Solved BSOD running Plex Media Server, now NIC not working and locking up

[doveman007]

OK, I've been doing a fresh install of Windows 7 x64 and had almost finished installing all the software, when I found it would BSOD whenever I tried to run Plex Media Server, which scans certain folders to build a media database. Running defrag didn't cause any problems, so it didn't seem to be an issue with accessing the disk as such.

I posted the dump from that BSOD at the Plex forum and someone looked at it for me and advised:

This is memory corruption in kernel mode. Nothing to do with Plex.

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.The crash appears to be a null dereference, which suggest a software bug rather than bad memory. But I'd suggest running memtest anyway.
FAULTING_IP:
nt!ExDeferredFreePool+249
fffff800`033c2b05 4c395808        cmp     qword ptr [rax+8],r11

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

TRAP_FRAME:  fffff880031857d0 -- (.trap 0xfffff880031857d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff8000341da50
rdx=fffff88009841450 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800033c2b05 rsp=fffff88003185960 rbp=0000000000000000
 r8=0000000000000000  r9=fffff88009841c90 r10=0000000000000001
r11=fffff88009841ca0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po cy
nt!ExDeferredFreePool+0x249:
fffff800`033c2b05 4c395808        cmp     qword ptr [rax+8],r11 ds:00000000`00000008=????????????????

Unfortunately, these tend to be fairly hard to track back to a specific driver. You can use the driver verifier to pinpoint the issue further (at the risk of exposing new issues). My general suggestion is to revert to inbox or WU drivers, as those tend to be more tested/stable.

This is the 063013-36535-01.dmp in the attached zip.

Since then, I disabled a BIOS option "SATA IDE Combined Mode". I have no idea what it's for but after disabling it, I didn't get any more BSOD when running Plex, although it did crash.



Everything was looking up until last night, when the onboard NIC stopped working. It still showed as OK in Device Manager but just insisted that the "Network Cable Disconnected". I first had the same problem a few months ago when I plugged in a CF Card IDE adapter. I have no idea why plugging something into the IDE port would affect the NIC but it did and started working again as soon as I disconnected the adapter.

Yesterday, I'd connected up an IDE HDD and ODD (actually I only had power to the ODD) but the NIC didn't stop working until several hours later. I disconnected the IDE cable from the motherboard but this time it didn't get the NIC working again.

This morning I ran a LAN test from the BIOS which confirmed the cable was fine. I also disabled the "Aggressive Link Power Management" option in the BIOS in case that was causing the NIC problem. Then I booted into a Win 7 x86 VHD I use for diagnostic purposes. After installing the NIC driver, which I had stored on the HDD "AR813x_AR815x_v2.1.0.14_WHQL (Ethernet)", it worked fine in that. So I rebooted into my normal Win7 x64 install but it seems to have got worse overnight, whilst the PC was off! Now, although the mouse pointer still moves, I can't click on anything, such as Start or the notification tray, which I normally can and the system is basically frozen. On my second boot, the whole thing, including the mouse pointer froze up.

So I rebooted into safe-mode from where I'm typing this, obviously with a working NIC. I'm really hoping it's a driver/software thing that can be fixed as I've put a lot of time into setting up this system for my brother and it's getting hard these days to find another board that has the required onboard VGA/DVI, adequate PCI slots, IDE connector, etc.

 

[Arc]

Hello doveman007.

First of all, I would suggest you to uninstall SoftPerfect Virtual Disk.

ITEM|VALUE
Name | SoftPerfect Virtual Bus
Manufacturer | KEG
Status | OK
PNP Device ID | ROOT\ SCSIADAPTER \0000
Driver | c:\windows\system32\drivers\spvdbus.sys (, 132.99 KB (136,184 bytes), 28/06/2013 21:52)

Then, depending on the situation, we will decide our further steps.

Let us know the situation after uninstalling it.

* Edit: The network problem ... that's common with Comodo and networx installed. Uninstall networx. Uninstall Comodo, too. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.

Download, install and update those, and then run full system scans with both of them, one by one.
_____________________________________________________________________________________
BSOD ANALYSIS:

.
*** WARNING: Unable to verify timestamp for spvve.sys
*** ERROR: Module load completed but symbols could not be loaded for spvve.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff800033de308, fffff880009a9098, fffff880009a88f0}

Probably caused by : spvve.sys ( spvve+1b6ca )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800033de308, The address that the exception occurred at
Arg3: fffff880009a9098, Exception Record Address
Arg4: fffff880009a88f0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!IopPerfCompleteRequest+58
fffff800`033de308 488b4cc270      mov     rcx,qword ptr [rdx+rax*8+70h]

EXCEPTION_RECORD:  fffff880009a9098 -- (.exr 0xfffff880009a9098)
ExceptionAddress: fffff800033de308 (nt!IopPerfCompleteRequest+0x0000000000000058)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff880009a88f0 -- (.cxr 0xfffff880009a88f0)
rax=0000000000000000 rbx=fffffa8006dabc88 rcx=0000000000000000
rdx=00670061006e0061 rsi=fffff880009a9400 rdi=fffffa8006dabb70
rip=fffff800033de308 rsp=fffff880009a92d0 rbp=0000000000000000
 r8=0000000000000000  r9=fffffa80072ed000 r10=0000000000401802
r11=fffff880009a93a0 r12=0000000000000001 r13=ffffffff800000fc
r14=fffffa801b57c870 r15=000000000000001c
iopl=0         nv up ei ng nz ac pe cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010293
nt!IopPerfCompleteRequest+0x58:
fffff800`033de308 488b4cc270      mov     rcx,qword ptr [rdx+rax*8+70h] ds:002b:00670061`006e00d1=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003512100
GetUlongFromAddress: unable to read from fffff800035121c0
 ffffffffffffffff 

FOLLOWUP_IP: 
spvve+1b6ca
fffff880`02c426ca ??              ???

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff88002c426ca to fffff800033de308

STACK_TEXT:  
fffff880`009a92d0 fffff880`02c426ca : fffffa80`1b5997f0 00000000`00000000 fffff880`009a9450 20206f49`00000001 : nt!IopPerfCompleteRequest+0x58
fffff880`009a9380 fffffa80`1b5997f0 : 00000000`00000000 fffff880`009a9450 20206f49`00000001 00000000`00000000 : spvve+0x1b6ca
fffff880`009a9388 00000000`00000000 : fffff880`009a9450 20206f49`00000001 00000000`00000000 fffff880`02c421d6 : 0xfffffa80`1b5997f0


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  spvve+1b6ca

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: spvve

IMAGE_NAME:  spvve.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  51a82acd

STACK_COMMAND:  .cxr 0xfffff880009a88f0 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_spvve+1b6ca

BUCKET_ID:  X64_0x7E_spvve+1b6ca

Followup: MachineOwner
---------

0: kd> lmvm spvve
start             end                 module name
fffff880`02c27000 fffff880`02c90000   spvve    T (no symbols)           
    Loaded symbol image file: spvve.sys
    Image path: \??\C:\Program Files\SoftPerfect RAM Disk\spvve.sys
    Image name: spvve.sys
    Timestamp:        Fri May 31 10:15:01 2013 (51A82ACD)
    CheckSum:         0006FFD2
    ImageSize:        00069000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
0: kd> lmvm spvdbus
start             end                 module name
fffff880`03f60000 fffff880`03f85000   spvdbus    (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\spvdbus.sys
    Image name: spvdbus.sys
    Timestamp:        Fri May 31 10:15:00 2013 (51A82ACC)
    CheckSum:         00028B1A
    ImageSize:        00025000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[doveman007]

Hi Arc

Thanks for your help.

I booted into Safe Mode and uninstalled SoftPerfect and Networx. I couldn't uninstall Comodo as it requires the MSI installer which is not available in Safe Mode. After that, I was able to boot normally and am typing this from there.

