locked
System repeated BSOD, system restore ineffective. RRS feed

  • Question

  • Yesterday I started getting random bsods, referencing bugcheck  0x00000050 and  0x00000024 .

    As well as following errors like so: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.

    The Peer Name Resolution Protocol service terminated with the following error:
    %%-2140993535

    The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error:
    %%-2140993535

     

    0x00000050:


    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 50, {fffffffffffffff4, 0, fffff80002e02dd3, 0}


    Could not read faulting driver name
    Probably caused by : cdd.dll ( cdd!CddBitmap::Release+33 )

    Followup: MachineOwner
    ---------

    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffffffffffffff4, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff80002e02dd3, If non-zero, the instruction address which referenced the bad memory
        address.
    Arg4: 0000000000000000, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f06100
     fffffffffffffff4

    FAULTING_IP:
    nt!ExFreePoolWithTag+43
    fffff800`02e02dd3 418b45f0        mov     eax,dword ptr [r13-10h]

    MM_INTERNAL_CODE:  0

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  dwm.exe

    CURRENT_IRQL:  0

    TRAP_FRAME:  fffff88007571420 -- (.trap 0xfffff88007571420)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000004
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002e02dd3 rsp=fffff880075715b0 rbp=fffff900c00d0020
     r8=0000000000000000  r9=0000000000000000 r10=fffff90000000240
    r11=fffffa8007167440 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe nc
    nt!ExFreePoolWithTag+0x43:
    fffff800`02e02dd3 418b45f0        mov     eax,dword ptr [r13-10h] ds:ffffffff`fffffff0=????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from fffff80002c82a0c to fffff80002cd6d00

    STACK_TEXT: 
    fffff880`075712b8 fffff800`02c82a0c : 00000000`00000050 ffffffff`fffffff4 00000000`00000000 fffff880`07571420 : nt!KeBugCheckEx
    fffff880`075712c0 fffff800`02cd4e2e : 00000000`00000000 ffffffff`fffffff4 0000ffff`00000000 fffffa80`03cda1d0 : nt! ?? ::FNODOBFM::`string'+0x4621f
    fffff880`07571420 fffff800`02e02dd3 : 00000000`00000010 fffff800`02cbcf2b fffffa80`0654fb60 fffff800`02cdd03a : nt!KiPageFault+0x16e
    fffff880`075715b0 fffff800`02cb4b70 : 00000000`00000000 fffff900`c26f09e0 fffffa80`03cda1b0 00000000`00000030 : nt!ExFreePoolWithTag+0x43
    fffff880`07571660 fffff960`00199018 : fffff900`c26f09e0 fffff900`c00d0020 00000000`80002ac0 00000000`00000001 : nt!ExDeleteResourceLite+0x190
    fffff880`075716c0 fffff960`006ac847 : fffff900`c26f09e0 fffff900`c00d14e8 fffff900`c021a640 00000000`0000007f : win32k!GreDeleteSemaphore+0x24
    fffff880`075716f0 fffff960`006adefb : fffffa80`06fa45c0 00000000`80002ac0 00001198`075717c8 fffff900`c21d0970 : cdd!CddBitmap::Release+0x33
    fffff880`07571720 fffff960`000d5804 : 00000000`00000001 fffff900`c0110280 00000000`00000001 fffff900`c21f4010 : cdd!CddBitmapHw::Release+0x2db
    fffff880`07571760 fffff960`000d5bc4 : fffff900`00000000 00000000`00000000 fffff900`c21f4010 fffff880`00000000 : win32k!SURFACE::bDeleteSurface+0x358
    fffff880`075718b0 fffff960`0023f4ff : fffff900`c2b28e38 fffff900`c21f4010 ffffffff`ba051198 fffffa80`0655eaf0 : win32k!bDeleteSurface+0x34
    fffff880`075718e0 fffff960`000d5804 : fffff900`c0109010 fffff900`c212e010 00000000`00010007 fffff880`07571a20 : win32k!MulDeleteDeviceOrRedirectionBitmap+0x67
    fffff880`07571910 fffff960`0020e3ab : 00000000`00000000 00000000`00000000 00000000`00007505 00000000`00000000 : win32k!SURFACE::bDeleteSurface+0x358
    fffff880`07571a60 fffff960`0028ed78 : fffff900`c210e540 00000000`00000001 fffff900`c212e010 ffffffff`ad12127d : win32k!GreDereferenceObject+0x7b
    fffff880`07571aa0 fffff960`0028fd97 : 00000000`00000000 ffffffff`ad12127d fffff900`c210e540 00000000`03e74ca0 : win32k!SFMLOGICALSURFACE::DeInitialize+0x88
    fffff880`07571ae0 fffff960`001ec41f : 00000000`00000000 fffff900`c0109010 fffff900`c210e540 00000000`00000020 : win32k!bhLSurfDestroyLogicalSurfaceObject+0x4b
    fffff880`07571b20 fffff960`0020d70c : 00000800`00000001 00000000`00000001 fffff880`07571c60 00000000`00000000 : win32k!GreSfmCloseCompositorRef+0x10f
    fffff880`07571b60 fffff800`02cd5f93 : fffffa80`07167440 00000000`025dfa30 000007fe`f85fc610 00000000`00000000 : win32k!NtGdiHLSurfSetInformation+0x1a8
    fffff880`07571be0 000007fe`ff454a3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`025df488 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`ff454a3a


