Periodic freezes in my system

cesm23 said:

wow.... before that, i almost tought there was no solution for this :) Another problem, you see, is that even if we can fix this problem of the midnight freeze, it's the hourly small freeze that is the most important to me, since i almost never capture anything at midnight, i just hope if we solve this one at midnight, that it might also solve the hourly ones.

Just because the problem's visible doesn't mean there's a practical solution

I'd suggest focusing on the midnight thing first, if only because it's so easy to spot. Perhaps the hourly freeze is indeed related in some way which is not obvious right now.

cesm23 said:

By the way can you download the log i uploaded in megaupload ? can you see if you are able to notice something similar to this too in that log ? As i told in the description, i did it exactly 10 seconds before and finished 10 seconds after.

I just looked at the megaupload log. Nothing obvious I'm afraid. It doesn't mean it's not in there, just that it might be like looking for a needle in a stack of needles. Do you actually perceive any sort of lockup in the user interface during the hourly freezes, or is it only the dropped frames in your videos which alert you to the existence of a problem?

I just looked at the megaupload log. Nothing obvious I'm afraid. It doesn't mean it's not in there, just that it might be like looking for a needle in a stack of needles. Do you actually perceive any sort of lockup in the user interface during the hourly freezes, or is it only the dropped frames in your videos which alert you to the existence of a problem?

Yeah indeed i don't notice anything at all in the user interface BUT there is for sure some freeze, because it's always exactly at each hour, and this never happened in windows xp by the way, it's ONLY in windows vista and windows 7 that this happens. altough just by the fact that it just drops ONE frame, that clearly indicates that the freeze should be quite small, therefore perhaps that's why it's not noticed in the logs. But since it also happens in a "scheduled" way it probably has a connection with the midnight freeze.

Oh also i almost forgot the 01:23:33 freeze too (this one it's not exactly a scheduled, it's just when the capture time duration reaches 01:23:33), altough i noticed that this one only happens if the other hourly one didn't happened in between. I will try also to do a log of this one too and also use the same method with the dump log too. This one you should notice because i also lose about the same amount of dropped frames, altough i don't remeber if there is any freeze in the user interface or not, i will check this out too when i do this.

cesm23 said:

Oh also i almost forgot the 01:23:33 freeze too (this one it's not exactly a scheduled, it's just when the capture time duration reaches 01:23:33), altough i noticed that this one only happens if the other hourly one didn't happened in between. I will try also to do a log of this one too and also use the same method with the dump log too. This one you should notice because i also lose about the same amount of dropped frames, altough i don't remeber if there is any freeze in the user interface or not, i will check this out too when i do this.

OK. If the theory is correct, the greater the magnitude of the freeze (the more it's apparent in the user interface), the easier it should be to spot in the Xperf log.

By the way, if you're interested you can easily look at those logs yourself (not that I mind doing it). The "xperfview" utility is included with that performance kit you installed - just feed it an ETL file and I'm sure you'll work out what to do from there.

H2SO4 said:

cesm23 said:

Oh also i almost forgot the 01:23:33 freeze too (this one it's not exactly a scheduled, it's just when the capture time duration reaches 01:23:33), altough i noticed that this one only happens if the other hourly one didn't happened in between. I will try also to do a log of this one too and also use the same method with the dump log too. This one you should notice because i also lose about the same amount of dropped frames, altough i don't remeber if there is any freeze in the user interface or not, i will check this out too when i do this.

OK. If the theory is correct, the greater the magnitude of the freeze (the more it's apparent in the user interface), the easier it should be to spot in the Xperf log.

By the way, if you're interested you can easily look at those logs yourself (not that I mind doing it). The "xperfview" utility is included with that performance kit you installed - just feed it an ETL file and I'm sure you'll work out what to do from there.

Hum... at first i tried to open them in explorer by double clicking in them but it would always appear this error :

---------------------------
Performance Analyzer
---------------------------
Trace 'E:\hourly_freeze.etl' could not be successfully opened [0x800700a1].

Aborting operation.

---------------------------
OK
---------------------------

And so i quit trying, but now that you said this, i had the idea of trying to open them in the program itself and it now worked. Lol i know this is something quite obvious but i am a bit lazy sometimes :)

By the way in the windows 7 system properties the memory dump settings, should i let it stay with these settings i show in the attached screenshot ? I ask this because since i have to wait another 24 hours after i do this log, it would be better to choose the most detailed dump, no ? Or the one you see selected in the screenshot is more than enought?

