bsod every time I boot up

TheCenturion · 19 Jun 2010 at 11:35

I'm on xp professional, sp3.

Whenever I click to log in, I get a BSOD, and the error code is something about ntfs.sys.

Last time I was able to use it, I had very little space on my C drive. I think that is what's causing it. How can I somehow remove some stuff from the harddrive without actually logging into my pc? To be honest, taking the hard drive out and putting in another system is dead end, I don't have another system available to me.

Thanks

EDIT: got into safe mode and deleted a whole load of stuff, still get the bsod

TheCenturion · 19 Jun 2010 at 12:03

The ntfs.sys file is causing the problem:

page_fault_in_nonpaged_area

TheCenturion · 19 Jun 2010 at 13:28

just run a chkdisk through safe mode, will report how it goes

theheyes · 19 Jun 2010 at 13:32

You could perhaps try a repair install, but if there is anything on there you want make a backup of it first.

TheCenturion · 19 Jun 2010 at 15:02

well chkdisk didn't solve the problem.

theheyes said:
You could perhaps try a repair install, but if there is anything on there you want make a backup of it first.

Will I need the cd for that? I've got a whole load of stuff that I need to keep, but I don't have a storage medium

theheyes · 19 Jun 2010 at 15:42

Are you running any antivirus or antivirus-type software?

TheCenturion · 19 Jun 2010 at 15:48

yeah, avg would have been running

theheyes · 19 Jun 2010 at 16:34

In answer to your above question yes you would normally need the cd to do a repair install.

When you get into safemode, try stopping the AVG service from starting. It might not be the problem in your case but worth a shot because I've seen this happen before with antivirus products.

TheCenturion · 19 Jun 2010 at 16:45

now that you mention it, I went onto a website earlier and an avg message came up

Pho · 19 Jun 2010 at 18:32

Log into the system through safe mode, do you have any files in c:\Windows\Minidump created around the times of the crashes? If so post them here / email me and I can take a look.

TheCenturion · 20 Jun 2010 at 15:13

THere's seven files in Windows\minidump

IAmATeaf · 20 Jun 2010 at 17:14

anant_shah94 said:
The ntfs.sys file is causing the problem:

page_fault_in_nonpaged_area

page fault to me would indicate possible problems with your RAM, get a copy of Memtest86+ and run that to see what it reports.

Pho · 20 Jun 2010 at 17:19

anant_shah94 said:
THere's seven files in Windows\minidump

Send a couple to my email (sig) or upload and post them here and I'll take a look for you.

TheCenturion · 22 Jun 2010 at 15:20

IAmATeaf said:
page fault to me would indicate possible problems with your RAM, get a copy of Memtest86+ and run that to see what it reports.

I can't get memtest, in safe mode it won't accept a usb drive, so I've got no way of getting memtest on my system

Pho- Thanks for your help, I'll be able to email it on Friday

IAmATeaf · 22 Jun 2010 at 15:48

Can't you use another PC/laptop, get a friend to download it for you? It normally creates a bootable floppy disk which you boot off.

TheCenturion · 26 Jun 2010 at 21:43

I could try to do that, but I'm not even sure I have any floppys lying about at the moment :\

TheCenturion · 26 Jun 2010 at 21:52

I've got the minidump files if anyone wants them

Pho · 26 Jun 2010 at 23:13

You should be able to burn memtest to disc as well.

Mini061910-01.dmp:

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Me\Desktop\Mini061910-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\temp\symbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.100216-1514
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sat Jun 19 10:36:10.546 2010 (GMT+1)
System Uptime: 0 days 0:59:52.252
Loading Kernel Symbols
...............................................................
................................................................
............................................
Loading User Symbols
Loading unloaded module list
.....................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, f7124c66, b496d0c4, 0}

Probably caused by : sr.sys ( sr!SrpExpandPathOfFileName+111 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f7124c66, The address that the exception occurred at
Arg3: b496d0c4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
Ntfs!NtfsCommonCreate+ac
f7124c66 89b8c8000000    mov     dword ptr [eax+0C8h],edi

