Code:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800b343918, fffff8800b343170, fffff880016e791d}
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonQueryInformation+9d )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800b343918
Arg3: fffff8800b343170
Arg4: fffff880016e791d
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800b343918 -- (.exr 0xfffff8800b343918)
ExceptionAddress: fffff880016e791d (Ntfs!NtfsCommonQueryInformation+0x000000000000009d)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000004
Attempt to read from address 0000000000000004
CONTEXT: fffff8800b343170 -- (.cxr 0xfffff8800b343170)
rax=fffff8800b3440a8 rbx=fffff8a00a635730 rcx=0000000000000008
rdx=fffffa8007c89a48 rsi=fffff8800b343cd0 rdi=fffffa8007c899e0
rip=fffff880016e791d rsp=fffff8800b343b50 rbp=fffff8800b343ee0
r8=0000000000000000 r9=0000000000000000 r10=0000000000000004
r11=fffff8800b343c28 r12=0000000000000006 r13=fffffa8008314368
r14=0000000000000000 r15=fffffa800826e070
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
Ntfs!NtfsCommonQueryInformation+0x9d:
fffff880`016e791d 418b4104 mov eax,dword ptr [r9+4] ds:002b:00000000`00000004=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: HPSA_Service.e
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000004
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb6100
GetUlongFromAddress: unable to read from fffff80002eb61c0
0000000000000004 Nonpaged pool
FOLLOWUP_IP:
Ntfs!NtfsCommonQueryInformation+9d
fffff880`016e791d 418b4104 mov eax,dword ptr [r9+4]
FAULTING_IP:
Ntfs!NtfsCommonQueryInformation+9d
fffff880`016e791d 418b4104 mov eax,dword ptr [r9+4]
BUGCHECK_STR: 0x24
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from fffff880016e6346 to fffff880016e791d
STACK_TEXT:
fffff880`0b343b50 fffff880`016e6346 : fffff880`0b343cd0 fffffa80`08314010 fffff880`00000008 fffffa80`00000008 : Ntfs!NtfsCommonQueryInformation+0x9d
fffff880`0b343c30 fffff880`016e6b14 : fffff880`0b343cd0 fffffa80`08314010 fffffa80`083143b0 fffff880`0b343cf8 : Ntfs!NtfsFsdDispatchSwitch+0x106
fffff880`0b343cb0 fffff880`00c02bcf : 00000000`0000000b 00000000`00000030 fffffa80`04cdb4a0 fffffa80`0500b800 : Ntfs!NtfsFsdDispatchWait+0x14
fffff880`0b343ea0 fffff880`00c05aea : 00000000`00000000 00000000`00000000 fffffa80`07c45300 fffffa80`048f7730 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0b343f30 fffff880`00c3b4f2 : fffffa80`07bb1330 00000000`0000001b fffffa80`0500b800 fffffa80`048f77e0 : fltmgr!FltPerformSynchronousIo+0x2ca
fffff880`0b343fd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : fltmgr!FltQueryInformationFile+0x52
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsCommonQueryInformation+9d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
STACK_COMMAND: .cxr 0xfffff8800b343170 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsCommonQueryInformation+9d
BUCKET_ID: X64_0x24_Ntfs!NtfsCommonQueryInformation+9d
Followup: MachineOwner
---------
2: kd> !thread
2: kd> dps fffff8800b33c000 fffff8800b345000
fffff880`0b33c000 ????????`????????
fffff880`0b342920 fffff880`016e791d Ntfs!NtfsCommonQueryInformation+0x9d
fffff880`0b342938 fffff880`0165ea88 Ntfs! ?? ::FNODOBFM::`string'+0x2b49
fffff880`0b342960 fffff880`016e791d Ntfs!NtfsCommonQueryInformation+0x9d
fffff880`0b342978 fffff880`0174d3e7 Ntfs! ?? ::NNGAKEGL::`string'+0x83b8
fffff880`0b342980 fffff880`016a97dc Ntfs!NtfsStatusQueue+0xfcc
fffff880`0b342998 fffff880`016682c3 Ntfs!NtfsAcquireExclusiveFcb+0x73
fffff880`0b342a08 fffff880`01672e28 Ntfs!_C_specific_handler
fffff880`0b342a10 fffff880`016c2360 Ntfs!__PchSym_ <PERF> (Ntfs+0x69360)
fffff880`0b342a18 fffff880`016e6346 Ntfs!NtfsFsdDispatchSwitch+0x106
fffff880`0b342a28 fffff800`02cafa6d nt!RtlpExecuteHandlerForException+0xd
fffff880`0b342a30 fffff880`016a97d0 Ntfs!NtfsStatusQueue+0xfc0
fffff880`0b342a48 fffff880`01659000 Ntfs!NtfsFreeReservedMdl <PERF> (Ntfs+0x0)
fffff880`0b342a60 fffff880`016a97d0 Ntfs!NtfsStatusQueue+0xfc0
fffff880`0b342268 fffff880`030c65ccUnable to load image \SystemRoot\system32\DRIVERS\eamonm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for eamonm.sys
*** ERROR: Module load completed but symbols could not be loaded for eamonm.sys
eamonm+0x45cc
Eset has been contributing to your BSOD's causing lot of NTFS errors. As a test, please remove it using its removal tool from here: Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase
We recommended Microsoft Security Essentials from a strict BSOD perspective. Is most compatible & provides most stability compared to other antivirus app/Internet Security Software.
Warning
Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.
Run a full scan with both (separately) once downloaded, installed and updated.
Perform a System File Check to check the integrity of all protected Windows 7:
- Click Start Menu
- Click All Programs
- Click Accessories
- Right click Command Prompt
- Click Run as administrator
- Type
- and press Enter
Full tutorial here:
Check your hard drive(s) for errors by running chkdsk:
Number down items at start-up. Keep only your anti-virus, this also improves the time for logging into windows.
- Click on the Start button
- Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
- Select the “Startup” tab.
- Deselect all items other than the antivirus.
- Apply > OK
- Accept then restart.
Full tutorial:
If the above does not provide stability start testing RAM. Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.
Note
Pay close attention to part 3 of the tutorial in order to rule out the faulty stick.
Information
Errors are sometimes found after 8 passes.
Tip
Do this test overnight, before going to bed.
Keep us posted with results.