BSOD Windows 7 ntkrnlpa.exe and ntfs.sys

[JackFlash]

Hi

Ive been working on a friends pc on and off for a couple of months. It was making really loud whining sounds, a bit like a dial up modem used to. A few BSODs here and there. I think it originated with bad graphics card drivers. He has a RADEON HD 5770 card. He didnt have a Win 7 disc, so I downloaded one from digital river but it wouldnt take it. Kept crashing during a transferring files stage. Spent hours trawling the web, found a developer who had the same issue, ran some windows system file fix tool and it repaired windows.

Graphics card and all other drivers are ok (i think!) and the sound has gone. But, its had a few BSODs recently. My mate isnt at the pc when it happens, he just comes back, and when he wakes his machine it says System has recovered from a serious error, or words to that effect.

Ive run bleuscreenviewer and since the reinstall of windows, the first 2 BSODs show ntfs.sys as driver causing it. 3rd one was ntkrnlpa.exe.

Ive been working on it today, and after waiting all day for scans etc to finish, ive registered here as this was on of the better forums ive visited for these issues, and im just looking for a heads up as to where to look to fix this. not bothered if its new hardware, drivers, whaetevr, i just need to be confident it will stay fixed. not forever, just fixed from the current cause of BSODs.

I ran memtest for 6 full passes, took 6 hours. no errors.
Ive run sfc /scannow - no errors
I turned on verifier.exe and while this was on, each time i plugged in a usb stick, it BSODs. I dont think im worried about these most recent 2 BSODs if having verifier on caused them.
Ive also run a check disk, didnt notice any errors, but if you need to find a log file or something, let me know.

Ive had a quick look at what to do before posting a BSOD thread, and done option 1 and 2 and attached the results.

Any help appreciated.

Cheers

 

[essenbe]

JackFlask, I'l show you what I get from looking at your dump files.

2 dumps listed

 lmvm fltsrv
start    end        module name
8618a000 861a1000   fltsrv   T (no symbols)           
    Loaded symbol image file: fltsrv.sys
    Image path: \SystemRoot\system32\DRIVERS\fltsrv.sys
    Image name: [COLOR=red]fltsrv.sys[/COLOR]
    Timestamp:        Mon [COLOR=red]May 13 04:41:02 2013[/COLOR] (5190B52E)
    CheckSum:         000236CE
    ImageSize:        00017000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

That is the Acronis Storage Filter Management Drive

2 listed this

SYMBOL_NAME[COLOR=red]:  ZEROED_PAGE_CORRUPTED[/COLOR]
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: [COLOR=red]hardware[/COLOR]
IMAGE_NAME: [COLOR=red]hardware_ram[/COLOR]
DEBUG_FLR_IMAGE_TIMESTAMP:  0

Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, ac0d3854, ac0d3430, 8b49d900}
Probably caused by :[COLOR=red] memory_corruption[/COLOR]
Followup: memory_corruption

Please Run Memtest86+

   Information

Please download from this site only http://www.memtest.org/ in the middle of the page are the Download links, you can download the ISO.zip or the Auto USB Flash Drive installer.zip

Extract the Zip file. If you chose the ISO image, burn it to a CD using Windows Disk Image Burner or any Image burner you may have. If you downloaded the Auto USB installer, extract it, insert your USB 2.0 Flash Drive and take note of the drive letter. Run the installer, select the Flash Drive Letter, check the format box and press next. It will install memtest86+ to a flash drive. You can use either V4.20 or V5.01. Boot from your selected media. If you use V5.01 it will tell you to press certain buttons at the start, please press no buttons. The test will begin on it's own and continue to run until you stop it. It needs to run for 8 complete passes or until you receive an error. If you receive an error, stop the test. Even 1 error is a fail. Each pass tests a different part of the ram and each of the 10 tests in each pass tests something different. It takes a minimum of 8 passes to completely test the ram, more passes are better. It is quite a long test and will take several hours depending on how much ram you have. Due to the time length it is best to run overnight. If you have any questions, please do not hesitate to ask​

 

[JackFlash]

hi
i ran memtest for 6 hours so it completed 6 full passes. no errors found

 

[JackFlash]

just read it again. i can do it for 8 tests overnight? when i was googling about this, i saw something saying 6-8 passes. i was bored silly. tbh, i ran 1, then tripped on power cable, so pc died. then ran 6 full tests

 

[essenbe]

You can do it or not, it's up to you. But, from everything I know about the test, 8 Passes are required to completely test the ram. I know a lot of places say 6. I just go back to the 2 dump files that list the cause as Memory corruption and know that ram can cause every other error you see. If the ram is causing the problems, nothing in the dump files is reliable.

So, it's up to you. If you do it and it passes or don't want to do it again, I want you to do 2 things for me.

Open a elevated command prompt ( click start, type cmd in the search box, right click on the cmd entry and select run as administrator) in the black box that opens, copy/paste sfc /scannow. If you decide to type it, notice the space between the sfc and the /. It is a system file checker which will scan your system files and attempt to correct any missing or corrupt files. What we want are the results to say windows found no integrity violations. If it says files were found but could not be repaired, close the box, reboot and run it again, after opening the administrative command prompt. You may have to reboot and run it three times for it to repair all system files. If it can't repair them after 3 reboots, let us know.

Before you start the next one be sure and create a restore point. Link is in the instructions.

Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours of actual use or the occurrence of the next crash, whichever is earlier.

   Information

What is Driver Verifier:
It puts stress on the drivers, and therefore it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How we know that DV is enabled:
It will make the system bit slow and sluggish.

