BOSD (random + shutdown) - ntoskrnl.exe, ntfs.sys

[Srono]

Hi experts,

I'm helping a friend to fix the laptop with BOSD. I tried to google and went thru many threads but i didnt got good result.

+ Laptop is MacbookAir 2011, core I7, installed windows 7 professional (OEM version).
+ The BOSD is quite random when using but almost all the time when i try to shut it down.

When i used Bluescreen to check the dump file, it shows the issue with NTFS.sys and NTOSKRNL.exe. I tried to use verified to test this 2 drivers and it crashed all the times when i start windows.

I ran CHKDSK /r but it didnt fix the problem. I tried mem test too but the result was good.

I appreciate all inputs from experts here. Attached is the dump files.

Many thanks!

 

[Srono]

I attached Windows_NT6_BSOD_jcgriff2.zip.

Thanks!

 

[writhziden]

One of the verifier enabled crashes implicates the Parallels Boot Camp Helper driver as the cause. Recommend removing the offending software.

Start Menu\Programs\Parallels Shared Applications	LiXue-PC\Li Xue:Start Menu\Programs\Parallels Shared Applications	LiXue-PC\Li Xue

There were also Windows files implicated in some crashes. Recommend checking for Windows corruption.

• If you are overclocking any hardware, please stop.
  
  
• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html.
  For any drives that do not give the message:
  Windows has checked the file system and found no problems
  run disk check again as above. In other words, if it says:
  Windows has made corrections to the file system
  after running the disk check, run the disk check again.
  
  
• Check Windows for corruption. Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations. Use OPTION THREE of http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html to provide us with the sfcdetails.txt file if errors occur.

 

[Srono]

Hi,

I uninstalled Parallels Boot camp, and I also uninstalled Paragon HFS because I saw its driver caused dump in another time.
I no longer have BSOD when shutting down and i havent seen BSOD so far.

However, when i use verifier to NTFS.sys and NTOSKRL.exe, it will still crash every boot up.

I will update the result asap.

Thanks writhziden for your help!

 

[writhziden]

Verifying system drivers will cause false positive crashes. The following is what I usually recommend for Verifier. For now, disable Verifier and see how the system responds for a few days. Report back after that time.

• An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
  a. Backup your system and user files
  b. Create a system restore point
  c. If you do not have a Windows 7 DVD, Create a system repair disc
  d. In Windows 7:
  

  • Click the Start Menu
  • Type verifier in Search programs and files (do not hit enter)
  • Right click verifier and click Run as administrator
  • Put a tick in Create custom settings (for code developers) and click next
  • Put a tick in Select individual settings from a full list and click next
  • Set up the individual settings as in the image and click next
    View attachment 212064
  • Put a tick in Select driver names from a list
  • Put a tick next to all non-Microsoft drivers.
  • Click Finish.
  • Restart your computer.

  
  If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using http://www.sevenforums.com/tutorials/700-system-restore.html OPTION TWO.
  
  Thanks to zigzag3143 for contributing to the Verifier steps.
  If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.​
  The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.
  
  When you are ready to disable Verifier: Start Menu -> All Programs -> Accessories -> Right click Command Prompt -> Run as administrator -> Type the following command and then Enter:
  verifier /reset​
  -> Restart your computer.