fastfat.sys causing BSOD

Hi,

Since this is a new computer check with the builder and have them fix it under warranty.

Do the below first to see if they help. There is a chance the hard drive or cabling has an

issue.

If you are over-clocking anything STOP!

Results verified by WInDBG, DumpCHK, and BlueScreenView.

The Bug_Check were 1E and 23 CAUSE fastfat.sys which is a Windows component which

means something else drove it into Fault.

BugCheck 1E, {ffffffffc0000005, fffff8801087d538, 0, 44}

Probably caused by : fastfat.SYS ( fastfat!FatPrepareWriteVolumeFile+20 )

1. Uninstall Acronis - necessary to see if it is involved.

2. Uninstall Kaspersky - necessary to see if it is involved. Then run the Kaspersky Removal

Tool to prevent it from leaving trouble causing remnants. Use Microsoft Security Essentials

• Free.

Kaspersky Removal Tool

http://support.kaspersky.com/common/service.aspx?el=1464

and  http://support.kaspersky.com/kis2010/service?qid=208279463* http://support.kaspersky.com/downloads/utils/kavremover.exehttp://support.kaspersky.com/kis2010/service?qid=208279463List of anti-malware program cleanup/uninstall tools

http://answers.microsoft.com/en-us/protect/wiki/mse-protect\_start/list-of-anti-malware-product-removal-tools/2bcb53f7-7ab4-4ef9-ab3a-6aebfa322f75

Uninstallers (removal tools) for common antivirus software

http://kb.eset.com/esetkb/index?page=content&id=SOLN146 

Microsoft Security Essentials - Free

http://www.microsoft.com/en-us/download/details.aspx?id=5201

3. Check with ASRock to be sure you are running the latest BIOS, chipset drivers, and the major

on-board and separate device drivers. The BIOS is very current however there might be a newer

version. Check with ASRock Support and their forums about any known issues. Run DriverView

• set VIEW to HIDE Microsoft drivers - update those without Dump in their names (see driver

update methods below).

BiosVersion = P1.10

BiosReleaseDate = 11/11/2013 <- check for updates to the BIOS, low level chipset drivers, and

the major on-board and separate device drivers.

BaseBoardManufacturer = ASRock

BaseBoardProduct = Z87 Killer

ASRock - Support

http://www.asrock.com/support/index.asp

ASRock - Forums

http://www.asrock.com/support/forum.asp

ASRock - Downloads

http://www.asrock.com/support/download.asp

4. Remove ALL power then reseat the cards, memory, and cables (on both ends when possible)

actually remove and replace - do not just snug. Ensure the fans are all working.

5. OPTIONAL - Test the memory very thoroughly. Keep in mind that memory tests do not

detect all errors such as the tiny speed differences between memory modules that appear

to be identical. So it may be necessary to swap the modules in and out in different combinations

and patterns (see memory test methods below). This is something the system builder should

check.

6. Use ALL the other methods in the troubleshooters below.

7. AFTER all the above if the issues continue run Driver Verifier to see if it can indicate a CAUSE

(see Driver Verifier methods below). Do not do this until after ALL the above or it will just detect

the same issues present now and it will not help us determine the root cause.

==============================================================

Resolving stop (blue screen) errors in Windows 7 - has a section for if you can or can't start Windows.

http://windows.microsoft.com/en-us/windows7/Resolving-stop-blue-screen-errors-in-Windows-7 

See this thread for information on using BlueScreenView, MyEventViewer, and other methods to

troubleshoot BlueScreens - top 3 answers (+1 other).

http://answers.microsoft.com/en-us/windows/forum/windows_7-system/sometimes-i-get-a-blue-screen-when-using-ie-8/c675b7b8-795f-474d-a1c4-6b77b3fcd990

========================================================

BCCode: 1E   0x0000001E Remove ALL power and reseat all the cards, memory, and cables (both ends whenpossible) - actually remove and replace - do not just snug. Those are for a PC and about all

that can be done for a laptop is reseat the memory and clear the vents. Make sure the BIOS,

low level chipset drivers, and major device drivers are all up to date by check manually at the

makers' sites.

Many Bluescreens are caused by BIOS, low level chipset drivers, and other major device

drivers which are not the most current even though the computer is new. Check manually

for updates using the methods for updates as indicated in the troubleshooter linked above

and/or the methods below (which are the same).

---

BCCode: 1E   0x0000001E Bug Check 0x1E: KMODE_EXCEPTION_NOT_HANDLEDThe KMODE_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000001E. This indicates that a kernel-mode program generated an exception which the error handler did not catch.

Important Info If You Have Received a STOP Code

If you received a blue screen error, or stop code, the computer has shut down abruptly to protect itself from data loss. A hardware device, its driver, or related software might have caused this error. If your copy of Windows came with your computer, call the manufacturer of your computer. If you purchased Windows separately from your computer, Microsoft provides support. To find contact info for Microsoft or your computer manufacturer, Contact Support.

If you have experience with computers and want to try to recover from this error, follow the steps provided in the Microsoft article Resolving STOP (Blue Screen) Errors in Windows.

These actions might prevent an error like this from happening again:

1. Download and install updates and device drivers for your computer from Windows Update.
2. Scan your computer for computer viruses.
3. Check your hard disk for errors.

KMODE_EXCEPTION_NOT_HANDLED Parameters

The following parameters are displayed on the blue screen.

Parameter	Description
1	The exception code that was not handled
2	The address at which the exception occurred
3	Parameter 0 of the exception
4	Parameter 1 of the exception

Cause

This is a very common bug check. To interpret it, you must identify which exception was generated.

Common exception codes include:

• 0x80000002: STATUS_DATATYPE_MISALIGNMENT An unaligned data reference was encountered.
• 0x80000003: STATUS_BREAKPOINT A breakpoint or ASSERT was encountered when no kernel debugger was attached to the system.
• 0xC0000005: STATUS_ACCESS_VIOLATION A memory access violation occurred. (Parameter 4 of the bug check is the address that the driver attempted to access.)

For a complete list of exception codes, see the ntstatus.h file located in the inc directory of the Windows Driver Kit.

Resolution

If you are not equipped to debug this problem, you should use some basic troubleshooting techniques. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates. Try changing video adapters. Check with your hardware vendor for any BIOS updates. Disable BIOS memory options such as caching or shadowing.

If you plan to debug this problem, you may find it difficult to obtain a stack trace. Parameter 2 (the exception address) should pinpoint the driver or function that caused this problem.

If exception code 0x80000003 occurs, this indicates that a hard-coded breakpoint or assertion was hit, but the system was started with the /NODEBUG switch. This problem should rarely occur. If it occurs repeatedly, make sure a kernel debugger is connected and the system is started with the /DEBUG switch.

If exception code 0x80000002 occurs, the trap frame will supply additional information.

If the specific cause of the exception is unknown, the following should be considered:

Hardware incompatibility. First, make sure that any new hardware installed is compatible with the installed version of Windows. For example, you can get information about compatibility with Windows 7 at the Windows 7 Compatibility Center.

Faulty device driver or system service. In addition, a faulty device driver or system service might be responsible for this error. Hardware issues, such as BIOS incompatibilities, memory conflicts, and IRQ conflicts can also generate this error.

If a driver is listed by name within the bug check message, disable or remove that driver. Disable or remove any drivers or services that were recently added. If the error occurs during the startup sequence and the system partition is formatted with NTFS file system, you might be able to use Safe Mode to rename or delete the faulty driver. If the driver is used as part of the system startup process in Safe Mode, you need to start the computer by using the Recovery Console to access the file.

