none
Win 7 x64 BSOD BugCheck 0x00000050

    Question

  • Hello...

     

    I'm running into a problem where a workstation running Windows 7 x64 Pro keeps blue screening. Here is the System Event ID Error:

     

    Log Name:   System
    Source:    Microsoft-Windows-WER-SystemErrorReporting
    Date:     5/28/2010 10:51:09 AM
    Event ID:   1001
    Task Category: None
    Level:     Error
    Keywords:   Classic
    User:     N/A
    Computer:   REIDDELL10
    Description:
    The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xfffff98105dc26a8, 0x0000000000000000, 0xfffff880012414e0, 0x0000000000000005). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 052810-20482-01.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
     <System>
      <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
      <EventID Qualifiers="16384">1001</EventID>
      <Version>0</Version>
      <Level>2</Level>
      <Task>0</Task>
      <Opcode>0</Opcode>
      <Keywords>0x80000000000000</Keywords>
      <TimeCreated SystemTime="2010-05-28T14:51:09.000000000Z" />
      <EventRecordID>8931</EventRecordID>
      <Correlation />
      <Execution ProcessID="0" ThreadID="0" />
      <Channel>System</Channel>
      <Computer>REIDDELL10</Computer>
      <Security />
     </System>
     <EventData>
      <Data Name="param1">0x00000050 (0xfffff98105dc26a8, 0x0000000000000000, 0xfffff880012414e0, 0x0000000000000005)</Data>
      <Data Name="param2">C:\Windows\MEMORY.DMP</Data>
      <Data Name="param3">052810-20482-01</Data>
     </EventData>
    </Event>

    I found this blog post on getting the MEMORY.DMP file analyzed. Here is the output:

     

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\FGJR.HERMITS\Desktop\Reid\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available
    
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (2 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
    Machine Name:
    Kernel base = 0xfffff800`0280f000 PsLoadedModuleList = 0xfffff800`02a4ce50
    Debug session time: Fri May 28 10:49:51.720 2010 (UTC - 4:00)
    System Uptime: 0 days 0:36:55.188
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ....................
    Loading User Symbols
    
    Loading unloaded module list
    ....
    *******************************************************************************
    *                                       *
    *            Bugcheck Analysis                  *
    *                                       *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 50, {fffff98105dc26a8, 0, fffff880012414e0, 5}
    
    Probably caused by : Ntfs.sys ( Ntfs!memmove+250 )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                       *
    *            Bugcheck Analysis                  *
    *                                       *
    *******************************************************************************
    
    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffff98105dc26a8, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff880012414e0, If non-zero, the instruction address which referenced the bad memory
    	address.
    Arg4: 0000000000000005, (reserved)
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS: fffff98105dc26a8 
    
    FAULTING_IP: 
    Ntfs!memmove+250
    fffff880`012414e0 488b440af8   mov   rax,qword ptr [rdx+rcx-8]
    
    MM_INTERNAL_CODE: 5
    
    IMAGE_NAME: Ntfs.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
    
    MODULE_NAME: Ntfs
    
    FAULTING_MODULE: fffff88001236000 Ntfs
    
    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
    
    BUGCHECK_STR: 0x50
    
    PROCESS_NAME: System
    
    CURRENT_IRQL: 0
    
    TRAP_FRAME: fffff88002fcbd60 -- (.trap 0xfffff88002fcbd60)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000020 rbx=0000000000000000 rcx=fffff98105dc26d8
    rdx=ffffffffffffffd8 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff880012414e0 rsp=fffff88002fcbef8 rbp=fffff98005dc2728
     r8=00000000ffffff68 r9=0000000007fffffb r10=fffff8a0047d3430
    r11=fffff98005dc2770 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0     nv up ei pl nz na po nc
    Ntfs!memmove+0x250:
    fffff880`012414e0 488b440af8   mov   rax,qword ptr [rdx+rcx-8] ds:fffff981`05dc26a8=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER: from fffff800028fe801 to fffff8000287f600
    
