..E..E.3..}..E.
89a99290 05 a8 *00 00 00 89 45 d4 8d 4d *00 51 8d 4d c8 51 ......E..M.Q.M.Q
89a992a0 8d 4d *00 51 50 ff 15 8c 93 a3 *00 3b c6 0f 84 a1 .M.QP......;....
89a992b0 00 00 00 8b 78 08 89 7d e0 f6 *00 04 01 74 2f 8b ....x..}.....t/.
89a992c0 47 08 *00 45 98 8b 47 0c 89 45 *00 8d 45 98 50 8b G..E..G..E..E.P.
89a992d0 47 38 *00 a8 02 00 00 50 ff 15 *00 95 a3 89 83 67 G8.....P.......g
89a992e0 04 bf *00 45 e7 01 89 75 e0 8b *00 10 eb 71 8b 45 ...E...u.....q.E
89a992f0 24 c6 00 01 8b 5d 10 3b de 74 *00 39 b7 d8 00 00 $....].;.t.9....
89a99300 00 75 *00 8d 43 30 33 c9 41 f0 *00 c1 08 8d 43 14 .u..C03.A.....C.
89a99310 33 c9 *00 f0 0f c1 08 39 b7 d8 00 00 00 74 2d 8b 3......9.....t-.
89a99320 87 d8 00 00 00 83 c0 14 83 c9 *00 f0 0f c1 08 8b ................
89a99330 87 d8 00 00 00 83 c0 30 83 c9 *00 f0 0f c1 08 75 .......0.......u
89a99340 0b ff *00 d8 00 00 00 e8 38 1d *00 00 89 9f d8 00 ........8.......
89a99350 00 00 *00 03 8b 5d 10 3b fe 0f *00 5c 02 00 00 8b .....].;...\....
89a99360 45 24 *00 00 00 89 75 fc 33 c0 *00 89 45 24 80 7d E$....u.3...E$.}
89a99370 1c 00 *00 77 39 45 14 76 72 83 *00 14 08 74 6c 83 ...w9E.vr....tl.
89a99380 7d 14 *00 74 66 80 7d 20 00 74 *00 68 c0 5c a4 89 }..tf.} .t.h.\..
89a99390 e8 36 *00 f8 ff 8b f0 89 75 dc *00 fe 89 7d e0 68 .6......u....}.h
89a993a0 e8 03 00 00 6a 00 56 e8 21 ce *00 ff 83 c4 0c 81 ....j.V.!.......
...
89a993c0 e8 06 *00 f8 ff 8b f0 89 75 dc *00 fe 89 7d e0 68 ........u....}.h
89a993d0 70 03 00 00 6a 00 56 e8 f1 cd *00 ff 83 c4 0c 81 p...j.V.........
...
89a993f0 68 f0 00 00 00 6a 10 ff 15 f0 *00 a3 89 8b f0 89 h....j..........
89a99400 75 dc *00 fe 89 7d e0 68 f0 00 00 00 6a 00 56 e8 u....}.h....j.V.
89a99410 b9 cd *00 ff 83 c4 0c 80 7d 1c 00 74 4b 8b 45 0c ........}..tK.E.
89a99420 f7 40 *00 00 00 00 02 74 34 a0 *00 4c a4 89 84 c0 [email protected]
89a99430 74 14 *00 7c 07 00 00 68 36 6d *00 89 68 a2 00 00 t..|...h6m..h...

