BSOD: Stop: 0x00000024 from ntfs.sys with Norton Ghost

[DocBrown]

I am attempting to create a Custom Recovery Boot Disk using Norton Ghost
12.0. It gets to the place where it says it is copying drivers. Then the
system fails with BSOD with the following info:

Stop: 0x00000024 (0x001902FE, 0xECD0A3CC, 0xECD0A0C8, 0xF842A7B6)

NTFS.SYS - Address: F842A7B6 base at F842A000, Datestamp 41107eea

This is repeatable and it also occurs when I try and create the same using
Genie Backup Manager Home 8.0. So I think something is corrupted on my system.

My system is:
Asus P4P800-E Deluxe MB.
Disk 1 (was): Maxtor 200GB DiamondMax Plus 9
Disk 2: WDC 200GB
Disk 3: Maxtor 500GB OneTouch Firewire connection
Display Adapter: RADEON 9800 Pro

Disk 1 is now WDC WD5000AAJB 500GB

My system was originally built from Win XP Update CD with SP1. (Previous OS,
Win ME, was never installed on this system.)

Windows XP Home w/ SP2 updated.
All latest Win updates have been applied (except IE7)

This is the first time I've tried to create a recovery disk. But I have
recently upgraded from Norton Ghost 9.0. I doubt the upgrade is a factor.

I started to try and create a recovery disk because I was getting
indications that my disk was starting to have problems. (I know should have
had it before now....) Trying to create a NG backup, Ghost started failing
with bad CRC check on blocks. Ran the Maxtor diags and it said my disk was
failing. So I replaced it with the 500 GB WDC and recovered from my last
successful Ghost backup. (no guarentee all is was exactly ok with the backup.
Corruption may have been present for unknown time.)

Here's what I've done.

Contacted Norton, They say something is wrong with MB. Ran diags, NTF.
Executed MSKB article 822800 to replace ntfs.sys from original CD.

Disabled all services and startups except essentials.

Downloaded SP2 full file and re-installed XP2.

Is there a way to re-install XP to insure all win files are ok? When I try
to install from my Update CD, setup says the OS on the disk is newer and
exits. I hope I don't have to do a full re-install of my OS and apps.

Any help would be appreciated.

 

[DocBrown]

When the Stop first happened, I ran chkdsk /r to try and fix errors. Errors
were found and fixed. But the STOP still occured when I ran NG.
Other info:
- No yellow question marks in Device Mgr.
- RAM: 512MB

From Event Viewer:
-------------
Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 1/4/2008
Time: 8:44:28 PM
User: N/A
Computer: JOHN1252
Description:
Error code 00000024, parameter1 001902fe, parameter2 ecb613cc, parameter3
ecb610c8, parameter4 f842a7b6.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 30 30 30 30 30 30 32 0000002
0020: 34 20 20 50 61 72 61 6d 4 Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 31 39 30 32 66 65 2c 20 1902fe,
0038: 65 63 62 36 31 33 63 63 ecb613cc
0040: 2c 20 65 63 62 36 31 30 , ecb610
0048: 63 38 2c 20 66 38 34 32 c8, f842
0050: 61 37 62 36 a7b6
--------------------
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 1/4/2008
Time: 8:44:02 PM
User: N/A
Computer: JOHN1252
Description:
The following boot-start or system-start driver(s) failed to load:
kl1
SYMTDI

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
------------------------
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 1/4/2008
Time: 8:44:02 PM
User: N/A
Computer: JOHN1252
Description:
The mrtRate service failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

 

[Gerry]

Doc

Event ID: 7000
The mrtRate service failed to start due to the following error:

The system cannot find the file specified.

You may need to update Quicken driver?

Event ID: 7026
The following boot-start or system-start driver(s) failed to load:

kl1
SYMTDI

This is probably referring to symtdi.sys, which is a Norton Anti-Virus
driver. Logical response is to uninstall and reininstall Norton. Good
luck <G>.

Stop: 0x00000024 (0x001902FE, 0xECD0A3CC, 0xECD0A0C8, 0xF842A7B6)
NTFS.SYS - Address: F842A7B6 base at F842A000, Datestamp 41107eea

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793935.aspx

0x00000024: NTFS_FILE_SYSTEM
A problem occurred within NTFS.SYS, the driver file that allows the
system to read and write to NTFS file system drives. There may be a
physical problem with the disk, or an Interrupt Request Packet (IRP) may
be corrupted. Other common causes include heavy hard drive
fragmentation, heavy file I/O, problems with some types of
drive-mirroring software, or some antivirus software. I suggest running
ChkDsk or ScanDisk as a first step; then disable all file system filters
such as virus scanners, firewall software, or backup utilities. Check
the file properties of NTFS.SYS to ensure it matches the current OS or
SP version. Update all disk, tape backup, CD-ROM, or removable device
drivers to the most current versions.
Source: http://aumha.org/a/stop.htm

The suggested commammand is chkdsk /f /r NOT chkdsk /r.

I would clear the earlier errors before tackling the Stop Error messages
as they could be contributing towards the Stop Error message.

You might also try HD Tune(freeware) as you can see the SMART
information relating to the drive etc.

Download and run it and see what it turns up.
http://www.hdtune.com/

Select the Info tabs and place the cursor on the drive under Drive
letter and then double click the two page icon ( copy to Clipboard )
and copy into a further message.

Select the Health tab and then double click the two page icon ( copy to
Clipboard ) and copy into a further message. Make sure you do a full
surface scan with HD Tune.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[DocBrown]

Gerry,

Thanks for the help. I used the autoruns.exe and I found the entries that
were causing the errors. I've corrected them as I describe below.

Boot is now completely clean with no logged errors or warnings.

I've also included the logs from HD Tune. But be aware that this is a new
disk I Just finished recovering to. My original disk was definitely having
errors. I used a Norton Ghost recovery image to recover to the new disk. The
image creation was ok so am I safe to say that the disk failures didn't
corrupt the image? There is, of course, something else that was (still is)
not straight with the OS.

Any further suggestions?

John

Event ID: 7000
The mrtRate service failed to start due to the following error:

You may need to update Quicken driver?

Found and corrected that error. It was from:

HKEY_LOCAL_MACHINE\SOFTWARE\ATI Technologies\CDS\Device\0
DeviceItem0071 REG_SZ [Non-Plug and Play Drivers] -> [mrtRate] (0x00000000)

That's my display adapter driver. File doesn't exist, so I disabled the
service. I'm going reinstall that portion of my display adapter.

Event ID: 7026
The following boot-start or system-start driver(s) failed to load:

This is probably referring to symtdi.sys, which is a Norton Anti-Virus
driver. Logical response is to uninstall and reininstall Norton. Good
luck <G>.

I had uninstalled Norton AV and only Norton/symantec products on system are
Ghost and LiveUpdate. I deleted these entries from the Registry.

Stop: 0x00000024 (0x001902FE, 0xECD0A3CC, 0xECD0A0C8, 0xF842A7B6)
NTFS.SYS - Address: F842A7B6 base at F842A000, Datestamp 41107eea

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793935.aspx

0x00000024: NTFS_FILE_SYSTEM [snipped]
The suggested commammand is chkdsk /f /r NOT chkdsk /r.

Done... Found some errors (see below). The disk is new so will complete a
scan later today. Disk fragmetation is 5%. When error occurs, system is only
running Ghost, Stop still occurs when ALL startups and services, including
anti-virus and firewall, are disabled except for essentials.

