ws has recovered from an unexpected shutdown - BlueScreen

Discussion in 'Windows 7 Blue Screen of Death (BSOD)' started by sunni198, May 15, 2012.

  1. sunni198

    sunni198 New Member

    Joined:
    May 15, 2012
    Messages:
    2
    Likes Received:
    0
    I am getting this error each morning, its happening over night. I am unable to open the mini dump file that it notes in the error box. Can someone help me identify the problem? I have seen threads that say it can be a number of things but I want to address the correct thing. I am attaching my dmp file. Please help! This has been happening since I installed Win 7.

    Additionally, my windows application error logs show an error each morning, sounds directly related...

    WMI errorEvent filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
     

    Attached Files:

    #1 sunni198, May 15, 2012
    Last edited: May 15, 2012
  2. Adamsappleone

    Adamsappleone U.S.Navy D.A.V.

    Joined:
    Aug 2, 2009
    Messages:
    1,662
    Likes Received:
    122
  3. Trouble

    Trouble Noob Whisperer

    Joined:
    Nov 30, 2009
    Messages:
    13,845
    Likes Received:
    833
    I suspect you have something messing with fltmgr.sys and my bet is on ccsvchst.exe (Symantec / Norton)
    My recommendation is try it without Norton. Uninstall it completely using the programs uninstaller if present or else the programs and features applet in the control panel and follow that up by running this vendor specific proprietary removal tool here https://www-secure.symantec.com/norton-support/jsp/help-solutions.jsp?lg=english&ct=united+states&docid=20080710133834EN&product=home&version=1&pvid=f-home
    Replace it, at least temporarily for testing purposes with MSE from here Anti-Malware, Virus, Spyware Protection | Microsoft Security Essentials
    DUMP FILE:
    Code:
    NTFS_FILE_SYSTEM (24)
        If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
        parameters are the exception record and context record. Do a .cxr
        on the 3rd parameter and then kb to obtain a more informative stack
        trace.
    Arguments:
    Arg1: 001904fb
    Arg2: 9ca56998
    Arg3: 9ca56570
    Arg4: 8a56121c
    EXCEPTION_RECORD:  9ca56998 -- (.exr 0xffffffff9ca56998)
    ExceptionAddress: 8a56121c (Ntfs!NtfsAcquireResourceExclusive+0x00000015)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 00000000
       Parameter[1]: 0000003c
    Attempt to read from address 0000003c
    CONTEXT:  9ca56570 -- (.cxr 0xffffffff9ca56570)
    eax=00000000 ebx=c00000d8 ecx=00000702 edx=00000000 esi=b6295270 edi=00000000
    eip=8a56121c esp=9ca56a60 ebp=9ca56a60 iopl=0         nv up ei pl nz ac pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010216
    Ntfs!NtfsAcquireResourceExclusive+0x15:
    8a56121c 8b403c          mov     eax,dword ptr [eax+3Ch] ds:0023:0000003c=????????
    Resetting default scope
    CUSTOMER_CRASH_COUNT:  1
    PROCESS_NAME:  [COLOR=#ff0000][U][B]ccsvchst.exe[/B][/U][/COLOR]
    CURRENT_IRQL:  0
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    EXCEPTION_PARAMETER1:  00000000
    EXCEPTION_PARAMETER2:  0000003c
    READ_ADDRESS: GetPointerFromAddress: unable to read from 8297e828
    Unable to read MiSystemVaType memory at 8295ed80
     0000003c 
    FOLLOWUP_IP: 
    Ntfs!NtfsAcquireResourceExclusive+15
    8a56121c 8b403c          mov     eax,dword ptr [eax+3Ch]
