Error code 24, NTFS_FILE_SYSTEM - usual causes are Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure
Error code 3B, SYSTEM_SERVICE_EXCEPTION - usual causes are System service, Device driver, graphics driver, ?memory
Error code 7E, SYSTEM_THREAD_EXCEPTION_NOT_HANDLED - usual causes are Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control
This is a hardware/hardware related problem. Notice what each of these error code causes have in common.
Code:
Kernel base = 0xfffff800`02c0a000 PsLoadedModuleList = 0xfffff800`02e47e50
Debug session time: Tue Sep 28 06:12:32.628 2010 (GMT-4)
System Uptime: 0 days 0:39:36.282
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff88008a5fd68, fffff88008a5f5d0, fffff80002c99137}
Probably caused by : Ntfs.sys ( Ntfs! ?? ::FNODOBFM::`string'+2cc9 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88008a5fd68
Arg3: fffff88008a5f5d0
Arg4: fffff80002c99137
Debugging Details:
------------------
EXCEPTION_RECORD: fffff88008a5fd68 -- (.exr 0xfffff88008a5fd68)
ExceptionAddress: fffff80002c99137 (nt!CcGetVirtualAddress+0x0000000000000047)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: ffffffffffffffff
Parameter[1]: 0000000000000000
Attempt to execute non-executable address 0000000000000000
CONTEXT: fffff88008a5f5d0 -- (.cxr 0xfffff88008a5f5d0)
rax=0000000000000000 rbx=000000000000000e rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000001 rdi=fffffa8008fbf7a0
rip=fffff80002c99137 rsp=fffff88008a5ffa0 rbp=ffdffa8008fb4010
r8=fffff88008a600f8 r9=fffff88008a600f0 r10=0000000000000000
r11=0000000000000001 r12=0000000000000001 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!CcGetVirtualAddress+0x47:
fffff800`02c99137 8b8598000000 mov eax,dword ptr [rbp+98h] ss:0018:ffdffa80`08fb40a8=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: NULL_DEREFERENCE
PROCESS_NAME: rundll32.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: ffffffffffffffff
EXCEPTION_PARAMETER2: 0000000000000000
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb20e0
0000000000000000
FOLLOWUP_IP:
Ntfs! ?? ::FNODOBFM::`string'+2cc9
fffff880`012553d8 cc int 3
FAULTING_IP:
nt!CcGetVirtualAddress+47
fffff800`02c99137 8b8598000000 mov eax,dword ptr [rbp+98h]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002c99137
STACK_TEXT:
fffff880`08a5eda8 fffff880`012553d8 : 00000000`00000024 00000000`001904fb fffff880`08a5fd68 fffff880`08a5f5d0 : nt!KeBugCheckEx
fffff880`08a5edb0 fffff880`0123d753 : fffff880`012813b8 fffff880`08a60920 fffff880`08a60920 00000000`00017007 : Ntfs! ?? ::FNODOBFM::`string'+0x2cc9
fffff880`08a5edf0 fffff800`02ca8d1c : 00000000`00010012 fffff800`02ca89af 00000000`00000010 00000000`00000246 : Ntfs! ?? ::FNODOBFM::`string'+0x1413
fffff880`08a5ee20 fffff800`02ca040d : fffff880`012813ac fffff880`08a60920 00000000`00000000 fffff880`01234000 : nt!_C_specific_handler+0x8c
fffff880`08a5ee90 fffff800`02ca7a90 : fffff880`012813ac fffff880`08a5ef08 fffff880`08a5fd68 fffff880`01234000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`08a5eec0 fffff800`02cb49ef : fffff880`08a5fd68 fffff880`08a5f5d0 fffff880`00000000 fffffa80`08fbf7a0 : nt!RtlDispatchException+0x410
fffff880`08a5f5a0 fffff800`02c79d82 : fffff880`08a5fd68 00000000`0000000e fffff880`08a5fe10 00000000`00000001 : nt!KiDispatchException+0x16f
fffff880`08a5fc30 fffff800`02c78552 : 00000000`00000000 00000000`00000000 fffff8a0`00213070 fffff8a0`002135f0 : nt!KiExceptionDispatch+0xc2
fffff880`08a5fe10 fffff800`02c99137 : fffff8a0`0f0f2140 fffff880`08a60090 00000000`00000002 fffff980`00000000 : nt!KiStackFault+0x112
fffff880`08a5ffa0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!CcGetVirtualAddress+0x47
STACK_COMMAND: kb
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: Ntfs! ?? ::FNODOBFM::`string'+2cc9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
FAILURE_BUCKET_ID: X64_0x24_Ntfs!_??_::FNODOBFM::_string_+2cc9
BUCKET_ID: X64_0x24_Ntfs!_??_::FNODOBFM::_string_+2cc9
Followup: MachineOwner
---------
Kernel base = 0xfffff800`02c5e000 PsLoadedModuleList = 0xfffff800`02e9be50
Debug session time: Tue Sep 28 06:21:27.109 2010 (GMT-4)
System Uptime: 0 days 0:08:25.138
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002caa7b4, fffff880087fa020, 0}
Probably caused by : ntkrnlmp.exe ( nt!AlpcpLookasidePacketCallbackRoutine+14 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002caa7b4, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff880087fa020, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!AlpcpLookasidePacketCallbackRoutine+14
fffff800`02caa7b4 488b7a10 mov rdi,qword ptr [rdx+10h]
CONTEXT: fffff880087fa020 -- (.cxr 0xfffff880087fa020)
rax=fffff80002caa7a0 rbx=fffffa8005b93f50 rcx=fffffa8005b93f50
rdx=ffdffa8005f26020 rsi=0000000000000001 rdi=0000000000000000
rip=fffff80002caa7b4 rsp=fffff880087fa9f0 rbp=fffff880087faca0
r8=fffff80002c5e000 r9=0000000000000000 r10=fffffffffffffffe
r11=fffffa8005b93f50 r12=0000000000000000 r13=fffff880087faba8
r14=ffffffffffffffff r15=0000000000299b70
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!AlpcpLookasidePacketCallbackRoutine+0x14:
fffff800`02caa7b4 488b7a10 mov rdi,qword ptr [rdx+10h] ds:002b:ffdffa80`05f26030=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: SearchFilterHo
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002fc9f48 to fffff80002caa7b4
STACK_TEXT:
fffff880`087fa9f0 fffff800`02fc9f48 : 00000000`00000000 fffff880`087fabc8 fffffa80`05b93f50 00000000`00000000 : nt!AlpcpLookasidePacketCallbackRoutine+0x14
fffff880`087faa90 fffff800`02cdeaa6 : 000007fe`00000000 fffff880`087faba8 fffff880`087fabc8 00000000`00000001 : nt!IoRemoveIoCompletion+0x198
fffff880`087fab20 fffff800`02ccd993 : fffffa80`0855c6c0 00000000`775c4270 00000000`00000000 00000000`00000000 : nt!NtWaitForWorkViaWorkerFactory+0x285
fffff880`087fac20 00000000`7751165a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`011bfb48 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7751165a
FOLLOWUP_IP:
nt!AlpcpLookasidePacketCallbackRoutine+14
fffff800`02caa7b4 488b7a10 mov rdi,qword ptr [rdx+10h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!AlpcpLookasidePacketCallbackRoutine+14
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
STACK_COMMAND: .cxr 0xfffff880087fa020 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!AlpcpLookasidePacketCallbackRoutine+14
BUCKET_ID: X64_0x3B_nt!AlpcpLookasidePacketCallbackRoutine+14
Followup: MachineOwner
---------
Kernel base = 0xfffff800`02c01000 PsLoadedModuleList = 0xfffff800`02e3ee50
Debug session time: Tue Sep 28 05:08:16.096 2010 (GMT-4)
System Uptime: 0 days 0:44:47.125
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
.....
