BSOD Windows 7 ntkrnlpa.exe and ntfs.sys

JackFlash · 31 Aug 2014

Hi

Ive been working on a friends pc on and off for a couple of months. It was making really loud whining sounds, a bit like a dial up modem used to. A few BSODs here and there. I think it originated with bad graphics card drivers. He has a RADEON HD 5770 card. He didnt have a Win 7 disc, so I downloaded one from digital river but it wouldnt take it. Kept crashing during a transferring files stage. Spent hours trawling the web, found a developer who had the same issue, ran some windows system file fix tool and it repaired windows.

Graphics card and all other drivers are ok (i think!) and the sound has gone. But, its had a few BSODs recently. My mate isnt at the pc when it happens, he just comes back, and when he wakes his machine it says System has recovered from a serious error, or words to that effect.

Ive run bleuscreenviewer and since the reinstall of windows, the first 2 BSODs show ntfs.sys as driver causing it. 3rd one was ntkrnlpa.exe.

Ive been working on it today, and after waiting all day for scans etc to finish, ive registered here as this was on of the better forums ive visited for these issues, and im just looking for a heads up as to where to look to fix this. not bothered if its new hardware, drivers, whaetevr, i just need to be confident it will stay fixed. not forever, just fixed from the current cause of BSODs.

I ran memtest for 6 full passes, took 6 hours. no errors.
Ive run sfc /scannow - no errors
I turned on verifier.exe and while this was on, each time i plugged in a usb stick, it BSODs. I dont think im worried about these most recent 2 BSODs if having verifier on caused them.
Ive also run a check disk, didnt notice any errors, but if you need to find a log file or something, let me know.

Ive had a quick look at what to do before posting a BSOD thread, and done option 1 and 2 and attached the results.

Any help appreciated.

Cheers

essenbe · 31 Aug 2014

JackFlask, I'l show you what I get from looking at your dump files.

2 dumps listed

Code:

 lmvm fltsrv
start    end        module name
8618a000 861a1000   fltsrv   T (no symbols)           
    Loaded symbol image file: fltsrv.sys
    Image path: \SystemRoot\system32\DRIVERS\fltsrv.sys
    Image name: fltsrv.sys
    Timestamp:        Mon May 13 04:41:02 2013 (5190B52E)
    CheckSum:         000236CE
    ImageSize:        00017000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

That is the Acronis Storage Filter Management Drive

2 listed this

Code:

SYMBOL_NAME:  ZEROED_PAGE_CORRUPTED
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: hardware
IMAGE_NAME: hardware_ram
DEBUG_FLR_IMAGE_TIMESTAMP:  0

Code:

Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, ac0d3854, ac0d3430, 8b49d900}
Probably caused by : memory_corruption
Followup: memory_corruption

Please Run Memtest86+

Information

Please download from this site only http://www.memtest.org/ in the middle of the page are the Download links, you can download the ISO.zip or the Auto USB Flash Drive installer.zip

Extract the Zip file. If you chose the ISO image, burn it to a CD using Windows Disk Image Burner or any Image burner you may have. If you downloaded the Auto USB installer, extract it, insert your USB 2.0 Flash Drive and take note of the drive letter. Run the installer, select the Flash Drive Letter, check the format box and press next. It will install memtest86+ to a flash drive. You can use either V4.20 or V5.01. Boot from your selected media. If you use V5.01 it will tell you to press certain buttons at the start, please press no buttons. The test will begin on it's own and continue to run until you stop it. It needs to run for 8 complete passes or until you receive an error. If you receive an error, stop the test. Even 1 error is a fail. Each pass tests a different part of the ram and each of the 10 tests in each pass tests something different. It takes a minimum of 8 passes to completely test the ram, more passes are better. It is quite a long test and will take several hours depending on how much ram you have. Due to the time length it is best to run overnight. If you have any questions, please do not hesitate to ask

JackFlash · 31 Aug 2014

hi
i ran memtest for 6 hours so it completed 6 full passes. no errors found

JackFlash · 31 Aug 2014

just read it again. i can do it for 8 tests overnight? when i was googling about this, i saw something saying 6-8 passes. i was bored silly. tbh, i ran 1, then tripped on power cable, so pc died. then ran 6 full tests

essenbe · 31 Aug 2014

You can do it or not, it's up to you. But, from everything I know about the test, 8 Passes are required to completely test the ram. I know a lot of places say 6. I just go back to the 2 dump files that list the cause as Memory corruption and know that ram can cause every other error you see. If the ram is causing the problems, nothing in the dump files is reliable.

So, it's up to you. If you do it and it passes or don't want to do it again, I want you to do 2 things for me.

Open a elevated command prompt ( click start, type cmd in the search box, right click on the cmd entry and select run as administrator) in the black box that opens, copy/paste sfc /scannow. If you decide to type it, notice the space between the sfc and the /. It is a system file checker which will scan your system files and attempt to correct any missing or corrupt files. What we want are the results to say windows found no integrity violations. If it says files were found but could not be repaired, close the box, reboot and run it again, after opening the administrative command prompt. You may have to reboot and run it three times for it to repair all system files. If it can't repair them after 3 reboots, let us know.

Before you start the next one be sure and create a restore point. Link is in the instructions.

Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours of actual use or the occurrence of the next crash, whichever is earlier.

Information

What is Driver Verifier:
It puts stress on the drivers, and therefore it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How we know that DV is enabled:
It will make the system bit slow and sluggish.

Warning

Before enabling DV, make it sure that you have earlier System restore points.

If there are no Restore points, make a System Restore Point manually before enabling DV.

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

JackFlash · 31 Aug 2014

hi, thanks for the reply

I did run sfc /scannow and although i said it came back no errors, the actual message was what you posted, no integrity violations. im downloading something slowly atm, but when thats done, ill run memtest again and see how many passes its done by the time i go to work in the morning. once its done a minimum of 8, ill stop it, and let you know what happened.

after that, ill arrange to give it back to my mate with verifier turned on, and tell him to use it like normal until it crashes, and then ill get you guys more log files

cheers

essenbe · 31 Aug 2014

Sound good. Just let me know.

JackFlash · 01 Sep 2014

hi essenbe

ok, so today i left memtest running while i was at work. i went to the pub after work, and ended up staying there all night :)

memtest had a good run, 13 passes completed, 0 integrity violations.

ive cancelled that and now its booted up, ive turned verifier on.

do you have any more advice for what i can do, or should i just give the pc back to my mate, with verifier on and wait for the next blue screen? it will happen, im sure of that. i just dont want to get to a position where i tell my mate to replace graphics card, or ram, or motherboard and then for pc to blue screen again.

any advice greatly appreciated. even though i have had a skinful of beer, im cooking chicken atm so will be about for a while

cheers

essenbe · 01 Sep 2014

At this point Verifier needs to run while being used as you would normally use it, for 24 hours or until you get a BSOD. Once one of those 2 things happens, we'll decide where to go from there. When you enabled it, you did sort and only check non Microsoft drivers didn't you? We want all the Microsoft drivers running fine, but stress the non Microsoft drivers. I think I explained that right.

JackFlash · 01 Sep 2014

hi
ive turned it off and rebooted now. before i go to sleep, i need to know ive set it up right.

i start up verifier.exe and it gives me a few options. i didnt see any specifically related to microsoft. there was the deafult option, called standard settings, custom settings for developers, delete settings, display existing settings, or display currently verified drivers.

which option do i need to choose?

cheers again