none
CACHE_MANAGER Stop Error

    Question

  • Hello,

     

    I am new at attempting to resolve blue screens, but this is driving me crazy!  At all sorts of different random times, I get this stop error with several other numerical parameters.  I downloaded BlueScreenView, which indicates that the cause is Ntfs.sys and ntoskrnl.exe (the kernel + the system), so this is not very useful. In addition to the bug check code (0x0x00000034), Parameters are:

    Param 1: 00000000`00050830

    Param2: fffff880`033cc808

    Param3: fffff880`033cc070

    Param4: fffff800`03d6ddb4

    Ofcourse, in the original bsod the params appeared as hex values, 0x0000000000050830, etc ...

    I would be very happy to upload the minidump file that I have to anyone who might be able to help.

    Thanks in advance!

    Friday, September 17, 2010 8:12 PM

Answers

  •  It looks like this was due to an access violation, it might be worth
    checking memory with an extended test with Windows memory diagnostic or
    a longer test, >5 hrs, with memtest86+ (preferred) to see if any DIMMs
    are having problems,
     
     
    You may also want to do a chkdsk on each drive to see if any
    inconsistencies are found and perform a chkdsk /R on the drives to
    attempt to repair, but I would investigate it as a memory issue first
    above. Do you have any more dumps that you can upload to try to confirm
    it one way or another?
     
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
     
    Use !analyze -v to get detailed debugging information.
     
    BugCheck 34, {50830, fffff880033cc808, fffff880033cc070, fffff80003d6ddb4}
     
    Probably caused by : memory_corruption ( nt!MiSectionDelete+24 )
     
    Followup: MachineOwner
    ---------
     
    0: kd>  !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
     
    CACHE_MANAGER (34)
        See the comment for FAT_FILE_SYSTEM (0x23)
    Arguments:
    Arg1: 0000000000050830
    Arg2: fffff880033cc808
    Arg3: fffff880033cc070
    Arg4: fffff80003d6ddb4
     
    Debugging Details:
    ------------------
     EXCEPTION_RECORD:  fffff880033cc808 -- (.exr 0xfffff880033cc808)
    ExceptionAddress: fffff80003d6ddb4 (nt!MiSectionDelete+0x0000000000000024)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: ffffffffffffffff
    Attempt to read from address ffffffffffffffff
     
    CONTEXT:  fffff880033cc070 -- (.cxr 0xfffff880033cc070)
    rax=ffff0067006f006c rbx=0000000000000000 rcx=fffff8a010fd2b90
    rdx=fffffa8006c32000 rsi=0000000000000000 rdi=fffff8a010fd2b60
    rip=fffff80003d6ddb4 rsp=fffff880033cca40 rbp=0000000000000002
     r8=000000000000c828  r9=0000000000000310 r10=fffff80003a0c000
    r11=fffff880033ccab0 r12=0000000000000011 r13=0000000000000000
    r14=00000000ffffffff r15=0000000000000001
    iopl=0         nv up ei ng nz na po nc
    cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
    nt!MiSectionDelete+0x24:
    fffff800`03d6ddb4 488b18          mov     rbx,qword ptr [rax] ds:002b:ffff0067`006f006c=????????????????
    Resetting default scope
     
    CUSTOMER_CRASH_COUNT:  1
     
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
     
    PROCESS_NAME:  System
     
    CURRENT_IRQL:  0
     
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
     
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
     
    EXCEPTION_PARAMETER1:  0000000000000000
     
    EXCEPTION_PARAMETER2:  ffffffffffffffff
     
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003cb40e0
     ffffffffffffffff
     
    FOLLOWUP_IP:
    nt!MiSectionDelete+24
    fffff800`03d6ddb4 488b18          mov     rbx,qword ptr [rax]
     
    FAULTING_IP:
    nt!MiSectionDelete+24
    fffff800`03d6ddb4 488b18          mov     rbx,qword ptr [rax]
     
    BUGCHECK_STR:  0x34
     
    LAST_CONTROL_TRANSFER:  from fffff80003a818b4 to fffff80003d6ddb4
     
    STACK_TEXT:
    fffff880`033cca40 fffff800`03a818b4 : 00000000`00000000 00000000`00000002 fffffa80`06d30790 fffffa80`00000000 : nt!MiSectionDelete+0x24
    fffff880`033cca80 fffff800`03a6c2f0 : 00000000`00000002 fffffa80`0afb5630 00000000`00000000 00000000`00000000 : nt!ObfDereferenceObject+0xd4
    fffff880`033ccae0 fffff800`03a6fd1c : fffffa80`07002820 00000000`00000011 fffffa80`07002820 fffffa80`00000000 : nt!CcDeleteSharedCacheMap+0x1bc
    fffff880`033ccb50 fffff800`03a70520 : fffff800`03c83100 fffff880`033ccc58 00000000`00000000 fffffa80`00000000 : nt!CcWriteBehind+0x5bc
    fffff880`033ccc00 fffff800`03a89961 : fffffa80`06d213d0 fffff800`03a70358 fffff800`03c83140 fffffa80`00000003 : nt!CcWorkerThread+0x1c8
    fffff880`033cccb0 fffff800`03d20c06 : 00000000`00000000 fffffa80`06d22040 00000000`00000080 fffffa80`06d0e040 : nt!ExpWorkerThread+0x111
    fffff880`033ccd40 fffff800`03a5ac26 : fffff880`009ed180 fffffa80`06d22040 fffff880`009f7f40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
    fffff880`033ccd80 00000000`00000000 : fffff880`033cd000 fffff880`033c7000 fffff880`033cbc20 00000000`00000000 : nt!KxStartSystemThread+0x16
     SYMBOL_STACK_INDEX:  0
     
