PC hanging on shut down

Bossworld · 18 Nov 2010

Hi, have been searching all over the net for answers for my HTPC, don't seem to be able to use it for more than 2 weeks before a new problem occurs.

Standby mode works fine, goes into S3, wakes up to record, no issues there. Recently started using the Media Centre Standby Tool again but I believe that to be unrelated, as I've been having this problem intermittently even before that was installed.

Recently I've been experiencing some stutter on videos and live TV through MCE. When this happens, the machine will go onto the 'shutting windows down' screen, but will either take 7/8 minutes to switch off, or stay there indefinitely. Sometimes it will restart OK without issue, but this is getting few and far between. Tried to download the hotfix for the hang, no difference. For what it's worth, if I hard power the machine off when it hangs, then go back into MCE, it is usually ok.

Thought it may be something to do with the 640GB drive. This is because sometimes the hard drive won't display any folders within Explorer after it's been heavily used. So, i've moved everything off, did a full reformat through windows, and transferred everything back on. No difference to this shutdown issue. Reason for trying this was that I've been using a newsgroup program that was taxing the hard drive quite hard, but was still within the manufacturer's tolerance levels for temperature (46 degrees C).

This last time, was watching an HD satellite channel. CPU usage seemed to waver between 50 and 70 (which is higher than usual) but nothing out of the ordinary was jumping out in the processes. It isn't always to do with that 640GB drive not showing files either.

As another note, I restarted last night, it played TV fine for 3 hours, went to sleep last night, woke it up this morning and still working fine. Can't establish a pattern to it.

If I post a log (if someone can tell me where and how), can anyone diagnose?

Many thanks

Bossworld · 18 Nov 2010

Sorry for not following instructions, have run that exe and the report and the other system report are attached.

Interestingly ,noted the following error tv_ConfigMgrErr24 which I'm now going to google.

System spec:
Scaleo E custom case/250W power supply
2x DVB-S tuner cards
bluetooth usb (belkin)
320GB 2.5" drive, 640GB 3.5" drive
samsung bluray combo
usb dual dvb-t
win 7 HP retail 32 bit
nvidia gt220 (asus bravo)

EDIT: only thing of note relating to that device is that when hidden devices on device manager are shown, there is an entry under 'non plug and play drivers' for 'null', showing a code24.

The only thing of note with this is the device class guid, which is 8ECC055D-047F-11D1-A537-0000F8753ED1

According to some sources this is a rootkit, although I don't have the other matching registry entries to go with that theory?

usasma · 20 Nov 2010

Just a whole pile of suggestions in no particular order.
BLUF (Bottom Line Up Front) - I suspect that the outdated Norton/Symantec product is the largest problem that you have (but not the only one).

1 - Just in case, run the free TDSS Killer application from here: http://support.kaspersky.com/viruses...?qid=208280684
A friend of mine sees recurrent infections from this at work a lot - it's due to the router being compromised because the password was never changed from the default. The "fix" is to reset the router completely to defaults, reset your security settings and change the password on the router.

2 - Set a system restore point, then try this registry edit for the NULL device. If it doesn't fix the "Null" thing, then use System Restore to reset the system. http://siebn.de/other/nulldevice/ Yes, it's an XP article, but it'll probably work with Win7 (most of the entries are on my Win7 system). If not, the System Restore will put it back to the way it was before we started messing with it.

3 - I suggest starting all troubleshooting with the following diagnostic tests. They'll save you a lot of time and heartache if there is a hardware failure, and you'll have the disks on hand in case you need them in the future:

H/W Diagnostics:
Please start by running these bootable hardware diagnostics:
Memory Diagnostics (read the details at the link)
HD Diagnostic (read the details at the link)

Also, please run one of these free, independent online malware scans to ensure that your current protection hasn't been compromised: Malware (read the details at the link)

4 - Both MalwareBytes and Norton/Symantec are in your startups. I'd suggest uninstalling MalwareBytes, then doing the following with Norton/Symantec:

Anti-Virus Removal:
Please do the following:
- download a free antivirus for testing purposes: Free AntiVirus
- uninstall the Norton/Symantec from your system (you can reinstall it, if so desired, when we're done troubleshooting)
- remove any remnants of Norton/Symantec using this free tool: KB Article Not Found
- IMMEDIATELY install and update the free antivirus
- check to see if this fixes the BSOD's

FWIW - the Norton/Symantec product has some very outdated drivers, I'd suggest not reinstalling it until you can get a more current copy.

