Add'l BSODs (1909)

On further investigation of your logs I can see that you installed Microsoft Office on 15th May 2021. It appears that you have not activated this correctly. Please explain because you may have compromised your system.

Well I went to a third party site off of a youtube suggestion.

GQJ17 said:

Well I went to a third party site off of a youtube suggestion.

Software packages like Microsoft Office should be paid for and activated through the proper channels. Workarounds via third party sites are risky and usually illegal and they open your system up to all sorts of unknown risks that make BSOD troubleshooting more difficult. Please remove the software and the associated activation methods before posting new logs for any further help. (See Forum rule #4).

So can I keep the computer on and just uninstall the program and you will still look at the next log?

GQJ17 said:

So can I keep the computer on and just uninstall the program and you will still look at the next log?

Once the software is removed and new logs posted we can continue.

HARLEEN-(2021-07-20_18-31-02).zip - Google Drive

Hello,

Thanks for making the changes and I've looked at your latest crash dump. The cause seems to be an old version of ntfs.sys. This is the Microsoft NT file system driver. But it is dated from 1987!!

Code:

12: kd> lmvm ntfs
Browse full module list
start             end                 module name
fffff805`76a70000 fffff805`76d49000   Ntfs     T (no symbols)           
    Loaded symbol image file: Ntfs.sys
    Image path: \SystemRoot\System32\Drivers\Ntfs.sys
    Image name: Ntfs.sys
    Browse all global symbolsfunctionsdata
    Timestamp:        Thu May  7 12:36:26 1987 (20A071BA)
    CheckSum:         002C65F9
    ImageSize:        002D9000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

Not sure where it has come from but I would run sfc /scannow in a command prompt and see if you can get the correct version.

How do I know if the date is updated?

You can check the file date by looking in c:\Windows\system32\drivers\

I've relooked at your ntfs,sys file and this time I get a different result. There does not seem to be anything wrong with it so it was my mistake caused by looking at the crash file on another PC with different software.

Code:

12: kd> lmvm Ntfs
Browse full module list
start             end                 module name
fffff805`76a70000 fffff805`76d49000   Ntfs     # (pdb symbols)          c:\symcache\ntfs.pdb\33B8B1A72A6CEA2DBBAD3FE90D0865DB1\ntfs.pdb
    Loaded symbol image file: Ntfs.sys
    Mapped memory image file: c:\symcache\Ntfs.sys\20A071BA2d9000\Ntfs.sys
    Image path: \SystemRoot\System32\Drivers\Ntfs.sys
    Image name: Ntfs.sys
    Browse all global symbolsfunctionsdata
    Image was built with /Brepro flag.
    Timestamp:        20A071BA (This is a reproducible build file hash, not a timestamp)
    CheckSum:         002C65F9
    ImageSize:        002D9000
    File version:     10.0.19041.1083
    Product version:  10.0.19041.1083
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    Information from resource tables:
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     ntfs.sys
        OriginalFilename: ntfs.sys
        ProductVersion:   10.0.19041.1083
        FileVersion:      10.0.19041.1083 (WinBuild.160101.0800)
        FileDescription:  NT File System Driver
        LegalCopyright:   © Microsoft Corporation. All rights reserved.

I would tend to suspect this could be memory related. This has been our feeling all along.