If the problem is associated with Win32k.sys, the source of the error might be a third-party remote control program. If such software is installed, the service can be removed by starting the system using the Recovery Console and deleting the offending system service file.

Check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing bug check 0x1E. Disabling memory caching of the BIOS might also resolve the error. You should also run hardware diagnostics, especially the memory scanner, supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer.

The error that generates this message can occur after the first restart during Windows Setup, or after Setup is finished. A possible cause of the error is a system BIOS incompatibility. BIOS problems can be resolved by upgrading the system BIOS version.

To get a stack trace if the normal stack tracing procedures fail

1. Use the **kb (Display Stack Backtrace)** command to display parameters in the stack trace. Look for the call to NT!PspUnhandledExceptionInSystemThread. (If this function is not listed, see the note below.)
2. The first parameter to NT!PspUnhandledExceptionInSystemThread is a pointer to a structure, which contains pointers to an except statement:

Copy

typedef struct _EXCEPTION_POINTERS { PEXCEPTION_RECORD ExceptionRecord; PCONTEXT ContextRecord; } EXCEPTION_POINTERS, *PEXCEPTION_POINTERS; ULONG PspUnhandledExceptionInSystemThread( IN PEXCEPTION_POINTERS ExceptionPointers )

Use the [**dd (Display Memory)**](http://msdn.microsoft.com/en-us/library/ff542790%28v=vs.85%29.aspx) command on that address to display the necessary data.

3. The first retrieved value is an exception record and the second is a context record. Use the **.exr (Display Exception Record)** command and the **.cxr (Display Context Record)** command with these two values as their arguments, respectively.
4. After the .cxr command executes, use the kb command to display a stack trace that is based on the context record information. This stack trace indicates the calling stack where the unhandled exception occurred.

Note  This procedure assumes that you can locate NT!PspUnhandledExceptionInSystemThread. However, in some cases (such as an access violation crash) you will not be able to do this. In that case, look for ntoskrnl!KiDispatchException. The third parameter passed to this function is a trap frame address. Use the **.trap (Display Trap Frame)** command with this address to set the Register Context to the proper value. You can then perform stack traces and issue other commands.

Here is an example of bug check 0x1E on an x86 processor:

Bug_Check 0x1E - read link for the examplehttp://msdn.microsoft.com/en-us/library/ff557408(v=vs.85).aspx

BCCode: 1E   0x0000001E  <-- read this linkhttp://www.faultwire.com/solutions-fatal\_error/Check-to-be-sure-you-have-adequate-disk-space-0x0000001E-\*1045.html 

==========================================================

References to Vista also apply to Windows 7.

This is my generic how to for proper driver updates : (Major drivers and BIOS)

This utility makes it easy to see which versions are loaded :

DriverView - Free - utility displays the list of all device drivers currently loaded on your system.

For each driver in the list, additional useful information is displayed: load address of the driver,

description, version, product name, company that created the driver, and more.

http://www.nirsoft.net/utils/driverview.html

For Drivers check System Maker as fallbacks and Device Maker's which are the most current.

Control Panel - Device Manager - Display Adapter - write down the make and complete model

of your video adapter - double click - Driver's tab - write down the version info. Now click UPdate

Driver (this may not do anything as MS is far behind certifying drivers) - then Right Click -

Uninstall - REBOOT this will refresh the driver stack.

Repeat that for Network - Network Card (NIC), Wifi, Sound, Mouse and Keyboard if 3rd party

with their own software and drivers and any other major device drivers you have.

Now go to System Maker's site (Dell, HP, Toshiba as examples) (as rollback) and then Device

Maker's site (Realtek, Intel, Nvidia, ATI as examples) and get their latest versions. (Look for

BIOS, Chipset and software updates at System Maker's site while there.)

Download - SAVE - go to where you put them - Right Click - RUN AD ADMIN - REBOOT after

each installation.

Always check in Device Manager - Drivers tab to be sure the version you are installing actually

shows up. This is because some drivers rollback before the latest is installed (sound drivers

particularly do this) so install a driver - reboot - check to be sure it is installed and repeat as

needed.

Repeat at Device Makers - BTW at Device Makers DO NOT RUN THEIR SCANNER - check

manually by model.

Manually look at manufacturer's sites for drivers - and Device Maker's sites.

http://pcsupport.about.com/od/driverssupport/ht/driverdlmfgr.htm

Installing and updating drivers in Windows 7 (updating drivers manually using the methods above

is preferred to ensure the latest drivers from System maker and Device makers are found)

http://www.sevenforums.com/tutorials/43216-installing-updating-drivers-7-a.html

If you update drivers manually then it is a good idea to disable Driver Installations in Windows

Updates, this leaves Windows Updates ON however it will not install drivers which will usually be

older and cause issues. If Updates suggests a new driver then HIDE it (Right Click on it) and then

go look for new ones manually if you wish.

Stop Windows 7 from Automatically Installing Device Drivers

http://helpdeskgeek.com/windows-7/stop-windows-7-from-automatically-installing-device-drivers/

How To Disable Automatic Driver Installation In Windows 7 / Vista

http://www.addictivetips.com/windows-tips/how-to-disable-automatic-driver-installation-in-windows-vista/

Disable Windows Update Device Driver Search Prompt In Windows 7 / Vista (for Professional,

Ultimate, and Enterprise)

http://www.addictivetips.com/windows-tips/disable-windows-update-device-driver-search-prompt/

==========================================

Memory tests do not catch all errors such as mismatched memory (possible even for sticks

that appear to be identical) and when faster memory is placed in system behind slower memory.

So it is best to also swap sticks in and out to check for those even if all memory tests fail to show

a problem.

To test RAM check here - let it run 4+ hours or so.  <-- best methodwww.memtest.org

For the Windows Memory Diagnostic Tool.

Start - type in Search box ->  Memory - find Memory Diagnostics tool at top of list - Right Click -

RUN AS ADMIN follow the instructions

Windows Vista: How to Scan / Test your RAM or Memory with Windows Vista Memory Diagnostic

Tool

http://www.shivaranjan.com/2007/11/01/windows-vista-how-to-scan-test-your-ram-or-memory-with-windows-vista-memory-diagnostic-tool/

How to Run the Memory Diagnostics Tool in Windows 7

http://www.sevenforums.com/tutorials/715-memory-diagnostics-tool.html

============================================================

Please do not run this unless you have performed ALL the above as it will just waste mytime and yours.

Driver Verifier can help find some BSOD issues :

Using Driver Verifier to identify issues with Windows drivers for advanced users

http://support.microsoft.com/kb/244617

How To Troubleshoot Driver Problems in Windows Vista or 7.

http://www.winvistaclub.com/t79.html

Using Driver Verifier

http://msdn.microsoft.com/en-us/library/ff554113(v=VS.85).aspx

How to use Windows Driver Verifier Manager to Troubleshoot & Identify Driver Issueshttp://www.youtube.com/watch?v=\_VwIDD9xngM

Driver Verifier

http://www.techsupportforum.com/2110308-post3.html

Using Driver Verifier

http://www.faultwire.com/solutions/using\_driver\_verifier.php

How to use Windows Driver Verifier Manager to Troubleshoot & Identify Driver Issueshttp://www.youtube.com/watch?v=\_VwIDD9xngM

You can disable Driver Verifier

http://support.microsoft.com/kb/244617

Start - type in Search box -> verifier /reset      hit enter to disable

Use BlueScreenView to see if there is a driver specified in the error message. Also check with

MyEventViewer at the time of the BlueScreen.

If DriverVerifier creates a minidump upload it and post the link here so we can analyze it.

Hope this helps.

---

Rob Brown - Microsoft MVP <- profile - Windows Expert - Consumer : Bicycle <- Mark Twain said it right!