Freezing followed by BSOD when writing to a file

[daviga404]

I recently purchased an SSD for my computer, an ADATA 120GB S511. The SSD had been previously used and apparently was in working condition. I installed Windows 7 Professional x64 on my SSD to use it as a boot drive, rather than my standard HDD which I formatted as NTFS. Since then, I have been experiencing troubles while writing to files.

I try and save a file on my HDD (not the SSD) and a lot of the time it works. In some occasions, however, the following events take place:

• I attempt to save a file
• The cursor is replaced with the pending symbol (spinning circle)
• Any programs open cease to function
• I cannot open directories or files, and icons go blank
• The entire computer freezes up
• A blue screen flashes for a split second and disappears (I do not get the chance to read any information).
• The computer restarts to show a flashing underscore.
• I restart the computer which returns back to normal.

I have looked through the event log and do not see any critical record aside from Kernel-Power which I believe regards the sudden crash but has no information about it.
I researched for anybody having the same problem online, but the ambiguity of this meant that I found few search results. One of the results said to run the chkdsk command in an elevated command prompt to make it run at boot-time. I did so and the problem still occurred. I also ran the "sfc /scannow" command in an elevated command prompt, but the problem still occurred.

I am now stuck for ideas on how to fix this, and am starting to think that it may be a hardware-related problem rather than a software-related one. Any input to how to fix this would be greatly appreciated!

[EDIT] Additional information: the file that I was trying to save became filled with nothing (shows as NUL in Programmer's Notepad 2). [EDIT2] A hex editor shows the file filled with 0s.

[EDIT3] More info: when the BSOD causes a restart, the computer stays at the motherboard loading screen with "press 4 to activate Asus core unlocker" (which isn't usually there)

 

[Arc]

Post it following the Blue Screen of Death (BSOD) Posting Instructions.

 

[daviga404]

Post it following the Blue Screen of Death (BSOD) Posting Instructions.

I can't - the folder created by the program seems to be empty and Windows won't allow me to zip it.

My mistake - the program created it in the wrong directory.

 

[essenbe]

Have you updated the firmware on your SSD? Here are the firmware and guides. Also, when you installed, did you do a clean install? If you are overclocking anything, set everything back to default levels and be sure you set the SSD as 2ND boot option abd DVD as 1st boot option.
Also, please download and install AS SSD, if you don't already have it. Open it , select the SSD from the dropdown list at the top and post a screenshot, you don't have to run the benchmark unless you want to. Also, as always, be careful to not download the junk they always want to download with it. It is an SSD benchmark program, but it shows some good info on the screen. ( http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html) Also, pleas post a screenshot of Disk Management. http://www.sevenforums.com/tutorials/274797-disk-management-post-screen-capture-image.html

 

[daviga404]

Have you updated the firmware on your SSD? Here are the firmware and guides. Also, when you installed, did you do a clean install? If you are overclocking anything, set everything back to default levels and be sure you set the SSD as 2ND boot option abd DVD as 1st boot option.
Also, please download and install AS SSD, if you don't already have it. Open it , select the SSD from the dropdown list at the top and post a screenshot, you don't have to run the benchmark unless you want to. Also, as always, be careful to not download the junk they always want to download with it. It is an SSD benchmark program, but it shows some good info on the screen. ( http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html) Also, pleas post a screenshot of Disk Management. http://www.sevenforums.com/tutorials/274797-disk-management-post-screen-capture-image.html

I installed the firmware for the SSD (I googled for the page rather than the link you sent, the one you sent was for the wrong model) v5.0.7a.

This is a screenshot of the benchmark:

And this is the disk management screenshot:

The problem has not occurred again YET, but like I said, it is random so I don't know when/if it will happen.

 

[essenbe]

OK, you seem to have a system reserved (K) installed on your Drive D and E disk rather than on your SSD. You are also installed in IDE mode.
You need to change to ahci mode. but follow these instructions exactly. http://www.sevenforums.com/tutorials/61869-ahci-enable-windows-7-vista.html

To check, disconnect your D/E drive and try to boot your SSD. If it boots, what is on the K drive?
If it will not boot, follow these instructions. Be sure to read the warning and info boxes also.
http://www.sevenforums.com/tutorials/71363-system-reserved-partition-delete.html

If you have another OS installed, please let us know before you do anything. And sorry about the wrong link on the SSD. I assume you found the correct one, and did you update it ?

