NTFS.SYS causing BSODs on wake/startup (sometimes)

Discussion in 'Crashes, BSODs and Debugging' started by JonathanTOOKMYNAME, Jan 4, 2017.

  1. JonathanTOOKMYNAME

    JonathanTOOKMYNAME

    Joined:
    Jan 4, 2017
    Messages:
    3
    Likes Received:
    0
    The problem ----------------
    So we have a very frustrating BSOD issue affecting several of our designer's workstations. These workstations were built in-house by myself. It is happening primarily on one workstation and not on others of a similar build, so we'll focus on only one for now and see if its solution applies to the other workstations. So far it seems like it must be a device, driver, or BIOS setting associated with this specific motherboard.

    This workstation has been encountering a BSOD on startup and while waking from sleep for over a month. The crash occurs every two to five days, and only when 1) the computer is woken from a sleeping state, or 2) the computer is powered on. Once the displays are awake on the system, the user sees the BSOD message, and the workstation restarts. After it is restarted the user logs in and does not have any issues at all until the BSOD occurs another morning several days later.

    The problem description of the crash changes between one of several possibilities, but it is almost always caused by ntfs.sys. That made me think it was related to either our backup program (CrashPlanPRO) or the SSD firmware, driver, etc.

    I look forward to hearing your ideas and hopefully getting to the bottom of this. Attached are the minidumps, and the URLs of the actual components in the system from Amazon.


    What we've tried -----------
    - tested RAM with Memtest86 v4.20 -- no errors were detected after 9 passes and 14 hours of testing
    - uninstalled unwanted apps
    - updated "Intel Graphics Driver" from x.x.x.4264 to x.x.x.4414 (which also updated the Intel audio driver) via Intel Driver Update Utility
    - updated "Intel Z97 Chipset LPC Controller" driver via Device manager
    - updated "Intel 9 Series Chipset Family PCI Express Root Port 1 - 8C90" driver via Device Manager
    - updated "Intel 9 Series Chipset Family PCI Express Root Port 3 - 8C94" driver via Device Manager
    - updated "Intel 9 Series Chipset Family PCI Express Root Port 4 - 8C96" driver via Device Manager
    - updated "Intel 9 Series Chipset Family SMBus Host Controller - 8CA2" driver via Device Manager
    - updated "NVIDIA Quadro K2000" driver via Device Manager
    - updated "Intel Xeon processor E3 - 1200 v3/4th Gen Core processor PCI Express x16 Controller - 0C01" driver via Device Manager
    - updated "Intel Xeon processor E3 - 1200 v3/4th Gen Core processor DRAM Controller - 0C00" driver via Device Manager
    - verified that the Samsung SSD firmware is up to date and that there are no known compatibility issues via Samsung Magician


    System specs ---------------
    Video: NVIDIA Quadro K2000 2GB GDDR5 Graphics card
    Memory: Kingston HyperX FURY 16GB Kit (2x8GB) 1866MHz DDR3 CL10 DIMM
    Motherboard: Gigabyte GA-Z97X-GAMING 3 LGA 1150 Z97 Gaming
    CPU: Intel Core i7-4790
    SSD: Samsung 850 EVO 250GB 2.5-Inch SATA III Internal SSD
    HDD: WD Blue 1TB Desktop 3.5 Inch SATA 6Gb/s 7200rpm
    OS: Microsoft Windows 7 Professional SP1 64bit
    Power Supply: Corsair CS Series 750 Watt - CS750M


    Other notes ----------------
    - The biggest difference between the problematic workstations and the others which are not having the problem is that these have an Gigabyte Z97 board and the others have an Asus Z97 board.
    - Another difference is that others have an NVIDIA SSD, this has a Samsung SSD.
    - One workstation had a similar problem where it would crash at the same time the Antimalware server (Kaspersky Administration Center) would send the WOL signal to prepare the nightly system update cycle. This issue has since stopped on its own.
    - It does not seem to matter whether the computer is turning on from a cold boot or if it is being woken after going to sleep -- the issue will simply happen sometimes and not most of the time.
    - Initially I sustected that it is caused by Kaspersky Endpoint Security or CrashPlanPRO, but by this point it seems to be related to a system device or its driver as none of the crashes are similar to problems we've seen with those applications in the past.


