BSOD while restarting comp, error 0x00000024

joncc8 · 27 Nov 2011

Hey guys, I had a BSOD while trying to restart my computer. Origin and JDownloader were still running but I chose to force close the programs for the computer to restart, I don't know if that had anything to do with the blue screen that happened afterwards but I thought I'd add that.

I downloaded the whocrashed program and it said that it was caused by ntfs.sys and a possible driver conflicting with it.

I already ran chkdsk /f and sfc /scannow, no problems with either of them.

System Specs:
-Windows 7 Professional x64 (OEM)
-6gb DDR3
-NVIDIA GTX 285
-hardware is a little over 1 year old
-re-installed Windows about 4 months ago when my old hard drive died

Any help on this would be much appreciated!

Dave76 · 27 Nov 2011

Welcome to Seven Forums.

STOP 0x00000024: NTFS_FILE_SYSTEM
Usual causes: Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

Cause
One possible cause of this bug check is disk corruption. Corruption in the NTFS file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the system's ability to read and write to disk, thus causing the error.

Another possible cause is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

How much available space on your first partition, the 100 MB partition?
You should have about 290GB free space on your C drive.

D/L and run Seagate SeaTools – Short Drive Self Test and Long Drive Self Test

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800838ec78
Arg3: fffff8800838e4d0
Arg4: fffff80002aa757f

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800838ec78 -- (.exr 0xfffff8800838ec78)
ExceptionAddress: fffff80002aa757f (nt!IoGetRelatedDeviceObject+0x000000000000005f)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000100000002
Attempt to read from address 0000000100000002

CONTEXT:  fffff8800838e4d0 -- (.cxr 0xfffff8800838e4d0)
rax=fffffa8007868030 rbx=0000000000000000 rcx=fffffa8007651970
rdx=0000000100000002 rsi=0000000000000000 rdi=fffffa800742aa00
rip=fffff80002aa757f rsp=fffff8800838eeb8 rbp=fffffa800742a880
 r8=fffff9802ec08fb0  r9=fffff80002c09e00 r10=0000000000000000
r11=0000000000000000 r12=fffff8800838eef0 r13=fffffa800742aa00
r14=fffffa8007373400 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!IoGetRelatedDeviceObject+0x5f:
fffff800`02aa757f 488b12          mov     rdx,qword ptr [rdx] ds:002b:00000001`00000002=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000100000002

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cc6100
 0000000100000002 

FOLLOWUP_IP: 
Ntfs! ?? ::FNODOBFM::`string'+2b49
fffff880`01227a88 cc              int     3

FAULTING_IP: 
nt!IoGetRelatedDeviceObject+5f
fffff800`02aa757f 488b12          mov     rdx,qword ptr [rdx]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff80002d6a040 to fffff80002aa757f

STACK_TEXT:  
fffff880`0838dca8 fffff880`01227a88 : 00000000`00000024 00000000`001904fb fffff880`0838ec78 fffff880`0838e4d0 : nt!KeBugCheckEx
fffff880`0838dcb0 fffff880`01316363 : fffff880`01273b6c fffff880`0838f5b0 fffff880`0838f5b0 00000000`00000018 : Ntfs! ?? ::FNODOBFM::`string'+0x2b49
fffff880`0838dcf0 fffff800`02abfa7c : fffff880`01288a74 fffffa80`05aaeb30 fffff880`0838de40 00000000`0001237c : Ntfs! ?? ::NNGAKEGL::`string'+0x830e
fffff880`0838dd20 fffff800`02abf4fd : fffff880`01273b60 fffff880`0838f5b0 00000000`00000000 fffff880`01222000 : nt!_C_specific_handler+0x8c
fffff880`0838dd90 fffff800`02abe2d5 : fffff880`01273b60 fffff880`0838de08 fffff880`0838ec78 fffff880`01222000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0838ddc0 fffff800`02acf361 : fffff880`0838ec78 fffff880`0838e4d0 fffff880`00000000 fffffa80`0742aa00 : nt!RtlDispatchException+0x415
fffff880`0838e4a0 fffff800`02a932c2 : fffff880`0838ec78 00000000`00000000 fffff880`0838ed20 00000000`00000000 : nt!KiDispatchException+0x135
fffff880`0838eb40 fffff800`02a91e3a : 00000000`00000000 00000001`00000002 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`0838ed20 fffff800`02aa757f : fffff800`02d6a040 00000000`0000000a fffff6fc`c00ea4c0 fffff781`c0000000 : nt!KiPageFault+0x23a
fffff880`0838eeb8 fffff800`02d6a040 : 00000000`0000000a fffff6fc`c00ea4c0 fffff781`c0000000 00000000`00000000 : nt!IoGetRelatedDeviceObject+0x5f
fffff880`0838eec0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!FsRtlAcquireFileForCcFlushEx+0x3c


STACK_COMMAND:  kb

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  Ntfs! ?? ::FNODOBFM::`string'+2b49

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

FAILURE_BUCKET_ID:  X64_0x24_VRF_Ntfs!_??_::FNODOBFM::_string_+2b49

BUCKET_ID:  X64_0x24_VRF_Ntfs!_??_::FNODOBFM::_string_+2b49

Followup: MachineOwner
---------

Check your Device Manager for any yellow triangles.

Find an updated driver for your keyboard.

Code:

Standard PS/2 Keyboard	ACPI\PNP0303\4&136CDFB0&0	This device is not present, is not working properly, or does not have all its drivers installed.

Have you install all the Microsoft Windows updates?

Go to Windows update and D/L the latest MSE definition updates.

Code:

Event[49]:
  Log Name: System
  Source: Microsoft Antimalware
  Date: 2011-11-26T22:45:11.000
  Event ID: 3002
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: J07-20-2011
  Description: 
Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.
 	Feature: Behavior Monitoring
 	Error Code: 0x80004005
 	Error description: Unspecified error 
 	Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

Have you checking your CPU core temps?
Use Real Temp, to check the CPU temps when at idle, under load and/or testing.
Let us know the minimum and maximum temps you get.

Code:

Event[121]:
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2011-11-26T22:44:29.234
  Event ID: 89
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: J07-20-2011
  Description: 
ACPI thermal zone ACPI\ThermalZone\THRM has been enumerated.             
_PSV = 323K             
_TC1 = 4             
_TC2 = 3             
_TSP = 6000ms             
_AC0 = 323K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 6553K             
_HOT = 0K             
_PSL - see event data.

Event[122]:
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2011-11-26T22:44:22.312
  Event ID: 26
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: J07-20-2011
  Description: 
Processor 1 in group 0 exposes the following:

1 idle state(s)
0 performance state(s)
0 throttle state(s)

Event[123]:
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2011-11-26T22:44:22.312
  Event ID: 35
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: J07-20-2011
  Description: 
Performance power management features on processor 1 in group 0 are disabled due to a firmware problem. Check with the computer manufacturer for updated firmware.

Event[125]:
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2011-11-26T22:44:22.312
  Event ID: 35
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: J07-20-2011
  Description: 
Performance power management features on processor 7 in group 0 are disabled due to a firmware problem. Check with the computer manufacturer for updated firmware.

There are many of these errors

These are unavailable Windows drivers, check your Windows updates.

Code:

ATMFD    ATMFD.DLL    unavailable (00000000)
cdd      cdd.dll      unavailable (00000000)
Fs_Rec   Fs_Rec.sys   unavailable (00000000)
msrpc    msrpc.sys    unavailable (00000000)
Null     Null.SYS     unavailable (00000000)
TSDDD    TSDDD.dll    unavailable (00000000)
vmstorfl vmstorfl.sys unavailable (00000000)
volmgrx  volmgrx.sys  unavailable (00000000)
win32k   win32k.sys   unavailable (00000000)

joncc8 · 27 Nov 2011

Hey Dave thanks for replying.

I downloaded and ran the SeaTools and did both the short and long scans. Both tests said the hard drive passed.

I went into device manager to look for any yellow triangles but found nothing. I was trying to do that "perfmon /report" system health report as listed in the sticky here in these forums but I was not able to complete the report. I received an error saying there's a device driver missing with this line posted "Standard PS/2 Keyboard ACPI\PNP0303\4&136CDFB0&0." I downloaded and installed the latest keyboard software (intellitype 8.2) but I still can't complete that system health report. Not actually sure what to do here or if it was the cause of the BSOD.

I have the latest MSE definitions and checked windows update for any updates I may need but only saw optional updates I don't need. I still haven't checked my CPU temps with real temp just yet.

Finally, I can't duplicate the BSOD. I have shutdown and restarted this computer for various reasons and have been using the computer normally (web browsing, gaming, etc.) but nothing has happened.

Dave76 · 28 Nov 2011

Good that the HDD passed the tests.

I would check you CPU Core temps before doing anything else.
High temps can damage your CPU.
D/L RealTemp from the link above and keep it open while at idle and when running your system, especially when stressing it like gaming.

Let us know the idle and max temps you get.
Intel® Core™ i7-920 Processor

Your Tcase is 67.9°C, add 5°C for the max core temps, don't go over 72.9°C.

Do you use a PS2 keyboard?
If not, which keyboard do you have.

If you get another crash, find a different keyboard to use for a while, just to see if that is causing your crashes.
Keyboards and mice can and do cause crashes, best to rule that out.

joncc8 · 28 Nov 2011

Just wanted to post an update. I downloaded real temp and used it for a bit. When idling (idled for about 20 minutes) I see temps: 39C/35C/36C/34C. While gaming the max temp was 58C but usually around 53 Celsius.

I don't use a PS2 keyboard. My keyboard is a Microsoft Sidewinder x4 (USB) so I'm really confused about that error saying I need to update the PS2 keyboard drivers/PS2 keyboard device is not present.

I still haven't seen another crash/BSOD just yet.

joncc8 · 28 Nov 2011

Hmm, everytime I ask my friends on advice when dealing with crashes/BSODs they tell me to google the problem and if it doesn't work to reformat.

Dave76 · 29 Nov 2011

That's good advice.

With the huge amount of 'ACPI thermal zone ACPI\ThermalZone\THRM has been enumerated' and 'Microsoft Antimalware Real-Time Protection feature has encountered an error and failed' errors in the event log you are having issues.

For the thermal zone errors, keep a close watch on the CPU core temps, if it has an occasional temp spike then re-apply the thermal paste.
For the MSE errors, you should un-install MSE, then re-install it.

Check your BIOS version, if there are any updates for the issues your having you should consider updating the BIOS. This should not be done unless there is a good reason.

joncc8 · 29 Nov 2011

I finally figured out the issue with perfmon /report problem and that ps/2 keyboard driver.

I went back into device manager and clicked the option to show hidden devices. The standard ps/2 keyboard device finally shows up with that yellow triangle. I clicked update drivers and it said I had the latest drivers but still had that yellow triangle. I disabled the device but still could not run a performance report and that yellow triangle wouldn't go away. I did try uninstalling the device and I would finally be able to run the performance report but restarting or starting up the computer would bring that ps/2 keyboard device back along with that stupid triangle.

I checked the mb manufacturer's website to look for answers and found the latest BIOS update. Once I updated the BIOS, the standard ps/2 device driver issue was gone!

I still haven't seen another BSOD but at least I figured out that driver issue and I know my hd isn't bad. I'll continue to watch the temps but I just wanted to give an update and to say thanks for the help.

Dave76 · 30 Nov 2011

You're welcome.

Glad to hear you got the driver issues sorted out, good work.

Let us know if it's stable and if you have any more BSoDs.