Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Very Annoying BSOD [HELP PLEASE]


  • Please log in to reply
20 replies to this topic

#1 mrnerdisg0d

mrnerdisg0d

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:24 PM

Posted 26 August 2013 - 11:25 PM

I been having this problem a while...so I decided to just finally ask for help since I cant seem to figure out what it is.

 

I mainly get  ntoskrnl.exe BSOD Errors.

 

 

Speccy:

 

http://speccy.piriform.com/results/EW3Lv7cN8ZqlLSFE5SlamdO

 

 

Minitoolbox [Result.txt] is attached

 

BSOD. Dump File is attached also.

 

 

thanks for anyone who can help me!!

 

its driving me crazy!

Attached Files



BC AdBot (Login to Remove)

 


#2 jhayz

jhayz

  • BC Advisor
  • 6,922 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:24 AM

Posted 26 August 2013 - 11:50 PM

Hi and Welcome to Bleeping Computer :)

 

While waiting for further suggestions. What particular events or actions does the bluescreen happens? The old Microsoft article refers generally of certain causes as quoted :


 

 

This behavior occurs when drivers do not handle power state transition requests properly. The error message most often occurs during one of the following actions:

  • Shutting down

  • Suspending or resuming from Standby mode

  • Suspending or resuming from Hibernate mode

 


Tekken
 


#3 mrnerdisg0d

mrnerdisg0d
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:24 PM

Posted 27 August 2013 - 12:11 AM

 

Hi and Welcome to Bleeping Computer :)

 

While waiting for further suggestions. What particular events or actions does the bluescreen happens? The old Microsoft article refers generally of certain causes as quoted :


 

 

This behavior occurs when drivers do not handle power state transition requests properly. The error message most often occurs during one of the following actions:

  • Shutting down

  • Suspending or resuming from Standby mode

  • Suspending or resuming from Hibernate mode

THANK YOU!!

 

 its always random ... ill be on fb or on tumblr.. or youtube...or on steam...it hasnt done it while i was playing a game...but ill leave for a few hours come home and my computer is off...i have 3 different browsers so I know it cant be that. but i could be wrong..

 



#4 jhayz

jhayz

  • BC Advisor
  • 6,922 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:24 AM

Posted 27 August 2013 - 12:22 AM

Please go to C:\Windows\Minidump folder. Do you see any dmp logs from the folder?  If yes, then read the instruction of the second paragraph below.If not, configure kernel memory dump debugging information under startup and recovery.

> Right-click My Computer and choose Properties.
> Go to Advanced System Settings - Advance Tab.
> Under Startup and Recovery, click Settings...
> Look for 'write debugging information' and use Kernel memory dump
> Checkmark overwrite any existing file

If there are latest created minidumps under C:\Windows\Minidump folder, please post the latest dmp logs (atleast 5) by :

> Highlight (holding ctrl key) and choosing the dmp logs by hitting enter or left mouse click.
> Right-click and choose send to desktop.
> When on desktop, highlight all dmp logs and right-click and send to compressed zipped folder.
> Upload and share the link by registering here https://www.box.com/
* minidumps log sample 010613 - 16676 -01.dmp -> 01 is for month - 06 for day - 13 is for year.


Edited by jhayz, 27 August 2013 - 12:23 AM.

Tekken
 


#5 mrnerdisg0d

mrnerdisg0d
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:24 PM

Posted 27 August 2013 - 12:26 AM

Please go to C:\Windows\Minidump folder. Do you see any dmp logs from the folder?  If yes, then read the instruction of the second paragraph below.If not, configure kernel memory dump debugging information under startup and recovery.

> Right-click My Computer and choose Properties.
> Go to Advanced System Settings - Advance Tab.
> Under Startup and Recovery, click Settings...
> Look for 'write debugging information' and use Kernel memory dump
> Checkmark overwrite any existing file

If there are latest created minidumps under C:\Windows\Minidump folder, please post the latest dmp logs (atleast 5) by :

> Highlight (holding ctrl key) and choosing the dmp logs by hitting enter or left mouse click.
> Right-click and choose send to desktop.
> When on desktop, highlight all dmp logs and right-click and send to compressed zipped folder.
> Upload and share the link by registering here https://www.box.com/
* minidumps log sample 010613 - 16676 -01.dmp -> 01 is for month - 06 for day - 13 is for year.

that is posted on the OP BSOD.txt its the latest one.



#6 jhayz

jhayz

  • BC Advisor
  • 6,922 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:24 AM

Posted 27 August 2013 - 12:31 AM

The minidump files and WinDbg would be able to extract the faulty application or driver as the BSOD txt from bluescreen view was not able to provide. :thumbup2:


Tekken
 


#7 mrnerdisg0d

mrnerdisg0d
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:24 PM

Posted 27 August 2013 - 12:42 AM

The minidump files and WinDbg would be able to extract the faulty application or driver as the BSOD txt from bluescreen view was not able to provide. 

 

umm alright?

 

https://docs.google.com/file/d/0B_ji3CXH8-SHbmV2S3d4aTBHOUU/edit?usp=sharing

 

thats the minidumps.



#8 jhayz

jhayz

  • BC Advisor
  • 6,922 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:24 AM

Posted 27 August 2013 - 01:10 AM

There are multiple minidumps but was able to extract the faulty application on the latest bluescreen, dated - 08/26/13.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800a3049c8, fffff8800a304220, fffff880018c91b8}

Probably caused by : Ntfs.sys ( Ntfs!NtfsOpenAttribute+388 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800a3049c8
Arg3: fffff8800a304220
Arg4: fffff880018c91b8

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800a3049c8 -- (.exr 0xfffff8800a3049c8)
ExceptionAddress: fffff880018c91b8 (Ntfs!NtfsOpenAttribute+0x0000000000000388)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8800a304220 -- (.cxr 0xfffff8800a304220)
rax=fffffa8007dea180 rbx=fffffa800c9f0f20 rcx=fffffa800b3f5018
rdx=0000000000000000 rsi=fffffa8006db9f68 rdi=fffff8a010f823a8
rip=fffff880018c91b8 rsp=fffff8800a304c00 rbp=0000000000000000
 r8=fffffa800b3f5018  r9=0000000000000000 r10=fffffa800699a3c8
r11=0000000000000000 r12=fffff8800a305540 r13=fffff8a010f82010
r14=fffff8800a305548 r15=fffff8800a3054d0
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
Ntfs!NtfsOpenAttribute+0x388:
fffff880`018c91b8 ff15f2baf9ff    call    qword ptr [Ntfs!_imp_ExAcquireFastMutex (fffff880`01864cb0)] ds:002b:fffff880`01864cb0=00000000001828aa
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  avp.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002905100
 ffffffffffffffff

FOLLOWUP_IP:
Ntfs!NtfsOpenAttribute+388
fffff880`018c91b8 ff15f2baf9ff    call    qword ptr [Ntfs!_imp_ExAcquireFastMutex (fffff880`01864cb0)]

FAULTING_IP:
Ntfs!NtfsOpenAttribute+388
fffff880`018c91b8 ff15f2baf9ff    call    qword ptr [Ntfs!_imp_ExAcquireFastMutex (fffff880`01864cb0)]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff880018b7eb5 to fffff880018c91b8

STACK_TEXT:  
fffff880`0a304c00 fffff880`018b7eb5 : fffffa80`0c5de8d0 fffffa80`06db9f68 fffffa80`07dea180 fffff8a0`10f823a8 : Ntfs!NtfsOpenAttribute+0x388
fffff880`0a304d10 fffff880`018b3d0b : fffff880`0a3054d0 fffffa80`0c5de8d0 fffff8a0`10f823a8 fffff8a0`00000048 : Ntfs!NtfsOpenExistingAttr+0x145
fffff880`0a304dd0 fffff880`018b6f6f : fffffa80`0c5de8d0 fffffa80`06db9c10 fffff8a0`10f823a8 fffff880`00000048 : Ntfs!NtfsOpenAttributeInExistingFile+0x5ab
fffff880`0a304f60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsOpenExistingPrefixFcb+0x1ef


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsOpenAttribute+388

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5167f5fc

STACK_COMMAND:  .cxr 0xfffff8800a304220 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsOpenAttribute+388

BUCKET_ID:  X64_0x24_Ntfs!NtfsOpenAttribute+388

Followup: MachineOwner
---------

http://www.carrona.org/bsodindx.html#0x00000024

STOP 0x00000024: NTFS_FILE_SYSTEM

Usual causes:  Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

 

:step1: Please run the hard drive test first and if windows is still workable, use the windows mode utility for WD diagnostic test (shortand long) instead.

http://support.wdc.com/product/download.asp?groupid=810&sid=3&lang=en

SMART Speccy reports shows :

 

 

C5 Current Pending Sector Count: 200 (200) Data 0000000001
C6 Uncorrectable Sector Count: 200 (200) Data 0000000001

 

There is already one unrepairable sector which is not a good sign for a system drive. Please post the results after running the WD diagnostic test.

 

:step2: One of your BSOD points to your Kaspersky antivirus. Is the protection software still up to date or working?

 

Download SecurityCheck.exe from Here

. Run SecurityCheck and follow the instruction from inside the code box.
. When the scan is finished, a notepad will automatically open as check.txt
   Please copy and paste the contents here on your next reply.

 

 

 


Tekken
 


#9 jhayz

jhayz

  • BC Advisor
  • 6,922 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:24 AM

Posted 27 August 2013 - 01:22 AM

08/24/13 minidump file refers to gogotun.sys http://systemexplorer.net/file-database/file/gogotun-sys


Tekken
 


#10 mrnerdisg0d

mrnerdisg0d
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:24 PM

Posted 28 August 2013 - 07:24 AM


 Results of screen317's Security Check version 0.99.73  
 Windows 7 Service Pack 1 x64 (UAC is disabled!)
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:``````````````
 Windows Security Center service is not running! This report may not be accurate!
 Windows Firewall Enabled!  
Kaspersky Anti-Virus   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:`````````
 Java 7 Update 25  
 Adobe Flash Player 11.8.800.94  
 Mozilla Firefox (23.0.1) 
 Google Chrome 28.0.1500.95  
 Google Chrome 29.0.1547.57  
````````Process Check: objlist.exe by Laurent````````
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamgui.exe  
 Kaspersky Lab Kaspersky Anti-Virus 2013 avp.exe  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 0% 
````````````````````End of Log``````````````````````
 

I REMOVED KASPERSKY

Test Option: QUICK TEST Model Number: WDC WD6400AAKS-07A7B2 Unit Serial Number: WD-WCASY7912316 Firmware Number: 01.03B01 Capacity: 640.13 GB SMART Status: PASS Test Result: FAIL Test Error Code: 06-Quick Test on drive 2 did not complete! Status code = 07 (Failed read test element), Failure Checkpoint = 97 (Unknown Test) SMART self-test did not complete on drive 2! Test Time: 08:22:12, August 28, 2013

Edited by mrnerdisg0d, 28 August 2013 - 07:45 AM.


#11 jhayz

jhayz

  • BC Advisor
  • 6,922 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:24 AM

Posted 29 August 2013 - 12:14 AM

Was the long test completed? It seems it was stop/aborted or not able to finish? At this point, prioritized first on backing up your important files on a different storage before proceeding to any steps.

 

 

GB SMART Status: PASS Test Result: FAIL Test Error Code: 06-Quick Test on drive 2 did not complete! Status code = 07 (Failed read test element)

 


Tekken
 


#12 mrnerdisg0d

mrnerdisg0d
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:24 PM

Posted 29 August 2013 - 11:15 AM

 

Was the long test completed? It seems it was stop/aborted or not able to finish? At this point, prioritized first on backing up your important files on a different storage before proceeding to any steps.

 

 

GB SMART Status: PASS Test Result: FAIL Test Error Code: 06-Quick Test on drive 2 did not complete! Status code = 07 (Failed read test element)

 

 

its ok its just my system drive so i dont have to worry about much,,,i just wanna replace it. if need be.

 

 

	
		
			
				Test Option:
			
				EXTENDED TEST
		
		
			
				Model Number:
			
				WDC WD6400AAKS-07A7B2
		
		
			
				Unit Serial Number:
			
				WD-WCASY7912316
		
		
			
				Firmware Number:
			
				01.03B01
		
		
			
				Capacity:
			
				640.13 GB
		
		
			
				SMART Status:
			
				PASS
		
		
			
				Test Result:
			
				FAIL
		
		
			
				Test Error Code:
			
				08-Error was detected while repairing bad sectors.
		
		
			
				Test Time:
			
				14:40:13, August 29, 2013
		
	


Edited by mrnerdisg0d, 29 August 2013 - 01:41 PM.


#13 jhayz

jhayz

  • BC Advisor
  • 6,922 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:24 AM

Posted 29 August 2013 - 08:55 PM

 

Test Result : FAIL
        

Test Error Code: 08-Error was detected while repairing bad sectors.

 

The fail result is persistent on both test with the uncorrectable sector. I would try the DOS mode version of WD diagnostic test utility in this case and see if any attempted repairs would be made or to use the write zero/low level format utility in DOS mode.


Tekken
 


#14 mrnerdisg0d

mrnerdisg0d
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:24 PM

Posted 01 September 2013 - 07:49 PM

 

 

Test Result : FAIL
        

Test Error Code: 08-Error was detected while repairing bad sectors.

 

The fail result is persistent on both test with the uncorrectable sector. I would try the DOS mode version of WD diagnostic test utility in this case and see if any attempted repairs would be made or to use the write zero/low level format utility in DOS mode.

 

ok ill work on t hat or just try to replace it..

 

 

i keep getting another blue screen now 

 

 

 

https://docs.google.com/file/d/0B_ji3CXH8-SHdmc1TlY2cWpaWEE/edit?usp=sharing

 

 

Minidumps.

....would you be willing to teach me how to debug these dmp files..?

 

so i dont have to keep asking and asking lol thanks alot for all the help.


Edited by mrnerdisg0d, 01 September 2013 - 07:51 PM.


#15 jhayz

jhayz

  • BC Advisor
  • 6,922 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:24 AM

Posted 01 September 2013 - 08:32 PM

What particular event does the recent bluescreen happens? Was the hard drive problem already replaced? The bluescreen dump files is Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL http://msdn.microsoft.com/en-us/library/ff560129%28v=vs.85%29.aspx

 

 

 

  1. Download and install updates and device drivers for your computer from Windows Update.
  2. Scan your computer for computer viruses.
  3. Check your hard disk for errors.

 

 


Tekken
 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users