I wonder if disabling that "Aggressive Link Power Management" BIOS option confused Windows and caused it to start locking up and maybe it's adjusted now. Anyway, someone has advised me that he's had nothing but severe problems with that option enabled and disabling it is one of the first things he does, so I think it's best I leave it disabled, even though I'm not sure what it does. I wonder if it's connected to the option in Windows Power Schemes "PCI Express - Link State Power Management" which defaults to "Moderate Power Savings". This can be changed to Off but I'm not sure if having that BIOS option disabled makes this setting irrelevant anyway.

I need to keep Comodo really, as whilst far from perfect in the way it adds rules to the top, rather than the bottom of the list, it's the only decent free firewall I've found. I find Windows Firewall totally non-user friendly and I don't think it even gives alerts for outgoing connections. I'll uninstall it for now of course though if you need me to before you can help me diagnose my problems.

I really don't like MSE either I'm afraid. I can't remember exactly why but I know I've tried it and found a few things about it rather annoying. I could go back to Avira antivir which is what I was using before Avast was recommended to me but for now, I'll do without an antivirus whilst we try and sort things out.

I wanted to use Networx as my brother has a monthly download limit so it would have been useful to him to keep track of his usage but if it causes problems he'll just have to do without it.

I'll need some RAMDisk on there, mainly for MediaPortal as it constantly creates Timeshifting files whilst watching TV and I don't want them on the HDD to reduce wear and also keep the noise down. Softperfect benchmarks a lot faster but I could use the AMD RAMDisk instead, which is just a branded version of DataRAM Ramdisk RAMDisk - Software - Server Memory Products & Services - Dataram which allows larger RAMDisks than the freeware product. I've used that before (and still do on another PC) without any problems (not that SoftPerfect has caused me any problems on my other PC). Anyway, I'll leave that off for now as well.

I'm doing the MBAM scan now. Please let me know if you need me to do the MSE scan, even if I won't be keeping it installed once we've finished.

 

[doveman007]

Here's the MBAM scan:

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.07.10.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16618
Steve :: STE-PC [administrator]

10/07/2013 20:52:51
MBAM-log-2013-07-10 (21-42-17).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 438812
Time elapsed: 44 minute(s), 11 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 5
C:\ProgramData\Team MediaPortal\MediaPortal\Installer\V2\9b9bc24e-69ca-4abc-8810-f8f95bd4bbe6\1.3.0.2\9b9bc24e-69ca-4abc-8810-f8f95bd4bbe6.mpe2 (Trojan.Clicker.M) -> No action taken.
C:\ProgramData\Team MediaPortal\MediaPortal\Installer\V2\9b9bc24e-69ca-4abc-8810-f8f95bd4bbe6\1.4.0.0\9b9bc24e-69ca-4abc-8810-f8f95bd4bbe6.mpe2 (Trojan.Clicker.M) -> No action taken.
D:\$RECYCLE.BIN\S-1-5-21-1074606757-3784109166-4096876264-1003\$RU1IGBJ.dll (Malware.Packer.Gen) -> No action taken.
D:\$RECYCLE.BIN\S-1-5-21-1074606757-3784109166-4096876264-1003\$RLIU599\StartupRun.exe (PUP.StartUpManager) -> No action taken.
D:\$RECYCLE.BIN\S-1-5-21-4142153632-2294863933-3660688552-1000\$RH4H5G3.dll (Trojan.Clicker.M) -> No action taken.

(end)

I'd be surprised if the MediaPortal files aren't false positives and I probably shouldn't remove them in case they're needed for something (I'll ask in the MediaPortal forum about them). I've removed the other files from the Recycle Bin though.

 

[doveman007]

I've noticed I haven't installed the AMD Chipset drivers yet, so maybe I should do that? I've got the 13.1 Legacy graphics card drivers installed (for my onboard HD4250) but I guess I should install the chipset drivers for the AMD SATA driver (currently have the "Standard AHCI 1.0 Serial ATA Controller" installed.

