Functions cause long delays, BSOD

dogiebitt · 14 Oct 2011

Disclaimer: This is my mom's laptop, I am in no way held liable for what the logs in the zip file may show..

OS:

Windows 7 Home Premium x64
Original OS - Came with laptop from Best Buy - OEM Version
Laptop is about 1 year old, have never re-installed Windows on it.

Hardware:

Gateway NV55C03u
Pentium P6100
Intel HD Graphics
3GB DDR3 RAM (1x Elpida 2GB stick, 1x Kingston 1GB stick - Came this way, I have done no upgrades to this laptop)
320 GB Hard Drive

Symptoms:

Slowness attributed to commands causing the computer to "think". For example, right clicks to bring up context menus will sit for 10-30 seconds before bring them up. Hovering over the start button (or clicking it) will freeze everything but the mouse for 10-30 seconds. Placing the cursor into a field (actually clicking to place the blinking line) to type will hang for 10-30 seconds.
BSOD randomly. I think it has something to do with the iaStor.exe timing out (from the event logs), but then other signs point to something about a Kernel having a problem.
Cannot complete a "sfc /scannow", it stops around 76%. "sfc /verifyonly" will complete to 100% and tell me there were problems found, but skimming the log I did not see anything stand out at me. I don't know what I'm looking for though and there are thousands of lines of log.
Can't do chkdsk error I get is - "Chkdsk cannot run because the volume is in use." So I schedule it to run after a restart. During startup, the screen goes blue and some words appear, but then go away and it continues to boot into windows. They disappear too quick to read, but I think it had some acronyms like NTFS in there.

zigzag3143 · 14 Oct 2011

dogiebitt said:

Disclaimer: This is my mom's laptop, I am in no way held liable for what the logs in the zip file may show..

OS:

Windows 7 Home Premium x64
Original OS - Came with laptop from Best Buy - OEM Version
Laptop is about 1 year old, have never re-installed Windows on it.

Hardware:

Gateway NV55C03u
Pentium P6100
Intel HD Graphics
3GB DDR3 RAM (1x Elpida 2GB stick, 1x Kingston 1GB stick - Came this way, I have done no upgrades to this laptop)
320 GB Hard Drive

Symptoms:

Slowness attributed to commands causing the computer to "think". For example, right clicks to bring up context menus will sit for 10-30 seconds before bring them up. Hovering over the start button (or clicking it) will freeze everything but the mouse for 10-30 seconds. Placing the cursor into a field (actually clicking to place the blinking line) to type will hang for 10-30 seconds.
BSOD randomly. I think it has something to do with the iaStor.exe timing out (from the event logs), but then other signs point to something about a Kernel having a problem.
Cannot complete a "sfc /scannow", it stops around 76%. "sfc /verifyonly" will complete to 100% and tell me there were problems found, but skimming the log I did not see anything stand out at me. I don't know what I'm looking for though and there are thousands of lines of log.
Can't do chkdsk error I get is - "Chkdsk cannot run because the volume is in use." So I schedule it to run after a restart. During startup, the screen goes blue and some words appear, but then go away and it continues to boot into windows. They disappear too quick to read, but I think it had some acronyms like NTFS in there.

These were all related to your iaStor.sys (raid driver). I would re-install newest version available.

dogiebitt · 14 Oct 2011

As far as I know, all of the drivers on this laptop are up to date. I ran driver checked and it also told me the same thing.
isStor.exe driver is at version 10.6.0.1002 fro 5/20/2011

dogiebitt · 14 Oct 2011

Just got another BSOD. Here is some info from it. I'm not sure how to fix my symbols errors in the dump logs...

Code:

Problem signature:
  Problem Event Name:    BlueScreen
  OS Version:    6.1.7601.2.1.0.768.3
  Locale ID:    1033

Additional information about the problem:
  BCCode:    7a
  BCP1:    FFFFF6FC5002BF20
  BCP2:    FFFFFFFFC00000B5
  BCP3:    0000000053455880
  BCP4:    FFFFF8A0057E42C8
  OS Version:    6_1_7601
  Service Pack:    1_0
  Product:    768_1

Files that help describe the problem:
  C:\Windows\Minidump\101411-49639-01.dmp
  C:\Users\Eleonora\AppData\Local\Temp\WER-110916-0.sysdata.xml

Read our privacy statement online:
  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
  C:\Windows\system32\en-US\erofflps.txt


==================
Minidump
==================

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\101411-49639-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c5d000 PsLoadedModuleList = 0xfffff800`02ea2670
Debug session time: Fri Oct 14 04:00:35.123 2011 (UTC - 4:00)
System Uptime: 0 days 2:18:25.496
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7A, {fffff6fc5002bf20, ffffffffc00000b5, 53455880, fffff8a0057e42c8}

*** WARNING: Unable to verify timestamp for mssmbios.sys
*** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt+7cc40 )

Followup: MachineOwner
---------

zigzag3143 · 14 Oct 2011

dogiebitt said:

Just got another BSOD. Here is some info from it. I'm not sure how to fix my symbols errors in the dump logs...

Code:

Problem signature:
  Problem Event Name:    BlueScreen
  OS Version:    6.1.7601.2.1.0.768.3
  Locale ID:    1033

Additional information about the problem:
  BCCode:    7a
  BCP1:    FFFFF6FC5002BF20
  BCP2:    FFFFFFFFC00000B5
  BCP3:    0000000053455880
  BCP4:    FFFFF8A0057E42C8
  OS Version:    6_1_7601
  Service Pack:    1_0
  Product:    768_1

Files that help describe the problem:
  C:\Windows\Minidump\101411-49639-01.dmp
  C:\Users\Eleonora\AppData\Local\Temp\WER-110916-0.sysdata.xml

Read our privacy statement online:
  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
  C:\Windows\system32\en-US\erofflps.txt


==================
Minidump
==================

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\101411-49639-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c5d000 PsLoadedModuleList = 0xfffff800`02ea2670
Debug session time: Fri Oct 14 04:00:35.123 2011 (UTC - 4:00)
System Uptime: 0 days 2:18:25.496
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7A, {fffff6fc5002bf20, ffffffffc00000b5, 53455880, fffff8a0057e42c8}

*** WARNING: Unable to verify timestamp for mssmbios.sys
*** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt+7cc40 )

Followup: MachineOwner
---------

We could use the new DMp's

dogiebitt · 14 Oct 2011

Alright I'll run it again. Took like 1.5 hours last time

In the mean time, attaching the latest minidump after the BSOD, if that helps.

dogiebitt · 15 Oct 2011

While running the "Windows_NT6_BSOD_v3.03_jcgriff2_" file from the How To thread, it BSOD again. Here is the new new minilog. Trying to run it again...

zigzag3143 · 15 Oct 2011

dogiebitt said:

While running the "Windows_NT6_BSOD_v3.03_jcgriff2_" file from the How To thread, it BSOD again. Here is the new new minilog. Trying to run it again...

Related to CI.dll. CI can be either a valid OS file or malware. Please run Malwarebytes just to rule out malware.

dogiebitt · 15 Oct 2011

Code:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7955

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

10/15/2011 3:27:21 PM
mbam-log-2011-10-15 (15-27-21).txt

Scan type: Quick scan
Objects scanned: 175984
Time elapsed: 12 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

dogiebitt · 15 Oct 2011

So after numerous attempts at a chkdsk, it finally ran. I was then able to also run it in /f and /r. It found and fixed a bunch of errors
some bad clusters included
\windows\system32\driver~1\filere~1\igdlh6~2.inf\igdumd64.dll
\windows\system32\driver~1\filere~1\igdlh6~2.inf\igfxext.exe
\system~1\{3d3d8~1

I then tried to run sfc /scannow and it again got to 76%, and gave error

Code:

C:\Windows\system32>sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 76% complete.
Windows Resource Protection found corrupt files but was unable to fix some of th
em.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.log

CBS.log attached.