BleepingComputer.com: blue screen crash

i can restart my pc without a problem but if i shut it down overnight then when i atart it up it crashes and then restarts itsself anf i cant read the stop errorr page or see it it restarts so fast and then it will boot into windows after about 5 minutes or so

i was able to copy the unexpexted shutdown notice today here is what it says


Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.0.6001.2.1.0.256.1
Locale ID: 1033

Additional information about the problem:
BCCode: c2
BCP1: 00000007
BCP2: 0000110B
BCP3: 00000000
BCP4: 8884A410
OS Version: 6_0_6001
Service Pack: 1_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\Mini031309-01.dmp
C:\Users\Dad1\AppData\Local\Temp\WER-36379027-0.sysdata.xml
C:\Users\Dad1\AppData\Local\Temp\WER3AC9.tmp.version.txt

Read our privacy statement:
http://go.microsoft.com/fwlink/?linkid=501...mp;clcid=0x0409
i am using the hp media center with vista / xp pro dual boot
both op systems work ok but i keep getting the error when i turn on the pc
any help would be appreciated ty

I'd suggest that you follow the instructions in this topic to perform an analysis of the error: http://www.bleepingcomputer.com/forums/topic176011.html
Typically these things are caused by a bad/buggy driver accessing memory in an unapproved way - so isolating it may be difficult. But we can't tell without a copy of the analysis.
Have you changed anything on the system recently?

just installed xp pro on my secondary hard drive
so i m dual booting xp and vista
it was working ok except for the crash upon startup

ok heres the mini dump debug report see what u can make of it.....




Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini031309-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

;C:\symbols
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18145.x86fre.vistasp1_gdr.080917-1612
Machine Name:
Kernel base = 0x8244e000 PsLoadedModuleList = 0x82565c70
Debug session time: Fri Mar 13 06:20:17.863 2009 (GMT-5)
System Uptime: 0 days 0:00:31.566
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, 110b, 0, 8884a410}