 

[daviga404]

OK, you seem to have a system reserved (K) installed on your Drive D and E disk rather than on your SSD. You are also installed in IDE mode.
You need to change to ahci mode. but follow these instructions exactly. http://www.sevenforums.com/tutorials/61869-ahci-enable-windows-7-vista.html

To check, disconnect your D/E drive and try to boot your SSD. If it boots, what is on the K drive?
If it will not boot, follow these instructions. Be sure to read the warning and info boxes also.
http://www.sevenforums.com/tutorials/71363-system-reserved-partition-delete.html

If you have another OS installed, please let us know before you do anything. And sorry about the wrong link on the SSD. I assume you found the correct one, and did you update it ?

Right, I changed to AHCI mode in the registry & BIOS, and the speeds from the benchmark vastly improved:

About the System Reserved drive: I use Paragon Partition Manager to manage my partions; there was something that I needed to change and PPM needed to do it at boot time. When it does that, it seems to create a separate partition for it's boot manager (which shows up differently than the Microsoft one). It makes a very, very, lightweight version of Linux which makes the changes and then removes the separate partition, but for me this didn't work. When it didn't work, I didn't want to keep that boot manager so I updated the MBR and it switched back to the Windows one (on the C drive). However, the System Reserved still remained which I wasn't too bothered about so I just left it.

Also, yes, I found the correct firmware (v5.0.7a) and installed it using the updater tool provided.

 

[essenbe]

Nice increase in scores. Maybe that will help your freezing problem ( let's hope anyway). Let us know if you continue to have the freezes.

 

[Arc]

Thank you lots for all the help, Steve

daviga 404, Your BSOD is APC_INDEX_MISMATCH, BugCheck 1. In most of the cases I have seen it, it is caused by any antivirus/firewall software. Let us see what it shows in your crash dump.

A deeper search reveals that it is caused by COMODO Firewall Pro Sandbox Driver.

fffff880`09a5e468  fffff880`01221e24Unable to load image \SystemRoot\System32\DRIVERS\[URL="http://www.carrona.org/drivers/driver.php?id=cmdguard.sys"]cmdguard.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=cmdguard.sys"]cmdguard.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=cmdguard.sys"]cmdguard.sys[/URL]
 cmdguard+0x6e24

Description here: Driver Reference Table - cmdguard.sys

If you want to get rid of the BSODs, I'd suggest you to uninstall Comodo. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Also make it sure that your ADATA S511 SSD is having the latest firmware.

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Let us know the results.
________________________________________________________________________________
BSOD ANALYSIS:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1, {76d5040a, 0, ffff, fffff88009a5eca0}

Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->CombinedApcDisable field. This consists of two separate 16-bit
fields, the SpecialApcDisable and the KernelApcDisable. A negative value
of either indicates that a driver has disabled special or normal APCs
(respectively) without re-enabling them; a positive value indicates that
a driver has enabled special or normal APCs (respectively) too many times.
Arguments:
Arg1: 0000000076d5040a, Address of system call function or worker routine
Arg2: 0000000000000000, Thread->ApcStateIndex
Arg3: 000000000000ffff, (Thread->SpecialApcDisable << 16) | Thread->KernelApcDisable
Arg4: fffff88009a5eca0, Call type (0 - system call, 1 - worker routine)

Debugging Details:
------------------


FAULTING_IP: 
+0
00000000`76d5040a ??              ???

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x1

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002ad4469 to fffff80002ad4f00

STACK_TEXT:  
fffff880`09a5ea68 fffff800`02ad4469 : 00000000`00000001 00000000`76d5040a 00000000`00000000 00000000`0000ffff : nt!KeBugCheckEx
fffff880`09a5ea70 fffff800`02ad43a0 : ffffffff`ffffffff 00000000`00000001 00000000`009d9b20 fffff800`0000007a : nt!KiBugCheckDispatch+0x69
fffff880`09a5ebb0 00000000`76d5040a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
00000000`016fd1c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d5040a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiSystemServiceExit+245
fffff800`02ad43a0 4883ec50        sub     rsp,50h

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiSystemServiceExit+245

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0x1_SysCallNum_52_nt!KiSystemServiceExit+245

BUCKET_ID:  X64_0x1_SysCallNum_52_nt!KiSystemServiceExit+245

Followup: MachineOwner
---------

 

[Pauly]

Should the system reserved partition be assigned a drive letter ??
Normally i would say no but have no knowledge/experience of paragon part manager so dont know if this is something that it has changed especially with it being over 200MB, dual boot ?

 

[Arc]

Should the system reserved partition be assigned a drive letter ??
Normally i would say no but have no knowledge/experience of paragon part manager so dont know if this is something that it has changed especially with it being over 200MB, dual boot ?

Sharp noticed, my friend
Really, 227 is an odd figure, it should be either 100 MB or 300 MB and another 100+ MB for UEFI ....

I am also guessing he has done something there with the bootloader.