    SYMBOL_NAME:  nt!MiSectionDelete+24
     
    FOLLOWUP_NAME:  MachineOwner
     
    MODULE_NAME: nt
     
    DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9
     
    STACK_COMMAND:  .cxr 0xfffff880033cc070 ; kb
     
    IMAGE_NAME:  memory_corruption
     
    FAILURE_BUCKET_ID:  X64_0x34_nt!MiSectionDelete+24
     
    BUCKET_ID:  X64_0x34_nt!MiSectionDelete+24
     
    Followup: MachineOwner
    ---------
     
    0: kd>  .exr 0xfffff880033cc808
    ExceptionAddress: fffff80003d6ddb4 (nt!MiSectionDelete+0x0000000000000024)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: ffffffffffffffff
    Attempt to read from address ffffffffffffffff
     
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
     
    Use !analyze -v to get detailed debugging information.
     
    BugCheck 24, {1904fb, fffff8800a0b6868, fffff8800a0b60d0, fffff80003a84905}
     
    Unable to load image MpFilter.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for MpFilter.sys
    *** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys
    Probably caused by : Ntfs.sys ( Ntfs!NtfsRestartIndexEnumeration+271 )
     
    Followup: MachineOwner
    ---------
     
    0: kd>  !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
     
    NTFS_FILE_SYSTEM (24)
        If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
        parameters are the exception record and context record. Do a .cxr
        on the 3rd parameter and then kb to obtain a more informative stack
        trace.
    Arguments:
    Arg1: 00000000001904fb
    Arg2: fffff8800a0b6868
    Arg3: fffff8800a0b60d0
    Arg4: fffff80003a84905
     
    Debugging Details:
    ------------------
     EXCEPTION_RECORD:  fffff8800a0b6868 -- (.exr 0xfffff8800a0b6868)
    ExceptionAddress: fffff80003a84905 (nt!ExpInterlockedPopEntrySListFault16)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: ffffffffffffffff
    Attempt to read from address ffffffffffffffff
     
    CONTEXT:  fffff8800a0b60d0 -- (.cxr 0xfffff8800a0b60d0)
    rax=0000004da573005a rbx=fffff9800f3c04c8 rcx=fffff80003bfd600
    rdx=006e006f00430051 rsi=fffff80003bfd600 rdi=0000000000000011
    rip=fffff80003a84905 rsp=fffff8800a0b6aa0 rbp=fffffa8006c95000
     r8=006e006f00430050  r9=fffff80003a11000 r10=fffff80003bfd600
    r11=fffff8a0003aa000 r12=0000000000000009 r13=0000000000000000
    r14=0000000000000002 r15=000000004946744e
    iopl=0         nv up ei pl nz na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
    nt!ExpInterlockedPopEntrySListFault16:
    fffff800`03a84905 498b08          mov     rcx,qword ptr [r8] ds:002b:006e006f`00430050=????????????????
    Resetting default scope
     
    CUSTOMER_CRASH_COUNT:  1
     
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
     
    PROCESS_NAME:  MsMpEng.exe
     
    CURRENT_IRQL:  0
     
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
     
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
     
    EXCEPTION_PARAMETER1:  0000000000000000
     
    EXCEPTION_PARAMETER2:  ffffffffffffffff
     
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003cb90e0
     ffffffffffffffff
     
    FOLLOWUP_IP:
    Ntfs!NtfsRestartIndexEnumeration+271
    fffff880`014cfbd1 4989842498000000 mov     qword ptr [r12+98h],rax
     
    FAULTING_IP:
    nt!ExpInterlockedPopEntrySListFault16+0
    fffff800`03a84905 498b08          mov     rcx,qword ptr [r8]
     
