Welcome onboard, Olivers.
As far as I am seeing, it is the storage access issue. Let me explain ....
Code:
CHKIMG_EXTENSION: !chkimg -lo 50 -d !Ntfs
fffff88001742001-fffff88001742008 8 bytes - Ntfs! ?? ::NNGAKEGL::`string'+1fea
[ 48 83 c1 68 48 8d 95 e8:00 00 00 00 00 00 00 00 ]
fffff8800174200c-fffff8800174200e 3 bytes - Ntfs! ?? ::NNGAKEGL::`string'+1ff5 (+0x0b)
[ 41 b8 38:00 00 00 ]
fffff88001742012-fffff88001742017 6 bytes - Ntfs! ?? ::NNGAKEGL::`string'+1ffb (+0x06)
[ e8 99 db f1 ff eb:00 00 00 00 00 00 ]
fffff88001742019-fffff8800174208f 119 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2002 (+0x07)
[ 48 83 c4 58 5d 5b c3 53:00 00 00 00 00 00 00 00 ]
fffff88001742093-fffff88001742096 4 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2083 (+0x7a)
[ f0 83 80 88:00 00 00 00 ]
fffff8800174209a-fffff880017420a7 14 bytes - Ntfs! ?? ::NNGAKEGL::`string'+208a (+0x07)
[ ff 48 8b 48 70 f0 83 41:00 00 00 00 00 00 00 00 ]
fffff880017420aa-fffff880017420c1 24 bytes - Ntfs! ?? ::NNGAKEGL::`string'+209a (+0x10)
[ 74 17 45 33 c9 45 33 c0:00 00 00 00 00 00 00 00 ]
fffff880017420c3-fffff880017420db 25 bytes - Ntfs! ?? ::NNGAKEGL::`string'+20b3 (+0x19)
[ 48 83 c4 40 5f 5d 5b c3:00 00 00 00 00 00 00 00 ]
fffff880017420df-fffff880017420e4 6 bytes - Ntfs! ?? ::NNGAKEGL::`string'+20d5 (+0x1c)
[ e8 bc b1 fc ff eb:00 00 00 00 00 00 ]
fffff880017420e6-fffff880017420fb 22 bytes - Ntfs! ?? ::NNGAKEGL::`string'+20dc (+0x07)
[ 48 83 c4 50 5d c3 55 48:00 00 00 00 00 00 00 00 ]
fffff880017420ff-fffff88001742104 6 bytes - Ntfs! ?? ::NNGAKEGL::`string'+20fc (+0x19)
[ e8 9c b1 fc ff eb:00 00 00 00 00 00 ]
fffff88001742106-fffff88001742117 18 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2103 (+0x07)
[ 48 83 c4 50 5d c3 55 48:00 00 00 00 00 00 00 00 ]
fffff8800174211b-fffff8800174211d 3 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2120 (+0x15)
[ 48 8b 8d:00 00 00 ]
fffff8800174211f - Ntfs! ?? ::NNGAKEGL::`string'+2124 (+0x04)
[ 03:00 ]
fffff88001742122-fffff8800174212b 10 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2127 (+0x03)
[ e8 79 b1 fc ff 4c 8d 9d:00 00 00 00 00 00 00 00 ]
fffff8800174212e-fffff8800174213f 18 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2133 (+0x0c)
[ 48 8b 4d 70 49 3b cb 74:00 00 00 00 00 00 00 00 ]
fffff88001742141-fffff88001742153 19 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2146 (+0x13)
[ 48 83 c4 60 5d c3 90 55:00 00 00 00 00 00 00 00 ]
fffff88001742157-fffff8800174215a 4 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2162 (+0x16)
[ 48 8b 8d d0:00 00 00 00 ]
fffff8800174215e-fffff88001742165 8 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2169 (+0x07)
[ e8 6d f1 f1 ff 80 7d 50:00 00 00 00 00 00 00 00 ]
fffff88001742167-fffff88001742170 10 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2172 (+0x09)
[ 74 12 48 8d 55 60 48 8b:00 00 00 00 00 00 00 00 ]
fffff88001742174-fffff88001742179 6 bytes - Ntfs! ?? ::NNGAKEGL::`string'+217f (+0x0d)
[ e8 27 b1 fc ff eb:00 00 00 00 00 00 ]
fffff8800174217b-fffff88001742193 25 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2186 (+0x07)
[ 48 83 c4 50 5d c3 90 90:00 00 00 00 00 00 00 00 ]
fffff88001742197-fffff8800174219f 9 bytes - Ntfs! ?? ::NNGAKEGL::`string'+21a6 (+0x1c)