File properties of ntfs.sys are good.

Question: If there was a problem with the other Disk/tape/CD-ROM/other disk
drivers, wouldn't that show up when I do other Disk operations? So far, the
only trigger I've found is trying to create a bootable recovery CD. Will
research and insure device drivers are up to date.

I would clear the earlier errors before tackling the Stop Error messages
as they could be contributing towards the Stop Error message.

You might also try HD Tune(freeware) as you can see the SMART
information relating to the drive etc.

Download and run it and see what it turns up.
http://www.hdtune.com/

Select the Info tabs and place the cursor on the drive under Drive
letter and then double click the two page icon ( copy to Clipboard )
and copy into a further message.

Select the Health tab and then double click the two page icon ( copy to
Clipboard ) and copy into a further message. Make sure you do a full
surface scan with HD Tune.

chkdsk log:

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 1/5/2008
Time: 9:50:44 AM
User: N/A
Computer: JOHN1252
Description:
Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 46 unused index entries from index $SII of file 0x9.
Cleaning up 46 unused index entries from index $SDH of file 0x9.
Cleaning up 46 unused security descriptors.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

67111505 KB total disk space.
20961876 KB in 108335 files.
71304 KB in 10281 indexes.
0 KB in bad sectors.
211157 KB in use by the system.
65536 KB occupied by the log file.
45867168 KB available on disk.

4096 bytes in each allocation unit.
16777876 total allocation units on disk.
11466792 allocation units available on disk.

Internal Info:
f0 16 02 00 61 cf 01 00 d5 d1 02 00 00 00 00 00 ....a...........
3d cb 01 00 01 00 00 00 8b 04 00 00 00 00 00 00 =...............
6a fb b9 08 00 00 00 00 ac 1c ff 9b 00 00 00 00 j...............
38 12 cd 10 00 00 00 00 2a 65 11 03 02 00 00 00 8.......*e......
ea a4 99 85 01 00 00 00 f2 09 1f 45 04 00 00 00 ...........E....
a0 3c a5 be 00 00 00 00 d8 3c 07 00 2f a7 01 00 .<.......<../...
00 00 00 00 00 50 69 ff 04 00 00 00 29 28 00 00 .....Pi.....)(..

Windows has finished checking your disk.
Please wait while your computer restarts
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
==================================
HD Tune: WDC WD5000AAJB-00YRA Information

Firmware version : 12.01C02
Serial number : WD-WCAS82246187
Capacity : 465.8 GB (~500.1 GB)
Buffer size : 8192 KB
Standard : ATA/ATAPI-8
Supported mode : UDMA Mode 5 (Ultra ATA/100)
Current mode : UDMA Mode 5 (Ultra ATA/100)

S.M.A.R.T : yes
48-bit Address : yes
Read Look-Ahead : yes
Write Cache : yes
Host Protected Area : yes
Device Configuration Overlay : yes
Automatic Acoustic Management: yes
Power Management : yes
Advanced Power Management : no
Power-up in Standby : no
Security Mode : yes
Firmware Upgradable : yes

Partition : 1
Drive letter : C:\
Label :
Capacity : 65538 MB
Usage : 31.66%
Type : NTFS
Bootable : Yes

Partition : 2
Drive letter : D:\
Label : Data Disk
Capacity : 411391 MB
Usage : 25.99%
Type : NTFS
Bootable : No

HD Tune: WDC WD5000AAJB-00YRA Health

ID Current Worst ThresholdData Status
(01) Raw Read Error Rate 200 200 51 0 Ok
(03) Spin Up Time 190 177 21 5483 Ok
(04) Start/Stop Count 100 100 0 14 Ok
(05) Reallocated Sector Count 200 200 140 0 Ok
(07) Seek Error Rate 200 200 51 0 Ok
(09) Power On Hours Count 100 100 0 20 Ok
(0A) Spin Retry Count 100 253 51 0 Ok
(0B) Calibration Retry Count 100 253 51 0 Ok
(0C) Power Cycle Count 100 100 0 12 Ok
(C0) Power Off Retract Count 200 200 0 5 Ok
(C1) Load Cycle Count 200 200 0 14 Ok
(C2) Temperature 113 106 0 37 Ok
(C4) Reallocated Event Count 200 200 0 0 Ok
(C5) Current Pending Sector 200 200 0 0 Ok
(C6) Offline Uncorrectable 100 253 0 0 Ok
(C7) Ultra DMA CRC Error Count 200 200 0 0 Ok
(C8) Write Error Rate 100 253 51 0 Ok

Power On Time : 20
Health Status : Ok
====================================================

 

[DocBrown]

Gerry,

Thanks for the help. I used the autoruns.exe and I found the entries that
were causing the errors. I've corrected them as I describe below.

System boot is now clean with no errors or warnings.

I've also included the logs from HD Tune. But be aware that this is a new
disk I Just finished recovering to. My original disk was definitely having
errors. I used a Norton Ghost recovery image to recover to the new disk. The
image creation was ok so am I safe to say that the disk failures didn't
corrupt the image? There is, of course, something else that was (still is)
not straight with the OS.

Any further suggestions?

John

Event ID: 7000
The mrtRate service failed to start due to the following error:

You may need to update Quicken driver?

Found and corrected that error. It was from:

HKEY_LOCAL_MACHINE\SOFTWARE\ATI Technologies\CDS\Device\0
DeviceItem0071 REG_SZ [Non-Plug and Play Drivers] -> [mrtRate] (0x00000000)

That's my display adapter driver. File doesn't exist, so I disabled the
service. I'm going reinstall that portion of my display adapter.

Event ID: 7026
The following boot-start or system-start driver(s) failed to load:

This is probably referring to symtdi.sys, which is a Norton Anti-Virus
driver. Logical response is to uninstall and reininstall Norton. Good
luck <G>.

I had uninstalled Norton AV and only Norton/symantec products on system are
Ghost and LiveUpdate. I deleted these entries from the Registry.

Stop: 0x00000024 (0x001902FE, 0xECD0A3CC, 0xECD0A0C8, 0xF842A7B6)
NTFS.SYS - Address: F842A7B6 base at F842A000, Datestamp 41107eea

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793935.aspx

0x00000024: NTFS_FILE_SYSTEM [snipped]
The suggested commammand is chkdsk /f /r NOT chkdsk /r.

Done... Found some errors (see below). The disk is new so will complete a
scan later today. Disk fragmetation is 5%. When error occurs, system is only
running Ghost, Stop still occurs when ALL startups and services, including
anti-virus and firewall, are disabled except for essentials.

File properties of ntfs.sys are good.

Question: If there was a problem with the other Disk/tape/CD-ROM/other disk
drivers, wouldn't that show up when I do other Disk operations? So far, the
only trigger I've found is trying to create a bootable recovery CD. Will
research and insure device drivers are up to date.

I would clear the earlier errors before tackling the Stop Error messages
as they could be contributing towards the Stop Error message.

Boot is now completely clean with no logged errors or warnings.

You might also try HD Tune(freeware) as you can see the SMART
information relating to the drive etc.

Download and run it and see what it turns up.
http://www.hdtune.com/

Select the Info tabs and place the cursor on the drive under Drive
letter and then double click the two page icon ( copy to Clipboard )
and copy into a further message.