    BUGCHECK_STR:  0x24
     
    LAST_CONTROL_TRANSFER:  from fffff80003bb5646 to fffff80003a84905
     
    STACK_TEXT:
    fffff880`0a0b6aa0 fffff800`03bb5646 : fffffa80`06d166b0 fffffa80`0d564060 00000000`00100010 fffff980`0f3c051a : nt!ExpInterlockedPopEntrySListFault16
    fffff880`0a0b6ab0 fffff880`014cfbd1 : fffff8a0`01cea500 fffff980`0f3c04c8 fffff8a0`1536e4f0 fffff8a0`01cea501 : nt!ExAllocatePoolWithTag+0x276
    fffff880`0a0b6ba0 fffff880`014ccdfe : fffffa80`0cb76420 fffff8a0`05b52e10 fffff8a0`05b52bc0 fffffa80`0cb76420 : Ntfs!NtfsRestartIndexEnumeration+0x271
    fffff880`0a0b6dc0 fffff880`014ce421 : fffff880`0a0b72d0 00000000`00000008 fffffa80`07dcf6d0 fffffa80`0bc23010 : Ntfs!NtfsQueryDirectory+0x94e
    fffff880`0a0b7160 fffff880`014d078f : fffffa80`0cb76420 00000000`00000000 fffff880`0a0b7260 00000000`00000000 : Ntfs!NtfsCommonDirectoryControl+0xa1
    fffff880`0a0b71a0 fffff880`0136b23f : fffffa80`0bc236c8 fffffa80`0bc23010 fffffa80`0cb76420 fffff880`0a0b71c8 : Ntfs!NtfsFsdDirectoryControl+0x10f
    fffff880`0a0b7210 fffff880`0136d94a : 00000000`00000000 00000000`00000000 fffffa80`099c6000 fffffa80`0c84eb70 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
    fffff880`0a0b72a0 fffff880`0138cdb8 : fffffa80`07e51430 00000000`00000022 fffffa80`07dda800 fffffa80`0c84ec20 : fltmgr!FltPerformSynchronousIo+0x2ca
    fffff880`0a0b7340 fffff880`0635ad71 : 00000000`00000000 00000000`00000020 fffff880`0a0b7400 fffff880`0a0b7490 : fltmgr!FltQueryDirectoryFile+0x98
    fffff880`0a0b7380 fffff880`0138cd02 : 00000000`0000004e fffffa80`0afa6550 fffffa80`0cd7a070 00000000`00000017 : luafv!LuafvNormalizeNameComponentEx+0x145
    fffff880`0a0b7480 fffff880`0138c01e : 00000000`00000017 00000000`00000057 fffffa80`0afa6550 00000000`000007ff : fltmgr!FltpCallNormalizeNameComponentHandler+0x82
    fffff880`0a0b74e0 fffff880`0138d361 : 00000000`00000057 00000000`00000080 00000000`0000004f 00000000`00000000 : fltmgr!FltpExpandShortNames+0x14e
    fffff880`0a0b7540 fffff880`0138d13e : fffffa80`0afa6550 fffffa80`099c0000 00000000`00000000 fffffa80`0bc11201 : fltmgr!FltpGetNormalizedFileNameWorker+0xc1
    fffff880`0a0b7580 fffff880`0136e54b : fffffa80`07dda800 fffffa80`0e01fa50 fffffa80`07737000 fffff880`0a0b8000 : fltmgr!FltpCreateFileNameInformation+0xee
    fffff880`0a0b75e0 fffff880`0138b5ef : 00000000`00008000 fffffa80`0e01fa50 fffffa80`099c6010 fffff8a0`1a0bb488 : fltmgr!FltpGetFileNameInformation+0x26b
    fffff880`0a0b7660 fffff880`0411c278 : fffffa80`0afa6550 00000000`00000000 00000000`00000101 00000000`00000000 : fltmgr!FltGetFileNameInformationUnsafe+0x7f
    fffff880`0a0b76d0 fffffa80`0afa6550 : 00000000`00000000 00000000`00000101 00000000`00000000 00000000`00000000 : MpFilter+0xb278
    fffff880`0a0b76d8 00000000`00000000 : 00000000`00000101 00000000`00000000 00000000`00000000 00000000`00000001 : 0xfffffa80`0afa6550
     SYMBOL_STACK_INDEX:  2
     
    SYMBOL_NAME:  Ntfs!NtfsRestartIndexEnumeration+271
     
    FOLLOWUP_NAME:  MachineOwner
     
    MODULE_NAME: Ntfs
     
    IMAGE_NAME:  Ntfs.sys
     
    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f
     
    STACK_COMMAND:  .cxr 0xfffff8800a0b60d0 ; kb
     
    FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsRestartIndexEnumeration+271
     
