BSOD Crash help Please.

[zapp22]

I'm attaching the required .zip file per the sticky.
This was a first on this very rock-solid system ['til now].
This is a
- Thinkpad x120e
- AMD E350
- Crucial SSD and
- 8GB ram,
- Win7 SP2 x64 which I clean-installed from scratch quite some time ago. Far as I know its pretty up to date, no malware etc.

This crash occurred while I was trying to debug a network connection with a very bad LAN in a hotel - wireless was spotty and I was trying to get service via CAT5 physical to the ethernet NIC, causing me to have to disable/enable both the WIFI device and the Enet NIC multiple times - so it was no just another breezy day.

All help greatly appreciated as deciphering crash dump info is definitely not a skill I have at this point.

 

[karlsnooks]

Just as a question? Is this the one and the only BSOD you have had?

 

[zapp22]

Just as a question? Is this the one and the only BSOD you have had?

only one I can recall, yes. there's a tiny chance one may have occurred the very few times anyone else used this notebook, but I doubt.

 

[karlsnooks]

Hard to trace a hiccup, however, I'm not a bsod analyzer.

What's the chance that you had the laptop sitting on the bed with most of the air vents blocked and the resulting internal heat being an aggravating factor?

don't know about where you are, but we've had 104 to 107 degrees farenheit the last few days (and today).

Of course, hotel room no doubt had an adequate AC.

 

[writhziden]

Event[4373]:
  Log Name: System
  Source: Ntfs
  Date: 2012-06-18T09:05:12.702
  Event ID: 57
  Task: N/A
  Level: Warning
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Samwise-PC
  Description: 
The system failed to flush data to the transaction log. Corruption may occur.

Event[5461]:
  Log Name: System
  Source: Ntfs
  Date: 2012-06-11T15:30:58.332
  Event ID: 55
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Samwise-PC
  Description: 
The file system structure on the disk is corrupt and unusable. 
Please run the chkdsk utility on the volume D:.

Event[5462]:
  Log Name: System
  Source: Ntfs
  Date: 2012-06-11T15:30:58.332
  Event ID: 55
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Samwise-PC
  Description: 
The file system structure on the disk is corrupt and unusable. 
Please run the chkdsk utility on the volume .

Crashes are occurring due to corruption on your hard disk. The crash pointed to NTFS.sys, which is your file system driver built into Windows for your hard disk.

Run Disk Check with Automatically fix file system errors checked for all drives and partitions. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html (you may need to search for wininit instead of chkdsk).
For any drives that do not give the message:
Windows has checked the file system and found no problems
run disk check again as above. In other words, if it says:
Windows has made corrections to the file system
after running the disk check, run the disk check again.
​

 

[zapp22]

ok.
for the record, there was no volume D: in the system yesterday.
the only "D"'s its seen this past week were my 'droid and a couple of sd cards.
I'll run checks/repairs on C now.
z

 

[zapp22]

1st and 2nd logs attached.
thx guys
z

 

[karlsnooks]

zapp,

If you would like more readable log results:

# ************************************************************
# Places CHKDSKLOGS.txt on your DESKTOP
#
# Results of running chkdsk (check disk) are in ChkDskLogs.txt
# ************************************************************
# STEP 1 *****************************************************
# RUN PowerShell as administrator
# START ORB | type POWERSHELL | CTRL+SHIFT+ENTER key combo | ALT+Y keycombo
# ************************************************************
# STEP 2 *****************************************************
# COPY, using CTRL+C, every line down thru both EXIT statements 
# PASTE into Powershell == Right-Click at the PowerShell Prompt
#  (Ctrl+V does not work)
# Start copying with first line without a # at start of the line
# Note: Actually, you can paste the entire file if you rather
#       Lines starting with a # are ignored by PowerShell
# ************************************************************

$events = get-winevent -filterhashtable @{logname='application';id=1001,26212,26214} -verbose:$false -ea:silentlycontinue |
sort-object -property timecreated -desc | 
where {($_.providername -ne 'Microsoft-Windows-LoadPerf') -and ($_.providername -ne 'Windows Error Reporting')}

If ($events -eq $Null) {"No check disk logs exist." | OUT-FILE $env:userprofile\desktop\CHKDSKLOGS.TXT} ELSE {
$events | SELECT timecreated, id, message |
format-table -auto -wrap | OUT-FILE $env:userprofile\desktop\CHKDSKLOGS.TXT }

EXIT
EXIT

# **********************INSTRUCTIONS**************************
EXIT
EXIT

# ***************** NOTE - POWERSHELL VERSION*****************
# if you receive this error msg:
#  Get-WinEvent: The system can not find the path specified
# you need to update your PowerShell
# you must be using Powershell 2.0 or later.
#
# To determine your Powershell version:
#   Run PowerShell
#   enter $host.version
#   you should see at least:
# Major  Minor  Build  Revision
# -----  -----  -----  --------
# 2      0      -1     -1
#
# If you do not see the above, update your Vista/Win 7.
# ************************************************************
# *************** NOTE - EXECUTION POLICY*********************
# If you haven't set the execution policy, you may need to:
#   Run PowerShell
#   enter Set-ExecutionPolicy -executionpolicy remotesigned
#
# ************************************************************


Upload the resulting file placed your desktop.
thanks,
karl

 

[zapp22]

I'm missing the bigger issue: What caused the BSOD? a few unused index entries and some free space marked as allocated? somehow that doesn't seem 'worthy'...

 

[writhziden]

Hard disk corruption can cause any number of problems. If you do not believe it to be that, though, we can look into other possible causes of the 0x24 BugCheck:

--------------------------------------------
--------------------START-------------------
--------------------------------------------
Loading Dump File [C:\Users\BSODAnalyst\Downloads\zapp22\062712-5818-01.dmp]

Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64

System Uptime: 0 days 20:52:16.085

BugCheck 24, {1904fb, fffff88005f43158, fffff88005f429b0, fffff80002cf6f80}

Probably caused by : Ntfs.sys ( Ntfs!NtfsFlushUserStream+b4 )

NTFS_FILE_SYSTEM (24)

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

STACK_TEXT:  
fffff880`05f43398 fffff800`02fb5c10 : fffff800`05000000 00000000`00000000 00000000`00000000 fffff880`012c5e69 : nt!IoGetRelatedDeviceObject
fffff880`05f433a0 fffff800`02d25ae7 : fffff880`05f43838 fffff880`05f43800 fffffa80`092a2e10 00000000`00000000 : nt!FsRtlAcquireFileForCcFlushEx+0x3c
fffff880`05f43640 fffff800`02d24ea9 : fffffa80`086740c8 00000000`00000000 00000000`00001000 00000000`00000000 : nt!MmFlushSection+0x1c3
fffff880`05f43700 fffff880`012986d4 : fffffa80`086740c8 fffff880`00000000 fffffa80`00000000 fffff880`00001000 : nt!CcFlushCache+0x5e9
fffff880`05f43800 fffff880`01297d4e : fffff8a0`02127b10 fffff8a0`02127b10 fffff8a0`02127b10 fffffa80`08b69650 : Ntfs!NtfsFlushUserStream+0xb4
fffff880`05f43880 fffff880`01296c7e : fffffa80`08b69650 fffff8a0`02127b10 fffffa80`08790b30 00000000`00000000 : Ntfs!NtfsPerformOptimisticFlush+0x7e
fffff880`05f438e0 fffff880`012976b4 : fffffa80`08b69650 fffffa80`08cc4c10 fffffa80`096d0210 00000000`00000000 : Ntfs!NtfsCommonFlushBuffers+0x12a
fffff880`05f439c0 fffff880`01146bcf : fffffa80`08cc4fb0 fffffa80`08cc4c10 fffffa80`08b69650 fffff880`05f439e8 : Ntfs!NtfsFsdFlushBuffers+0x104
fffff880`05f43a30 fffff880`011456df : fffffa80`072700e0 00000000`00000001 fffffa80`07270000 fffffa80`08cc4c10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`05f43ac0 fffff800`02fe7eab : 00000000`00000002 fffffa80`096d0210 00000000`00000001 fffffa80`08cc4c10 : fltmgr!FltpDispatch+0xcf
fffff880`05f43b20 fffff800`02f7ca31 : fffffa80`08cc4c10 fffffa80`0766e4f0 fffffa80`096d0210 fffff880`009e4180 : nt!IopSynchronousServiceTail+0xfb
fffff880`05f43b90 fffff800`02ce3453 : fffffa80`0766e4f0 00000000`00000000 fffffa80`072700e0 fffffa80`096d0210 : nt!NtFlushBuffersFile+0x171
fffff880`05f43c20 00000000`778917ca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02fdf048 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x778917ca


FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsFlushUserStream+b4

--------------------------------------------
---------------------END--------------------
--------------------------------------------

Other possible causes of the 0x24 BugCheck code:

Usual causes: Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

From STOP 0x00000024: NTFS_FILE_SYSTEM.
Crashes may also be due to Windows files or registry corruption and/or viruses

• If you are overclocking any hardware, please stop.
  
  
• Run all Basic tests with SeaTools: S.M.A.R.T. Check, Short Drive Self Test, Drive Information, Short Generic, and Long Generic. Run the tests for all HDDs.
  SeaTools for Windows
  
  SeaTools for DOS​
  
  
• Check Windows for corruption. Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations. Use OPTION THREE of http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html to provide us with the sfcdetails.txt file if errors occur.
  
  
• Download and install Malwarebytes, update it, do not start the free trial, and then run a full scan. Also run a full scan with your antivirus software installed on your system. If you do not have antivirus software installed, see the http://www.sevenforums.com/system-s...-system-security-combination.html#post1732627 for better security steps and scanning tools. Make sure to update the security software before running the full scan.
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
     Warning

  Before you proceed with the following, answer these two questions: Are you still under warranty? Does your warranty allow you to open up the machine to check hardware? If you are unsure of the answers to these questions, contact your system manufacturer. :warn:WARNING: The steps that follow can void your warranty!!!
  
  For Part 3: If You Have Errors: If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working. If you do not have an anti-static workbench, desk, or pad, you can use your computer tower/case by finding a metal hold in it, such as a drive bay.
  Once these steps have been followed, it is safe to remove and replace components within your computer.