Windows 10: Blue screen error, WARNING: Unable to verify timestamp for Ntfs.sys, anyone knows what to do?

[COLOR=rgba30, 30, 30, 1]Microsoft R Windows Debugger Version 10.0.21306.1007 AMD64Copyright c Microsoft Corporation. All rights reserved.Loading Dump File [C:\Users\cosmi\Desktop\bepis\MEMORY.DMP]Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.Symbol search path is: srv*Executable search path is: Windows 10 Kernel Version 19041 MP 16 procs Free x64Product: WinNt, suite: TerminalServer SingleUserTS PersonalEdition build lab: 19041.1.amd64fre.vb_release.191206-1406Machine Name:Kernel base = 0xfffff803`70c00000 PsLoadedModuleList = 0xfffff803`7182a490Debug session time: Wed Apr 14 19:50:31.505 2021 UTC + 2:00System Uptime: 1 days 1:21:49.112Loading Kernel Symbols............................................................................................................................................................Page 7e7fbb not present in the dump file. Type ".hh dbgerr004" for details.....................................................................Loading User SymbolsPEB is paged out Peb.Ldr = 00000001`0034a018. Type ".hh dbgerr001" for detailsLoading unloaded module list..........................For analysis of this file, run [/COLOR][COLOR=rgba0, 0, 255, 1]!analyze -v[/COLOR][COLOR=rgba30, 30, 30, 1]nt!KeBugCheckEx:fffff803`70ff5c50 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffd60e`c446ee30=00000000000001094: kd> !analyze -v******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************CRITICAL_STRUCTURE_CORRUPTION 109This bugcheck is generated when the kernel detects that critical kernel code ordata have been corrupted. There are generally three causes for a corruption:1 A driver has inadvertently or deliberately modified critical kernel code or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx2 A developer attempted to set a normal kernel breakpoint using a kernel debugger that was not attached when the system was booted. Normal breakpoints, "bp", can only be set if the debugger is attached at boot time. Hardware breakpoints, "ba", can be set at any time.3 A hardware corruption occurred, e.g. failing RAM holding kernel code or data.Arguments:Arg1: a3a01b67a3d8d9b2, ReservedArg2: b3b727edf65a484a, ReservedArg3: fffff80375040000, Failure type dependent informationArg4: 000000000000002c, Type of corrupted region, can be 0 : A generic data region 1 : Modification of a function or .pdata 2 : A processor IDT 3 : A processor GDT 4 : Type 1 process list corruption 5 : Type 2 process list corruption 6 : Debug routine modification 7 : Critical MSR modification 8 : Object type 9 : A processor IVT a : Modification of a system service function b : A generic session data region c : Modification of a session function or .pdata d : Modification of an import table e : Modification of a session import table f : Ps Win32 callout modification 10 : Debug switch routine modification 11 : IRP allocator modification 12 : Driver call dispatcher modification 13 : IRP completion dispatcher modification 14 : IRP deallocator modification 15 : A processor control register 16 : Critical floating point control register modification 17 : Local APIC modification 18 : Kernel notification callout modification 19 : Loaded module list modification 1a : Type 3 process list corruption 1b : Type 4 process list corruption 1c : Driver object corruption 1d : Executive callback object modification 1e : Modification of module padding 1f : Modification of a protected process 20 : A generic data region 21 : A page hash mismatch 22 : A session page hash mismatch 23 : Load config directory modification 24 : Inverted function table modification 25 : Session configuration modification 26 : An extended processor control register 27 : Type 1 pool corruption 28 : Type 2 pool corruption 29 : Type 3 pool corruption 2a : Type 4 pool corruption 2b : Modification of a function or .pdata 2c : Image integrity corruption 2d : Processor misconfiguration 2e : Type 5 process list corruption 2f : Process shadow corruption 30 : Retpoline code page corruption 101 : General pool corruption 102 : Modification of win32k.sysDebugging Details:------------------Unable to load image \SystemRoot\System32\Drivers\Ntfs.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for Ntfs.sysKEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 2687 Key : Analysis.DebugAnalysisManager Value: Create Key : Analysis.Elapsed.mSec Value: 3597 Key : Analysis.Init.CPU.mSec Value: 843 Key : Analysis.Init.Elapsed.mSec Value: 43849 Key : Analysis.Memory.CommitPeak.Mb Value: 80 Key : WER.OS.Branch Value: vb_release Key : WER.OS.Timestamp Value: 2019-12-06T14:06:00Z Key : WER.OS.Version Value: 10.0.19041.1BUGCHECK_CODE: 109BUGCHECK_P1: a3a01b67a3d8d9b2BUGCHECK_P2: b3b727edf65a484aBUGCHECK_P3: fffff80375040000BUGCHECK_P4: 2cBLACKBOXBSD: 1 [/COLOR][COLOR=rgba0, 0, 255, 1]!blackboxbsd[/COLOR][COLOR=rgba30, 30, 30, 1]BLACKBOXNTFS: 1 [/COLOR][COLOR=rgba0, 0, 255, 1]!blackboxntfs[/COLOR][COLOR=rgba30, 30, 30, 1]BLACKBOXPNP: 1 [/COLOR][COLOR=rgba0, 0, 255, 1]!blackboxpnp[/COLOR][COLOR=rgba30, 30, 30, 1]BLACKBOXWINLOGON: 1PROCESS_NAME: csrss.exeSTACK_TEXT: ffffd60e`c446ee28 00000000`00000000 : 00000000`00000109 a3a01b67`a3d8d9b2 b3b727ed`f65a484a fffff803`75040000 : nt!KeBugCheckExMODULE_NAME: [/COLOR][COLOR=rgba0, 0, 255, 1]Ntfs[/COLOR][COLOR=rgba30, 30, 30, 1]IMAGE_NAME: Ntfs.sysSTACK_COMMAND: .thread ; .cxr ; kbFAILURE_BUCKET_ID: 0x109_2c_IMAGE_Ntfs.sysOS_VERSION: 10.0.19041.1BUILDLAB_STR: vb_releaseOSPLATFORM_TYPE: x64OSNAME: Windows 10FAILURE_ID_HASH: {1ac1cef4-57d0-75db-be0a-7f8b6ff55cb8}Followup: MachineOwner---------[/COLOR]

:)

 

Highly Frequent Blue Screens

Quite a lot of Drivers that are crashing and one even blamed some hardware.

• Probably caused by : hardware ( !MiCheckVadSequential+1e2 )

nt

• *** WARNING: Unable to verify timestamp for aswSnx.sys

*** ERROR: Module load completed but symbols could not be loaded for aswSnx.sys

aswSnx+0xd7708

• *** WARNING: Unable to verify timestamp for aswSP.sys

*** ERROR: Module load completed but symbols could not be loaded for aswSP.sys

aswSP+0x61240

• *** WARNING: Unable to verify timestamp for .sys

aswbidsdrivera

• *** ERROR: Module load completed but symbols could not be loaded for .sys

aswbidsdrivera

aswbidsdrivera+0x440b0

• *** WARNING: Unable to verify timestamp for .sys

nvlddmkm

*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys

nvlddmkm+0x9b6181



First thing, update BIOS to 3.20:

ASRock > X99 Extreme6

Then, uninstall Avast and use Built-in defender. Use the removal tool given below:

List of anti-malware product removal tools

The next thing is to completely remove Nvidia drivers using DDU:

Completely remove everything from Nvidia using DDU and install the newest copy of the driver available.

Display Driver Uninstaller Download version 18.0.3.8

Head to Nvidia or to get the newest driver.

Let us know if you require any assistance.

 

Multiple blue screens. Some in rapid succession.


If I didn't yet tell to only use 1 GPU for everything, thus NOT GPU 1 for this and GPU 2 for gaming, then please start with it.
I believe that both the GPU drivers have been flagged due to switching.
Code:

Code:

ffffd000`22aa9160  fffff801`1d63a558Unable to load image nvlddmkm.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for nvlddmkm.sys *** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys  nvlddmkm+0x71a558 ffffd000`208869c8  fffff800`10716935Unable to load image igdkmd64.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for igdkmd64.sys *** ERROR: Module load completed but symbols could not be loaded for igdkmd64.sys  igdkmd64+0x16935

I would also suggest to uninstall Trend Micro using their uninstall tool, I couldn't find it which is why I didn't add a link to uninstall instructions/tool.
Code:

Code:

ffffd000`22aa9838  fffff801`1bb68a68Unable to load image tmevtmgr.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for tmevtmgr.sys *** ERROR: Module load completed but symbols could not be loaded for tmevtmgr.sys  tmevtmgr+0x8a68 ffffd000`22aa96d8  fffff801`1b2d9507Unable to load image tmactmon.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for tmactmon.sys *** ERROR: Module load completed but symbols could not be loaded for tmactmon.sys  tmactmon+0x9507 ffffd000`22aa89e0  fffff801`1ad6f920Unable to load image tmcomm.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for tmcomm.sys *** ERROR: Module load completed but symbols could not be loaded for tmcomm.sys  tmcomm+0x3f920

 

Blue screen: DPC_WATCHDOG_VIOLATION

101018-114343-01.dmp

** WARNING: Unable to verify timestamp for nvlddmkm.sys

*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys

101018-118078-01.dmp

*** WARNING: Unable to verify timestamp for HECIx64.sys

*** ERROR: Module load completed but symbols could not be loaded for HECIx64.sys

*** WARNING: Unable to verify timestamp for nvlddmkm.sys

*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys

*** WARNING: Unable to verify timestamp for WdFilter.sys

*** ERROR: Module load completed but symbols could not be loaded for WdFilter.sys

nvlddmkm.sys - Your nVidia driver has a date of 27-Oct-2017. You should download the latest driver from computer manufacturer's site and update it.

HECIx64.sys - Your Intel Management Engine Interface driver has a date of 19-Oct-2010. See if you have a driver whose date is greater than this on computer manufacturer's website.

WdFilter.sys - This is Windows Defender file. Don't do anything for the time being. Just execute above two steps and see whether BSOD occurs. If occurs again, post the dumps again.