BSOD for fltmgr.sys

[crashnet]

I have only had 3 BSODs in recent memory, but they have all been in the last month. Two of them happened when the computer was unattended, but the last one briefly flashed on screen and I could read that it was related to fltmgr.sys.

2 out of the 3 crashes occurred in the last 3 days. The only software I installed since the 4th of the month was join.me, by LogMeIn. Skype and evernote were updated after that.

I also ran a sfc /scanow and included CBS.log in the zipped file.

TIA

 

[Arc]

It is Acronis Snapshot Manager that is causing the BSODs. The latest version, 11.5 is in use. At most you can try uninstalling and reinstalling it.

And, You have 28 programs in startup! :shock: Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Let us know what you opted for and what it resulted.

_____________________________________________

BugCheck 50, {fffffa8026ab37dc, 0, fffff80002482d5c, 0}

*** WARNING: Unable to verify timestamp for snapman.sys
*** ERROR: Module load completed but symbols could not be loaded for snapman.sys

Could not read faulting driver name
Probably caused by : snapman.sys ( snapman+2f900 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa8026ab37dc, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002482d5c, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800026ca100
GetUlongFromAddress: unable to read from fffff800026ca1c0
 fffffa8026ab37dc Nonpaged pool

FAULTING_IP: 
nt!IoBuildAsynchronousFsdRequest+2c
fffff800`02482d5c 418a4f4c        mov     cl,byte ptr [r15+4Ch]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  mms.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

TRAP_FRAME:  fffff88019aab830 -- (.trap 0xfffff88019aab830)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000003 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002482d5c rsp=fffff88019aab9c0 rbp=fffff88019aaba70
 r8=fffff8800202f900  r9=0000000000000200 r10=fffffa8026ab3790
r11=0000fffffffff000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!IoBuildAsynchronousFsdRequest+0x2c:
fffff800`02482d5c 418a4f4c        mov     cl,byte ptr [r15+4Ch] ds:00000000`0000004c=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002508de7 to fffff8000248d8c0

STACK_TEXT:  
fffff880`19aab6c8 fffff800`02508de7 : 00000000`00000050 fffffa80`26ab37dc 00000000`00000000 fffff880`19aab830 : nt!KeBugCheckEx
fffff880`19aab6d0 fffff800`0248b9ee : 00000000`00000000 fffffa80`26ab37dc fffff880`19aab900 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4172f
fffff880`19aab830 fffff800`02482d5c : fffffa80`26caaa00 fffff800`00000000 fffffa80`17214670 fffffa80`17214670 : nt!KiPageFault+0x16e
fffff880`19aab9c0 fffff880`0202f900 : 00000000`00000000 00000000`059d0000 fffffa80`26ab3790 00000000`00400000 : nt!IoBuildAsynchronousFsdRequest+0x2c
fffff880`19aaba10 00000000`00000000 : 00000000`059d0000 fffffa80`26ab3790 00000000`00400000 fffff880`19aabab0 : snapman+0x2f900


STACK_COMMAND:  kb

FOLLOWUP_IP: 
snapman+2f900
fffff880`0202f900 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  snapman+2f900

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: snapman

IMAGE_NAME:  snapman.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  54c27838

FAILURE_BUCKET_ID:  X64_0x50_snapman+2f900

BUCKET_ID:  X64_0x50_snapman+2f900

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x50_snapman+2f900

FAILURE_ID_HASH:  {492f7a58-d469-825b-08cd-55d21b4b6ba9}

Followup: MachineOwner
---------

1: kd> lmvm snapman
start             end                 module name
fffff880`02000000 fffff880`0204f000   snapman  T (no symbols)           
    Loaded symbol image file: snapman.sys
    Image path: \SystemRoot\system32\DRIVERS\snapman.sys
    Image name: snapman.sys
    Timestamp:        Fri Jan 23 22:05:04 2015 (54C27838)
    CheckSum:         00055D1F
    ImageSize:        0004F000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[crashnet]

What about now, is acronis still responsible? I uninstalled then reinstalled Acronis Backup 11.5. It is the latest version.

TIA!

 

[Arc]

The latest crash dump is not saying anything precisely.

BugCheck 18, {0, fffffa8014ab0cd0, 2, fffffffffffffff0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+487a1 )

Followup: MachineOwner
---------

You have 22 startup items, which might have some implication there. Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Then see how it goes. Let us know for any further BSOD.

