Tech Support Forum banner
Cancel
Create thread New Forums
Status
Not open for further replies.

[SOLVED] ntfs.sys related bsod (already searched)

Jump to Latest
38K views 53 replies 6 participants last post by  phrosyn  
P
#1 ·
After seeing some excellent informed responses to a similar issue I have decided to post mine. I would really appreciate any advice.

Getting the bsod saying because of ntfs.sys

memtest86+ for 9 hours showed no errors
seatools showed no errors on hdd (done low level format anyway, chkdsk /f comes up with nothing)

I have attatched my dump file and specs below

All new setup includes;
Hdd is Seagate 500GB ST3500418AS
AMD Phenom II x4 810
GB ATI 5770
GB MA770T-UD3P
4GB G.Skill NQ 1600 DDR3 RAM
Windows 7 Ultimate x64

Please any ideas?
 

Attachments

#27 · (Edited by Moderator)
Re: ntfs.sys related bsod (already searched)

Hi here is the dump it mention memory corruption
Code: 
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\joe\Desktop\050610-14773-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*[url]http://msdl.microsoft.com/download/symbols[/url]
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a68000 PsLoadedModuleList = 0xfffff800`02ca5e50
Debug session time: Thu May  6 01:19:20.572 2010 (GMT+1)
System Uptime: 0 days 0:02:20.366
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80002dc10cc, 0, ffffffffffffffff}

Probably caused by : memory_corruption ( nt!MiApplyCompressedFixups+40 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002dc10cc, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MiApplyCompressedFixups+40
fffff800`02dc10cc 0fb603          movzx   eax,byte ptr [rbx]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d100e0
 ffffffffffffffff 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0x1E

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff880027615d8 -- (.exr 0xfffff880027615d8)
ExceptionAddress: fffff80002dc10cc (nt!MiApplyCompressedFixups+0x0000000000000040)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff88002761680 -- (.trap 0xfffff88002761680)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a002a62000 rbx=0000000000000000 rcx=fffffa8004376aa0
rdx=fffff88006199000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002dc10cc rsp=fffff88002761810 rbp=000000000000000a
 r8=0010000000000000  r9=000001feef1d0000 r10=0000000000000fff
r11=fffff88006199000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!MiApplyCompressedFixups+0x40:
fffff800`02dc10cc 0fb603          movzx   eax,byte ptr [rbx] ds:9010:00000000`00000000=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002b12929 to fffff80002ad8600

STACK_TEXT:  
fffff880`02760e08 fffff800`02b12929 : 00000000`0000001e ffffffff`c0000005 fffff800`02dc10cc 00000000`00000000 : nt!KeBugCheckEx
fffff880`02760e10 fffff800`02ad7c42 : fffff880`027615d8 00100000`00000000 fffff880`02761680 000001fe`ef1d0000 : nt!KiDispatchException+0x1b9
fffff880`027614a0 fffff800`02ad654a : 00000000`00000000 fffff880`02761688 fffff880`02761688 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`02761680 fffff800`02dc10cc : fffffa80`046893b0 fffff880`02761860 fffffa80`05a9d7c0 fffffa80`06a51af0 : nt!KiGeneralProtectionFault+0x10a
fffff880`02761810 fffff800`02dc0f45 : fffff880`06199000 000001fe`ef1d0000 00000000`00198000 fffffa80`0062b680 : nt!MiApplyCompressedFixups+0x40
fffff880`02761860 fffff800`02dae17c : fffffa80`00000000 fffffa80`06674060 00000000`00000000 fffffa80`00000000 : nt!MiPerformFixups+0x65
fffff880`027618b0 fffff800`02ac9b4c : fffffa80`0062b680 fffffa80`0685bd60 00000000`00000000 00000000`00000000 : nt!MiRelocateImagePfn+0x114
fffff880`02761910 fffff800`02aca42b : fffffa80`0685bca0 fffff880`02761a80 fffffa80`0661dec8 00000000`00000001 : nt!MiWaitForInPageComplete+0x89c
fffff880`027619f0 fffff800`02af379b : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00000000`00000000 : nt!MiIssueHardFault+0x28b
fffff880`02761ac0 fffff800`02ad66ee : 00000000`00000000 000007fe`ef3e56a0 fffff880`00000001 fffffa80`043ad1e0 : nt!MmAccessFault+0x14bb
fffff880`02761c20 000007fe`ff1d3821 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0310ebd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`ff1d3821


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiApplyCompressedFixups+40
fffff800`02dc10cc 0fb603          movzx   eax,byte ptr [rbx]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!MiApplyCompressedFixups+40

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x1E_VRF_nt!MiApplyCompressedFixups+40

BUCKET_ID:  X64_0x1E_VRF_nt!MiApplyCompressedFixups+40

Followup: MachineOwner
---------
 
T
#29 ·
Re: ntfs.sys related bsod (already searched)

Hey. This is what I would do if it were my machine:

1) Install the latest bios. http://www.gigabyte.com.tw/Support/Motherboard/BIOS_Model.aspx?ProductID=3096&ver=#anchor_os

2) Visit GSkill's website for the precise information on your memory modules. You want the vdimm (voltage), timings and frequency. Then, adjust your bios manually using this information.

3) Completely uninstall any antivirus for the moment and see how it goes.
 
P
#31 ·
Re: ntfs.sys related bsod (already searched)

Would memory corruption be unlikely since memtest86+ didnt find any problems when ran for 9 hours?

Antivirus software hasn't been anywhere near these intallations on this machine.

Latest bios is now installed.

RAM timings are set perfectly. Gskill say the voltage should be 1.5v but my bios settings only go as low a 1.6v in manual mode.

I have now disabled HDD S.M.A.R.T. Capability.

Wish me luck. Or tell me why I am only seeing voltages as low as 1.6v in DRAM???
 
#32 ·
Re: ntfs.sys related bsod (already searched)

So S.M.A.R.T. was enabled? This option gives permission to the operating system to throw an error (i.e. BSOD) if the hard drive is found to be erroneous. The weird thing is that all of the tests came back clean. Let us know how it goes from there.

I don't know much about voltages, but 1.5V for memory is low. 1.6V should be fine.
 
T
#34 ·
Re: ntfs.sys related bsod (already searched)

Alright. Now you're getting a 0x3b error.

This is how I would proceed exactly if your machine was mine. Proceed accordingly is my recommendation.

1) Unsure if you have any antivirus on the machine currently. If so, completely uninstall it and be very safe what you download and where you browse, for now. This is only temporary.

2) Completely uninstall your video driver the normal method. Then, visit Guru3d.com for Driver Sweeper. Let it rid your system of every ATI file and/or setting it possibly can.

3) Reboot to bios and set the memory voltage (vdimm) to 1.6 which fixes issues many times. Here's a recent possible example if interested to see:

http://www.techsupportforum.com/f217/bsod-new-build-completely-baffled-476799.html#post2715326

4) Reboot to Windows. Visit http://game.amd.com/us-en/drivers_catalyst.aspx to download a fresh copy of the latest video driver and install.

5) Run the machine with no antivirus for now and hope for the best. Post a new crash dump if one should unfortunately happen again.

Good luck! :grin:

Code: 
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\Temp\Rar$DI00.929\050710-15256-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a0e000 PsLoadedModuleList = 0xfffff800`02c4be50
Debug session time: Thu May  6 21:01:11.936 2010 (UTC - 4:00)
System Uptime: 0 days 0:14:59.715
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002afd155, fffff8800995e0a0, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+40789 )

Followup: MachineOwner
---------
 
T
#35 ·
Re: ntfs.sys related bsod (already searched)

You might also try to type services.msc in the start menu. Hit enter. Then disable the Windows Search service. Almost any tech instantly does this to their machine(s) anyhow.

Code: 
BUGCHECK_STR:  0x3B

PROCESS_NAME:  SearchIndexer.

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002a837b4 to fffff80002afd155
 
P
#36 ·
Re: ntfs.sys related bsod (already searched)

Deactivated Windows search service. Side note; Would that be the same if I just used the tickbox?

I have no antivirus

Removed and installed ati drivers as per instructions

Just not sure about memory voltage. Is this the same as dram? If so, my bios only lets me go down to 1.6 so that's where its always been set.
 
P
#37 ·
Re: ntfs.sys related bsod (already searched)

Boys! (maybe girls but thats probably unlikely). This is great not having to worry about a bsod waiting for me around every corner. I don't really understand why but it seems this pc has been unbsod'd for now. I should be able to confirm in a week or so...
 
T
#40 ·
Re: ntfs.sys related bsod (already searched)

Now you've got an error with your Huawei USB Modem/Serial Device driver. Perhaps to a mobile phone? You'll have to locate an updated driver and install for it.

Code: 
ewusbmdm ewusbmdm.sys Fri Dec 12 22:28:19 2008
Code: 
Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa8006fb91f1, 1, fffff88007ac5dab, 0}

Unable to load image \SystemRoot\system32\DRIVERS\ewusbmdm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ewusbmdm.sys
*** ERROR: Module load completed but symbols could not be loaded for ewusbmdm.sys

Could not read faulting driver name
Probably caused by : ewusbmdm.sys ( ewusbmdm+3dab )

Followup: MachineOwner
 
T
#43 ·
Re: ntfs.sys related bsod (already searched)

Going over your drivers another time, I noticed your Logitech mouse driver could use an update, although I don't believe it to be the cause:

Code: 
LMouFilt LMouFilt.Sys Wed Jun 17 12:49:43 2009
http://www.logitech.com/en-us/support_downloads/

Since you say you don't have any antivirus, it would probably be worth downloading Malwarebytes, installing, running and then updating to latest definitions. Finally, scan the machine to see if it picks up on anything.
 
#47 ·
Re: ntfs.sys related bsod (already searched)

Hi -

The bugcheck changed from 0xa = invalid memory referenced to 0x24 after the driver updates.

0x24 = NTFS file system - Hard Drive. Interestingly, there is an exception error showing up - 0xc0000005 = memory access violation. Any HDD encryption of any kind?

Run chkdsk /r

Run HDD manufacturer's diagnostics.

I see no software related issue in the loaded driver listings at this time to be the cause of the BSODs. All 3 dumps were VERIFIER_ENABLED, yet no 3rd party drivers flagged.

I believe the BSODs to be caused by unknown hardware failure.

Regards. . .

jcgriff2

.


BSOD BUGCHECK SUMMARY
Code: 
[font=lucida console]
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Tue May 11 05:48:09.857 2010 (GMT-4)
System Uptime: 0 days 0:08:33.620
BugCheck 24, {1904fb, fffff8800a1f6248, fffff8800a1f5ab0, fffff8800121a8a0}
Probably caused by : Ntfs.sys ( Ntfs!NtfsCleanupIrpContext+2db )
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  Nero.exe
BUGCHECK_STR:  0x24
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Tue May 11 05:38:18.613 2010 (GMT-4)
System Uptime: 0 days 0:24:37.002
BugCheck 24, {1904fb, fffff88007dda848, fffff88007dda0b0, fffff880012618a0}
Probably caused by : Ntfs.sys ( Ntfs!NtfsCleanupIrpContext+2db )
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  System
BUGCHECK_STR:  0x24
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Tue May 11 04:52:57.832 2010 (GMT-4)
System Uptime: 0 days 2:01:36.611
BugCheck A, {fffff80002d68a86, 0, 0, fffff80002af0662}
Probably caused by : ntkrnlmp.exe ( nt!RtlDispatchException+122 )
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR:  0xA
PROCESS_NAME:  csrss.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
 
[/font]
 
P
#48 ·
Re: ntfs.sys related bsod (already searched)

Nope no hdd encryption. Unknown hardware fault is frustrating. Spoke to the place where I got my components and they said they could have a look at the mobo for me. I'll let you know what they say after I bring it in
 
P
#51 ·
Re: ntfs.sys related bsod (already searched)

Thats alright blade, i'll figure it out. Took it to the guy I got the MB from who said because it was saying 'Begining dump of physical memory' that it was gauranteed to be a ram issue. But he was stank of alcohol and it was only 11am. Could this information still be accurate even though I had my ram pass a 9 hour memtest?
 
Status
Not open for further replies.
You have insufficient privileges to reply here.
Tech Support Forum
posts
4.8M
members
966K
Since
2002
A forum community dedicated to tech experts and enthusiasts. Come join the discussion about articles, computer security, Mac, Microsoft, Linux, hardware, networking, gaming, reviews, accessories, and more!
Full Forum Listing
Explore Our Forums
Windows XP Support Windows 7 , Windows Vista Support Motherboards, Bios|UEFI & CPU Networking Support Laptop Support