TRAP_FRAME:  b496d0c4 -- (.trap 0xffffffffb496d0c4)
ErrCode = 00000002
eax=00000000 ebx=b496d270 ecx=b496d2ac edx=00000000 esi=85046b14 edi=00000000
eip=f7124c66 esp=b496d138 ebp=b496d274 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
Ntfs!NtfsCommonCreate+0xac:
f7124c66 89b8c8000000    mov     dword ptr [eax+0C8h],edi ds:0023:000000c8=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  avgrsx.exe

LAST_CONTROL_TRANSFER:  from f7126f2d to f7124c66

STACK_TEXT:  
b496d274 f7126f2d 00000000 850469a8 b496d270 Ntfs!NtfsCommonCreate+0xac
b496d2fc 804ef19f 873326d8 00000001 850469a8 Ntfs!NtfsFsdCreate+0x1dc
b496d30c f71e2e9b 00000000 850469a8 85046b38 nt!IopfCallDriver+0x31
b496d330 f71ef754 b496d350 86755860 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
b496d36c 804ef19f 86755860 850469a8 850469a8 fltmgr!FltpCreate+0x26a
b496d37c 805831fa 8729fc78 8515b454 b496d514 nt!IopfCallDriver+0x31
b496d45c 805bf434 8729fc90 00000000 8515b3b0 nt!IopParseDevice+0xa12
b496d4d4 805bb9c0 00000000 b496d514 00000240 nt!ObpLookupObjectName+0x53c
b496d528 80576033 00000000 00000000 96d7f800 nt!ObOpenObjectByName+0xea
b496d5a4 80576a20 b496d664 00100000 b496d644 nt!IopCreateFile+0x407
b496d5ec f71d6ea5 b496d664 00100000 b496d644 nt!IoCreateFileSpecifyDeviceObjectHint+0x52
b496d78c f71d76d1 873326d8 b496d878 b496d875 sr!SrpExpandPathOfFileName+0x111
b496d7ac f71d7713 873326d8 866f6db8 b496d878 sr!SrpGetFileNameFromFileObject+0xe7
b496d7c4 f71d77a0 873326d8 866f6db8 00140008 sr!SrpExpandFileName+0x35
b496d7ec f71d03e2 873326d8 866f6db8 00000000 sr!SrIsFileEligible+0x5a
b496d98c f71d282c 873326d8 866f6db8 00140008 sr!SrCreateContext+0x13e
b496d9ec 804ef19f 873326d8 00000005 86945008 sr!SrCreate+0x106
b496d9fc f71e2e9b 00000000 86945008 86945198 nt!IopfCallDriver+0x31
b496da20 f71ef754 b496da40 86755860 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
b496da5c 804ef19f 86755860 86945008 86945008 fltmgr!FltpCreate+0x26a
b496da6c 805831fa 8729fc78 869224e4 b496dc04 nt!IopfCallDriver+0x31
b496db4c 805bf434 8729fc90 00000000 86922440 nt!IopParseDevice+0xa12
b496dbc4 805bb9c0 00000000 b496dc04 00000040 nt!ObpLookupObjectName+0x53c
b496dc18 80576033 00000000 00000000 00000001 nt!ObOpenObjectByName+0xea
b496dc94 805769aa 05b2f488 c0110080 05b2f428 nt!IopCreateFile+0x407
b496dcf0 805790b4 05b2f488 c0110080 05b2f428 nt!IoCreateFile+0x8e
b496dd30 8054163c 05b2f488 c0110080 05b2f428 nt!NtCreateFile+0x30
b496dd30 7c90e514 05b2f488 c0110080 05b2f428 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
05b2f480 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
sr!SrpExpandPathOfFileName+111
f71d6ea5 3bc6            cmp     eax,esi

SYMBOL_STACK_INDEX:  b

SYMBOL_NAME:  sr!SrpExpandPathOfFileName+111

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: sr

IMAGE_NAME:  sr.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  480252c2

FAILURE_BUCKET_ID:  0x8E_sr!SrpExpandPathOfFileName+111

BUCKET_ID:  0x8E_sr!SrpExpandPathOfFileName+111

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f7124c66, The address that the exception occurred at
Arg3: b496d0c4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
Ntfs!NtfsCommonCreate+ac
f7124c66 89b8c8000000    mov     dword ptr [eax+0C8h],edi

TRAP_FRAME:  b496d0c4 -- (.trap 0xffffffffb496d0c4)
ErrCode = 00000002
eax=00000000 ebx=b496d270 ecx=b496d2ac edx=00000000 esi=85046b14 edi=00000000
eip=f7124c66 esp=b496d138 ebp=b496d274 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
Ntfs!NtfsCommonCreate+0xac:
f7124c66 89b8c8000000    mov     dword ptr [eax+0C8h],edi ds:0023:000000c8=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  avgrsx.exe

LAST_CONTROL_TRANSFER:  from f7126f2d to f7124c66

STACK_TEXT:  
b496d274 f7126f2d 00000000 850469a8 b496d270 Ntfs!NtfsCommonCreate+0xac
b496d2fc 804ef19f 873326d8 00000001 850469a8 Ntfs!NtfsFsdCreate+0x1dc
b496d30c f71e2e9b 00000000 850469a8 85046b38 nt!IopfCallDriver+0x31
b496d330 f71ef754 b496d350 86755860 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
b496d36c 804ef19f 86755860 850469a8 850469a8 fltmgr!FltpCreate+0x26a
b496d37c 805831fa 8729fc78 8515b454 b496d514 nt!IopfCallDriver+0x31
b496d45c 805bf434 8729fc90 00000000 8515b3b0 nt!IopParseDevice+0xa12
b496d4d4 805bb9c0 00000000 b496d514 00000240 nt!ObpLookupObjectName+0x53c
b496d528 80576033 00000000 00000000 96d7f800 nt!ObOpenObjectByName+0xea
b496d5a4 80576a20 b496d664 00100000 b496d644 nt!IopCreateFile+0x407
b496d5ec f71d6ea5 b496d664 00100000 b496d644 nt!IoCreateFileSpecifyDeviceObjectHint+0x52
b496d78c f71d76d1 873326d8 b496d878 b496d875 sr!SrpExpandPathOfFileName+0x111
b496d7ac f71d7713 873326d8 866f6db8 b496d878 sr!SrpGetFileNameFromFileObject+0xe7
b496d7c4 f71d77a0 873326d8 866f6db8 00140008 sr!SrpExpandFileName+0x35
b496d7ec f71d03e2 873326d8 866f6db8 00000000 sr!SrIsFileEligible+0x5a
b496d98c f71d282c 873326d8 866f6db8 00140008 sr!SrCreateContext+0x13e
b496d9ec 804ef19f 873326d8 00000005 86945008 sr!SrCreate+0x106
b496d9fc f71e2e9b 00000000 86945008 86945198 nt!IopfCallDriver+0x31
b496da20 f71ef754 b496da40 86755860 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
b496da5c 804ef19f 86755860 86945008 86945008 fltmgr!FltpCreate+0x26a
b496da6c 805831fa 8729fc78 869224e4 b496dc04 nt!IopfCallDriver+0x31
b496db4c 805bf434 8729fc90 00000000 86922440 nt!IopParseDevice+0xa12
b496dbc4 805bb9c0 00000000 b496dc04 00000040 nt!ObpLookupObjectName+0x53c
b496dc18 80576033 00000000 00000000 00000001 nt!ObOpenObjectByName+0xea
b496dc94 805769aa 05b2f488 c0110080 05b2f428 nt!IopCreateFile+0x407
b496dcf0 805790b4 05b2f488 c0110080 05b2f428 nt!IoCreateFile+0x8e
b496dd30 8054163c 05b2f488 c0110080 05b2f428 nt!NtCreateFile+0x30
b496dd30 7c90e514 05b2f488 c0110080 05b2f428 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
05b2f480 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
sr!SrpExpandPathOfFileName+111
f71d6ea5 3bc6            cmp     eax,esi