Select the Health tab and then double click the two page icon ( copy to
Clipboard ) and copy into a further message. Make sure you do a full
surface scan with HD Tune.

chkdsk log:

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 1/5/2008
Time: 9:50:44 AM
User: N/A
Computer: JOHN1252
Description:
Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 46 unused index entries from index $SII of file 0x9.
Cleaning up 46 unused index entries from index $SDH of file 0x9.
Cleaning up 46 unused security descriptors.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

67111505 KB total disk space.
20961876 KB in 108335 files.
71304 KB in 10281 indexes.
0 KB in bad sectors.
211157 KB in use by the system.
65536 KB occupied by the log file.
45867168 KB available on disk.

4096 bytes in each allocation unit.
16777876 total allocation units on disk.
11466792 allocation units available on disk.

Internal Info:
f0 16 02 00 61 cf 01 00 d5 d1 02 00 00 00 00 00 ....a...........
3d cb 01 00 01 00 00 00 8b 04 00 00 00 00 00 00 =...............
6a fb b9 08 00 00 00 00 ac 1c ff 9b 00 00 00 00 j...............
38 12 cd 10 00 00 00 00 2a 65 11 03 02 00 00 00 8.......*e......
ea a4 99 85 01 00 00 00 f2 09 1f 45 04 00 00 00 ...........E....
a0 3c a5 be 00 00 00 00 d8 3c 07 00 2f a7 01 00 .<.......<../...
00 00 00 00 00 50 69 ff 04 00 00 00 29 28 00 00 .....Pi.....)(..

Windows has finished checking your disk.
Please wait while your computer restarts
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
==================================
HD Tune: WDC WD5000AAJB-00YRA Information

Firmware version : 12.01C02
Serial number : WD-WCAS82246187
Capacity : 465.8 GB (~500.1 GB)
Buffer size : 8192 KB
Standard : ATA/ATAPI-8
Supported mode : UDMA Mode 5 (Ultra ATA/100)
Current mode : UDMA Mode 5 (Ultra ATA/100)

S.M.A.R.T : yes
48-bit Address : yes
Read Look-Ahead : yes
Write Cache : yes
Host Protected Area : yes
Device Configuration Overlay : yes
Automatic Acoustic Management: yes
Power Management : yes
Advanced Power Management : no
Power-up in Standby : no
Security Mode : yes
Firmware Upgradable : yes

Partition : 1
Drive letter : C:\
Label :
Capacity : 65538 MB
Usage : 31.66%
Type : NTFS
Bootable : Yes

Partition : 2
Drive letter : D:\
Label : Data Disk
Capacity : 411391 MB
Usage : 25.99%
Type : NTFS
Bootable : No

HD Tune: WDC WD5000AAJB-00YRA Health

ID Current Worst ThresholdData Status
(01) Raw Read Error Rate 200 200 51 0 Ok
(03) Spin Up Time 190 177 21 5483 Ok
(04) Start/Stop Count 100 100 0 14 Ok
(05) Reallocated Sector Count 200 200 140 0 Ok
(07) Seek Error Rate 200 200 51 0 Ok
(09) Power On Hours Count 100 100 0 20 Ok
(0A) Spin Retry Count 100 253 51 0 Ok
(0B) Calibration Retry Count 100 253 51 0 Ok
(0C) Power Cycle Count 100 100 0 12 Ok
(C0) Power Off Retract Count 200 200 0 5 Ok
(C1) Load Cycle Count 200 200 0 14 Ok
(C2) Temperature 113 106 0 37 Ok
(C4) Reallocated Event Count 200 200 0 0 Ok
(C5) Current Pending Sector 200 200 0 0 Ok
(C6) Offline Uncorrectable 100 253 0 0 Ok
(C7) Ultra DMA CRC Error Count 200 200 0 0 Ok
(C8) Write Error Rate 100 253 51 0 Ok

Power On Time : 20
Health Status : Ok
====================================================

 

[Gerry]

John

Does your Windows XP CD include SP2?

What version of ntfs.sys is on your system?

Why did you replace the original hard drive?


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Gerry,

Thanks for the help. I used the autoruns.exe and I found the entries
that were causing the errors. I've corrected them as I describe below.

System boot is now clean with no errors or warnings.

I've also included the logs from HD Tune. But be aware that this is a
new disk I Just finished recovering to. My original disk was
definitely having errors. I used a Norton Ghost recovery image to
recover to the new disk. The image creation was ok so am I safe to
say that the disk failures didn't corrupt the image? There is, of
course, something else that was (still is) not straight with the OS.

Any further suggestions?

John

Event ID: 7000
The mrtRate service failed to start due to the following error:

You may need to update Quicken driver?

Found and corrected that error. It was from:

HKEY_LOCAL_MACHINE\SOFTWARE\ATI Technologies\CDS\Device\0
DeviceItem0071 REG_SZ [Non-Plug and Play Drivers] -> [mrtRate]
(0x00000000)

That's my display adapter driver. File doesn't exist, so I disabled
the service. I'm going reinstall that portion of my display adapter.

Event ID: 7026
The following boot-start or system-start driver(s) failed to load:

This is probably referring to symtdi.sys, which is a Norton
Anti-Virus driver. Logical response is to uninstall and reininstall
Norton. Good luck <G>.

I had uninstalled Norton AV and only Norton/symantec products on
system are Ghost and LiveUpdate. I deleted these entries from the
Registry.

Stop: 0x00000024 (0x001902FE, 0xECD0A3CC, 0xECD0A0C8, 0xF842A7B6)
NTFS.SYS - Address: F842A7B6 base at F842A000, Datestamp 41107eea

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793935.aspx

0x00000024: NTFS_FILE_SYSTEM [snipped]
The suggested commammand is chkdsk /f /r NOT chkdsk /r.

Done... Found some errors (see below). The disk is new so will
complete a scan later today. Disk fragmetation is 5%. When error
occurs, system is only running Ghost, Stop still occurs when ALL
startups and services, including anti-virus and firewall, are
disabled except for essentials.

File properties of ntfs.sys are good.

Question: If there was a problem with the other
Disk/tape/CD-ROM/other disk drivers, wouldn't that show up when I do
other Disk operations? So far, the only trigger I've found is trying
to create a bootable recovery CD. Will research and insure device
drivers are up to date.

I would clear the earlier errors before tackling the Stop Error
messages as they could be contributing towards the Stop Error
message.

Boot is now completely clean with no logged errors or warnings.

You might also try HD Tune(freeware) as you can see the SMART
information relating to the drive etc.

Download and run it and see what it turns up.
http://www.hdtune.com/

Select the Info tabs and place the cursor on the drive under Drive
letter and then double click the two page icon ( copy to Clipboard )
and copy into a further message.

Select the Health tab and then double click the two page icon (
copy to Clipboard ) and copy into a further message. Make sure you
do a full surface scan with HD Tune.

chkdsk log:

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 1/5/2008
Time: 9:50:44 AM
User: N/A
Computer: JOHN1252
Description:
Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 46 unused index entries from index $SII of file 0x9.
Cleaning up 46 unused index entries from index $SDH of file 0x9.
Cleaning up 46 unused security descriptors.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

67111505 KB total disk space.
20961876 KB in 108335 files.
71304 KB in 10281 indexes.
0 KB in bad sectors.
211157 KB in use by the system.
65536 KB occupied by the log file.
45867168 KB available on disk.