    WhoCrashed output ----------
    On Sun 01-Jan-17 17:56:29 your computer crashed
    crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\010117-5241-01.dmp
    uptime: 21:05:13
    This was probably caused by the following module: ntfs.sys (Ntfs! ?? ::FNODOBFM::`string'+0x299D)
    Bugcheck code: 0x24 (0x1904FB, 0xFFFFF8800C38DF28, 0xFFFFF8800C38D780, 0xFFFFF88001C36F2A)
    Error: NTFS_FILE_SYSTEM
    file path: C:\WINDOWS\system32\drivers\ntfs.sys
    product: Microsoft® Windows® Operating System
    company: Microsoft Corporation
    description: NT File System Driver
    Bug check description: This indicates a problem occurred in the NTFS file system.
    The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



    On Sat 31-Dec-16 20:50:17 your computer crashed
    crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\123116-5413-01.dmp
    uptime: 1 day, 04:41:15
    This was probably caused by the following module: ntfs.sys (Ntfs!NtfsRestartIndexEnumeration+0x277)
    Bugcheck code: 0x50 (0xFFFFF8A019BFFF88, 0x1, 0xFFFFF800033AD627, 0x0)
    Error: PAGE_FAULT_IN_NONPAGED_AREA
    file path: C:\WINDOWS\system32\drivers\ntfs.sys
    product: Microsoft® Windows® Operating System
    company: Microsoft Corporation
    description: NT File System Driver
    Bug check description: This indicates that invalid system memory has been referenced.
    This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
    The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



    On Tue 27-Dec-16 22:55:19 your computer crashed
    crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\122716-5366-01.dmp
    uptime: 15:31:22
    This was probably caused by the following module: ntfs.sys (Ntfs! ?? ::FNODOBFM::`string'+0x299D)
    Bugcheck code: 0x24 (0x1904FB, 0xFFFFF88008D8DC28, 0xFFFFF88008D8D480, 0xFFFFF88001CE1EC4)
    Error: NTFS_FILE_SYSTEM
    file path: C:\WINDOWS\system32\drivers\ntfs.sys
    product: Microsoft® Windows® Operating System
    company: Microsoft Corporation
    description: NT File System Driver
    Bug check description: This indicates a problem occurred in the NTFS file system.
    The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



    On Wed 21-Dec-16 22:55:16 your computer crashed
    crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\122116-5569-01.dmp
    uptime: 15:38:31
    This was probably caused by the following module: ntfs.sys (Ntfs! ?? ::FNODOBFM::`string'+0x299D)
    Bugcheck code: 0x24 (0x1904FB, 0xFFFFF8800F547A38, 0xFFFFF8800F547290, 0xFFFFF800033C1627)
    Error: NTFS_FILE_SYSTEM
    file path: C:\WINDOWS\system32\drivers\ntfs.sys
    product: Microsoft® Windows® Operating System
    company: Microsoft Corporation
    description: NT File System Driver
    Bug check description: This indicates a problem occurred in the NTFS file system.
    The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



    On Fri 16-Dec-16 06:44:29 your computer crashed
    crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\121616-5475-01.dmp
    uptime: 05:53:03
    This was probably caused by the following module: dxgkrnl.sys (dxgkrnl!DXGDEVICE::DestroyAllocations+0x72D)
    Bugcheck code: 0xC2 (0xD, 0xFFFFF8A032F74AC0, 0x4B677844, 0xFFFFFA8015351070)
    Error: BAD_POOL_CALLER
    file path: C:\WINDOWS\system32\drivers\dxgkrnl.sys
    product: Microsoft® Windows® Operating System
    company: Microsoft Corporation
    description: DirectX Graphics Kernel
    Bug check description: This indicates that the current thread is making a bad pool request.
    This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
    The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



    On Wed 14-Dec-16 00:50:16 your computer crashed
    crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\121416-5584-01.dmp
    uptime: 12:16:10
    This was probably caused by the following module: ntfs.sys (Ntfs! ?? ::FNODOBFM::`string'+0x299D)
    Bugcheck code: 0x24 (0x1904FB, 0xFFFFF8800AD2E3C8, 0xFFFFF8800AD2DC20, 0xFFFFF8000328C4F4)
    Error: NTFS_FILE_SYSTEM
    file path: C:\WINDOWS\system32\drivers\ntfs.sys
    product: Microsoft® Windows® Operating System
    company: Microsoft Corporation
    description: NT File System Driver
    Bug check description: This indicates a problem occurred in the NTFS file system.
    The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



