Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Failing Hard drive?


  • Please log in to reply
32 replies to this topic

#1 LilDeamon

LilDeamon

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:England, Manchester
  • Local time:07:17 PM

Posted 12 January 2010 - 01:00 PM

Since I installed windows 7 after formatting my hard drive ive been having 0x024 blue screens with the ntfs.sys file. This is completely random and has done this whilst web browseing and playing games. The computer im using at the moment has been unstable for about 2 years and almost everything has been replaced, other than the HDD and power supply.

HDD Model is Hyundai Electronics 'HYMP125U64CP8-Y5'

I'll post a WinDbg of the most recent blue screen, thanks for your help. :thumbsup:

Loading Dump File [C:\Windows\Minidump\011110-19078-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a09000 PsLoadedModuleList = 0xfffff800`02c46e50
Debug session time: Mon Jan 11 00:35:48.629 2010 (GMT+0)
System Uptime: 0 days 1:49:06.486
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88005d7e150, fffff88005d7e1f0, fffff80002aa97f8}

Probably caused by : Ntfs.sys ( Ntfs!NtfsReadUsnJournal+aad )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88005d7e150
Arg3: fffff88005d7e1f0
Arg4: fffff80002aa97f8

Debugging Details:
------------------


EXCEPTION_RECORD: fffff88005d7e150 -- (.exr 0xfffff88005d7e150)
ExceptionAddress: fffff80002aa97f8 (nt!RtlRaiseStatus+0x0000000000000018)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000001
NumberParameters: 0

CONTEXT: fffff88005d7e1f0 -- (.cxr 0xfffff88005d7e1f0)
rax=00000000ffffff00 rbx=00000000c0000005 rcx=fffff88005d7e1f0
rdx=fffff80002a4ffe1 rsi=00000000c0000005 rdi=0000000000000000
rip=fffff80002aa97f8 rsp=fffff88005d7e130 rbp=0000000000000103
r8=0000000000000000 r9=fffff88005d7d180 r10=0000000010000000
r11=fffff88005d7d900 r12=0000000000000000 r13=fffffa800201e390
r14=000000001bfbef19 r15=fffffa8002792fb0
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000286
nt!RtlRaiseStatus+0x18:
fffff800`02aa97f8 488b8424b8010000 mov rax,qword ptr [rsp+1B8h] ss:0018:fffff880`05d7e2e8=fffff80002aa97f8
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: NULL_DEREFERENCE

PROCESS_NAME: SearchIndexer.

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cb10e0
0000000000000000

FOLLOWUP_IP:
Ntfs!NtfsReadUsnJournal+aad
fffff880`012fd86e 90 nop

FAULTING_IP:
nt!RtlRaiseStatus+18
fffff800`02aa97f8 488b8424b8010000 mov rax,qword ptr [rsp+1B8h]

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from fffff880012fd86e to fffff80002aa97f8

STACK_TEXT:
fffff880`05d7e130 fffff880`012fd86e : fffff880`012679a0 fffff880`05d7e960 fffff8a0`001dbc70 00000000`00000000 : nt!RtlRaiseStatus+0x18
fffff880`05d7e6d0 fffff880`012f5576 : fffffa80`0201e390 fffffa80`02792c10 fffffa80`0280b000 fffff880`05d7e8c8 : Ntfs!NtfsReadUsnJournal+0xaad
fffff880`05d7e840 fffff880`012f12ed : fffffa80`0201e390 00000000`00000000 fffff880`05d7e960 00000000`00000000 : Ntfs!NtfsUserFsRequest+0x122
fffff880`05d7e880 fffff880`0111023f : fffff880`05d7e9d0 fffffa80`02792c10 fffff880`05d7e900 fffffa80`0201e390 : Ntfs!NtfsFsdFileSystemControl+0x13d
fffff880`05d7e920 fffff880`0112f91e : fffffa80`0280b040 fffffa80`049f9920 fffffa80`0280b000 fffffa80`02792c10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`05d7e9b0 fffff800`02d933a7 : fffffa80`049f9920 fffff880`05d7eca0 fffffa80`02792ff8 fffffa80`02792c10 : fltmgr!FltpFsControl+0xee
fffff880`05d7ea10 fffff800`02d5c98a : fffffa80`0330b060 00000000`000008b8 00000000`00000000 00000000`016380b0 : nt!IopXxxControlFile+0x607
fffff880`05d7eb40 fffff800`02a7a153 : 00000000`00000000 fffff800`02d94dfc fffff880`05d7eca0 00000000`00000000 : nt!NtFsControlFile+0x56
fffff880`05d7ebb0 00000000`774c024a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0395ea38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774c024a


SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: Ntfs!NtfsReadUsnJournal+aad

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f

STACK_COMMAND: .cxr 0xfffff88005d7e1f0 ; kb

FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsReadUsnJournal+aad

BUCKET_ID: X64_0x24_Ntfs!NtfsReadUsnJournal+aad

Followup: MachineOwner
---------


Edited by LilDeamon, 12 January 2010 - 01:02 PM.


BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,699 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:11:17 AM

Posted 12 January 2010 - 01:58 PM

Download BlueScreenView
No installation required.
Double click on BlueScreenView.exe file to run the program.
When scanning is done, go Edit>Select All.
Go File>Save Selected Items, and save the report as BSOD.txt.
Open BSOD.txt in Notepad, copy all content, and paste it into your next reply.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#3 LilDeamon

LilDeamon
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:England, Manchester
  • Local time:07:17 PM

Posted 12 January 2010 - 02:07 PM

Thanks for the reply.

There have been way more bsods, but I think CCleaner has deleted the older ones.

==================================================
Dump File : 011210-16099-01.dmp
Crash Time : 12/01/2010 18:14:41
Bug Check String : SYSTEM_SERVICE_EXCEPTION
Bug Check Code : 0x0000003b
Parameter 1 : 00000000`c0000005
Parameter 2 : fffff800`02a99c60
Parameter 3 : fffff880`042ef060
Parameter 4 : 00000000`00000000
Caused By Driver : dump_atapi.sys
Caused By Address : dump_atapi.sys+4a7060
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\minidump\011210-16099-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 011210-16551-01.dmp
Crash Time : 12/01/2010 15:39:19
Bug Check String : SYSTEM_SERVICE_EXCEPTION
Bug Check Code : 0x0000003b
Parameter 1 : 00000000`c000001d
Parameter 2 : fffff960`000fb5c4
Parameter 3 : fffff880`04bf21b0
Parameter 4 : 00000000`00000000
Caused By Driver : raspppoe.sys
Caused By Address : raspppoe.sys+fc0fb5c4
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\minidump\011210-16551-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 011110-27393-01.dmp
Crash Time : 11/01/2010 20:00:41
Bug Check String : DRIVER_IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x000000d1
Parameter 1 : 00000100`00000040
Parameter 2 : 00000000`00000007
Parameter 3 : 00000000`00000000
Parameter 4 : fffff880`03cd726b
Caused By Driver : dump_atapi.sys
Caused By Address : dump_atapi.sys+22426b
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\minidump\011110-27393-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 011110-19078-01.dmp
Crash Time : 11/01/2010 16:02:59
Bug Check String : NTFS_FILE_SYSTEM
Bug Check Code : 0x00000024
Parameter 1 : 00000000`001904fb
Parameter 2 : fffff880`05d7e150
Parameter 3 : fffff880`05d7e1f0
Parameter 4 : fffff800`02aa97f8
Caused By Driver : Ntfs.sys
Caused By Address : Ntfs.sys+213d8
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\minidump\011110-19078-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 011010-25662-01.dmp
Crash Time : 10/01/2010 22:47:05
Bug Check String : NTFS_FILE_SYSTEM
Bug Check Code : 0x00000024
Parameter 1 : 00000000`001904fb
Parameter 2 : fffff880`024d4330
Parameter 3 : fffff880`024d43d0
Parameter 4 : fffff800`02af07f8
Caused By Driver : Ntfs.sys
Caused By Address : Ntfs.sys+213d8
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\minidump\011010-25662-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 011010-20186-01.dmp
Crash Time : 10/01/2010 22:34:52
Bug Check String : NTFS_FILE_SYSTEM