4096 bytes in each allocation unit.
16777876 total allocation units on disk.
11466792 allocation units available on disk.

Internal Info:
f0 16 02 00 61 cf 01 00 d5 d1 02 00 00 00 00 00 ....a...........
3d cb 01 00 01 00 00 00 8b 04 00 00 00 00 00 00 =...............
6a fb b9 08 00 00 00 00 ac 1c ff 9b 00 00 00 00 j...............
38 12 cd 10 00 00 00 00 2a 65 11 03 02 00 00 00 8.......*e......
ea a4 99 85 01 00 00 00 f2 09 1f 45 04 00 00 00 ...........E....
a0 3c a5 be 00 00 00 00 d8 3c 07 00 2f a7 01 00 .<.......<../...
00 00 00 00 00 50 69 ff 04 00 00 00 29 28 00 00 .....Pi.....)(..

Windows has finished checking your disk.
Please wait while your computer restarts
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
==================================
HD Tune: WDC WD5000AAJB-00YRA Information

Firmware version : 12.01C02
Serial number : WD-WCAS82246187
Capacity : 465.8 GB (~500.1 GB)
Buffer size : 8192 KB
Standard : ATA/ATAPI-8
Supported mode : UDMA Mode 5 (Ultra ATA/100)
Current mode : UDMA Mode 5 (Ultra ATA/100)

S.M.A.R.T : yes
48-bit Address : yes
Read Look-Ahead : yes
Write Cache : yes
Host Protected Area : yes
Device Configuration Overlay : yes
Automatic Acoustic Management: yes
Power Management : yes
Advanced Power Management : no
Power-up in Standby : no
Security Mode : yes
Firmware Upgradable : yes

Partition : 1
Drive letter : C:\
Label :
Capacity : 65538 MB
Usage : 31.66%
Type : NTFS
Bootable : Yes

Partition : 2
Drive letter : D:\
Label : Data Disk
Capacity : 411391 MB
Usage : 25.99%
Type : NTFS
Bootable : No

HD Tune: WDC WD5000AAJB-00YRA Health

ID Current Worst ThresholdData
Status (01) Raw Read Error Rate 200 200 51 0
Ok (03) Spin Up Time 190 177 21 5483
Ok (04) Start/Stop Count 100 100 0 14
Ok (05) Reallocated Sector Count 200 200 140 0
Ok (07) Seek Error Rate 200 200 51 0
Ok (09) Power On Hours Count 100 100 0 20
Ok (0A) Spin Retry Count 100 253 51 0
Ok (0B) Calibration Retry Count 100 253 51 0
Ok (0C) Power Cycle Count 100 100 0 12
Ok (C0) Power Off Retract Count 200 200 0 5
Ok (C1) Load Cycle Count 200 200 0 14
Ok (C2) Temperature 113 106 0 37
Ok (C4) Reallocated Event Count 200 200 0 0
Ok (C5) Current Pending Sector 200 200 0 0
Ok (C6) Offline Uncorrectable 100 253 0 0
Ok (C7) Ultra DMA CRC Error Count 200 200 0 0
Ok (C8) Write Error Rate 100 253 51 0
Ok

Power On Time : 20
Health Status : Ok
====================================================

Doc

Event ID: 7000
The mrtRate service failed to start due to the following error:

You may need to update Quicken driver?

Event ID: 7026
The following boot-start or system-start driver(s) failed to load:

This is probably referring to symtdi.sys, which is a Norton
Anti-Virus driver. Logical response is to uninstall and reininstall
Norton. Good luck <G>.

Stop: 0x00000024 (0x001902FE, 0xECD0A3CC, 0xECD0A0C8, 0xF842A7B6)
NTFS.SYS - Address: F842A7B6 base at F842A000, Datestamp 41107eea

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793935.aspx

0x00000024: NTFS_FILE_SYSTEM
A problem occurred within NTFS.SYS, the driver file that allows the
system to read and write to NTFS file system drives. There may be a
physical problem with the disk, or an Interrupt Request Packet (IRP)
may be corrupted. Other common causes include heavy hard drive
fragmentation, heavy file I/O, problems with some types of
drive-mirroring software, or some antivirus software. I suggest
running ChkDsk or ScanDisk as a first step; then disable all file
system filters such as virus scanners, firewall software, or backup
utilities. Check the file properties of NTFS.SYS to ensure it
matches the current OS or SP version. Update all disk, tape backup,
CD-ROM, or removable device drivers to the most current versions.
Source: http://aumha.org/a/stop.htm

The suggested commammand is chkdsk /f /r NOT chkdsk /r.

I would clear the earlier errors before tackling the Stop Error
messages as they could be contributing towards the Stop Error
message.

You might also try HD Tune(freeware) as you can see the SMART
information relating to the drive etc.

Download and run it and see what it turns up.
http://www.hdtune.com/

Select the Info tabs and place the cursor on the drive under Drive
letter and then double click the two page icon ( copy to Clipboard )
and copy into a further message.

Select the Health tab and then double click the two page icon (
copy to Clipboard ) and copy into a further message. Make sure you
do a full surface scan with HD Tune.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Plato]

Stop: 0x00000024 (0x001902FE, 0xECD0A3CC, 0xECD0A0C8, 0xF842A7B6)

http://www.updatexp.com/stop-messages.html
http://aumha.org/win5/kbestop.htm
http://www.theeldergeek.com/stop_error_messages.htm

 

[DocBrown]

Gerry,

John

Does your Windows XP CD include SP2?

No.. It is Win XP Home w/ SP1. I originally installed SP2 from MS Updates.
Yesterday, I downloaded the Network Installation package and re-ran the
install.

What version of ntfs.sys is on your system?

5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

Why did you replace the original hard drive?

Norton Ghost could no longer backup my C drive and started reporting Bad CRC
check errors from multiple LBAs. Then I ran the Maxtor disk scan and it said
my disk was failing.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Gerry,

Thanks for the help. I used the autoruns.exe and I found the entries
that were causing the errors. I've corrected them as I describe below.

System boot is now clean with no errors or warnings.

I've also included the logs from HD Tune. But be aware that this is a
new disk I Just finished recovering to. My original disk was
definitely having errors. I used a Norton Ghost recovery image to
recover to the new disk. The image creation was ok so am I safe to
say that the disk failures didn't corrupt the image? There is, of
course, something else that was (still is) not straight with the OS.

Any further suggestions?

John

Event ID: 7000
The mrtRate service failed to start due to the following error:
The system cannot find the file specified.

You may need to update Quicken driver?

Found and corrected that error. It was from:

HKEY_LOCAL_MACHINE\SOFTWARE\ATI Technologies\CDS\Device\0
DeviceItem0071 REG_SZ [Non-Plug and Play Drivers] -> [mrtRate]
(0x00000000)

That's my display adapter driver. File doesn't exist, so I disabled
the service. I'm going reinstall that portion of my display adapter.

Event ID: 7026
The following boot-start or system-start driver(s) failed to load:
kl1
SYMTDI

This is probably referring to symtdi.sys, which is a Norton
Anti-Virus driver. Logical response is to uninstall and reininstall
Norton. Good luck <G>.

I had uninstalled Norton AV and only Norton/symantec products on
system are Ghost and LiveUpdate. I deleted these entries from the
Registry.

