Help on analyzing BugCheck 24, {19025e, be29c350, be29bfa8, bfe786fe}

During backup a Windows 2000 server often crashes with a 0x24 stop error.
The first parameter is always the same "0019025e ".
Could this be related to hardware, software, drivers or filesystem?

I've done just about anything to isolate the problem, updated system bios, drivers, defragged, created new pagefile, chkdsk-ed, disabled HT, but it still crashes often with the exact same stop error.

Thanks in advance for your help!

regards,
Matthijs

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\temp\crashdump\Mini031506-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (2 procs) Free x86 compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x80484980
Debug session time: Wed Mar 15 08:43:13.890 2006 (GMT+1)
System Uptime: not available
Loading Kernel Symbols
.....................................................................................................
Loading User Symbols
Loading unloaded module list
....
*** WARNING: Unable to verify timestamp for Ntfs.sys
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {19025e, be29c350, be29bfa8, bfe786fe}

Probably caused by : Ntfs.sys ( Ntfs+186fe )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 0019025e
Arg2: be29c350
Arg3: be29bfa8
Arg4: bfe786fe

Debugging Details:
------------------


EXCEPTION_RECORD: be29c350 -- (.exr ffffffffbe29c350)
.exr ffffffffbe29c350
ExceptionAddress: bfe786fe (Ntfs+0x000186fe)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000048
Attempt to read from address 00000048

CONTEXT: be29bfa8 -- (.cxr ffffffffbe29bfa8)
.cxr ffffffffbe29bfa8
eax=00000001 ebx=87e97268 ecx=00000000 edx=00000000 esi=00000000 edi=00000000
eip=bfe786fe esp=be29c418 ebp=be29c42c iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
Ntfs+0x186fe:
bfe786fe ?? ???
.cxr
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

READ_ADDRESS: unable to read from 804849d8
unable to read from 80484368
unable to read from 80484240
unable to read from 80475fb0
unable to read from 80484258
unable to read from 80484364
unable to read from 80475fb4
unable to read from 80484424
unable to read from 80484978
00000048

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from 87e97201 to bfe786fe

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
be29c414 87e97201 88e79220 e241a6b8 80465c7c Ntfs+0x186fe
be29c42c bfe6a5b9 87e97201 00000000 e241a6b8 0x87e97201
be29c490 bfe7e04d 87e97268 88e790f0 eeb69a08 Ntfs+0xa5b9
be29c4f8 bfe82478 87e97268 eeb69a08 eeb69cf8 Ntfs+0x1e04d
be29c7f4 bfe7e5a2 87e97268 8240aa68 be29c868 Ntfs+0x22478
be29c8a8 8041dfe5 88e79020 8240aa68 8240aa78 Ntfs+0x1e5a2
be29c8bc 804c2115 80485680 804c1668 be29cbb8 nt!IopfCallDriver+0x35
be29ca44 804520d0 88eb5b70 00000000 be29cafc nt!IopParseDevice+0xaad
be29cabc 804d7eff 00000000 8905f900 00000040 nt!ObpLookupObjectName+0x504
be29cbcc 804a24e5 00000000 00000000 00000001 nt!ObOpenObjectByName+0xc5
be29cca8 804a208a 0012e8ec 81100080 0012e888 nt!IopCreateFile+0x407
be29ccf0 804a9a08 0012e8ec 81100080 0012e888 nt!IoCreateFile+0x36
be29cd30 80466ef9 0012e8ec 81100080 0012e888 nt!NtCreateFile+0x2e
be29cd30 77f87cb7 0012e8ec 81100080 0012e888 nt!KiSystemService+0xc9
0012e8e4 00000000 00000000 00000000 00000000 0x77f87cb7


FOLLOWUP_IP:
Ntfs+186fe
bfe786fe ?? ???