    On Sat 10-Dec-16 23:03:04 your computer crashed
    crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\121016-5288-01.dmp
    uptime: 1 day, 04:25:34
    This was probably caused by the following module: ntfs.sys (Ntfs!NtfsCommonClose+0x534)
    Bugcheck code: 0xC2 (0x7, 0x109B, 0x1090219, 0xFFFFF8A01D4D3700)
    Error: BAD_POOL_CALLER
    file path: C:\WINDOWS\system32\drivers\ntfs.sys
    product: Microsoft® Windows® Operating System
    company: Microsoft Corporation
    description: NT File System Driver
    Bug check description: This indicates that the current thread is making a bad pool request.
    This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
    The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



    On Thu 08-Dec-16 06:19:01 your computer crashed
    crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\120816-6318-01.dmp
    uptime: 3 days, 00:00:23
    This was probably caused by the following module: ntfs.sys (Ntfs! ?? ::FNODOBFM::`string'+0x299D)
    Bugcheck code: 0x24 (0x1904FB, 0xFFFFF88024A063C8, 0xFFFFF88024A05C20, 0xFFFFF8000308A4F4)
    Error: NTFS_FILE_SYSTEM
    file path: C:\WINDOWS\system32\drivers\ntfs.sys
    product: Microsoft® Windows® Operating System
    company: Microsoft Corporation
    description: NT File System Driver
    Bug check description: This indicates a problem occurred in the NTFS file system.
    The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



    On Thu 01-Dec-16 07:46:56 your computer crashed
    crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\120116-6505-01.dmp
    uptime: 1 day, 19:14:30
    This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
    Bugcheck code: 0x1A (0x31, 0xFFFFFA800D5B6E20, 0xFFFFF8800D939000, 0xFFFFF8A011F8C401)
    Error: MEMORY_MANAGEMENT
    Bug check description: This indicates that a severe memory management error occurred.
    This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules. This problem might also be caused because of overheating (thermal issue).
    The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



    On Fri 25-Nov-16 07:28:30 your computer crashed
    crash dump file: C:\Users\corbin\Desktop\New folder\WKS-082715\112516-6068-01.dmp
    uptime: 11 days, 01:18:09
    This was probably caused by the following module: fltmgr.sys (fltmgr!FltpAllocateFileNameInformation+0x2D)
    Bugcheck code: 0x3B (0xC0000005, 0xFFFFF800031B1627, 0xFFFFF8800CE0B3E0, 0x0)
    Error: SYSTEM_SERVICE_EXCEPTION
    file path: C:\WINDOWS\system32\drivers\fltmgr.sys
    product: Microsoft® Windows® Operating System
    company: Microsoft Corporation
    description: Microsoft Filesystem Filter Manager
    Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
    This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
    The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.
     

    Attached Files:

    JonathanTOOKMYNAME, Jan 4, 2017
    #1
    1. Advertisements

  2. JonathanTOOKMYNAME

    JonathanTOOKMYNAME

    Joined:
    Jan 4, 2017
    Messages:
    3
    Likes Received:
    0
    Crashed again this weekend. Does anyone out there have any insight at all? Or should I just swap out the motherboard and hope the problem goes with it?
     
    JonathanTOOKMYNAME, Jan 10, 2017
    #2
    1. Advertisements

  3. JonathanTOOKMYNAME

    TrainableMan ^ The World's First ^ Moderator

    Joined:
    May 10, 2010
    Messages:
    9,020
    Likes Received:
    1,582
    Location:
    PA, USA
    NTFS would seem to point to the hard drive. Some drives don't like to be put to sleep and sometimes there may be trouble with hybrid sleep.