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    cdd!CddBitmap::Release+33
    fffff960`006ac847 4883634800      and     qword ptr [rbx+48h],0

    SYMBOL_STACK_INDEX:  6

    SYMBOL_NAME:  cdd!CddBitmap::Release+33

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: cdd

    IMAGE_NAME:  cdd.dll

    DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7c546

    FAILURE_BUCKET_ID:  X64_0x50_cdd!CddBitmap::Release+33

    BUCKET_ID:  X64_0x50_cdd!CddBitmap::Release+33

    Followup: MachineOwner
    ---------

     

     

    and 0x0000002:

     

    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 24, {1904fb, fffff8800319a6f8, fffff88003199f50, fffff88001274939}

    Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteReservedBitmap+31 )

    Followup: MachineOwner
    ---------

    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    NTFS_FILE_SYSTEM (24)
        If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
        parameters are the exception record and context record. Do a .cxr
        on the 3rd parameter and then kb to obtain a more informative stack
        trace.
    Arguments:
    Arg1: 00000000001904fb
    Arg2: fffff8800319a6f8
    Arg3: fffff88003199f50
    Arg4: fffff88001274939

    Debugging Details:
    ------------------


    EXCEPTION_RECORD:  fffff8800319a6f8 -- (.exr 0xfffff8800319a6f8)
    ExceptionAddress: fffff88001274939 (Ntfs!NtfsDeleteReservedBitmap+0x0000000000000031)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000004
    Attempt to read from address 0000000000000004

    CONTEXT:  fffff88003199f50 -- (.cxr 0xfffff88003199f50)
    rax=fffff8a00b46fbc0 rbx=fffff8a00b46fbc0 rcx=fffff8a00b46fbc0
    rdx=fffffa8003c765c8 rsi=0000000000000004 rdi=0000000000000000
    rip=fffff88001274939 rsp=fffff8800319a930 rbp=0000000000000130
     r8=fffffa8003cda010  r9=ffffffffffffffff r10=fffff880010995c0
    r11=fffffa8003b94510 r12=0000000000000705 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
    Ntfs!NtfsDeleteReservedBitmap+0x31:
    fffff880`01274939 48833e00        cmp     qword ptr [rsi],0 ds:002b:00000000`00000004=????????????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  1

    PROCESS_NAME:  System

    CURRENT_IRQL:  0

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_PARAMETER1:  0000000000000000

    EXCEPTION_PARAMETER2:  0000000000000004

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb4100
     0000000000000004

    FOLLOWUP_IP:
    Ntfs!NtfsDeleteReservedBitmap+31
    fffff880`01274939 48833e00        cmp     qword ptr [rsi],0

    FAULTING_IP:
    Ntfs!NtfsDeleteReservedBitmap+31
    fffff880`01274939 48833e00        cmp     qword ptr [rsi],0

    BUGCHECK_STR:  0x24

    DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

    LAST_CONTROL_TRANSFER:  from fffff8800128dd91 to fffff88001274939

    STACK_TEXT: 
    fffff880`0319a930 fffff880`0128dd91 : fffff880`0319a9e8 00000000`00000706 fffff880`0319a9e8 00000000`00000706 : Ntfs!NtfsDeleteReservedBitmap+0x31
    fffff880`0319a960 fffff880`01292cc1 : 00000000`01010000 00000000`00000000 fffff800`02e22200 00000000`00000001 : Ntfs!NtfsDeleteScb+0x2ed
    fffff880`0319a9a0 fffff880`0120b85c : fffff8a0`0b46fac0 fffff8a0`0b46fbc0 fffff800`02e22200 fffff880`0319ab12 : Ntfs!NtfsRemoveScb+0x61
    fffff880`0319a9e0 fffff880`0129064c : fffff8a0`0b46fa90 fffff800`02e22260 fffff880`0319ab12 fffffa80`03b3fe40 : Ntfs!NtfsPrepareFcbForRemoval+0x50
    fffff880`0319aa10 fffff880`012120e2 : fffffa80`03b3fe40 fffffa80`03b3fe40 fffff8a0`0b46fa90 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xdc
    fffff880`0319aa90 fffff880`012a0193 : fffffa80`03b3fe40 fffff800`02e22260 fffff8a0`0b46fa90 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
    fffff880`0319aad0 fffff880`0128f357 : fffffa80`03b3fe40 fffff8a0`0b46fbc0 fffff8a0`0b46fa90 fffffa80`05a68180 : Ntfs!NtfsCommonClose+0x353
    fffff880`0319aba0 fffff800`02c8f021 : 00000000`00000000 fffff800`02f7b000 fffff800`02e83801 00000000`00000002 : Ntfs!NtfsFspClose+0x15f
    fffff880`0319ac70 fffff800`02f2132e : 00000000`00000000 fffffa80`037041a0 00000000`00000080 fffffa80`036d9040 : nt!ExpWorkerThread+0x111
    fffff880`0319ad00 fffff800`02c76666 : fffff880`02f63180 fffffa80`037041a0 fffff880`02f6dfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
    fffff880`0319ad40 00000000`00000000 : fffff880`0319b000 fffff880`03195000 fffff880`0319a6c0 00000000`00000000 : nt!KiStartSystemThread+0x16


