Help reading WinDbg dump file

[moe661]

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\Minidump\Mini010510-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090804-1435
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Tue Jan 5 16:31:45.298 2010 (GMT-8)
System Uptime: 0 days 5:24:14.551
Loading Kernel Symbols
...............................................................
................................................................
.....
Loading User Symbols
Loading unloaded module list
....................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, b482e3ac, b482e0a8, 8052d2ef}

Probably caused by : Ntfs.sys ( Ntfs!NtfsGetNextFcbTableEntry+17 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001902fe
Arg2: b482e3ac
Arg3: b482e0a8
Arg4: 8052d2ef

Debugging Details:
------------------


EXCEPTION_RECORD: b482e3ac -- (.exr 0xffffffffb482e3ac)
ExceptionAddress: 8052d2ef (nt!RealSuccessor+0x00000013)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00004004
Attempt to read from address 00004004

CONTEXT: b482e0a8 -- (.cxr 0xffffffffb482e0a8)
eax=00004000 ebx=00000000 ecx=00004000 edx=00000000 esi=b482e4c8 edi=e62c0cc8
eip=8052d2ef esp=b482e474 ebp=b482e474 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!RealSuccessor+0x13:
8052d2ef 8b4804 mov ecx,dword ptr [eax+4] ds:0023:00004004=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 00004004

READ_ADDRESS: 00004004

FOLLOWUP_IP:
Ntfs!NtfsGetNextFcbTableEntry+17
b9e62b09 85c0 test eax,eax

FAULTING_IP:
nt!RealSuccessor+13
8052d2ef 8b4804 mov ecx,dword ptr [eax+4]

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from 8052dd1c to 8052d2ef

STACK_TEXT:
b482e474 8052dd1c e5d7e918 8af88260 b482e494 nt!RealSuccessor+0x13
b482e484 b9e62b09 8af883c8 b482e4c8 b482e510 nt!RtlEnumerateGenericTableWithoutSplayingAvl+0x32
b482e494 b9e62a6b 8af88100 b482e4c8 00000001 Ntfs!NtfsGetNextFcbTableEntry+0x17
b482e510 b9e62d28 89245dc0 8af88100 00000001 Ntfs!NtfsFlushVolume+0x43d
b482e5b0 b9e5003b 89245dc0 89d75368 b4820000 Ntfs!NtfsCommonVolumeOpen+0x341
b482e68c 804ef19f 8af88020 89d75368 8a1f5d80 Ntfs!NtfsFsdCreate+0x14d
b482e69c b9ede876 00000000 8aff7320 893840f0 nt!IopfCallDriver+0x31
b482e6e8 804ef19f 8af96ac0 00000001 89d75368 sr!SrCreate+0x150
b482e6f8 b9eeee9b 00000000 89d75368 89d7551c nt!IopfCallDriver+0x31
b482e71c b9efb754 b482e73c 8ae692f8 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
b482e758 804ef19f 8ae692f8 89d75368 89d75368 fltmgr!FltpCreate+0x26a
b482e768 b9eeee9b 00000000 89d75368 89d75540 nt!IopfCallDriver+0x31
b482e78c b9efb754 b482e7ac 8a2266f0 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
b482e7c8 804ef19f 8a2266f0 89d75368 89d75368 fltmgr!FltpCreate+0x26a
b482e7d8 805831fa 8afb48e8 8acec0ac b482e970 nt!IopfCallDriver+0x31
b482e8b8 805bf452 8afb4900 00000000 8acec008 nt!IopParseDevice+0xa12
b482e930 805bb9de 00000000 b482e970 00000240 nt!ObpLookupObjectName+0x53c
b482e984 80576033 00000000 00000000 82ecf000 nt!ObOpenObjectByName+0xea
b482ea00 805769aa b482eba4 00100003 b482eb8c nt!IopCreateFile+0x407
b482ea5c 805790b4 b482eba4 00100003 b482eb8c nt!IoCreateFile+0x8e
b482ea9c 8054162c b482eba4 00100003 b482eb8c nt!NtCreateFile+0x30
b482ea9c 80500031 b482eba4 00100003 b482eb8c nt!KiFastCallEntry+0xfc
b482eb40 805c8113 b482eba4 00100003 b482eb8c nt!ZwCreateFile+0x11
b482edac 805cff72 ba217ad0 00000000 00000000 nt!PopFlushVolumeWorker+0xe3
b482eddc 805460ee 805c8030 ba217ad0 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: Ntfs!NtfsGetNextFcbTableEntry+17

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 48025be5

STACK_COMMAND: .cxr 0xffffffffb482e0a8 ; kb

FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsGetNextFcbTableEntry+17

BUCKET_ID: 0x24_Ntfs!NtfsGetNextFcbTableEntry+17

Followup: MachineOwner
---------

0: kd> .cxr 0xffffffffb482e0a8
eax=00004000 ebx=00000000 ecx=00004000 edx=00000000 esi=b482e4c8 edi=e62c0cc8
eip=8052d2ef esp=b482e474 ebp=b482e474 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!RealSuccessor+0x13:
8052d2ef 8b4804 mov ecx,dword ptr [eax+4] ds:0023:00004004=????????
0: kd> .exr 0xffffffffb482e3ac
ExceptionAddress: 8052d2ef (nt!RealSuccessor+0x00000013)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00004004
Attempt to read from address 00004004

 

[Route44]

How old is your system? When did this error occur? Is this the only time you have received a BSOD?

0x00000024: NTFS_FILE_SYSTEM
A problem occurred within NTFS.SYS, the driver file that allows the system to read and write to NTFS file system drives. There may be a physical problem with the disk, or an Interrupt Request Packet (IRP) may be corrupted. Other common causes include heavy hard drive fragmentation, heavy file I/O, problems with some types of drive-mirroring software, or some antivirus software.

1. Go to your Run box and run ChkDsk. Please note in stage 2 if it indicates it is recovering lost files.

2. Do a harddrive diagnostics.

3. Check your cable connections to see if they are firm between harddrive and motherboard.

 

[moe661]

1-Its a brand new system but with an old hard drive with windows xp. Running ddr3 ram and a quad core intel.

2-check dsk recovering lost files showed up at 100% of stage 2 but didnt show any progress and went to stage 3

3- cables are new and connected

How old is your system? When did this error occur? Is this the only time you have received a BSOD?

0x00000024: NTFS_FILE_SYSTEM
A problem occurred within NTFS.SYS, the driver file that allows the system to read and write to NTFS file system drives. There may be a physical problem with the disk, or an Interrupt Request Packet (IRP) may be corrupted. Other common causes include heavy hard drive fragmentation, heavy file I/O, problems with some types of drive-mirroring software, or some antivirus software.

1. Go to your Run box and run ChkDsk. Please note in stage 2 if it indicates it is recovering lost files.

2. Do a harddrive diagnostics.

3. Check your cable connections to see if they are firm between harddrive and motherboard.

 

[moe661]

did hard drive tests already all passed

 

[Archean]

Did you reinstalled xp after shifting that old HDD to new system?