We help IT Professionals succeed at work.

Random BSOD's

1,090 Views
Last Modified: 2016-08-29
I'm still receiving random BSOD's. Memory has been replaced/tested. Errors occur for no particular reason and under varying circumstances.
Comment
Watch Question

evilrixSenior Software Engineer (Avast)
CERTIFIED EXPERT

Commented:
Check the System Event log as that will give you good information regarding the Bug Check. Also, when your system BSOD is will create a minidump file. This is a dump of the state of system at the time the system crash. It will also contain information about the bugcheck that was generated. If you can upload the latest one to EE Stuff I should be able to look at it and tell you what caused the crash, or at least give you more info to help you diagnose it: -

http://www.ee-stuff.com/

NB. They are normally located in c:\windows\minidump\

More about minidumps: -

http://support.microsoft.com/kb/315263

Author

Commented:
I've uploaded the file:

Your file has successfully been uploaded!
To download the file, you must be logged into EE-Stuff. Here are two pages that will display your file, if logged in:

View all files for Question ID: 23026635
https://filedb.experts-exchange.com/incoming/ee-stuff/6193-Mini.ziphttps://filedb.experts-exchange.com/incoming/ee-stuff/6207-Mini2.zip
 

Direct link to your file
https://filedb.experts-exchange.com/incoming/ee-stuff/6193-Mini.zip 
evilrixSenior Software Engineer (Avast)
CERTIFIED EXPERT

Commented:
Microsoft's online crash analysis web site is also worth a visit: -

http://oca.microsoft.com/en/Welcome.aspx
evilrixSenior Software Engineer (Avast)
CERTIFIED EXPERT

Commented:
Well, the faulting driver is ntfs.sys, during a call to NtfsDeleteScb(). The reason for failure was an access violation. This issue can occur if a problem occurred within the Ntfs.sys file. The Ntfs.sys file is the driver file that enables your computer to read and write to NTFS partitions. Damage in the NTFS file system, damaged portions of your hard disk, or damaged SCSI or IDE drivers can also cause this issue. Basically, this function tried to access (one assumes tried to delete) a resource it expected to be able to but it could not not. I would suggest you try running chkdsk/scandisk as this could be related to file system issues (it certainly won't hurt to check it).

For your information, the full bug check analysis is below.

I hope this helps.

-Rx.
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001902fe
Arg2: bace7ae4
Arg3: bace77e0
Arg4: ba663967
 
Debugging Details:
------------------
 
 
EXCEPTION_RECORD:  bace7ae4 -- (.exr ffffffffbace7ae4)
ExceptionAddress: ba663967 (Ntfs!NtfsDeleteScb+0x0000009b)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 11b20104
Attempt to read from address 11b20104
 
CONTEXT:  bace77e0 -- (.cxr ffffffffbace77e0)
eax=890ec0e4 ebx=8afc9100 ecx=88a34000 edx=00000000 esi=bace7be0 edi=8afc9318
eip=ba663967 esp=bace7bac ebp=bace7bbc iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
Ntfs!NtfsDeleteScb+0x9b:
ba663967 8b440820        mov     eax,dword ptr [eax+ecx+20h] ds:0023:11b20104=????????
Resetting default scope
 
CUSTOMER_CRASH_COUNT:  2
 
DEFAULT_BUCKET_ID:  DRIVER_FAULT
 
PROCESS_NAME:  System
 
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
 
READ_ADDRESS:  11b20104 
 
BUGCHECK_STR:  0x24
 
LAST_CONTROL_TRANSFER:  from ba649c30 to ba663967
 
STACK_TEXT:  
bace7bbc ba649c30 8988fae8 bace0705 ea293740 Ntfs!NtfsDeleteScb+0x9b
bace7bd4 ba624800 8988fae8 ea2937d8 00000000 Ntfs!NtfsRemoveScb+0x88
bace7bf0 ba649a17 8988fae8 ea293710 00000000 Ntfs!NtfsPrepareFcbForRemoval+0x52
bace7c38 ba6247b0 8988fae8 ea2937d8 ea293970 Ntfs!NtfsTeardownStructures+0x5b
bace7c64 ba6474b5 8988fae8 002937d8 ea293970 Ntfs!NtfsDecrementCloseCounts+0x9e
bace7ce8 ba64c3e3 8988fae8 ea2937d8 ea293710 Ntfs!NtfsCommonClose+0x397
bace7d7c 805379bd 00000000 00000000 8b017c10 Ntfs!NtfsFspClose+0xe3
bace7dac 805ce84c 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
bace7ddc 8054532e 805378ce 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
 
 
FOLLOWUP_IP: 
Ntfs!NtfsDeleteScb+9b
ba663967 8b440820        mov     eax,dword ptr [eax+ecx+20h]
 
SYMBOL_STACK_INDEX:  0
 
SYMBOL_NAME:  Ntfs!NtfsDeleteScb+9b
 
FOLLOWUP_NAME:  MachineOwner
 
MODULE_NAME: Ntfs
 
IMAGE_NAME:  Ntfs.sys
 
DEBUG_FLR_IMAGE_TIMESTAMP:  45cc56a7
 
STACK_COMMAND:  .cxr 0xffffffffbace77e0 ; kb
 
FAILURE_BUCKET_ID:  0x24_Ntfs!NtfsDeleteScb+9b
 
BUCKET_ID:  0x24_Ntfs!NtfsDeleteScb+9b
 
Followup: MachineOwner
---------

Open in new window

evilrixSenior Software Engineer (Avast)
CERTIFIED EXPERT

Commented:
I've now had a look at all the mini dumps (the one above was the latest) and the results are not conclusive, they seem, to me different; however, they could all be related to file system issues but it isn't clear. I would start off by ruling out hard disk/file system issues first and then take it from there. You should consider installing a SMART monitor to check your drive. A Google search finds plenty to choose from: -

http://www.google.co.uk/search?sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8&q=SMART+MONITOR

Also, run scandisk as I suggested above.

I hope this helps.
evilrixSenior Software Engineer (Avast)
CERTIFIED EXPERT

Commented:
There were the three BugChecks you received. Below I've identified them along with links to Microsoft's website where they are described.

BAD_POOL_CALLER
http://msdn2.microsoft.com/en-us/library/ms796120.aspx

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
http://msdn2.microsoft.com/en-us/library/ms797156.aspx

NTFS_FILE_SYSTEM
http://msdn2.microsoft.com/en-us/library/ms793935.aspx

Author

Commented:
i was having harddrive issues and replaced it with a Maxtor HD. I used MaxBlast to 'clone' the contents. come to think of it, this may be when the majority of my problems started. i'll follow your instructions when i'm back (i've got to run out for a bit) and let you know the results.
evilrixSenior Software Engineer (Avast)
CERTIFIED EXPERT

Commented:
Ok, good luck :)
evilrixSenior Software Engineer (Avast)
CERTIFIED EXPERT

Commented:
Did you get to the bottom of this?

Author

Commented:
my computer wouldn't start at all after using verifier.exe. i couldn't even get into safe mode. i did a "last know good". so far so good. i'd be surprised if it's repaired, but will award you the points if it is. i'll post the last 'dumps'. for you to look at, too.

View all files for Question ID: 23026635
https://filedb.experts-exchange.com/incoming/ee-stuff/6193-Mini.ziphttps://filedb.experts-exchange.com/incoming/ee-stuff/6207-Mini2.zip
 

Direct link to your file
https://filedb.experts-exchange.com/incoming/ee-stuff/6207-Mini2.zip 
evilrixSenior Software Engineer (Avast)
CERTIFIED EXPERT

Commented:
Did you not try scandisk as I suggested? I didn't suggest verifier did I? I will look at last dumps and get back to you.

Author

Commented:
sorry...yes, i ran scandisk, too. it found a few errors and repaired them. i think the bad_pool link from MSDN listed that as a remedy.
evilrixSenior Software Engineer (Avast)
CERTIFIED EXPERT

Commented:
So, were these other dumps before or after scandisk?
Senior Software Engineer (Avast)
CERTIFIED EXPERT
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.