   Warning

Before enabling DV, make it sure that you have earlier System restore points.

If there are no Restore points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[JackFlash]

hi, thanks for the reply

I did run sfc /scannow and although i said it came back no errors, the actual message was what you posted, no integrity violations. im downloading something slowly atm, but when thats done, ill run memtest again and see how many passes its done by the time i go to work in the morning. once its done a minimum of 8, ill stop it, and let you know what happened.

after that, ill arrange to give it back to my mate with verifier turned on, and tell him to use it like normal until it crashes, and then ill get you guys more log files

cheers

 

[essenbe]

Sound good. Just let me know.

 

[JackFlash]

hi essenbe

ok, so today i left memtest running while i was at work. i went to the pub after work, and ended up staying there all night

memtest had a good run, 13 passes completed, 0 integrity violations.

ive cancelled that and now its booted up, ive turned verifier on.

do you have any more advice for what i can do, or should i just give the pc back to my mate, with verifier on and wait for the next blue screen? it will happen, im sure of that. i just dont want to get to a position where i tell my mate to replace graphics card, or ram, or motherboard and then for pc to blue screen again.

any advice greatly appreciated. even though i have had a skinful of beer, im cooking chicken atm so will be about for a while

cheers

 

[essenbe]

At this point Verifier needs to run while being used as you would normally use it, for 24 hours or until you get a BSOD. Once one of those 2 things happens, we'll decide where to go from there. When you enabled it, you did sort and only check non Microsoft drivers didn't you? We want all the Microsoft drivers running fine, but stress the non Microsoft drivers. I think I explained that right.

 

[JackFlash]

hi
ive turned it off and rebooted now. before i go to sleep, i need to know ive set it up right.

i start up verifier.exe and it gives me a few options. i didnt see any specifically related to microsoft. there was the deafult option, called standard settings, custom settings for developers, delete settings, display existing settings, or display currently verified drivers.

which option do i need to choose?

cheers again

 

[essenbe]

Go by this. It should tell you exactly how http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

What is Driver Verifier:
It puts stress on the drivers, and therefore it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How we know that DV is enabled:
It will make the system bit slow and sluggish.

   Warning

Before enabling DV, make it sure that you have created a restore point.
make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[JackFlash]

ok, from startup of verifier, ive selected custom developer option> select individual settings from full list > ticked everything > next > next > select driver names from a list > see a huge list of drivers and ticked all non-microsoft drivers > next > gonna reboot now

 

[JackFlash]

just had a thought. im off to bed soon. will verifier load up with same settings after a reboot? im gonna turn off in the morning, go to work, and then drop off the pc. or do i need to select all the settings from previous post again, reboot, keep pc off, and then give back to my mate, and tell him to keep it on and use as normal until it blue screens?

once it does blue screen, do i need to get you a log file or something after?

cheers, im crashing now, so will be up and hungover in about 5 hours time.

 

[essenbe]

Don't use low resolution setting

View attachment 331616

 

[essenbe]

It will stay on until you turn it off. Remember to tell your Mate that it will seem slow and sluggish with verifier on, but use it to do whatever you usually do or anything you want. We want it to be used for 24 hours or until it crashes. The point of verifier is to make it crash and trap the offending driver, hopefully. Just be sure youhave created a restore point before enabling it.

 

[JackFlash]

Hi

My mate has been using his pc with Driver verifier on. It blue screened as soon as he plugged in a USB drive. When I had the machine, it also blue screened twice while I had verifier running and plugged in a usb device.

Would any log files from verifier be of any use in these circumstances? The blue screens that were originally the problem were not happening when usb drives were plugged in and verifier was not running...

 

[essenbe]

Yes, they would. That is the purpose of DV, to make it BSOD and hopefully trap the offending driver. Just post http://www.sevenforums.com/bsod-help-support/96879-blue-screen-death-bsod-posting-instructions.html

 

[JackFlash]

hi. i ran the 2 options for getting logs. didnt have time to upload them from his pc, i just whacked them in dropbox. not sure why, but it extracted all the files when i put them in dropbox. everything is present in the 2 attachments, just have non standard filenames. cheers for helping

 

[essenbe]

This is the driver it caught. This is several times and I suggest removing it with this https://kb.acronis.com/content/34876

lmvm fltsrv
start    end        module name
85fd2000 85fe9000   fltsrv   T (no symbols)           
    Loaded symbol image file: fltsrv.sys
    Image path: \SystemRoot\system32\DRIVERS\fltsrv.sys
    Image name: fltsrv.sys
    Timestamp:        Mon May 13 04:41:02 2013 (5190B52E)
    CheckSum:         000236CE
    ImageSize:        00017000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Acronis Storage Filter Management Driver

Acronis causes problems with a lot of people and is near impossible to completely remove. In fact, I had it at one point and had to reinstall the OS to get rid of it. One suggestion, there is a setting in Acronis that allows it to take over Windows Backup. Before removing it, reverse that setting where windows backup is primary. Then uninstall the program with the removal tool. Follow those instructions.

I would disable verifier before uninstalling Acronis, then enable it again and see if there are any other misbehaving drivers. This will tell you how to disable it. Much easier than enabling it. http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

 

[JackFlash]

thanks. the only reason the guy got acronis was because his pc was making really strange noises and bluescreening and he had a nightmare reinstalling (or upgrading) windows 7. he now has used acronis to make a full image, so if his pc does die, it will be a doddle to get it back up and running without any updates or config or software to be installed.

i can do as you suggest, thats not a problem, but if the guy was getting blue screens before acronis was installed, is there anything else pointed out in the logs as to what is going on with his pc?

cheers