Sign in to follow this  
Followers 0
hbp71605

Debugging windows crash

3 posts in this topic

Ok so i bought this toughbook cf-73 a couple weeks ago. It has been crashing lately, Ive reformatted/reinstalled twice, using two different xp cds. Im using the drivers from https://eww.pavc.panasonic.co.jp/pc/itn/dri...u_en.html#CF-73

(they say they are for windows xp pro, sp1, all ive got is sp2. could this be causing a problem?)

I have been getting BSODs and errors saying NTFS.sys is missing or corrupt (among other stop messages). today I decided to replace the ntfs.sys on my hdd with the one on the xp CD. no luck, i just came back here to find that it had crashed, heres minidump infoz:

Unable to load image Ntfs.sys, Win32 error 0n2

*** WARNING: Unable to verify timestamp for Ntfs.sys

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, f799f918, f799f614, 8057a65e}

*** WARNING: Unable to verify timestamp for sr.sys

Probably caused by : Ntfs.sys ( Ntfs!NtfsUpdateFileDupInfo+212 )

Followup: MachineOwner

---------

kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

NTFS_FILE_SYSTEM (24)

If you see NtfsExceptionFilter on the stack then the 2nd and 3rd

parameters are the exception record and context record. Do a .cxr

on the 3rd parameter and then kb to obtain a more informative stack

trace.

Arguments:

Arg1: 001902fe

Arg2: f799f918

Arg3: f799f614

Arg4: 8057a65e

Debugging Details:

------------------

EXCEPTION_RECORD: f799f918 -- (.exr 0xfffffffff799f918)

ExceptionAddress: 8057a65e (nt!FsRtlNotifyFilterReportChange+0x0000008c)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 00000000

Parameter[1]: 000007b0

Attempt to read from address 000007b0

CONTEXT: f799f614 -- (.cxr 0xfffffffff799f614)

eax=f799f9f4 ebx=e17fdf48 ecx=e1814a88 edx=000007b0 esi=82fde8f8 edi=0000002e

eip=8057a65e esp=f799f9e0 ebp=f799fa58 iopl=0 nv up ei ng nz na pe nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286

nt!FsRtlNotifyFilterReportChange+0x8c:

8057a65e 66833a00 cmp word ptr [edx],0 ds:0023:000007b0=????

Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 000007b0

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from f73db45e to 8057a65e

STACK_TEXT:

f799fa58 f73db45e 82fde8f8 82fcb400 e1814a88 nt!FsRtlNotifyFilterReportChange+0x8c

f799fad4 f73ec947 8291ea88 e1591cc8 e1814a80 Ntfs!NtfsUpdateFileDupInfo+0x212

f799fbb0 f73dae2f 8291ea88 82952938 82965988 Ntfs!NtfsSetEndOfFileInfo+0xe3

f799fc20 f73b3ad8 8291ea88 82965988 82965988 Ntfs!NtfsCommonSetInformation+0x477

f799fc88 804e3d77 82fcb020 82965988 82965b18 Ntfs!NtfsFsdSetInformation+0xa3

f799fc98 f7461f45 82952938 82fe6d70 00000000 nt!IopfCallDriver+0x31

f799fcac 804e3d77 82f82478 82965988 82f823c0 sr!SrSetInformation+0x179

f799fcbc 804f1426 00000000 82944450 0000238f nt!IopfCallDriver+0x31

f799fcf0 804ee473 82952938 f799fd18 80556d10 nt!CcSetValidData+0xa5

f799fd2c 804e54ad 82fbfa38 80561b40 82fc5640 nt!CcWriteBehind+0x21f

f799fd74 804e47fe 82fbfa38 00000000 82fc5640 nt!CcWorkerThread+0x126

f799fdac 8057dfed 82fbfa38 00000000 00000000 nt!ExpWorkerThread+0x100

f799fddc 804fa477 804e4729 00000000 00000000 nt!PspSystemThreadStartup+0x34

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

FOLLOWUP_IP:

Ntfs!NtfsUpdateFileDupInfo+212

f73db45e ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: Ntfs!NtfsUpdateFileDupInfo+212

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107eea

STACK_COMMAND: .cxr 0xfffffffff799f614 ; kb

FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsUpdateFileDupInfo+212

BUCKET_ID: 0x24_Ntfs!NtfsUpdateFileDupInfo+212

Followup: MachineOwner

---------

Ill post stop messages as i get them...

I hope you can be of some help.

thanks.

heres the stop message i found when i woke up this morning (sorry for shitty picture quality)

1_158.jpg

2_116.jpg 3_75.jpg 4_67.jpg

Edited by hbp
0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0