ntoskrnl.exe 0x0000001E BSOD

Another BSOD. The USB thing must have been some part of the problem, since it was a longer interval between BSODs.

NTFS_File_System.

*Note: I do still have Verifier running. I am going to be turning it off today.

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\justinbronze\Windows_NT6_BSOD_jcgriff2\012212-42993-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c57000 PsLoadedModuleList = 0xfffff800`02e9c670
Debug session time: Sun Jan 22 03:38:43.091 2012 (UTC - 7:00)
System Uptime: 6 days 7:29:15.636
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
........................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {190477, fffff880097490e8, fffff88009748940, fffff8800125d138}

Probably caused by : Ntfs.sys ( Ntfs!NtfsMapUserBuffer+28 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 0000000000190477
Arg2: fffff880097490e8
Arg3: fffff88009748940
Arg4: fffff8800125d138

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880097490e8 -- (.exr 0xfffff880097490e8)
ExceptionAddress: fffff8800125d138 (Ntfs!NtfsMapUserBuffer+0x0000000000000028)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88009748940 -- (.cxr 0xfffff88009748940)
rax=fffff9808bb80c60 rbx=000000035c3ea900 rcx=fffa8006a269f000
rdx=0000000000000020 rsi=0000000000000001 rdi=0000000000000000
rip=fffff8800125d138 rsp=fffff88009749320 rbp=fffff88009749800
 r8=fffff880097493b8  r9=fffff88009749480 r10=fffff88009749478
r11=fffff8a0001556d0 r12=fffff8a0002c5140 r13=fffffa8004e87b70
r14=fffff9808bb80c60 r15=fffff9808bb80f70
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
Ntfs!NtfsMapUserBuffer+0x28:
fffff880`0125d138 f6410a05        test    byte ptr [rcx+0Ah],5 ds:002b:fffa8006`a269f00a=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  MsMpEng.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f06100
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsMapUserBuffer+28
fffff880`0125d138 f6410a05        test    byte ptr [rcx+0Ah],5

FAULTING_IP: 
Ntfs!NtfsMapUserBuffer+28
fffff880`0125d138 f6410a05        test    byte ptr [rcx+0Ah],5

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff8800130eb05 to fffff8800125d138

STACK_TEXT:  
fffff880`09749320 fffff880`0130eb05 : fffff880`097493d0 fffffa80`04e87b70 fffff8a0`1a872b40 fffffa80`04e87b70 : Ntfs!NtfsMapUserBuffer+0x28
fffff880`09749360 fffff880`0130d754 : fffffa80`04e87b70 fffff980`8bb80c60 00000000`00000003 00000000`ffffff40 : Ntfs!NtfsReadUsnJournal+0xb5
fffff880`097494d0 fffff880`012fb88a : fffffa80`04e87b70 fffff8a0`002c5140 00000003`5c3ea900 fffff880`00000101 : Ntfs!NtOfsPostNewLength+0xc8
fffff880`09749560 fffff880`0130e203 : 00000000`00000001 fffff880`09749800 fffffa80`04e87b70 00000000`00000000 : Ntfs!NtfsCommitCurrentTransaction+0x22a
fffff880`097495f0 fffff880`0126411e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCheckpointCurrentTransaction+0x27
fffff880`09749620 fffff880`012651a3 : fffffa80`04e87b70 fffff980`8ddb8c60 fffff880`09749801 fffff880`09749800 : Ntfs!NtfsCommonWrite+0x28b8
fffff880`097497d0 fffff800`03179c16 : fffff980`8ddb8c60 fffff980`8ddb8c60 fffffa80`0545c030 fffffa80`067942e0 : Ntfs!NtfsFsdWrite+0x1c3
fffff880`09749890 fffff880`0115fbcf : fffff980`8ddb8fb8 fffff880`09749940 fffffa80`05dd9360 fffffa80`067942e0 : nt!IovCallDriver+0x566
fffff880`097498f0 fffff880`0115e6df : fffffa80`05121de0 fffffa80`05121de0 fffffa80`05121d00 fffff980`8ddb8c60 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`09749980 fffff800`03179c16 : fffff980`8ddb8c60 00000000`00000002 fffff980`8ddb8c60 00000000`00000000 : fltmgr!FltpDispatch+0xcf
fffff880`097499e0 fffff800`02fdc21b : 00000000`00000001 fffffa80`04c0bb60 00000000`00000001 fffffa80`094f96f0 : nt!IovCallDriver+0x566
fffff880`09749a40 fffff800`02fe6c83 : fffff980`8ddb9000 fffff880`09749ca0 fffffa80`04c0bb60 00000000`00000000 : nt!IopSynchronousServiceTail+0xfb
fffff880`09749ab0 fffff800`02cd2ed3 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x7e2
fffff880`09749bb0 00000000`7708139a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`020ef5e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7708139a


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsMapUserBuffer+28

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

STACK_COMMAND:  .cxr 0xfffff88009748940 ; kb

FAILURE_BUCKET_ID:  X64_0x24_VRF_Ntfs!NtfsMapUserBuffer+28

BUCKET_ID:  X64_0x24_VRF_Ntfs!NtfsMapUserBuffer+28

Followup: MachineOwner
---------

Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log

Also, since you keep getting disk related crashes, check for an update to your IDE ATA/ATAPI controllers devices in Device Manager. If no updates exist, the drivers for them may be corrupted. Uninstall each of those devices through right clicking each of them in device manager, clicking uninstall, putting a tick in "Delete the driver software for this device", and then hitting OK. Restart the computer after uninstalling drivers for all devices and install the latest driver for each of the devices.

Okay. Disk check is scheduled. I just finished uninstalling the devices (four of them, no updates for any). Had to restart three times, one to finish uninstalling, and twice to "apply changes". It now shows that I have 10 IDE controller devices, and one I had previously is gone.

So three of the four controller devices are still present in the current 10 (The one missing had AMD in the name. But everything seems to be running fine and opening fine.)

justinbronze said:

Okay. Disk check is scheduled. I just finished uninstalling the devices (four of them, no updates for any). Had to restart three times, one to finish uninstalling, and twice to "apply changes". It now shows that I have 10 IDE controller devices, and one I had previously is gone.

So three of the four controller devices are still present in the current 10 (The one missing had AMD in the name. But everything seems to be running fine and opening fine.)

Any exclamation marks indicating a device is unknown?

Nope. And since there nothing indicating a device is unknown, and nothing seems affected negatively, I'd say the removal of whatever it was was for the better.

Hopefully. Go ahead and disable Verifier and see how the stability is. If you continue to have problems, I would highly recommend considering at least a repair install if not a clean install.

I will do the repair install if there are anymore BSODs.

And I would like to thank you VERY VERY much for helping so much this past month or so. I greatly appreciate you sticking with me and helping me.

You are welcome. I will stick through until we get it resolved, no doubt about that. :)

Here's the Disk Check.

Weirdest thing just happened. As soon as I clicked 'submit post' on here to send the chkdsk file, I got an IRQL Blue screen. So here's a zip file.

I've turned verifier back on to prevent BSODs.