    STACK_TEXT: 
    fffff880`02fcbbf8 fffff800`028fe801 : 00000000`00000050 fffff981`05dc26a8 00000000`00000000 fffff880`02fcbd60 : nt!KeBugCheckEx
    fffff880`02fcbc00 fffff800`0287d6ee : 00000000`00000000 00000000`00000028 00000000`00000000 fffff880`012ff4a3 : nt! ?? ::FNODOBFM::`string'+0x40ecb
    fffff880`02fcbd60 fffff880`012414e0 : fffff880`01300310 fffffa80`0579ce40 fffff880`02fcbf50 fffff8a0`00000400 : nt!KiPageFault+0x16e
    fffff880`02fcbef8 fffff880`01300310 : fffffa80`0579ce40 fffff880`02fcbf50 fffff8a0`00000400 fffff8a0`047c3db0 : Ntfs!memmove+0x250
    fffff880`02fcbf00 fffff880`01300dbc : fffff8a0`047c3db0 fffff800`02a245a0 fffff8a0`047c3db0 00000000`00000000 : Ntfs!NtfsRestartInsertSimpleRoot+0x50
    fffff880`02fcbf40 fffff880`012fa54f : fffffa80`0579ce40 fffffa80`03c9a180 fffff880`02fcc0d8 fffff880`02fcc110 : Ntfs!InsertSimpleRoot+0xb8
    fffff880`02fcc010 fffff880`012aee17 : 00000000`00000000 fffff8a0`047c3db0 fffff880`02fcc0d8 fffff880`02fcc168 : Ntfs!AddToIndex+0xcf
    fffff880`02fcc090 fffff880`012b3665 : fffffa80`0579ce40 fffff8a0`047c3db0 fffff8a0`00c1db58 fffffa80`00000000 : Ntfs!NtOfsAddRecords+0x167
    fffff880`02fcc270 fffff880`012f9ebc : fffffa80`0579ce40 fffff8a0`00c1db50 00000000`0002e15c 00000000`0002e160 : Ntfs!GetSecurityIdFromSecurityDescriptorUnsafe+0x1fd
    fffff880`02fcc320 fffff880`013324be : fffffa80`0579ce40 fffffa80`03c9a180 00000000`00000000 fffff980`05dc2d00 : Ntfs!NtfsCacheSharedSecurityByDescriptor+0xa0
    fffff880`02fcc370 fffff880`012b88fd : fffffa80`0579ce40 fffffa80`03c9a180 fffff800`02a245a0 00000000`00000000 : Ntfs! ?? ::NNGAKEGL::`string'+0x11130
    fffff880`02fcc3f0 fffff880`012536c4 : fffffa80`0579ce40 fffff880`0127da00 fffffa80`0579ce40 fffff8a0`048234e0 : Ntfs!NtfsUpdateFcbInfoFromDisk+0x4fe
    fffff880`02fcc540 fffff880`01320c66 : fffffa80`0579ce40 00000000`00000000 00000000`00000000 fffff8a0`048234e0 : Ntfs!NtfsInitializeDirectory+0x254
    fffff880`02fcc650 fffff880`0131590a : fffffa80`0579ce40 fffffa80`03c9a180 00000000`00000000 fffffa80`03c9a180 : Ntfs!NtfsInitializeExtendDirectory+0x3d6
    fffff880`02fcc810 fffff880`012b1c79 : 00000000`00000000 fffffa80`03aca780 00000000`00000001 00000000`00000000 : Ntfs!NtfsMountVolume+0x1691
    fffff880`02fccb50 fffff880`0123951d : 00000000`00000000 00000000`00000000 fffffa80`0579ce40 00000000`00000000 : Ntfs!NtfsCommonFileSystemControl+0x59
    fffff880`02fccb90 fffff800`0288c861 : fffff880`01030e00 fffff880`01030e00 fffffa80`0386d000 fffff800`00000001 : Ntfs!NtfsFspDispatch+0x2ad
    fffff880`02fccc70 fffff800`02b24a86 : 00004d88`000043b0 fffffa80`0386d040 00000000`00000080 fffffa80`037eb5f0 : nt!ExpWorkerThread+0x111
    fffff880`02fccd00 fffff800`0285db06 : fffff880`009f1180 fffffa80`0386d040 fffff880`009fbf40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
    fffff880`02fccd40 00000000`00000000 : fffff880`02fcd000 fffff880`02fc7000 fffff880`02fcb2e0 00000000`00000000 : nt!KxStartSystemThread+0x16
    
    
    STACK_COMMAND: kb
    
    FOLLOWUP_IP: 
    Ntfs!memmove+250
    fffff880`012414e0 488b440af8   mov   rax,qword ptr [rdx+rcx-8]
    
    SYMBOL_STACK_INDEX: 3
    
    SYMBOL_NAME: Ntfs!memmove+250
    
    FOLLOWUP_NAME: MachineOwner
    
    FAILURE_BUCKET_ID: X64_0x50_Ntfs!memmove+250
    
    BUCKET_ID: X64_0x50_Ntfs!memmove+250
    
    Followup: MachineOwner
    ---------
    

    It would seem to me like I've got a driver issue. But I'm unsure which one. 

    Any help anyone can give is greatly appreciated! :) 

    Friday, May 28, 2010 5:39 PM

Answers

  • The PAGE_FAULT_IN_NONPAGED_AREA bugcheck you referred to, that references NTFS.SYS, is likely due to corruption or some similar fault that ultimately causes ntfs.sys to trigger a bugcheck.  The original bugcheck you posted about was similar - that one referred to the memmove function which, as indicated, is a good indicator of corruption (memory corruption tends to be found far after the corruption has taken place - so, when memory is being moved, corruption of data structures used to track memory allocations, etc. can cause a bugcheck.  The problem is that that corruption took place in the first place, and the corruptor may not even be loaded in memory at the time of the crash.)

    In your case, the latest bugchecks are all identical - ntfs.sys+0xc9836 (Ntfs!memmove+250 with symbols) is the fault address.

    Did you run CHKDSK as suggested?  

    The previously referenced stale drivers are still present, as well.

     

    As far as mapisvc.inf goes - see the previous suggestion: "Do you have the Windows Fax and Scan feature turned on?  Perhaps, you could try removing that feature, running SFC again, and checking the results."

    Thursday, June 03, 2010 5:14 PM

All replies

  • Are the bugcheck details always the same?

    NTFS.SYS + memmove is a good indicator of memory corruption.  This can be caused by a bad/incompatible driver, or faulty hardware such as RAM.   Check out chkdsk, SFC, verifier, and memory testing details below.

    Can you upload the contents of c:\windows\minidump to SkyDrive and provide a link?

    General guidance for dealing with bluescreens:

     Consider running chkdsk on all partitions.  Let chkdsk complete on each partition and see if that helps.

    Also consider running SFC /SCANNOW.

    It can be helpful to use Driver Verifier.  To enable Driver Verifier... start->verifier.exe->OK->Create standard settings- >Next->select driver names from a list->Next->sort by Provider->select all non-Microsoft drivers->Finish, and OK your way out  of the dialog.

    Then, reboot and use the system as you normally would, and wait for a problem.  In the event that the system does not boot  completely after enabling driver verifier, boot into Safe Mode and run driver verifier, and tell it to delete the changes.

    Wait for a bugcheck to occur after enabling verifier as described, and then upload it.

    If you boot into safe mode, do you still experience bugchecks? What about if you do a clean boot, ordevice clean boot?

    Consider testing memory with Windows Memory Diagnostic or memtest86. Note that memory that passes tests is not necessarily  good memory - it just hasn't failed a test.  Consider systematically eliminating RAM from the system - run with a couple of  modules for a while, and see how things go. Then try the other modules.

    Other common suggestions include ensuring drivers are up to date (including video drivers), as well as ensuring that you're  using the latest BIOS.

