Windows 7 Increasing BSOD Issues Related to NTFS.sys: Diagnosing Hardware Problems

[Jakee]

Starting to occur more frequently then usual.

Also the last one had something to do with NTFS.sys or something like that.

View attachment Minidump.zip

Anyway to determine if it is a hardware problem.

Cheers for the help.

 

[TorrentG]

NTFS is the file system in use. This means your hard drive is either defective or needs the file system corrected.
Open an elevated command prompt and run this command from it for every hard drive partition letter on the system. Change C: to match the drive letters each time...

chkdsk /r C:

If the issue persists after all that is completed and you still get 0x24 errors, replace the hard drive.

Before doing so, test system memory with Memtest86+ to ensure the ram is well. If so, you can guarantee a hdd failure.

As a side note, probably good to run Malwarebytes to scan for any malware.

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\Temp\Rar$DI00.156\091210-17484-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82c50000 PsLoadedModuleList = 0x82d98810
Debug session time: Sat Sep 11 23:08:04.594 2010 (UTC - 4:00)
System Uptime: 0 days 5:59:28.356
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.........
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001904fb
Arg2: a9eb46b8
Arg3: a9eb4290
Arg4: 83b0c804

Debugging Details:
------------------


EXCEPTION_RECORD:  a9eb46b8 -- (.exr 0xffffffffa9eb46b8)
ExceptionAddress: 83b0c804 (Ntfs!TxfMoveAttrToDifferentFile+0x00000030)
   ExceptionCode: c000001d (Illegal instruction)
  ExceptionFlags: 00000000
NumberParameters: 0

CONTEXT:  a9eb4290 -- (.cxr 0xffffffffa9eb4290)
eax=0000008f ebx=00000000 ecx=00000000 edx=a9eb499c esi=8faa15e8 edi=00000000
eip=83b0c804 esp=a9eb4780 ebp=a9eb4800 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
Ntfs!TxfMoveAttrToDifferentFile+0x30:
83b0c804 c6              ???
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x24

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

LAST_CONTROL_TRANSFER:  from 83b0e20d to 83b0c804

STACK_TEXT:  
a9eb4800 83b0e20d 85e7eac0 92acc578 b2b9cc88 Ntfs!TxfMoveAttrToDifferentFile+0x30
a9eb487c 83b0eed0 85e7eac0 92acc578 92acc668 Ntfs!TxfMoveAttrInternal+0x88
a9eb48e4 83a573ba 92acc668 9ef63978 92acc578 Ntfs!TxfCreateBackupAttr+0x176
a9eb4974 83aa6194 85e7eac0 00acc668 a9eb499c Ntfs!TxfOverwriteAttribute+0x1c9
a9eb4a0c 83abd19c 85e7eac0 85e5e620 92acc810 Ntfs!NtfsOverwriteAttr+0x60e
a9eb4af4 83abd677 85e7eac0 85e5e620 92acc810 Ntfs!NtfsOpenAttributeInExistingFile+0x729
a9eb4ba0 83abca2d 85e7eac0 85e5e620 92acc810 Ntfs!NtfsOpenExistingPrefixFcb+0x26e
a9eb4c00 83abec5c 85e7eac0 85e5e620 8c9be4c0 Ntfs!NtfsFindStartingNode+0xb88
a9eb4cdc 83a45210 85e7eac0 85e5e620 a4f1b944 Ntfs!NtfsCommonCreate+0x65f
a9eb4d1c 82cc011e a4f1b8dc 00000000 ffffffff Ntfs!NtfsCommonCreateCallout+0x20
a9eb4d1c 82cc0215 a4f1b8dc 00000000 ffffffff nt!KiSwapKernelStackAndExit+0x15a
a4f1b840 00000000 00000000 00000000 00000000 nt!KiSwitchKernelStackAndCallout+0x31


CHKIMG_EXTENSION: !chkimg -lo 50 -d !Ntfs
    83b0c801 - Ntfs!TxfMoveAttrToDifferentFile+2d
    [ 46:44 ]
1 error : !Ntfs (83b0c801)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

STACK_COMMAND:  .cxr 0xffffffffa9eb4290 ; kb

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

 

[Jakee]

chkdsk /r C: Doesn't seem to do anything, The CMD pops up for a split seconds and vanishes and nothing happens.

Also picked up another BSOD just then with the last text as my last one, Since it seems it is my HDD should i take my computer into my local computer store and get them to do what?

 

[TorrentG]

You have to run the command from an elevated command prompt.

Right click the shortcut for the command prompt and choose "run as administrator."

 

[Jakee]

View attachment Minidump.zip

Just picked up 1 more and also one from before, Going to try the chkdsk /r thing now and will let you know.

Also the latest had cng.sys.

 

[cybercore]

Follow the instructions in post #2.

You have to run the command from an elevated command prompt.

Right click the shortcut for the command prompt and choose "run as administrator."

chkdsk /r C:

Update this one if newer version is available (won't help you much but still):

athr.sys Mon Oct 05 19:31:48 2009
Atheros Extensible Wireless LAN device driver

091210-19234-01.dmp
Probably caused by : memory_corruption
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e) 
FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_STRIDE


091210-18062-01.dmp
NTFS_FILE_SYSTEM (24)

STACK_TEXT:  
a6583800 83b0420d 86016540 9fb8f6f8 b755f530 Ntfs!TxfMoveAttrToDifferentFile+0x30
a658387c 83b04ed0 86016540 9fb8f6f8 9fb8f7e8 Ntfs!TxfMoveAttrInternal+0x88
a65838e4 83a4d3ba 9fb8f7e8 9f6af288 9fb8f6f8 Ntfs!TxfCreateBackupAttr+0x176
a6583974 83a9c194 86016540 00b8f7e8 a658399c Ntfs!TxfOverwriteAttribute+0x1c9
a6583a0c 83ab319c 86016540 860223b0 9fb8f990 Ntfs!NtfsOverwriteAttr+0x60e
....
FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT