what caused this memory dump

[junjijia]

Windows Home Premium 64bit version
OEM
Computer bought yesterday

I was just reading a PDF file and suddenly the blue screen appeared and said there is a memory dump. I extracted the dmp file associated with this dmp. but i am still not sure what cause the problem. i bought this computer yesterday and now i am thinking what should i do.
here is the report:

.........................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff880031466e8, fffff88003145f50, fffff80002a634a7}
Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteFcb+10c )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880031466e8
Arg3: fffff88003145f50
Arg4: fffff80002a634a7
Debugging Details:
------------------

EXCEPTION_RECORD: fffff880031466e8 -- (.exr 0xfffff880031466e8)
ExceptionAddress: fffff80002a634a7 (nt!ExReinitializeResourceLite+0x0000000000000167)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 0000000000000020
Attempt to write to address 0000000000000020
CONTEXT: fffff88003145f50 -- (.cxr 0xfffff88003145f50)
rax=0000000000000020 rbx=fffffa80062f6670 rcx=0000000000000000
rdx=000000000000070d rsi=0000000000000001 rdi=0000000000000000
rip=fffff80002a634a7 rsp=fffff88003146920 rbp=0000000000000745
r8=fffff880031469e1 r9=0000000000000000 r10=fffff80002a0a000
r11=0000000000000000 r12=0000000000000001 r13=fffffa800429c180
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!ExReinitializeResourceLite+0x167:
fffff800`02a634a7 c60001 mov byte ptr [rax],1 ds:002b:00000000`00000020=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000000000020
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cb20e0
0000000000000020
FOLLOWUP_IP:
Ntfs!NtfsDeleteFcb+10c
fffff880`0129fefc 66392e cmp word ptr [rsi],bp
FAULTING_IP:
nt!ExReinitializeResourceLite+167
fffff800`02a634a7 c60001 mov byte ptr [rax],1
BUGCHECK_STR: 0x24
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from fffff8800129fefc to fffff80002a634a7
STACK_TEXT:
fffff880`03146920 fffff880`0129fefc : fffff880`031469f0 00000000`00000745 fffffa80`062f6630 fffffa80`0742c7c0 : nt!ExReinitializeResourceLite+0x167
fffff880`03146960 fffff880`01212f6a : fffff800`02c1f5a0 fffff880`03146b01 fffff880`031469e1 fffff8a0`15f5c010 : Ntfs!NtfsDeleteFcb+0x10c
fffff880`031469c0 fffff880`0129d2cc : fffffa80`0742c7c0 fffffa80`0429c180 fffff8a0`15f5c010 fffff8a0`15f5c3a8 : Ntfs!NtfsTeardownFromLcb+0x1ea
fffff880`03146a50 fffff880`0121b882 : fffffa80`0742c7c0 fffffa80`0742c7c0 fffff8a0`15f5c010 fffff880`03146c00 : Ntfs!NtfsTeardownStructures+0xcc
fffff880`03146ad0 fffff880`012b4813 : fffffa80`0429c180 fffff800`02c1f5a0 fffff8a0`6366744e 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`03146b10 fffff880`0128e38f : fffffa80`0742c7c0 fffff8a0`15f5c140 fffff8a0`15f5c010 fffffa80`0429c180 : Ntfs!NtfsCommonClose+0x353
fffff880`03146be0 fffff800`02a87861 : 00000000`00000000 fffff880`0128e200 fffffa80`036e3001 00000000`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`03146cb0 fffff800`02d1fa86 : 00000000`00000000 fffffa80`036e3040 00000000`00000080 fffffa80`03669450 : nt!ExpWorkerThread+0x111
fffff880`03146d40 fffff800`02a58b06 : fffff880`02f63180 fffffa80`036e3040 fffff880`02f6df80 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03146d80 00000000`00000000 : fffff880`03147000 fffff880`03141000 fffff880`031469f0 00000000`00000000 : nt!KxStartSystemThread+0x16

SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: Ntfs!NtfsDeleteFcb+10c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff88003145f50 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteFcb+10c
BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteFcb+10c
Followup: MachineOwner
---------

anyone can tell me what happened? is it a software or hardware problem? is there an solution if it is software related?

Thanks a lot!

 

[cluberti]

That callstack and bugcheck code would indicate a corrupt block in the filesystem - I would suggest running chkdsk /f (and rebooting, of course), as well as making sure any disk controller drivers are updated to the latest supported versions as necessary.

 

[junjijia]

callstack and bugcheck code? which are these codes? (sorry I am really a newbie here).

is chkdsk /f usually implying the harddisk is failing?

 

[cluberti]

Not necessarily - the error says it's a filesystem (NTFS) error. If chkdsk /f and driver updates fix it, you're fine. If you update your drivers, run chkdsk /f, and the problem continues, you may have a hard disk problem. I wouldn't say it's a hardware error just yet though.

 

[junjijia]

i just did the driver check. windows searched online and says the driver of the disk is up to date. should i reinstall it? also, how to run chkdsk /f?

 

[cluberti]

If windows thinks the driver is up to date, I'd trust it is. As to running chkdsk, open a command prompt, type "chkdsk /r" (minus the quotes, of course), and hit enter. It will likely tell you the volume is currently in use and ask if you want to scan it on the next reboot. Press Y and hit enter to confirm, and then reboot. Checkdisk will then run during the reboot, before Windows is allowed to start.

 

[junjijia]

i just run chkdsk and windows did not have any complain. In particular, there is no bad sector. So i guess the hard drive should be ok.
also, i read that McAfee is not good for win7. So i uninstalled it and changed to OfficeScan, which is provided by my employer.
should i do anything else?