Hello, I am new at attempting to resolve blue screens, but this is driving me crazy! At all sorts of different random times, I get this stop error with several other numerical parameters. I downloaded BlueScreenView, which indicates that the cause is Ntfs.sys and ntoskrnl.exe (the kernel + the system), so this is not very useful. In addition to the bug check code (0x0x00000034), Parameters are: Param 1: 00000000`00050830 Param2: fffff880`033cc808 Param3: fffff880`033cc070 Param4: fffff800`03d6ddb4 Ofcourse, in the original bsod the params appeared as hex values, 0x0000000000050830, etc ... I would be very happy to upload the minidump file that I have to anyone who might be able to help. Thanks in advance!

Bug Check 0x34: CACHE_MANAGER This indicates that a problem occurred in the file system's cache manager. Please copy the dmp files from the folder C:\Windows\Minidump first to your desktop, zip all dmp into 1 zip file and upload the zip file to your Skydrive [1] and post a link here, so that I can look at the dumps. André [1] http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/

Hi Andre, I uploaded the minidump, which is here: http://cid-11ac254488e21108.office.live.com/self.aspx/MiniDump/091710-15319-01.zip For what is may be worth, the Bugcheck code and Param values are below. I have been sufferring many many BSODs over the past few weeks, and they are not always the CACHE_MANAGER 0x34 flavor. I rebuilt the entire Windows7 image and re-loaded all software. I am a software engineer and the software on the box is limited to standard fare dev stuff (Visual Studio, SQL-Server, Office, Forefront). I added ShadowProtect recently, but did this after the Bluescreens started because I wanted to make sure that I had good backup images (and this has now saved me many times b/c after some of these BSOD's the system is no longer bootable). The BSODs have calmed down but not gone away, and the last 2 have been exactly this CACHE_MANAGER flavor. Yesterday, I completely rebuilt my master boot record. Today, I found and installed the latest and greatest video driver and chipset driver (disk controller), and thought that the problem was over, but after a few hours this last BSOD happened. I'm thinking it might be memory related and have ordered new RAM, but if you find that it is probably something else then I can cancel or return the order. Finally, I'll mention that I can create a BSOD at will simply by uninstalling any application with Forefront 2010 running. However, if I stop Forefront's real-time protection then I can successfully uninstall anything and there is no BSOD. Unfortunately, not running Forefront is not an option for me as my employer requires it. Thanks in advance! BugcheckCode 0x34 BugcheckParameter1 0x50830 BugcheckParameter2 0xfffff880033cc808 BugcheckParameter3 0xfffff880033cc070 BugcheckParameter4 0xfffff80003d6ddb4

Hello Again Andre, In addition to http://cid-11ac254488e21108.office.live.com/self.aspx/MiniDump/091710-15319-01.zip (which contains the 0x34 stop), please also see http://cid-11ac254488e21108.office.live.com/self.aspx/MiniDump/091710-33321-01.zip. This is a 0x24 stop error that I can produce at will simply by uninstalling almost anything. I can work-around it by disabling my anti-virus software (MSFT Forefront 2010).