 

[crashnet]

The latest crash dump is not saying anything precisely.

BugCheck 18, {0, fffffa8014ab0cd0, 2, fffffffffffffff0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+487a1 )

Followup: MachineOwner
---------

You have 22 startup items, which might have some implication there. Free up the startup. Windows does not need any other program to auto start with it,

I am very aware of the startup programs I have in place and I regularly trim them down. The 22 are either manufacturer mandated or programs that I need. What Windows needs is only what Windows needs - I am not Windows

Joke aside, the machine has been running smooth for years and only now the problem started - the startup list has been large for all these years.

I will try to post the next time it occurs.

Thank you again.

 

[Arc]

I am very aware of the startup programs I have in place and I regularly trim them down. The 22 are either manufacturer mandated or programs that I need. What Windows needs is only what Windows needs - I am not Windows

Ah ..... well. It is your computer, and you will decide how you will run it.

But, bad decisions usually have bad impacts, earlier or later.

Anyway, as you are reluctant to take my suggestions, I will try to redirect this issue to some better people.

 

[ICIT2LOL]

I am no expert but agree with Arc that is far too many start up items - after all it is only start up - I start up with nothing ticked on all my machines and before I got rid of the bloatware did the same thing and it made not one scrap of difference to how the machine worked at start up. But as Arc said your machine I suppose but all the same if you will not try it how will you know?

That aside a few searches has me wondering if it would not be a good idea to run a memtest at least it would rule out that cause especially if the machine is stopping when in idle.

MEMTEST

The memtest you will need to make abootable disk / stick and set the BIOS to boot from the optical or USB and itwill take a fair time to run- some leave it overnight.

This is the current version http://www.memtest.org/ please use thisas any other test is useless - the Windows one sadly is not worth even athought about.

But one thing is very important you mustlet the test run for at least 8 passes any less and the findings are no good. Now if errors come upstraight away then you can stop it - see my pics. Now if there are errors andyou have more than one stick of RAM in then you will need to test each stick ieremove the sticks and replace stick 1 in slot 1 and test no errors do thesame in slot 2 with stick 1 no errors then repeat the process with stick 2 -that will show up the faulty stick - the other thing is it could be a faultyslot but most unusual. With more than two sticks the process is even longer asone may realize.

It is a very lengthy and tedious processbut worth it if you have errors.

 

[Boozad]

programs that I need. What Windows needs is only what Windows needs - I am not Windows

I'll repeat what Arc said; it's your machine and you can do as you wish with it, but a bloated Startup can easily lead to problems, it's why http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html was written. Programs that you need can be started manually whenever you want them to as soon as you're booted into 7, nothing's stopping you. Your Startup will be cleaner and quicker and I daresay you do not need 22 programs running as soon as you hit your desktop.
This is my Startup below, my 7 install is exactly the same.

View attachment 365992
​

I do have to add that in refusing to listen to some of the best advice offered on here regarding your Startup you've also turned away one of the very best BSOD analysts we have. Troubleshooting steps are offered for a reason, if you refuse to to follow them there's next to nothing we can do to help.

 

[gregrocker]

You don't need any Startups except your AV and any sync, maybe gagdets or stickies if you like them. Any others are freeloaders on System resources. You refer to "manufacturer mandated" which would probably include every manufacturer if they had their way because most want an "Updater" monitoring your system to spy and sell your system info stats.

I specialize in cleaning up factory bloatware and have a tutorial below that is a major web publication involving a dozen steps to trim and then repair the damage it's done. Yet the most important step by far is to turn off the 20+ average startups that the manufacturer lards into the system. That alone will improve performance so profoundly that many don't care to do anything else.

The Clean Boot tutorial was popular in XP when System startups were not separated out, but that was before the rise of this as undisputed top tech forums in history and the fundamental principle that you don't need any startups other than AV except those that you yourself choose because of their convenience. You drive a Ferrari or you drive the Beverly Hillbillies truck with everything including granny's sink.

What settles the issue is that 1.5 million consumers have followed the steps here to Clean Reinstall Windows 7 without a single complaint, not only shucking all the bloatware but confident in not allowing any startup freeloaders whatsoever. They have the best installs of Win7 in the world.

Please do not make rash statements about things you should be here to learn about, from the top experts in the world.

 

[ICIT2LOL]

Well if nothing else I found on my main machine this morning some things I deleted a long time ago but they are still listed in the start up tab in msconfig see pics

So some searching needs doing methinks