[ e8 04 b1 fc ff 48 8b 8d:00 00 00 00 00 00 00 00 ]
fffff880017421a3-fffff880017421ae 12 bytes - Ntfs! ?? ::NNGAKEGL::`string'+21b2 (+0x0c)
[ 48 85 c9 74 08 ff 15 e2:00 00 00 00 00 00 00 00 ]
fffff880017421b0-fffff880017421d2 35 bytes - Ntfs! ?? ::NNGAKEGL::`string'+21bf (+0x0d)
[ 48 83 c4 50 5d c3 90 90:00 00 00 00 00 00 00 00 ]
fffff880017421d4-fffff880017421db 8 bytes - Ntfs! ?? ::NNGAKEGL::`string'+21e8 (+0x24)
[ 48 8d 55 70 48 8b 8d d0:00 00 00 00 00 00 00 00 ]
fffff880017421df-fffff880017421e4 6 bytes - Ntfs! ?? ::NNGAKEGL::`string'+21f3 (+0x0b)
[ e8 bc b0 fc ff eb:00 00 00 00 00 00 ]
fffff880017421e6-fffff8800174222e 73 bytes - Ntfs! ?? ::NNGAKEGL::`string'+21fa (+0x07)
[ 48 83 c4 50 5d c3 55 57:00 00 00 00 00 00 00 00 ]
fffff88001742230-fffff88001742255 38 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2255 (+0x4a)
[ 48 83 c4 38 5f 5d c3 90:00 00 00 00 00 00 00 00 ]
fffff88001742259-fffff88001742261 9 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2284 (+0x29)
[ 74 16 33 d2 48 8b 8f 18:00 00 00 00 00 00 00 00 ]
fffff88001742264-fffff8800174226d 10 bytes - Ntfs! ?? ::NNGAKEGL::`string'+228f (+0x0b)
[ e8 ff 17 f8 ff 48 83 a7:00 00 00 00 00 00 00 00 ]
fffff88001742271-fffff8800174227d 13 bytes - Ntfs! ?? ::NNGAKEGL::`string'+229c (+0x0d)
[ 48 8b 4d 50 48 85 c9 74:00 00 00 00 00 00 00 00 ]
fffff8800174227f-fffff88001742290 18 bytes - Ntfs! ?? ::NNGAKEGL::`string'+22aa (+0x0e)
[ 48 8b 4d 48 48 85 c9 74:00 00 00 00 00 00 00 00 ]
fffff88001742292-fffff880017422ab 26 bytes - Ntfs! ?? ::NNGAKEGL::`string'+22bd (+0x13)
[ 48 83 c4 38 5f 5d c3 90:00 00 00 00 00 00 00 00 ]
fffff880017422af-fffff880017422b4 6 bytes - Ntfs! ?? ::NNGAKEGL::`string'+22de (+0x1d)
[ e8 ec af fc ff eb:00 00 00 00 00 00 ]
fffff880017422b6-fffff880017422c7 18 bytes - Ntfs! ?? ::NNGAKEGL::`string'+22e5 (+0x07)
[ 48 83 c4 50 5d c3 55 48:00 00 00 00 00 00 00 00 ]
fffff880017422cb-fffff880017422d2 8 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2301 (+0x15)
[ 48 8b 01 8b 08 89 8d e0:00 00 00 00 00 00 00 00 ]
fffff880017422d6-fffff880017422e5 16 bytes - Ntfs! ?? ::NNGAKEGL::`string'+230c (+0x0b)
[ ff 15 bc 42 f5 ff 33 c9:00 00 00 00 00 00 00 00 ]
fffff880017422e7-fffff8800174230c 38 bytes - Ntfs! ?? ::NNGAKEGL::`string'+231d (+0x11)
[ 48 83 c4 50 5d c3 90 90:00 00 00 00 00 00 00 00 ]
fffff8800174230e-fffff8800174231e 17 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2350 (+0x27)
[ 48 83 c4 50 5d c3 55 48:00 00 00 00 00 00 00 00 ]
fffff88001742320-fffff88001742333 20 bytes - Ntfs! ?? ::NNGAKEGL::`string'+236e (+0x12)
[ 74 1f 48 8d 0d 7f bc f6:00 00 00 00 00 00 00 00 ]
fffff88001742336-fffff88001742339 4 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2384 (+0x16)
[ 48 8b 85 a0:00 00 00 00 ]
fffff8800174233d-fffff88001742352 22 bytes - Ntfs! ?? ::NNGAKEGL::`string'+238b (+0x07)
[ 49 89 43 30 48 8b 4d 60:00 00 00 00 00 00 00 00 ]
fffff88001742354-fffff88001742376 35 bytes - Ntfs! ?? ::NNGAKEGL::`string'+23a2 (+0x17)
[ 48 83 c4 50 5d c3 90 90:00 00 00 00 00 00 00 00 ]
fffff88001742378-fffff8800174237b 4 bytes - Ntfs! ?? ::NNGAKEGL::`string'+23cb (+0x24)
[ 48 8d 95 d0:00 00 00 00 ]
