Additional errors found while troublrshooting BSOD

writhziden said:

Make sure you do not have a backup pending. The VSS errors indicate that the computer is trying to backup your computer files to a removable storage drive that is not connected.

I have 2 back up systems:
Local: USB-connected Seagate (Drive L) Scheduled daily at noon. No back-up pending.
On-line: Crashplan. Just checked the logs and there are some files not being backed-up which causes the back-up process to re-start every few minutes. Last bad back-up was at 4:37PM. Once I cleaned the files up (bad file types, etc), the following back up attempt was completed successfully and now there are no pending back ups. To my pleasant surprise, the following is showing in the event logs:
Last VSS error (EVENT ID 12294 ) at 4:37PM
At 4:40PM VSS Information (EVENT ID 8224): The VSS service is shutting down due to idle timeout.
And 2 hours later, still no VSS errors since:)
Also, at 4:37PM last Disk error (EVENT ID 11: The driver detected a controller error on \Device\Harddisk5\DR5
And 2 hours later, still no Disk errors since:)

Question 1: While this is great news (in addition to no more BSOD events:)), I am puzzled by the following: the Disk errors (EVENT ID 11) say The driver detected a controller error on \Device\Harddisk5\DR5
Harddisk5 is an external USB hard drive which is NOT backed-up on line to Crashplan server. Does it make sense that this error would go away when the pending on-line backups to Crashplan stopped?

Question 2: the only errors since 4:37PM are 2 CAPI2 errors (EVENT IT 4107) even though I followed the recommendations at Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server to resolve. I used the “Fix It” method (Microsoft Fix it 50531). Could it be that the "Fix It" method didn’t work and that I should try the alternative manual method described?

Question 3: I continue to have the problem which I mentioned at the beginning of this thread i.
During my debugging efforts I also ran System Health Report. I always get ONE error as follows:
Symptom: A service is reported as having an unexpected error code
Cause: One or more services has failed. The service did not stop gracefully, suggesting the service may have crashed or one of its components stopped in an unsupported way.
Details: Service exited with code not equal to 0 or 1077
If I double-click on “A service is reported as having an unexpected error code” I get the following:
Abnormally Stopped System Services
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

Any suggestion on how to handle?


Thanks again for the patience and for the very effective guidance,

Alright, now that we have cleaned up the controller errors, we can proceed with the other error. I was hoping the controller errors were related, but evidently not.

drdigital1 said:

I have 2 back up systems:
Local: USB-connected Seagate (Drive L) Scheduled daily at noon. No back-up pending.

Pay close attention to whether the controller error occurs only when the USB drive is not plugged in. My guess is, your system is trying to access the USB drive through the hidden removable disk, does not find the drive, but finds the hidden removable disk instead, and throws a controller error.

It may also be that despite you not having the drive backing up online, Windows was using the drive as a resource for the VSS operation.

Both of the above are just hypotheses, so you will have to determine which is most likely by monitoring for a few days.

drdigital1 said:

On-line: Crashplan. Just checked the logs and there are some files not being backed-up which causes the back-up process to re-start every few minutes. Last bad back-up was at 4:37PM. Once I cleaned the files up (bad file types, etc), the following back up attempt was completed successfully and now there are no pending back ups. To my pleasant surprise, the following is showing in the event logs:
Last VSS error (EVENT ID 12294 ) at 4:37PM
At 4:40PM VSS Information (EVENT ID 8224): The VSS service is shutting down due to idle timeout.
And 2 hours later, still no VSS errors since:)
Also, at 4:37PM last Disk error (EVENT ID 11: The driver detected a controller error on \Device\Harddisk5\DR5
And 2 hours later, still no Disk errors since:)

All great news (as you say)! :)

drdigital1 said:

Question 1: While this is great news (in addition to no more BSOD events:)), I am puzzled by the following: the Disk errors (EVENT ID 11) say The driver detected a controller error on \Device\Harddisk5\DR5
Harddisk5 is an external USB hard drive which is NOT backed-up on line to Crashplan server. Does it make sense that this error would go away when the pending on-line backups to Crashplan stopped?

