Constant BSOD's Need Help Bad! RRS feed

  • Question

  • So I have re-installed windows 7 because I had some issues and now Keep crashing and can not pin point what is causing me to crash. It seems to happen when I'm searching a website or playing with a program the system will hang and crash immediately. Here are the dump files from all of my crashes that I hope will help. If I did it correctly they should be uploaded to skydrive.


    Saturday, December 31, 2011 12:26 AM

All replies

  • I looked at a number of them, but not all of them according to these steps,
    IRQL_NOT_LESS_OR_EQUAL (referencing memory corruption)
    To start troubleshooting, lets look at hardware issues with the memory
    and hard drive
    Then you should perform a system integrity verification
    This one is sort of an undocumented one, but points to corruption in a
    dll (specifically ntdll.dll),
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    Use !analyze -v to get detailed debugging information.
    BugCheck C0000221, {fffff8a0002400e0, 0, 0, 0}
    Probably caused by : ntkrnlmp.exe ( nt!ExpSystemErrorHandler2+5ff )
    Followup: MachineOwner
    0: kd>  !analyze -v
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    Unknown bugcheck code (c0000221)
    Unknown bugcheck description
    Arg1: fffff8a0002400e0
    Arg2: 0000000000000000
    Arg3: 0000000000000000
    Arg4: 0000000000000000
    Debugging Details:
     BUGCHECK_STR:  0xc0000221
    ERROR_CODE: (NTSTATUS) 0xc0000221 - {Bad Image Checksum}  The image %hs is possibly corrupt. The header checksum does not match the computed checksum.
    EXCEPTION_CODE: (NTSTATUS) 0xc0000221 - {Bad Image Checksum}  The image %hs is possibly corrupt. The header checksum does not match the computed checksum.
    EXCEPTION_PARAMETER1:  fffff8a0002400e0
    EXCEPTION_PARAMETER2:  0000000000000000
    EXCEPTION_PARAMETER3:  0000000000000000
    IMAGE_NAME:  ntkrnlmp.exe
    PROCESS_NAME:  System
    LAST_CONTROL_TRANSFER:  from fffff800033112df to fffff800030c7c40
    fffff880`009a91a8 fffff800`033112df : 00000000`0000004c 00000000`c0000221 fffff880`009a9248 fffffa80`06673370 : nt!KeBugCheckEx
    fffff880`009a91b0 fffff800`0311474d : fffffa80`051e9258 fffffa80`051e9040 00000000`00000000 00000000`00000000 : nt!ExpSystemErrorHandler2+0x5ff
    fffff880`009a93e0 fffff800`034f72a1 : 00000000`c0000221 00000000`00000001 00000000`00000001 00000000`000c0000 : nt!ExpSystemErrorHandler+0xdd
    fffff880`009a9420 fffff800`034f76a6 : fffffa80`c0000221 00000000`00000001 fffffa80`00000001 00000000`000c0000 : nt!ExpRaiseHardError+0xe1
    fffff880`009a9750 fffff800`034f9066 : fffff880`c0000221 00000000`00000001 00000000`00000001 fffff880`009a9948 : nt!ExRaiseHardError+0x1d6
    fffff880`009a9850 fffff800`0350c3af : 00000000`c0000221 00000000`08000000 fffff800`03592828 ffffffff`80000080 : nt!NtRaiseHardError+0x1e4
    fffff880`009a98f0 fffff800`0350c709 : 00000000`002a0028 00000000`00000000 00000000`00000001 fffff800`035c2a30 : nt!PspLocateSystemDll+0xbf
    fffff880`009a99c0 fffff800`035f631d : fffff800`00812920 00000000`00000002 00000000`00000000 fffff800`0323de80 : nt!PsLocateSystemDlls+0x69
    fffff880`009a9a00 fffff800`035f94ca : 00000000`00000000 00000000`00000010 ffffffff`8000002c fffff800`00812920 : nt!IoInitSystem+0x85d
    fffff880`009a9b00 fffff800`03549979 : 0003cb04`00000001 fffffa80`051e9b60 00000000`00000080 fffffa80`051e9040 : nt!Phase1InitializationDiscard+0x129a
    fffff880`009a9cd0 fffff800`03362fee : 0003daea`00000001 00000000`00000080 00081711`00000000 fffff800`030b95d9 : nt!Phase1Initialization+0x9
    fffff880`009a9d00 fffff800`030b95e6 : fffff800`0323de80 fffffa80`051e9b60 fffff800`0324bcc0 0013541c`0015641c : nt!PspSystemThreadStartup+0x5a
    fffff880`009a9d40 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a93b0 00000000`00000000 : nt!KxStartSystemThread+0x16
    fffff800`033112df cc              int     3
    SYMBOL_NAME:  nt!ExpSystemErrorHandler2+5ff
    FOLLOWUP_NAME:  MachineOwner
    FAILURE_BUCKET_ID:  X64_0xc0000221_nt!ExpSystemErrorHandler2+5ff
    BUCKET_ID:  X64_0xc0000221_nt!ExpSystemErrorHandler2+5ff
    Followup: MachineOwner
    0: kd>  da fffff8a0002400e0
    fffff8a0`002400e0  "\SystemRoot\System32\ntdll.dll"

    -- Mike Burr
    Saturday, December 31, 2011 1:51 AM
  • *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
        If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
        parameters are the exception record and context record. Do a .cxr
        on the 3rd parameter and then kb to obtain a more informative stack
    Arg1: 00000000001904fb
    Arg2: fffff88008ea9b38
    Arg3: fffff88008ea9390
    Arg4: fffff8800126a590
    Debugging Details:
    EXCEPTION_RECORD:  fffff88008ea9b38 -- (.exr 0xfffff88008ea9b38)
    ExceptionAddress: fffff8800126a590 (Ntfs!NtfsSnapshotScbInternal+0x0000000000000160)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000080000060
    Attempt to read from address 0000000080000060
    CONTEXT:  fffff88008ea9390 -- (.cxr 0xfffff88008ea9390)
    rax=0000000080000000 rbx=fffff8a0001cf6f0 rcx=fffff88008eaa6f0
    rdx=fffff8a0001cf6f0 rsi=fffff88008eaa7a0 rdi=fffff88008eaa6f0
    rip=fffff8800126a590 rsp=fffff88008ea9d70 rbp=0000000000000727
     r8=0000000000000000  r9=0000000000000000 r10=fffff880012b6300
    r11=0000000000000000 r12=fffff88008eaa778 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
    fffff880`0126a590 48394860        cmp     qword ptr [rax+60h],rcx ds:002b:00000000`80000060=????????????????
    Resetting default scope
    PROCESS_NAME:  svchost.exe
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    EXCEPTION_PARAMETER1:  0000000000000000
    EXCEPTION_PARAMETER2:  0000000080000060
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b6100
    fffff880`0126a590 48394860        cmp     qword ptr [rax+60h],rcx
    fffff880`0126a590 48394860        cmp     qword ptr [rax+60h],rcx
    BUGCHECK_STR:  0x24
    LAST_CONTROL_TRANSFER:  from fffff88001272792 to fffff8800126a590
    fffff880`08ea9d70 fffff880`01272792 : fffff8a0`001cf6f0 fffff880`08eaa940 fffff880`08eaa6f0 fffff880`08eaa6f0 : Ntfs!NtfsSnapshotScbInternal+0x160
    fffff880`08ea9da0 fffff880`0131d08d : fffff880`08eaa6f0 00000000`00000000 00000000`d70e0000 fffff980`13322400 : Ntfs!NtfsAcquireExclusiveScb+0x4e
    fffff880`08ea9dd0 fffff880`0131b24e : fffff8a0`078cfb01 00000000`00000000 fffff8a0`001cf6f0 fffff8a0`07555780 : Ntfs!NtfsWriteUsnJournalChanges+0xb1
    fffff880`08ea9e50 fffff880`012da3e8 : 00000000`00000000 fffffa80`06620180 fffff880`00000000 00000000`00000000 : Ntfs!NtfsCheckpointCurrentTransaction+0x72
    fffff880`08ea9e80 fffff880`012fb033 : fffff880`08eaa6f0 fffff8a0`07555780 fffff8a0`078cfbc0 fffff880`08eaa188 : Ntfs!NtfsDeleteFile+0x448
    fffff880`08eaa100 fffff880`01269cc9 : 00000000`00000002 00000000`000007ff fffff880`08eaa650 00000000`00006000 : Ntfs!NtfsCommonCleanup+0x1653
    fffff880`08eaa510 fffff800`03090618 : fffff880`08eaa650 00000000`00000000 00000000`00000001 fffff8a0`0915e21c : Ntfs!NtfsCommonCleanupCallout+0x19
    fffff880`08eaa540 fffff880`01269d42 : fffff880`01269cb0 00000000`0000000c fffff880`08eaa900 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