It looks like this was due to an access violation, it might be worth checking memory with an extended test with Windows memory diagnostic or a longer test, >5 hrs, with memtest86+ (preferred) to see if any DIMMs are having problems, http://oca.microsoft.com/en/windiag.asp http://www.memtest.org/ You may also want to do a chkdsk on each drive to see if any inconsistencies are found and perform a chkdsk /R on the drives to attempt to repair, but I would investigate it as a memory issue first above. Do you have any more dumps that you can upload to try to confirm it one way or another? ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 34, {50830, fffff880033cc808, fffff880033cc070, fffff80003d6ddb4} Probably caused by : memory_corruption ( nt!MiSectionDelete+24 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* CACHE_MANAGER (34) See the comment for FAT_FILE_SYSTEM (0x23) Arguments: Arg1: 0000000000050830 Arg2: fffff880033cc808 Arg3: fffff880033cc070 Arg4: fffff80003d6ddb4 Debugging Details: ------------------ EXCEPTION_RECORD: fffff880033cc808 -- (.exr 0xfffff880033cc808) ExceptionAddress: fffff80003d6ddb4 (nt!MiSectionDelete+0x0000000000000024) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff880033cc070 -- (.cxr 0xfffff880033cc070) rax=ffff0067006f006c rbx=0000000000000000 rcx=fffff8a010fd2b90 rdx=fffffa8006c32000 rsi=0000000000000000 rdi=fffff8a010fd2b60 rip=fffff80003d6ddb4 rsp=fffff880033cca40 rbp=0000000000000002 r8=000000000000c828 r9=0000000000000310 r10=fffff80003a0c000 r11=fffff880033ccab0 r12=0000000000000011 r13=0000000000000000 r14=00000000ffffffff r15=0000000000000001 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00010286 nt!MiSectionDelete+0x24: fffff800`03d6ddb4 488b18 mov rbx,qword ptr [rax] ds:002b:ffff0067`006f006c=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003cb40e0 ffffffffffffffff FOLLOWUP_IP: nt!MiSectionDelete+24 fffff800`03d6ddb4 488b18 mov rbx,qword ptr [rax] FAULTING_IP: nt!MiSectionDelete+24 fffff800`03d6ddb4 488b18 mov rbx,qword ptr [rax] BUGCHECK_STR: 0x34 LAST_CONTROL_TRANSFER: from fffff80003a818b4 to fffff80003d6ddb4 STACK_TEXT: fffff880`033cca40 fffff800`03a818b4 : 00000000`00000000 00000000`00000002 fffffa80`06d30790 fffffa80`00000000 : nt!MiSectionDelete+0x24 fffff880`033cca80 fffff800`03a6c2f0 : 00000000`00000002 fffffa80`0afb5630 00000000`00000000 00000000`00000000 : nt!ObfDereferenceObject+0xd4 fffff880`033ccae0 fffff800`03a6fd1c : fffffa80`07002820 00000000`00000011 fffffa80`07002820 fffffa80`00000000 : nt!CcDeleteSharedCacheMap+0x1bc fffff880`033ccb50 fffff800`03a70520 : fffff800`03c83100 fffff880`033ccc58 00000000`00000000 fffffa80`00000000 : nt!CcWriteBehind+0x5bc fffff880`033ccc00 fffff800`03a89961 : fffffa80`06d213d0 fffff800`03a70358 fffff800`03c83140 fffffa80`00000003 : nt!CcWorkerThread+0x1c8 fffff880`033cccb0 fffff800`03d20c06 : 00000000`00000000 fffffa80`06d22040 00000000`00000080 fffffa80`06d0e040 : nt!ExpWorkerThread+0x111 fffff880`033ccd40 fffff800`03a5ac26 : fffff880`009ed180 fffffa80`06d22040 fffff880`009f7f40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`033ccd80 00000000`00000000 : fffff880`033cd000 fffff880`033c7000 fffff880`033cbc20 00000000`00000000 : nt!KxStartSystemThread+0x16 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!MiSectionDelete+24 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9 STACK_COMMAND: .cxr 0xfffff880033cc070 ; kb IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x34_nt!MiSectionDelete+24 BUCKET_ID: X64_0x34_nt!MiSectionDelete+24 Followup: MachineOwner --------- 0: kd> .exr 0xfffff880033cc808 ExceptionAddress: fffff80003d6ddb4 (nt!MiSectionDelete+0x0000000000000024) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1904fb, fffff8800a0b6868, fffff8800a0b60d0, fffff80003a84905} Unable to load image MpFilter.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for MpFilter.sys *** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys Probably caused by : Ntfs.sys ( Ntfs!NtfsRestartIndexEnumeration+271 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff8800a0b6868 Arg3: fffff8800a0b60d0 Arg4: fffff80003a84905 Debugging Details: ------------------ EXCEPTION_RECORD: fffff8800a0b6868 -- (.exr 0xfffff8800a0b6868) ExceptionAddress: fffff80003a84905 (nt!ExpInterlockedPopEntrySListFault16) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff8800a0b60d0 -- (.cxr 0xfffff8800a0b60d0) rax=0000004da573005a rbx=fffff9800f3c04c8 rcx=fffff80003bfd600 rdx=006e006f00430051 rsi=fffff80003bfd600 rdi=0000000000000011 rip=fffff80003a84905 rsp=fffff8800a0b6aa0 rbp=fffffa8006c95000 r8=006e006f00430050 r9=fffff80003a11000 r10=fffff80003bfd600 r11=fffff8a0003aa000 r12=0000000000000009 r13=0000000000000000 r14=0000000000000002 r15=000000004946744e iopl=0 nv up ei pl nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206 nt!ExpInterlockedPopEntrySListFault16: fffff800`03a84905 498b08 mov rcx,qword ptr [r8] ds:002b:006e006f`00430050=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: MsMpEng.exe CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003cb90e0 ffffffffffffffff FOLLOWUP_IP: Ntfs!NtfsRestartIndexEnumeration+271 fffff880`014cfbd1 4989842498000000 mov qword ptr [r12+98h],rax FAULTING_IP: nt!ExpInterlockedPopEntrySListFault16+0 fffff800`03a84905 498b08 mov rcx,qword ptr [r8] BUGCHECK_STR: 0x24 LAST_CONTROL_TRANSFER: from fffff80003bb5646 to fffff80003a84905 STACK_TEXT: fffff880`0a0b6aa0 fffff800`03bb5646 : fffffa80`06d166b0 fffffa80`0d564060 00000000`00100010 fffff980`0f3c051a : nt!ExpInterlockedPopEntrySListFault16 fffff880`0a0b6ab0 fffff880`014cfbd1 : fffff8a0`01cea500 fffff980`0f3c04c8 fffff8a0`1536e4f0 fffff8a0`01cea501 : nt!ExAllocatePoolWithTag+0x276 fffff880`0a0b6ba0 fffff880`014ccdfe : fffffa80`0cb76420 fffff8a0`05b52e10 fffff8a0`05b52bc0 fffffa80`0cb76420 : Ntfs!NtfsRestartIndexEnumeration+0x271 fffff880`0a0b6dc0 fffff880`014ce421 : fffff880`0a0b72d0 00000000`00000008 fffffa80`07dcf6d0 fffffa80`0bc23010 : Ntfs!NtfsQueryDirectory+0x94e fffff880`0a0b7160 fffff880`014d078f : fffffa80`0cb76420 00000000`00000000 fffff880`0a0b7260 00000000`00000000 : Ntfs!NtfsCommonDirectoryControl+0xa1 fffff880`0a0b71a0 fffff880`0136b23f : fffffa80`0bc236c8 fffffa80`0bc23010 fffffa80`0cb76420 fffff880`0a0b71c8 : Ntfs!NtfsFsdDirectoryControl+0x10f fffff880`0a0b7210 fffff880`0136d94a : 00000000`00000000 00000000`00000000 fffffa80`099c6000 fffffa80`0c84eb70 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`0a0b72a0 fffff880`0138cdb8 : fffffa80`07e51430 00000000`00000022 fffffa80`07dda800 fffffa80`0c84ec20 : fltmgr!FltPerformSynchronousIo+0x2ca fffff880`0a0b7340 fffff880`0635ad71 : 00000000`00000000 00000000`00000020 fffff880`0a0b7400 fffff880`0a0b7490 : fltmgr!FltQueryDirectoryFile+0x98 fffff880`0a0b7380 fffff880`0138cd02 : 00000000`0000004e fffffa80`0afa6550 fffffa80`0cd7a070 00000000`00000017 : luafv!LuafvNormalizeNameComponentEx+0x145 fffff880`0a0b7480 fffff880`0138c01e : 00000000`00000017 00000000`00000057 fffffa80`0afa6550 00000000`000007ff : fltmgr!FltpCallNormalizeNameComponentHandler+0x82 fffff880`0a0b74e0 fffff880`0138d361 : 00000000`00000057 00000000`00000080 00000000`0000004f 00000000`00000000 : fltmgr!FltpExpandShortNames+0x14e fffff880`0a0b7540 fffff880`0138d13e : fffffa80`0afa6550 fffffa80`099c0000 00000000`00000000 fffffa80`0bc11201 : fltmgr!FltpGetNormalizedFileNameWorker+0xc1 fffff880`0a0b7580 fffff880`0136e54b : fffffa80`07dda800 fffffa80`0e01fa50 fffffa80`07737000 fffff880`0a0b8000 : fltmgr!FltpCreateFileNameInformation+0xee fffff880`0a0b75e0 fffff880`0138b5ef : 00000000`00008000 fffffa80`0e01fa50 fffffa80`099c6010 fffff8a0`1a0bb488 : fltmgr!FltpGetFileNameInformation+0x26b fffff880`0a0b7660 fffff880`0411c278 : fffffa80`0afa6550 00000000`00000000 00000000`00000101 00000000`00000000 : fltmgr!FltGetFileNameInformationUnsafe+0x7f fffff880`0a0b76d0 fffffa80`0afa6550 : 00000000`00000000 