(已解决，谢谢) BugCheck NTFS_FILE_SYSTEM

NTFS_FILE_SYSTEM (24)

我对Sfilter作了些改动，一旦我长时间不操作(10分钟后)，就出现这个，摸不着头脑

遇到过的朋友指点一下，谢谢

给个或许有帮助的帮助，：-）
http://support.microsoft.com/kb/228888/zh-cn

谢谢devia，不过我都已经在能搜索的地方搜索过了，尝试不行了来问的


Sfilter:FileNocacheWriteCompletion Before \DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF9028.tmp,WriteLength=4096,Offset=0,Prcocess=0
Sfilter:FileNocacheWriteCompletion Before \DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF9028.tmp,WriteLength=12288,Offset=0,Prcocess=0
Sfilter:FileNocacheWriteCompletion \DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF9028.tmp,WriteLength=12288,Offset=0,Prcocess=0
Sfilter:FileNocacheWriteCompletion \DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF9028.tmp,WriteLength=4096,Offset=0,Prcocess=0

*** Fatal System Error: 0x00000024
                       (0x001902FE,0xF781261C,0xF7812318,0x8053296A)

Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrnlpa.exe -
Loading Kernel Symbols
.............................................................................................................
Loading User Symbols
...............................
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, f781261c, f7812318, 8053296a}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
*** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ole32.dll -
Probably caused by : Ntfs.sys ( Ntfs+7d6a )

Followup: MachineOwner
---------

nt!DbgBreakPointWithStatus+0x4:
80527da8 cc              int     3
kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001902fe
Arg2: f781261c
Arg3: f7812318
Arg4: 8053296a

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


MODULE_NAME: Ntfs

FAULTING_MODULE: 804d8000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  41107eea

EXCEPTION_RECORD:  f781261c -- (.exr fffffffff781261c)
ExceptionAddress: 8053296a (nt!ExAcquireResourceExclusiveLite+0x00000036)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 0000000c
Attempt to read from address 0000000c

CONTEXT:  f7812318 -- (.cxr fffffffff7812318)
eax=814eb2d0 ebx=8150f358 ecx=00000000 edx=00000000 esi=00000000 edi=814eb2d0
eip=8053296a esp=f78126e4 ebp=f78126ec iopl=0         nv up di ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010086
nt!ExAcquireResourceExclusiveLite+0x36:
8053296a 66837e0c00      cmp     word ptr [esi+0Ch],0     ds:0023:0000000c=????
Resetting default scope

DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from f9719d6a to 8053296a

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
f78126ec f9719d6a 00000000 00000001 815ca7b8 nt!ExAcquireResourceExclusiveLite+0x36
f78127b8 f9714fbf 8150f358 815ca7b8 00000001 Ntfs+0x7d6a
f7812858 804eedf9 817be658 815ca7b8 81755eb0 Ntfs+0x2fbf
f7812870 804eedf9 817be020 815ca7b8 8163abe8 nt!IoBuildPartialMdl+0xed
f78128f8 804eedf9 814ca930 815ca7b8 8160d518 nt!IoBuildPartialMdl+0xed
f7812944 f7726728 814f7768 f781298c 00001000 nt!IoBuildPartialMdl+0xed
f7812994 f77255de 814f7768 f78129e4 f77284ce Sfilter!SendIrpReadFile+0xa8 [c:\winddk\3790.1830\Sfilter\Sfilter.c @ 3580]
f78129a0 f77284ce 814f7768 e128369c 00000001 Sfilter!Look_FileObject+0xe [c:\winddk\3790.1830\Sfilter\Sfilter.c @ 2871]
f78129e4 f772d601 8160d4fc 8160d390 8160d3a0 Sfilter!AfterFileCreate+0x3ce [c:\winddk\3790.1830\Sfilter\Sfilter.c @ 4383]
f7812a4c 804eedf9 814ca930 8160d390 8160d390 Sfilter!SfCreate+0x311 [c:\winddk\3790.1830\Sfilter\Sfilter.c @ 6917]
f7812b3c 805b4642 817d2360 00000000 814bbe30 nt!IoBuildPartialMdl+0xed
f7812bc4 805b0b23 00000000 f7812c04 00000040 nt!NtDuplicateObject+0x146e
f7812c18 8056b11d 00000000 00000000 5b632501 nt!ObOpenObjectByName+0xeb
f7812c94 8056ba94 00b3ec70 00100080 00b3ec10 nt!IoCreateDevice+0x753
f7812cf0 8056e166 00b3ec70 00100080 00b3ec10 nt!IoCreateFile+0x8e
f7812d30 8053d808 00b3ec70 00100080 00b3ec10 nt!NtCreateFile+0x30
f7812e2c 769b0155 001522c8 0000e7a6 00000000 nt!KeReleaseInStackQueuedSpinLockFromDpcLevel+0xb14
f7812e60 769adb7f 0000cdb0 00000000 769d8a5d ole32!CoCreateInstance+0x692
f7812e6c 769d8a5d 0016cda8 00003098 00000000 ole32!IsValidInterface+0x756
00000000 00000000 00000000 00000000 00000000 ole32!CoQueryProxyBlanket+0xd69


FOLLOWUP_IP:
Ntfs+7d6a
f9719d6a 80befc00000000  cmp     byte ptr [esi+0FCh],0

SYMBOL_STACK_INDEX:  1

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  Ntfs.sys

SYMBOL_NAME:  Ntfs+7d6a

STACK_COMMAND:  .cxr 0xfffffffff7812318 ; kb

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

How did you solve it?
I estimate memory leaking may exist in your code.
for example,you didn't free related memory after an error occur.

!process 0 7
!stacks