    fffff880`08eaa620 fffff880`01308a04 : fffff880`08eaa6f0 fffff880`08eaa6f0 fffff880`08eaa6f0 00000000`00000000 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
    fffff880`08eaa690 fffff880`010c8bcf : fffff880`08eaa6f0 fffffa80`057c6c10 fffffa80`057c6fb0 fffffa80`06117c30 : Ntfs!NtfsFsdCleanup+0x144
    fffff880`08eaa900 fffff880`010c76df : fffffa80`06249780 00000000`00000000 fffffa80`05d2a700 fffffa80`057c6c10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
    fffff880`08eaa990 fffff800`0338ba0f : fffffa80`057c6c10 fffffa80`076496d0 00000000`00000000 fffffa80`05d6a9d0 : fltmgr!FltpDispatch+0xcf
    fffff880`08eaa9f0 fffff800`0337b174 : 00000000`00000000 fffffa80`076496d0 00000000`00000000 fffff800`0308dafc : nt!IopCloseFile+0x11f
    fffff880`08eaaa80 fffff800`0337af31 : fffffa80`076496d0 fffffa80`00000001 fffff8a0`078e99f0 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4
    fffff880`08eaab00 fffff800`0337b4f4 : 00000000`00000544 fffffa80`076496d0 fffff8a0`078e99f0 00000000`00000544 : nt!ObpCloseHandleTableEntry+0xb1
    fffff880`08eaab90 fffff800`03082ed3 : fffffa80`07ffdb60 fffff880`08eaac60 00000000`01a64870 fffffa80`069a5670 : nt!ObpCloseHandle+0x94
    fffff880`08eaabe0 00000000`773b140a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`0053eb88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x773b140a
    SYMBOL_NAME:  Ntfs!NtfsSnapshotScbInternal+160
    FOLLOWUP_NAME:  MachineOwner
    IMAGE_NAME:  Ntfs.sys
    STACK_COMMAND:  .cxr 0xfffff88008ea9390 ; kb
    FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsSnapshotScbInternal+160
    BUCKET_ID:  X64_0x24_Ntfs!NtfsSnapshotScbInternal+160
    Followup: MachineOwner
    Please start by running chkdsk /r /f. If you have unresolved errors then possible that you have hardware problems. For that, I would recommend contacting your manufacturer Technical Support for assistance in this case.
    Please also do that:
    • Update all possible drivers
    • Uninstall all unused programs
    • Disable all security softwares that you have
    • Run memtest86+. If an error was detected then replace the faulty RAM or contact your manufacturer Technical Support

    Once done, check results.

    You can also contact Microsoft CSS for assistance.

    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. 

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
    Microsoft Certified IT Professional: Enterprise Administrator
    Microsoft Certified IT Professional: Server Administrator
    Microsoft Certified Trainer

    Saturday, December 31, 2011 2:48 PM
  • I checked my memory, at first It gave me a bunch of errors on memtest86. Then I removed my ram and tested each stick in each slot and all passed, I re-installed the ram and tried different combinations all passed. I am not sure why it failed the first time and now all is passing I am hoping maybe one was just seated improperly. I am going to see if I crash or not over the next few hours.
    Sunday, January 1, 2012 10:57 PM