    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  Ntfs!NtfsDeleteReservedBitmap+31

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: Ntfs

    IMAGE_NAME:  Ntfs.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

    STACK_COMMAND:  .cxr 0xfffff88003199f50 ; kb

    FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsDeleteReservedBitmap+31

    BUCKET_ID:  X64_0x24_Ntfs!NtfsDeleteReservedBitmap+31

    Followup: MachineOwner
    ---------

    Tuesday, June 7, 2011 9:27 AM

Answers

  • All 3 BSOD types have NTFS corruption/disk issues as one of their usual causes, that's what the STACK_TEXT in both debugged BSOD's feels like to me.

    Use the CD (downloadable ISO, use imgburn to create the bootable CD) from your hard drive manufacturer to check the drive for errors.

    Run Chkdsk /r on the drive - it will need to do this scheduled at boot, once the reboot and check have completed, insert your Windows DVD into the machine and run SFC /scannow.

     

    • Marked as answer by Stalker7d7 Thursday, June 9, 2011 12:21 PM
    Wednesday, June 8, 2011 4:23 PM
  • Hello,

    as you have multiple BSODs, start by updating all possible drivers / firmwares / BIOS. Once done, check again.

    If chkdsk /r /f gave no result then I suspect that you have a disk problem and in this case I recommend that you contact your manufacturer Technical Support.

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified IT Professional: Enterprise Administrator

    • Marked as answer by Stalker7d7 Thursday, June 9, 2011 12:21 PM
    Wednesday, June 8, 2011 6:44 PM

All replies

  • Bug Check Code 0x50: http://msdn.microsoft.com/en-us/library/ff559023(VS.85).aspx

    Run chkdsk /r /f and check if this solve your problem.

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified IT Professional: Enterprise Administrator

    Tuesday, June 7, 2011 11:24 AM
  • I did, and it didn't.

     

    I also wiped the drive clean, and reinstalled the windows 7 OS completely.  And I am still having major problems.

     

    BSOD's:

    0x19  1 of these

    0x50  3 of these

    0x3b  3 of these

    0x0a  2 of these

     

    I get bsod every time I try to use windows update to install SP1. 

     

    I had the problem of windows update checking for updates indefinately(not actually doing anything but saying it was checking for updated) and fixed with microsoft fixit 50202 [http://support.microsoft.com/kb/971058].

    Microsoft security essentials however has the problem as well.  And just keeps checking until it eventually says "connection failed" when I do actually have an active internet connection(wired).

     

    Here's a bit from my event logs:

    [The Windows Modules Installer service terminated unexpectedly.  It has done this 2 time(s).  The following corrective action will be taken in 300000 milliseconds: Restart the service.]

     

    [Faulting application name: TrustedInstaller.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc4b0
    Faulting module name: wcp.dll, version: 6.1.7601.17592, time stamp: 0x4da00342
    Exception code: 0x80000003
    Fault offset: 0x00000000000a0b9e
    Faulting process id: 0xb4c
    Faulting application start time: 0x01cc25f1ea7b4b17
    Faulting application path: C:\Windows\servicing\TrustedInstaller.exe
    Faulting module path: C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17592_none_672ce6c3de2cb17f\wcp.dll
    Report Id: 350b0933-91e5-11e0-9b45-6cf0497709dc]

     

    [Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.
         Feature: Network Inspection System
         Error Code: 0x8007042c
         Error description: The dependency service or group failed to start.
         Reason: The system is missing updates that are required for running Network Inspection System.  Install the required updates and restart the computer.]