Stop: 0x00000024 (0x001902FE, 0xECD0A3CC, 0xECD0A0C8, 0xF842A7B6)
NTFS.SYS - Address: F842A7B6 base at F842A000, Datestamp 41107eea

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793935.aspx

0x00000024: NTFS_FILE_SYSTEM [snipped]
The suggested commammand is chkdsk /f /r NOT chkdsk /r.

Done... Found some errors (see below). The disk is new so will
complete a scan later today. Disk fragmetation is 5%. When error
occurs, system is only running Ghost, Stop still occurs when ALL
startups and services, including anti-virus and firewall, are
disabled except for essentials.

File properties of ntfs.sys are good.

Question: If there was a problem with the other
Disk/tape/CD-ROM/other disk drivers, wouldn't that show up when I do
other Disk operations? So far, the only trigger I've found is trying
to create a bootable recovery CD. Will research and insure device
drivers are up to date.

I would clear the earlier errors before tackling the Stop Error
messages as they could be contributing towards the Stop Error
message.

Boot is now completely clean with no logged errors or warnings.

You might also try HD Tune(freeware) as you can see the SMART
information relating to the drive etc.

Download and run it and see what it turns up.
http://www.hdtune.com/

Select the Info tabs and place the cursor on the drive under Drive
letter and then double click the two page icon ( copy to Clipboard )
and copy into a further message.

Select the Health tab and then double click the two page icon (
copy to Clipboard ) and copy into a further message. Make sure you
do a full surface scan with HD Tune.

chkdsk log:

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 1/5/2008
Time: 9:50:44 AM
User: N/A
Computer: JOHN1252
Description:
Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 46 unused index entries from index $SII of file 0x9.
Cleaning up 46 unused index entries from index $SDH of file 0x9.
Cleaning up 46 unused security descriptors.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

67111505 KB total disk space.
20961876 KB in 108335 files.
71304 KB in 10281 indexes.
0 KB in bad sectors.
211157 KB in use by the system.
65536 KB occupied by the log file.
45867168 KB available on disk.

4096 bytes in each allocation unit.
16777876 total allocation units on disk.
11466792 allocation units available on disk.

Internal Info:
f0 16 02 00 61 cf 01 00 d5 d1 02 00 00 00 00 00 ....a...........
3d cb 01 00 01 00 00 00 8b 04 00 00 00 00 00 00 =...............
6a fb b9 08 00 00 00 00 ac 1c ff 9b 00 00 00 00 j...............
38 12 cd 10 00 00 00 00 2a 65 11 03 02 00 00 00 8.......*e......
ea a4 99 85 01 00 00 00 f2 09 1f 45 04 00 00 00 ...........E....
a0 3c a5 be 00 00 00 00 d8 3c 07 00 2f a7 01 00 .<.......<../...
00 00 00 00 00 50 69 ff 04 00 00 00 29 28 00 00 .....Pi.....)(..

Windows has finished checking your disk.
Please wait while your computer restarts
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
==================================
HD Tune: WDC WD5000AAJB-00YRA Information

Firmware version : 12.01C02
Serial number : WD-WCAS82246187
Capacity : 465.8 GB (~500.1 GB)
Buffer size : 8192 KB
Standard : ATA/ATAPI-8
Supported mode : UDMA Mode 5 (Ultra ATA/100)
Current mode : UDMA Mode 5 (Ultra ATA/100)

S.M.A.R.T : yes
48-bit Address : yes
Read Look-Ahead : yes
Write Cache : yes
Host Protected Area : yes
Device Configuration Overlay : yes
Automatic Acoustic Management: yes
Power Management : yes
Advanced Power Management : no
Power-up in Standby : no
Security Mode : yes
Firmware Upgradable : yes

Partition : 1
Drive letter : C:\
Label :
Capacity : 65538 MB
Usage : 31.66%
Type : NTFS
Bootable : Yes

Partition : 2
Drive letter : D:\
Label : Data Disk
Capacity : 411391 MB
Usage : 25.99%
Type : NTFS
Bootable : No

HD Tune: WDC WD5000AAJB-00YRA Health

ID Current Worst ThresholdData
Status (01) Raw Read Error Rate 200 200 51 0
Ok (03) Spin Up Time 190 177 21 5483
Ok (04) Start/Stop Count 100 100 0 14
Ok (05) Reallocated Sector Count 200 200 140 0
Ok (07) Seek Error Rate 200 200 51 0
Ok (09) Power On Hours Count 100 100 0 20
Ok (0A) Spin Retry Count 100 253 51 0
Ok (0B) Calibration Retry Count 100 253 51 0
Ok (0C) Power Cycle Count 100 100 0 12
Ok (C0) Power Off Retract Count 200 200 0 5
Ok (C1) Load Cycle Count 200 200 0 14
Ok (C2) Temperature 113 106 0 37
Ok (C4) Reallocated Event Count 200 200 0 0
Ok (C5) Current Pending Sector 200 200 0 0
Ok (C6) Offline Uncorrectable 100 253 0 0
Ok (C7) Ultra DMA CRC Error Count 200 200 0 0
Ok (C8) Write Error Rate 100 253 51 0
Ok

Power On Time : 20
Health Status : Ok
====================================================

Doc

Event ID: 7000
The mrtRate service failed to start due to the following error:
The system cannot find the file specified.

You may need to update Quicken driver?

Event ID: 7026
The following boot-start or system-start driver(s) failed to load:
kl1
SYMTDI

This is probably referring to symtdi.sys, which is a Norton
Anti-Virus driver. Logical response is to uninstall and reininstall
Norton. Good luck <G>.

Stop: 0x00000024 (0x001902FE, 0xECD0A3CC, 0xECD0A0C8, 0xF842A7B6)
NTFS.SYS - Address: F842A7B6 base at F842A000, Datestamp 41107eea

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793935.aspx

0x00000024: NTFS_FILE_SYSTEM
A problem occurred within NTFS.SYS, the driver file that allows the
system to read and write to NTFS file system drives. There may be a
physical problem with the disk, or an Interrupt Request Packet (IRP)
may be corrupted. Other common causes include heavy hard drive
fragmentation, heavy file I/O, problems with some types of
drive-mirroring software, or some antivirus software. I suggest
running ChkDsk or ScanDisk as a first step; then disable all file
system filters such as virus scanners, firewall software, or backup
utilities. Check the file properties of NTFS.SYS to ensure it
matches the current OS or SP version. Update all disk, tape backup,
CD-ROM, or removable device drivers to the most current versions.
Source: http://aumha.org/a/stop.htm

The suggested commammand is chkdsk /f /r NOT chkdsk /r.

I would clear the earlier errors before tackling the Stop Error
messages as they could be contributing towards the Stop Error
message.

You might also try HD Tune(freeware) as you can see the SMART
information relating to the drive etc.

Download and run it and see what it turns up.
http://www.hdtune.com/

Select the Info tabs and place the cursor on the drive under Drive
letter and then double click the two page icon ( copy to Clipboard )
and copy into a further message.

Select the Health tab and then double click the two page icon (
copy to Clipboard ) and copy into a further message. Make sure you
do a full surface scan with HD Tune.

 

[Gerry]

John

I have a later version of ntfs.sys on my system, which is also Windows
XP Home Edition. The file comes with KB930916. I would install this
update.

Error message when you try to open files on an NTFS file system volume
on a Windows XP-based computer: "Stop 0x0000008E"
http://support.microsoft.com/kb/930916/en-us

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Gerry,

John

Does your Windows XP CD include SP2?