    BUCKET_ID:  X64_0x24_Ntfs!NtfsRestartIndexEnumeration+271
     
    Followup: MachineOwner
    ---------
     
    0: kd>  .exr 0xfffff8800a0b6868
    ExceptionAddress: fffff80003a84905 (nt!ExpInterlockedPopEntrySListFault16)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: ffffffffffffffff
    Attempt to read from address ffffffffffffffff
    0: kd>  .cxr 0xfffff8800a0b60d0
    rax=0000004da573005a rbx=fffff9800f3c04c8 rcx=fffff80003bfd600
    rdx=006e006f00430051 rsi=fffff80003bfd600 rdi=0000000000000011
    rip=fffff80003a84905 rsp=fffff8800a0b6aa0 rbp=fffffa8006c95000
     r8=006e006f00430050  r9=fffff80003a11000 r10=fffff80003bfd600
    r11=fffff8a0003aa000 r12=0000000000000009 r13=0000000000000000
    r14=0000000000000002 r15=000000004946744e
    iopl=0         nv up ei pl nz na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
    nt!ExpInterlockedPopEntrySListFault16:
    fffff800`03a84905 498b08          mov     rcx,qword ptr [r8] ds:002b:006e006f`00430050=????????????????
    0: kd>  kb 1000
    RetAddr           : Args to Child                                                           : Call Site
    fffff800`03bb5646 : fffffa80`06d166b0 fffffa80`0d564060 00000000`00100010 fffff980`0f3c051a : nt!ExpInterlockedPopEntrySListFault16
    fffff880`014cfbd1 : fffff8a0`01cea500 fffff980`0f3c04c8 fffff8a0`1536e4f0 fffff8a0`01cea501 : nt!ExAllocatePoolWithTag+0x276
    fffff880`014ccdfe : fffffa80`0cb76420 fffff8a0`05b52e10 fffff8a0`05b52bc0 fffffa80`0cb76420 : Ntfs!NtfsRestartIndexEnumeration+0x271
    fffff880`014ce421 : fffff880`0a0b72d0 00000000`00000008 fffffa80`07dcf6d0 fffffa80`0bc23010 : Ntfs!NtfsQueryDirectory+0x94e
    fffff880`014d078f : fffffa80`0cb76420 00000000`00000000 fffff880`0a0b7260 00000000`00000000 : Ntfs!NtfsCommonDirectoryControl+0xa1
    fffff880`0136b23f : fffffa80`0bc236c8 fffffa80`0bc23010 fffffa80`0cb76420 fffff880`0a0b71c8 : Ntfs!NtfsFsdDirectoryControl+0x10f
    fffff880`0136d94a : 00000000`00000000 00000000`00000000 fffffa80`099c6000 fffffa80`0c84eb70 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
    fffff880`0138cdb8 : fffffa80`07e51430 00000000`00000022 fffffa80`07dda800 fffffa80`0c84ec20 : fltmgr!FltPerformSynchronousIo+0x2ca
    fffff880`0635ad71 : 00000000`00000000 00000000`00000020 fffff880`0a0b7400 fffff880`0a0b7490 : fltmgr!FltQueryDirectoryFile+0x98
    fffff880`0138cd02 : 00000000`0000004e fffffa80`0afa6550 fffffa80`0cd7a070 00000000`00000017 : luafv!LuafvNormalizeNameComponentEx+0x145
    fffff880`0138c01e : 00000000`00000017 00000000`00000057 fffffa80`0afa6550 00000000`000007ff : fltmgr!FltpCallNormalizeNameComponentHandler+0x82
    fffff880`0138d361 : 00000000`00000057 00000000`00000080 00000000`0000004f 00000000`00000000 : fltmgr!FltpExpandShortNames+0x14e
    fffff880`0138d13e : fffffa80`0afa6550 fffffa80`099c0000 00000000`00000000 fffffa80`0bc11201 : fltmgr!FltpGetNormalizedFileNameWorker+0xc1
    fffff880`0136e54b : fffffa80`07dda800 fffffa80`0e01fa50 fffffa80`07737000 fffff880`0a0b8000 : fltmgr!FltpCreateFileNameInformation+0xee
    fffff880`0138b5ef : 00000000`00008000 fffffa80`0e01fa50 fffffa80`099c6010 fffff8a0`1a0bb488 : fltmgr!FltpGetFileNameInformation+0x26b
    fffff880`0411c278 : fffffa80`0afa6550 00000000`00000000 00000000`00000101 00000000`00000000 : fltmgr!FltGetFileNameInformationUnsafe+0x7f
    fffffa80`0afa6550 : 00000000`00000000 00000000`00000101 00000000`00000000 00000000`00000000 : MpFilter+0xb278
    00000000`00000000 : 00000000`00000101 00000000`00000000 00000000`00000000 00000000`00000001 : 0xfffffa80`0afa6550
     

    -- Mike Burr
    Sunday, September 19, 2010 12:41 PM

All replies

  • Bug Check 0x34: CACHE_MANAGER

    This indicates that a problem occurred in the file system's cache manager.


    Please copy the dmp files from the folder C:\Windows\Minidump first to your desktop, zip all dmp into 1 zip file and upload the zip file to your Skydrive [1] and post a link here, so that I can look at the dumps.

    André

    [1] http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, September 17, 2010 10:01 PM
  • Hi Andre,

    I uploaded the minidump, which is here: http://cid-11ac254488e21108.office.live.com/self.aspx/MiniDump/091710-15319-01.zip

    For what is may be worth, the Bugcheck code and Param values are below.  I have been sufferring many many BSODs over the past few weeks, and they are not always the CACHE_MANAGER 0x34 flavor.  I rebuilt the entire Windows7 image and re-loaded all software. I am a software engineer and the software on the box is limited to standard fare dev stuff (Visual Studio, SQL-Server, Office, Forefront).  I added ShadowProtect recently, but did this after the Bluescreens started because I wanted to make sure that I had good backup images (and this has now saved me many times b/c after some of these BSOD's the system is no longer bootable). 

