Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSODs (0x00000050, 0x00000024) relating to NTFS.sys


  • Please log in to reply
5 replies to this topic

#1 Arcane

Arcane

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:46 PM

Posted 29 May 2009 - 10:17 AM

0x00000050 and 0x00000024 bsods appear every time i boot to windows xp pro. can boot into safe mode. tried chkdsk /f and after restart another 0x00000024 appears. tried last known good configuration yet it happens again after a cold boot. uhm.. i can still use my pc though. after a few restarts. All my drivers are signed, i checked it. i'll attach a few windows debugger reports for my current minidumps.

Please find time to view and decode the bugcheck analyses. I really need help since I'm a noob at these things.
These are only the dumps i got the chance to analyze. Most of the bsods don't give dumps. >_<

------------------
System Information
------------------
Time of this report: 5/29/2009, 23:18:03
Operating System: Windows XP Professional (5.1, Build 2600) Service Pack 3 (2600.xpsp_sp3_gdr.090206-1234)
Language: English (Regional Setting: English)
System Manufacturer: ECS
System Model: P4VMM2
BIOS: Default System BIOS
Processor: Intel® Pentium® 4 CPU 1.80GHz
Memory: 480MB RAM

Yah, i know my pc is weak. xp
I pity my pc forcing it to start by restarting it about 3-4 times. It might be straining it more.
There. That's all the info i can give as for now. driver problems? corrupted ram? any suggested actions?
Thanks dude. :D

Attached Files



BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,541 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:03:46 AM

Posted 29 May 2009 - 11:56 AM

Please try a couple of these free online scanners to see if anything has slipped by your protection:
(Be advised that some of these scanners will pickup things in "quarantine" from other anti-virus programs - so review the results carefully)

http://www.pandasecurity.com/homeusers/solutions/activescan/
http://us.mcafee.com/root/mfs/default.asp
http://housecall.trendmicro.com
http://www.bitdefender.com/scan8/ie.html
http://support.f-secure.com/enu/home/ols.shtml
http://onlinescan.avast.com/
http://ca.com/us/securityadvisor/virusinfo/scan.aspx
http://www.eset.com/onlinescan/

http://www.kaspersky.com/virusscanner Scan Only - no removal


If you find that you're infected (or the scan doesn't complete or closes unexpectedly), post in the Am I Infected forum located here: http://www.bleepingcomputer.com/forums/f/103/am-i-infected-what-do-i-do/

Those screenshots indicate problems with both Ad-Aware and Avast AV...I suggest that you uninstall AA 20067 and replace ti with either SUPERAntispyware or Malwarebytes...and I suggest that you reinstall Avast and promptly update it.

I also suggest that you ensure that the system is current with critical updates.

It seems unlikely to me that 2 malware-defense programs would become possibly corrupt at the same time...but stranger things happen every day. But the steps I suggest...won't hurt and will improve your system defense posture.

If the BSODs continue, we can then move on with other approaches.

Louis

#3 Sunildev

Sunildev

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:46 AM

Posted 29 May 2009 - 03:45 PM

Did you try to run a ram check?
Sunildev.

#4 Arcane

Arcane
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:46 PM

Posted 30 May 2009 - 02:53 AM

Those screenshots indicate problems with both Ad-Aware and Avast AV...I suggest that you uninstall AA 20067 and replace ti with either SUPERAntispyware or Malwarebytes...and I suggest that you reinstall Avast and promptly update it.

I also suggest that you ensure that the system is current with critical updates.

It seems unlikely to me that 2 malware-defense programs would become possibly corrupt at the same time...but stranger things happen every day. But the steps I suggest...won't hurt and will improve your system defense posture.

If the BSODs continue, we can then move on with other approaches.

Louis


Uhm. no viruses or sumthing. i uninstalled both avast and ad-aware, yet the same BSODS show up. i did a chkdsk /f /r and after a restart a few "Windows has recovered from a serious errror" popups appeared. The problems are still there anyway.