Bug Check Code : 0x00000024
Parameter 1 : 00000000`001904fb
Parameter 2 : fffff880`058f2150
Parameter 3 : fffff880`058f21f0
Parameter 4 : fffff800`02aeb7f8
Caused By Driver : Ntfs.sys
Caused By Address : Ntfs.sys+213d8
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\minidump\011010-20186-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 011010-24913-01.dmp
Crash Time : 10/01/2010 21:43:51
Bug Check String : NTFS_FILE_SYSTEM
Bug Check Code : 0x00000024
Parameter 1 : 00000000`001904fb
Parameter 2 : fffff880`02622150
Parameter 3 : fffff880`026221f0
Parameter 4 : fffff800`02afb7f8
Caused By Driver : Ntfs.sys
Caused By Address : Ntfs.sys+213d8
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\minidump\011010-24913-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 011010-25116-01.dmp
Crash Time : 10/01/2010 21:12:26
Bug Check String : NTFS_FILE_SYSTEM
Bug Check Code : 0x00000024
Parameter 1 : 00000000`001904fb
Parameter 2 : fffff880`02f8f238
Parameter 3 : fffff880`02f8ea90
Parameter 4 : fffff800`02afb32c
Caused By Driver : Ntfs.sys
Caused By Address : Ntfs.sys+213d8
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\minidump\011010-25116-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 011010-24445-01.dmp
Crash Time : 10/01/2010 19:55:40
Bug Check String : SYSTEM_SERVICE_EXCEPTION
Bug Check Code : 0x0000003b
Parameter 1 : 00000000`c0000005
Parameter 2 : fffff960`000d9630
Parameter 3 : fffff880`062031d0
Parameter 4 : 00000000`00000000
Caused By Driver : win32k.sys
Caused By Address : win32k.sys+79630
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\minidump\011010-24445-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 011010-20872-01.dmp
Crash Time : 10/01/2010 18:31:15
Bug Check String : NTFS_FILE_SYSTEM
Bug Check Code : 0x00000024
Parameter 1 : 00000000`001904fb
Parameter 2 : fffff880`05852150
Parameter 3 : fffff880`058521f0
Parameter 4 : fffff800`02aae7f8
Caused By Driver : Ntfs.sys
Caused By Address : Ntfs.sys+213d8
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\minidump\011010-20872-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 011010-24632-01.dmp
Crash Time : 10/01/2010 17:53:40
Bug Check String : NTFS_FILE_SYSTEM
Bug Check Code : 0x00000024
Parameter 1 : 00000000`001904fb
Parameter 2 : fffff880`02282330
Parameter 3 : fffff880`022823d0
Parameter 4 : fffff800`02b057f8
Caused By Driver : Ntfs.sys
Caused By Address : Ntfs.sys+213d8
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\minidump\011010-24632-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 010810-21028-01.dmp
Crash Time : 08/01/2010 16:34:57
Bug Check String : SYSTEM_SERVICE_EXCEPTION
Bug Check Code : 0x0000003b
Parameter 1 : 00000000`c0000005
Parameter 2 : fffff960`000d9dbd
Parameter 3 : fffff880`04f47d70
Parameter 4 : 00000000`00000000
Caused By Driver : raspppoe.sys
Caused By Address : raspppoe.sys+f18480
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\minidump\010810-21028-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 010710-13790-01.dmp
Crash Time : 07/01/2010 23:30:12
Bug Check String : DRIVER_IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x000000d1
Parameter 1 : ffffffff`ffffffd6
Parameter 2 : 00000000`0000000c
Parameter 3 : 00000000`00000000
Parameter 4 : fffffa80`02c5a621
Caused By Driver : tdx.sys
Caused By Address : tdx.sys+185a621
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\minidump\010710-13790-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7600
==================================================


Edited by LilDeamon, 12 January 2010 - 02:08 PM.


#4 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,699 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:11:17 AM

Posted 12 January 2010 - 02:16 PM

It looks to me as either some infection, or hardware problem (possibly RAM).
I'd like to ask you to go to malware forum and see, if your computer is clean.
If it's, please come back here and we'll go from there.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#5 LilDeamon

LilDeamon
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:England, Manchester
  • Local time:07:17 PM

Posted 12 January 2010 - 02:17 PM

Ok, thanks i'll get back to you if all goes well.

#6 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,699 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:11:17 AM

Posted 12 January 2010 - 02:19 PM

No problem :thumbsup:

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#7 LilDeamon

LilDeamon
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:England, Manchester
  • Local time:07:17 PM

Posted 28 January 2010 - 12:42 PM

Hello again,

Ok, the people at the malware section say its safe and clean. :thumbsup: When you said it could be RAM, could that be the video RAM also?

#8 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,699 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:11:17 AM

Posted 28 January 2010 - 08:38 PM

Yes.

A. If you have more than one RAM module installed, try starting computer with one RAM stick at a time.

NOTE Keep in mind, the manual check listed above is always superior to the software check, listed below. DO NOT proceed with memtest, if you can go with option A

B. If you have only one RAM stick installed...
...run memtest...

1. Download - Pre-Compiled Bootable ISO (.zip)
2. Unzip downloaded memtest86+-2.11.iso.zip file.
3. Inside, you'll find memtest86+-2.11.iso file.
4. Download, and install ImgBurn: http://www.imgburn.com/
5. Insert blank CD into your CD drive.
6. Open ImgBurn, and click on Write image file to disc
7. Click on Browse for a file... icon:

Posted Image

8. Locate memtest86+-2.11.iso file, and click Open button.
9. Click on ImgBurn green arrow to start burning bootable memtest86 CD:

Posted Image

10. Once the CD is created, boot from it, and memtest will automatically start to run.

The running program will look something like this depending on the size and number of ram modules installed:


Posted Image

It's recommended to run 5-6 passes. Each pass contains very same 8 tests.

This will show the progress of the test. It can take a while. Be patient, or leave it running overnight.

Posted Image

The following image is the test results area:

Posted Image

The most important item here is the “errors” line. If you see ANY errors, even one, most likely, you have bad RAM.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#9 LilDeamon

LilDeamon
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:England, Manchester
  • Local time:07:17 PM

Posted 29 January 2010 - 11:20 AM

Ok thanks ill try this over the weekend. :thumbsup:

Two questions though,

1) Can I run the computer off just the video card memory?

2) Should i use memtest86+ 4.00 or the version you suggested?

#10 hamluis

hamluis

    Moderator


  • Moderator
  • 55,758 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:01:17 PM

Posted 29 January 2010 - 12:47 PM

86+, 4.0 for Memtest version.

You cannot run a computer off video RAM. Video RAM is designed to replace/augment the RAM normally required from the total RAM installed in the system. Video RAM has nothing to do with the system, but system RAM may possibly be used to augment RAM on a video card installed.

Louis

#11 LilDeamon

LilDeamon
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:England, Manchester
  • Local time:07:17 PM

Posted 07 February 2010 - 12:58 PM

No errors :/

Posted Image

#12 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,699 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:11:17 AM

Posted 07 February 2010 - 01:03 PM

Please, start new topic in "Am I Infected?" and make sure, your computer is clean.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#13 LilDeamon

LilDeamon
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:England, Manchester
  • Local time:07:17 PM

Posted 07 February 2010 - 01:06 PM

I already did that before and they said it was clean.

I have had BSOD saying memory corruption :/

#14 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,699 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:11:17 AM

Posted 07 February 2010 - 01:09 PM

Do you have only one RAM stick installed?
Is this desktop, or laptop?
If desktop, on-board video, or separate video card?

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#15 LilDeamon

LilDeamon
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:England, Manchester
  • Local time:07:17 PM

Posted 07 February 2010 - 01:10 PM

One stick.
Desktop.
Seperate GFX card, though there is an onboard one too.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users