NTFS.SYS causing BSODs on wake/startup (sometimes)

[JonathanTOOKMYNAME]

The problem ----------------
So we have a very frustrating BSOD issue affecting several of our designer's workstations. These workstations were built in-house by myself. It is happening primarily on one workstation and not on others of a similar build, so we'll focus on only one for now and see if its solution applies to the other workstations. So far it seems like it must be a device, driver, or BIOS setting associated with this specific motherboard.

This workstation has been encountering a BSOD on startup and while waking from sleep for over a month. The crash occurs every two to five days, and only when 1) the computer is woken from a sleeping state, or 2) the computer is powered on. Once the displays are awake on the system, the user sees the BSOD message, and the workstation restarts. After it is restarted the user logs in and does not have any issues at all until the BSOD occurs another morning several days later.

The problem description of the crash changes between one of several possibilities, but it is almost always caused by ntfs.sys. That made me think it was related to either our backup program (CrashPlanPRO) or the SSD firmware, driver, etc.

I look forward to hearing your ideas and hopefully getting to the bottom of this. Attached are the minidumps, and the URLs of the actual components in the system from Amazon.


What we've tried -----------
- tested RAM with Memtest86 v4.20 -- no errors were detected after 9 passes and 14 hours of testing
- uninstalled unwanted apps
- updated "Intel Graphics Driver" from x.x.x.4264 to x.x.x.4414 (which also updated the Intel audio driver) via Intel Driver Update Utility
- updated "Intel Z97 Chipset LPC Controller" driver via Device manager
- updated "Intel 9 Series Chipset Family PCI Express Root Port 1 - 8C90" driver via Device Manager
- updated "Intel 9 Series Chipset Family PCI Express Root Port 3 - 8C94" driver via Device Manager
- updated "Intel 9 Series Chipset Family PCI Express Root Port 4 - 8C96" driver via Device Manager
- updated "Intel 9 Series Chipset Family SMBus Host Controller - 8CA2" driver via Device Manager
- updated "NVIDIA Quadro K2000" driver via Device Manager
- updated "Intel Xeon processor E3 - 1200 v3/4th Gen Core processor PCI Express x16 Controller - 0C01" driver via Device Manager
- updated "Intel Xeon processor E3 - 1200 v3/4th Gen Core processor DRAM Controller - 0C00" driver via Device Manager
- verified that the Samsung SSD firmware is up to date and that there are no known compatibility issues via Samsung Magician


System specs ---------------
Video: NVIDIA Quadro K2000 2GB GDDR5 Graphics card
Memory: Kingston HyperX FURY 16GB Kit (2x8GB) 1866MHz DDR3 CL10 DIMM
Motherboard: Gigabyte GA-Z97X-GAMING 3 LGA 1150 Z97 Gaming
CPU: Intel Core i7-4790
SSD: Samsung 850 EVO 250GB 2.5-Inch SATA III Internal SSD
HDD: WD Blue 1TB Desktop 3.5 Inch SATA 6Gb/s 7200rpm
OS: Microsoft Windows 7 Professional SP1 64bit
Power Supply: Corsair CS Series 750 Watt - CS750M


Other notes ----------------
- The biggest difference between the problematic workstations and the others which are not having the problem is that these have an Gigabyte Z97 board and the others have an Asus Z97 board.
- Another difference is that others have an NVIDIA SSD, this has a Samsung SSD.
- One workstation had a similar problem where it would crash at the same time the Antimalware server (Kaspersky Administration Center) would send the WOL signal to prepare the nightly system update cycle. This issue has since stopped on its own.
- It does not seem to matter whether the computer is turning on from a cold boot or if it is being woken after going to sleep -- the issue will simply happen sometimes and not most of the time.
- Initially I sustected that it is caused by Kaspersky Endpoint Security or CrashPlanPRO, but by this point it seems to be related to a system device or its driver as none of the crashes are similar to problems we've seen with those applications in the past.


WhoCrashed output ----------
On Sun 01-Jan-17 17:56:29 your computer crashed
crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\010117-5241-01.dmp
uptime: 21:05:13
This was probably caused by the following module: ntfs.sys (Ntfs! ?? ::FNODOBFM::`string'+0x299D)
Bugcheck code: 0x24 (0x1904FB, 0xFFFFF8800C38DF28, 0xFFFFF8800C38D780, 0xFFFFF88001C36F2A)
Error: NTFS_FILE_SYSTEM
file path: C:\WINDOWS\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates a problem occurred in the NTFS file system.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Sat 31-Dec-16 20:50:17 your computer crashed
crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\123116-5413-01.dmp
uptime: 1 day, 04:41:15
This was probably caused by the following module: ntfs.sys (Ntfs!NtfsRestartIndexEnumeration+0x277)
Bugcheck code: 0x50 (0xFFFFF8A019BFFF88, 0x1, 0xFFFFF800033AD627, 0x0)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\WINDOWS\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Tue 27-Dec-16 22:55:19 your computer crashed
crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\122716-5366-01.dmp
uptime: 15:31:22
This was probably caused by the following module: ntfs.sys (Ntfs! ?? ::FNODOBFM::`string'+0x299D)
Bugcheck code: 0x24 (0x1904FB, 0xFFFFF88008D8DC28, 0xFFFFF88008D8D480, 0xFFFFF88001CE1EC4)
Error: NTFS_FILE_SYSTEM
file path: C:\WINDOWS\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates a problem occurred in the NTFS file system.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Wed 21-Dec-16 22:55:16 your computer crashed
crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\122116-5569-01.dmp
uptime: 15:38:31
This was probably caused by the following module: ntfs.sys (Ntfs! ?? ::FNODOBFM::`string'+0x299D)
Bugcheck code: 0x24 (0x1904FB, 0xFFFFF8800F547A38, 0xFFFFF8800F547290, 0xFFFFF800033C1627)
Error: NTFS_FILE_SYSTEM
file path: C:\WINDOWS\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates a problem occurred in the NTFS file system.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Fri 16-Dec-16 06:44:29 your computer crashed
crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\121616-5475-01.dmp
uptime: 05:53:03
This was probably caused by the following module: dxgkrnl.sys (dxgkrnl!DXGDEVICE:estroyAllocations+0x72D)
Bugcheck code: 0xC2 (0xD, 0xFFFFF8A032F74AC0, 0x4B677844, 0xFFFFFA8015351070)
Error: BAD_POOL_CALLER
file path: C:\WINDOWS\system32\drivers\dxgkrnl.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: DirectX Graphics Kernel
Bug check description: This indicates that the current thread is making a bad pool request.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Wed 14-Dec-16 00:50:16 your computer crashed
crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\121416-5584-01.dmp
uptime: 12:16:10
This was probably caused by the following module: ntfs.sys (Ntfs! ?? ::FNODOBFM::`string'+0x299D)
Bugcheck code: 0x24 (0x1904FB, 0xFFFFF8800AD2E3C8, 0xFFFFF8800AD2DC20, 0xFFFFF8000328C4F4)
Error: NTFS_FILE_SYSTEM
file path: C:\WINDOWS\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates a problem occurred in the NTFS file system.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Sat 10-Dec-16 23:03:04 your computer crashed
crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\121016-5288-01.dmp
uptime: 1 day, 04:25:34
This was probably caused by the following module: ntfs.sys (Ntfs!NtfsCommonClose+0x534)
Bugcheck code: 0xC2 (0x7, 0x109B, 0x1090219, 0xFFFFF8A01D4D3700)
Error: BAD_POOL_CALLER
file path: C:\WINDOWS\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates that the current thread is making a bad pool request.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Thu 08-Dec-16 06:19:01 your computer crashed
crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\120816-6318-01.dmp
uptime: 3 days, 00:00:23
This was probably caused by the following module: ntfs.sys (Ntfs! ?? ::FNODOBFM::`string'+0x299D)
Bugcheck code: 0x24 (0x1904FB, 0xFFFFF88024A063C8, 0xFFFFF88024A05C20, 0xFFFFF8000308A4F4)
Error: NTFS_FILE_SYSTEM
file path: C:\WINDOWS\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates a problem occurred in the NTFS file system.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Thu 01-Dec-16 07:46:56 your computer crashed
crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\120116-6505-01.dmp
uptime: 1 day, 19:14:30
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
Bugcheck code: 0x1A (0x31, 0xFFFFFA800D5B6E20, 0xFFFFF8800D939000, 0xFFFFF8A011F8C401)
Error: MEMORY_MANAGEMENT
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules. This problem might also be caused because of overheating (thermal issue).
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Fri 25-Nov-16 07:28:30 your computer crashed
crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\112516-6068-01.dmp
uptime: 11 days, 01:18:09
This was probably caused by the following module: fltmgr.sys (fltmgr!FltpAllocateFileNameInformation+0x2D)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF800031B1627, 0xFFFFF8800CE0B3E0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\WINDOWS\system32\drivers\fltmgr.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Microsoft Filesystem Filter Manager
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.

 

[JonathanTOOKMYNAME]

Crashed again this weekend. Does anyone out there have any insight at all? Or should I just swap out the motherboard and hope the problem goes with it?

 

[TrainableMan]

NTFS would seem to point to the hard drive. Some drives don't like to be put to sleep and sometimes there may be trouble with hybrid sleep.

So the first thing I would try is simply to go to the advanced power options (Control Panel > Power Options ... Change power settings ... Change advanced power settings) and try...
Sleep > Allow hybrid sleep > set options to off
&
Hard disk > Turn off > set to never

 

[JonathanTOOKMYNAME]

Thanks for taking a look, Trainable. I checked the power settings and the system has been running as you suggested the entire time we've had the issue. We push the following settings to all workstations via GroupPolicy:

- Hard disk > Turn off hard disk after > Setting: Never
- Sleep > Allow hybrid sleep > Setting: Off
- Sleep > Hibernate after > Setting: Never

I manually set those same settings in the other (inactive) power plans in case the system switches power plans when it goes to sleep. I have always suspected the disk to some extent, but it isn't obvious if that is the cause as the driver and firmware are up-to-date and the SSD is healthy and showing that it is compatible with the system. However, there are two disk-related developments today that may help or may not be related:

1) the filesystem on the SSD has been finicky, at least in the last few days. See the oldest checkdisk result at the bottom of the attached file. It had some nasty looking errors it cleaned up, though it is checking as healthy this morning. The disk errors may have been caused by the improper shutdown rather than the drive causing the shutdown.

2) the system has a 1TB WesternDigital hard drive, but I apparently forgot it initialize the drive. It is possible this unused and unmonitored device could be a factor, but it has been in the system for over a year before we had any issues, and due to the disk being uninitialized, there was not an NTFS file system (or any filesystem at all) on the disk. I have initialized the disk as a 1TB NTFS filesystem and it passes all disk checks.

I'm running the system through a load test now to see if it's problematic in general, but I think it will pass with flying colors. The BSOD only occurs during startup or when waking up, and it runs like a dream once booted.

 

[TrainableMan]

I would still suspect an issue with the SSD (not the WD that was never even allocated), that's why I mentioned the power because a sudden power loss can prevent the write buffer from being written out properly. Unfortunately I don't have any other ideas, sorry.