GetPointerFromAddress: unable to read from 82585868
Unable to read MiSystemVaType memory at 82565420
*** WARNING: Unable to verify timestamp for btwavdt.sys
*** ERROR: Module load completed but symbols could not be loaded for btwavdt.sys
*** WARNING: Unable to verify timestamp for btwaudio.sys
*** ERROR: Module load completed but symbols could not be loaded for btwaudio.sys
*** WARNING: Unable to verify timestamp for iaStor.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStor.sys
*** WARNING: Unable to verify timestamp for iastorv.sys
*** ERROR: Module load completed but symbols could not be loaded for iastorv.sys
*** WARNING: Unable to verify timestamp for PxHelp20.sys
*** ERROR: Module load completed but symbols could not be loaded for PxHelp20.sys
*** ERROR: Module load completed but symbols could not be loaded for spldr.sys
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
*** WARNING: Unable to verify timestamp for nvBridge.kmd
*** ERROR: Module load completed but symbols could not be loaded for nvBridge.kmd
*** WARNING: Unable to verify timestamp for HS3dSensor1394.sys
*** ERROR: Module load completed but symbols could not be loaded for HS3dSensor1394.sys
*** WARNING: Unable to verify timestamp for e1e6032.sys
*** ERROR: Module load completed but symbols could not be loaded for e1e6032.sys
*** WARNING: Unable to verify timestamp for hcw18bda.sys
*** ERROR: Module load completed but symbols could not be loaded for hcw18bda.sys
*** WARNING: Unable to verify timestamp for athr.sys
*** ERROR: Module load completed but symbols could not be loaded for athr.sys
*** WARNING: Unable to verify timestamp for HSXHWBS2.sys
*** ERROR: Module load completed but symbols could not be loaded for HSXHWBS2.sys
*** WARNING: Unable to verify timestamp for HSX_DP.sys
*** ERROR: Module load completed but symbols could not be loaded for HSX_DP.sys
*** WARNING: Unable to verify timestamp for HSX_CNXT.sys
*** ERROR: Module load completed but symbols could not be loaded for HSX_CNXT.sys
*** WARNING: Unable to verify timestamp for GEARAspiWDM.sys
*** ERROR: Module load completed but symbols could not be loaded for GEARAspiWDM.sys
*** WARNING: Unable to verify timestamp for ISODrive.sys
*** ERROR: Module load completed but symbols could not be loaded for ISODrive.sys
*** WARNING: Unable to verify timestamp for aswSP.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswSP.SYS
*** WARNING: Unable to verify timestamp for RTKVHDA.sys
*** ERROR: Module load completed but symbols could not be loaded for RTKVHDA.sys
*** WARNING: Unable to verify timestamp for drmk.sys
*** ERROR: Module load completed but symbols could not be loaded for drmk.sys
*** WARNING: Unable to verify timestamp for aswTdi.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswTdi.SYS
*** WARNING: Unable to verify timestamp for aswRdr.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswRdr.SYS
*** WARNING: Unable to verify timestamp for btwrchid.sys
*** ERROR: Module load completed but symbols could not be loaded for btwrchid.sys
*** WARNING: Unable to verify timestamp for dump_iaStor.sys
*** ERROR: Module load completed but symbols could not be loaded for dump_iaStor.sys
*** WARNING: Unable to verify timestamp for aswMonFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for aswMonFlt.sys
*** WARNING: Unable to verify timestamp for aswFsBlk.sys
*** ERROR: Module load completed but symbols could not be loaded for aswFsBlk.sys
*** WARNING: Unable to verify timestamp for DefragFS.SYS
*** ERROR: Module load completed but symbols could not be loaded for DefragFS.SYS
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
*** WARNING: Unable to verify timestamp for TSDDD.dll
*** ERROR: Module load completed but symbols could not be loaded for TSDDD.dll
*** WARNING: Unable to verify timestamp for cdd.dll
*** ERROR: Module load completed but symbols could not be loaded for cdd.dll
*** WARNING: Unable to verify timestamp for spsys.sys
*** ERROR: Module load completed but symbols could not be loaded for spsys.sys
Probably caused by : ecache.sys ( ecache!EcMdlFree+23 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 0000110b, (reserved)
Arg3: 00000000, Memory contents of the pool block
Arg4: 8884a410, Address of the block of pool being deallocated

Debugging Details:
------------------

GetPointerFromAddress: unable to read from 82585868
Unable to read MiSystemVaType memory at 82565420

POOL_ADDRESS: GetPointerFromAddress: unable to read from 82585868
Unable to read MiSystemVaType memory at 82565420
8884a410

BUGCHECK_STR: 0xc2_7

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 8253c00c to 8251b0e3

STACK_TEXT:
8c7c55bc 8253c00c 000000c2 00000007 0000110b nt!KeBugCheckEx+0x1e
8c7c5630 82493f7e 8884a410 00000000 879e2a40 nt!ExFreePoolWithTag+0x17f
8c7c564c 8b96bf0d 8884a410 8b980500 889c4c60 nt!IoFreeMdl+0x73
8c7c5660 8b973838 879e2a40 8b980500 889c4cb8 ecache!EcMdlFree+0x23
8c7c56f0 8b975888 889c4c60 889c4cb8 8b980500 ecache!EcCacheIoCleanup+0xa8
8c7c5c8c 8b976e54 889c4c60 00000000 85c88430 ecache!EcCacheIoDereference+0x558
8c7c5d7c 82623b18 8b980500 b5deb91e 00000000 ecache!EcCacheIoWorker+0x886
8c7c5dc0 8247ca2e 8b9765ce 8b980500 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
ecache!EcMdlFree+23
8b96bf0d 6a00 push 0