    The BSODs have calmed down but not gone away, and the last 2 have been exactly this CACHE_MANAGER flavor. 

    Yesterday, I completely rebuilt my master boot record.  Today, I found and installed the latest and greatest video driver and chipset driver (disk controller), and thought that the problem was over, but after a few hours this last BSOD happened. 

    I'm thinking it might be memory related and have ordered new RAM, but if you find that it is probably something else then I can cancel or return the order. 

    Finally, I'll mention that I can create a BSOD at will simply by uninstalling any application with Forefront 2010 running.  However, if I stop Forefront's real-time protection then I can successfully uninstall anything and there is no BSOD.  Unfortunately, not running Forefront is not an option for me as my employer requires it.  

    Thanks in advance!

    BugcheckCode 0x34
    BugcheckParameter1 0x50830
    BugcheckParameter2 0xfffff880033cc808
    BugcheckParameter3 0xfffff880033cc070
    BugcheckParameter4 0xfffff80003d6ddb4

    Saturday, September 18, 2010 1:20 AM
  • Hello Again Andre,

     

    In addition to http://cid-11ac254488e21108.office.live.com/self.aspx/MiniDump/091710-15319-01.zip (which contains the 0x34 stop), please also see http://cid-11ac254488e21108.office.live.com/self.aspx/MiniDump/091710-33321-01.zip.  This is a 0x24 stop error that I can produce at will simply by uninstalling almost anything.  I can work-around it by disabling my anti-virus software (MSFT Forefront 2010).

    Saturday, September 18, 2010 3:46 AM
  •  It looks like this was due to an access violation, it might be worth
    checking memory with an extended test with Windows memory diagnostic or
    a longer test, >5 hrs, with memtest86+ (preferred) to see if any DIMMs
    are having problems,
     
     
    You may also want to do a chkdsk on each drive to see if any
    inconsistencies are found and perform a chkdsk /R on the drives to
    attempt to repair, but I would investigate it as a memory issue first
    above. Do you have any more dumps that you can upload to try to confirm
    it one way or another?
     
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
     
    Use !analyze -v to get detailed debugging information.
     
    BugCheck 34, {50830, fffff880033cc808, fffff880033cc070, fffff80003d6ddb4}
     
    Probably caused by : memory_corruption ( nt!MiSectionDelete+24 )
     
    Followup: MachineOwner
    ---------
     
    0: kd>  !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
     
    CACHE_MANAGER (34)
        See the comment for FAT_FILE_SYSTEM (0x23)
    Arguments:
    Arg1: 0000000000050830
    Arg2: fffff880033cc808
    Arg3: fffff880033cc070
    Arg4: fffff80003d6ddb4
     
    Debugging Details:
    ------------------
     EXCEPTION_RECORD:  fffff880033cc808 -- (.exr 0xfffff880033cc808)
    ExceptionAddress: fffff80003d6ddb4 (nt!MiSectionDelete+0x0000000000000024)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: ffffffffffffffff
    Attempt to read from address ffffffffffffffff
     
    CONTEXT:  fffff880033cc070 -- (.cxr 0xfffff880033cc070)
    rax=ffff0067006f006c rbx=0000000000000000 rcx=fffff8a010fd2b90
    rdx=fffffa8006c32000 rsi=0000000000000000 rdi=fffff8a010fd2b60
    rip=fffff80003d6ddb4 rsp=fffff880033cca40 rbp=0000000000000002
     r8=000000000000c828  r9=0000000000000310 r10=fffff80003a0c000
    r11=fffff880033ccab0 r12=0000000000000011 r13=0000000000000000
    r14=00000000ffffffff r15=0000000000000001
    iopl=0         nv up ei ng nz na po nc
    cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
    nt!MiSectionDelete+0x24:
    fffff800`03d6ddb4 488b18          mov     rbx,qword ptr [rax] ds:002b:ffff0067`006f006c=????????????????
    Resetting default scope
     
    CUSTOMER_CRASH_COUNT:  1
     
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
     
    PROCESS_NAME:  System
     
    CURRENT_IRQL:  0
     
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
     
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
     
    EXCEPTION_PARAMETER1:  0000000000000000
     
    EXCEPTION_PARAMETER2:  ffffffffffffffff
     
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003cb40e0
     ffffffffffffffff
     
    FOLLOWUP_IP:
    nt!MiSectionDelete+24
    fffff800`03d6ddb4 488b18          mov     rbx,qword ptr [rax]
     
    FAULTING_IP:
    nt!MiSectionDelete+24
    fffff800`03d6ddb4 488b18          mov     rbx,qword ptr [rax]
     
