Log in
Register
What's new
Search
Search
Search titles only
By:
Menu
Log in
Register
What's new
Search
Search
Search titles only
By:
Forums
Tutorials
About
Rules
What's New
Driver Reference Table
Donate
Search titles only
By:
Latest activity
Register
Microsoft Support & Malware Removal
BSOD Crashes, Kernel Debugging
Windows 7 System Random BSOD
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Reply to thread
Message
<blockquote data-quote="Patrick" data-source="post: 75478" data-attributes="member: 208"><p>Hi,</p><p></p><p>Three bug checks:</p><p></p><p><u><strong>NTFS_FILE_SYSTEM (24)</strong></u></p><p></p><p><em>This indicates a problem occurred in ntfs.sys, the driver file that allows the system to read and write to NTFS drives.</em></p><p></p><p>One possible cause of this bug check is disk corruption. Corruption in the NTFS file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the system's ability to read and write to disk, thus causing the error.</p><p></p><p>Another possible cause is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.</p><p></p><p>[CODE]1: kd> .exr 0xfffff88005045388</p><p>ExceptionAddress: fffff8800129a999 (<span style="color: #4b0082">Ntfs!NtfsFullDeleteLcb+0x00000000000000a9</span>)</p><p> ExceptionCode: <span style="color: #ff0000">c0000005 (Access violation)</span></p><p></p><p>[/CODE]</p><p></p><p>[CODE]1: kd> k</p><p>Child-SP RetAddr Call Site</p><p>fffff880`05044398 fffff880`01213211 nt!KeBugCheckEx</p><p>fffff880`050443a0 fffff880`013049af Ntfs! ?? ::FNODOBFM::`string'+0x299d</p><p>fffff880`050443e0 fffff800`028fccdc Ntfs! ?? ::NNGAKEGL::`string'+0x850c</p><p>fffff880`05044430 fffff800`028fc75d nt!_C_specific_handler+0x8c</p><p>fffff880`050444a0 fffff800`028fb535 nt!RtlpExecuteHandlerForException+0xd</p><p>fffff880`050444d0 fffff800`0290c4c1 nt!RtlDispatchException+0x415</p><p>fffff880`05044bb0 fffff800`028d1242 nt!KiDispatchException+0x135</p><p>fffff880`05045250 fffff800`028cfb4a nt!KiExceptionDispatch+0xc2</p><p>fffff880`05045430 fffff880`0129a999 nt!KiGeneralProtectionFault+0x10a</p><p>fffff880`050455c0 fffff880`01216279 Ntfs!NtfsFullDeleteLcb+0xa9</p><p>fffff880`050455f0 fffff880`0129ba2c Ntfs!NtfsTeardownFromLcb+0x129</p><p>fffff880`05045680 fffff880`0121ea52 Ntfs!NtfsTeardownStructures+0xcc</p><p>fffff880`05045700 fffff880`012ab2d3 Ntfs!NtfsDecrementCloseCounts+0xa2</p><p>fffff880`05045740 fffff880`012b281c Ntfs!NtfsCommonClose+0x353</p><p>fffff880`05045810 fffff880`010a7bcf Ntfs!NtfsFsdClose+0x2dc</p><p>fffff880`05045910 fffff880`010a66df fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f</p><p>fffff880`050459a0 fffff800`02bcf3ce fltmgr!FltpDispatch+0xcf</p><p>fffff880`05045a00 fffff800`028dae54 nt!IopDeleteFile+0x11e</p><p>fffff880`05045a90 fffff800`02915c94 nt!ObfDereferenceObject+0xd4</p><p>fffff880`05045af0 fffff800`029164be nt!CcDeleteSharedCacheMap+0x224</p><p>fffff880`05045b50 fffff800`02916af8 nt!CcWriteBehind+0x54e</p><p>fffff880`05045c00 fffff800`028db261 nt!CcWorkerThread+0x1c8</p><p>fffff880`05045cb0 fffff800`02b6d73a nt!ExpWorkerThread+0x111</p><p>fffff880`05045d40 fffff800`028c28e6 nt!PspSystemThreadStartup+0x5a</p><p>fffff880`05045d80 00000000`00000000 nt!KxStartSystemThread+0x16</p><p></p><p>[/CODE]</p><p></p><p>At the time of the crash, the NT File System driver is doing a teardown/deletion of the LCB.</p><p></p><p><u><strong>DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)</strong></u></p><p></p><p><em>This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.</em></p><p></p><p>A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high. This bug check is usually caused by drivers that have used improper addresses.