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: ecache!EcMdlFree+23

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ecache

IMAGE_NAME: ecache.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47918fb7

FAILURE_BUCKET_ID: 0xc2_7_ecache!EcMdlFree+23

BUCKET_ID: 0xc2_7_ecache!EcMdlFree+23

Followup: MachineOwner
---------

1: kd> lmvm ecache
start end module name
8b969000 8b990000 ecache (pdb symbols) c:\symbols\ecache.pdb\9435C63CF684452B8E175ECD6EBEEB501\ecache.pdb
Loaded symbol image file: ecache.sys
Mapped memory image file: c:\symbols\ecache.sys\47918FB727000\ecache.sys
Image path: \SystemRoot\System32\drivers\ecache.sys
Image name: ecache.sys
Timestamp: Fri Jan 18 23:50:47 2008 (47918FB7)
CheckSum: 0002BF07
ImageSize: 00027000
File version: 6.0.6001.18000
Product version: 6.0.6001.18000
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0000.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ecache.sys
OriginalFilename: ecache.sys
ProductVersion: 6.0.6001.18000
FileVersion: 6.0.6001.18000 (longhorn_rtm.080118-1840)
FileDescription: Special Memory Device Cache
LegalCopyright: © Microsoft Corporation. All rights reserved.

Looks to me like ecache.sys is the problem (but your symbols aren't correct - so something could be missing).
This is reinforced by the presence of ecache in the stack shortly before the system crashed

Does this article describe your problem (disregarding the STOP error information in it)? http://support.microsoft.com/kb/941020

Ok that wasnt a good dump analysis so heres the one from the day before that is complete sybol wise


Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini031209-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18145.x86fre.vistasp1_gdr.080917-1612
Machine Name:
Kernel base = 0x8244a000 PsLoadedModuleList = 0x82561c70
Debug session time: Thu Mar 12 07:20:48.327 2009 (GMT-5)
System Uptime: 0 days 0:00:20.155
Loading Kernel Symbols
...............................................................
................................................................
........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904aa, 8c34f6d4, 8c34f3d0, 8b891d4a}

Probably caused by : Ntfs.sys ( Ntfs!NtfsAddRecentlyDeallocated+a9 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001904aa
Arg2: 8c34f6d4
Arg3: 8c34f3d0
Arg4: 8b891d4a

Debugging Details:
------------------


EXCEPTION_RECORD: 8c34f6d4 -- (.exr 0xffffffff8c34f6d4)
ExceptionAddress: 8b891d4a (Ntfs!NtfsAddRecentlyDeallocated+0x000000a9)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000020
Attempt to read from address 00000020

CONTEXT: 8c34f3d0 -- (.cxr 0xffffffff8c34f3d0)
eax=882e5730 ebx=00000000 ecx=00000000 edx=00000000 esi=8c34fa3c edi=882e5418
eip=8b891d4a esp=8c34f79c ebp=8c34f7d8 iopl=0 nv up ei pl nz na po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010203
Ntfs!NtfsAddRecentlyDeallocated+0xa9:
8b891d4a 8b4320 mov eax,dword ptr [ebx+20h] ds:0023:00000020=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 00000020

READ_ADDRESS: GetPointerFromAddress: unable to read from 82581868
Unable to read MiSystemVaType memory at 82561420
00000020

FOLLOWUP_IP:
Ntfs!NtfsAddRecentlyDeallocated+a9
8b891d4a 8b4320 mov eax,dword ptr [ebx+20h]

FAULTING_IP:
Ntfs!NtfsAddRecentlyDeallocated+a9
8b891d4a 8b4320 mov eax,dword ptr [ebx+20h]

BUGCHECK_STR: 0x24

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER: from 8b851ade to 8b891d4a

STACK_TEXT:
8c34f7d8 8b851ade 00000000 06be8000 00000000 Ntfs!NtfsAddRecentlyDeallocated+0xa9
8c34fa70 8b853eb8 875530b0 882e5498 00000000 Ntfs!NtfsScanEntireBitmap+0x16a
8c34fab4 8b8534c1 875530b0 882e5498 07b087db Ntfs!NtfsInitializeClusterAllocation+0x4d
8c34fca0 8b8a0963 875530b0 8765d510 8c34fcc0 Ntfs!NtfsMountVolume+0x1779
8c34fcc4 8b81303e 875530b0 8765d510 07b0863f Ntfs!NtfsCommonFileSystemControl+0x80
8c34fd44 82482445 00000000 00000000 84f73d78 Ntfs!NtfsFspDispatch+0x264
8c34fd7c 8261fb18 875530b0 5d337253 00000000 nt!ExpWorkerThread+0xfd
8c34fdc0 82478a2e 82482348 00000000 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: Ntfs!NtfsAddRecentlyDeallocated+a9