    Friday, May 28, 2010 5:58 PM
  • Here is the link to where the mini dumps are :  Mini Dump Files

     

    I'll be trying the other suggestions you have in the mean time

    Friday, May 28, 2010 6:11 PM
  • All 4 dumps were identical and the dumps don't indicate any "smoking gun".

    Pending the results of the aforementioned suggestions...

    The following seem suspect:

    lmimirr.sys 4/10/2007  LogMeIn mirror driver

    dwvkbd64.sys 4/11/2007  DameWare virtual KB

    RaInfo.sys 1/4/2008   LogMeIn

    adfs.SYS 6/26/2008  (Adobe Drive FileSystem ??)

    LMIRfsDriver.sys 7/14/2008  LogMeIn

    iaStorV.sys 4/8/2009  Intel Matrix Storage Manager

    igdkmd64.sys 5/6/2009  Intel Graphics driver

    e1k62x64.sys 11/5/2009  Intel networking adapeter

    sbapifs.sys 1/3/2010   Sunbelt Software

    SBREdrv.sys 1/20/2010  Sunbelt 

    sbtis.sys 2/20/2010  Sunbelt


    Mirror drivers can cause funky issues, and the LMI kernel components are pre-Win7 RTM.  You might consider unisntalling LMI and checking the behavior there.  ADFS, whatever that is, seems suspect due to the potential for FS to refer to "filesystem" and the relation there to NTFS.  The Intel drivers seem old and there is likely an update available.  The Sunbelt software seems suspect because of the nature of security / AV software (invasive, poking around in core kernel data structures, etc.)

    Ultimately, the idea would be to break the above apart and update or remove one group of the components at a time to test the issue to see what may have an impact on the problem.

    • Proposed as answer by No.Compromise Monday, May 31, 2010 4:57 PM
    Friday, May 28, 2010 6:30 PM
  • Hi,

     

    Please refer the following two Microsoft Knowledge Base Articles to check if they are helpful:

     

    "Stop 0x0000007E" or "Stop 0x00000050" Stop error message in Windows 7 or Windows Server 2008 R2

    Error message on a computer that is running Windows 7 or Windows Server 2008 R2: "STOP: 0x00000050"

     

    Hope it works!

     

    Regards,


    Arthur Li - MSFT
    Monday, May 31, 2010 7:11 AM
  • I ran the SFC /SCANNOW and it reported "Windows Resource Protection found corrupt files but was unable to fix". I've uploaded the CBS.log file and you can find it here

     

    Can you let me know if this helps to narrow down the reasons for the BSOD's??? 

    Wednesday, June 02, 2010 6:57 PM
  • Looks like problems fixing mapisvc.inf, which is referenced by the Fax Services Client.  Do you have the Windows Fax and Scan feature turned on?  Perhaps, you could try removing that feature, running SFC again, and checking the results.

    Unfortunately, since SFC can't fix the problems, you are somewhat limited.  Consider the steps outlined "How to use the System File Checker tool to troubleshoot missing or corrupted system files on Windows Vista or on Windows 7" to try to restore legit copies of the affected files.  Else, it seems a repair install would be necessary, as described in this thread: Windows Resource Protection found corrupt files but was unable to fix some of them.

     

    Have you tried updating the drivers as suggested? Any new blue screens?

    Wednesday, June 02, 2010 8:57 PM
  • Looks like problems fixing mapisvc.inf, which is referenced by the Fax Services Client.  Do you have the Windows Fax and Scan feature turned on?  Perhaps, you could try removing that feature, running SFC again, and checking the results.

     

    Unfortunately, since SFC can't fix the problems, you are somewhat limited.  Consider the steps outlined "How to use the System File Checker tool to troubleshoot missing or corrupted system files on Windows Vista or on Windows 7" to try to restore legit copies of the affected files.  Else, it seems a repair install would be necessary, as described in this thread: Windows Resource Protection found corrupt files but was unable to fix some of them.