</p><p></p><p>[CODE]0: kd> k</p><p>Child-SP RetAddr Call Site</p><p>fffff880`06356f68 fffff800`02883169 nt!KeBugCheckEx</p><p>fffff880`06356f70 fffff800`02881de0 nt!KiBugCheckDispatch+0x69</p><p>fffff880`063570b0 fffff880`012f668c nt!KiPageFault+0x260</p><p>fffff880`06357248 fffff800`028aecdc Ntfs! ?? ::NNGAKEGL::`string'+0x6f60</p><p>fffff880`06357250 fffff800`028ae75d nt!_C_specific_handler+0x8c</p><p>fffff880`063572c0 fffff800`028ad535 nt!RtlpExecuteHandlerForException+0xd</p><p>fffff880`063572f0 fffff800`028be4c1 nt!RtlDispatchException+0x415</p><p>fffff880`063579d0 fffff800`02883242 nt!KiDispatchException+0x135</p><p>fffff880`06358070 fffff800`02881b4a nt!KiExceptionDispatch+0xc2</p><p>fffff880`06358250 fffff800`028c430e nt!KiGeneralProtectionFault+0x10a</p><p>fffff880`063583e0 fffff880`012872e7 nt!CcFlushCache+0x11e</p><p>fffff880`063584e0 fffff880`0127d137 Ntfs!NtfsFlushUserStream+0xb7</p><p>fffff880`06358560 fffff880`012207c8 Ntfs!NtfsFlushVolume+0x2a7</p><p>fffff880`06358690 fffff880`0120db9f Ntfs!NtfsVolumeDasdIo+0x1b8</p><p>fffff880`06358740 fffff880`0120f398 Ntfs!NtfsCommonRead+0x5bf</p><p>fffff880`063588b0 fffff880`0115abcf Ntfs!NtfsFsdRead+0x1b8</p><p>fffff880`06358960 fffff880`011596df fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f</p><p>fffff880`063589f0 fffff800`02b8dc3b fltmgr!FltpDispatch+0xcf</p><p>fffff880`06358a50 fffff800`02b6dd53 nt!IopSynchronousServiceTail+0xfb</p><p>fffff880`06358ac0 fffff800`02882e53 nt!NtReadFile+0x631</p><p>fffff880`06358bb0 00000000`74ad2e09 nt!KiSystemServiceCopyEnd+0x13</p><p>00000000`0862e958 00000000`00000000 0x74ad2e09</p><p></p><p>[/CODE]</p><p></p><p>More NT File System stuff, flushing a volume/user stream at the time of the crash.</p><p></p><p><u><strong>IRQL_NOT_LESS_OR_EQUAL (a)</strong></u></p><p></p><p><em>This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.</em></p><p></p><p>This bug check is issued if paged memory (or invalid memory) is accessed when the IRQL is too high. The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS.</p><p></p><p>[HR][/HR]</p><p>Remove and replace avast! with Microsoft Security Essentials for temporary troubleshooting purposes as it's likely causing file system conflicts:</p><p></p><p><strong>avast! removal -</strong> <a href="http://www.avast.com/uninstall-utility" target="_blank">avast! Uninstall Utility | Download aswClear for avast! Removal</a></p><p></p><p><strong>MSE -</strong> <a href="http://windows.microsoft.com/en-us/windows/security-essentials-download" target="_blank">Microsoft Security Essentials - Microsoft Windows</a></p><p></p><p>Regards,</p><p></p><p>Patrick</p></blockquote><p></p>
[QUOTE="Patrick, post: 75478, member: 208"] Hi, Three bug checks: [U][B]NTFS_FILE_SYSTEM (24)[/B][/U] [I]This indicates a problem occurred in ntfs.sys, the driver file that allows the system to read and write to NTFS drives.[/I] One possible cause of this bug check is disk corruption. Corruption in the NTFS file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the system's ability to read and write to disk, thus causing the error. Another possible cause is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error. [CODE]1: kd> .exr 0xfffff88005045388 ExceptionAddress: fffff8800129a999 ([COLOR=#4b0082]Ntfs!NtfsFullDeleteLcb+0x00000000000000a9[/COLOR]) ExceptionCode: [COLOR=#ff0000]c0000005 (Access violation)[/COLOR] [/CODE] [CODE]1: kd> k Child-SP RetAddr Call Site fffff880`05044398 fffff880`01213211 nt!KeBugCheckEx fffff880`050443a0 fffff880`013049af Ntfs! ?? ::FNODOBFM::`string'+0x299d fffff880`050443e0 fffff800`028fccdc Ntfs! ?? ::NNGAKEGL::`string'+0x850c fffff880`05044430 fffff800`028fc75d nt!