No.. It is Win XP Home w/ SP1. I originally installed SP2 from MS
Updates. Yesterday, I downloaded the Network Installation package and
re-ran the install.

What version of ntfs.sys is on your system?

5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

Why did you replace the original hard drive?

Norton Ghost could no longer backup my C drive and started reporting
Bad CRC check errors from multiple LBAs. Then I ran the Maxtor disk
scan and it said my disk was failing.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Gerry,

Thanks for the help. I used the autoruns.exe and I found the entries
that were causing the errors. I've corrected them as I describe
below.

System boot is now clean with no errors or warnings.

I've also included the logs from HD Tune. But be aware that this is
a new disk I Just finished recovering to. My original disk was
definitely having errors. I used a Norton Ghost recovery image to
recover to the new disk. The image creation was ok so am I safe to
say that the disk failures didn't corrupt the image? There is, of
course, something else that was (still is) not straight with the OS.

Any further suggestions?

John

Event ID: 7000
The mrtRate service failed to start due to the following error:
The system cannot find the file specified.

You may need to update Quicken driver?

Found and corrected that error. It was from:

HKEY_LOCAL_MACHINE\SOFTWARE\ATI Technologies\CDS\Device\0
DeviceItem0071 REG_SZ [Non-Plug and Play Drivers] -> [mrtRate]
(0x00000000)

That's my display adapter driver. File doesn't exist, so I disabled
the service. I'm going reinstall that portion of my display adapter.


Event ID: 7026
The following boot-start or system-start driver(s) failed to load:
kl1
SYMTDI

This is probably referring to symtdi.sys, which is a Norton
Anti-Virus driver. Logical response is to uninstall and reininstall
Norton. Good luck <G>.

I had uninstalled Norton AV and only Norton/symantec products on
system are Ghost and LiveUpdate. I deleted these entries from the
Registry.


Stop: 0x00000024 (0x001902FE, 0xECD0A3CC, 0xECD0A0C8, 0xF842A7B6)
NTFS.SYS - Address: F842A7B6 base at F842A000, Datestamp 41107eea

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793935.aspx

0x00000024: NTFS_FILE_SYSTEM
[snipped]
The suggested commammand is chkdsk /f /r NOT chkdsk /r.

Done... Found some errors (see below). The disk is new so will
complete a scan later today. Disk fragmetation is 5%. When error
occurs, system is only running Ghost, Stop still occurs when ALL
startups and services, including anti-virus and firewall, are
disabled except for essentials.

File properties of ntfs.sys are good.

Question: If there was a problem with the other
Disk/tape/CD-ROM/other disk drivers, wouldn't that show up when I do
other Disk operations? So far, the only trigger I've found is trying
to create a bootable recovery CD. Will research and insure device
drivers are up to date.


I would clear the earlier errors before tackling the Stop Error
messages as they could be contributing towards the Stop Error
message.

Boot is now completely clean with no logged errors or warnings.


You might also try HD Tune(freeware) as you can see the SMART
information relating to the drive etc.

Download and run it and see what it turns up.
http://www.hdtune.com/

Select the Info tabs and place the cursor on the drive under Drive
letter and then double click the two page icon ( copy to
Clipboard ) and copy into a further message.

Select the Health tab and then double click the two page icon (
copy to Clipboard ) and copy into a further message. Make sure you
do a full surface scan with HD Tune.


chkdsk log:

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 1/5/2008
Time: 9:50:44 AM
User: N/A
Computer: JOHN1252
Description:
Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 46 unused index entries from index $SII of file 0x9.
Cleaning up 46 unused index entries from index $SDH of file 0x9.
Cleaning up 46 unused security descriptors.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the volume
bitmap. Windows has made corrections to the file system.

67111505 KB total disk space.
20961876 KB in 108335 files.
71304 KB in 10281 indexes.
0 KB in bad sectors.
211157 KB in use by the system.
65536 KB occupied by the log file.
45867168 KB available on disk.

4096 bytes in each allocation unit.
16777876 total allocation units on disk.
11466792 allocation units available on disk.

Internal Info:
f0 16 02 00 61 cf 01 00 d5 d1 02 00 00 00 00 00 ....a...........
3d cb 01 00 01 00 00 00 8b 04 00 00 00 00 00 00 =...............
6a fb b9 08 00 00 00 00 ac 1c ff 9b 00 00 00 00 j...............
38 12 cd 10 00 00 00 00 2a 65 11 03 02 00 00 00 8.......*e......
ea a4 99 85 01 00 00 00 f2 09 1f 45 04 00 00 00 ...........E....
a0 3c a5 be 00 00 00 00 d8 3c 07 00 2f a7 01 00 .<.......<../...
00 00 00 00 00 50 69 ff 04 00 00 00 29 28 00 00 .....Pi.....)(..

Windows has finished checking your disk.
Please wait while your computer restarts
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
==================================
HD Tune: WDC WD5000AAJB-00YRA Information

Firmware version : 12.01C02
Serial number : WD-WCAS82246187
Capacity : 465.8 GB (~500.1 GB)
Buffer size : 8192 KB
Standard : ATA/ATAPI-8
Supported mode : UDMA Mode 5 (Ultra ATA/100)
Current mode : UDMA Mode 5 (Ultra ATA/100)

S.M.A.R.T : yes
48-bit Address : yes
Read Look-Ahead : yes
Write Cache : yes
Host Protected Area : yes
Device Configuration Overlay : yes
Automatic Acoustic Management: yes
Power Management : yes
Advanced Power Management : no
Power-up in Standby : no
Security Mode : yes
Firmware Upgradable : yes

Partition : 1
Drive letter : C:\
Label :
Capacity : 65538 MB
Usage : 31.66%
Type : NTFS
Bootable : Yes

Partition : 2
Drive letter : D:\
Label : Data Disk
Capacity : 411391 MB
Usage : 25.99%
Type : NTFS
Bootable : No

HD Tune: WDC WD5000AAJB-00YRA Health

ID Current Worst ThresholdData
Status (01) Raw Read Error Rate 200 200 51 0
Ok (03) Spin Up Time 190 177 21 5483
Ok (04) Start/Stop Count 100 100 0 14
Ok (05) Reallocated Sector Count 200 200 140 0
Ok (07) Seek Error Rate 200 200 51 0
Ok (09) Power On Hours Count 100 100 0 20
Ok (0A) Spin Retry Count 100 253 51 0
Ok (0B) Calibration Retry Count 100 253 51 0
Ok (0C) Power Cycle Count 100 100 0 12
Ok (C0) Power Off Retract Count 200 200 0 5
Ok (C1) Load Cycle Count 200 200 0 14
Ok (C2) Temperature 113 106 0 37
Ok (C4) Reallocated Event Count 200 200 0 0
Ok (C5) Current Pending Sector 200 200 0 0
Ok (C6) Offline Uncorrectable 100 253 0 0
Ok (C7) Ultra DMA CRC Error Count 200 200 0 0
Ok (C8) Write Error Rate 100 253 51 0
Ok

Power On Time : 20
Health Status : Ok
====================================================

:

Doc

Event ID: 7000
The mrtRate service failed to start due to the following error:
The system cannot find the file specified.

You may need to update Quicken driver?