This time i started the trace exactly 15 seconds before midnight (using the latest settings you told me of course) and 15 seconds later i stopped. Then about 3 minutes later i did the crash as you told, and i send everything in the attached file. Wow around 192000 dpc's this time... Even tough the freeze was precisely one second.

cesm23 said:

This time i started the trace exactly 15 seconds before midnight (using the latest settings you told me of course) and 15 seconds later i stopped. Then about 3 minutes later i did the crash as you told, and i send everything in the attached file. Wow around 192000 dpc's this time... Even tough the freeze was precisely one second.

Hey, you're good at this computer lark

This time, the address of the function corresponding to all those DPCs is 0x8f24b6c0, although we can be almost certain it's the exact same function as last time, only relocated in memory after a reboot.

As per the minidump, the address is squarely in "kl1.sys" -a Kaspersky Labs driver, according to the web:

kd> lmvm kl1
start end module name
8f21a000 8f73a000 kl1 T (no symbols)
Loaded symbol image file: kl1.sys
Image path: \SystemRoot\system32\DRIVERS\kl1.sys

Does fully uninstalling (not just disabling) Kaspersky AV improve matters for either the midnight or the hourly freezes?

hum... first of all tell me how you did this, which program you use to find the adress in the minidump? It would be really usefull to me to find this later, since of course i am learning from this too and also i need to know how to diagnose dropped frames like this, because i am SO tired of dropped frames, that i need to do very advanced diagnosis like this. Also tell me if there is another way of finding those adresses or to make this minidump WITHOUT making windows crash like this ? There's gotta be another way without having to restart windows like this.

Well in fact i haven't tested yet the midnight freeze without kaspersky active, this is very interesting results altough i am WORRIED about this, because unfortunately as i said in the beginning of the topic, in a clean windows 7 install, that means WITHOUT kaspersky internet security suite installed the hourly freezes still happen, but in fact i haven't tested the midnight freeze like this, but then i am afraid this won't solve the hourly small freezes, i have to really analyse better the traces of the hourly freezes there's gotta be something in there to indicate the problem since if that didn't happened in windows xp there is someway to avoid it happening on windows vista and seven.

Ok then, next time i can i will test the midnight freeze with kaspersky disabled as you said. Meanwhile just tell me those things i asked in the first paragraph, since it's very important.

cesm23 said:

hum... first of all tell me how you did this, which program you use to find the adress in the minidump?

More info: https://www.sevenforums.com/crashes-d...tml#post288658

cesm23 said:

Also tell me if there is another way of finding those adresses or to make this minidump WITHOUT making windows crash like this ? There's gotta be another way without having to restart windows like this.

Yes. You can attach a "live" kernel debugger to a running system in a way that let's you inspect without modifying. Short version: start WinDBG as an admin (run as admin), ctrl+K, "local" tab, and then find the address via the 'lm' (list loaded modules) command.

cesm23 said:

...but then i am afraid this won't solve the hourly small freezes,...

I understand your concern. I was surprised when the address turned out to be in the kl1.sys range based on what you said about the hourly freeze happening even on a clean install (and I realise we were looking at a midnight log just then). Actually, I expected some sort of interaction between hal.dll and the hardware, but it's best not to guess in these situations. The memory address clearly implicates Kaspersky. Let's trust the numbers and see what happens with kl1 temporarily out of the picture.

thanks so much for the info to make me use this by myself too :)

Ok i just remembered now, i ALREADY tried to disable or even close kaspersky completly in windows xp when i once tried to prevent the midnight freeze to happen, i think it STILL did the midnight freeze but the dropped frames reduced to half, i am not too sure since this was several months ago... I think it's because even tough kaspersky's main program will be closed, the drivers are still working at the background.

Anyway i am not sure anymore if we should go on with this anymore, the midnight freeze isn't much serious to me, specially if i would have to use another internet security suite instead of kaspersky, and since without it installed the hourly freezes still happen... i guess the only thing left to do, is making a clean install of windows 7 again, and make douzens of hourly traces, perhaps in a clean install there will be a lot less stuff to appear in the trace and like this perhaps it's easier to find the thing causing the hourly freezes.