Windows 7 Help Needed: Frequent BSOD Issues on Windows 7 with ntfs.sys and ntoskrnl.exe Errors

[TerryWood]

Hi Windows 7 Forum

I am a brand new member and this my first post. I am not overly technical but I can follow instructions.

My Problem is that over many months I have been experiencing BSODs, occurring when I install either software or Windows Updates or just booting up. Even a BSD by clicking on Libre Office.

The last few BSODs have centred on ntfs.sys+91865 and ntoskrnl.exe+6fb29 as an example

I have as far as I am aware updated all my drivers.

I have scanned in safe mode with MBAM for viuses (None) Also for Rootkits with TDSS (None)

HP has a Support Assistant Software enabling Memory, Hard Drive and Graphic Card Stress Testing. None have shown a problem

My PC "Terry" is an HP Pavilion Slimline s5325uk with Windows 7 64bit on board (Two years old this coming July)

2 Core i3 CPU 530 @2.93GHZ

I have 4gb Ram 2x2048 MB DDR3-SDRAM (1333MHZ)

Logical cpus=4

Nvidia Gforce G210 Graphics Card

4xDIMM slots

Motherboard

Manufacturer MSI
Product Iona
Vendor American Megatrends

I Have two external USB Hard Drives attached for backup of 1.0GB and 1.5GB


Security Software

Comodo Firewall+Dplus both in Safe Mode

Antivirus is Microsoft Security Essentials (Was Avast Home Free but I removed it to see if it was causing the problems)

Shadow Defender

Sandboxie Free

MBAM Free

Superantispyware

Keyscrambler

TDSS


Browsers

Main = Portable Google Chrome 17.0.963.46

Secondary Firefox 10.0.2

Hope You can shed some light on the problem

Thank you

Terry

 

[TerryWood]

Hi Windows 7 ForumsI was wondering if there was the possibility of a reply, or if there is something wrong with the presentation of my problem, could someone suggest how I might improve it.Thank youTerry

 

[Trouble]

Hi Windows 7 ForumsI was wondering if there was the possibility of a reply

Sure I'll give it a go and see how things go.
DUMP FILE:

BugCheck 3B, {c0000005, fffff8000368f7a5, fffff880087b7450, 0}
Unable to load image \SystemRoot\SYSTEM32\drivers\[U][B]diskpt.sys[/B][/U], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [U][B]diskpt.sys[/B][/U]
*** ERROR: Module load completed but symbols could not be loaded for [U][B]diskpt.sys[/B][/U]
[U][B]Probably caused by : diskpt.sys[/B][/U] ( diskpt+17cac )
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8000368f7a5, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff880087b7450, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP: 
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`0368f7a5 498b08          mov     rcx,qword ptr [r8]
CONTEXT:  fffff880087b7450 -- (.cxr 0xfffff880087b7450)
rax=00000065dcc90001 rbx=fffff880087b7e98 rcx=fffff88000c1b680
rdx=a4fff8a00bb9d941 rsi=fffff8a00155ffc0 rdi=fffffa80044d6af0
rip=fffff8000368f7a5 rsp=fffff880087b7e20 rbp=fffffa8004879d60
 r8=a4fff8a00bb9d940  r9=0000000000000727 r10=fffff88000c1b680
r11=0000000000000000 r12=0000000080000000 r13=fffff8a00c9a4bc0
r14=0000000000000001 r15=fffffa80044d6fb0
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
nt!ExpInterlockedPopEntrySListFault16:
fffff800`0368f7a5 498b08          mov     rcx,qword ptr [r8] ds:002b:a4fff8a0`0bb9d940=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x3B
PROCESS_NAME:  chrome.exe
CURRENT_IRQL:  0
LAST_CONTROL_TRANSFER:  from fffff88000c17cac to fffff8000368f7a5
STACK_TEXT:  
fffff880`087b7e20 fffff880`00c17cac : 00000000`08060000 fffff880`087b7e38 fffff8a0`0c9a4bc0 fffff8a0`02eb67e0 : nt!ExpInterlockedPopEntrySListFault16
fffff880`087b7e30 00000000`08060000 : fffff880`087b7e38 fffff8a0`0c9a4bc0 fffff8a0`02eb67e0 fffffa80`044d6af0 :[U][B] diskpt[/B][/U]+0x17cac
fffff880`087b7e38 fffff880`087b7e38 : fffff8a0`0c9a4bc0 fffff8a0`02eb67e0 fffffa80`044d6af0 fffff880`00c0d0c0 : 0x8060000
fffff880`087b7e40 fffff8a0`0c9a4bc0 : fffff8a0`02eb67e0 fffffa80`044d6af0 fffff880`00c0d0c0 fffff880`00c1b680 : 0xfffff880`087b7e38
fffff880`087b7e48 fffff8a0`02eb67e0 : fffffa80`044d6af0 fffff880`00c0d0c0 fffff880`00c1b680 fffffa80`04879d60 : 0xfffff8a0`0c9a4bc0
fffff880`087b7e50 fffffa80`044d6af0 : fffff880`00c0d0c0 fffff880`00c1b680 fffffa80`04879d60 00000000`00000000 : 0xfffff8a0`02eb67e0
fffff880`087b7e58 fffff880`00c0d0c0 : fffff880`00c1b680 fffffa80`04879d60 00000000`00000000 00000000`00000001 : 0xfffffa80`044d6af0
fffff880`087b7e60 fffff880`00c1b680 : fffffa80`04879d60 00000000`00000000 00000000`00000001 00000240`087b8088 : [U][B]diskpt[/B][/U]+0xd0c0
fffff880`087b7e68 fffffa80`04879d60 : 00000000`00000000 00000000`00000001 00000240`087b8088 fffffa80`09020db8 :[U][B] diskpt[/B][/U]+0x1b680
fffff880`087b7e70 00000000`00000000 : 00000000`00000001 00000240`087b8088 fffffa80`09020db8 03935800`00000000 : 0xfffffa80`04879d60
FOLLOWUP_IP: 
[U][B]diskpt[/B][/U]+17cac
fffff880`00c17cac ??              ???
SYMBOL_STACK_INDEX:  1
SYMBOL_NAME:  [U][B]diskpt[/B][/U]+17cac
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: [U][B]diskpt[/B][/U]
IMAGE_NAME:  [U][B]diskpt.sys[/B][/U]
DEBUG_FLR_IMAGE_TIMESTAMP:  4b6fa027
STACK_COMMAND:  .cxr 0xfffff880087b7450 ; kb
FAILURE_BUCKET_ID:  X64_0x3B_[U][B]diskpt[/B][/U]+17cac
BUCKET_ID:  X64_0x3B_[U][B]diskpt[/B][/U]+17cac

So.......
you need to address that driver "diskpt.sys" apparently associated with a product called Shadow Defender Shadow Defender - the easiest PC/laptop security and privacy protection tool
Good luck, keep us posted and welcome to the forum
Regards
Randy

 

[TerryWood]

Hi Trouble (Randy)Just to say thank you for your prompt response. I have removed Shadow Defender and will wait to see what happens then revert back to confirm whether the problem is resolved.AS AN ASIDE, what was the tool you used to identify diskpt.sys as the culprit?Thank you again for your helpTerry

 

[Trouble]

AS AN ASIDE, what was the tool you used to identify diskpt.sys as the culprit?

Terry:
The Windows Debugger (windbg.exe)

You'll likely want to do a search of your system drive for diskpt.sys must to confirm that the uninstaller took that driver with it and make sure that it is no longer present on your system.
Additionally you may, if the software is important to you, contact the vendor and see if they either have a new version of the software or are familiar with any potential issues and can advise as to a work around or possible configuration changes that you can make in the software itself to prevent the problem reoccurring.
Regards
Randy

 

[FlameProofSuit]

Hi Windows 7 Forum

I am a brand new member and this my first post.

Welcome to the site