Here is a recent bugcheck:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {c09a638c, 0, f76ef64a, 2}


Could not read faulting driver name
Probably caused by : Ntfs.sys ( Ntfs!NtfsFindNameLink+1e )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: c09a638c, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: f76ef64a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: c09a638c

FAULTING_IP:
Ntfs!NtfsFindNameLink+1e
f76ef64a 668b10 mov dx,word ptr [eax]

MM_INTERNAL_CODE: 2

CUSTOMER_CRASH_COUNT: 5

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: lsass.exe

LAST_CONTROL_TRANSFER: from f76ef6f4 to f76ef64a

STACK_TEXT:
efbc57d8 f76ef6f4 e1843a84 efbc581c e1838378 Ntfs!NtfsFindNameLink+0x1e
efbc5804 f76ef822 859907f8 e1843918 efbc5944 Ntfs!NtfsFindPrefix+0x7c
efbc5968 f76ecf2d 859907f8 8597de70 efbc59c0 Ntfs!NtfsCommonCreate+0xbb6
efbc5a4c 804e37f7 85b62770 8597de70 8597de70 Ntfs!NtfsFsdCreate+0x1dc
efbc5a5c 8056c712 85b5ce18 85a93f84 efbc5c04 nt!IopfCallDriver+0x31
efbc5b3c 80563fec 85b5ce30 00000000 85a93ee0 nt!IopParseDevice+0xa12
efbc5bc4 805684da 00000000 efbc5c04 00000040 nt!ObpLookupObjectName+0x56a
efbc5c18 8056cbeb 00000000 00000000 5646c301 nt!ObOpenObjectByName+0xeb
efbc5c94 8056ccba 00b6f5c8 00100001 00b6f588 nt!IopCreateFile+0x407
efbc5cf0 8056cdf0 00b6f5c8 00100001 00b6f588 nt!IoCreateFile+0x8e
efbc5d30 804de7ec 00b6f5c8 00100001 00b6f588 nt!NtCreateFile+0x30
efbc5d30 7c90e514 00b6f5c8 00100001 00b6f588 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00b6f5c0 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_IP:
Ntfs!NtfsFindNameLink+1e
f76ef64a 668b10 mov dx,word ptr [eax]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: Ntfs!NtfsFindNameLink+1e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 48025be5

FAILURE_BUCKET_ID: 0x50_Ntfs!NtfsFindNameLink+1e

BUCKET_ID: 0x50_Ntfs!NtfsFindNameLink+1e

Followup: MachineOwner
---------

The Errors in the Event Log:
Error code 1000000a, parameter1 fb613158, parameter2 00000002, parameter3 00000000, parameter4 804f98f8.
Error code 10000050, parameter1 c65de900, parameter2 00000001, parameter3 8058cbbd, parameter4 00000000.
Error code 00000024, parameter1 001902fe, parameter2 f7a8f380, parameter3 f7a8f07c, parameter4 f74dd64a.
Error code 1000000a, parameter1 85d7c5c0, parameter2 00000002, parameter3 00000000, parameter4 804f98f8.
Error code 1000007f, parameter1 0000000d, parameter2 00000000, parameter3 00000000, parameter4 00000000.
Error code 10000050, parameter1 c0801f60, parameter2 00000000, parameter3 f74dd64a, parameter4 00000002.
Error code 10000050, parameter1 d19082f8, parameter2 00000000, parameter3 804e70dd, parameter4 00000000.

gawd. sorry for the wordy post. these information are not eye-catchy. hmmm? run a memtest, maybe?

#5 Arcane

Arcane
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:46 PM

Posted 30 May 2009 - 02:57 AM

Did you try to run a ram check?


nope. haven't tried yet. still have to ask my friend to burn me one. i don't have a burner here. arrgh.

#6 hamluis

hamluis

    Moderator


  • Moderator
  • 55,541 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:03:46 AM

Posted 30 May 2009 - 10:49 AM

<<PROCESS_NAME: lsass.exe>>

http://www.liutilities.com/news/articles/article9/

http://www.liutilities.com/products/wintas...slibrary/lsass/

http://www.whatsrunning.net/whatsrunning/Q....aspx?Process=5

If your lsass.exe files (you may have more than one) are anywhere other than the System32 and System32\dllcache folders...along with SP folders...and if the file size is other than 13KB...you may have malware.

The lsass.exe and the previous files I mentioned re Avast and AA...are all tied in to system security.

http://www.computerhope.com/issues/ch000876.htm

To be honest...it doesn't make any sense to me that there are all these pointers leading nowhere.

Others seem to think it's bad RAM...I suggest running Memtest86+ for a couple of hours or until errors kick up.

Memtest86+ - Advanced Memory Diagnostic Tool - http://www.memtest.org/#downiso

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users