     

    [Audit events have been dropped by the transport.  0]

     

     

     

     

    When I had Ubuntu on my system however, I had 0 errors.  I had ubuntu because my oem windows 7 disk is apparently corrupt and couldn't install windows 7 properly forcing me to wipe my drive.  I used ubuntu to download an oem copy which worked, using that to reinstall windows.  Everything was good until the first boot(setting up for first boot thing), where is BSOD'd.

     

    Anything else you want to know?  Want the dump files?  Tell me where to upload them and I will...  All ∞ of them.

     

     

     

     

     

    Wednesday, June 8, 2011 4:00 PM
  • I've just downloaded service pack 1 manually, and am attempting an install(risky move I know).
    Wednesday, June 8, 2011 4:02 PM
  • Instant BSOD after I closed firefox(making me regret my current decision to open firefox again instead of IE or something else).

     

    0x7e   a new one....

    Wednesday, June 8, 2011 4:07 PM
  • 0x24 bluescreen during installation attempt.
    Wednesday, June 8, 2011 4:18 PM
  • All 3 BSOD types have NTFS corruption/disk issues as one of their usual causes, that's what the STACK_TEXT in both debugged BSOD's feels like to me.

    Use the CD (downloadable ISO, use imgburn to create the bootable CD) from your hard drive manufacturer to check the drive for errors.

    Run Chkdsk /r on the drive - it will need to do this scheduled at boot, once the reboot and check have completed, insert your Windows DVD into the machine and run SFC /scannow.

     

    • Marked as answer by Stalker7d7 Thursday, June 9, 2011 12:21 PM
    Wednesday, June 8, 2011 4:23 PM
  • Hello,

    as you have multiple BSODs, start by updating all possible drivers / firmwares / BIOS. Once done, check again.

    If chkdsk /r /f gave no result then I suspect that you have a disk problem and in this case I recommend that you contact your manufacturer Technical Support.

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified IT Professional: Enterprise Administrator

    • Marked as answer by Stalker7d7 Thursday, June 9, 2011 12:21 PM
    Wednesday, June 8, 2011 6:44 PM
  • ran chkdsk 3 times got nothin.  Ran the HD manufacturer CD and it said (after extended test) that there were no problems.  Yet the BSOD still persist.  All drivers are latest version.  Even got bsod in safe mode when idling.

     

    Going to get a spare hdd to install OS on. 

     

     

    Wednesday, June 8, 2011 11:06 PM
  • Check and disconnect/reconnect all drive connections. You could also test the hardware side of the computer by booting with a LiveCD and surf the 'net and watch flash movies, etc. for a while. If that pans out ok after a few hours, suspect malware, eg. a rootkit/bootkit MBR infection - MS have recently released a bootable anti-malware ISO, try downloading it from here: http://connect.microsoft.com/systemsweeper
    • Proposed as answer by Miya Yao Thursday, June 9, 2011 6:46 AM
    Wednesday, June 8, 2011 11:16 PM
  • good ideas, I'll try them.  Easier than finding a spare(old) hdd that still works...
    Thursday, June 9, 2011 12:45 AM
  • It was a bad hard drive.  Although all tests performed on the hard drive showed no errors, the hard drive did not work right. 

     

    I installed the OS on an older 120GB hard drive with no problems.  Installed all updates with no problems.  Did normal computing things with no problems.  No BSOD, no updating problems, no nothing.

     

    Any idea what could be wrong with the hard drive?  Why it doesn't work, but at the same time doesn't give any errors when tested?

    Thursday, June 9, 2011 11:11 AM
  • Difficult to say what the cause might be, I wouldn't offer a possible reason without actually running a few tests on it live and listening/feeling it as it starts and during testing. Some drives are better than others and some makers make new firmware available as they discover/fix bugs but, unfortunately, there's little real, honest data out there about them.

    The latest in a series of breakdowns of hardware returns rates from a French e-tailer is here, it makes interesting reading over the 2-3 years it's been running: http://www.behardware.com/art/imprimer/831/

    Thursday, June 9, 2011 11:28 AM
  • Wrote zero's to entire disk (using the diag CD).  Have windows ultimate up and running on it.  No problems yet.  Will see if anything happens.

     

     

    Friday, June 10, 2011 5:10 PM
  • I guess two more factors to take into account are:

     

    -Current drive on System 1(where original went 'bad') is IDE as opposed to SATA.

    -'Bad' drive is on system 2, different motherboard.

     

    With the current lack of any errors, it seems to me there are 2 possibilities: 

    Either A:  SATA port 0 on the motherboard of system 1 is malfunctioning?

    or B:  Writing zero's do the entire disk cleared up some low level problem that effected the integrity of the disk while running?

     

    Any ideas?

     

     

    Keep in mind I have a 2 TB storage drive installed in SATA port 1 on system 1, with no problems.


    Friday, June 10, 2011 5:42 PM