Event ID: 7026
The following boot-start or system-start driver(s) failed to load:
kl1
SYMTDI

This is probably referring to symtdi.sys, which is a Norton
Anti-Virus driver. Logical response is to uninstall and reininstall
Norton. Good luck <G>.

Stop: 0x00000024 (0x001902FE, 0xECD0A3CC, 0xECD0A0C8, 0xF842A7B6)
NTFS.SYS - Address: F842A7B6 base at F842A000, Datestamp 41107eea

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793935.aspx

0x00000024: NTFS_FILE_SYSTEM
A problem occurred within NTFS.SYS, the driver file that allows the
system to read and write to NTFS file system drives. There may be a
physical problem with the disk, or an Interrupt Request Packet
(IRP) may be corrupted. Other common causes include heavy hard
drive fragmentation, heavy file I/O, problems with some types of
drive-mirroring software, or some antivirus software. I suggest
running ChkDsk or ScanDisk as a first step; then disable all file
system filters such as virus scanners, firewall software, or backup
utilities. Check the file properties of NTFS.SYS to ensure it
matches the current OS or SP version. Update all disk, tape backup,
CD-ROM, or removable device drivers to the most current versions.
Source: http://aumha.org/a/stop.htm

The suggested commammand is chkdsk /f /r NOT chkdsk /r.

I would clear the earlier errors before tackling the Stop Error
messages as they could be contributing towards the Stop Error
message.

You might also try HD Tune(freeware) as you can see the SMART
information relating to the drive etc.

Download and run it and see what it turns up.
http://www.hdtune.com/

Select the Info tabs and place the cursor on the drive under Drive
letter and then double click the two page icon ( copy to
Clipboard ) and copy into a further message.

Select the Health tab and then double click the two page icon (
copy to Clipboard ) and copy into a further message. Make sure you
do a full surface scan with HD Tune.


--

 

[DocBrown]

Didn't help... It just changed the stack info and messed up the windbg
analyze..

Below is the info from minidump... If I interpret this correctly, the ntfs
driver is attempting access a relative memory location, but it's reading
0x00000004! The eax register is 0. From what I know about OSs, I doubt this
is correct. I don't think there's anything more I can do. Any ideas?
===============================

windbg -y SRV*c:\symbols*http://msdl.microsoft.com/download/symbols -i
C:\WINDOWS\ServicePackFiles\i386 -z C:\WINDOWS\Minidump\mini010608-07.dmp


Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\mini010608-07.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS\ServicePackFiles\i386
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86
compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Sun Jan 6 22:21:36.750 2008 (GMT-8)
System Uptime: 0 days 0:04:54.437
Loading Kernel Symbol
................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
ERROR: FindPlugIns 8007007
*******************************************************************************
*
*
* Bugcheck Analysis
*
*

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, ec96e3cc, ec96e0c8, f85aa7b6}

*** WARNING: Unable to verify timestamp for symsnap.sys
*** ERROR: Module load completed but symbols could not be loaded for
symsnap.sys
*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys


Probably caused by : Ntfs.sys ( Ntfs!NtfsDecodeFileObject+37 )

Followup: MachineOwner
---------

0: kd> !analyze -v
ERROR: FindPlugIns 8007007
*******************************************************************************
*
*
* Bugcheck Analysis
*
*

*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001902fe
Arg2: ec96e3cc
Arg3: ec96e0c8
Arg4: f85aa7b6

Debugging Details:
------------------




EXCEPTION_RECORD: ec96e3cc -- (.exr 0xffffffffec96e3cc)
ExceptionAddress: f85aa7b6 (Ntfs!NtfsDecodeFileObject+0x00000037)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000004
Attempt to read from address 00000004

CONTEXT: ec96e0c8 -- (.cxr 0xffffffffec96e0c8)
eax=00000000 ebx=ec96e584 ecx=ff5a3e80 edx=ec96e4d0 esi=ec96e4e0 edi=ec96e844
eip=f85aa7b6 esp=ec96e494 ebp=ec96e498 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
Ntfs!NtfsDecodeFileObject+0x37:
f85aa7b6 8b4804 mov ecx,dword ptr [eax+4]
ds:0023:00000004=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 7

PROCESS_NAME: ModifiableSRD.e

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced
memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 00000004

BUGCHECK_STR: 0x24

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER: from f85d1d60 to f85aa7b6

STACK_TEXT:
ec96e498 f85d1d60 ec96e584 ec96ecc0 ec96e4d4 Ntfs!NtfsDecodeFileObject+0x37
ec96e50c f85d04b4 ec96e584 829b26b8 829b2888
Ntfs!NtfsCommonQueryInformation+0x56
ec96e570 f85d04ed ec96e584 829b26b8 00000001 Ntfs!NtfsFsdDispatchSwitch+0x12a
ec96e694 804e13d9 83334020 829b26b8 8332e9f0 Ntfs!NtfsFsdDispatchWait+0x1c
ec96e6a4 f8682459 ec96e6d0 804e13d9 833546b0 nt!IopfCallDriver+0x31
ec96e6ac 804e13d9 833546b0 829b26b8 829b28ac sr!SrPassThrough+0x31
ec96e6bc f8656d78 804e84d5 833d7808 833d784c nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be
wrong.
ec96e6d0 f86503f3 833d7788 829b26b8 00000000 symsnap+0x8d78
ec96e6f0 f8656734 833d7808 829b26b8 00639f00 symsnap+0x23f3
ec96e7c4 f8656b98 833d76d0 829b26b8 833d76d0 symsnap+0x8734
ec96e7e0 804e13d9 833d76d0 829b26b8 829b26b8 symsnap+0x8b98
ec96e7f0 f86a6433 00000000 8274a8e8 00000000 nt!IopfCallDriver+0x31
ec96e81c f86a89f2 833d76d0 ec96ecc0 ec96e844
fltmgr!FltpQueryInformationFile+0x99
ec96e864 f86a8fc5 826a8c18 00000000 80559000
fltmgr!SetStreamListStandardInformationFlags+0x7e
ec96e888 ef94f504 ec96ecc0 8274a8e8 826538c0 fltmgr!FltIsDirectory+0x4b
00000000 00000000 00000000 00000000 00000000 klif+0xf504


FOLLOWUP_IP:
Ntfs!NtfsDecodeFileObject+37
f85aa7b6 8b4804 mov ecx,dword ptr [eax+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: Ntfs!NtfsDecodeFileObject+37

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107eea

STACK_COMMAND: .cxr 0xffffffffec96e0c8 ; kb

FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsDecodeFileObject+37

BUCKET_ID: 0x24_Ntfs!NtfsDecodeFileObject+37

Followup: MachineOwner
---------

John

I have a later version of ntfs.sys on my system, which is also Windows
XP Home Edition. The file comes with KB930916. I would install this
update.

Error message when you try to open files on an NTFS file system volume
on a Windows XP-based computer: "Stop 0x0000008E"
http://support.microsoft.com/kb/930916/en-us

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Gerry,

John

Does your Windows XP CD include SP2?

No.. It is Win XP Home w/ SP1. I originally installed SP2 from MS
Updates. Yesterday, I downloaded the Network Installation package and
re-ran the install.

What version of ntfs.sys is on your system?

5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)

Why did you replace the original hard drive?

Norton Ghost could no longer backup my C drive and started reporting
Bad CRC check errors from multiple LBAs. Then I ran the Maxtor disk
scan and it said my disk was failing.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


DocBrown wrote:
Gerry,

Thanks for the help. I used the autoruns.exe and I found the entries
that were causing the errors. I've corrected them as I describe
below.