Unable to load image \SystemRoot\system32\DRIVERS\atipmdag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atipmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atipmdag.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff88004b2610f, fffff8800219c278, fffff8800219bae0}
Probably caused by : atipmdag.sys ( atipmdag+2ad10f )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88004b2610f, The address that the exception occurred at
Arg3: fffff8800219c278, Exception Record Address
Arg4: fffff8800219bae0, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
atipmdag+2ad10f
fffff880`04b2610f 8179083800bebe cmp dword ptr [rcx+8],0BEBE0038h
EXCEPTION_RECORD: fffff8800219c278 -- (.exr 0xfffff8800219c278)
ExceptionAddress: fffff88004b2610f (atipmdag+0x00000000002ad10f)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff8800219bae0 -- (.cxr 0xfffff8800219bae0)
rax=0000000000000000 rbx=fffffa8007366000 rcx=ffdff8a000e29570
rdx=0000000000000003 rsi=fffffa8007366000 rdi=0000000000000000
rip=fffff88004b2610f rsp=fffff8800219c4b0 rbp=fffffa8006bc2000
r8=0000000000000003 r9=fffffa8006bc2000 r10=ffdff8a000e29570
r11=0000000000000000 r12=0000000000000000 r13=0000000000000149
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
atipmdag+0x2ad10f:
fffff880`04b2610f 8179083800bebe cmp dword ptr [rcx+8],0BEBE0038h ds:002b:ffdff8a0`00e29578=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ea90e0
ffffffffffffffff
FOLLOWUP_IP:
atipmdag+2ad10f
fffff880`04b2610f 8179083800bebe cmp dword ptr [rcx+8],0BEBE0038h
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff88004b2610f
STACK_TEXT:
fffff880`0219c4b0 00000000`00000000 : fffffa80`06bc2000 fffffa80`07366000 fffff880`04b5b426 fffff880`0219c5b0 : atipmdag+0x2ad10f
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: atipmdag+2ad10f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: atipmdag
IMAGE_NAME: atipmdag.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4bb09c5a
STACK_COMMAND: .cxr 0xfffff8800219bae0 ; kb
FAILURE_BUCKET_ID: X64_0x7E_atipmdag+2ad10f
BUCKET_ID: X64_0x7E_atipmdag+2ad10f
Followup: MachineOwner
---------
All three dumps reference memory corruption. The first and second dumps blame a Windows system core driver (not likely the cause); the third blames atipmdag.sys.
Since the first dumps indicates a hard drive problem, I suggest you run Disk Check.
Run CHKDSK /R /F from an elevated (Run as adminstrator) Command Prompt. Please do this for each hard drive on your system.
When it tells you it can't do it right now - and asks you if you'd like to do it at the next reboot - answer Y (for Yes) and press Enter. Then reboot and let the test run. It may take a while for it to run, but keep an occasional eye on it to see if it generates any errors. See "CHKDSK LogFile" below in order to check the results of the test.
Elevated Command Prompt:
Go to Start and type in "cmd.exe" (without the quotes)
At the top of the Search Box, right click on Cmd.exe and select "Run as administrator"
CHKDSK LogFile:
Go to Start and type in "eventvwr.msc" (without the quotes) and press Enter
Expand the Windows logs heading, then select the Application log file entry.
Double click on the Source column header.
Scroll down the list until you find the Chkdsk entry (wininit for Windows 7).
While you are troubleshooting, I recommend that you uninstall AVG using this uninstall tool: Info > Tool (32bit) - Tool (64 bit). If you have installed Identity Protection, uninstall it using this tool: Info > Tool. One of your error codes lists antivirus program as a possible cause. AVG has been known to cause BSOD's on some Win 7 systems. Download and install Microsoft Security Essentials in its place.
The drivers listed below are out of date. Older drivers can and do cause memory corruption and crashes.
mwlPSDFilter.sys Tue Jun 02 06:07:30 2009
mwlPSDNServ.sys Tue Jun 02 06:07:39 2009
mwlPSDVDisk.sys Tue Jun 02 06:15:29 2009
NTIDrvr.sys Tue Mar 24 23:09:39 2009
UBHelper.sys Mon Apr 27 04:48:19 2009
How to update drivers:
- I have listed links to most of the drivers in the code box below. Please use the links there to see what info I've found about those drivers.
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
-
if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.
- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads
- - To remove any left over driver remnants, especially from graphics cards, use driver sweeper Guru3D - Driver Sweeper
If you need help with the drivers, please post.