timntr.sys causing BSOD at shutdown

I've just installed Acronis True Image Home 9.0.3677. My first backup to my external USB 2.0 HDD wouldn't verify and when I tried to close my system I got a blue screen of death (BSOD) with STOP 0x00000050 (0xE12DF000, 1, 0x805D428C, 1) PAGE FAULT IN NON PAGED AREA. A Windbg analasis showed the 'problem driver' as 'timntr.sys'

Why is this happening from a brand new installation of the most recent build of the product? It's really very annoying!

Any help much appreciated. Thanks

 

Don't know if this helps but way back in Sep 2004, RonnieJP posted this reply after he had similar problems

Seems like it is a very old problem that should have been resolved long ago.

 

Yes, I found that thread too... no help though as that was an 8.0 problem and should have been fixed by v9.0.3677. Question: is there a newer timntr.sys out there somewhere?

 

Does anybody have a clue what I'm doing wrong here?!

 

I don't think that you are doing anything wrong.

* timntr.sys is not a "signed" driver. In itself not a problem but as I am sure you know, if you have a problem with an unsigned driver both Microsoft and your OEM will put their hands up and say "not our problem". It would be nice if Acronis paid some attention to these admin type tasks and ensured that all their drivers were signed.

* timntr.sys has been problematic in the past but that was about a thousand builds ago. I have not seen the problem raised on this forum in recent times.

* Have you tried taking the USB out of the equation by using an internal drive. I see from your specs that you have 2 internal disks. If you did some test runs between these two disks you could then determine if the problem was isolated to your USB drive.

* Have you tried running outside of Windows via the Acronis Linux shell? This removes the "Windows-pain-in-the-rear-end" from the equation. Can you backup/restore to the USB via the Linux shell?

* As a suggestion it may be helpful if you made the assumption that TrueImage is OK and that the problem lies elsewhere. There is a very good possibility (about an 80% chance) that TI is working just fine and that there is some small compatibility issue, timing inconsistency, buffer overflow, memory corruption.... etc that is causing the problem.

In your next post if you let me know what you have tried and what the result was it would help me to make further (hopefully more intelligent) suggestions.

 

Tabvla, thanks for your reply

I've spent all day yesterday testing my RAM sticks one by one. I've got 2x Kingston 1Gb PC3200 and the older sticks they replaced (but were working fine) 2x HTL 512Mb PC2700. I performed the following memory tests on all sticks one by one:

1) Smith Micro Software Inc, Check It Diagnostics v7.1.0.83 (Windows)
2) MemTest86+ v1.65 (DOS)
3) GoldMemory v5.07 (DOS)
4) DocMemory RAM Diagnostics v2.2 (DOS)

All RAM sticks passed all tests with flying colours, they all booted into Windows XP perfectly and the system always crashed perfectly on shutdown with a STOP: 0x00000050 (0x1Ennn000,0x00000001,0x805D428C,0x00000001)! (nnn = any hexedecimal number/letter).

Now, the following analysis of Memory.dmp and mini250706-0x.dmp files reveals the following:

a) Symbols for NTOSKRNL.SYS can't be found (despite unpacking the 195MB file from Microsoft to c:\symbols and including that directory in my enviromental symbols path correctly).
b) All Memory.dmp files refer to 'memory_corruption' and 'MEMORY_CORRUPTION_LARGE' in the KD> !Analyze -v section despite my tests above on the RAM.
c) All mini250706-0x.dmp files refer 1) to a driver, either: timntr.sys (twice today and many times before), mup.sys (once) or NSID.sys (once), 2) 'LAST_CONTROL_TRANSFER: from 80523f44 to 8053331e' (ie always the same) and 3) an 'instruction address which referenced the bad memory' as 0x805D428C (i.e always the same instruction address).

I've also completely disconnected my external USB HDD drive (which is where my backup is and this is where I have, in the past, mounted an image from - timntr.exe be looking for this drive?). Anyway the system still crashes

Re backup from c: (160Gb - 110GB used) to d: (80Gb)drive - it won't fit! I suppose I could install the 160GB external as the D: drive and test it but I'll wait till you reply to the above issues first

Finally: re ntoskrnl.exe, I have 6 files on the PC all in different sub-directories. Their properties are all slightly different (size, size on disk, creation date, modified date or version number). A checksum on all six files reveals the same CRC32 (F31B3752) and MD5 (4D4CF2C14550A4B7718E94A6E581856E). Do you know where I can get a definitive version for my system?

If you need any dumps let me know.

