Multiple BSOD issue, 0XF4 was the only culprit caught.

squish8294 · 26 Nov 2014

Okay, so. I've had a couple of BSOD's today while doing video work using quicksync, another one while ripping a disc, and then I manually did one using the USB keyboard kernel dump of ctrl + scroll lock twice, and then, upon reboot, it BSODs before login 3 times. Everything before the manual crash dump my pc rebooted too fast to catch the bugcheck codes. I set the PC to NOT reboot after a crash if it BSODs, and forced it to BSOD with Bugcheck 0XE2 (Manual Bugcheck)

Then the 2 or 3 it gave me after this were stop ALL stop code 0XF4, critical system process or thread terminated, all before login. Any clues as to what caused it? I'm downloading windbg now to debug the crash dumps myself, to see what may have caused this issue.

Here's the windbg readout. Seems like a driver issue? I dunno.

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8011339060, Terminating object
Arg3: fffffa8011339340, Process image file name
Arg4: fffff80003598270, Explanatory message (ascii)
Debugging Details:
------------------
PROCESS_OBJECT: fffffa8011339060
IMAGE_NAME: wininit.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: wininit
FAULTING_MODULE: 0000000000000000
PROCESS_NAME: wininit.exe
EXCEPTION_CODE: (Win32) 0x5 (5) - Access is denied.
BUGCHECK_STR: 0xF4_5
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
STACK_TEXT:
fffff880`02ff19c8 fffff800`03620ab2 : 00000000`000000f4 00000000`00000003 fffffa80`11339060 fffffa80`11339340 : nt!KeBugCheckEx
fffff880`02ff19d0 fffff800`035cbabb : 00000000`00000001 fffffa80`1133bb50 fffffa80`11339060 fffff880`82ac8000 : nt!PspCatchCriticalBreak+0x92
fffff880`02ff1a10 fffff800`0354af04 : 00000000`00000001 00000000`00000001 fffffa80`11339060 0000007f`00000000 : nt! ?? ::NNGAKEGL::`string'+0x17486
fffff880`02ff1a60 fffff800`03291e53 : 00000000`00000008 00000000`00000005 fffffa80`1133bb50 00000000`00155cc8 : nt!NtTerminateProcess+0xf4
fffff880`02ff1ae0 00000000`776601af : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0024f738 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x776601af
STACK_COMMAND: kb
FOLLOWUP_NAME: MachineOwner
IMAGE_VERSION:
FAILURE_BUCKET_ID: X64_0xF4_5_IMAGE_wininit.exe
BUCKET_ID: X64_0xF4_5_IMAGE_wininit.exe
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0xf4_5_image_wininit.exe
FAILURE_ID_HASH: {9d5c7bc4-c11b-cfc3-c306-233fc3c94195}
Followup: MachineOwner

Also of note, I did run an sfc /scannow and it said some files were corrupt but unable to be fixed.

More on this in a moment, per the BSOD instructions thread.

essenbe · 26 Nov 2014

Hello, squish8294. I'll try to help you with this. First I need you to do something that will help us help you.

Please fill out your System Specs

Information

Your System Specs will help us to help you, and doing it in this manner will make them available to all helpers in every post and keep us from hunting for them. We ask that you fill them out in as much detail as possible including Desktop or Laptop, Model number if it is an OEM computer and all components with the Manufacturer and Model number if possible.

If you will go to your last post and click the 'System Specs' in the bottom left of the post, you will find a link to update your system specs. Please fill those out in as much detail as possible, making sure to click save at the bottom of the page. If you would like to know what we would like, you can click 'My System Specs' at the bottom left of this post to see mine. If you do not know what your components are, this will help you accomplish this task. System Info - See Your System Specs

After doing that, please run Check Disk Disk Check
then run Seatools for DOS SeaTools for DOS and Windows - How to Use. Please run the short and the long test. Let us know how the results come out.

squish8294 · 27 Nov 2014

system specs updated, will do the rest when I get home

essenbe · 27 Nov 2014

Great, just let us know the results.

squish8294 · 28 Nov 2014

Do you want me to run checkdisk for all drives?

squish8294 · 28 Nov 2014

Short Generic

SSD: pass
Momentus XT 500GB: pass
WDCAVIARBLUE: Pass
Barracuda: Pass

essenbe · 28 Nov 2014

Run the long test too. That's the one you will usually fail and yes, if it were mine I would run check disk. As I recall, your dump files did not blame the Hard drive for the BSOD, but it did show several I/O errors.

squish8294 · 29 Nov 2014

Long test: SSD pass, Momentus fail, WDCB pass, Barracuda pass. The momentus is NOT the OS drive in this scenario.

Edit: Inputting smart data from momentus

Code:

smartctl 6.3 2014-07-26 r3976 [x86_64-w64-mingw32-win7-sp1] (sf-6.3-1)
Copyright (C) 2002-14, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Family:     Seagate Momentus XT
Device Model:     ST95005620AS
Serial Number:    5YX1MD9K
LU WWN Device Id: 5 000c50 044ebeee2
Firmware Version: SD28
User Capacity:    500,107,862,016 bytes [500 GB]
Sector Size:      512 bytes logical/physical
Rotation Rate:    7200 rpm
Form Factor:      2.5 inches
Device is:        In smartctl database [for details use: -P show]
ATA Version is:   ATA8-ACS T13/1699-D revision 4
SATA Version is:  SATA 2.6, 3.0 Gb/s
Local Time is:    Sat Nov 29 03:58:56 2014 CST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED
See vendor-specific Attribute list for marginal Attributes.

General SMART Values:
Offline data collection status:  (0x00)    Offline data collection activity
                    was never started.
                    Auto Offline Data Collection: Disabled.
Self-test execution status:      (  25)    The self-test routine was aborted by
                    the host.
Total time to complete Offline 
data collection:         (  625) seconds.
Offline data collection
capabilities:              (0x73) SMART execute Offline immediate.
                    Auto Offline data collection on/off support.
                    Suspend Offline collection upon new
                    command.
                    No Offline surface scan supported.
                    Self-test supported.
                    Conveyance Self-test supported.
                    Selective Self-test supported.
SMART capabilities:            (0x0003)    Saves SMART data before entering
                    power-saving mode.
                    Supports SMART auto save timer.
Error logging capability:        (0x01)    Error logging supported.
                    General Purpose Logging supported.
Short self-test routine 
recommended polling time:      (   1) minutes.
Extended self-test routine
recommended polling time:      ( 102) minutes.
Conveyance self-test routine
recommended polling time:      (   2) minutes.
SCT capabilities:            (0x1001)    SCT Status supported.

SMART Attributes Data Structure revision number: 10
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x000f   120   096   006    Pre-fail  Always       -       0
  3 Spin_Up_Time            0x0003   097   097   000    Pre-fail  Always       -       0
  4 Start_Stop_Count        0x0032   100   100   020    Old_age   Always       -       468
  5 Reallocated_Sector_Ct   0x0033   100   100   036    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x000f   081   060   030    Pre-fail  Always       -       124307020
  9 Power_On_Hours          0x0032   086   086   000    Old_age   Always       -       12431
 10 Spin_Retry_Count        0x0013   100   100   097    Pre-fail  Always       -       0
 12 Power_Cycle_Count       0x0032   100   100   020    Old_age   Always       -       530
184 End-to-End_Error        0x0032   082   082   099    Old_age   Always   FAILING_NOW 18
187 Reported_Uncorrect      0x0032   001   001   000    Old_age   Always       -       4431
188 Command_Timeout         0x0032   100   253   000    Old_age   Always       -       0
189 High_Fly_Writes         0x003a   100   100   000    Old_age   Always       -       0
190 Airflow_Temperature_Cel 0x0022   073   062   045    Old_age   Always       -       27 (Min/Max 23/30)
191 G-Sense_Error_Rate      0x0032   100   100   000    Old_age   Always       -       0
192 Power-Off_Retract_Count 0x0032   100   100   000    Old_age   Always       -       337
193 Load_Cycle_Count        0x0032   093   093   000    Old_age   Always       -       14264
194 Temperature_Celsius     0x0022   027   040   000    Old_age   Always       -       27 (0 14 0 0 0)
195 Hardware_ECC_Recovered  0x001a   050   041   000    Old_age   Always       -       0
197 Current_Pending_Sector  0x0012   100   100   000    Old_age   Always       -       1
198 Offline_Uncorrectable   0x0010   100   100   000    Old_age   Offline      -       1
199 UDMA_CRC_Error_Count    0x003e   200   200   000    Old_age   Always       -       0

SMART Error Log Version: 1
ATA Error Count: 4401 (device log contains only the most recent five errors)
    CR = Command Register [HEX]
    FR = Features Register [HEX]
    SC = Sector Count Register [HEX]
    SN = Sector Number Register [HEX]
    CL = Cylinder Low Register [HEX]
    CH = Cylinder High Register [HEX]
    DH = Device/Head Register [HEX]
    DC = Device Command Register [HEX]
    ER = Error register [HEX]
    ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.