SYMBOL_STACK_INDEX:  b

SYMBOL_NAME:  sr!SrpExpandPathOfFileName+111

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: sr

IMAGE_NAME:  sr.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  480252c2

FAILURE_BUCKET_ID:  0x8E_sr!SrpExpandPathOfFileName+111

BUCKET_ID:  0x8E_sr!SrpExpandPathOfFileName+111

Followup: MachineOwner
---------

Mini061910-02.dmp

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Me\Desktop\Mini061910-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\temp\symbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.100216-1514
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sat Jun 19 11:29:55.187 2010 (GMT+1)
System Uptime: 0 days 0:01:23.890
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
.........................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, f7124c66, f58f97c8, 0}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonCreate+ac )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f7124c66, The address that the exception occurred at
Arg3: f58f97c8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
Ntfs!NtfsCommonCreate+ac
f7124c66 89b8c8000000    mov     dword ptr [eax+0C8h],edi

TRAP_FRAME:  f58f97c8 -- (.trap 0xfffffffff58f97c8)
ErrCode = 00000002
eax=00000000 ebx=f58f9974 ecx=f58f99b0 edx=00000000 esi=8536b174 edi=00000000
eip=f7124c66 esp=f58f983c ebp=f58f9978 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
Ntfs!NtfsCommonCreate+0xac:
f7124c66 89b8c8000000    mov     dword ptr [eax+0C8h],edi ds:0023:000000c8=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  WgaTray.exe

LAST_CONTROL_TRANSFER:  from f7126f2d to f7124c66

STACK_TEXT:  
f58f9978 f7126f2d 00000000 8536b008 f58f9974 Ntfs!NtfsCommonCreate+0xac
f58f9a00 804ef19f 8737ee88 00000001 8536b008 Ntfs!NtfsFsdCreate+0x1dc
f58f9a10 f71e2e9b 00000000 8536b008 8536b198 nt!IopfCallDriver+0x31
f58f9a34 f71ef754 f58f9a54 85ede020 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
f58f9a70 804ef19f 85ede020 8536b008 8536b008 fltmgr!FltpCreate+0x26a
f58f9a80 805831fa 8728dcc0 852fce14 f58f9c18 nt!IopfCallDriver+0x31
f58f9b60 805bf434 8728dcd8 00000000 852fcd70 nt!IopParseDevice+0xa12
f58f9bd8 805bb9c0 00000000 f58f9c18 00000040 nt!ObpLookupObjectName+0x53c
f58f9c2c 80576033 00000000 00000000 00000001 nt!ObOpenObjectByName+0xea
f58f9ca8 805769aa 0006f5e0 00100100 0006f59c nt!IopCreateFile+0x407
f58f9d04 8057a1a9 0006f5e0 00100100 0006f59c nt!IoCreateFile+0x8e
f58f9d44 8054163c 0006f5e0 00100100 0006f59c nt!NtOpenFile+0x27
f58f9d44 7c90e514 0006f5e0 00100100 0006f59c nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0006f5d8 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsCommonCreate+ac
f7124c66 89b8c8000000    mov     dword ptr [eax+0C8h],edi

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsCommonCreate+ac

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48025be5

FAILURE_BUCKET_ID:  0x8E_Ntfs!NtfsCommonCreate+ac

BUCKET_ID:  0x8E_Ntfs!NtfsCommonCreate+ac

Followup: MachineOwner
---------

Mini061910-03.dmp

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Me\Desktop\Mini061910-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\temp\symbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.100216-1514
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sat Jun 19 11:31:27.265 2010 (GMT+1)
System Uptime: 0 days 0:01:07.968
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
.......................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, f7124c66, ee4a20c8, 0}

Probably caused by : sr.sys ( sr!SrpExpandPathOfFileName+111 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f7124c66, The address that the exception occurred at
Arg3: ee4a20c8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
Ntfs!NtfsCommonCreate+ac
f7124c66 89b8c8000000    mov     dword ptr [eax+0C8h],edi

TRAP_FRAME:  ee4a20c8 -- (.trap 0xffffffffee4a20c8)
ErrCode = 00000002
eax=00000000 ebx=ee4a2270 ecx=ba036980 edx=00000000 esi=85360a74 edi=00000000
eip=f7124c66 esp=ee4a213c ebp=ee4a2278 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
Ntfs!NtfsCommonCreate+0xac:
f7124c66 89b8c8000000    mov     dword ptr [eax+0C8h],edi ds:0023:000000c8=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  3