Thx for the help
Bob

 

Based on your feedback my first impression is that there are some of those proverbial "red herrings" swimming in your system.

There are two courses of action which you may consider.

1. Option 1 - Uninstall TrueImage 9.

Not as drastic as it sounds you can always do a fresh install if you have downloaded the installation file. If TI9 is the problem then you are going to have to do a fresh install anyway.

If you decide to do this then ensure that every TI9 entry has been removed from the Registry by running a registry check for invalid entries.

The advantage of doing this is that you will be able to determine whether or not your current installation of TI9 is creating the problem. If the problem persists then you know it is not TI9. If the problem goes away after you have uninstalled TI9 then reinstall and see if the problem returns. If it doesn't, problem solved; if it does then you may need to raise a Support Call with Acronis.

2. Option 2 - NTOSKRNL.SYS

This is probably the most interesting of the errors you are receiving. Of course don't discount that it is one of the red herrings mentioned previously. But, if your problem originates with this system file then the impact is going to be right across the system with a multiplicity of error messages which are in fact all nonsense because the only problem that you will have is NTOSKRNL.SYS which will have a system-wide impact.

Below are some links to KB articles on problems with NTOSKRNL.SYS Look through these and see if any of the information seems appropriate to the problems that you are experiencing.

Unable to find Ntoskrnl.exe - http://msdn.microsoft.com/library/d...xpehelp/html/xeconunabletofindntoskrnldll.asp.

STOP 0x0000000A in Ntoskrnl.exe at Logon to Windows NT 4.0 - http://support.microsoft.com/default.aspx?scid=kb;en-us;160649.

STOP 0x0000001e Error Occurs in Ntoskrnl.exe at Blue Build Screen - http://support.microsoft.com/default.aspx?scid=kb;en-us;247908.

STOP 0x0000000a in Ntoskrnl.exe with InocuLAN Virus Software - http://support.microsoft.com/default.aspx?scid=kb;en-us;160285.

 

Tabvla, cheers mate!

Right, I think I've resolved this TI9 problem of the BSOD at shutdown. I uninstalled TI9 but it still crashed on the shutdown. Reviewed MS config.exe and removed Hard Disk Inspector v1.6.915 (this 15-day trial program had passed its trial period) from startup, removed MS Visual Studio Machine Debug Manager (\VS7Debug\mdm.exe) and Auto Complete Service (AceSoft's Tracks Eraser Pro v5.05.23) from services and re-booted the system - SUCCESS! Permanently deleted Hard Disk Inspector v1.6.915 and AceSoft's Tracks Eraser Pro v5.05.23. Shut down and power off. No problems!

Power on and re-install TI9. Re-boot process ok. Checked out and mounted (read only) my previous TI9 backup's (incremental backup02) on my external USB2.0 HDD. No problem. Dismounted image and made another incremental backup. Shut down the system - all ok. Re-started the PC and mounted (read/write) the new image (incremental backup03). ALL OK! TI9 problem resolved.

As for the ntoskrnl.exe & Windbg problem I've started a new thread at Microsoft TechNet Help & Support forum at http://www.microsoft.com/technet/community/newsgroups/dgbrowser/en-us/default.mspx?dg=microsoft.public.windowsxp.help_and_support. It's not a TI issue!

Thanks for your help.

 

Great ! Interesting solution.

Now if only Microsoft would include a "red-herring net" with Vista, then they really would have a killer-OS

 

Tabvla

Exactly the same problem arose again as soon as I finished emailing this forum about 10 days ago! (I've had real problems with PLDT here in the Philippines and haven't been on-line since 27/6/2006 sorry!).

timntr.exe was still giving me grief....again!

I got to thinking timntr.exe wasn't closing down properly and after some serious research found a microsoft tool called UHPClean. As MS say...

"UPHClean is a service that once and for all gets rid of problems with user
profile not unloading.

You are having profile unload problems if you experience slow logoff (with
Saving Settings for most of the time while logging off), roaming profiles
that do not reconcile, or the registry size limit is reached".

I downloaded this from http://www.microsoft.com/downloads/details.aspx?familyid=1B286E6D-8912-4E18-B570-42470E2F3582&displaylang=en It's a service that runs and cleans up the user profile hive prior to shut down.

Now and only now does everything work okay. Perhaps this will work for others too!

Thanks for all your help on this
Cheers
Bob

 

Bob

Thanks for the feedback. Good info. One to be added to my personal Knowledgebase.

Windows is a bit like a medieval castle - you learn of a new dungeon everyday