    FAULTING_IP: 
    Ntfs!NtfsAcquireResourceExclusive+15
    8a56121c 8b403c          mov     eax,dword ptr [eax+3Ch]
    BUGCHECK_STR:  0x24
    DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE
    LAST_CONTROL_TRANSFER:  from 8a5610df to 8a56121c
    STACK_TEXT:  
    9ca56a60 8a5610df 85369c40 b6295270 85369c01 Ntfs!NtfsAcquireResourceExclusive+0x15
    9ca56a84 8a5ceb93 85369c40 b6295270 00000000 Ntfs!NtfsAcquireExclusiveFcb+0x42
    9ca56b20 8a5d2b3c 85369c40 8595b0d8 00000001 Ntfs!NtfsFlushVolume+0x13e
    9ca56ba4 8a5ccd72 85369c40 859438e0 16fdd725 Ntfs!NtfsCommonFlushBuffers+0x1a9
    9ca56c0c 8284e032 8595b020 859438e0 859438e0 Ntfs!NtfsFsdFlushBuffers+0xf7
    9ca56c24 8a38c20c 85d43408 859438e0 00000000 nt!IofCallDriver+0x63
    9ca56c48 8a38c3cb 9ca56c68 85d43408 00000000 [COLOR=#ff0000][U][B]fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa[/B][/U][/COLOR]
    9ca56c80 8284e032 85d43408 859438e0 859438e0 [COLOR=#ff0000][U][B]fltmgr!FltpDispatch+0xc5[/B][/U][/COLOR]
    9ca56c98 82a23b1d 859438e0 85050f80 00000000 nt!IofCallDriver+0x63
    9ca56cb8 82a43dc7 85d43408 85050f80 00000000 nt!IopSynchronousServiceTail+0x1f8
    9ca56d24 8285483a 00000000 03a9d848 03a9d850 nt!NtFlushBuffersFile+0x1d7
    9ca56d24 76ee7094 00000000 03a9d848 03a9d850 nt!KiFastCallEntry+0x12a
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    03a9d850 00000000 00000000 00000000 00000000 0x76ee7094
    SYMBOL_STACK_INDEX:  0
    SYMBOL_NAME:  Ntfs!NtfsAcquireResourceExclusive+15
    FOLLOWUP_NAME:  MachineOwner
    MODULE_NAME: Ntfs
    IMAGE_NAME:  Ntfs.sys
    DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7892c
    STACK_COMMAND:  .cxr 0xffffffff9ca56570 ; kb
    FAILURE_BUCKET_ID:  0x24_Ntfs!NtfsAcquireResourceExclusive+15
    BUCKET_ID:  0x24_Ntfs!NtfsAcquireResourceExclusive+15
    If Blue Screens persist, open an elevated command prompt and run Check Disk by typing
    chkdsk C: /R
    hit enter and answer yes "Y" when prompted and reboot. See what that produces.
    Additionally you have several older drivers on your system which you might consider addressing if possible by either updating, uninstalling or renaming.
    [TABLE="width: 200"]
    [TR]
    [TD]mohfilt.sys
    [/TD]
    [TD="align: right"]5/6/2005
    [/TD]
    [/TR]
    [TR]
    [TD]IntelC53.sys
    [/TD]
    [TD="align: right"]5/6/2005
    [/TD]
    [/TR]
    [TR]
    [TD]IntelC51.sys
    [/TD]
    [TD="align: right"]5/6/2005
    [/TD]
    [/TR]
    [TR]
    [TD]smwdm.sys[/TD]
    [TD="align: right"]11/29/2005
    [/TD]
    [/TR]
    [TR]
    [TD]IntelC52.sys[/TD]
    [TD="align: right"]3/1/2006
    [/TD]
    [/TR]
    [TR]
    [TD]LHidFilt.Sys[/TD]
    [TD="align: right"]11/29/2007
    [/TD]
    [/TR]
    [TR]
    [TD]LMouFilt.Sys[/TD]
    [TD="align: right"]11/29/2007
    [/TD]
    [/TR]
    [TR]
    [TD]LUsbFilt.Sys[/TD]
    [TD="align: right"]11/29/2007
    [/TD]
    [/TR]
    [TR]
    [TD]L8042Kbd.sys[/TD]
    [TD="align: right"]11/29/2007
    [/TD]
    [/TR]
    [TR]
    [TD]b57nd60x.sys[/TD]
    [TD="align: right"]4/26/2009
    [/TD]
    [/TR]
    [/TABLE]
    So arm yourself with Google and see what you can find looks pretty much like a very old modem, some logitech keyboard and or mouse drivers an old sound card and a broadcom network adapter.
    Good luck
    Randy
     

Share This Page

Loading...