 

[daviga404]

Thank you lots for all the help, Steve

daviga 404, Your BSOD is APC_INDEX_MISMATCH, BugCheck 1. In most of the cases I have seen it, it is caused by any antivirus/firewall software. Let us see what it shows in your crash dump.

A deeper search reveals that it is caused by COMODO Firewall Pro Sandbox Driver.

fffff880`09a5e468  fffff880`01221e24Unable to load image \SystemRoot\System32\DRIVERS\[URL="http://www.carrona.org/drivers/driver.php?id=cmdguard.sys"]cmdguard.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=cmdguard.sys"]cmdguard.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=cmdguard.sys"]cmdguard.sys[/URL]
 cmdguard+0x6e24

Description here: Driver Reference Table - cmdguard.sys

If you want to get rid of the BSODs, I'd suggest you to uninstall Comodo. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Also make it sure that your ADATA S511 SSD is having the latest firmware.

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Let us know the results.
________________________________________________________________________________
BSOD ANALYSIS:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1, {76d5040a, 0, ffff, fffff88009a5eca0}

Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->CombinedApcDisable field. This consists of two separate 16-bit
fields, the SpecialApcDisable and the KernelApcDisable. A negative value
of either indicates that a driver has disabled special or normal APCs
(respectively) without re-enabling them; a positive value indicates that
a driver has enabled special or normal APCs (respectively) too many times.
Arguments:
Arg1: 0000000076d5040a, Address of system call function or worker routine
Arg2: 0000000000000000, Thread->ApcStateIndex
Arg3: 000000000000ffff, (Thread->SpecialApcDisable << 16) | Thread->KernelApcDisable
Arg4: fffff88009a5eca0, Call type (0 - system call, 1 - worker routine)

Debugging Details:
------------------


FAULTING_IP: 
+0
00000000`76d5040a ??              ???

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x1

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002ad4469 to fffff80002ad4f00

STACK_TEXT:  
fffff880`09a5ea68 fffff800`02ad4469 : 00000000`00000001 00000000`76d5040a 00000000`00000000 00000000`0000ffff : nt!KeBugCheckEx
fffff880`09a5ea70 fffff800`02ad43a0 : ffffffff`ffffffff 00000000`00000001 00000000`009d9b20 fffff800`0000007a : nt!KiBugCheckDispatch+0x69
fffff880`09a5ebb0 00000000`76d5040a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
00000000`016fd1c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d5040a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiSystemServiceExit+245
fffff800`02ad43a0 4883ec50        sub     rsp,50h

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiSystemServiceExit+245

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0x1_SysCallNum_52_nt!KiSystemServiceExit+245

BUCKET_ID:  X64_0x1_SysCallNum_52_nt!KiSystemServiceExit+245

Followup: MachineOwner
---------

Actually, I used to have Commodo but uninstalled it a while ago, which seems confusing to me as the driver shouldn't still be there, right? I have Avast! Antivirus and just the bog-standard Windows Firewall installed, at the minute.

I do have the latest firmware on my SSD as essenbe recommended me to get, and I also cleaned the startup in MsConfig not too long ago.

 

[daviga404]

Should the system reserved partition be assigned a drive letter ??
Normally i would say no but have no knowledge/experience of paragon part manager so dont know if this is something that it has changed especially with it being over 200MB, dual boot ?

Sharp noticed, my friend
Really, 227 is an odd figure, it should be either 100 MB or 300 MB and another 100+ MB for UEFI ....

I am also guessing he has done something there with the bootloader.

I left the drive as is - the same thing happened on my previous install of Windows when I used Paragon, and it did have a drive letter assigned too. Is it safe to just delete the partition?

 

[essenbe]

Pauly, according to the OP, it is a file created by Partition Manager and was supposed to be deleted by Partition Manager after it had finished, but was not. He decided to leave it, as it caused him no problem. Regardless of it's name, it is not active, so should cause no problem, I guess. Perhaps it was left there to confuse me.

 

[Arc]

I left the drive as is - the same thing happened on my previous install of Windows when I used Paragon, and it did have a drive letter assigned too. Is it safe to just delete the partition?

No! Leave it as it is. Let us know how the computer is running after taking the suggested changes.

 

[daviga404]

Well - problem is still persistent. Exactly the same scenario and blue screen. Turns out installing firmware didn't fix it :|

 

[Arc]

Post it following the Blue Screen of Death (BSOD) Posting Instructions.

 

[daviga404]

Post it following the Blue Screen of Death (BSOD) Posting Instructions.

Attached

 

[Arc]

No new BSOD is there.

View attachment 274661

 

[daviga404]

No new BSOD is there.

View attachment 274661

That seems odd - there definitely was a crash, and I'm fairly sure there was another blue screen. Anyway, that is all the Diagnostic Tool gave me.

The crash appears in Event Log: