Help! Blue screen!!!!

[directhex]

Couldn't hurt to run through memtest86

[nukesploder]

Yes I did use memtest and ram is fine but im still getting crashes! I wish that I could talk to you guys more directly so that you could help me out more directly (although I do appreciate the help regardless). Here's my most recent dump file. http://speedyshare.com/4DMrf/030314-19749-01-Copy.dmp

Did anything change?

[satrow]

Ok, 2x IoBit drivers removed, only SmartDefrag left. The RIM (Blackberry) drivers are also a possibility for causing interference and the AMD Overdrive/EasyTune6 driver, AODDriver2.sys, is still loaded.

Once the above drivers have been removed, we'll stand a better chance of seeing if this is hard- or software related. The other 3rd party drivers look good.

Can you get us a full data collection, please? Study and follow these instructions carefully and upload the required zipped folder: http://www.sysnative.com/forums/bsod...8-7-vista.html as it might furnish further clues.

Also, if you could describe what you were doing in the seconds leading up to the crashes, that might also help us to visualise what's happening.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80003d60825, Address of the instruction which caused the bugcheck
Arg3: fffff88005411c80, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MiGetTopLevelPfn+65
fffff800`03d60825 4c8b4928        mov     r9,qword ptr [rcx+28h]

CONTEXT:  fffff88005411c80 -- (.cxr 0xfffff88005411c80)
.cxr 0xfffff88005411c80
rax=0000fffffffffffd rbx=000fffffffffffff rcx=002ffa7fffffff70
rdx=fffffff555715b79 rsi=fffffa8009908000 rdi=0000058000000000
rip=fffff80003d60825 rsp=fffff88005412668 rbp=0000000000000000
 r8=fffffe00054126a0  r9=0000fffffffffffd r10=fffff88005412718
r11=0000000000000001 r12=000000003ffffff8 r13=0000000000000000
r14=fffff6fb40000000 r15=0000000fffffffff
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!MiGetTopLevelPfn+0x65:
fffff800`03d60825 4c8b4928        mov     r9,qword ptr [rcx+28h] ds:002b:002ffa7f`ffffff98=????????????????
.cxr
Resetting default scope

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80003d60825

STACK_TEXT:  
fffff880`05412668 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiGetTopLevelPfn+0x65


FOLLOWUP_IP: 
nt!MiGetTopLevelPfn+65
fffff800`03d60825 4c8b4928        mov     r9,qword ptr [rcx+28h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MiGetTopLevelPfn+65

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035

STACK_COMMAND:  .cxr 0xfffff88005411c80 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x3B_nt!MiGetTopLevelPfn+65

BUCKET_ID:  X64_0x3B_nt!MiGetTopLevelPfn+65

Followup: MachineOwner
---------

[nukesploder]

Is this what you wanted? http://speedy.sh/pSrBX/stuff-that-a-person-wants.zip I think I did it right... I went into my amd cataclyist control centre and turned off the overdrive but I really don't get the Easy Tune 6 driver and the AODDriver2.sys but I got rid of the blackberry driver and the IoBits and smartdefrag.

As to what I am doing when the crash happens, really anything from watching videos to gaming with friends and It's really annoying. Thanks again for helping btw and I hope this issue can be resolved

[satrow]

AODDriver2.sys is part of AMD Fuel, so that's what you need to uninstall. (C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys <- but don't delete it, that's likely to make things worse )

There's also a snakeoil product from Paretologic installed - undo anything that it has done, if possible, and then uninstall it. Whilst this type of product can 'fix' problems occasionally, they also increase the risk of further issues later on and it might well have contributed to some of the many errors reported by Windows in the logs.

There's a PUP (spyware) installed - I think the process here will get rid of it: http://malwaretips.com/blogs/pup-opt...ive-a-removal/ - the trigger is autostarting: NextLive NewNext Helper Engine NewNextDotMe c:\users\kastriot\appdata\roaming\newnext.me\nengine.dll and it could well be causing some interference. (Anything running from a location in your AppData folder should be treated with suspicion.)

Add the log file texts from the 4x removal tools above in a Code box in a Reply, please, I'll check them over for more clues.

Check for a firmware update for your OCZ Vertex SSD, if there is one, please update it.

[nukesploder]

Ok, so here's what I've done so far.
http://speedyshare.com/PxVVv/Another...for-person.zip

I have clicked on your link that you've sent me and have use all of the programs there and have the results in the zipped folder. I'm still not sure if I fixed the AODDRIVER2.SYS but what I can tell you is that I have used this program:http://www.windowexeallkiller.com/ and I'm not sure if it helped my problem or not. I have also done a firmware update for my OCZ Vertex SSD.

[nukesploder]

Got another dump file for you

http://speedyshare.com/M6TFA/030414-18423-01-Copy.dmp

[satrow]

Thanks for the logs, it looks like they took care of Paretologic, NewNextDotMe and more. Do you have the log from the Windowsexeallkiller software you ran? What did it/you remove?

The latest dump was NTFS -related (could this be pointing to a 'bad' SSD/HDD?), a 0x24 with yet another ExceptionCode: c0000005 (Access violation)

STOP 0x00000024: NTFS_FILE_SYSTEM
Usual causes: Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

AODDriver2.sys is still loading.


Please run bootable HDD/SSD diagnostics on your SSD and HDD: http://www.carrona.org/hddiag.html

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880093d7e38
Arg3: fffff880093d7690
Arg4: fffff80003c9d8db

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880093d7e38 -- (.exr 0xfffff880093d7e38)
.exr 0xfffff880093d7e38
ExceptionAddress: fffff80003c9d8db (nt!CcUninitializeCacheMap+0x00000000000000cb)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff880093d7690 -- (.cxr 0xfffff880093d7690)
.cxr 0xfffff880093d7690
rax=ff00fa8009e70ee0 rbx=fffffa8009e70e00 rcx=fffffa8009e70ee0
rdx=0000000000000000 rsi=0000000000000000 rdi=fffffa8009e70f70
rip=fffff80003c9d8db rsp=fffff880093d8070 rbp=fffffa800bbc1b70
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=fffff880093d8730 r12=fffff80003ebfa80 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!CcUninitializeCacheMap+0xcb:
fffff800`03c9d8db 488908          mov     qword ptr [rax],rcx ds:002b:ff00fa80`09e70ee0=????????????????
.cxr
Resetting default scope

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  wmpnetwk.exe

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003ebc100
GetUlongFromAddress: unable to read from fffff80003ebc1c0
 ffffffffffffffff 

FOLLOWUP_IP: 
nt!CcUninitializeCacheMap+cb
fffff800`03c9d8db 488908          mov     qword ptr [rax],rcx

FAULTING_IP: 
nt!CcUninitializeCacheMap+cb
fffff800`03c9d8db 488908          mov     qword ptr [rax],rcx

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff880012fdf5c to fffff80003c9d8db

STACK_TEXT:  
fffff880`093d8070 fffff880`012fdf5c : 00000000`00000000 00000000`00000000 fffff8a0`118cfc70 00000000`00000000 : nt!CcUninitializeCacheMap+0xcb
fffff880`093d80f0 fffff880`012ddf4b : fffff8a0`118cfb40 fffff880`093d8980 fffff8a0`118cfc70 fffff8a0`118cfb40 : Ntfs!NtfsDeleteInternalAttributeStream+0xcc
fffff880`093d8140 fffff880`0124e699 : 00000000`00000000 fffffa80`0a0de800 fffff880`093d8690 00000000`00006000 : Ntfs!NtfsCommonCleanup+0x76b
fffff880`093d8550 fffff800`03c90878 : fffff880`093d8690 00000000`a0000003 fffffa80`0f05c660 00000000`00000000 : Ntfs!NtfsCommonCleanupCallout+0x19
fffff880`093d8580 fffff880`0124e712 : fffff880`0124e680 00000000`00000000 fffff880`093d8900 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`093d8660 fffff880`012ec7f4 : fffff880`093d8730 fffff880`093d8730 fffff880`093d8730 fffffa80`0a0de8a0 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
fffff880`093d86d0 fffff880`01015bcf : fffff880`093d8730 fffffa80`0f05c660 fffffa80`0f05ca00 fffffa80`0d9ee2b0 : Ntfs!NtfsFsdCleanup+0x144
fffff880`093d8940 fffff880`010146df : fffffa80`0d053de0 00000000`00000000 fffffa80`09b7ab00 fffffa80`0f05c660 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`093d89d0 fffff800`03f8d96f : fffffa80`0f05c660 fffffa80`0fc399b0 00000000`00000000 fffffa80`0d6cd680 : fltmgr!FltpDispatch+0xcf
fffff880`093d8a30 fffff800`03f7b964 : 00000000`00000000 fffffa80`0fc399b0 00000000`00000000 fffff800`03c8de5c : nt!IopCloseFile+0x11f
fffff880`093d8ac0 fffff800`03f7b721 : fffffa80`0fc399b0 fffffa80`00000001 fffff8a0`0440b4e0 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4
fffff880`093d8b40 fffff800`03f7bce4 : 00000000`00000114 fffffa80`0fc399b0 fffff8a0`0440b4e0 00000000`00000114 : nt!ObpCloseHandleTableEntry+0xb1
fffff880`093d8bd0 fffff800`03c83e53 : fffffa80`09ec7060 fffff880`093d8ca0 00000000`00000002 fffffa80`0bc661e0 : nt!ObpCloseHandle+0x94
fffff880`093d8c20 00000000`774413aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00daf828 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774413aa


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!CcUninitializeCacheMap+cb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035

STACK_COMMAND:  .cxr 0xfffff880093d7690 ; kb

FAILURE_BUCKET_ID:  X64_0x24_nt!CcUninitializeCacheMap+cb

BUCKET_ID:  X64_0x24_nt!CcUninitializeCacheMap+cb

Followup: MachineOwner
---------

[jcgriff2]

Is there any doubt that the SSD firmware upgrade went well (was in fact updated)?

Bugcheck 0x24 itself points us to the SSD/HDD

The 0xc5 exception along with 0x24 often points to a problem with the SSD.

RAM is never far from being a suspect either (or an unknown hardware failure affecting RAMs ability to properly hold kernel code).

You ran memtest86+ one stick at a time and alternated the slots?

Regards. . .

jcgriff2
MS MVP

p.s. any external USB drives/sticks plugged in?

If so, please disconnect for now.

[nukesploder]

Update on my issue:
I managed to uninstall amd fuel and block it from booting and I did a HHD and SSD test via western digital's software and it shows green. Like I said earlier, I did multiple ram checks and I did found out that there was a slot that was malfunctioning but I removed the stick of ram so I shouldn't have a problem..... here's my recent dump file. The only thing that I can say is that the crashes are happening less often than usual

http://www.speedyshare.com/vqgwy/030...94-01-Copy.dmp

[satrow]

nuke, we're missing the answers to a number of questions that have been asked, without them, our mental picture of your problem isn't going to get any better

Let's do a full memory test next, a suspected 'bad' slot might be a broken trace on the motherboard, if it's caused by a crack or delamination, it's not going to get better and could be worse by now.

Memtest86+ for 7+ full runs per slot, start with the slot nearest the CPU and use only one RAM stick for the first series of tests. Once all slots have been tested, test the next RAM stick in the good slots only, same 7+ runs. Repeat for all RAM sticks. Any errors will mean a bad stick or slot and that test can be stopped, note carefully which sticks/slots are bad and take care to fully test all sticks (don't mix them up).

I suggest using the auto installer for a bootable USB stick: http://www.memtest.org/#downiso



AODDriver2.sys is still loaded, we'll work on that later if necessary, once bad hardware has been ruled out.