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  avgrsx.exe

LAST_CONTROL_TRANSFER:  from f7126f2d to f7124c66

STACK_TEXT:  
ee4a2278 f7126f2d 00000000 85360908 86a09468 Ntfs!NtfsCommonCreate+0xac
ee4a22fc 804ef19f 873a30d8 00000001 85360908 Ntfs!NtfsFsdCreate+0x1dc
ee4a230c f71e2e9b 00000000 85360908 85360a98 nt!IopfCallDriver+0x31
ee4a2330 f71ef754 ee4a2350 85ce7d50 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
ee4a236c 804ef19f 85ce7d50 85360908 85360908 fltmgr!FltpCreate+0x26a
ee4a237c 805831fa 8729fcc0 86a3bccc ee4a2514 nt!IopfCallDriver+0x31
ee4a245c 805bf434 8729fcd8 00000000 86a3bc28 nt!IopParseDevice+0xa12
ee4a24d4 805bb9c0 00000000 ee4a2514 00000240 nt!ObpLookupObjectName+0x53c
ee4a2528 80576033 00000000 00000000 4a27f800 nt!ObOpenObjectByName+0xea
ee4a25a4 80576a20 ee4a2664 00100000 ee4a2644 nt!IopCreateFile+0x407
ee4a25ec f71d6ea5 ee4a2664 00100000 ee4a2644 nt!IoCreateFileSpecifyDeviceObjectHint+0x52
ee4a278c f71d76d1 873a30d8 ee4a2878 ee4a2875 sr!SrpExpandPathOfFileName+0x111
ee4a27ac f71d7713 873a30d8 85a992c0 ee4a2878 sr!SrpGetFileNameFromFileObject+0xe7
ee4a27c4 f71d77a0 873a30d8 85a992c0 00140008 sr!SrpExpandFileName+0x35
ee4a27ec f71d03e2 873a30d8 85a992c0 00000000 sr!SrIsFileEligible+0x5a
ee4a298c f71d282c 873a30d8 85a992c0 00140008 sr!SrCreateContext+0x13e
ee4a29ec 804ef19f 873a30d8 00000005 85360ac8 sr!SrCreate+0x106
ee4a29fc f71e2e9b 00000000 85360ac8 85360c58 nt!IopfCallDriver+0x31
ee4a2a20 f71ef754 ee4a2a40 85ce7d50 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
ee4a2a5c 804ef19f 85ce7d50 85360ac8 85360ac8 fltmgr!FltpCreate+0x26a
ee4a2a6c 805831fa 8729fcc0 8697afd4 ee4a2c04 nt!IopfCallDriver+0x31
ee4a2b4c 805bf434 8729fcd8 00000000 8697af30 nt!IopParseDevice+0xa12
ee4a2bc4 805bb9c0 00000000 ee4a2c04 00000040 nt!ObpLookupObjectName+0x53c
ee4a2c18 80576033 00000000 00000000 00000001 nt!ObOpenObjectByName+0xea
ee4a2c94 805769aa 05c2f470 c0110080 05c2f410 nt!IopCreateFile+0x407
ee4a2cf0 805790b4 05c2f470 c0110080 05c2f410 nt!IoCreateFile+0x8e
ee4a2d30 8054163c 05c2f470 c0110080 05c2f410 nt!NtCreateFile+0x30
ee4a2d30 7c90e514 05c2f470 c0110080 05c2f410 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
05c2f468 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
sr!SrpExpandPathOfFileName+111
f71d6ea5 3bc6            cmp     eax,esi

SYMBOL_STACK_INDEX:  b

SYMBOL_NAME:  sr!SrpExpandPathOfFileName+111

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: sr

IMAGE_NAME:  sr.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  480252c2

FAILURE_BUCKET_ID:  0x8E_sr!SrpExpandPathOfFileName+111

BUCKET_ID:  0x8E_sr!SrpExpandPathOfFileName+111

Followup: MachineOwner
---------

Mini061910-04.dmp

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Me\Desktop\Mini061910-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\temp\symbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.100216-1514
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sat Jun 19 11:38:36.359 2010 (GMT+1)
System Uptime: 0 days 0:06:42.062
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
.........................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, f7124c66, ba4360c8, 0}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonCreate+ac )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f7124c66, The address that the exception occurred at
Arg3: ba4360c8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
Ntfs!NtfsCommonCreate+ac
f7124c66 89b8c8000000    mov     dword ptr [eax+0C8h],edi