I checked the installed drivers for my other devices and found there's some updates available

SATA3 - 2 x SATA3 6.0 Gb/s connectors by ASMedia ASM1061, support NCQ, AHCI and Hot Plug functions
Installed v1.3.9.0 (17/09/2012), latest 1.4.1.0 (04/07/2013)

USB 3.0 - 2 x USB 3.0 ports by ASMedia ASM1042, support USB 1.0/2.0/3.0 up to 5Gb/s
Installed v1.16.2.0 (20/08/2012) latest 1.16.4.0 (06/03/2013)

USB3.0 Firmware (not sure of installed version), latest version 120816-02-02-06D (V3) (16/04/2013) (Origine Asus)
ASMEDIA drivers & firmwares

LAN - PCIE x1 Gigabit LAN 10/100/1000 Mb/s - Atheros AR8151
Installed v2.1.0.13 (14/12/2012), latest v2.1.0.15
Latest Qualcomm Atheros AR8151 PCI-E Gigabit Ethernet Controller (NDIS 6.20) Driver...

I won't install anything until you ask me to though

EDIT: By the way, which dump was that BSOD analysis you did from. Was it the 063013-36535-01.dmp associated with the first BSOD I had, when launching Plex or another one? As it refers to the SoftPerfect driver, I feel I should inform them about it in case there's anything they need to do to avoid this happening in future, so the more information I can give them about the circumstances in which it happened the better.

 

[Arc]

Let us know how it is running after following the suggestions. If there are further BSODs, upload the dumps as per BSOD posting instruction.

When the situation is stable, any question is welcome ... but before that, the single point objective is to fix the issue.

Apparently the start blockage was caused by the fake SCSI adapter installed by SoftPerfect. Its the common nature of those programs.

I usually check the latest ones, did the same here too.

 

[doveman007]

Thanks. It seems to be OK at the moment.

I uninstalled Comodo for now, partly to see if it was causing the high latency issues. It wasn't but that's another issue.

I guess I'll try running Plex again and see if it works OK now. If so, I'll install the AMD Chipset drivers and then maybe update the others. Then I'll have to try plugging in the IDE devices again and see if it behaves itself.

I reported the issue to SoftPerfect and will send them the last dump if requested.

 

[Arc]

About SoftPerfect, it is not present in the dump. Nobody can say it with certainty seeing those that it is SoftPerfect that is causing the issue. But you can see the difference having softperfect uninstalled.

It is the nature of the program that those programs (all of them of this type) are problematic in the same way.

 

[doveman007]

Sorry, I thought I saw references to spvve.sys if not spvdbus.sys in the dump. Did I misunderstand?

 

[Arc]

I havent got a fulproof that spvve.sys is an element of SoftPerfect; and that driver was not found within the system at verification other than the dumps.

I just conclude by the similarity of name and the exactly same driver date. From my part, it was an attempt to make a decision; when I know it that all the virtual CD emaluator programs does some mishap during boot up.

spvdbus.sys is present in the system, but never pointed out in the dumps as a failing element. I just checked the date of it, to draw the inference.

If you have the surity that it is the element of SoftPerfect, it gives the proof.

BTW, how the system is running? Any more issues?

 

[doveman007]

spvve.sys is definitely part of SoftPerfect as it's in it's folder, as is spvdbus.sys, so I think your decision was good

Seems to be running fine at the moment, with no crashes running HwInfo or Plex, so it's better than it ever was thanks

I am still having an issue with latency, as shown by LatencyMon, with it hitting 3000us+ within 30s (just hit 7210us after 1.5mins). It doesn't really give me a clue what is triggering it though. Perhaps it will improve after I install the AMD chipset and other drivers.

 

[Arc]

OK, try the other drivers one by one, but dont install anything from the motherboard disc other than chipset

 

[doveman007]

OK, try the other drivers one by one, but dont install anything from the motherboard disc other than chipset

Heh, I don't even know where the motherboard disc is anymore and always download the latest available drivers

I've installed the 13.4 AMD Chipset driver and upgraded the Realtek Audio to 6923 now. I'm still seeing the same problems with latency, which seems to be connected to HDD activity as it stays around 80-300us, with the occasional spike to 500us whilst idle but when I launch Iron, which has several tabs open, it spikes to 3000us+. Launching Plex and scanning the media folders and it hit around 4000us+. Launching IE, which only has one tab open and it hit 1700us.

