BSOD while PC is left idle (sleep?)

desertdubu · 03 Jul 2013

Hello, in the past week or so my PC has been crashing while left idle. When I try and click my mouse my tv that I run an HDMI cable from my monitor into recieves no signal, when I turn my monitor on I see my desktop but not my mouse, and sometimes it makes a beep noise when I try and click. I have to do a hard reboot to get it working again. I have attached my SF zip file. Thank you.

Arc · 04 Jul 2013

The zip you uploaded does not contain any crash dump.

Follow it: Dump Files - Configure Windows to Create on BSOD
Go to Option Two, Point 2. Download the .reg file and merge it in registry by double clicking it.

Now wait for another BSOD. When it occurred, search the .dmp files manually in the default path: C:\Windows\Minidump or %SystemRoot%\Minidump. See if the crash dump is recorded or not (hopefully it will be recorded).Post it following the Blue Screen of Death (BSOD) Posting Instructions.

As it is a desktop, you may disable sleep there. Sleep function is needed for Laptops or other mobile computers, not for Desktop PCs.
Start > Control Panel > Power Options.
Under the existing plan, Click on "change plan settings.
In the next page, Put to sleep: Never.
Attachment 275034

It will be a worthy shot.

desertdubu · 08 Jul 2013

Hello, thanks for replying, I've been out this past weekend away from my pc.

I downloaded and ran that extension you sent last night, this morning I found it had crashed so I did a hard reboot and found the Minidump folder but it was empty. Is there another way I can find and record what happened?'

As for the sleep option, I went into the power options and noticed I had already set the sleep time to never, so I'm guessing the crash isn't related to when the pc sleeps.

Northernsoul55 · 08 Jul 2013

Hi,

Concerning dump files:

1. Have you run ccleaner recently, as that will usually wipes the dump files?
2. Also have you checked to be sure that your

pagefile is at least 400 mb larger than the
installed RAM?
3. Did you configure windows correctly as Arc suggested:

https://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html

Please check these and run the SF Tool once again

Tip

Ensure you click the "GRAB ALL" button and then wait for each window to appear in turn and then click OK

Suggestions:

Please remove Norton from your system. Also do you have AVG installed?
If so remove please as having two AV on your system may cause conflicts

Norton and it's other products are known to cause BSODs with Windows 7, Norton is a very resource-consuming program too, it's best to remove all traces of Norton using the

Norton Removal Tool, and then installing this free and proven alternative which work with Windows 7.

Microsoft Security Essentials.

Recommended from a strict BSOD perspective, compatibility & stability
compared to other antiviruses/internet security software.

Note

Once downloaded, update and run a full system scan

I would also remove Programs:

Please uninstall Daemon tools as it is well known for BSOD.

Start > click on Computer > Uninstall or change a program > choose Daemon tools. Reboot.

Once uninstalled please go here and remove the SPTD driver itself with this tool:

http://www.duplexsecure.com/en/downloads

Warning

If the uninstall button is grayed out when you run the program you dont need to do anything and can close the window, if it is not click it and allow it to run. DO NOT click the install button as it will install a driver known to cause BSODs onto your system.

Otherwise, go to C:\Windows\System32\drivers, look for and delete SPTD.sys manually. Reboot

Also remove:
Glary Utilities
PowerISO
MagicISO

If you have any issues removing these programs use:

Revo Uninstaller
Download and install Revo Uninstaller free from here: Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

Opt for "Advanced Mode" and uninstall the software (also delete the leftover registry entries).

Does your issue still remain?

Cheers

Dave

desertdubu · 16 Jul 2013

Hello, I tried the steps you gave, but I'm still getting the crashes. I did manage to find a dump file in the minidump folder which I have included in the SF zip file if that might help. Thank you.

Arc · 16 Jul 2013

It is a stop 0x24, NTFS_FILE_SYSTEM BSOD. Let us do some things and see how it goes.

Uninstall AVG. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one. For some extra security reasons, scan the system for possible virus infection with the following programs, too.

Uininstall MagicISO.

No code has to be inserted here.

This mcdbus.sys SCSI adapter can cause a BSOD under observation, too.

Do some Disc checks.

Reseat the sata and power.
Run chkdsk /f/r, following the option two of the tutorial Disk Check
Seatool for dos: SeaTools | Seagate download
Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

** You can use Win32 DiscImager to create a bootable USB and run Seatools for DOS. Follow this post to know how to make a bootable Seatools USB.
Post a screenshot of your HDD using CrystalDiskInfo - Software - Crystal Dew World

XBox USB wireless controller needs to be updated. That old driver is a known cause of BSOD.

Code:

fffff880`06674000 fffff880`06686100   xusb21     (deferred)             
    Image path: xusb21.sys
    Image name: xusb21.sys
    Timestamp:        Fri Aug 14 03:40:17 2009 (4A848F49)
    CheckSum:         00020048
    ImageSize:        00012100
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Get it from Software Downloads | Microsoft Hardware

And, update your display driver to NVIDIA DRIVERS 320.49WHQL

Let us know the results.
_______________________________________________________________________________
BSOD ANALYSIS:

Code:

....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88009ce9898, fffff88009ce90f0, fffff880012cbf25}

Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteInternalAttributeStream+95 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88009ce9898
Arg3: fffff88009ce90f0
Arg4: fffff880012cbf25

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88009ce9898 -- (.exr 0xfffff88009ce9898)
ExceptionAddress: fffff880012cbf25 (Ntfs!NtfsDeleteInternalAttributeStream+0x0000000000000095)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88009ce90f0 -- (.cxr 0xfffff88009ce90f0)
rax=0000000000000001 rbx=0000000000000000 rcx=fffffa8004b4a880
rdx=0000000000000000 rsi=0100000000000000 rdi=fffff8a0092a97d0
rip=fffff880012cbf25 rsp=fffff88009ce9ad0 rbp=fffff88009cc8980
 r8=fffffa800727d248  r9=0000000000000000 r10=fffffa8004b4a180
r11=fffff88009cc8730 r12=fffff88009cc8700 r13=0000000000000000
r14=fffff88009cc8730 r15=fffff8a0092a99c0
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
Ntfs!NtfsDeleteInternalAttributeStream+0x95:
fffff880`012cbf25 66895e5a        mov     word ptr [rsi+5Ah],bx ds:002b:01000000`0000005a=????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000330a100
GetUlongFromAddress: unable to read from fffff8000330a1c0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsDeleteInternalAttributeStream+95
fffff880`012cbf25 66895e5a        mov     word ptr [rsi+5Ah],bx

FAULTING_IP: 
Ntfs!NtfsDeleteInternalAttributeStream+95
fffff880`012cbf25 66895e5a        mov     word ptr [rsi+5Ah],bx

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff880012abf4b to fffff880012cbf25

STACK_TEXT:  
fffff880`09ce9ad0 fffff880`012abf4b : fffff8a0`092a96a0 fffff880`09cc8980 fffff8a0`092a97d0 fffff880`09cc8504 : Ntfs!NtfsDeleteInternalAttributeStream+0x95
fffff880`09ce9b20 fffff880`0121c699 : fffffa80`04f2e720 fffffa80`0506f5a0 fffff880`09cc8690 fffffa80`04a6a060 : Ntfs!NtfsCommonCleanup+0x76b
fffff880`09ce9f30 fffff800`030ca6f7 : fffff880`09cc8690 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCleanupCallout+0x19
fffff880`09ce9f60 fffff800`030ca6b8 : 00000000`00000000 00000000`00000000 fffff880`09cea000 fffff800`030dea42 : nt!KySwitchKernelStackCallout+0x27
fffff880`09cc8560 fffff800`030dea42 : fffffa80`03ee48a0 00000000`00000002 fffff880`09cc8500 fffff880`00000030 : nt!KiSwitchKernelStackContinue
fffff880`09cc8580 fffff880`0121c712 : fffff880`0121c680 00000000`00004d98 fffff880`09cc8900 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0x2a2
fffff880`09cc8660 fffff880`012ba7f4 : fffff880`09cc8730 fffff880`09cc8730 fffff880`09cc8730 fffff880`01345750 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
fffff880`09cc86d0 fffff880`01063bcf : fffff880`09cc8730 fffffa80`0506f5a0 fffffa80`0506f940 fffffa80`046f9cb0 : Ntfs!NtfsFsdCleanup+0x144
fffff880`09cc8940 fffff880`010626df : fffffa80`0496bde0 00000000`00000000 fffffa80`04801f00 fffffa80`0506f5a0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`09cc89d0 fffff800`033dd50f : fffffa80`0506f5a0 fffffa80`046a0b30 00000000`00000000 fffffa80`052e9070 : fltmgr!FltpDispatch+0xcf
fffff880`09cc8a30 fffff800`033cb504 : 00000000`00000000 fffffa80`046a0b30 00000000`00000000 fffffa80`052e9070 : nt!IopCloseFile+0x11f
fffff880`09cc8ac0 fffff800`033cb2c1 : fffffa80`046a0b30 fffffa80`00000001 fffff8a0`1173a4e0 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4
fffff880`09cc8b40 fffff800`033cb884 : 00000000`00000190 fffffa80`046a0b30 fffff8a0`1173a4e0 00000000`00000190 : nt!ObpCloseHandleTableEntry+0xb1
fffff880`09cc8bd0 fffff800`030d1e93 : fffffa80`04a6a060 fffff880`09cc8ca0 00000000`004e8b70 00000000`027591c0 : nt!ObpCloseHandle+0x94
fffff880`09cc8c20 00000000`7723140a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0155e3d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7723140a


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsDeleteInternalAttributeStream+95

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5167f5fc

STACK_COMMAND:  .cxr 0xfffff88009ce90f0 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsDeleteInternalAttributeStream+95

BUCKET_ID:  X64_0x24_Ntfs!NtfsDeleteInternalAttributeStream+95

Followup: MachineOwner
---------

desertdubu · 24 Jul 2013

Hello, I tried all of the steps in the post above except for Windows Defender Offline, I installed it on my USB stick but I can't figure out how to boot my pc from the usb. The Seatools test says my HD passed, and my cables all seem to be properly connected. Is it possible I just need a new harddrive?

One other note that may or may not be of importance, I cannot install the Microsoft update KB2791765, it fails every time I try with an "unknown error". This is the update in the MS database:
http://support.microsoft.com/kb/2791765

Arc · 25 Jul 2013

For the update issue, first try Windows Update - Reset and let us know if it is fixed or not. If not, we have to take the help of our update experts.

Usually the boot menu key for MSI is F8. Try it. Or see the POST scree, the BIOS setup and Boot Menu keys are listed there.

Anyway, have you had any more BSODs lately?

desertdubu · 26 Jul 2013

I reset the Windows update and checked again but it failed again installing that update. Here's the screenshot of my HDD.

I'm still getting the crashes, again usually when my pc is left idle but it also happened tonight when I launched a game.

Northernsoul55 · 27 Jul 2013

Hi,

Please look at

Windows Update Posting instructions

Post back the info.

Cheers

Dave