TRAP_FRAME:  ba4360c8 -- (.trap 0xffffffffba4360c8)
ErrCode = 00000002
eax=00000000 ebx=ba436271 ecx=b9e0b980 edx=00000000 esi=86a03174 edi=00000000
eip=f7124c66 esp=ba43613c ebp=ba436278 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
Ntfs!NtfsCommonCreate+0xac:
f7124c66 89b8c8000000    mov     dword ptr [eax+0C8h],edi ds:0023:000000c8=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  avgrsx.exe

LAST_CONTROL_TRANSFER:  from f7126f2d to f7124c66

STACK_TEXT:  
ba436278 f7126f2d 00000000 86a03008 04d98871 Ntfs!NtfsCommonCreate+0xac
ba4362fd e8804ef1 0187331c 08000000 9b86a030 Ntfs!NtfsFsdCreate+0x1dc
WARNING: Frame IP not in any known module. Following frames may be wrong.
ba436309 9b86a030 00f71e2e 08000000 9886a030 0xe8804ef1
ba43630d 00f71e2e 08000000 9886a030 0886a031 0x9b86a030
ba436311 08000000 9886a030 0886a031 08000000 0xf71e2e
ba436315 9886a030 0886a031 08000000 9886a030 0x8000000
ba436319 0886a031 08000000 9886a030 aa86a031 0x9886a030
ba43631d 08000000 9886a030 aa86a031 6c001ed6 0x886a031
ba436321 9886a030 aa86a031 6c001ed6 54ba4363 0x8000000
ba436325 aa86a031 6c001ed6 54ba4363 50f71ef7 0x9886a030
ba436329 6c001ed6 54ba4363 50f71ef7 10ba4363 0xaa86a031
ba43632d 54ba4363 50f71ef7 10ba4363 0085f6e3 0x6c001ed6
ba436331 50f71ef7 10ba4363 0085f6e3 88000000 0x54ba4363
ba436335 10ba4363 0085f6e3 88000000 188504d9 0x50f71ef7
ba436339 0085f6e3 88000000 188504d9 c086a030 0x10ba4363
ba43633d 88000000 188504d9 c086a030 0886db58 0x85f6e3
ba436341 188504d9 c086a030 0886db58 0885f6d0 0x88000000
ba436345 c086a030 0886db58 0885f6d0 d086a030 0x188504d9
ba436349 0886db58 0885f6d0 d086a030 ff850586 0xc086a030
ba43634d 0885f6d0 d086a030 ff850586 00ffffff 0x886db58
ba436351 d086a030 ff850586 00ffffff 04000000 0x885f6d0
ba436355 ff850586 00ffffff 04000000 d8000000 0xd086a030
ba436359 00ffffff 04000000 d8000000 5c000003 0xff850586
ba43635d 04000000 d8000000 5c000003 9fba4364 0xffffff
ba436361 d8000000 5c000003 9fba4364 10804ef1 0x4000000
ba436365 5c000003 9fba4364 10804ef1 0885f6e3 0xd8000000
ba436369 9fba4364 10804ef1 0885f6e3 0886a030 0x5c000003
ba43636d 10804ef1 0885f6e3 0886a030 fa86a030 0x9fba4364
ba436371 0885f6e3 0886a030 fa86a030 18805831 0x10804ef1
ba436375 0886a030 fa86a030 18805831 8c8729fc 0x885f6e3
ba436379 fa86a030 18805831 8c8729fc 1485fff6 0x886a030
ba43637d 18805831 8c8729fc 1485fff6 18ba4365 0xfa86a030
ba436381 8c8729fc 1485fff6 18ba4365 00000000 0x18805831
ba436385 1485fff6 18ba4365 00000000 00000000 0x8c8729fc
ba436389 18ba4365 00000000 00000000 40000000 0x1485fff6
ba43638d 00000000 00000000 40000000 00000002 0x18ba4365