    BUGCHECK_STR:  0x34
     
    LAST_CONTROL_TRANSFER:  from fffff80003a818b4 to fffff80003d6ddb4
     
    STACK_TEXT:
    fffff880`033cca40 fffff800`03a818b4 : 00000000`00000000 00000000`00000002 fffffa80`06d30790 fffffa80`00000000 : nt!MiSectionDelete+0x24
    fffff880`033cca80 fffff800`03a6c2f0 : 00000000`00000002 fffffa80`0afb5630 00000000`00000000 00000000`00000000 : nt!ObfDereferenceObject+0xd4
    fffff880`033ccae0 fffff800`03a6fd1c : fffffa80`07002820 00000000`00000011 fffffa80`07002820 fffffa80`00000000 : nt!CcDeleteSharedCacheMap+0x1bc
    fffff880`033ccb50 fffff800`03a70520 : fffff800`03c83100 fffff880`033ccc58 00000000`00000000 fffffa80`00000000 : nt!CcWriteBehind+0x5bc
    fffff880`033ccc00 fffff800`03a89961 : fffffa80`06d213d0 fffff800`03a70358 fffff800`03c83140 fffffa80`00000003 : nt!CcWorkerThread+0x1c8
    fffff880`033cccb0 fffff800`03d20c06 : 00000000`00000000 fffffa80`06d22040 00000000`00000080 fffffa80`06d0e040 : nt!ExpWorkerThread+0x111
    fffff880`033ccd40 fffff800`03a5ac26 : fffff880`009ed180 fffffa80`06d22040 fffff880`009f7f40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
    fffff880`033ccd80 00000000`00000000 : fffff880`033cd000 fffff880`033c7000 fffff880`033cbc20 00000000`00000000 : nt!KxStartSystemThread+0x16
     SYMBOL_STACK_INDEX:  0
     
    SYMBOL_NAME:  nt!MiSectionDelete+24
     
    FOLLOWUP_NAME:  MachineOwner
     
    MODULE_NAME: nt
     
    DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9
     
    STACK_COMMAND:  .cxr 0xfffff880033cc070 ; kb
     
    IMAGE_NAME:  memory_corruption
     
    FAILURE_BUCKET_ID:  X64_0x34_nt!MiSectionDelete+24
     
    BUCKET_ID:  X64_0x34_nt!MiSectionDelete+24
     
    Followup: MachineOwner
    ---------
     
    0: kd>  .exr 0xfffff880033cc808
    ExceptionAddress: fffff80003d6ddb4 (nt!MiSectionDelete+0x0000000000000024)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: ffffffffffffffff
    Attempt to read from address ffffffffffffffff
     
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
     
    Use !analyze -v to get detailed debugging information.
     
    BugCheck 24, {1904fb, fffff8800a0b6868, fffff8800a0b60d0, fffff80003a84905}
     
    Unable to load image MpFilter.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for MpFilter.sys
    *** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys
    Probably caused by : Ntfs.sys ( Ntfs!NtfsRestartIndexEnumeration+271 )
     
    Followup: MachineOwner
    ---------
     
    0: kd>  !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
     
    NTFS_FILE_SYSTEM (24)
        If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
        parameters are the exception record and context record. Do a .cxr
        on the 3rd parameter and then kb to obtain a more informative stack
        trace.
    Arguments:
    Arg1: 00000000001904fb
    Arg2: fffff8800a0b6868
    Arg3: fffff8800a0b60d0
    Arg4: fffff80003a84905
     
    Debugging Details:
    ------------------
     EXCEPTION_RECORD:  fffff8800a0b6868 -- (.exr 0xfffff8800a0b6868)
    ExceptionAddress: fffff80003a84905 (nt!ExpInterlockedPopEntrySListFault16)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: ffffffffffffffff
    Attempt to read from address ffffffffffffffff
     
    CONTEXT:  fffff8800a0b60d0 -- (.cxr 0xfffff8800a0b60d0)
    rax=0000004da573005a rbx=fffff9800f3c04c8 rcx=fffff80003bfd600
    rdx=006e006f00430051 rsi=fffff80003bfd600 rdi=0000000000000011
    rip=fffff80003a84905 rsp=fffff8800a0b6aa0 rbp=fffffa8006c95000
     r8=006e006f00430050  r9=fffff80003a11000 r10=fffff80003bfd600
    r11=fffff8a0003aa000 r12=0000000000000009 r13=0000000000000000
    r14=0000000000000002 r15=000000004946744e
    iopl=0         nv up ei pl nz na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
    nt!ExpInterlockedPopEntrySListFault16:
    fffff800`03a84905 498b08          mov     rcx,qword ptr [r8] ds:002b:006e006f`00430050=????????????????
    Resetting default scope
     
    CUSTOMER_CRASH_COUNT:  1
     
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
     
    PROCESS_NAME:  MsMpEng.exe
     
    CURRENT_IRQL:  0
     
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
     
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
     
    EXCEPTION_PARAMETER1:  0000000000000000
     
    EXCEPTION_PARAMETER2:  ffffffffffffffff
     
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003cb90e0
     ffffffffffffffff
     