See above for my hypotheses on this.

drdigital1 said:

Question 2: the only errors since 4:37PM are 2 CAPI2 errors (EVENT IT 4107) even though I followed the recommendations at Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server to resolve. I used the “Fix It” method (Microsoft Fix it 50531). Could it be that the "Fix It" method didn’t work and that I should try the alternative manual method described?

It could be the Fix It did not stick. You could try it again. If it still does not resolve the error, try the manual method.

drdigital1 said:

Question 3: I continue to have the problem which I mentioned at the beginning of this thread i.
During my debugging efforts I also ran System Health Report. I always get ONE error as follows:
Symptom: A service is reported as having an unexpected error code
Cause: One or more services has failed. The service did not stop gracefully, suggesting the service may have crashed or one of its components stopped in an unsupported way.
Details: Service exited with code not equal to 0 or 1077
If I double-click on “A service is reported as having an unexpected error code” I get the following:
Abnormally Stopped System Services
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

Any suggestion on how to handle?

I am unable to find anything in your error logs regarding svchost.exe or Abnormally Stopped System Services. The only service issues I see are Volume Shadow Copy Service (VSS) and Bonjour (you may want to read through Removing and reinstalling iTunes, QuickTime, and other software components for Windows Vista or Windows 7 and make sure to uninstall in the correct order or it may cause further problems with the Apple software). Anyway, I do not think the error you mention is critical since it is not mentioned in the administrative logs. If you are concerned, you can upload the perfmon report as in the https://www.sevenforums.com/crashes-d...tructions.html (we do not need the jcgriff2 report in this case, just the perfmon html file compressed/zipped and uploaded).

drdigital1 said:

Thanks again for the patience and for the very effective guidance,

You're welcome. :)

While a little confusing as to why, the bottom line is that I have no more disk errors (EVENT ID 11) at all (6+ hours!), while before I used to have them every few seconds
VSS errors still happen sometimes but in a short burst that disappears right away; when comparing event log timestamps, I found out that VSS errors coincide with backup to Crashplan server. Once the backup completes successfully, VSS errors stop.
CAPI2 errors (EVENT IT 4107) - the “FixIt” method (Microsoft Fix it 50531) described at Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server didn’t stick. So I tried the manual method described and the errors continued. I’ll keep looking at this.
And now to the last one:
Abnormally Stopped System Services
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

writhziden said:

If you are concerned, you can upload the perfmon report as in the https://www.sevenforums.com/crashes-d...tructions.html (we do not need the jcgriff2 report in this case, just the perfmon html file compressed/zipped and uploaded).

You will find the report enclosed

Alright, I've done a little more research into your problem. I suspect that the abnormally stopped system service is the result of a third party program. Go through the steps to Troubleshoot Application Conflicts by Performing a Clean Startup and see if the abnormally stopped system service still exists after a clean startup.

I think it’s time to declare victory.
1. All the major problems have been addressed successfully (BSOD, disk errors, VSS errors)
2. The remaining 2 problems i.e., the Abnormally Stopped System Service (see P.S. below) and CAPI2 errors EVENT ID 4107 don’t seem to have any bad effects and seem very widespread as lots of people on the Internet are complaining about these.
So, writhziden I want to thank you again for your infinite knowledge, patience and kindness; you are awesome!
P.S. the problem happens even with all non-Microsoft services disabled.

drdigital1 said:

I think it’s time to declare victory.
1. All the major problems have been addressed successfully (BSOD, disk errors, VSS errors)
2. The remaining 2 problems i.e., the Abnormally Stopped System Service (see P.S. below) and CAPI2 errors EVENT ID 4107 don’t seem to have any bad effects and seem very widespread as lots of people on the Internet are complaining about these.
So, writhziden I want to thank you again for your infinite knowledge, patience and kindness; you are awesome!
P.S. the problem happens even with all non-Microsoft services disabled.

You're welcome. Just be forewarned: I did notice one other possible cause of the abnormally stopped system service error; some have said it may be virus/malware related. You should scan your system for these. Good and Free system security combination. may help in that regard. Malwarebytes and SuperAntiSpyware both are good at catching things antivirus software might miss. Careful for any false positives, though.