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsCommonCreate+ac
f7124c66 89b8c8000000    mov     dword ptr [eax+0C8h],edi

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsCommonCreate+ac

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48025be5

FAILURE_BUCKET_ID:  0x8E_Ntfs!NtfsCommonCreate+ac

BUCKET_ID:  0x8E_Ntfs!NtfsCommonCreate+ac

Followup: MachineOwner
---------

Mini061910-05.dmp

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Me\Desktop\Mini061910-05.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\temp\symbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.100216-1514
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sat Jun 19 11:45:09.109 2010 (GMT+1)
System Uptime: 0 days 0:01:06.828
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
.......................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, f7124c66, ef7f1318, 0}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonCreate+ac )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f7124c66, The address that the exception occurred at
Arg3: ef7f1318, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
Ntfs!NtfsCommonCreate+ac
f7124c66 89b8c8000000    mov     dword ptr [eax+0C8h],edi

TRAP_FRAME:  ef7f1318 -- (.trap 0xffffffffef7f1318)
ErrCode = 00000002
eax=7085d59d ebx=ef7f14c1 ecx=ba3f6980 edx=00000000 esi=85b70900 edi=00000000
eip=f7124c66 esp=ef7f138c ebp=ef7f14c8 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
Ntfs!NtfsCommonCreate+0xac:
f7124c66 89b8c8000000    mov     dword ptr [eax+0C8h],edi ds:0023:7085d665=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  5

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  lsass.exe

LAST_CONTROL_TRANSFER:  from f7126f2d to f7124c66

STACK_TEXT:  
ef7f14c8 f7126f2d 7085d59d 85b70770 d59dc0c1 Ntfs!NtfsCommonCreate+0xac
ef7f154d 88804ef1 01873dfe 70000000 c385b707 Ntfs!NtfsFsdCreate+0x1dc
WARNING: Frame IP not in any known module. Following frames may be wrong.
ef7f1559 c385b707 c0f71ef6 8085d59d e085b707 0x88804ef1
ef7f155d c0f71ef6 8085d59d e085b707 6886db58 0xc385b707
ef7f1561 8085d59d e085b707 6886db58 7085a457 0xc0f71ef6
ef7f1565 e085b707 6886db58 7085a457 0085b707 0x8085d59d
ef7f1569 6886db58 7085a457 0085b707 00000000 0xe085b707
ef7f156d 7085a457 0085b707 00000000 00000000 0x6886db58
ef7f1571 0085b707 00000000 00000000 02000000 0x7085a457
ef7f1575 00000000 00000000 02000000 50000000 0x85b707


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsCommonCreate+ac
f7124c66 89b8c8000000    mov     dword ptr [eax+0C8h],edi

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsCommonCreate+ac

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48025be5

FAILURE_BUCKET_ID:  0x8E_Ntfs!NtfsCommonCreate+ac

BUCKET_ID:  0x8E_Ntfs!NtfsCommonCreate+ac

Followup: MachineOwner
---------

Definitely looks like it could be something to do with your hard drive. Every dump mentions NTFS in the stack like you mentioned which implies it could be either the hard disk itself or maybe a dodgy controller. It might be a good idea to try changing the HD cable should that be bad.

A couple of the crashes look to be from system restore, but again it seems to be trying to create something on your HD and then dieing. Maybe look at upgrading the chip-set drivers for your motherboard/hard disk controller as well.

From safe mode you should be able to run (to attempt to repair any bad blocks on the hard disk just in-case):
chkdsk /r c:

Mind you, a lot of the crashes were caused from within avgrsx.exe which looks to be an AVG process. I'd definitely try uninstalling AVG and seeing if that helps too.

Try running some drive diagnostics from your hard drive manufacturer and see what it says.

.. it could also be your memory still as well as that is mentioned

.

TheCenturion · 27 Jun 2010 at 11:26

deleted avg, ran another chkdsk, but to no avail. I'll try to get memtest on there asap

TheCenturion · 27 Jun 2010 at 17:39

Safe mode won't even work now

I'm at the end of my tether I need some files off there. Would a repair install delete my personal files?