_C_specific_handler+0x8c fffff880`050444a0 fffff800`028fb535 nt!RtlpExecuteHandlerForException+0xd fffff880`050444d0 fffff800`0290c4c1 nt!RtlDispatchException+0x415 fffff880`05044bb0 fffff800`028d1242 nt!KiDispatchException+0x135 fffff880`05045250 fffff800`028cfb4a nt!KiExceptionDispatch+0xc2 fffff880`05045430 fffff880`0129a999 nt!KiGeneralProtectionFault+0x10a fffff880`050455c0 fffff880`01216279 Ntfs!NtfsFullDeleteLcb+0xa9 fffff880`050455f0 fffff880`0129ba2c Ntfs!NtfsTeardownFromLcb+0x129 fffff880`05045680 fffff880`0121ea52 Ntfs!NtfsTeardownStructures+0xcc fffff880`05045700 fffff880`012ab2d3 Ntfs!NtfsDecrementCloseCounts+0xa2 fffff880`05045740 fffff880`012b281c Ntfs!NtfsCommonClose+0x353 fffff880`05045810 fffff880`010a7bcf Ntfs!NtfsFsdClose+0x2dc fffff880`05045910 fffff880`010a66df fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`050459a0 fffff800`02bcf3ce fltmgr!FltpDispatch+0xcf fffff880`05045a00 fffff800`028dae54 nt!IopDeleteFile+0x11e fffff880`05045a90 fffff800`02915c94 nt!ObfDereferenceObject+0xd4 fffff880`05045af0 fffff800`029164be nt!CcDeleteSharedCacheMap+0x224 fffff880`05045b50 fffff800`02916af8 nt!CcWriteBehind+0x54e fffff880`05045c00 fffff800`028db261 nt!CcWorkerThread+0x1c8 fffff880`05045cb0 fffff800`02b6d73a nt!ExpWorkerThread+0x111 fffff880`05045d40 fffff800`028c28e6 nt!PspSystemThreadStartup+0x5a fffff880`05045d80 00000000`00000000 nt!KxStartSystemThread+0x16 [/CODE] At the time of the crash, the NT File System driver is doing a teardown/deletion of the LCB. [U][B]DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)[/B][/U] [I]This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.[/I] A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high. This bug check is usually caused by drivers that have used improper addresses. [CODE]0: kd> k Child-SP RetAddr Call Site fffff880`06356f68 fffff800`02883169 nt!KeBugCheckEx fffff880`06356f70 fffff800`02881de0 nt!KiBugCheckDispatch+0x69 fffff880`063570b0 fffff880`012f668c nt!KiPageFault+0x260 fffff880`06357248 fffff800`028aecdc Ntfs! ?? ::NNGAKEGL::`string'+0x6f60 fffff880`06357250 fffff800`028ae75d nt!_C_specific_handler+0x8c fffff880`063572c0 fffff800`028ad535 nt!RtlpExecuteHandlerForException+0xd fffff880`063572f0 fffff800`028be4c1 nt!RtlDispatchException+0x415 fffff880`063579d0 fffff800`02883242 nt!KiDispatchException+0x135 fffff880`06358070 fffff800`02881b4a nt!KiExceptionDispatch+0xc2 fffff880`06358250 fffff800`028c430e nt!KiGeneralProtectionFault+0x10a fffff880`063583e0 fffff880`012872e7 nt!CcFlushCache+0x11e fffff880`063584e0 fffff880`0127d137 Ntfs!NtfsFlushUserStream+0xb7 fffff880`06358560 fffff880`012207c8 Ntfs!NtfsFlushVolume+0x2a7 fffff880`06358690 fffff880`0120db9f Ntfs!NtfsVolumeDasdIo+0x1b8 fffff880`06358740 fffff880`0120f398 Ntfs!NtfsCommonRead+0x5bf fffff880`063588b0 fffff880`0115abcf Ntfs!NtfsFsdRead+0x1b8 fffff880`06358960 fffff880`011596df fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`063589f0 fffff800`02b8dc3b fltmgr!FltpDispatch+0xcf fffff880`06358a50 fffff800`02b6dd53 nt!IopSynchronousServiceTail+0xfb fffff880`06358ac0 fffff800`02882e53 nt!NtReadFile+0x631 fffff880`06358bb0 00000000`74ad2e09 nt!KiSystemServiceCopyEnd+0x13 00000000`0862e958 00000000`00000000 0x74ad2e09 [/CODE] More NT File System stuff, flushing a volume/user stream at the time of the crash. [U][B]IRQL_NOT_LESS_OR_EQUAL (a)[/B][/U] [I]This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.[/I] This bug check is issued if paged memory (or invalid memory) is accessed when the IRQL is too high. The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS. [HR][/HR] Remove and replace avast! with Microsoft Security Essentials for temporary troubleshooting purposes as it's likely causing file system conflicts: [B]avast! removal -[/B] [url=http://www.avast.com/uninstall-utility]avast! Uninstall Utility | Download aswClear for avast! Removal[/url] [B]MSE -[/B] [url=http://windows.microsoft.com/en-us/windows/security-essentials-download]Microsoft Security Essentials - Microsoft Windows[/url] Regards, Patrick [/QUOTE]
Insert quotes...
Verification
Post reply
Microsoft Support & Malware Removal
BSOD Crashes, Kernel Debugging
Windows 7 System Random BSOD
Menu
Log in
Register
Top