Error 4401 occurred at disk power-on lifetime: 12413 hours (517 days + 5 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 41 78 ff ff ff 4f  Error: UNC at LBA = 0x0fffffff = 268435455

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 00 78 ff ff ff 0f 00  14d+22:06:05.414  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  14d+22:06:00.967  READ LOG EXT
  60 00 78 ff ff ff 0f 00  14d+11:01:17.261  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  14d+11:01:12.769  READ LOG EXT
  60 00 78 ff ff ff 0f 00  13d+23:56:29.186  READ FPDMA QUEUED

Error 4400 occurred at disk power-on lifetime: 12413 hours (517 days + 5 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 41 78 ff ff ff 4f  Error: UNC at LBA = 0x0fffffff = 268435455

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 00 78 ff ff ff 0f 00  14d+11:01:17.261  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  14d+11:01:12.769  READ LOG EXT
  60 00 78 ff ff ff 0f 00  13d+23:56:29.186  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  13d+23:56:24.725  READ LOG EXT
  60 00 78 ff ff ff 0f 00  13d+12:51:41.091  READ FPDMA QUEUED

Error 4399 occurred at disk power-on lifetime: 12413 hours (517 days + 5 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 41 78 ff ff ff 4f  Error: UNC at LBA = 0x0fffffff = 268435455

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 00 78 ff ff ff 0f 00  13d+23:56:29.186  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  13d+23:56:24.725  READ LOG EXT
  60 00 78 ff ff ff 0f 00  13d+12:51:41.091  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  13d+12:51:36.657  READ LOG EXT
  60 00 78 ff ff ff 0f 00  13d+01:46:52.992  READ FPDMA QUEUED

Error 4398 occurred at disk power-on lifetime: 12413 hours (517 days + 5 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 41 78 ff ff ff 4f  Error: UNC at LBA = 0x0fffffff = 268435455

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 00 78 ff ff ff 0f 00  13d+12:51:41.091  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  13d+12:51:36.657  READ LOG EXT
  60 00 78 ff ff ff 0f 00  13d+01:46:52.992  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  13d+01:46:48.546  READ LOG EXT
  60 00 78 ff ff ff 0f 00  12d+14:44:53.394  READ FPDMA QUEUED

Error 4397 occurred at disk power-on lifetime: 12413 hours (517 days + 5 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 41 78 ff ff ff 4f  Error: UNC at LBA = 0x0fffffff = 268435455

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 00 78 ff ff ff 0f 00  13d+01:46:52.992  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  13d+01:46:48.546  READ LOG EXT
  60 00 78 ff ff ff 0f 00  12d+14:44:53.394  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  12d+14:44:48.947  READ LOG EXT
  60 00 78 ff ff ff 0f 00  11d+22:23:25.511  READ FPDMA QUEUED

SMART Self-test log structure revision number 1
Num  Test_Description    Status                  Remaining  LifeTime(hours)  LBA_of_first_error
# 1  Short offline       Aborted by host               90%     12412         -
# 2  Short offline       Completed: read failure       90%     10931         382460965
# 3  Short offline       Completed: read failure       90%     10931         382460965
# 4  Short offline       Completed without error       00%     10675         -
# 5  Short offline       Completed without error       00%      9437         -
# 6  Short offline       Completed without error       00%      8686         -
# 7  Short offline       Completed without error       00%       395         -

SMART Selective self-test log data structure revision number 1
 SPAN  MIN_LBA  MAX_LBA  CURRENT_TEST_STATUS
    1        0        0  Not_testing
    2        0        0  Not_testing
    3        0        0  Not_testing
    4        0        0  Not_testing
    5        0        0  Not_testing
Selective self-test flags (0x0):
  After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.

More edit: Chkdsk C no problems, Checking others now, with problems on barracuda and seagate.

Laith · 29 Nov 2014

Since this is a F4 code and wininit.exe was killed begin with searching for viruses.
Install Malwarebytes Anti-Malware

When your done and have come to the last page of setup make sure to UN-TICK the try the free trial of malwarebytes-antimalware.

After that run a quick scan and post the logs.

squish8294 · 29 Nov 2014

Code:

Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software

Scan Date: 11/29/2014
Scan Time: 7:59:06 AM
Logfile: mbam.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.11.29.03
Rootkit Database: v2014.11.22.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Squish

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 321191
Time Elapsed: 3 min, 10 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

I have malware bytes premium already....