    FOLLOWUP_IP:
    Ntfs!NtfsRestartIndexEnumeration+271
    fffff880`014cfbd1 4989842498000000 mov     qword ptr [r12+98h],rax
     
    FAULTING_IP:
    nt!ExpInterlockedPopEntrySListFault16+0
    fffff800`03a84905 498b08          mov     rcx,qword ptr [r8]
     
    BUGCHECK_STR:  0x24
     
    LAST_CONTROL_TRANSFER:  from fffff80003bb5646 to fffff80003a84905
     
    STACK_TEXT:
    fffff880`0a0b6aa0 fffff800`03bb5646 : fffffa80`06d166b0 fffffa80`0d564060 00000000`00100010 fffff980`0f3c051a : nt!ExpInterlockedPopEntrySListFault16
    fffff880`0a0b6ab0 fffff880`014cfbd1 : fffff8a0`01cea500 fffff980`0f3c04c8 fffff8a0`1536e4f0 fffff8a0`01cea501 : nt!ExAllocatePoolWithTag+0x276
    fffff880`0a0b6ba0 fffff880`014ccdfe : fffffa80`0cb76420 fffff8a0`05b52e10 fffff8a0`05b52bc0 fffffa80`0cb76420 : Ntfs!NtfsRestartIndexEnumeration+0x271
    fffff880`0a0b6dc0 fffff880`014ce421 : fffff880`0a0b72d0 00000000`00000008 fffffa80`07dcf6d0 fffffa80`0bc23010 : Ntfs!NtfsQueryDirectory+0x94e
    fffff880`0a0b7160 fffff880`014d078f : fffffa80`0cb76420 00000000`00000000 fffff880`0a0b7260 00000000`00000000 : Ntfs!NtfsCommonDirectoryControl+0xa1
    fffff880`0a0b71a0 fffff880`0136b23f : fffffa80`0bc236c8 fffffa80`0bc23010 fffffa80`0cb76420 fffff880`0a0b71c8 : Ntfs!NtfsFsdDirectoryControl+0x10f
    fffff880`0a0b7210 fffff880`0136d94a : 00000000`00000000 00000000`00000000 fffffa80`099c6000 fffffa80`0c84eb70 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
    fffff880`0a0b72a0 fffff880`0138cdb8 : fffffa80`07e51430 00000000`00000022 fffffa80`07dda800 fffffa80`0c84ec20 : fltmgr!FltPerformSynchronousIo+0x2ca
    fffff880`0a0b7340 fffff880`0635ad71 : 00000000`00000000 00000000`00000020 fffff880`0a0b7400 fffff880`0a0b7490 : fltmgr!FltQueryDirectoryFile+0x98
    fffff880`0a0b7380 fffff880`0138cd02 : 00000000`0000004e fffffa80`0afa6550 fffffa80`0cd7a070 00000000`00000017 : luafv!LuafvNormalizeNameComponentEx+0x145
    fffff880`0a0b7480 fffff880`0138c01e : 00000000`00000017 00000000`00000057 fffffa80`0afa6550 00000000`000007ff : fltmgr!FltpCallNormalizeNameComponentHandler+0x82
    fffff880`0a0b74e0 fffff880`0138d361 : 00000000`00000057 00000000`00000080 00000000`0000004f 00000000`00000000 : fltmgr!FltpExpandShortNames+0x14e
    fffff880`0a0b7540 fffff880`0138d13e : fffffa80`0afa6550 fffffa80`099c0000 00000000`00000000 fffffa80`0bc11201 : fltmgr!FltpGetNormalizedFileNameWorker+0xc1
    fffff880`0a0b7580 fffff880`0136e54b : fffffa80`07dda800 fffffa80`0e01fa50 fffffa80`07737000 fffff880`0a0b8000 : fltmgr!FltpCreateFileNameInformation+0xee
    fffff880`0a0b75e0 fffff880`0138b5ef : 00000000`00008000 fffffa80`0e01fa50 fffffa80`099c6010 fffff8a0`1a0bb488 : fltmgr!FltpGetFileNameInformation+0x26b
    fffff880`0a0b7660 fffff880`0411c278 : fffffa80`0afa6550 00000000`00000000 00000000`00000101 00000000`00000000 : fltmgr!FltGetFileNameInformationUnsafe+0x7f
    fffff880`0a0b76d0 fffffa80`0afa6550 : 00000000`00000000 00000000`00000101 00000000`00000000 00000000`00000000 : MpFilter+0xb278
    fffff880`0a0b76d8 00000000`00000000 : 00000000`00000101 00000000`00000000 00000000`00000000 00000000`00000001 : 0xfffffa80`0afa6550
     SYMBOL_STACK_INDEX:  2
     
    SYMBOL_NAME:  Ntfs!NtfsRestartIndexEnumeration+271
     
    FOLLOWUP_NAME:  MachineOwner
     
    MODULE_NAME: Ntfs
     
    IMAGE_NAME:  Ntfs.sys
     
    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f
     
    STACK_COMMAND:  .cxr 0xfffff8800a0b60d0 ; kb
     
    FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsRestartIndexEnumeration+271
     