    So the first thing I would try is simply to go to the advanced power options (Control Panel > Power Options ... Change power settings ... Change advanced power settings) and try...
    Sleep > Allow hybrid sleep > set options to off
    &
    Hard disk > Turn off > set to never
     
    TrainableMan, Jan 10, 2017
    #3
  4. JonathanTOOKMYNAME

    JonathanTOOKMYNAME

    Joined:
    Jan 4, 2017
    Messages:
    3
    Likes Received:
    0
    Thanks for taking a look, Trainable. I checked the power settings and the system has been running as you suggested the entire time we've had the issue. We push the following settings to all workstations via GroupPolicy:

    - Hard disk > Turn off hard disk after > Setting: Never
    - Sleep > Allow hybrid sleep > Setting: Off
    - Sleep > Hibernate after > Setting: Never

    I manually set those same settings in the other (inactive) power plans in case the system switches power plans when it goes to sleep. I have always suspected the disk to some extent, but it isn't obvious if that is the cause as the driver and firmware are up-to-date and the SSD is healthy and showing that it is compatible with the system. However, there are two disk-related developments today that may help or may not be related:

    1) the filesystem on the SSD has been finicky, at least in the last few days. See the oldest checkdisk result at the bottom of the attached file. It had some nasty looking errors it cleaned up, though it is checking as healthy this morning. The disk errors may have been caused by the improper shutdown rather than the drive causing the shutdown.

    2) the system has a 1TB WesternDigital hard drive, but I apparently forgot it initialize the drive. It is possible this unused and unmonitored device could be a factor, but it has been in the system for over a year before we had any issues, and due to the disk being uninitialized, there was not an NTFS file system (or any filesystem at all) on the disk. I have initialized the disk as a 1TB NTFS filesystem and it passes all disk checks.

    I'm running the system through a load test now to see if it's problematic in general, but I think it will pass with flying colors. The BSOD only occurs during startup or when waking up, and it runs like a dream once booted.
     

    Attached Files:

    JonathanTOOKMYNAME, Jan 10, 2017
    #4
  5. JonathanTOOKMYNAME

    TrainableMan ^ The World's First ^ Moderator

    Joined:
    May 10, 2010
    Messages:
    9,020
    Likes Received:
    1,582
    Location:
    PA, USA
    I would still suspect an issue with the SSD (not the WD that was never even allocated), that's why I mentioned the power because a sudden power loss can prevent the write buffer from being written out properly. Unfortunately I don't have any other ideas, sorry.
     
    TrainableMan, Jan 11, 2017
    #5
    1. Advertisements

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Liv Lukas
    Replies:
    8
    Views:
    7,937
    Liv Lukas
    Feb 4, 2011
  2. cgyarring

    BSOD atikmdag.sys dxgmms1.sys while playing BF3

    cgyarring, Oct 25, 2011, in forum: Crashes, BSODs and Debugging
    Replies:
    16
    Views:
    8,054
    phetish
    Feb 12, 2012
  3. Roger Mills

    W7 sometimes freezes a few minutes after startup

    Roger Mills, Feb 8, 2012, in forum: alt.windows7.general
    Replies:
    32
    Views:
    7,870
  4. Cedric

    BSOD : ntfs.sys and ntoskrnl.exe

    Cedric, Jun 1, 2012, in forum: Crashes, BSODs and Debugging
    Replies:
    1
    Views:
    1,674
    Shintaro
    Jun 3, 2012
  5. sonicdh

    DRIVER_IRQL_NOT_LESS_OR_EQUAL for dump_atapi.sys and 1394ohci.sys

    sonicdh, Aug 23, 2012, in forum: Crashes, BSODs and Debugging
    Replies:
    3
    Views:
    5,456
    Shintaro
    Aug 25, 2012
  6. marwels23

    Crashes a few times a day (sometimes during games, sometimes not)

    marwels23, Dec 19, 2012, in forum: Crashes, BSODs and Debugging
    Replies:
    4
    Views:
    1,052
    marwels23
    Dec 21, 2012
  7. MeGusta90

    usbohci.sys causing BSoDs

    MeGusta90, Mar 12, 2013, in forum: Crashes, BSODs and Debugging
    Replies:
    3
    Views:
    2,372
    TrainableMan
    Mar 13, 2013
  8. avinashj
    Replies:
    2
    Views:
    2,205
    avinashj
    Aug 10, 2013
Loading...