5 - I would wonder about these drivers as they are mentioned in the dump files:

mod7700.sys Thu Aug 13 10:31:07 2009 (4A8423AB) - VIA RAID driver for X86-32
vsmraid.sys Fri Jan 30 20:13:29 2009 (4983A5B9) - VIA RAID driver for X86-32

My suggestion here is to download a fresh copy, uninstall the current copy, and install the fresh copy, then monitor for further problems.

6 - It is possible that the following older drivers may be causing your problems.
Please either REMOVE or Update the older drivers listed below.

HOW TO FIND DRIVERS:
DO NOT use Windows Update or the Update Driver function of Device Manager as they are not the most current versions available.
Also, DO NOT update from the PC Manufacturer's website unless the Driver Reference cited below states that you should get the drivers from the OEM.

The most common drivers are located on this page: Driver Reference
If you can't find the driver, post back and we'll see what we can find.

Here's the older drivers that were found in the memory dump files:

Code:


SRTSP.SYS    Mon Jan 21 23:58:54 2008 (4795780E)
 - Norton/Symantec AutoProtect
 - Driver Reference

SYMEVENT.SYS Mon Jan 14 18:29:24 2008 (478BF054)
 - Norton/Symantec Event Library
 - Driver Reference

SRTSPX.SYS   Tue Jan 22 00:00:19 2008 (47957863)
 - Norton/Symantec AutoProtect
 - Driver Reference

SYMTDI.SYS   Mon Jan 08 21:31:16 2007 (45A2FE74)
 -  Norton/Symantec Network Dispatch Driver
 - Driver Reference

SPBBCDrv.sys Thu Jan 17 21:12:20 2008 (47900B04)
 - Norton/Symantec Firewall driver
 - Driver Reference

SYMREDRV.SYS Mon Jan 08 21:34:37 2007 (45A2FF3D)
 - Norton/Symantec Redirector Filter driver
 - Driver Reference

7 - BSOD BUGCHECK SUMMARY

Code:


Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Debug session time: Tue Nov  2 19:56:22.073 2010 (UTC - 5:00)
System Uptime: 1 days 7:21:46.041
*** WARNING: Unable to verify timestamp for vsmraid.sys
*** ERROR: Module load completed but symbols could not be loaded for vsmraid.sys
DEFAULT_BUCKET_ID:  INTEL_CPU_MICROCODE_ZERO
BUGCHECK_STR:  0x9F
PROCESS_NAME:  System
Bugcheck code 0000009F
Arguments 00000003 84eb36b0 82f68ae0 85550df8
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Debug session time: Fri Oct 29 01:33:45.828 2010 (UTC - 5:00)
System Uptime: 0 days 13:56:55.796
*** WARNING: Unable to verify timestamp for mod7700.sys
*** ERROR: Module load completed but symbols could not be loaded for mod7700.sys
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0xFE
PROCESS_NAME:  System
Bugcheck code 000000FE
Arguments 00000002 87a302d0 85f7b858 a0914a74
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

Bossworld · 21 Nov 2010

Many thanks for that update.

Trend micro online scan and that rootkit scanner show 0 threats.

I've just ran through it, i've also just noticed in event viewer there are a several thousand messages of

'Reset to device, \device\raidport0, was issued'

Event ID 129, source vsmraid

So that would perhaps tie into the SATA controller there. For what it's worth, my motherboard has one on board SATA, i've disabled the onboard IDE controller, and I have a VIA addin PC card that gives me two extra SATA ports - one is used by the secondary hard drive (that I thought was causing issues), and the other is my bluray combo drive. I am not using a RAID setup. That addin card is not bootable (but I've just made it so by flashing the VIA ROM into the BIOS). VIA also state that they don't update the driver for this: http://www.via.com.tw/en/support/tech_faq.jsp#win7

Mod7700.sys should related to a DVB-T tuner, I'm using the most available version from Elgato. If it's any help, it was installed as a workaround for 100% compatible hardware that didn't have it's own Windows driver.

For what it's worth, I've disabled the Windows 7 background DVB scanner and that seems to have stopped the stuter, I did have a lock up about an hour ago but that hung on 'logging off' rather than 'shutting down' so may have been an unrelated issue.

I'm unable to import that registry file, a couple of days ago I deleted the unknown device. I've then been able to import that file the first time around after changing the permissions, but now checked in device manager and the device is there but not installed properly. Now when trying to import the file again I'm told that some keys are in use.

Have uninstalled Malwarebytes and Symantec, and upgrading to the latest corporate version (endpoint protection)

Bossworld · 21 Nov 2010

The null device is now showing as 'working properly' in device manager, although event viewer still states "the following boot-start or system-start drivers failed to load Null"

Not bothered if it's not causing an issue.

Cleared event viewer's log and that other error message relating to the RAID hasn't appeared yet.

Will just have to try and run this as it is for a couple of days and see if the hangs return.

EDIT: I think I've isolated it down to Newsleecher. Just hanged again there, machine wouldn't shut down, had to hard power off. Checked event viewer and there were several entries of "Reset to device, \Device\RaidPort0, was issued." against VSMRAID.

Any ideas what that entails? Unfortunately for some reason I am unable to either of the ISO images you linked to, to boot. Windows 7 installation DVD boots fine.

------------

EDIT 2: I've somehow updated the VIA driver (found one in a Vista folder online), and for the first hour or so it's ok when left downloading, then there's a whole host of the same 'reset to device' warnings, every 4 minutes or so, now to the new VIAMRAID.

Newsleecher is also saying that it's having to pause downloading so the disk can keep up.

Could it just be that I'm overloading whatever bus it is? In which case I'm thinking the most viable solution is to ditch the two hard drives, and buy another much larger one, leave that on the internal controller and then hopefuly the Blu-Ray drive should still be ok left on the VIA card.

The drive is now also taking a long time to navigate through in Windows media centre. So it would seem that all of my problems are hardware related, and I'm guessing that either the hard drive or the SATA controller are overheating and not responding - I can't even get speedfan to fully run to check what the temperature is.

usasma · 21 Nov 2010

I'd suggest getting rid of Newsleecher for the time being. You can easily reinstall it later (after we're done troubleshooting).

As for the vsmraid, this is a very significant problem and it's most likely the source of your issues. I'd suggest uninstalling the software for the card and then removing the card from the system. Then check to see if the errors recur.

Bossworld · 22 Nov 2010

Hi,

There isn't actually any software for the card, VIA's website states that drivers are included within Windows 7. I've only managed to change it by installing a Vista driver.

I'll ditch Newsleecher then, I'd imagine the errors are going to disappear. Will give it 24 hours then confirm back just so this one can be put to bed.

usasma · 22 Nov 2010

Well, I wouldn't do anything with the vsmraid driver. My worry is that if we disable that driver, it'll render your entire system inoperable. We can fix it, but it may take some detailed work (booting to another OS, mounting your registry in that OS, and re-enabling the driver there.

Another option would be to rename the driver from vsmraid.sys to vsmraid.BAK and see if that breaks the computer. That can be fixed more easily by booting to another OS and naming the file back to .sys

Bossworld · 23 Nov 2010

For what it's worth, I've uninstalled Newsleecher, I've been using another program (with a web interface) all last night without a single error.

The only warnings I've found are relating to HID (bluetooth devices going out of range) which is absolutely fine.

It would seem that there is perhaps an underlying issue that the system can't sustain the data transfer rate that NL was wanting between the two drives.

The VSMRAID errors were now VIAMRAID errors, but as I say since changing programs that has completely stopped and the system seems stable.