fffff8800174237f-fffff88001742382 4 bytes - Ntfs! ?? ::NNGAKEGL::`string'+23d2 (+0x07)
[ 48 8b 8d b8:00 00 00 00 ]
fffff88001742386-fffff8800174238b 6 bytes - Ntfs! ?? ::NNGAKEGL::`string'+23d9 (+0x07)
[ e8 15 af fc ff eb:00 00 00 00 00 00 ]
fffff8800174238d-fffff880017423ab 31 bytes - Ntfs! ?? ::NNGAKEGL::`string'+23e0 (+0x07)
[ 48 83 c4 50 5d c3 90 53:00 00 00 00 00 00 00 00 ]
fffff880017423af-fffff880017423b4 6 bytes - Ntfs! ?? ::NNGAKEGL::`string'+2408 (+0x22)
[ e8 ec ae fc ff eb:00 00 00 00 00 00 ]
fffff880017423b6-fffff880017423cb 22 bytes - Ntfs! ?? ::NNGAKEGL::`string'+240f (+0x07)
[ 48 83 c4 58 5d 5b c3 90:00 00 00 00 00 00 00 00 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view entire output.
3678 errors : !Ntfs (fffff88001742001-fffff88001742ffe)
3678 errors : !Ntfs. So it is visible that the storage access (represented by NT file system driver Ntfs.sys) is highly violated here. But what is causing it?
Acronis True Image Snapshot Manager driver is failing here ....
Code:
fffff880`0b90a458 fffff880`02182dc2Unable to load image \SystemRoot\system32\DRIVERS\snapman.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for snapman.sys
*** ERROR: Module load completed but symbols could not be loaded for snapman.sys
snapman+0x25dc2
Also Acronis Try&Decide and Restore Points Volume Filter Driver .....
Code:
fffff880`0b90a0b8 fffff880`020adaa0Unable to load image \SystemRoot\system32\DRIVERS\tdrpman.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for tdrpman.sys
*** ERROR: Module load completed but symbols could not be loaded for tdrpman.sys
tdrpman+0xacaa0
Also Acronis Storage Filter Management Driver .......
Code:
fffff880`0b90a098 fffff880`01fd73e6Unable to load image \SystemRoot\system32\DRIVERS\fltsrv.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for fltsrv.sys
*** ERROR: Module load completed but symbols could not be loaded for fltsrv.sys
fltsrv+0x73e6
In such a situation, I would suggest you to uninstall Acronis. Uninstall the following ...
Code:
Start Menu\Programs\Acronis
Start Menu\Programs\Acronis\True Image
Start Menu\Programs\Acronis\True Image\Tools and Utilities
Start Menu\Programs\Acronis\True Image 2013 Plus Pack
You have 29 items at startup. Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.
- Click on the Start button
- Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
- Select the “Startup” tab.
- Deselect all items other than the antivirus.
- Apply > OK
- Accept then restart.
Let us know the results.
_______________________________________________________________
BSOD ANALYSIS:
Code:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7A, {fffff6fc4000ba10, ffffffffc0000056, 2ff169860, fffff88001742544}
GetPointerFromAddress: unable to read from fffff800034bb278
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
Followup: memory_corruption
---------
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in. Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: fffff6fc4000ba10, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffffc0000056, error status (normally i/o status code)
Arg3: 00000002ff169860, current process (virtual address for lock type 3, or PTE)
Arg4: fffff88001742544, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)