ntfs.sys BSOD Help

Toggle sidebar Toggle sidebar
K

KennyZDead

Reputable
May 25, 2015
2
0
4,510
I keep getting a variety of BSODs ever since I had to do a reinstall of windows. I've memtested my Ram, and my HDDs multiple times and no errors have occurred.

There doesn't seem to be any rhyme or reason to the crashes. On some occasions it'll occur while browsing; others it will occur while streaming. I have my rig set up in such a way that the computer needs to access multiple HDDs to access my media and programs, so I don't think it's any single piece of hardware (besides the fact that they check out after testing).

Latest crash was a ntfs.sys error which seems to be connected to a driver malfunction.

System Specs:

i5-4670K @ 3.4GHz
8GB DDR3 (Corsair)
AMD 290X
INTEL 120GB SSD (C2BW120A4)

Most recent .dmp

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800339a418
Arg3: fffff88003399c70
Arg4: fffff800034af540

Debugging Details:
------------------


EXCEPTION_RECORD: fffff8800339a418 -- (.exr 0xfffff8800339a418)
ExceptionAddress: fffff800034af540 (nt!CcUnmapVacbArray+0x0000000000000270)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT: fffff88003399c70 -- (.cxr 0xfffff88003399c70)
rax=fffffa8006cc92f8 rbx=0000000000000000 rcx=ffff7e800ad4b000
rdx=fffff8000368a7d0 rsi=0000000000000000 rdi=0000000000100000
rip=fffff800034af540 rsp=fffff8800339a650 rbp=fffffa800ad5e840
r8=000000001801a2c0 r9=0000000000000000 r10=0000000018047900
r11=fffff8800339a2b8 r12=fffff88003165180 r13=fffffa8007242e00
r14=fffffa8006d37b60 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!CcUnmapVacbArray+0x270:
fffff800`034af540 8b4104 mov eax,dword ptr [rcx+4] ds:002b:ffff7e80`0ad4b004=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036bb100
ffffffffffffffff

FOLLOWUP_IP:
Ntfs!NtfsDeleteInternalAttributeStream+ea
fffff880`014f2182 48397b10 cmp qword ptr [rbx+10h],rdi

FAULTING_IP:
nt!CcUnmapVacbArray+270
fffff800`034af540 8b4104 mov eax,dword ptr [rcx+4]

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from fffff800034d0a44 to fffff800034af540

STACK_TEXT:
fffff880`0339a650 fffff800`034d0a44 : fffff8a0`03ea5e01 fffffa80`0ad99260 fffffa80`0aa3ac00 00000000`00000000 : nt!CcUnmapVacbArray+0x270
fffff880`0339a6e0 fffff800`034a5749 : fffffa80`0aa3acb0 fffffa80`07242e00 fffffa80`0ad99260 00000000`00000000 : nt!CcDeleteSharedCacheMap+0x154
fffff880`0339a740 fffff880`014f2182 : fffffa80`075e0180 fffff8a0`0b450140 00000000`00000001 00000000`00000000 : nt!CcUninitializeCacheMap+0x389
fffff880`0339a7c0 fffff880`014c2d42 : 00000000`00000000 fffff800`03629200 00000000`00000001 fffff8a0`0b450140 : Ntfs!NtfsDeleteInternalAttributeStream+0xea
fffff880`0339a810 fffff880`0143b85c : fffff8a0`0b450040 fffff8a0`0b450140 fffff800`03629200 fffff8a0`0b4ea040 : Ntfs!NtfsRemoveScb+0xe2
fffff880`0339a850 fffff880`0143aa3f : fffff8a0`0b450010 fffff800`03629260 fffff880`0339aa01 fffffa80`0bc797e0 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`0339a880 fffff880`014c063c : fffffa80`0bc797e0 fffffa80`075e0180 fffff8a0`0b4ea010 fffff8a0`0b4ea3a8 : Ntfs!NtfsTeardownFromLcb+0x2af
fffff880`0339a910 fffff880`014420e2 : fffffa80`0bc797e0 fffffa80`0bc797e0 fffff8a0`0b4ea010 fffff880`0339aa00 : Ntfs!NtfsTeardownStructures+0xcc
fffff880`0339a990 fffff880`014d0193 : fffffa80`075e0180 fffff800`03629260 fffff8a0`6366744e 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`0339a9d0 fffff880`014bf357 : fffffa80`0bc797e0 fffff8a0`0b4ea140 fffff8a0`0b4ea010 fffffa80`075e0180 : Ntfs!NtfsCommonClose+0x353
fffff880`0339aaa0 fffff800`03496021 : 00000000`00000000 fffff800`03782000 fffff800`03629201 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`0339ab70 fffff800`0372832e : 00000000`00000000 fffffa80`06d37b60 00000000`00000080 fffffa80`06cda890 : nt!ExpWorkerThread+0x111
fffff880`0339ac00 fffff800`0347d666 : fffff880`03165180 fffffa80`06d37b60 fffff880`0316ffc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0339ac40 00000000`00000000 : fffff880`0339b000 fffff880`03395000 fffff880`0339a8a0 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: Ntfs!NtfsDeleteInternalAttributeStream+ea

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4ce792f9

STACK_COMMAND: .cxr 0xfffff88003399c70 ; kb

FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteInternalAttributeStream+ea

BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteInternalAttributeStream+ea

Followup: MachineOwner
 
Sort by date Sort by votes
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
a bad memory address (-1) was passed to the file system driver.
actually the cache manager. You might google "how to turn off lazy writes"
or look here:http://www.thewindowsclub.com/enable-disable-disk-write-caching-windows-7-8

make the change and see if it has an effect.
I would look to update any thing that can effect your drives:
update motherboard BIOS, update any SATA drivers, update firmware for drives.
(This assumes you are not overclocking, or have corrupted files due to a malware infection of your storage driver)
(often bugchecks in the filesystem are just a symptom of another problem)

generally to figure out the exact cause you need to provide a kernel memory dump file.
https://www.sophos.com/en-us/support/knowledgebase/111474.aspx

there are other causes but I have to go.





 
Upvote 0 Downvote
K

KennyZDead

Reputable
May 25, 2015
2
0
4,510
My C drive is on an Intel SSD, so I couldn't locate a feature to disable disk write caching. My first step when the BSODs started coming was to update my firmware, bios, and SATA drivers; as far as I know they are all current.

The install is fresh and has been scanned for malware so that shouldn't be an issue. I can upload a kernel file if it happens again.

What other causes did you spot?
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
see if you have the mini dump file, it would be in c:\system\minidump
directory with a file extension of .dmp
if you do, you can put it on a server like microsoft onedrive and post a link with public access.

problems involving the cache manager are very timing dependent and hard to reproduce.
The minidump will not help much but sometimes will show outdated drivers or ones known to have bugs that corrupt memory.

I would set your system for a kernel dump and just run until you hit another problem. It will make a much larger memory dump when it crashes but your system will not be slowed down. (you are not running verifier.exe so no extra debugging is occuring)



 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom