Windows 7: My PC has been freezing/hanging intermittently since Thursday night.

EmjayTKD · 13 May 2012

My PC has been freezing/hanging intermittently since Thursday night.

Scanned Boot disk for viruses using rescue boot CDs:
-BitDefender Rescue CD 2010
-Avira AntiVir Rescue System
-Kaspersky Rescue CD 2010

It found some threats for already quarantines files, some threats in old emails on boot disk-not location of current email directory on D drive, some in temporary internet files, deleted some java files.

While booted from my Windows 7 install DVD in a command prompt (did this before Kaspersky):
-I ran a thorough file system check with Chkdsk C: /F /R (2.5 hrs), fixed a few things, also confirmed boot disk is fine
-Ran system file checker: sfc /scannow /offbootdir=c:\ /offwindir=c:\windows
System File Checker said Windows resource protection did not find any integrity violations.

I worked through troubleshooting steps for windows 7. It’s not a booting issue and I don’t seem to have any viruses.

Yesterday, I got the blue screen of death. I was able boot normally again but a few hours later, my PC froze/ hung. Sometimes after logging in, before it’s started all startup programs it hangs, other times shortly after all programs started, other times a few hours later.

When booting in safe mode with networking, sometimes it hangs after loading the last driver. I don’t think it’s hung in that mode once I can login. Many programs don’t start or crash in that mode, I’m guessing because only basic files and drivers are loaded,
Crash:
Thunderbird v8

Won’t start
Event viewer (is that normal?), explorer (Using explorer++ ok)

It seems like the PC hardware may be ok, since Kaspersky rescue CD Linux OS ran for > 12 hours with no crash. There must be a problem with a device driver, or program, however, I haven’t installed anything related to hardware recently.

I don’t have a recent memory.dmp crash dump file even though when I got the BSOD, it said it dumped physical memory to disk.
In C:\Windows, I only have a memory.dmp file from 2009. Windows is configured for the default-kernel memory dump & %SystemRoot%\MEMORY.DM. Other options are none or small memory dump. Overwrite any existing file wasn’t checked, so I checked it now. C:\Windows\Minidump doesn’t exist.

My PC has been running in safe mode with networking now for 4.5 hours ok. Just running Thunderbird email client, explorer++, msconfig and taskmgr. I burnt a CD of Ultimate Boot CD.

OS: Windows 7 Ultimate 32bit SP1, retail version. I upgraded from Windows Vista Ultimate retail version in April 2011.

My PC hardware (Feb 2009):
1) Motherboard: Asus P5Q Socket LGA775
2) Intel Quad Core Q9450 2.66 GHz CPUs
3) 4 GB DDR2 PC6400 dual channel memory - 2 x 2GB DIMMs (3.25GB usable)
4) Hard disk-Seagate ST3500320AS 500 GB SATA 7200 rpm 32 MB cache, 3 yr warranty boot
5) Hard disk-Seagate ST31500341AS 1500 GB SATA 7200 rpm 32 MB cache x 2, 3 yr warranty (first one is for data, second one is for backup)
6) LG GH22NS30 SATA 22x/22XDVD-RW burner
7) Video card-Zotac 9600GT amp 512 PCEI

writhziden · 14 May 2012

Please upload your msinfo32.nfo file. To get this: Start Menu -> Type msinfo32 into the Search programs and files box -> When it opens, go to File, Save -> Save as msinfo32.nfo and save in a place you will remember -> Let it finish the process of gathering and saving the system info -> Right click the .nfo file, click send to compressed (zipped) folder -> Upload the .zip file here.

Make sure the problem is not due to a startup program or service that is conflicting with your system: Troubleshoot Application Conflicts by Performing a Clean Startup

EmjayTKD · 15 May 2012

May 14, 6pm-I got another BSOD after 5 hours running in normal mode. Kernel_stack_inpage_error. I now have a dump to attach using the BSOD instructions.

writhziden · 15 May 2012

You have two security programs running that accomplish similar tasks. This can result in system instability due to them accessing system files simultaneously.

Code:

avastsvc.exe	c:\program files\avast software\avast\avastsvc.exe	1752	8	200	1380	5/15/2012 1:49 AM	7.0.1426.0	43.72 KB (44,768 bytes)	5/14/2012 1:00 PM
avastui.exe	c:\program files\avast software\avast\avastui.exe	1004	8	200	1380	5/15/2012 1:50 AM	7.0.1426.0	4.05 MB (4,241,512 bytes)	5/14/2012 1:00 PM
defwatch.exe	c:\program files\symantec antivirus\defwatch.exe	2444	8	200	1380	5/15/2012 1:49 AM	10.2.0.276	30.15 KB (30,872 bytes)	11/28/2006 6:34 AM
rtvscan.exe	c:\program files\symantec antivirus\rtvscan.exe	4996	8	200	1380	5/15/2012 1:50 AM	10.2.0.276	1.87 MB (1,962,136 bytes)	11/28/2006 6:34 AM

Please remove one of these programs. It appears Symantec Client Security is old software and should be removed and/or replaced with the current solution for Enterprise systems. If this is business related security, speak with your IT department regarding the conflict above; I would also recommend speaking with your IT department regarding your freezes/crashes if this is a business PC.

Possible out of date drivers:

Code:

thdudf	a8efe000	a8f0e580	Fri Apr 14 06:57:05 2006 (443f9c21)	000158be		thdudf.sys
SPBBCDrv	96999000	969ff000	Fri Oct 06 15:01:22 2006 (4526c422)	00066f19		SPBBCDrv.sys
SYMEVENT	919de000	91a00000	Tue Oct 17 22:13:40 2006 (4535a9f4)	0001e2a5		SYMEVENT.SYS
ASACPI	9ca00000	9ca08000	Tue Oct 17 23:44:46 2006 (4535bf4e)	0000b97e		ASACPI.sys
SYMTDI	9696d000	96998f00	Mon Oct 23 18:26:29 2006 (453d5db5)	00038671		SYMTDI.SYS
PdiPorts	9d3fb000	9d3fd300	Thu Nov 16 17:31:13 2006 (455d02d1)	0000676c		PdiPorts.sys
SRTSP	91804000	9184d000	Fri Nov 17 23:00:27 2006 (455ea17b)	0003dfa6		SRTSP.SYS
SRTSPX	9184d000	9185e000	Fri Nov 17 23:00:27 2006 (455ea17b)	0000efaf		SRTSPX.SYS
NmPar	9ecc3000	9ecdb000	Mon Dec 18 23:22:34 2006 (4587852a)	0001ab0a		NmPar.sys
timntr	8c54c000	8c5b6380	Wed Aug 29 06:13:12 2007 (46d562d8)	00071864		timntr.sys
tifsfilt	a8eda000	a8ee3340	Wed Aug 29 06:37:17 2007 (46d5687d)	0000b7a1		tifsfilt.sys
npf	9fc29000	9fc2fb00	Tue Nov 06 13:09:15 2007 (4730c9eb)	0000a7f5		npf.sys
tdrpman	8c198000	8c1f0540	Mon Nov 12 06:35:28 2007 (473856a0)	0005e9a4		tdrpman.sys
snapman	8c600000	8c61ea60	Thu Nov 22 01:19:58 2007 (47453bae)	00028219		snapman.sys
AsIO	9bc7c000	9bc7d440	Mon Dec 17 02:10:20 2007 (47663cfc)	00010d25		AsIO.sys
PxHelp20	8c18e000	8c197200	Wed Mar 12 19:57:44 2008 (47d88a18)	00011c5a		PxHelp20.sys
iaStor	8c00c000	8c0da000	Tue Apr 15 18:07:31 2008 (48054343)	000502de		iaStor.sys
dump_iaStor	9fec9000	9ff97000	Tue Apr 15 18:07:31 2008 (48054343)	000502de		dump_iaStor.sys
mv61xx	8c0da000	8c11a000	Tue Jun 10 04:25:20 2008 (484e5690)	00026722		mv61xx.sys
SCDEmu	96800000	9680ce20	Mon Jul 07 01:40:49 2008 (4871c881)	000122c2		SCDEmu.SYS
LVUSBSta	9fc17000	9fc1f900	Tue Dec 16 22:40:09 2008 (494890b9)	0001406e		LVUSBSta.sys
RTKVHDA	9fc37000	9fe73900	Mon Mar 30 03:13:37 2009 (49d08d41)	002426f4		RTKVHDA.sys
nvlddmkm	9ca14000	9d379940	Thu May 14 14:32:27 2009 (4a0c7fdb)	00968560		nvlddmkm.sys

Older versions of ASACPI.SYS are a known BSOD problem on Windows 7. Update the driver by:

Going to the ASUS - Motherboards- ASUS P5Q
When you reach the website:
Select Windows 7 32bit for your OS.
Scroll down the page and click Utilities
Hold Ctrl and press f (ctrl+f) to enter the browser's find feature
Search for "ATK0110 driver for WindowsXP/Vista/Windows 7 32&64-bit" (without quotes)
Download and install the driver.
After installation is complete, verify that it installed correctly.
- Click Start Menu
- Click My Computer
- Go to C:\WIndows\System32\drivers\
- Verify that the ASACPI.SYS file is dated 2009 or newer (2010,etc.)

Thanks to JMH and zigzag3143 for the above information.

thdudf.sys
SPBBCDrv.sys
SYMEVENT.SYS
ASACPI.sys
SYMTDI.SYS
PdiPorts.sys
SRTSP.SYS
SRTSPX.SYS
NmPar.sys
timntr.sys
tifsfilt.sys
npf.sys
tdrpman.sys
snapman.sys
AsIO.sys
PxHelp20.sys
iaStor.sys under SATA Intel(R) Matrix Storage Manager Driver
dump_iaStor.sys under SATA Intel(R) Matrix Storage Manager Driver
mv61xx.sys under SATA Marvell 6121 SATA Driver V1.2.0.69 for 32/64bit Windows7.
SCDEmu.SYS
LVUSBSta.sys Logitech QuickCam
RTKVHDA.sys under Audio Realtek ALC1200 Audio Driver V6.0.1.5859 for Windows 7 & Windows 64bit 7.(WHQL)
nvlddmkm.sys

The crashes themselves indicate bad sectors on your hard disk.

If you are overclocking any hardware, please stop.
Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log.
For any drives that do not give the message:
Windows has checked the file system and found no problems
run disk check again as above. In other words, if it says:
Windows has made corrections to the file system
after running the disk check, run the disk check again.
Run the short and long tests with SeaTools.
SeaTools for Windows

SeaTools for DOS

EmjayTKD · 18 May 2012

Summary of activities:
I upgraded the ASUS ATK0110 ACPI utility driver.

While booted from my Windows 7 DVD in system repair, in a command prompt, I ran chkdsk <drive>: /F /R
On my boot disk and 2 data disks, D & E. It made changes the the filesystem on E, so I had to run it twice to get it clean (took 5 hours to run each time).

I also ran again:
SFC /scannow /offbootdir=C:\ /offwindir=C:\windows
Windows resource protection did not find any integrity violations

I then booted from the DOS SeaTools CD. I found out that an important firmware upgrade is required for my boot disk.
I ran the short test on all 3 drives, all 3 passed.
I ran the long test on all 3 drives, the 2 data drives passed. The boot drive had 14 bad sector errors, it was able to repair them, then passed the long test. I ran the long test again, it passed.

I then booted the PC normally and upgraded the firmware on the boot drive (and rebooted again).
I then did a backup of the D drive to the E drive.

The PC was up from May 17, 316pm until May 18, 1240am when I rebooted again for something else. That’s the longest it’s been running recently from the boot disk since all the problems started. It’s been up now for 27 hours (minus the reboot I did myself).

I noticed UAC wasn’t enabled, so I set it to the highest level. This isn’t a business PC. I don’t do any overclocking. The event manager no longer works.

Here’s the output of chkdsk:
The type of the file system is NTFS.
Volume label is Boot.

CHKDSK is verifying files (stage 1 of 5)...
847872 file records processed.

File verification completed.
557 large file records processed.
0 bad file records processed.
2 EA records processed.
60 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
913424 index entries processed.

Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
847872 file SDs/SIDs processed.

Security descriptor verification completed.
32777 data files processed.

CHKDSK is verifying Usn Journal...
13 percent complete. (0 of 34940840 USN bytes processed)
34940840 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
847856 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
100882119 free clusters processed.

Free space verification is complete.
Windows has checked the file system and found no problems.

488384511 KB total disk space.
83769032 KB in 226798 files.
123276 KB in 32778 indexes.
56 KB in bad sectors.
963671 KB in use by the system.
65536 KB occupied by the log file.
403528476 KB available on disk.

4096 bytes in each allocation unit.
122096127 total allocation units on disk.
100882119 allocation units available on disk.
Failed to transfer logged messages to the event log with status 50.

The type of the file system is NTFS.
Volume label is Data.

CHKDSK is verifying files (stage 1 of 5)...
591616 file records processed.

File verification completed.
40213 large file records processed.
0 bad file records processed.
8 EA records processed.
1 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
623192 index entries processed.

Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
591616 file SDs/SIDs processed.

Security descriptor verification completed.
15789 data files processed.

CHKDSK is verifying Usn Journal...
36964768 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
591600 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
2713369 free clusters processed.

Free space verification is complete.
Windows has checked the file system and found no problems.

1465136127 KB total disk space.
1453302728 KB in 535359 files.
238200 KB in 15790 indexes.
0 KB in bad sectors.
741723 KB in use by the system.
65536 KB occupied by the log file.
10853476 KB available on disk.

4096 bytes in each allocation unit.
366284031 total allocation units on disk.
2713369 allocation units available on disk.
Failed to transfer logged messages to the event log with status 50.

The type of the file system is NTFS.
Volume label is Data-BU.

CHKDSK is verifying files (stage 1 of 5)...
887488 file records processed.

File verification completed.
81354 large file records processed.
0 bad file records processed.
8 EA records processed.
0 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
919056 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
887488 file SDs/SIDs processed.

Security descriptor verification completed.
15785 data files processed.

CHKDSK is verifying Usn Journal...
365248 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
887472 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
2644279 free clusters processed.

Free space verification is complete.
Windows has checked the file system and found no problems.

1465136127 KB total disk space.
1453312028 KB in 535217 files.
242860 KB in 15786 indexes.
0 KB in bad sectors.
1004123 KB in use by the system.
65536 KB occupied by the log file.
10577116 KB available on disk.

4096 bytes in each allocation unit.
366284031 total allocation units on disk.
2644279 allocation units available on disk.
Failed to transfer logged messages to the event log with status 50.

writhziden · 18 May 2012

Looks much better, and appears the steps have provided better stability. Monitor for a few days and post back again how the system is responding.

EmjayTKD · 24 May 2012

MY PC hung again yesterday. I ran the SeaTools long test, it repaired some more bad sectors but I keep getting DST - failed - Electrical Element. Short test - DST - failed - Electrical Element.

With this error, will I still be able to clone the hard disk to another one?

EmjayTKD · 24 May 2012

I created the Seagate DiscWizard boot CD to clone my boot disk to a replacement hard disk.

The clone disc operation failed:
Operation with partition 'C' was terminated. Details: File record corrupted. (0x70019).

I tried it twice and got the same error. Does that mean that the MBR is corrupt and there's no way to
clone the data from one hard disk to another? Or it there something I can use to rebuild the MBR?

I can't seem to get the boot disk to pass a clean test using the SeaTools.

Is my boot disk (Seagate Barracuda 7200.11 ST3500320AS) beyond disc clone or data recovery?

writhziden · 24 May 2012

You can repair the MBR. See Troubleshooting Windows 7 Failure to Boot step 6.

EmjayTKD · 24 May 2012

The real question is what does 'DST - failed - Electrical Element' mean for my hard disk. What should
I be doing to resolve that issue.

Windows 7: My PC has been freezing/hanging intermittently since Thursday night.

My PC has been freezing/hanging intermittently since Thursday night. problems?