Windows 8 Random Blue Screen have dump file need help

[Michael Flynn]

Can someone help me find what is causing my computer to crash every so often.

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 000000b500190637
Arg2: ffffd0002aecd958
Arg3: ffffd0002aecd160
Arg4: fffff8000095aa44

Debugging Details:
------------------

Page a6711 not present in the dump file. Type ".hh dbgerr004" for details

EXCEPTION_RECORD: ffffd0002aecd958 -- (.exr 0xffffd0002aecd958)
ExceptionAddress: fffff8000095aa44 (Ntfs!NtfsFindPrefix+0x00000000000000d4)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT: ffffd0002aecd160 -- (.cxr 0xffffd0002aecd160;r)
rax=ffffc0000326d0d8 rbx=ffffc000043e4420 rcx=000000000000004d
rdx=0000000000000056 rsi=fffbc0000a60f430 rdi=ffffc00008abd140
rip=fffff8000095aa44 rsp=ffffd0002aecdb90 rbp=ffffd0002aecdc21
r8=ffffd0002aecdbf0 r9=ffffc00021fd085e r10=ffffd0002aecdbe0
r11=ffffd0002aecdc00 r12=ffffc00008abd1a8 r13=ffffd0002d1fb430
r14=ffffd0002aecde60 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
Ntfs!NtfsFindPrefix+0xd4:
fffff800`0095aa44 4c8b4ef8 mov r9,qword ptr [rsi-8] ds:002b:fffbc000`0a60f428=????????????????
Last set context:
rax=ffffc0000326d0d8 rbx=ffffc000043e4420 rcx=000000000000004d
rdx=0000000000000056 rsi=fffbc0000a60f430 rdi=ffffc00008abd140
rip=fffff8000095aa44 rsp=ffffd0002aecdb90 rbp=ffffd0002aecdc21
r8=ffffd0002aecdbf0 r9=ffffc00021fd085e r10=ffffd0002aecdbe0
r11=ffffd0002aecdc00 r12=ffffc00008abd1a8 r13=ffffd0002d1fb430
r14=ffffd0002aecde60 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
Ntfs!NtfsFindPrefix+0xd4:
fffff800`0095aa44 4c8b4ef8 mov r9,qword ptr [rsi-8] ds:002b:fffbc000`0a60f428=????????????????
Resetting default scope

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: taskhost.exe

CURRENT_IRQL: 1

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

READ_ADDRESS: ffffffffffffffff

FOLLOWUP_IP:
Ntfs!NtfsFindPrefix+d4
fffff800`0095aa44 4c8b4ef8 mov r9,qword ptr [rsi-8]

FAULTING_IP:
Ntfs!NtfsFindPrefix+d4
fffff800`0095aa44 4c8b4ef8 mov r9,qword ptr [rsi-8]

BUGCHECK_STR: 0x24

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

LAST_CONTROL_TRANSFER: from fffff8000095538a to fffff8000095aa44

STACK_TEXT:
ffffd000`2aecdb90 fffff800`0095538a : ffffe000`097b16f8 ffffd000`2aecde18 ffffd000`2d1fb400 ffffd000`2aecde18 : Ntfs!NtfsFindPrefix+0xd4
ffffd000`2aecdc70 fffff800`0094cca2 : ffffe000`097b16f8 ffffe000`00605c60 ffffd000`2d1fb390 ffffd000`2aecde90 : Ntfs!NtfsFindStartingNode+0x38b
ffffd000`2aecdd30 fffff800`009567ed : ffffe000`097b16f8 ffffe000`00605c60 ffffd000`2d1fb390 ffffe000`00ca3401 : Ntfs!NtfsCommonCreate+0x402
ffffd000`2aecdf50 fffff800`9e5525f7 : ffffd000`2d1fb338 00000000`0085e3b8 00000000`fe38c000 00000000`0095f7c4 : Ntfs!NtfsCommonCreateCallout+0x1d
ffffd000`2aecdf80 fffff800`9e5525bd : 00000000`00000000 00000000`00000000 ffffd000`2d1f6000 fffff800`9e4b9539 : nt!KxSwitchKernelStackCallout+0x27
ffffd000`2d1fb170 fffff800`9e4b9539 : ffffe000`00000006 00000000`00000000 00000000`00000006 00000000`00000000 : nt!KiSwitchKernelStackContinue
ffffd000`2d1fb190 fffff800`00952065 : fffff800`009567d0 ffffd000`2d1fb338 ffffe000`097b1600 00000000`00000000 : nt!KeExpandKernelStackAndCalloutInternal+0x229
ffffd000`2d1fb2e0 fffff800`00602f3e : ffffe000`000a5030 ffffe000`00605c60 fffff800`00624000 ffffe000`00605fb8 : Ntfs!NtfsFsdCreate+0x1d5
ffffd000`2d1fb4c0 fffff800`0062b341 : ffffe000`01c05380 ffffe000`07988b00 ffffd000`2064f001 ffffe000`01c05380 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x25e
ffffd000`2d1fb540 fffff800`9e7ad533 : 00000000`00000000 00000000`00000085 00000000`00000000 00000000`000007ff : fltmgr!FltpCreate+0x342
ffffd000`2d1fb5f0 fffff800`9e7a90cf : ffffc000`00014188 ffffc000`00014188 ffffc000`0078df60 ffffe000`0193e5e0 : nt!IopParseDevice+0x7b3
ffffd000`2d1fb7f0 fffff800`9e7a6ad3 : 00000000`00000000 ffffd000`2d1fb9e8 ffffe000`00000040 ffffe000`001c6c60 : nt!ObpLookupObjectName+0x6ef
ffffd000`2d1fb970 fffff800`9e7a3ec2 : ffffe000`00000001 ffffe000`07988ba8 00000021`001fe520 00000000`00000020 : nt!ObOpenObjectByName+0x1e3
ffffd000`2d1fbaa0 fffff800`9e7a1c94 : 00000021`001fe508 ffffd000`80100080 00000021`001fe560 ffffc000`0de3e2b0 : nt!IopCreateFile+0x372
ffffd000`2d1fbb40 fffff800`9e55a4b3 : ffffd000`2d1fbbe8 00000000`00000000 00000000`00000000 ffffc000`00151cb0 : nt!NtCreateFile+0x78
ffffd000`2d1fbbd0 00007ff9`43d86aca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000021`001fe488 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`43d86aca


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: Ntfs!NtfsFindPrefix+d4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 5215d042

IMAGE_VERSION: 6.3.9600.16384

STACK_COMMAND: .cxr 0xffffd0002aecd160 ; kb

BUCKET_ID_FUNC_OFFSET: d4

FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsFindPrefix

BUCKET_ID: 0x24_Ntfs!NtfsFindPrefix

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x24_ntfs!ntfsfindprefix

FAILURE_ID_HASH: {ccddaf85-9dc9-84e5-c2c3-4e9e236dd1c3}

Followup: MachineOwner
---------

 

[kemical]

Hi,
please read this thread and post the results:
Link Removed

 

[Michael Flynn]

Attached is my BSOD information

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {8887, fffffa8001dbe060, fffffa800102c990, 705}

Probably caused by : hardware_ram ( ZEROED_PAGE_CORRUPTED )

Followup: MachineOwner

Hi,
your dump files range from the above to kernel related errors. This could be down to either a driver, hardware or some update needed like bios.

Your bios is in need of updating and usually when upgrading to Windows 8 a bios update is required for stable running. Your motherboard does have an update pertaining:
BiosVersion = 080016
BiosReleaseDate = 08/18/2009
Link Removed

bdfndisf6.sys Tue Aug 28 15:25:03 2012: BitDefender Firewall I did a little checking on the compatibility and it seemed a little suspect. Try un-installing to test..
http://www.bitdefender.com/Downloads/

CVPNDRVA.sys Fri Mar 04 19:43:37 2011: Cisco Systems VPN Client update if possible:
http://www.cisco.com

dtscsibus.sys Mon Oct 29 09:28:48 2012: DAEMON Tools Virtual SCSI Bus Driver Likely BSOD cause in Windows systems (first seen in Win8). lease remove to test.

EvoMouseDriverFilterHidUsb.sys Fri Jun 18 08:01:10 2010: I couldn't find anything concrete on this driver and I think it has something to do with this:
http://www.celluon.com/shop_evo_mouse.php (update if possible)

gzflt.sys Wed Apr 11 15:03:18 2012: Possibly a VIPRE Antivirus driver. Please remove and use MSE:
Link Removed

SaiH8000.sys Fri Apr 04 12:26:34 2008: Saitek Hid driver update if possible:
http://www.saitek.com/uk/down/drivers.php

There are other drivers which might need attention but for now just deal with the above.

Just to make sure we are not dealing with any corruption please run a system file scan. Open an admin command prompt and type:
sfc /scannow
Press enter and await results.

If after updating the above your still getting bsod then test your RAM using this and only this application:
http://www.memtest.org/

Please post any new dmp files.

 

[Michael Flynn]

I updated important things like BIOS, and drivers for BIOS, but now computer is crashing a little more frequently. I will run MemTest tonight.

 

[Michael Flynn]

I also did sfc /scannow, without any issues

 

[kemical]

I'll await your results from the RAM test and please remember to post any new dump files.

 

[Michael Flynn]

Here is my new BSOD if you want to review it.

 

[kemical]

Hi,
are you sure it was a bsod? I only ask because no dmp file was included.

How did the RAM test go?

 

[Michael Flynn]

Looks like I have some errors in my RAM. Funny thing is I removed a stick just a few weeks ago that was bad, even thought I had a bad RAM slot in my otherboard, so I left slot 4 empty because the computer wouldnt start with a stick in it. I put a new stick in slot 3 , so it looks like that stick is bad? Event slot 2 has errors now? Do you think the motherboard is bad?

 

[Michael Flynn]

Just after writing this I got a blue screen with APC_INDEX_MISMATCH, I thought it said _MATCH but all the articles say MISMATCH. Attached is my BSOD on this error.

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1, {7ffcd3ac75fa, 0, ffff, ffffd00029356cc0}

Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+24b )

Followup: MachineOwner

Hi Michael,
the above is usually associated with drivers but i think in this instance our main culprit is either your RAM or RAM slots.

Remove all sticks apart from one and stick that in the slot nearest the processor. This is usually slot 1. Run memtest and see if the stick errors out. If it doesn't then remove it and insert another stick. Run the test again until you know which sticks bsod or not.
If you do know that you have a good stick and you think slot 1 is ok then use that stick to test the other slots.
If you test your RAM in the the first slot and they all error out then move on to the next slot and try again. This way by trial and error you can determine which sticks and which slots are bad...or not.

 

[Michael Flynn]

How long should I run a test for on a single stick?

 

[kemical]

A couple of passes should be ok.