Win7 Ultimate Retail, BSOD

Phew! Four hours? Would have been quicker to remove Norton! Nothing stops a good learning curve though, so I took up your advice to look in Process Explorer. In the end from what I could see, none of the threads seemed to suggest anything linked to Norton, or networking.

But...I did find a new fangled service from Win7's own nest - Superfetch. Turns out this bit of code is to help to optimize your computer and keep things fresh. But that is an oxymoron when in my case at least, the entire svchost process was taking up 136 mb with Superfetch, and 7.7 mb without! Quite a difference! I have now disabled Superfetch in Services.msc and will keep an eye on general performance in case things really slow down. But so far it is not affected anything one iota. :S

I did read some months ago that Microsoft had found that the average graphics card had 10 times more processing power than the resident CPU. They had the idea therefore of offloading some of the processing to the graphics card, enabling the processor to to other things. I am told that Win7 is the first Windows OS to take advantage of this where possible - hence why a lot of things run well compared to Vista, despite a lot of shared code. Maybe Superfetch is one of those processes that would be priority offloaded to the graphics card in the first instance? I wonder about this as my card is basic, although it does support Aero, etc, My Windows rating is 4.0 for graphics, out of a possible 7.9; its just a musing anyway.

Anyway must dash, will let you know how the 7 days on, 7 days off experiment goes with Norton.

:)

Martin

MartinLondonUK said:

Phew! Four hours? Would have been quicker to remove Norton! Nothing stops a good learning curve though, so I took up your advice to look in Process Explorer. In the end from what I could see, none of the threads seemed to suggest anything linked to Norton, or networking.

But...I did find a new fangled service from Win7's own nest - Superfetch. Turns out this bit of code is to help to optimize your computer and keep things fresh. But that is an oxymoron when in my case at least, the entire svchost process was taking up 136 mb with Superfetch, and 7.7 mb without! Quite a difference! I have now disabled Superfetch in Services.msc and will keep an eye on general performance in case things really slow down. But so far it is not affected anything one iota. :S

I did read some months ago that Microsoft had found that the average graphics card had 10 times more processing power than the resident CPU. They had the idea therefore of offloading some of the processing to the graphics card, enabling the processor to to other things. I am told that Win7 is the first Windows OS to take advantage of this where possible - hence why a lot of things run well compared to Vista, despite a lot of shared code. Maybe Superfetch is one of those processes that would be priority offloaded to the graphics card in the first instance? I wonder about this as my card is basic, although it does support Aero, etc, My Windows rating is 4.0 for graphics, out of a possible 7.9; its just a musing anyway.

Anyway must dash, will let you know how the 7 days on, 7 days off experiment goes with Norton.

:)

Martin

Disabling superfetch is not a good idea from a performance standpoint. It optimises the way physical memory is used.

H2SO4 said:

Disabling superfetch is not a good idea from a performance standpoint. It optimises the way physical memory is used.

So what to do then? Superfetch was taking up the lions share of 136 mb, reduced to 7.7 mb. If I cannot see anything connected to Norton, and taking out Superfetch has this effect while memory remains stable, what are my other options?

MartinLondonUK said:

H2SO4 said:

Disabling superfetch is not a good idea from a performance standpoint. It optimises the way physical memory is used.

So what to do then? Superfetch was taking up the lions share of 136 mb, reduced to 7.7 mb. If I cannot see anything connected to Norton, and taking out Superfetch has this effect while memory remains stable, what are my other options?

You sound like a methodical person and I always appreciate that. Please don't mistake my tone for anything other than a purely mechanical attempt to get info across as efficiently as possible.

Unless I've misunderstood, the problem you're troubleshooting is that BSOD, right? If it's ongoing, you may wish to upload a few minidumps so that they can all be checked for consistency.

The advice to test without Norton is only meant to establish whether it is involved in the crash. Personally, I don't do this in order to hand out lofty opinions regarding the merits of one AV against another (and I don't think my esteemed colleagues are into that either), but only to try to identify the cause of a given crash. From an architectural standpoint, the function performed by an AV solution has the potential to cause the type of crash you're experiencing. Therefore, it is logical to test what happens without the AV, because a minidump is a tiny summary which is wholly inadequate for further "debugging" of the crash. What you choose to do afterwards, should it turn out that the Norton AV is indeed part of the problem, is entirely up to you.

As far as superfetch and that svchost instance are concerned, my advice is to forget about it. The behaviour you're describing (130MB when SF is active, <10MB without) is entirely normal and it is vanishingly unlikely to have anything to do with your BSOD. Crashes that occur due to memory exhaustion look very disctinct - this ain't one of 'em. The memory "consumed" by SF pays off in the form of more efficient RAM resource leveraging. You don't have to go far to see examples of people trying to minimise all memory usage in the belief that such an outcome will somehow speed up their system. That's misguided on so many levels it's hard to know where to start.

Suggestions:

1) Establish precisely what it is you're troubleshooting, so that you and those who're trying to help you are in no doubt.

2) If it's the periodic BSODding, upload multiple minidumps.

3) If they all look like the one Usasma and JCGriff looked at, test what happens when you uninstall the AV for a few days. Don't download dubious executables, don't open unknown attachments, and you'll be 'right without AV for a while.

H2S04,

To answer your questions:-

1. The original query, which still remains as the main query, is the issue of the BSOD. However in the response from jcgriff2, while he also suggested to remove Norton, there was a supplementary question about the amount of RAM in current use and why it appeared to be so high. Usasma then commented that one of the svchost processes seemed to carry a lot of memory and suggested that perhaps it was related to Norton as he had an experience himself. Hence all the sidetracked talk about Superfetch, graphics cards, etc. :)

2: To date I have only experienced one BSOD in Win7, the one three days after installation. Of course being experienced on a clean install so soon was not a pleasant surprise so that is why I need to establish what happened and prevent it in the future. As I said before, I have no idea when the next BSOD will occur, but hopefully these actions I take from the suggestions here will mitigate them. :) :)

3. Given that I have updated some of the 'Vista' drivers, not least due to to a line in the WinDbg report that mentions this as an issue, I'd thought I would see how everything performs under Norton for 7 days from last Wednesday, to finish tomorrow. Of course as we know the crash dumps can be too broad for their own good, so it is difficult to apply an accurate weighting to that line. Then I will take off Norton and test with Free AVG for the next 7 days. During this time I can also keep an eye on the system processes to see how things go. After that, if I want to kick Norton into the long grass, I am clear for take off.

Hope that clears everything up!
Martin

Hi -

I noticed in the screenshot that you have Ad-Aware running along with PC Tools security service and the late Norton. As-Aware is one to watch if BSODs return.

I saw your post on Windows 7 looking for its keys. The same thing happened here after testing KIS 2010. I believe its firewall got tangled in something and the next a/v scan somehow quarantined some files; not sure. I'm glad you got your key issue straightened out.

RE: svchost - those running Superfetch have most of the audio related services and it is not uncommon to find that particular svchost runnin >> 120k.

Regards. . .

jcgriff2

.