Problem Event Name:BlueScreen

[ihrsetrdr]

I just set up Win 7 Pro(64bit) about four days ago, was a bit surprised to get a BSOD a few minutes after booting. Rebooted, then got another bluescreen- now I'm paying attention. I figured that a recent Update may have been the cause, so I rolled System Restore back to before Updates. Another bluescreen. I'm getting the following:

Problem signature:
  Problem Event Name:	BlueScreen
  OS Version:	6.1.7600.2.0.0.256.48
  Locale ID:	1033

Additional information about the problem:
  BCCode:	24
  BCP1:	00000000001904FB
  BCP2:	FFFFF880038FF408
  BCP3:	FFFFF880038FEC70
  BCP4:	FFFFF80002AF79E1
  OS Version:	6_1_7600
  Service Pack:	0_0
  Product:	256_1

Files that help describe the problem:
  C:\Windows\Minidump\061513-20248-01.dmp
  C:\Users\tnthomas\AppData\Local\Temp\WER-34601-0.sysdata.xml

Googling

BCP1: 00000000001904FB

led to answers.microsoft.com where it was stated that:

The Blue screen of Death error (BSOD) description you have posted indicates Bug Check Code 24 (BCCode: 24) that is caused by a problem in Ntfs.sys

Usually it is caused by disk corruption, disk defragmenters, or (in rare cases) creating a partition larger than 7 GB on a Services for Macintosh volume with a large number of files. The general troubleshooting steps to solve this issue if it occurs randomly are suggested below.



Method 1: - Check drive for errors



1. Open Computer by clicking the Start button, and then clicking Computer.

2. Right-click the drive that you want to check, and then click Properties.

3. Click the Tools tab, and then, under Error-checking, click Check now. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.



To automatically repair problems with files and folders that the scan detects, select Automatically fix file system errors. Otherwise, the disk check will report problems but not fix them.



To perform a thorough check, select Scan for and attempt recovery of bad sectors. This scan attempts to find and repair physical errors on the drive itself, and it can take much longer to complete.



To check for both file errors and physical errors, select both Automatically fix file system errors and Scan for and attempt recovery of bad sectors.

...so ATM the machine is automatically trying to fix file system errors and scan for and attempt recovery of bad sectors.


Does this actually sound like 'disk corruption' or some such problem, or is there something more tangible going on?


Edit:

My purpose for this Win7 setup is to attempt to run a scanner(this post) that has drivers & software compatible up to Win XP only.

Other actions:

Dropped this skt 1155 i7 2600K back to stock clocks, ran OCCT Large Data Set for one hour, also ran Linpack for an hour; no anomalies detected. Currently has been running a f@h WU smoothly.

 

[EmptySoul]

Is there enough time to analyze the crash dump file before it crashes again? If not what about trying to load it in safe mode then putting the file onto a USB and analysing it on another computer

 

[ihrsetrdr]

Is there enough time to analyze the crash dump file before it crashes again? If not what about trying to load it in safe mode then putting the file onto a USB and analysing it on another computer

This is my only Windows machine, but it does seem to be stable, so the dump file could be examined locally. I've not done this procedure, but have read that an .iso file can be downloaded from MS that has a toolkit for such analysis.

I presume the .iso would need to be burned to disc, then the system booted to it?

 

[EmptySoul]

Not an ISO just an EXE. Google WinDBG and yes it's from MS.

Once you have installed it you will need to set up the symbols

The dump file can not be loaded in the program because its in the folder Windows\minidump but if you copy and paste the dump file to the desktop you can load it from there.

Once you have the symbols set up and you have the dumpfile open just type "!analyse -v" into the command line.. I think that's it anyway, it's off the top of my head. But it says on the screen also it's in a blue hyperlink text.

Once you have run it and you have scrolled down it should tell you the fault. Even if you can not tell what the fault actually was it still tells you the program or driver which had the fatal error and an error code which you can google for solutions.

For example last year I was getting blue screen errors all of a sudden and after doing this I found out it was the Network driver... After googling the error code I found out it was because of a windows update and I had to roll back the driver.

Unfortunately I have just left for work so someone else will have to help you from here...

But install the program
Google how to set up the symbols.. It takes 2 minutes
Run the program and if you can't figure it out then post the result of the analyst on here and I'm sure you will get a solution really quickly

Good luck

 

[ihrsetrdr]

"Not an ISO just an EXE. Google WinDBG and yes it's from MS"

OK, will do that, but perhaps in the morning, as we're UTC−08:00 here.

 

[redduc900]

... or just load the *.dmp file in BlueScreenView to find out which driver is causing the errors...

http://www.nirsoft.net/utils/blue_screen_view.html

... but a BCCode: 24 usually indicates file corruption, and as such I'd probably run a chkdsk /f /r c:\ from the WinRE.

 

[ihrsetrdr]

Here's a dump file from just a few minutes ago:

==================================================
Dump File         : 061813-40872-01.dmp
Crash Time        : 6/18/2013 12:04:20 PM
Bug Check String  : MEMORY_MANAGEMENT
Bug Check Code    : 0x0000001a
Parameter 1       : 00000000`00000031
Parameter 2       : fffffa80`04e937b0
Parameter 3       : fffff880`07116000
Parameter 4       : fffff8a0`0fe789a9
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+75c00
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18113 (win7sp1_gdr.130318-1533)
Processor         : x64
Crash Address     : ntoskrnl.exe+75c00
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\Windows\Minidump\061813-40872-01.dmp
Processors Count  : 8
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 282,040
Dump File Time    : 6/18/2013 12:05:41 PM
==================================================

Here's a couple from
Saturday:

==================================================
Dump File         : 061513-24710-01.dmp
Crash Time        : 6/15/2013 12:07:17 PM
Bug Check String  : NTFS_FILE_SYSTEM
Bug Check Code    : 0x00000024
Parameter 1       : 00000000`001904fb
Parameter 2       : fffff880`09080e28
Parameter 3       : fffff880`09080690
Parameter 4       : fffff880`01265ae9
Caused By Driver  : Ntfs.sys
Caused By Address : Ntfs.sys+aae9
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Crash Address     : ntoskrnl.exe+6f880
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\Windows\Minidump\061513-24710-01.dmp
Processors Count  : 8
Major Version     : 15
Minor Version     : 7600
Dump File Size    : 281,216
Dump File Time    : 6/15/2013 12:22:39 PM
==================================================

==================================================
Dump File         : 061513-23088-01.dmp
Crash Time        : 6/15/2013 12:01:34 PM
Bug Check String  : SYSTEM_SERVICE_EXCEPTION
Bug Check Code    : 0x0000003b
Parameter 1       : 00000000`c0000005
Parameter 2       : fffff800`02a979e1
Parameter 3       : fffff880`07040aa0
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+6f880
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7601.18113 (win7sp1_gdr.130318-1533)
Processor         : x64
Crash Address     : ntoskrnl.exe+6f880
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\Windows\Minidump\061513-23088-01.dmp
Processors Count  : 8
Major Version     : 15
Minor Version     : 7600
Dump File Size    : 281,600
Dump File Time    : 6/15/2013 12:03:40 PM
==================================================

Can chkdsk fix these kind of kernel file problems?

 

[RollingThunder]

Tim,

Couple questions and I'm only thinking out loud here:

1. Your system clean regarding malware / virus?

2. Run any hard drive checks recently (if you are using a HD)?

 

[ihrsetrdr]

I had run the "fix file system errors and scan for and attempt recovery of bad sectors" tools that are available, when right-clicking the drive icon when in My Computer. I've had ClamAV running since this Win 7 install was set up, which has been about a week. I did wipe this (and the storage disc) with gparted before the Win 7 install, then just let the Windows installer set up the system disc. I'm downloading Avira and also Passmark's DiskCheckup, just to leave no stone unturned.

 

[ihrsetrdr]

I caught this screenshot[edited] of the affected system(via tightvnc) while attempting an MS Security Essentials scan:

...lost vnc connection, system rebooted.

The same happened when doing an AV scan; will have to read up on how to use WinRE, and see what turns up.

 

[ihrsetrdr]

The first two attempts to run winRE resulted in the following message:

STOP: C0000221 unknown hard error

\systemroot\system32\ntdll.dll

-which prompted me to run memtest, really for lack of other better avenues of investigation. After 12+ hours of walltime with no errors, I gave the WinRE another shot. I ran chkdsk c: /f, but didn't see that there was any files that needed fixed.

I booted Win 7 in Safe Mode, looked at installed programs and uninstalled the nvidia graphics drivers, also uninstalled an ATI driver, that Windows Updates 'must' have installed(wasn't me).

Anyway, while still in Safe Mode ran an AV scan as well as MS Security Essentials, finding no malware with either scan.

I did install the current nvidia graphics driver, and have returned to full desktop session, running a f@h client, and conducting business normally. I would hesitate to mark this thread as [solved], as no definitive 'smoking gun' turned up, as the culprit for the BSODs. I am going to leave the system at stock clocks for a while, see what happens.