    BUCKET_ID:  X64_0x24_Ntfs!NtfsRestartIndexEnumeration+271
     
    Followup: MachineOwner
    ---------
     
    0: kd>  .exr 0xfffff8800a0b6868
    ExceptionAddress: fffff80003a84905 (nt!ExpInterlockedPopEntrySListFault16)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: ffffffffffffffff
    Attempt to read from address ffffffffffffffff
    0: kd>  .cxr 0xfffff8800a0b60d0
    rax=0000004da573005a rbx=fffff9800f3c04c8 rcx=fffff80003bfd600
    rdx=006e006f00430051 rsi=fffff80003bfd600 rdi=0000000000000011
    rip=fffff80003a84905 rsp=fffff8800a0b6aa0 rbp=fffffa8006c95000
     r8=006e006f00430050  r9=fffff80003a11000 r10=fffff80003bfd600
    r11=fffff8a0003aa000 r12=0000000000000009 r13=0000000000000000
    r14=0000000000000002 r15=000000004946744e
    iopl=0         nv up ei pl nz na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
    nt!ExpInterlockedPopEntrySListFault16:
    fffff800`03a84905 498b08          mov     rcx,qword ptr [r8] ds:002b:006e006f`00430050=????????????????
    0: kd>  kb 1000
    RetAddr           : Args to Child                                                           : Call Site
    fffff800`03bb5646 : fffffa80`06d166b0 fffffa80`0d564060 00000000`00100010 fffff980`0f3c051a : nt!ExpInterlockedPopEntrySListFault16
    fffff880`014cfbd1 : fffff8a0`01cea500 fffff980`0f3c04c8 fffff8a0`1536e4f0 fffff8a0`01cea501 : nt!ExAllocatePoolWithTag+0x276
    fffff880`014ccdfe : fffffa80`0cb76420 fffff8a0`05b52e10 fffff8a0`05b52bc0 fffffa80`0cb76420 : Ntfs!NtfsRestartIndexEnumeration+0x271
    fffff880`014ce421 : fffff880`0a0b72d0 00000000`00000008 fffffa80`07dcf6d0 fffffa80`0bc23010 : Ntfs!NtfsQueryDirectory+0x94e
    fffff880`014d078f : fffffa80`0cb76420 00000000`00000000 fffff880`0a0b7260 00000000`00000000 : Ntfs!NtfsCommonDirectoryControl+0xa1
    fffff880`0136b23f : fffffa80`0bc236c8 fffffa80`0bc23010 fffffa80`0cb76420 fffff880`0a0b71c8 : Ntfs!NtfsFsdDirectoryControl+0x10f
    fffff880`0136d94a : 00000000`00000000 00000000`00000000 fffffa80`099c6000 fffffa80`0c84eb70 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
    fffff880`0138cdb8 : fffffa80`07e51430 00000000`00000022 fffffa80`07dda800 fffffa80`0c84ec20 : fltmgr!FltPerformSynchronousIo+0x2ca
    fffff880`0635ad71 : 00000000`00000000 00000000`00000020 fffff880`0a0b7400 fffff880`0a0b7490 : fltmgr!FltQueryDirectoryFile+0x98
    fffff880`0138cd02 : 00000000`0000004e fffffa80`0afa6550 fffffa80`0cd7a070 00000000`00000017 : luafv!LuafvNormalizeNameComponentEx+0x145
    fffff880`0138c01e : 00000000`00000017 00000000`00000057 fffffa80`0afa6550 00000000`000007ff : fltmgr!FltpCallNormalizeNameComponentHandler+0x82
    fffff880`0138d361 : 00000000`00000057 00000000`00000080 00000000`0000004f 00000000`00000000 : fltmgr!FltpExpandShortNames+0x14e
    fffff880`0138d13e : fffffa80`0afa6550 fffffa80`099c0000 00000000`00000000 fffffa80`0bc11201 : fltmgr!FltpGetNormalizedFileNameWorker+0xc1
    fffff880`0136e54b : fffffa80`07dda800 fffffa80`0e01fa50 fffffa80`07737000 fffff880`0a0b8000 : fltmgr!FltpCreateFileNameInformation+0xee
    fffff880`0138b5ef : 00000000`00008000 fffffa80`0e01fa50 fffffa80`099c6010 fffff8a0`1a0bb488 : fltmgr!FltpGetFileNameInformation+0x26b
    fffff880`0411c278 : fffffa80`0afa6550 00000000`00000000 00000000`00000101 00000000`00000000 : fltmgr!FltGetFileNameInformationUnsafe+0x7f
    fffffa80`0afa6550 : 00000000`00000000 00000000`00000101 00000000`00000000 00000000`00000000 : MpFilter+0xb278
    00000000`00000000 : 00000000`00000101 00000000`00000000 00000000`00000000 00000000`00000001 : 0xfffffa80`0afa6550
     

    -- Mike Burr
    Sunday, September 19, 2010 12:41 PM