A very rare BSOD for me

[steve-pressman]

Hi Guys not sure why this has happened can you take a look for me please I suspect Google Chrome.


Thanks



Steve

 

[richc46]

STOP 0x00000024: NTFS_FILE_SYSTEM :Usual causes: Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure
The NTFS_FILE_SYSTEM bug check has a value of 0x00000024. This indicates a problem occurred in ntfs.sys, the driver file that allows the system to read and write to NTFS drives.

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
Loading Dump File [C:\Users\richc46\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5\35JPVY5O\Bsod%20Zip%2013.08.10[1]\Windows7_BSOD_jcgriff2\081410-13197-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e1b000 PsLoadedModuleList = 0xfffff800`03058e50
Debug session time: Fri Aug 13 21:47:16.917 2010 (GMT-4)
System Uptime: 0 days 5:19:05.527
Loading Kernel Symbols
...............................................................
................................................................
.......................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800e11d2b8, fffff8800e11cb20, fffff80002e42a09}
Probably caused by : Ntfs.sys ( Ntfs!NtfsExtendedCompleteRequestInternal+110 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800e11d2b8
Arg3: fffff8800e11cb20
Arg4: fffff80002e42a09
Debugging Details:
------------------
 
EXCEPTION_RECORD:  fffff8800e11d2b8 -- (.exr 0xfffff8800e11d2b8)
ExceptionAddress: fffff80002e42a09 (nt!RtlSubtreePredecessor+0x0000000000000009)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT:  fffff8800e11cb20 -- (.cxr 0xfffff8800e11cb20)
rax=0800000000000000 rbx=fffffa800b0e36d8 rcx=fffff8a019a4d488
rdx=fffffa800b0e36d8 rsi=fffffa800b0e36d0 rdi=0000000000000000
rip=fffff80002e42a09 rsp=fffff8800e11d4f8 rbp=fffffa800b0e36d8
 r8=ffffffffffffffff  r9=ffffffffffffffff r10=fffff80002e1b000
r11=fffff8a019a4d488 r12=ffffffffffffffff r13=fffffa80060a9e58
r14=0000000000008000 r15=0000000000000001
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
nt!RtlSubtreePredecessor+0x9:
fffff800`02e42a09 488b4810        mov     rcx,qword ptr [rax+10h] ds:002b:08000000`00000010=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  chrome.exe
CURRENT_IRQL:  0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1:  0000000000000000
EXCEPTION_PARAMETER2:  ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c30e0
 ffffffffffffffff 
FOLLOWUP_IP: 
Ntfs!NtfsExtendedCompleteRequestInternal+110
fffff880`01224f30 488b5c2450      mov     rbx,qword ptr [rsp+50h]
FAULTING_IP: 
nt!RtlSubtreePredecessor+9
fffff800`02e42a09 488b4810        mov     rcx,qword ptr [rax+10h]
BUGCHECK_STR:  0x24
LAST_CONTROL_TRANSFER:  from fffff80002e6eca8 to fffff80002e42a09
STACK_TEXT:  
fffff880`0e11d4f8 fffff800`02e6eca8 : 00000000`00000000 fffff8a0`13ed7ea0 00000000`00000010 00000000`00000286 : nt!RtlSubtreePredecessor+0x9
fffff880`0e11d500 fffff880`010db373 : 00000000`00000000 ffffffff`ffffffff 00000000`00000000 fffff880`010f5600 : nt!RtlDeleteNoSplay+0x7c
fffff880`0e11d530 fffff880`010d7238 : fffff8a0`16e89410 00000000`00000018 00000000`00000001 00000000`00004000 : fltmgr!TreeUnlinkNoBalance+0x13
fffff880`0e11d560 fffff880`010f546f : ffffffff`ffffffff fffffa80`060a9800 fffff880`6e664d46 fffff880`010f5da8 : fltmgr!TreeUnlinkMulti+0x148
fffff880`0e11d5b0 fffff880`010f5dfe : ffffffff`ffffffff fffffa80`090f4a10 fffffa80`060a9800 fffffa80`0b0e3660 : fltmgr!DeleteNameCacheNodes+0x9f
fffff880`0e11d5f0 fffff880`011052af : fffffa80`090f4a10 fffffa80`0b0e3660 00000000`00000000 00000000`00000000 : fltmgr!PurgeStreamNameCache+0x8e
fffff880`0e11d630 fffff880`010fca30 : fffffa80`05419e00 fffffa80`060a9800 00000000`00000000 fffffa80`0b784368 : fltmgr!FltpPurgeVolumeNameCache+0x7f
fffff880`0e11d670 fffff880`010f5d4b : fffffa80`060a9800 00000000`00000000 fffffa80`05ae2bc0 00000000`00000000 : fltmgr! ?? ::NNGAKEGL::`string'+0x1a04
fffff880`0e11d6b0 fffff880`010d806a : fffffa80`0a68fbb0 fffffa80`05ef68b0 fffff8a0`1282ded0 fffff800`02fc02dd : fltmgr!FltpReinstateNameCachingAllFrames+0x4b
fffff880`0e11d6e0 fffff800`02e8dd26 : 00000000`00000000 ffffe727`f2325038 fffffa80`05ef2fe8 00000000`00000001 : fltmgr!FltpPassThroughCompletion+0x8a
fffff880`0e11d720 fffff880`01224f30 : fffffa80`0b264ca0 00000000`00000001 00000000`00000000 00000000`00000000 : nt!IopfCompleteRequest+0x3a6
fffff880`0e11d800 fffff880`012aedfa : fffff8a0`0d63fbc0 fffffa80`0610a180 00000000`00000000 00000000`00000701 : Ntfs!NtfsExtendedCompleteRequestInternal+0x110
fffff880`0e11d840 fffff880`0121de0c : fffffa80`0b264ca0 fffffa80`0b784010 fffff880`0e11d901 fffff880`0e11d900 : Ntfs!NtfsCommonSetInformation+0xef1
fffff880`0e11d920 fffff880`010d523f : fffffa80`0b7843b0 fffffa80`0b784010 fffffa80`0b264ca0 fffff880`0e11d948 : Ntfs!NtfsFsdSetInformation+0x11c
fffff880`0e11d9a0 fffff880`010d36df : fffffa80`05ef68b0 fffffa80`0b784010 fffffa80`05ef6800 fffffa80`0b784010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0e11da30 fffff800`0316e62d : 00000000`000000b6 fffff880`0e11dca0 00000000`00000000 fffffa80`051a7f20 : fltmgr!FltpDispatch+0xcf
fffff880`0e11da90 fffff800`02e8a993 : 00000000`0000077c fffffa80`0ca75060 00000000`03c5e528 0000007f`000000b6 : nt!NtSetInformationFile+0x909
fffff880`0e11dbb0 00000000`76f6ffca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`03c5e508 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f6ffca
 
SYMBOL_STACK_INDEX:  b
SYMBOL_NAME:  Ntfs!NtfsExtendedCompleteRequestInternal+110
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME:  Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f
STACK_COMMAND:  .cxr 0xfffff8800e11cb20 ; kb
FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsExtendedCompleteRequestInternal+110
BUCKET_ID:  X64_0x24_Ntfs!NtfsExtendedCompleteRequestInternal+110
Followup: MachineOwner
---------

Probable causes shown above
The specific cause was given as NTFS.sys. This may indicate a problem with the hard drive and it should be tested and backed up, to avoid losing and doucments

Solution
Check to be sure that sufficient space is available on hard drive
Be sure that your memory is working properly and sufficient
Take memtest86. Run for 6 passes and use a good stick to test the MB slots.
Uninstall your AntiVirus and install Microsoft Security Essentials, Malwarebytes and Windows FireWall
My opinon is the potential hard drive failure as indicated by NTFS given as a potential cause.
Uninstall any defrag programs and use the Defrag included with Windows 7

Additional "canned" solution to the ntfs.sys BC
Resolving the Problem
To resolve a disk corruption problem: Check Event Viewer for error messages from SCSI and FASTFAT (System Log) or Autochk (Application Log) that might help pinpoint the device or driver that is causing the error. Try disabling any virus scanners, backup programs, or disk defragmenter tools that continually monitor the system. You should also run hardware diagnostics supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer. Run Chkdsk /f /r to detect and resolve any file system structural corruption. You must restart the system before the disk scan begins on a system partition.
To resolve a nonpaged pool memory depletion problem: Either add new physical memory to the computer (thus increasing the quantity of nonpaged pool memory available to the kernel), or reduce the number of files on the Services for Macintosh (SFM) volume.

 

[steve-pressman]

Thanks Rich It is a SSD Drive though so it doesn't get defragged, possibly cause was I installed Itunes and it decided to fill up my whole drive with music typical Apple I had do delete all of them. I will do a drive check and see if it finds any errors.


Steve

 

[richc46]

I am sorry that you are having a problem, but it is a pleasure to help a member that has helped so many.

 

[steve-pressman]

Thing is I don't have a problem it has only ever happened once I done a disk check and it said disk was clean

Oh well will just have to wait and see what happens, I do of course have an image of my drive and the satisfaction of knowing I have 9 months warranty on the rig still, so it's all good thanks for taking the time to look my friend Have a great day.


Steve

 

[richc46]

A disc check will not cut it. Go to the website of your mfg and take that test.