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: STRIDE

STACK_COMMAND: .cxr 0xffffffffa5f5078c ; kb

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_STRIDE

BUCKET_ID: MEMORY_CORRUPTION_STRIDE

Followup: memory_corruption
---------

1: kd> !chkimg -d !Ntfs
89a99202 - Ntfs!NtfsIsFileNameValid+4e
[ f6:00 ]
89a9920a - Ntfs!NtfsIsFileNameValid+56 (+0x08)
[ ca:00 ]
89a99212 - Ntfs!NtfsIsFileNameValid+5e (+0x08)
[ fb:00 ]
89a9921a - Ntfs!NtfsIsFileNameValid+66 (+0x08)
[ 74:00 ]
89a99222 - Ntfs!NtfsIsFileNameValid+6e (+0x08)
[ c6:00 ]
89a9922a - Ntfs!NtfsIsFileNameValid+76 (+0x08)
[ f9:00 ]
89a9923a - Ntfs!NtfsIsFileNameValid+86 (+0x10)
[ 0e:00 ]
89a99242 - Ntfs!NtfsIsFileNameValid+8e (+0x08)
[ 02:00 ]
89a9924a - Ntfs!NtfsIsFileNameValid+96 (+0x08)
[ 45:00 ]
89a99252 - Ntfs!NtfsIsFileNameValid+9e (+0x08)
[ 90:00 ]
89a9925a - Ntfs!NtfsCreateFcb+4 (+0x08)
[ d7:00 ]
89a99262 - Ntfs!NtfsCreateFcb+c (+0x08)
[ c6:00 ]
89a9926a - Ntfs!NtfsCreateFcb+14 (+0x08)
[ dc:00 ]
89a99272 - Ntfs!NtfsCreateFcb+1c (+0x08)
[ 75:00 ]
89a9927a - Ntfs!NtfsCreateFcb+24 (+0x08)
[ 45:00 ]
89a99282 - Ntfs!NtfsCreateFcb+2c (+0x08)
[ 8b:00 ]
89a9928a - Ntfs!NtfsCreateFcb+34 (+0x08)
[ 89:00 ]
89a99292 - Ntfs!NtfsCreateFcb+3c (+0x08)
[ 02:00 ]
89a9929a - Ntfs!NtfsCreateFcb+44 (+0x08)
[ cc:00 ]
89a992a2 - Ntfs!NtfsCreateFcb+4c (+0x08)
[ a4:00 ]
89a992aa - Ntfs!NtfsCreateFcb+54 (+0x08)
[ 89:00 ]
89a992ba - Ntfs!NtfsCreateFcb+64 (+0x10)
[ 47:00 ]
89a992c2 - Ntfs!NtfsCreateFcb+6c (+0x08)
[ 89:00 ]
89a992ca - Ntfs!NtfsCreateFcb+74 (+0x08)
[ 9c:00 ]
89a992d2 - Ntfs!NtfsCreateFcb+7c (+0x08)
[ 05:00 ]
89a992da - Ntfs!NtfsCreateFcb+84 (+0x08)
[ b0:00 ]
89a992e2 - Ntfs!NtfsCreateFcb+8c (+0x08)
[ c6:00 ]
89a992ea - Ntfs!NtfsCreateFcb+94 (+0x08)
[ 5d:00 ]
89a992fa - Ntfs!NtfsCreateFcb+a4 (+0x10)
[ 5c:00 ]
89a99302 - Ntfs!NtfsCreateFcb+ac (+0x08)
[ 54:00 ]
89a9930a - Ntfs!NtfsCreateFcb+b4 (+0x08)
[ 0f:00 ]
89a99312 - Ntfs!NtfsCreateFcb+bc (+0x08)
[ 41:00 ]
89a9932a - Ntfs!NtfsCreateFcb+d4 (+0x18)
[ ff:00 ]
89a9933a - Ntfs!NtfsCreateFcb+e4 (+0x10)
[ ff:00 ]
89a99342 - Ntfs!NtfsCreateFcb+ec (+0x08)
[ b7:00 ]
89a9934a - Ntfs!NtfsCreateFcb+f4 (+0x08)
[ 04:00 ]
89a99352 - Ntfs!NtfsCreateFcb+fc (+0x08)
[ eb:00 ]
89a9935a - Ntfs!NtfsCreateFcb+104 (+0x08)
[ 85:00 ]
89a99362 - Ntfs!NtfsCreateFcb+10c (+0x08)
[ c6:00 ]
89a9936a - Ntfs!NtfsCreateFcb+114 (+0x08)
[ 40:00 ]
89a99372 - Ntfs!NtfsCreateFcb+11c (+0x08)
[ 75:00 ]
89a9937a - Ntfs!NtfsCreateFcb+124 (+0x08)
[ 7d:00 ]
89a99382 - Ntfs!NtfsCreateFcb+12c (+0x08)
[ 06:00 ]
89a9938a - Ntfs!NtfsCreateFcb+134 (+0x08)
[ 30:00 ]
89a99392 - Ntfs!NtfsCreateFcb+13c (+0x08)
[ 2b:00 ]
89a9939a - Ntfs!NtfsCreateFcb+144 (+0x08)
[ 8b:00 ]
89a993aa - Ntfs!NtfsCreateFcb+154 (+0x10)
[ f7:00 ]
89a993c2 - Ntfs!NtfsCreateFcb+16c (+0x18)
[ 2b:00 ]
89a993ca - Ntfs!NtfsCreateFcb+174 (+0x08)
[ 8b:00 ]
89a993da - Ntfs!NtfsCreateFcb+184 (+0x10)
[ f7:00 ]
89a993fa - Ntfs!NtfsCreateFcb+1a4 (+0x20)
[ 95:00 ]
89a99402 - Ntfs!NtfsCreateFcb+1ac (+0x08)
[ 8b:00 ]
89a99412 - Ntfs!NtfsCreateFcb+1bc (+0x10)
[ f7:00 ]
89a99422 - Ntfs!NtfsCreateFcb+1cc (+0x10)
[ 04:00 ]
89a9942a - Ntfs!NtfsCreateFcb+1d4 (+0x08)
[ 04:00 ]
89a99432 - Ntfs!NtfsCreateFcb+1dc (+0x08)
[ 68:00 ]
89a9943a - Ntfs!NtfsCreateFcb+1e4 (+0x08)
[ ab:00 ]
57 errors : !Ntfs (89a99202-89a9943a)





This shows that an executable image got corrupted. It's a system file (Ntfs.sys) that got messed up midway during execution. While I've seen a couple corrupted bytes here and there (and maybe even a string of bytes overwritten) in past experiences with this kind of thing, I've not quite seen a long band of zeroed out code that stretches downwards.

