Random Blue Screen have dump file need help

Discussion in 'Windows 8 Blue Screen of Death (BSOD)' started by Michael Flynn, Feb 7, 2014.

  1. Michael Flynn

    Joined:
    Feb 7, 2014
    Messages:
    8
    Likes Received:
    0
    Can someone help me find what is causing my computer to crash every so often.

    2: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
    Arguments:
    Arg1: 000000b500190637
    Arg2: ffffd0002aecd958
    Arg3: ffffd0002aecd160
    Arg4: fffff8000095aa44

    Debugging Details:
    ------------------

    Page a6711 not present in the dump file. Type ".hh dbgerr004" for details

    EXCEPTION_RECORD: ffffd0002aecd958 -- (.exr 0xffffd0002aecd958)
    ExceptionAddress: fffff8000095aa44 (Ntfs!NtfsFindPrefix+0x00000000000000d4)
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 0000000000000000
    Parameter[1]: ffffffffffffffff
    Attempt to read from address ffffffffffffffff

    CONTEXT: ffffd0002aecd160 -- (.cxr 0xffffd0002aecd160;r)
    rax=ffffc0000326d0d8 rbx=ffffc000043e4420 rcx=000000000000004d
    rdx=0000000000000056 rsi=fffbc0000a60f430 rdi=ffffc00008abd140
    rip=fffff8000095aa44 rsp=ffffd0002aecdb90 rbp=ffffd0002aecdc21
    r8=ffffd0002aecdbf0 r9=ffffc00021fd085e r10=ffffd0002aecdbe0
    r11=ffffd0002aecdc00 r12=ffffc00008abd1a8 r13=ffffd0002d1fb430
    r14=ffffd0002aecde60 r15=0000000000000000
    iopl=0 nv up ei ng nz na po nc
    cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
    Ntfs!NtfsFindPrefix+0xd4:
    fffff800`0095aa44 4c8b4ef8 mov r9,qword ptr [rsi-8] ds:002b:fffbc000`0a60f428=????????????????
    Last set context:
    rax=ffffc0000326d0d8 rbx=ffffc000043e4420 rcx=000000000000004d
    rdx=0000000000000056 rsi=fffbc0000a60f430 rdi=ffffc00008abd140
    rip=fffff8000095aa44 rsp=ffffd0002aecdb90 rbp=ffffd0002aecdc21
    r8=ffffd0002aecdbf0 r9=ffffc00021fd085e r10=ffffd0002aecdbe0
    r11=ffffd0002aecdc00 r12=ffffc00008abd1a8 r13=ffffd0002d1fb430
    r14=ffffd0002aecde60 r15=0000000000000000
    iopl=0 nv up ei ng nz na po nc
    cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
    Ntfs!NtfsFindPrefix+0xd4:
    fffff800`0095aa44 4c8b4ef8 mov r9,qword ptr [rsi-8] ds:002b:fffbc000`0a60f428=????????????????
    Resetting default scope

    DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

    PROCESS_NAME: taskhost.exe

    CURRENT_IRQL: 1

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_PARAMETER1: 0000000000000000

    EXCEPTION_PARAMETER2: ffffffffffffffff

    READ_ADDRESS: ffffffffffffffff

    FOLLOWUP_IP:
    Ntfs!NtfsFindPrefix+d4
    fffff800`0095aa44 4c8b4ef8 mov r9,qword ptr [rsi-8]

    FAULTING_IP:
    Ntfs!NtfsFindPrefix+d4
    fffff800`0095aa44 4c8b4ef8 mov r9,qword ptr [rsi-8]

    BUGCHECK_STR: 0x24

    ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

    LAST_CONTROL_TRANSFER: from fffff8000095538a to fffff8000095aa44

    STACK_TEXT:
    ffffd000`2aecdb90 fffff800`0095538a : ffffe000`097b16f8 ffffd000`2aecde18 ffffd000`2d1fb400 ffffd000`2aecde18 : Ntfs!NtfsFindPrefix+0xd4
    ffffd000`2aecdc70 fffff800`0094cca2 : ffffe000`097b16f8 ffffe000`00605c60 ffffd000`2d1fb390 ffffd000`2aecde90 : Ntfs!NtfsFindStartingNode+0x38b
    ffffd000`2aecdd30 fffff800`009567ed : ffffe000`097b16f8 ffffe000`00605c60 ffffd000`2d1fb390 ffffe000`00ca3401 : Ntfs!NtfsCommonCreate+0x402
    ffffd000`2aecdf50 fffff800`9e5525f7 : ffffd000`2d1fb338 00000000`0085e3b8 00000000`fe38c000 00000000`0095f7c4 : Ntfs!NtfsCommonCreateCallout+0x1d
    ffffd000`2aecdf80 fffff800`9e5525bd : 00000000`00000000 00000000`00000000 ffffd000`2d1f6000 fffff800`9e4b9539 : nt!KxSwitchKernelStackCallout+0x27
    ffffd000`2d1fb170 fffff800`9e4b9539 : ffffe000`00000006 00000000`00000000 00000000`00000006 00000000`00000000 : nt!KiSwitchKernelStackContinue
    ffffd000`2d1fb190 fffff800`00952065 : fffff800`009567d0 ffffd000`2d1fb338 ffffe000`097b1600 00000000`00000000 : nt!KeExpandKernelStackAndCalloutInternal+0x229
    ffffd000`2d1fb2e0 fffff800`00602f3e : ffffe000`000a5030 ffffe000`00605c60 fffff800`00624000 ffffe000`00605fb8 : Ntfs!NtfsFsdCreate+0x1d5
    ffffd000`2d1fb4c0 fffff800`0062b341 : ffffe000`01c05380 ffffe000`07988b00 ffffd000`2064f001 ffffe000`01c05380 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x25e
    ffffd000`2d1fb540 fffff800`9e7ad533 : 00000000`00000000 00000000`00000085 00000000`00000000 00000000`000007ff : fltmgr!FltpCreate+0x342
    ffffd000`2d1fb5f0 fffff800`9e7a90cf : ffffc000`00014188 ffffc000`00014188 ffffc000`0078df60 ffffe000`0193e5e0 : nt!IopParseDevice+0x7b3
    ffffd000`2d1fb7f0 fffff800`9e7a6ad3 : 00000000`00000000 ffffd000`2d1fb9e8 ffffe000`00000040 ffffe000`001c6c60 : nt!ObpLookupObjectName+0x6ef
    ffffd000`2d1fb970 fffff800`9e7a3ec2 : ffffe000`00000001 ffffe000`07988ba8 00000021`001fe520 00000000`00000020 : nt!ObOpenObjectByName+0x1e3
    ffffd000`2d1fbaa0 fffff800`9e7a1c94 : 00000021`001fe508 ffffd000`80100080 00000021`001fe560 ffffc000`0de3e2b0 : nt!IopCreateFile+0x372
    ffffd000`2d1fbb40 fffff800`9e55a4b3 : ffffd000`2d1fbbe8 00000000`00000000 00000000`00000000 ffffc000`00151cb0 : nt!NtCreateFile+0x78
    ffffd000`2d1fbbd0 00007ff9`43d86aca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000021`001fe488 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`43d86aca


    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: Ntfs!NtfsFindPrefix+d4

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: Ntfs

    IMAGE_NAME: Ntfs.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 5215d042

    IMAGE_VERSION: 6.3.9600.16384

    STACK_COMMAND: .cxr 0xffffd0002aecd160 ; kb

    BUCKET_ID_FUNC_OFFSET: d4

    FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsFindPrefix

    BUCKET_ID: 0x24_Ntfs!NtfsFindPrefix

    ANALYSIS_SOURCE: KM

    FAILURE_ID_HASH_STRING: km:0x24_ntfs!ntfsfindprefix

    FAILURE_ID_HASH: {ccddaf85-9dc9-84e5-c2c3-4e9e236dd1c3}

    Followup: MachineOwner
    ---------
     
  2. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,790
    Likes Received:
    1,563
  3. Michael Flynn

    Joined:
    Feb 7, 2014
    Messages:
    8
    Likes Received:
    0
    Attached is my BSOD information
     

    Attached Files:

  4. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,790
    Likes Received:
    1,563
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1A, {8887, fffffa8001dbe060, fffffa800102c990, 705}
    
    Probably caused by : hardware_ram ( ZEROED_PAGE_CORRUPTED )
    
    Followup: MachineOwner
    
    Hi,
    your dump files range from the above to kernel related errors. This could be down to either a driver, hardware or some update needed like bios.

    Your bios is in need of updating and usually when upgrading to Windows 8 a bios update is required for stable running. Your motherboard does have an update pertaining:
    BiosVersion = 080016
    BiosReleaseDate = 08/18/2009
    https://www.evga.com/support/download/default.aspx

    bdfndisf6.sys Tue Aug 28 15:25:03 2012: BitDefender Firewall I did a little checking on the compatibility and it seemed a little suspect. Try un-installing to test..
    http://www.bitdefender.com/Downloads/

    CVPNDRVA.sys Fri Mar 04 19:43:37 2011: Cisco Systems VPN Client update if possible:
    http://www.cisco.com

    dtscsibus.sys Mon Oct 29 09:28:48 2012: DAEMON Tools Virtual SCSI Bus Driver Likely BSOD cause in Windows systems (first seen in Win8). lease remove to test.

    EvoMouseDriverFilterHidUsb.sys Fri Jun 18 08:01:10 2010: I couldn't find anything concrete on this driver and I think it has something to do with this:
    http://www.celluon.com/shop_evo_mouse.php (update if possible)

    gzflt.sys Wed Apr 11 15:03:18 2012: Possibly a VIPRE Antivirus driver. Please remove and use MSE:
    http://www.microsoft.com/en-gb/security/pc-security/mse.aspx

    SaiH8000.sys Fri Apr 04 12:26:34 2008: Saitek Hid driver update if possible:
    http://www.saitek.com/uk/down/drivers.php

    There are other drivers which might need attention but for now just deal with the above.

    Just to make sure we are not dealing with any corruption please run a system file scan. Open an admin command prompt and type:
    sfc /scannow
    Press enter and await results.

    If after updating the above your still getting bsod then test your RAM using this and only this application:
    http://www.memtest.org/

    Please post any new dmp files.
     
  5. Michael Flynn

    Joined:
    Feb 7, 2014
    Messages:
    8
    Likes Received:
    0
    I updated important things like BIOS, and drivers for BIOS, but now computer is crashing a little more frequently. I will run MemTest tonight.
     
  6. Michael Flynn

    Joined:
    Feb 7, 2014
    Messages:
    8
    Likes Received:
    0
    I also did sfc /scannow, without any issues
     
  7. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,790
    Likes Received:
    1,563
    I'll await your results from the RAM test and please remember to post any new dump files.
     
  8. Michael Flynn

    Joined:
    Feb 7, 2014
    Messages:
    8
    Likes Received:
    0
    Here is my new BSOD if you want to review it.
     

    Attached Files:

  9. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,790
    Likes Received:
    1,563
    Hi,
    are you sure it was a bsod? I only ask because no dmp file was included.

    How did the RAM test go?
     
  10. Michael Flynn

    Joined:
    Feb 7, 2014
    Messages:
    8
    Likes Received:
    0
    Looks like I have some errors in my RAM. Funny thing is I removed a stick just a few weeks ago that was bad, even thought I had a bad RAM slot in my otherboard, so I left slot 4 empty because the computer wouldnt start with a stick in it. I put a new stick in slot 3 , so it looks like that stick is bad? Event slot 2 has errors now? Do you think the motherboard is bad?
     

    Attached Files:

  11. Michael Flynn

    Joined:
    Feb 7, 2014
    Messages:
    8
    Likes Received:
    0
    Just after writing this I got a blue screen with APC_INDEX_MISMATCH, I thought it said _MATCH but all the articles say MISMATCH. Attached is my BSOD on this error.
     

    Attached Files:

  12. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,790
    Likes Received:
    1,563
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1, {7ffcd3ac75fa, 0, ffff, ffffd00029356cc0}
    
    Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+24b )
    
    Followup: MachineOwner
    
    Hi Michael,
    the above is usually associated with drivers but i think in this instance our main culprit is either your RAM or RAM slots.

    Remove all sticks apart from one and stick that in the slot nearest the processor. This is usually slot 1. Run memtest and see if the stick errors out. If it doesn't then remove it and insert another stick. Run the test again until you know which sticks bsod or not.
    If you do know that you have a good stick and you think slot 1 is ok then use that stick to test the other slots.
    If you test your RAM in the the first slot and they all error out then move on to the next slot and try again. This way by trial and error you can determine which sticks and which slots are bad...or not.
     
  13. Michael Flynn

    Joined:
    Feb 7, 2014
    Messages:
    8
    Likes Received:
    0
    How long should I run a test for on a single stick?
     
  14. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,790
    Likes Received:
    1,563
    A couple of passes should be ok.
     

Share This Page

Loading...