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: Ntfs+186fe

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3ebc05a5

STACK_COMMAND: .cxr 0xffffffffbe29bfa8 ; kb

FAILURE_BUCKET_ID: 0x24_Ntfs+186fe

BUCKET_ID: 0x24_Ntfs+186fe

Followup: MachineOwner
---------

eax=ffdff13c ebx=00000024 ecx=c00000d8 edx=8046bb66 esi=87e97268 edi=c0000005
eip=bfe6aff1 esp=be29be7c ebp=c0000188 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
Ntfs+0xaff1:
bfe6aff1 ?? ???
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
be29be78 00000000 0019025e be29c350 be29bfa8 Ntfs+0xaff1
start end module name
80062000 80076460 hal hal.dll Fri Mar 21 03:04:42 2003 (3E7A733A)
80400000 805a00c0 nt ntkrnlmp.exe Thu Jun 17 19:15:06 2004 (40D1D19A)
a0000000 a018e860 win32k win32k.sys Tue Aug 10 05:51:25 2004 (4118463D)
a018f000 a01aff00 atidrab atidrab.dll Tue Nov 30 10:31:17 1999 (38439965)
be415000 be42af00 RDPWD RDPWD.SYS Wed Jan 21 20:50:25 2004 (400ED801)
be953000 be9753c0 Fastfat Fastfat.SYS Wed Jan 15 20:48:39 2003 (3E25BB17)
bea9e000 beaacfe0 Cdfs Cdfs.SYS Wed Apr 16 05:58:53 2003 (3E9CD4FD)
bec6e000 beca9bc0 srv srv.sys Wed Apr 30 01:05:07 2003 (3EAF0523)
bef02000 bef1f4a0 afd afd.sys Wed Apr 30 10:45:29 2003 (3EAF8D29)
befb8000 befc0240 Fips Fips.SYS Tue May 09 17:28:29 2000 (39182E9D)
bf87e000 bf8816c0 dump_scsiport dump_scsiport.sys Tue Feb 25 20:18:04 2003 (3E5BC16C)
bf892000 bf8f8240 mrxsmb mrxsmb.sys Fri May 23 00:46:57 2003 (3ECD5361)
bf90b000 bf9359c0 rdbss rdbss.sys Fri May 23 00:47:05 2003 (3ECD5369)
bf936000 bf95de00 netbt netbt.sys Wed Jul 16 21:44:26 2003 (3F15AB1A)
bf95e000 bf9af060 tcpip tcpip.sys Wed Apr 30 01:05:31 2003 (3EAF053B)
bfa88000 bfa90a60 termdd termdd.sys Fri Mar 21 22:43:08 2003 (3E7B876C)
bfa98000 bfa9f000 sysmgmt sysmgmt.sys Fri Jul 01 19:14:49 2005 (42C57A09)
bfae0000 bfae48c0 TDTCP TDTCP.SYS Fri Mar 21 22:43:08 2003 (3E7B876C)
bfbb0000 bfbda3a0 update update.sys Wed Apr 16 06:22:01 2003 (3E9CDA69)
bfbdb000 bfbf6b40 ks ks.sys Wed Apr 16 06:02:11 2003 (3E9CD5C3)
bfc09000 bfc2c060 rdpdr rdpdr.sys Fri Mar 21 22:43:14 2003 (3E7B8772)
bfc2d000 bfc43ba0 ndiswan ndiswan.sys Wed Apr 30 01:05:01 2003 (3EAF051D)
bfc4e000 bfc7b880 cpqteam cpqteam.sys Wed Oct 20 09:09:18 2004 (41760F1E)
bfc7c000 bfc9af40 q57w2k q57w2k.sys Fri Jan 28 03:04:25 2005 (41F99DA9)
bfc9f000 bfca2580 vga vga.sys Sat Sep 25 20:37:40 1999 (37ED1674)
bfcb7000 bfcb9c60 mouhid mouhid.sys Wed Jan 15 20:43:39 2003 (3E25B9EB)
bfcbf000 bfcc2540 hidusb hidusb.sys Tue Oct 05 01:03:30 1999 (37F93242)
bfcc3000 bfd02980 cpqasm2 cpqasm2.sys Fri Jul 01 19:17:17 2005 (42C57A9D)
bfd03000 bfd146c0 atimpab atimpab.sys Thu Nov 11 00:34:06 1999 (382A00EE)
bfda5000 bfda8e60 TDI TDI.SYS Wed Jan 15 20:56:26 2003 (3E25BCEA)
bfdb1000 bfdb32e0 ndistapi ndistapi.sys Wed Jan 15 20:54:15 2003 (3E25BC67)
bfdbd000 bfdc0640 serenum serenum.sys Wed Jan 15 20:47:01 2003 (3E25BAB5)
bfded000 bfe07000 CPQPHP CPQPHP.SYS Fri Aug 29 00:23:13 2003 (3F4E80D1)
bfe07000 bfe1c640 Mup Mup.sys Wed Jan 15 20:54:01 2003 (3E25BC59)
bfe1d000 bfe35b80 RAIDISK RAIDISK.sys Wed May 19 11:22:02 2004 (40AB273A)
bfe36000 bfe5faa0 NDIS NDIS.sys Wed Apr 30 01:05:01 2003 (3EAF051D)
bfe60000 bfee25a0 Ntfs Ntfs.sys Fri May 09 21:46:45 2003 (3EBC05A5)
bfee3000 bfef47c0 KSecDD KSecDD.sys Sun Sep 21 02:32:19 2003 (3F6CF193)
bfef5000 bff071c0 Dfs Dfs.sys Wed Feb 12 03:19:06 2003 (3E49AF1A)
bff08000 bff1b260 CPQKGPSA CPQKGPSA.sys Tue May 13 19:36:57 2003 (3EC12D39)
bff1c000 bff31500 adpu160m adpu160m.sys Fri Jun 27 22:33:46 2003 (3EFCAA2A)
bff32000 bff440c0 SCSIPORT SCSIPORT.SYS Sat May 17 03:11:02 2003 (3EC58C26)
bff45000 bff6c140 LsiCsb6 LsiCsb6.sys Thu Jul 31 22:38:06 2003 (3F297E2E)
bff6d000 bff82180 atapi atapi.sys Tue Apr 01 20:08:25 2003 (3E89D599)
bff83000 bff98300 hpap hpap.sys Tue Apr 13 14:50:43 2004 (407BE223)
bff99000 bffba9c0 dmio dmio.sys Wed Jan 15 20:47:04 2003 (3E25BAB8)
bffbb000 bffd7220 ftdisk ftdisk.sys Tue Apr 01 00:21:58 2003 (3E88BF86)
bffd8000 bffffc20 ACPI ACPI.sys Wed Jan 15 20:44:22 2003 (3E25BA16)
f5c00000 f5c0e6a0 pci pci.sys Wed Jan 15 20:44:07 2003 (3E25BA07)
f5c10000 f5c1b680 isapnp isapnp.sys Wed Jan 15 20:43:47 2003 (3E25B9F3)
f5c20000 f5c290e0 symmpi symmpi.sys Tue Dec 10 18:31:28 2002 (3DF624F0)
f5c30000 f5c38700 CLASSPNP CLASSPNP.SYS Wed Jan 15 20:42:51 2003 (3E25B9BB)
f5c40000 f5c49000 RdFil RdFil.sys Thu Mar 04 05:05:55 2004 (4046AB23)
f5c50000 f5c5c4c0 VIDEOPRT VIDEOPRT.SYS Wed Jan 15 20:47:20 2003 (3E25BAC8)
f5c90000 f5c9b680 i8042prt i8042prt.sys Wed Apr 16 06:00:59 2003 (3E9CD57B)
f5ca0000 f5caf400 serial serial.sys Wed Apr 16 06:19:39 2003 (3E9CD9DB)
f5cb0000 f5cbdd00 CPQCISSE CPQCISSE.sys Fri May 20 19:15:54 2005 (428E1B4A)
f5cc0000 f5ccca80 rasl2tp rasl2tp.sys Wed Apr 30 01:05:06 2003 (3EAF0522)
f5cd0000 f5cdbc40 raspptp raspptp.sys Thu May 15 01:47:00 2003 (3EC2D574)
f5cf0000 f5cf9be0 usbhub usbhub.sys Wed Mar 19 00:30:41 2003 (3E77AC21)
f5d20000 f5d29ce0 NDProxy NDProxy.SYS Fri Oct 01 01:25:35 1999 (37F3F16F)
f5d30000 f5d38fa0 Npfs Npfs.SYS Sun Oct 10 01:58:07 1999 (37FFD68F)
f5d40000 f5d48680 msgpc msgpc.sys Wed Jan 15 20:54:25 2003 (3E25BC71)
f5d50000 f5d581a0 netbios netbios.sys Tue Oct 12 21:34:19 1999 (38038D3B)
f5e80000 f5e85520 PCIIDEX PCIIDEX.SYS Tue Feb 25 19:31:08 2003 (3E5BB66C)
f5e88000 f5e8f4c0 MountMgr MountMgr.sys Tue Feb 10 20:47:53 2004 (40293569)
f5e90000 f5e96320 symc8xx symc8xx.sys Fri Mar 30 19:01:54 2001 (3AC4BC02)
f5e98000 f5e9d180 sym_hi sym_hi.sys Sat Sep 25 21:11:49 1999 (37ED1E75)
f5ea0000 f5ea4080 cpqcissm cpqcissm.sys Fri May 20 19:16:05 2005 (428E1B55)
f5ea8000 f5eaf720 disk disk.sys Wed Jan 15 20:43:05 2003 (3E25B9C9)
f5ec0000 f5ec4a60 flpydisk flpydisk.sys Wed Jan 15 20:42:52 2003 (3E25B9BC)
f5ed0000 f5ed6a20 EFS EFS.SYS Wed Jan 15 20:46:55 2003 (3E25BAAF)
f5ed8000 f5ede500 CpqCiDrv CpqCiDrv.sys Sat Jun 25 02:11:13 2005 (42BCA121)
f5ee8000 f5eedec0 kbdclass kbdclass.sys Thu Feb 20 17:37:30 2003 (3E55044A)
f5ef0000 f5ef5fa0 HIDCLASS HIDCLASS.SYS Wed Jan 15 20:45:26 2003 (3E25BA56)
f5ef8000 f5efd400 mouclass mouclass.sys Thu Feb 20 17:37:45 2003 (3E550459)
f5f10000 f5f11000 fdc fdc.sys unavailable (00000000)
f5f18000 f5f1d900 HIDPARSE HIDPARSE.SYS Tue Apr 08 19:34:46 2003 (3E930836)
f5f20000 f5f26c40 cdrom cdrom.sys Wed Jan 15 20:43:04 2003 (3E25B9C8)
f5f30000 f5f35fc0 openhci openhci.sys Sat Mar 01 01:28:59 2003 (3E5FFECB)
f5f48000 f5f4cfc0 USBD USBD.SYS Wed Jan 22 18:05:33 2003 (3E2ECF5D)
f5f50000 f5f55240 Msfs Msfs.SYS Wed Oct 27 01:21:32 1999 (3816377C)
f5f68000 f5f6fd00 wanarp wanarp.sys Fri Aug 16 14:25:01 2002 (3D5CEF1D)
f5f88000 f5f8c400 ptilink ptilink.sys Wed Jan 15 20:47:15 2003 (3E25BAC3)
f5f90000 f5f94080 dump_cpqcissm dump_cpqcissm.sys Fri May 20 19:16:05 2005 (428E1B55)
f5f98000 f5f9c0e0 raspti raspti.sys Fri Oct 08 22:45:10 1999 (37FE57D6)
f6010000 f6012a20 BOOTVID BOOTVID.dll Thu Nov 04 02:24:33 1999 (3820E051)
f6014000 f6016d00 PartMgr PartMgr.sys Wed Jan 15 20:43:07 2003 (3E25B9CB)
f6018000 f601bfe0 symc810 symc810.sys Sat Sep 25 21:11:49 1999 (37ED1E75)
f601c000 f601f460 cpqarry2 cpqarry2.sys Mon Nov 05 22:47:33 2001 (3BE708F5)
f6020000 f6022920 lpxftr lpxftr.sys Fri Feb 07 02:38:34 2003 (3E430E1A)
f6100000 f6101b80 dmload dmload.sys Wed Jan 15 20:47:06 2003 (3E25BABA)
f6110000 f6111ca0 Fs_Rec Fs_Rec.SYS Wed Jan 15 20:53:30 2003 (3E25BC3A)
f6118000 f6119e40 rasacd rasacd.sys Sat Sep 25 20:41:23 1999 (37ED1753)
f615a000 f615ba60 uphcleanhlp uphcleanhlp.sys Fri Mar 05 06:43:35 2004 (40481387)
f61c8000 f61c8f80 WMILIB WMILIB.SYS Sat Sep 25 20:36:47 1999 (37ED163F)
f61c9000 f61c9b00 pciide pciide.sys Wed Jan 15 20:43:03 2003 (3E25B9C7)
f61f7000 f61f7a40 audstub audstub.sys Sat Sep 25 20:35:33 1999 (37ED15F5)
f6201000 f6201d80 swenum swenum.sys Sat Sep 25 20:36:31 1999 (37ED162F)
f6219000 f62199e0 null null.sys Sat Sep 25 20:34:58 1999 (37ED15D2)
f621b000 f621bee0 Beep Beep.SYS Thu Oct 21 00:18:59 1999 (380E3FD3)
f621e000 f621ef80 mnmdd mnmdd.SYS Sat Sep 25 20:37:40 1999 (37ED1674)

Unloaded modules:
f5d60000 f5d69000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f5f38000 f5f3d000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
bfca7000 bfcaa000 libxprmc.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bfcaf000 bfcb2000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

Hi,

Probably the culprit is faulty ram. Run chkdsk /r to perform hard disk health check. Run memtest to stress test the ram.

 

Thanks for your reply.
Wouldn't faulty hardware/ram cause random crashes?

Can you explain what goes wrong on the moment of the error?

Regards,
Matthijs

 

I've run 2 passes extented test with Windows Memory Diagnostic
http://oca.microsoft.com/en/windiag.asp
RAM is healthy according to several diagnostic utilities.

Abnormal Program Termination (BugCheck, STOP: 0x00000024 (0x0019025E, 0xBE29C350, 0xBE29BFA8, 0xBFE786FE))

Parameter 1 and 4 are always the same, I would like to know how to find out what causes the problem.
My guess is something in the ntfs filesystem but I can't find what or where, do the 2nd and 3rd parameter tell something about this?

Regards,
Matthijs

 

Do you run chkdsk /r? Some faulty ramcan pass the memtest. Reseat the memory module to another memory slot.

 

Hardware is good, filesystem is fine.
Logged a supportcall at Microsoft, hope they'll find an answer soon.

Regards,
Matthijs