00000000`00000101 00000000`00000000 00000000`00000000 : MpFilter+0xb278 fffff880`0a0b76d8 00000000`00000000 : 00000000`00000101 00000000`00000000 00000000`00000000 00000000`00000001 : 0xfffffa80`0afa6550 SYMBOL_STACK_INDEX: 2 SYMBOL_NAME: Ntfs!NtfsRestartIndexEnumeration+271 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f STACK_COMMAND: .cxr 0xfffff8800a0b60d0 ; kb FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsRestartIndexEnumeration+271 BUCKET_ID: X64_0x24_Ntfs!NtfsRestartIndexEnumeration+271 Followup: MachineOwner --------- 0: kd> .exr 0xfffff8800a0b6868 ExceptionAddress: fffff80003a84905 (nt!ExpInterlockedPopEntrySListFault16) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff 0: kd> .cxr 0xfffff8800a0b60d0 rax=0000004da573005a rbx=fffff9800f3c04c8 rcx=fffff80003bfd600 rdx=006e006f00430051 rsi=fffff80003bfd600 rdi=0000000000000011 rip=fffff80003a84905 rsp=fffff8800a0b6aa0 rbp=fffffa8006c95000 r8=006e006f00430050 r9=fffff80003a11000 r10=fffff80003bfd600 r11=fffff8a0003aa000 r12=0000000000000009 r13=0000000000000000 r14=0000000000000002 r15=000000004946744e iopl=0 nv up ei pl nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206 nt!ExpInterlockedPopEntrySListFault16: fffff800`03a84905 498b08 mov rcx,qword ptr [r8] ds:002b:006e006f`00430050=???????????????? 0: kd> kb 1000 RetAddr : Args to Child : Call Site fffff800`03bb5646 : fffffa80`06d166b0 fffffa80`0d564060 00000000`00100010 fffff980`0f3c051a : nt!ExpInterlockedPopEntrySListFault16 fffff880`014cfbd1 : fffff8a0`01cea500 fffff980`0f3c04c8 fffff8a0`1536e4f0 fffff8a0`01cea501 : nt!ExAllocatePoolWithTag+0x276 fffff880`014ccdfe : fffffa80`0cb76420 fffff8a0`05b52e10 fffff8a0`05b52bc0 fffffa80`0cb76420 : Ntfs!NtfsRestartIndexEnumeration+0x271 fffff880`014ce421 : fffff880`0a0b72d0 00000000`00000008 fffffa80`07dcf6d0 fffffa80`0bc23010 : Ntfs!NtfsQueryDirectory+0x94e fffff880`014d078f : fffffa80`0cb76420 00000000`00000000 fffff880`0a0b7260 00000000`00000000 : Ntfs!NtfsCommonDirectoryControl+0xa1 fffff880`0136b23f : fffffa80`0bc236c8 fffffa80`0bc23010 fffffa80`0cb76420 fffff880`0a0b71c8 : Ntfs!NtfsFsdDirectoryControl+0x10f fffff880`0136d94a : 00000000`00000000 00000000`00000000 fffffa80`099c6000 fffffa80`0c84eb70 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`0138cdb8 : fffffa80`07e51430 00000000`00000022 fffffa80`07dda800 fffffa80`0c84ec20 : fltmgr!FltPerformSynchronousIo+0x2ca fffff880`0635ad71 : 00000000`00000000 00000000`00000020 fffff880`0a0b7400 fffff880`0a0b7490 : fltmgr!FltQueryDirectoryFile+0x98 fffff880`0138cd02 : 00000000`0000004e fffffa80`0afa6550 fffffa80`0cd7a070 00000000`00000017 : luafv!LuafvNormalizeNameComponentEx+0x145 fffff880`0138c01e : 00000000`00000017 00000000`00000057 fffffa80`0afa6550 00000000`000007ff : fltmgr!FltpCallNormalizeNameComponentHandler+0x82 fffff880`0138d361 : 00000000`00000057 00000000`00000080 00000000`0000004f 00000000`00000000 : fltmgr!FltpExpandShortNames+0x14e fffff880`0138d13e : fffffa80`0afa6550 fffffa80`099c0000 00000000`00000000 fffffa80`0bc11201 : fltmgr!FltpGetNormalizedFileNameWorker+0xc1 fffff880`0136e54b : fffffa80`07dda800 fffffa80`0e01fa50 fffffa80`07737000 fffff880`0a0b8000 : fltmgr!FltpCreateFileNameInformation+0xee fffff880`0138b5ef : 00000000`00008000 fffffa80`0e01fa50 fffffa80`099c6010 fffff8a0`1a0bb488 : fltmgr!FltpGetFileNameInformation+0x26b fffff880`0411c278 : fffffa80`0afa6550 00000000`00000000 00000000`00000101 00000000`00000000 : fltmgr!FltGetFileNameInformationUnsafe+0x7f fffffa80`0afa6550 : 00000000`00000000 00000000`00000101 00000000`00000000 00000000`00000000 : MpFilter+0xb278 00000000`00000000 : 00000000`00000101 00000000`00000000 00000000`00000000 00000000`00000001 : 0xfffffa80`0afa6550 -- Mike Burr