Need some help with minidump file

Key Keeper · Post by **Key Keeper** » Fri Dec 12, 2008 11:19 pm

Got BSOD and installed windbg and symbols and this is the output. Im thinking Im having either a hdd problem or mem from the looks of it. Could one of you veteran pc gurus take a look at this and give me your oppinion?

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001902fe
Arg2: bad13934
Arg3: bad13630
Arg4: ba4e596b

Debugging Details:
------------------

EXCEPTION_RECORD: bad13934 -- (.exr 0xffffffffbad13934)
ExceptionAddress: ba4e596b (Ntfs!NtfsUpdateScbFromAttribute+0x00000345)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 28001810
Attempt to write to address 28001810

CONTEXT: bad13630 -- (.cxr 0xffffffffbad13630)
eax=28001800 ebx=89c55100 ecx=890d1000 edx=00000000 esi=bad13a30 edi=89c55318
eip=ba4e596b esp=bad139fc ebp=bad13a0c iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
Ntfs!NtfsUpdateScbFromAttribute+0x345:
ba4e596b 83601000 and dword ptr [eax+10h],0 ds

28001810=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1: 00000001

EXCEPTION_PARAMETER2: 28001810

WRITE_ADDRESS: 28001810

FOLLOWUP_IP:
Ntfs!NtfsUpdateScbFromAttribute+345
ba4e596b 83601000 and dword ptr [eax+10h],0

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from ba4cbc30 to ba4e596b

STACK_TEXT:
bad13a0c ba4cbc30 890cf008 bad10705 e17cf4c0 Ntfs!NtfsUpdateScbFromAttribute+0x345
bad13a24 ba4a6800 890cf008 e17cf558 00000000 Ntfs!NtfsAttributeDefinitions+0x330
bad13a40 ba4cba17 890cf008 e17cf490 00000000 Ntfs!NtfsNonCachedIo+0xe
bad13a88 ba4a67b0 890cf008 e17cf558 e17cf6f0 Ntfs!NtfsAttributeDefinitions+0x117
bad13ab4 ba4c94b5 890cf008 007cf558 e17cf6f0 Ntfs!NtfsLookupAllocation+0x9e6
bad13b38 ba4c9254 890cf008 e17cf558 e17cf490 Ntfs!T8+0x15d
bad13bd8 804ef0b5 89c55020 88e78008 88e78008 Ntfs!T7+0x2fc
bad13c14 804ef0b5 89d29a60 88e78008 89cf8b38 nt!FsRtlTruncateLargeMcb+0x73
bad13c2c 804ef0b5 89c8f428 88e78008 804eff6a nt!FsRtlTruncateLargeMcb+0x73
bad13c54 b74c6800 89c8f428 89855730 bad13c8c nt!FsRtlTruncateLargeMcb+0x73
WARNING: Stack unwind information not available. Following frames may be wrong.
bad13c70 b74bf8b9 bad13c8c 804eff6a b74bf97a SYMEVENT+0xe800
bad13cac 804ef0b5 89896598 88e78008 88e78008 SYMEVENT+0x78b9
bad13ce8 804ef0b5 89855730 88e78008 88e78008 nt!FsRtlTruncateLargeMcb+0x73
bad13d30 805b9ee9 0084b3a8 00000000 8984b390 nt!FsRtlTruncateLargeMcb+0x73
bad13d4c 805259c6 8984b3a8 00000000 00000000 nt!ExAllocatePoolWithTag+0x1589
bad13d8c 8050b42f e17e43c0 00000000 89db0da8 nt!MmUnlockPages+0xab2
bad13dac 805ce858 00000000 00000000 00000000 nt!KeRemoveQueue+0x115
bad13ddc 8054534e 8050b388 00000000 00000000 nt!MiPageFileTraces+0x1098
00000000 00000000 00000000 00000000 00000000 nt!MiAddValidPageToWorkingSet+0x3a4

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: Ntfs!NtfsUpdateScbFromAttribute+345

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 45cc56a7

STACK_COMMAND: .cxr 0xffffffffbad13630 ; kb

FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsUpdateScbFromAttribute+345

BUCKET_ID: 0x24_Ntfs!NtfsUpdateScbFromAttribute+345

Followup: MachineOwner
---------

b-man1 · Post by **b-man1** » Sat Dec 13, 2008 12:36 am

check the SMART info on your drive to see if it's throwing errors...spinrite or that free app i posted a few weeks ago would do the trick. i've never dug into dump files...never really needed to. if it's not the drive, you could start pulling memory, run memtest, and see if it's ok without one of the sticks or in a different slot, etc.

.02

eGoCeNTRoNiX · Post by **eGoCeNTRoNiX** » Sat Dec 13, 2008 12:52 am

It looks like it's referencing a memory allocation error.. But I could be wrong.. Might just need to reseat the memory, could be dirty..

eGo

Key Keeper · Post by **Key Keeper** » Sat Dec 13, 2008 11:37 am

Well, my mem will only work in dim2 and 4. I think its memory. Memtest shows nil but that doest mean its compatible. As for smart, these drives are in raid 0 and for some reason that utility you posted wont show the data for them. My nividia storage config has a self test and they both pass.

eGoCeNTRoNiX · Post by **eGoCeNTRoNiX** » Sat Dec 13, 2008 11:38 am

If the mem will ONLY work in certain slots that seems fishy, could be the memory controller on the motherboard. Or perhaps slots 1 and 3 are for a different spec of ram? Dunno.. Sounds weird though.

eGo

Key Keeper · Post by **Key Keeper** » Sat Dec 13, 2008 11:43 am

Im pretty sure its mem, the compatability list for this mobo is very short. 650i was kinda like the nforce3....very picky.

Post by **FlyingPenguin** » Sat Dec 13, 2008 9:48 pm

If you can run MEMTEST86+ for 12 hours without an error, then you can eliminate memory as the culprit.