Welcome to Seven Forums.
STOP 0x00000024: NTFS_FILE_SYSTEM
Usual causes: Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure
Cause
One possible cause of this bug check is disk corruption. Corruption in the NTFS file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the system's ability to read and write to disk, thus causing the error.
Another possible cause is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.
How much available space on your first partition, the 100 MB partition?
You should have about 290GB free space on your C drive.
D/L and run Seagate SeaTools – Short Drive Self Test and Long Drive Self Test
Code:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800838ec78
Arg3: fffff8800838e4d0
Arg4: fffff80002aa757f
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800838ec78 -- (.exr 0xfffff8800838ec78)
ExceptionAddress: fffff80002aa757f (nt!IoGetRelatedDeviceObject+0x000000000000005f)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000100000002
Attempt to read from address 0000000100000002
CONTEXT: fffff8800838e4d0 -- (.cxr 0xfffff8800838e4d0)
rax=fffffa8007868030 rbx=0000000000000000 rcx=fffffa8007651970
rdx=0000000100000002 rsi=0000000000000000 rdi=fffffa800742aa00
rip=fffff80002aa757f rsp=fffff8800838eeb8 rbp=fffffa800742a880
r8=fffff9802ec08fb0 r9=fffff80002c09e00 r10=0000000000000000
r11=0000000000000000 r12=fffff8800838eef0 r13=fffffa800742aa00
r14=fffffa8007373400 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!IoGetRelatedDeviceObject+0x5f:
fffff800`02aa757f 488b12 mov rdx,qword ptr [rdx] ds:002b:00000001`00000002=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000100000002
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cc6100
0000000100000002
FOLLOWUP_IP:
Ntfs! ?? ::FNODOBFM::`string'+2b49
fffff880`01227a88 cc int 3
FAULTING_IP:
nt!IoGetRelatedDeviceObject+5f
fffff800`02aa757f 488b12 mov rdx,qword ptr [rdx]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff80002d6a040 to fffff80002aa757f
STACK_TEXT:
fffff880`0838dca8 fffff880`01227a88 : 00000000`00000024 00000000`001904fb fffff880`0838ec78 fffff880`0838e4d0 : nt!KeBugCheckEx
fffff880`0838dcb0 fffff880`01316363 : fffff880`01273b6c fffff880`0838f5b0 fffff880`0838f5b0 00000000`00000018 : Ntfs! ?? ::FNODOBFM::`string'+0x2b49
fffff880`0838dcf0 fffff800`02abfa7c : fffff880`01288a74 fffffa80`05aaeb30 fffff880`0838de40 00000000`0001237c : Ntfs! ?? ::NNGAKEGL::`string'+0x830e
fffff880`0838dd20 fffff800`02abf4fd : fffff880`01273b60 fffff880`0838f5b0 00000000`00000000 fffff880`01222000 : nt!_C_specific_handler+0x8c
fffff880`0838dd90 fffff800`02abe2d5 : fffff880`01273b60 fffff880`0838de08 fffff880`0838ec78 fffff880`01222000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0838ddc0 fffff800`02acf361 : fffff880`0838ec78 fffff880`0838e4d0 fffff880`00000000 fffffa80`0742aa00 : nt!RtlDispatchException+0x415
fffff880`0838e4a0 fffff800`02a932c2 : fffff880`0838ec78 00000000`00000000 fffff880`0838ed20 00000000`00000000 : nt!KiDispatchException+0x135
fffff880`0838eb40 fffff800`02a91e3a : 00000000`00000000 00000001`00000002 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`0838ed20 fffff800`02aa757f : fffff800`02d6a040 00000000`0000000a fffff6fc`c00ea4c0 fffff781`c0000000 : nt!KiPageFault+0x23a
fffff880`0838eeb8 fffff800`02d6a040 : 00000000`0000000a fffff6fc`c00ea4c0 fffff781`c0000000 00000000`00000000 : nt!IoGetRelatedDeviceObject+0x5f
fffff880`0838eec0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!FsRtlAcquireFileForCcFlushEx+0x3c
STACK_COMMAND: kb
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: Ntfs! ?? ::FNODOBFM::`string'+2b49
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
FAILURE_BUCKET_ID: X64_0x24_VRF_Ntfs!_??_::FNODOBFM::_string_+2b49
BUCKET_ID: X64_0x24_VRF_Ntfs!_??_::FNODOBFM::_string_+2b49
Followup: MachineOwner
---------
Check your Device Manager for any yellow triangles.
Find an updated driver for your keyboard.
Code:
Standard PS/2 Keyboard ACPI\PNP0303\4&136CDFB0&0 This device is not present, is not working properly, or does not have all its drivers installed.
Have you install all the Microsoft Windows updates?
Go to Windows update and D/L the latest MSE definition updates.
Code:
Event[49]:
Log Name: System
Source: Microsoft Antimalware
Date: 2011-11-26T22:45:11.000
Event ID: 3002
Task: N/A
Level: Error
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: J07-20-2011
Description:
Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.
Feature: Behavior Monitoring
Error Code: 0x80004005
Error description: Unspecified error
Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
Have you checking your CPU core temps?
Use Real Temp, to check the CPU temps when at idle, under load and/or testing.
Let us know the minimum and maximum temps you get.
Code:
Event[121]:
Log Name: System
Source: Microsoft-Windows-Kernel-Power
Date: 2011-11-26T22:44:29.234
Event ID: 89
Task: N/A
Level: Information
Opcode: Info
Keyword: N/A
User: S-1-5-18
User Name: NT AUTHORITY\SYSTEM
Computer: J07-20-2011
Description:
ACPI thermal zone ACPI\ThermalZone\THRM has been enumerated.
_PSV = 323K
_TC1 = 4
_TC2 = 3
_TSP = 6000ms
_AC0 = 323K
_AC1 = 0K
_AC2 = 0K
_AC3 = 0K
_AC4 = 0K
_AC5 = 0K
_AC6 = 0K
_AC7 = 0K
_AC8 = 0K
_AC9 = 0K
_CRT = 6553K
_HOT = 0K
_PSL - see event data.
Event[122]:
Log Name: System
Source: Microsoft-Windows-Kernel-Processor-Power
Date: 2011-11-26T22:44:22.312
Event ID: 26
Task: N/A
Level: Information
Opcode: Info
Keyword: N/A
User: S-1-5-18
User Name: NT AUTHORITY\SYSTEM
Computer: J07-20-2011
Description:
Processor 1 in group 0 exposes the following:
1 idle state(s)
0 performance state(s)
0 throttle state(s)
Event[123]:
Log Name: System
Source: Microsoft-Windows-Kernel-Processor-Power
Date: 2011-11-26T22:44:22.312
Event ID: 35
Task: N/A
Level: Error
Opcode: Info
Keyword: N/A
User: S-1-5-18
User Name: NT AUTHORITY\SYSTEM
Computer: J07-20-2011
Description:
Performance power management features on processor 1 in group 0 are disabled due to a firmware problem. Check with the computer manufacturer for updated firmware.
Event[125]:
Log Name: System
Source: Microsoft-Windows-Kernel-Processor-Power
Date: 2011-11-26T22:44:22.312
Event ID: 35
Task: N/A
Level: Error
Opcode: Info
Keyword: N/A
User: S-1-5-18
User Name: NT AUTHORITY\SYSTEM
Computer: J07-20-2011
Description:
Performance power management features on processor 7 in group 0 are disabled due to a firmware problem. Check with the computer manufacturer for updated firmware.
There are many of these errors
These are unavailable Windows drivers, check your Windows updates.
Code:
ATMFD ATMFD.DLL unavailable (00000000)
cdd cdd.dll unavailable (00000000)
Fs_Rec Fs_Rec.sys unavailable (00000000)
msrpc msrpc.sys unavailable (00000000)
Null Null.SYS unavailable (00000000)
TSDDD TSDDD.dll unavailable (00000000)
vmstorfl vmstorfl.sys unavailable (00000000)
volmgrx volmgrx.sys unavailable (00000000)
win32k win32k.sys unavailable (00000000)