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47918a96

STACK_COMMAND: .cxr 0xffffffff8c34f3d0 ; kb

FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsAddRecentlyDeallocated+a9

BUCKET_ID: 0x24_Ntfs!NtfsAddRecentlyDeallocated+a9

Followup: MachineOwner
---------

I have looked at all the other mini dumps and they all resemble this one

NTFS.sys refers to the file system on your hard drive.
The "fix" for that is to run Startup Repair: http://www.bleepingcomputer.com/tutorials/repair-windows-with-windows-startup-repair/

BUT, that's not all that could be causing it - so I'd also suggest a hard drive diagnostic from the manufacturer of your hard drive. Links to the most common ones are in this topic: http://www.bleepingcomputer.com/forums/topic28744.html

Finally, since these are errors in memory - I'd suggest running the Vista memory diagnostic: http://www.bleepingcomputer.com/tutorials/using-vista-windows-memory-diagnostics-tool/

Also, I'm wondering if you have any removable devices installed that are formatted with NTFS. That would help to explain issues both with ecache and ntfs (but isn't a 100% solution). If so, did the BSOD's occur when the device was in the machine? Try the system with that device unplugged to see what happens.

i have a removable pmd (1000 gb hp) USB
u think i should remove it and see if it still crashes?

Yes, it's worth a try. If it's formatted with NTFS, then it's definitely worth a try (and that KB article above discusses the issue that you're facing).

well i tried start up repair it said nothing was wrong
memory diag said nothing was wrong
the wd diag said there were errors on the c drive but it couldnt repair them
I will try removing the pmd now

Can you give us more info about the errors that couldn't be repaired?
If there's a problem with the disk, this could be the reason for the BSOD's

Test Option: QUICK TEST
Model Number: WDC WD3200AAJS-65RYA0
Unit Serial Number: WD-WMAPZ0507045
Firmware Number: 12.01B01
Capacity: 320.07 GB
SMART Status: PASS
Test Result: FAIL
Test Error Code: 06-Quick Test on drive 1 did not complete! Status code = 07 (Failed read test element), Failure Checkpoint = 65 (Error Log Test) SMART self-test did not complete on drive 1!
Test Time: 09:28:36, March 14, 2009

Test Option: EXTENDED TEST
Model Number: WDC WD3200AAJS-65RYA0
Unit Serial Number: WD-WMAPZ0507045
Firmware Number: 12.01B01
Capacity: 320.07 GB
SMART Status: PASS
Test Result: FAIL
Test Error Code: 08-Error was detected while repairing bad sectors.
Test Time: 10:50:10, March 14, 2009

this is all the info i have on the disk scan

do you want to see the debug report from todays crash on start up ?

No need. About 2/3 of the way down this page you'll find the error 0008: http://support.wdc.com/techinfo/general/errorcodes.asp
The drive is defective and needs to be replaced.

ok it said run the test again so i did and the c drive passed this time
heres the report

Test Option: EXTENDED TEST
Model Number: WDC WD3200AAJS-65RYA0
Unit Serial Number: WD-WMAPZ0507045
Firmware Number: 12.01B01
Capacity: 320.07 GB
SMART Status: PASS
Test Result: PASS
Test Time: 17:48:27, March 16, 2009


so theres a driver or something causing the bsod
i took the removable drive out
it still crashed at start up
the only other recent changes ive made was to add two more sticks of ram
so i need to rule that out how can i test the ram ?

never mind about the memory test
i see we all ready did that
so now i dont know what to do
reformat maybe?