System boot is now clean with no errors or warnings.

I've also included the logs from HD Tune. But be aware that this is
a new disk I Just finished recovering to. My original disk was
definitely having errors. I used a Norton Ghost recovery image to
recover to the new disk. The image creation was ok so am I safe to
say that the disk failures didn't corrupt the image? There is, of
course, something else that was (still is) not straight with the OS.

Any further suggestions?

John

Event ID: 7000
The mrtRate service failed to start due to the following error:
The system cannot find the file specified.

You may need to update Quicken driver?

Found and corrected that error. It was from:

HKEY_LOCAL_MACHINE\SOFTWARE\ATI Technologies\CDS\Device\0
DeviceItem0071 REG_SZ [Non-Plug and Play Drivers] -> [mrtRate]
(0x00000000)

That's my display adapter driver. File doesn't exist, so I disabled
the service. I'm going reinstall that portion of my display adapter.


Event ID: 7026
The following boot-start or system-start driver(s) failed to load:
kl1
SYMTDI

This is probably referring to symtdi.sys, which is a Norton
Anti-Virus driver. Logical response is to uninstall and reininstall
Norton. Good luck <G>.

I had uninstalled Norton AV and only Norton/symantec products on
system are Ghost and LiveUpdate. I deleted these entries from the
Registry.


Stop: 0x00000024 (0x001902FE, 0xECD0A3CC, 0xECD0A0C8, 0xF842A7B6)
NTFS.SYS - Address: F842A7B6 base at F842A000, Datestamp 41107eea

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793935.aspx

0x00000024: NTFS_FILE_SYSTEM
[snipped]
The suggested commammand is chkdsk /f /r NOT chkdsk /r.

Done... Found some errors (see below). The disk is new so will
complete a scan later today. Disk fragmetation is 5%. When error
occurs, system is only running Ghost, Stop still occurs when ALL
startups and services, including anti-virus and firewall, are
disabled except for essentials.

File properties of ntfs.sys are good.

Question: If there was a problem with the other
Disk/tape/CD-ROM/other disk drivers, wouldn't that show up when I do
other Disk operations? So far, the only trigger I've found is trying
to create a bootable recovery CD. Will research and insure device
drivers are up to date.


I would clear the earlier errors before tackling the Stop Error
messages as they could be contributing towards the Stop Error
message.

Boot is now completely clean with no logged errors or warnings.


You might also try HD Tune(freeware) as you can see the SMART
information relating to the drive etc.

Download and run it and see what it turns up.
http://www.hdtune.com/

Select the Info tabs and place the cursor on the drive under Drive
letter and then double click the two page icon ( copy to
Clipboard ) and copy into a further message.

Select the Health tab and then double click the two page icon (
copy to Clipboard ) and copy into a further message. Make sure you
do a full surface scan with HD Tune.


chkdsk log:

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 1/5/2008
Time: 9:50:44 AM
User: N/A
Computer: JOHN1252
Description:
Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 46 unused index entries from index $SII of file 0x9.
Cleaning up 46 unused index entries from index $SDH of file 0x9.
Cleaning up 46 unused security descriptors.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the volume
bitmap. Windows has made corrections to the file system.

67111505 KB total disk space.
20961876 KB in 108335 files.
71304 KB in 10281 indexes.
0 KB in bad sectors.
211157 KB in use by the system.
65536 KB occupied by the log file.
45867168 KB available on disk.

4096 bytes in each allocation unit.
16777876 total allocation units on disk.
11466792 allocation units available on disk.

Internal Info:
f0 16 02 00 61 cf 01 00 d5 d1 02 00 00 00 00 00 ....a...........
3d cb 01 00 01 00 00 00 8b 04 00 00 00 00 00 00 =...............
6a fb b9 08 00 00 00 00 ac 1c ff 9b 00 00 00 00 j...............
38 12 cd 10 00 00 00 00 2a 65 11 03 02 00 00 00 8.......*e......
ea a4 99 85 01 00 00 00 f2 09 1f 45 04 00 00 00 ...........E....
a0 3c a5 be 00 00 00 00 d8 3c 07 00 2f a7 01 00 .<.......<../...
00 00 00 00 00 50 69 ff 04 00 00 00 29 28 00 00 .....Pi.....)(..

Windows has finished checking your disk.
Please wait while your computer restarts
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
==================================
HD Tune: WDC WD5000AAJB-00YRA Information

Firmware version : 12.01C02
Serial number : WD-WCAS82246187
Capacity : 465.8 GB (~500.1 GB)
Buffer size : 8192 KB
Standard : ATA/ATAPI-8
Supported mode : UDMA Mode 5 (Ultra ATA/100)
Current mode : UDMA Mode 5 (Ultra ATA/100)

S.M.A.R.T : yes
48-bit Address : yes
Read Look-Ahead : yes
Write Cache : yes
Host Protected Area : yes
Device Configuration Overlay : yes
Automatic Acoustic Management: yes
Power Management : yes
Advanced Power Management : no
Power-up in Standby : no
Security Mode : yes
Firmware Upgradable : yes

Partition : 1
Drive letter : C:\
Label :
Capacity : 65538 MB
Usage : 31.66%
Type : NTFS
Bootable : Yes

Partition : 2
Drive letter : D:\
Label : Data Disk
Capacity : 411391 MB
Usage : 25.99%
Type : NTFS
Bootable : No

HD Tune: WDC WD5000AAJB-00YRA Health

ID Current Worst ThresholdData
Status (01) Raw Read Error Rate 200 200 51 0
Ok (03) Spin Up Time 190 177 21 5483
Ok (04) Start/Stop Count 100 100 0 14
Ok (05) Reallocated Sector Count 200 200 140 0
Ok (07) Seek Error Rate 200 200 51 0
Ok (09) Power On Hours Count 100 100 0 20
Ok (0A) Spin Retry Count 100 253 51 0
Ok (0B) Calibration Retry Count 100 253 51 0
Ok (0C) Power Cycle Count 100 100 0 12
Ok (C0) Power Off Retract Count 200 200 0 5
Ok (C1) Load Cycle Count 200 200 0 14
Ok (C2) Temperature 113 106 0 37
Ok (C4) Reallocated Event Count 200 200 0 0
Ok (C5) Current Pending Sector 200 200 0 0
Ok (C6) Offline Uncorrectable 100 253 0 0
Ok (C7) Ultra DMA CRC Error Count 200 200 0 0
Ok (C8) Write Error Rate 100 253 51 0
Ok

Power On Time : 20
Health Status : Ok
====================================================

:

Doc

Event ID: 7000
The mrtRate service failed to start due to the following error:
The system cannot find the file specified.

You may need to update Quicken driver?

Event ID: 7026
The following boot-start or system-start driver(s) failed to load:
kl1
SYMTDI

This is probably referring to symtdi.sys, which is a Norton
Anti-Virus driver. Logical response is to uninstall and reininstall
Norton. Good luck <G>.

Stop: 0x00000024 (0x001902FE, 0xECD0A3CC, 0xECD0A0C8, 0xF842A7B6)
NTFS.SYS - Address: F842A7B6 base at F842A000, Datestamp 41107eea

 

[DocBrown]

Thanks for the links. I think I've tried just about everything here. See my
other new post for what I've found.