BSOD on boot every time after I shut down, error 0x00000024

BobbleHead · 25 Mar 2012

Hi everyone,

I've had this problem for a while and it drives me nuts. Every time I shut down my computer it will crash the next time I power up and try to boot windows 7. I can go in and out of sleep or hibernate without issue but if I ever shut down my system it will BSOD during the next power on. After this initial BSOD there are usually a series of BSOD (usually they report different error codes) in subsequent restarts. Eventually the system does seem to stabilize and stop crashing. Once things are working it will run for literally months without another BSOD.

Any help would be appreciated. Thanks so much

Win 7 Ultimate x64 (retail)
8gb DDR3 ram
i5 750 @ 2.67ghz
RadeonHD 5770 1gb

system is less than 2 years old and OS was last installed ~18 months ago (c: partition reformat and clean install)

writhziden · 25 Mar 2012

Security Software (this is just a check that you have security software and it is running properly; nothing needs to be done at this time regarding this): Microsoft Security Essentials; SUPERAntiSpyware.

Possible out of date drivers:

Code:

AsUpIO	fffff880`04588000	fffff880`0458e000	Sun Jul 05 20:21:38 2009 (4a515fb2)	0000edf8		AsUpIO.sys

ASUS hardware monitoring software; probably not a problem that it is out of date...

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\BobbleHead\Windows_NT6_BSOD_jcgriff2\032412-30030-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`03c4a000 PsLoadedModuleList = 0xfffff800`03e8e650
Debug session time: Sat Mar 24 22:05:00.190 2012 (UTC - 6:00)
System Uptime: 0 days 0:06:42.486
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88003393758, fffff88003392fb0, fffff80003cd849a}

Probably caused by : Ntfs.sys ( Ntfs!NtfsTeardownFromLcb+fb )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88003393758
Arg3: fffff88003392fb0
Arg4: fffff80003cd849a

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88003393758 -- (.exr 0xfffff88003393758)
ExceptionAddress: fffff80003cd849a (nt!ExAcquireFastMutex+0x000000000000001a)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000000
Attempt to write to address 0000000000000000

CONTEXT:  fffff88003392fb0 -- (.cxr 0xfffff88003392fb0)
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa8006790b60 rsi=fffff88003393b01 rdi=0000000000000000
rip=fffff80003cd849a rsp=fffff88003393990 rbp=fffff80003e66260
 r8=0000000000000000  r9=0000000000000000 r10=fffff80003c4a000
r11=fffff88003393990 r12=fffff8a00fdfeb40 r13=fffff8a00fd80940
r14=fffff8a00fdfee00 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!ExAcquireFastMutex+0x1a:
fffff800`03cd849a f00fba3100      lock btr dword ptr [rcx],0 ds:002b:00000000`00000000=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  NULL_DEREFERENCE

PROCESS_NAME:  System

CURRENT_IRQL:  1

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000000

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003ef8100
 0000000000000000 

FOLLOWUP_IP: 
Ntfs!NtfsTeardownFromLcb+fb
fffff880`0125888b 83bfc000000000  cmp     dword ptr [rdi+0C0h],0

FAULTING_IP: 
nt!ExAcquireFastMutex+1a
fffff800`03cd849a f00fba3100      lock btr dword ptr [rcx],0

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff8800125888b to fffff80003cd849a

STACK_TEXT:  
fffff880`03393990 fffff880`0125888b : fffff8a0`0fdfeb40 fffff800`03e66260 fffff880`03393b01 fffff880`012e0cc1 : nt!ExAcquireFastMutex+0x1a
fffff880`033939c0 fffff880`012de63c : fffffa80`068b3490 fffffa80`08193180 fffff8a0`0fdfeb40 fffff8a0`0fdfeed8 : Ntfs!NtfsTeardownFromLcb+0xfb
fffff880`03393a50 fffff880`012600e2 : fffffa80`068b3490 fffffa80`068b3490 fffff8a0`0fdfeb40 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xcc
fffff880`03393ad0 fffff880`012ee193 : fffffa80`068b3490 fffff800`03e66260 fffff8a0`0fdfeb40 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`03393b10 fffff880`012dd357 : fffffa80`068b3490 fffff8a0`0fdfec70 fffff8a0`0fdfeb40 fffffa80`08193180 : Ntfs!NtfsCommonClose+0x353
fffff880`03393be0 fffff800`03cd0471 : 00000000`00000000 fffff800`03fbc700 fffff800`03ec7800 fffff800`00000005 : Ntfs!NtfsFspClose+0x15f
fffff880`03393cb0 fffff800`03f60f7a : 00000000`00000000 fffffa80`06790b60 00000000`00000080 fffffa80`06710890 : nt!ExpWorkerThread+0x111
fffff880`03393d40 fffff800`03cb79c6 : fffff880`03164180 fffffa80`06790b60 fffff880`0316efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03393d80 00000000`00000000 : fffff880`03394000 fffff880`0338e000 fffff880`033939e0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  Ntfs!NtfsTeardownFromLcb+fb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

STACK_COMMAND:  .cxr 0xfffff88003392fb0 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsTeardownFromLcb+fb

BUCKET_ID:  X64_0x24_Ntfs!NtfsTeardownFromLcb+fb

Followup: MachineOwner
---------

How often do you run disk checks?

Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log.
For any drives that do not give the message:
Windows has checked the file system and found no problems
run disk check again as above. In other words, if it says:
Windows has made corrections to the file system
after running the disk check, run the disk check again.

Please use System Info - See Your System Specs to provide more information about your hard disks.

BobbleHead · 25 Mar 2012

Here is the checkdisk I ran on startup of drive C: (Win partition)

Code:

Log Name:      Application
Source:        Microsoft-Windows-Wininit
Date:          3/25/2012 3:43:51 AM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Mikey-PC
Description:


Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.                         

CHKDSK is verifying files (stage 1 of 5)...
  452352 file records processed.                                         

File verification completed.
  572 large file records processed.                                   

  0 bad file records processed.                                     

  2 EA records processed.                                           

  72 reparse records processed.                                      

CHKDSK is verifying indexes (stage 2 of 5)...
  556306 index entries processed.                                        

Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered.                                      

CHKDSK is verifying security descriptors (stage 3 of 5)...
  452352 file SDs/SIDs processed.                                        

Cleaning up 18 unused index entries from index $SII of file 0x9.
Cleaning up 18 unused index entries from index $SDH of file 0x9.
Cleaning up 18 unused security descriptors.
Security descriptor verification completed.
  51978 data files processed.                                           

CHKDSK is verifying Usn Journal...
  37480648 USN bytes processed.                                            

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
  452336 files processed.                                                

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
  10575140 free clusters processed.                                        

Free space verification is complete.
Windows has checked the file system and found no problems.

 118545407 KB total disk space.
  75524664 KB in 346976 files.
    159820 KB in 51979 indexes.
         0 KB in bad sectors.
    560363 KB in use by the system.
     65536 KB occupied by the log file.
  42300560 KB available on disk.

      4096 bytes in each allocation unit.
  29636351 total allocation units on disk.
  10575140 allocation units available on disk.

Internal Info:
00 e7 06 00 72 16 06 00 15 64 0a 00 00 00 00 00  ....r....d......
49 03 00 00 48 00 00 00 00 00 00 00 00 00 00 00  I...H...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-03-25T10:43:51.000000000Z" />
    <EventRecordID>35964</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>Mikey-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.                         

CHKDSK is verifying files (stage 1 of 5)...
  452352 file records processed.                                         

File verification completed.
  572 large file records processed.                                   

  0 bad file records processed.                                     

  2 EA records processed.                                           

  72 reparse records processed.                                      

CHKDSK is verifying indexes (stage 2 of 5)...
  556306 index entries processed.                                        

Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered.                                      

CHKDSK is verifying security descriptors (stage 3 of 5)...
  452352 file SDs/SIDs processed.                                        

Cleaning up 18 unused index entries from index $SII of file 0x9.
Cleaning up 18 unused index entries from index $SDH of file 0x9.
Cleaning up 18 unused security descriptors.
Security descriptor verification completed.
  51978 data files processed.                                           

CHKDSK is verifying Usn Journal...
  37480648 USN bytes processed.                                            

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
  452336 files processed.                                                

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
  10575140 free clusters processed.                                        

Free space verification is complete.
Windows has checked the file system and found no problems.

 118545407 KB total disk space.
  75524664 KB in 346976 files.
    159820 KB in 51979 indexes.
         0 KB in bad sectors.
    560363 KB in use by the system.
     65536 KB occupied by the log file.
  42300560 KB available on disk.

      4096 bytes in each allocation unit.
  29636351 total allocation units on disk.
  10575140 allocation units available on disk.

Internal Info:
00 e7 06 00 72 16 06 00 15 64 0a 00 00 00 00 00  ....r....d......
49 03 00 00 48 00 00 00 00 00 00 00 00 00 00 00  I...H...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
  </EventData>
</Event>

I'm currently running chkdsk on my other drives (it is going to be a while).

SystemInfo.exe reports the following for hard drives:
(1) SAMSUNG HD103SJ ATA Device (2) WDC WD10EADS-00L5B1 ATA Device

Thanks for all of your help.

writhziden · 26 Mar 2012

Disk check came up clean. This can happen in cases when a drive is faulty, so I do not consider the Windows disk check a conclusive check, but it does mean the drive is probably working as it should. To be sure, run the short and long tests with SeaTools.

BobbleHead · 27 Mar 2012

Short drive self test - Pass

Short Generic - Pass

Long Generic - Pass

writhziden · 27 Mar 2012

Alright, it could be a hard disk controller issue. Install all updated drivers listed under SATA in your motherboard's download section for Windows 7 64bit: ASUS - Motherboards- ASUS P7P55D-E Deluxe