     

    Have you tried updating the drivers as suggested? Any new blue screens?

     

    Through MSConfig, I've turned off everything at startup and all Non-MS services yet I was still Blue Screening. Thats when I ran the SFC and got the results I posted. I also un-installed practically everything you posted prior to what *might* be the issue, except for the Intel Network Drivers and still got the same Blue Screens. 

     

    When I get into the office tomorrow morning I'll try the two links you gave and report back. 

    Wednesday, June 02, 2010 10:02 PM
  • Can you post new crash dumps?
    Wednesday, June 02, 2010 10:17 PM
  • Can you post new crash dumps?
    I'll be sure to post them in the morning. 
    Wednesday, June 02, 2010 11:40 PM
  • Can you post new crash dumps?
    I'll be sure to post them in the morning. 

    New mini dumps can be found here . I found a couple of mini-dumps on the system with todays ( 6/3/2010 ) date on them. I zipped them up so all can be inspected. 

     

    I'm in the process of looking at the links you provided now and will post back what I find. 

    Thursday, June 03, 2010 12:35 PM
  • Looks like problems fixing mapisvc.inf, which is referenced by the Fax Services Client.  Do you have the Windows Fax and Scan feature turned on?  Perhaps, you could try removing that feature, running SFC again, and checking the results.

     

    Unfortunately, since SFC can't fix the problems, you are somewhat limited.  Consider the steps outlined "How to use the System File Checker tool to troubleshoot missing or corrupted system files on Windows Vista or on Windows 7" to try to restore legit copies of the affected files.  Else, it seems a repair install would be necessary, as described in this thread: Windows Resource Protection found corrupt files but was unable to fix some of them.

     

    Have you tried updating the drivers as suggested? Any new blue screens?

     

    Through MSConfig, I've turned off everything at startup and all Non-MS services yet I was still Blue Screening. Thats when I ran the SFC and got the results I posted. I also un-installed practically everything you posted prior to what *might* be the issue, except for the Intel Network Drivers and still got the same Blue Screens. 

     

    When I get into the office tomorrow morning I'll try the two links you gave and report back. 

    I've tried doing the information "How to use System File Checker tool to troubleshoot missing or corrupted system files on Windows Vista or on Windows 7. I ran /findstr /C:"[SR] Cannot repair member file" %windir%\logs\cbs\cbs.log >sfcdetails.txt. It tells me that it cannot repair mapisvc.inf. So I try following the rest of the instructions except I cannot find the original location of mapisvc.inf. I tried doing lookups on Google on where to find the file, but its not in the system32 folder. 

    Any ideas?

    Thursday, June 03, 2010 12:53 PM
  • I've just now uploaded a new screen shot of a BSOD. This time it looks like it has something to do with NTFS.sys. You'll find the screen shot in the same place as the mini dump zip file, named CIMG0033
    Thursday, June 03, 2010 1:36 PM
  • The PAGE_FAULT_IN_NONPAGED_AREA bugcheck you referred to, that references NTFS.SYS, is likely due to corruption or some similar fault that ultimately causes ntfs.sys to trigger a bugcheck.  The original bugcheck you posted about was similar - that one referred to the memmove function which, as indicated, is a good indicator of corruption (memory corruption tends to be found far after the corruption has taken place - so, when memory is being moved, corruption of data structures used to track memory allocations, etc. can cause a bugcheck.  The problem is that that corruption took place in the first place, and the corruptor may not even be loaded in memory at the time of the crash.)

    In your case, the latest bugchecks are all identical - ntfs.sys+0xc9836 (Ntfs!memmove+250 with symbols) is the fault address.

    Did you run CHKDSK as suggested?  

    The previously referenced stale drivers are still present, as well.

     

    As far as mapisvc.inf goes - see the previous suggestion: "Do you have the Windows Fax and Scan feature turned on?  Perhaps, you could try removing that feature, running SFC again, and checking the results."

    Thursday, June 03, 2010 5:14 PM