Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: what caused this memory dump

06 Jan 2011   #1

windows 7 64 bit
what caused this memory dump

Windows Home Premium 64bit version
Computer bought yesterday

I was just reading a PDF file and suddenly the blue screen appeared and said there is a memory dump. I extracted the dmp file associated with this dmp. but i am still not sure what cause the problem. i bought this computer yesterday and now i am thinking what should i do.
here is the report:

* *
* Bugcheck Analysis *
* *
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff880031466e8, fffff88003145f50, fffff80002a634a7}
Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteFcb+10c )
Followup: MachineOwner
0: kd> !analyze -v
* *
* Bugcheck Analysis *
* *
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
Arg1: 00000000001904fb
Arg2: fffff880031466e8
Arg3: fffff88003145f50
Arg4: fffff80002a634a7
Debugging Details:

EXCEPTION_RECORD: fffff880031466e8 -- (.exr 0xfffff880031466e8)
ExceptionAddress: fffff80002a634a7 (nt!ExReinitializeResourceLite+0x0000000000000167)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 0000000000000020
Attempt to write to address 0000000000000020
CONTEXT: fffff88003145f50 -- (.cxr 0xfffff88003145f50)
rax=0000000000000020 rbx=fffffa80062f6670 rcx=0000000000000000
rdx=000000000000070d rsi=0000000000000001 rdi=0000000000000000
rip=fffff80002a634a7 rsp=fffff88003146920 rbp=0000000000000745
r8=fffff880031469e1 r9=0000000000000000 r10=fffff80002a0a000
r11=0000000000000000 r12=0000000000000001 r13=fffffa800429c180
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
fffff800`02a634a7 c60001 mov byte ptr [rax],1 ds:002b:00000000`00000020=??
Resetting default scope
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000000000020
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cb20e0
fffff880`0129fefc 66392e cmp word ptr [rsi],bp
fffff800`02a634a7 c60001 mov byte ptr [rax],1
LAST_CONTROL_TRANSFER: from fffff8800129fefc to fffff80002a634a7
fffff880`03146920 fffff880`0129fefc : fffff880`031469f0 00000000`00000745 fffffa80`062f6630 fffffa80`0742c7c0 : nt!ExReinitializeResourceLite+0x167
fffff880`03146960 fffff880`01212f6a : fffff800`02c1f5a0 fffff880`03146b01 fffff880`031469e1 fffff8a0`15f5c010 : Ntfs!NtfsDeleteFcb+0x10c
fffff880`031469c0 fffff880`0129d2cc : fffffa80`0742c7c0 fffffa80`0429c180 fffff8a0`15f5c010 fffff8a0`15f5c3a8 : Ntfs!NtfsTeardownFromLcb+0x1ea
fffff880`03146a50 fffff880`0121b882 : fffffa80`0742c7c0 fffffa80`0742c7c0 fffff8a0`15f5c010 fffff880`03146c00 : Ntfs!NtfsTeardownStructures+0xcc
fffff880`03146ad0 fffff880`012b4813 : fffffa80`0429c180 fffff800`02c1f5a0 fffff8a0`6366744e 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`03146b10 fffff880`0128e38f : fffffa80`0742c7c0 fffff8a0`15f5c140 fffff8a0`15f5c010 fffffa80`0429c180 : Ntfs!NtfsCommonClose+0x353
fffff880`03146be0 fffff800`02a87861 : 00000000`00000000 fffff880`0128e200 fffffa80`036e3001 00000000`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`03146cb0 fffff800`02d1fa86 : 00000000`00000000 fffffa80`036e3040 00000000`00000080 fffffa80`03669450 : nt!ExpWorkerThread+0x111
fffff880`03146d40 fffff800`02a58b06 : fffff880`02f63180 fffffa80`036e3040 fffff880`02f6df80 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03146d80 00000000`00000000 : fffff880`03147000 fffff880`03141000 fffff880`031469f0 00000000`00000000 : nt!KxStartSystemThread+0x16

SYMBOL_NAME: Ntfs!NtfsDeleteFcb+10c
IMAGE_NAME: Ntfs.sys
STACK_COMMAND: .cxr 0xfffff88003145f50 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteFcb+10c
BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteFcb+10c
Followup: MachineOwner

anyone can tell me what happened? is it a software or hardware problem? is there an solution if it is software related?

Thanks a lot!

My System SpecsSystem Spec
06 Jan 2011   #2

Windows 10 Pro x64

That callstack and bugcheck code would indicate a corrupt block in the filesystem - I would suggest running chkdsk /f (and rebooting, of course), as well as making sure any disk controller drivers are updated to the latest supported versions as necessary.
My System SpecsSystem Spec
06 Jan 2011   #3

windows 7 64 bit

callstack and bugcheck code? which are these codes? (sorry I am really a newbie here).

is chkdsk /f usually implying the harddisk is failing?
My System SpecsSystem Spec

06 Jan 2011   #4

Windows 10 Pro x64

Not necessarily - the error says it's a filesystem (NTFS) error. If chkdsk /f and driver updates fix it, you're fine. If you update your drivers, run chkdsk /f, and the problem continues, you may have a hard disk problem. I wouldn't say it's a hardware error just yet though.
My System SpecsSystem Spec
06 Jan 2011   #5

windows 7 64 bit

i just did the driver check. windows searched online and says the driver of the disk is up to date. should i reinstall it? also, how to run chkdsk /f?
My System SpecsSystem Spec
06 Jan 2011   #6

Windows 10 Pro x64

If windows thinks the driver is up to date, I'd trust it is. As to running chkdsk, open a command prompt, type "chkdsk /r" (minus the quotes, of course), and hit enter. It will likely tell you the volume is currently in use and ask if you want to scan it on the next reboot. Press Y and hit enter to confirm, and then reboot. Checkdisk will then run during the reboot, before Windows is allowed to start.
My System SpecsSystem Spec
07 Jan 2011   #7

windows 7 64 bit

i just run chkdsk and windows did not have any complain. In particular, there is no bad sector. So i guess the hard drive should be ok.
also, i read that McAfee is not good for win7. So i uninstalled it and changed to OfficeScan, which is provided by my employer.
should i do anything else?
My System SpecsSystem Spec

 what caused this memory dump

Thread Tools

Similar help and support threads
Thread Forum
BSOD Caused by ndoskrnl.exe (dump files attached)
BSOD Help and Support
BSOD Caused By ntoskrnl.exe, Please See Attached Dump File
Hi all! I'm hoping for a little help in troubleshooting this particular BSOD. I've attached BlueScreenView's HTML report, the Minidump file created and a Speccy snapshot of the machine on which this happening. If there is any other information you need, please let me know!
BSOD Help and Support
BSOD - 0x00000124 - caused by ntoskrnl.exe dump attached
Hi guys, Having BSOD issues. I thought initially it was scaned from hardware issue maybe loose connectors but my build is less than 30 days old and i've reseated all parts about 4 days ago. It didnt BSOD for 4 days but today it BSOD while browsing the internet, the next BSOD was when trying to...
BSOD Help and Support
win 7 memory dump help
windows 7 64bit oem version, 1 month old, new mobo, cpu, RAM, hard drive, video card. i've been getting memory dump errors recently while playing world of warcraft, sometimes i get the BSoD memory dump error sometimes WoW crashes with their "error 132 memory could not be read." this is the...
BSOD Help and Support

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 22:41.
Twitter Facebook Google+