If I switch to High Performance mode, which disables Cool'n'Quiet and Link State Power Management, I don't seem to get any spikes launching IE or running Plex but still do when launching Iron (and after that just with it open).

As I say, it's hard to tell from LatencyMon what's causing the spikes but storport.sys often appears for highest ISR and DPC (51us ISR, 607us DPC). This appears to have been installed by the AMD Chipset drivers as before I only saw ataport.sys mentioned (on my other system with the Chipset drivers installed, I do see storport.sys mentioned as well). Googling this driver suggests it's used for SCSI devices but that seems not to be completely true.

Under the drivers tab in LatencyMon, the top listed drivers for Highest Execution time are currently

ntoskrnl.exe 0.124
storport.sys 0.121
USBPORT.SYS 0.09
ndis.sys 0.078
dxgkrnl.sys 0.070
netbt.sys 0.063
tcpip.sys 0.061

everything else is 0.036 or lower.

As the top two seem unrelated to USB or NIC, it seems unlikely that upgrading those drivers will help much but I'll give that a go next. I guess I could try connecting the HDD to the SATA3 port and see if that helps

 

[doveman007]

Hmm, seems there's still some issues.

I updated the USB, NIC and SATA3 drivers, then connected the HDD to the SATA3 port to see if that would fix the latency problems. It didn't but that's not the issue. I ran HwInfo64 after using the system for a while and like before, the screen went off and I had to hard reset. When it rebooted, the Sidebar gadgets failed to appear and the mouse icon was stuck on busy and I couldn't do anything so had to hard reset again. I reconnected the HDD to the SATA2 port (and removed one of the PCI cards which was in the way) and I've booted OK again now and tested HwInfo and it's OK as well but it's worrying that this happened again.

 

[doveman007]

I'm trying to disable the pagefile as I see a lot of Hard Page Faults in LatencyMon, which seem to coincide with the latency spikes, so I thought if I could prevent it using the pagefile it might fix the latency problem.

However, Windows won't let me and when it reboot says

"Windows created a temporary paging file on your computer because of a problem that occurred with your paging file configuration when you started your computer"

and it creates a 8GB pagefile on C: (I previously had it on D. Going into the Virtual Memory settings, it shows that No Paging File is set for C: and D: but if I click Set on C:, it registers a change and makes me reboot, so obviously that screen is out of sync with the actual situation.

I have no problem disabling the pagefile on my other system, with 16GB. Does Windows not allow this when there's only 8GB?

 

[Arc]

I am not very faqmiliar with the programs you are talking about. I can do with the BSODs, what I have done. Requested our other members to have a look at your issue.

 

[bobafetthotmail]

Summon successful!

This article explains how to use latencymon to troubleshoot stuff.
This is the relevant part in your case:

Next, click the "Processes" tab, then click the "Hard page faults" column header so that the largest numbers appear at the top. Hard page faults occur when a program needs data that isn't resident in physical RAM, and so Windows has to read it in from the paging file, instead. This is a time-consuming business, and so if a process is generating a lot of hard page faults during audio playback then it might result in dropouts.

So, the culprit is a process, a program. What is the name (or names) you see?

Please don't disable pagefile as it's needed for collecting bluescreen dumps and other system stuff. But since you have 8 gigs of ram and thus it's not going to be needed for its main role (virtual memory) you can safely reduce it to 1024 MB in C: only (set it manually as both minimum and maximum size and hit "set", not hitting "set" when you change stuff in that panel won't apply changes).

 

[doveman007]

Thanks for the referral Arc and for helping me sort out the BSOD issues.

bobafetthotmail, I actually disabled the pagefile on my other system, with 16GB, and still saw hard pagefaults, which seems a bit weird but anyway, let's not worry about that for now.

I appreciate it's needed for the dumps, etc but I'm still a bit concerned that it won't let me disable it on this system, as I'm almost certain I've been able to in the past with systems with only 8GB. Anyway, we can look into that later perhaps.

LatencyMon shows that the process with the highest number of pagefaults is svchost at 190 (and rising) after about a minute. This isn't associated with high latency though, which is hovering below 75us with the odd spike to 200us and the highest around 400us. The latency seems to be triggered by HDD activity and the person who's analysed the traces for me tells me

"and you still have disk issues. Your HDD is flushing the data all the time (open the etl with xperfview.exe, make a rightclick on the disk graph and select "Detail graph", here you see a lot of red lines). The depth queue is better but still 30 which is still bad. "

by better I think he's referring to my other system, which showed a depth queue of 149 but I was launching Iron with a lot more tabs open and I'm currently running in High Performance mode, not Balanced, which might be helping as well.

I noticed that HwInfoMonitor (a sidebar gadget) was showing about 10 pagefaults, so closed that and restarted LatencyMon and now it only shows a count of 3 pagefaults after 3 minutes, one on svchost.exe and one on explorer.exe. I'm not sure where the third one is hiding! If I launch Iron, I get a latency spike of 12325us (and several below 1000us) and the pagefault count rises to 240 by the time all the tabs have loaded, but processes only shows 50 on Iron.exe, 3 on another instance of Iron.exe, 8 on TrustedInstaller.exe, 2 on svchost.exe, 1 on explorer.exe and 1 on another instance of iron.exe. The total count and the first instance of iron.exe are slowing rising, now on 264 and 66 respectively. Iron seems to open an instance of iron.exe for each tab, judging by Task Manager, so I'm not sure if this indicates that most of the pagefaults are associated with one particular tab.

Regarding the lockup I had after HwInfo crashed the system, although HwInfo wasn't running after rebooting I did have the Persistent Driver enabled, so I suppose that might have still been scanning and causing problems. I've disabled that now to eliminate it. Whilst this time the HwInfo induced crash and subsequent desktop lockup on reboot occurred whilst I had the HDD connected to the SATA3 port, both happened previously with it connected to the AMD SATA2 port. It's possible that the persistent driver was still scanning the SATA3 controller and that was causing problems, even with nothing connected to it, though. I'm waiting to hear from the HwInfo authors what they think about this.

Let me know if you'd like to look at the etl traces for yourself and I'll provide links to them.

EDIT: I closed Iron and re-enabled HwInfoMonitor and although it's still showing some pagefaults on that (6 after 1.5mins) I'm not seeing any of svchost.exe now.

 

[gregrocker]

I've never seen anything here since before Win7 was released about Comodo that wasn't a problem. Uninstalling it often solves them.

What kind of rules are you trying to add to firewall that Win7's perfectly balanced firewall cannot handle?

Avast and Avira are fine, but not that much better from what we've seen than MSE which offers the best performance and least bother. For chronically infected I recommend Malwarebytes Real-Time protection (30 day free trial, then $29 for life) which has always solved the problem.

 

[doveman007]

I've never seen anything here since before Win7 was released about Comodo that wasn't a problem. Uninstalling it often solves them.

What kind of rules are you trying to add to firewall that Win7's perfectly balanced firewall cannot handle?

Avast and Avira are fine, but not that much better from what we've seen than MSE which offers the best performance and least bother. For chronically infected I recommend Malwarebytes Real-Time protection (30 day free trial, then $29 for life) which has always solved the problem.

I've uninstalled Comodo for now anyway, so that can't be causing any of my current problems.

I seem to recall that Windows firewall didn't produce popups to alert to outgoing connections, which is vital as far as I'm concerned. I believe Tiny Firewall helps with that, so I might give it another go although I recall I preferred Comodo from last time I tested.

I'll certainly look at MSE once I've sorted out the current problems. I'm not sure if it allows to exclude folders as other AVs do, which I find useful to avoid wasting resources and slowdowns when running games, accessing media files, etc.