Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [c:\windows\minidump\Mini022211-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Inaccessible path: 'c:\windows\i386'
Symbol search path is: srv*c:\symbols*
http://msdl.microsoft.com/download/symbols
Executable search path is: c:\windows\i386
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.101209-1647
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Tue Feb 22 18:48:53.901 2011 (UTC + 2:00)
System Uptime: 0 days 0:04:26.181
Loading Kernel Symbols
...............................................................
...........................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1902fe, b265977c, b2659478, 8056f16a}
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonCleanup+2273 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001902fe
Arg2: b265977c
Arg3: b2659478
Arg4: 8056f16a
Debugging Details:
------------------
EXCEPTION_RECORD: b265977c -- (.exr 0xffffffffb265977c)
ExceptionAddress: 8056f16a (nt!FsRtlNotifyFilterReportChange+0x0000008c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
CONTEXT: b2659478 -- (.cxr 0xffffffffb2659478)
eax=b2659858 ebx=000a2452 ecx=e215fef0 edx=00000000 esi=8a2bb748 edi=e238b287
eip=8056f16a esp=b2659844 ebp=b26598bc iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
nt!FsRtlNotifyFilterReportChange+0x8c:
8056f16a 66833a00 cmp word ptr [edx],0 ds
00000000=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: NULL_DEREFERENCE
PROCESS_NAME: svchost.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 00000000
READ_ADDRESS: 00000000
FOLLOWUP_IP:
Ntfs!NtfsCommonCleanup+2273
b9e58aca 895dfc mov dword ptr [ebp-4],ebx
FAULTING_IP:
nt!FsRtlNotifyFilterReportChange+8c
8056f16a 66833a00 cmp word ptr [edx],0
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from b9e58aca to 8056f16a
STACK_TEXT:
b26598bc b9e58aca 8a2bb748 8a303400 e215fef0 nt!FsRtlNotifyFilterReportChange+0x8c
b2659ae8 b9e52d4d b2659b04 89f7ce70 8a100948 Ntfs!NtfsCommonCleanup+0x2273
b2659c60 804ef19f 8a303020 89f7ce70 89f7ce70 Ntfs!NtfsFsdCleanup+0xcf
b2659c70 80583979 8a100930 00000038 8a2d2560 nt!IopfCallDriver+0x31
b2659ca0 805bca4e 89fb9b10 8a303020 00120196 nt!IopCloseFile+0x26b
b2659cd4 805bc377 89fb9b10 00000001 8a2d2560 nt!ObpDecrementHandleCount+0xd8
b2659cfc 805bc415 e1d4b398 8a100948 00000d74 nt!ObpCloseHandleTableEntry+0x14d
b2659d44 805bc54d 00000d74 00000001 00000000 nt!ObpCloseHandle+0x87
b2659d58 8054167c 00000d74 025efc04 7c90e514 nt!NtClose+0x1d
b2659d58 7c90e514 00000d74 025efc04 7c90e514 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
025efc04 00000000 00000000 00000000 00000000 0x7c90e514
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: Ntfs!NtfsCommonCleanup+2273
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 48025be5
STACK_COMMAND: .cxr 0xffffffffb2659478 ; kb
FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsCommonCleanup+2273
BUCKET_ID: 0x24_Ntfs!NtfsCommonCleanup+2273
Followup: MachineOwner
---------