From a bit of research, I realized this is what's called a "stride" pattern of memory corruption. It means a contiguous region of memory physically went kaput. Notice also the bucket ids:

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_STRIDE

BUCKET_ID: MEMORY_CORRUPTION_STRIDE
VirGnarus is offline  
Old 04-01-2011, 08:03 AM   #3
TSF-Emeritus
 
Ninjaboi's Avatar
 
Join Date: Dec 2010
Location: Washington State, U.S.A.
Posts: 2,055
OS: Windows 7

My System


Quote:
MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: STRIDE

STACK_COMMAND: .cxr 0xffffffffa5f5078c ; kb

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_STRIDE

BUCKET_ID: MEMORY_CORRUPTION_STRIDE

Followup: memory_corruption
Quote:
EXCEPTION_DOESNOT_MATCH_CODE: This indicates a hardware error.
Instruction at 89a990f2 does not read/write to 67398db0

Quote:
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 81f6f868
Unable to read MiSystemVaType memory at 81f4f420
67398db0
Bolding and underlining the key points, it's obvious that what Vir said sounds reasonable. If anything else I could add to the argument, it may point to hardware problems instead of a simple .exe issue. Check that your RAM is running correctly ( try running a memory diagnostic ).
__________________
Ninjaboi is offline  
Sponsored Links
Advertisement
 
Old 04-01-2011, 08:18 AM   #4
TSF Enthusiast
 
Join Date: Jun 2010
Posts: 2,210
OS: Windows 7 SP1



To those who don't know !chkimg output, bytes with asterisks in "!chkimg -db" output are the corrupted bytes. Note the stride runs down the length of the Ntfs module. The "!chkimg -d" output displays two lines per item: first line is location, with memory address, module location and in parentheses displays position from last corrupted byte (notice in this case they're almost all 0x8). Second line is bracketed and displays the byte value it was supposed to see (left) and the byte value it actually saw (right; the corrupted one).
VirGnarus is offline  
Closed Thread

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Similar Threads
Thread Thread Starter Forum Replies Last Post
HELP! BSOD problem with windows 7 64 bit
Hello, I have clean installed windows 7 ultimate 64 bit to my laptop and since then I have many problems with blue screens of death. I tried to debug some of the minidump files saved at the windows/minidump using windows debugger and I managed to solve some of the issues with my laptop. ...
kostas84 BSOD, App Crashes And Hangs 23 03-31-2011 06:39 AM
Bsod problem
Hey all. Am not sure if this is the right place for this but can't find the right area. Ok my computer has just started playing up. I was watching BBC iplayer and it froze up and got the bsod. I tried it again and it loaded but as I tried watching it again I got a second bsod. Now the third time...
Psyconn Motherboards, Bios & CPU 3 02-12-2011 06:24 AM
BSOD - please help - files attached [Moved from Vista/7]
I have had the computer below for 2 weeks OS Version: Microsoft Windows 7 Professional , 32 bit Processor: Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz, x64 Family 6 Model 23 Stepping 10 Processor Count: 2 RAM: 2046 Mb Graphics Card: NVIDIA GeForce GT 220, 1024 Mb Hard Drives: C: Total...
TajDan BSOD, App Crashes And Hangs 11 02-07-2011 03:46 PM
Problem after problem, xp repair install
OS: XP Pro GPU: Asus Radeon HD 3850 CPU: AMD Athlon 64 X2 5000+ 2.6GHz Dual-Core Black Edition Processor MoBo: Foxconn A7GM-S RAM: OCZ SLI 2GB (X1) DDR2 800 SDRAM 2.1V; Crucial Ballistix Tracer 2GB (2 x 1GB) DDR2 800 SDRAM 2.2V. (btw just noticed they run dif timing doh) Power Supply: RAIDMAX...
komayaka Windows XP Support 2 01-25-2011 03:22 PM
I have encountered a problem that I can't troubleshoot. WEIRD BSOD
Hello. I will explain to you the troubleshooting steps after the problem. My computer will do one of four things at random. It will either freeze completely, requiring a physical shut down(holding in the button for 5 seconds,) or it will give me a MEMORY_MANAGEMENT BSOD, or a video driver BSOD, or...
diakonstero BSOD, App Crashes And Hangs 5 01-17-2011 11:59 PM

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Post a Question


» Site Navigation
 > FAQ
  > 10.0.0.2
Powered by vBadvanced CMPS v3.2.3


All times are GMT -7. The time now is 09:32 AM.


Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
vBulletin Security provided by vBSecurity v2.2.2 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
User Alert System provided by Advanced User Tagging v3.1.0 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
Copyright 2001 - 2018, Tech Support Forum

Windows 10 - Windows 7 - Windows XP - Windows Vista - Trojan Removal - Spyware Removal - Virus Removal - Networking - Security - Top Web Hosts