Solved Windows 7 64 bit Freezes and cannot boot new programs (DCOM?)

[eharper256]

To get straight onto the matter; this is a relatively new PC (built Feb 2014). It freezes on an almost daily basis and I'm rather at the end of my tether. The freeze is unusual in that I can still work the mouse and click around and even sometimes use currently active programs; but not start any new programs, such as that I cannot even get task manager up (not with ALT-CTRL-DEL or CTRL-SHIFT-ESC) in an attempt to see if that can fix anything, and always need a cold reset to bring it to its senses.

As a test, last night I left Task Manager running whilst I was playing Dragon Age and shortly after I finished the freeze recurred. Task Manager itself seemed to work fine. I aborted explorer with it, but couldn't restart it or anything else with Task Manager.

Initially I had thought this error was related to whenever the system was left idle; but it also occurs after use for some time. When checking the Event Viewer, the errors that show up basically every time seem to internet related?

Originally I had: Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0xE03F4911B5C9.

So I configured my router settings to give me a permanent DHCP connection on a set IP address, and that seems to have gone away now; but I still get DCOM 5 errors EVERY TIME when the freeze occurs:

Unable to start a DCOM Server: {1F87137D-0E7C-44D5-8C73-4EFFB68962F2}. The error: "5" Happened while starting this command: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
OR
Unable to start a DCOM Server: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}. The error: "5" Happened while starting this command: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

There is no concrete instructions I can see for fixing this. I read that Error 5 may be something to do with access denied, so I tried to alter the permissions of WmiPRVSE to full control rather than just Read/Read & Execute (as it currently has), but got an access denied when trying to change it (I am logged as an admin and have no UAC enabled).

THINGS TRIED:
>> All of the Windows Sleep Features, and all of the Motherboard Sleep Features have been disabled (EIST etc.)
>> memtestx86 has run 8 passes with no issues.
>> Seatools has done all of its tests on my HD with no issues detected.
>> I've updated all drivers I can, including motherboard ones.
>> Tried using wbemtest. It succeeds on doing default, but fails if using 'virtualization' as the string. Saw this on a thread somewhere as a test.
>> Tried this Event ID 10000 is logged in the Application log on a Windows Server 2003-based computer that has Terminal Server enabled
>> Since the system does not technically crash or BSOD; no minidumps are ever created, rendering things like WhoCrashed useless to me.
>> Have run DriverVerifier using this post http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html for some time with no problems or BSODs.
>> There is no overheating. The system rarely goes above 50 degrees according to Speccy.

No cigars. Anyone else have any ideas? This is technically not a BSOD so if it fits better elsewhere please accept my apologies and move it there. I created a DM Log Collector file but cannot apparently attach the file here (in fact I can't use any of the control panel to even make this post less wall of text... rather odd).

 

[Thedoctor44]

I think I know just the person for this.

I have requested his presence so hopefully he should be here shortly.

 

[Shadowjk]

Hmmm... Your DHCP request errors and the WMIprvse.exe error point to you losing network connectivity during this bizarre hang. How long has this been happening? Is it random at all? If not, are you able to try and replicate the issue in safe mode with networking? If not try and complete a clean boot and see if it hangs at all. If it doesn't then chances are that a third party application is causing this.

http://www.sevenforums.com/tutorials/179159-troubleshoot-application-conflicts-performing-clean-startup.html

Just as a precaution it would be good to check your IPconfig as it may indicate a potential cause of this issue.

Please follow this tutorial - http://www.sevenforums.com/network-sharing/300288-basic-requirements-before-posting-your-networking-thread.html. This can help us identify what may be causing your issue.

Many Thanks,
Josh

 

[eharper256]

Further details: Wired connection (Ethernet) on Virgin Media Cable Using a Virgin Media Superhub (A Netgear WNDA3200 in disguise I THINK) Using Online Armor (Free) and BitDefender (Free) IPConfig:


Event Viewer recently started getting errors with OAhlp, which is related to Online Armor and the NETGEAR WNDA3200 Device Checking Service. Normally I'd leap on those, but the problem started way before then. It has been present now for about a couple months or so at least, pretty much since I started with this machine, and hits about 2 days in 3. However, it did not do it yesterday evening. I'll try some clean startups but I won't get results for that for some time since I have to wait some time for this error to happen. Also, apologies, I cannot seem to adjust the formatting on this forum (or for the lead post; I didn't post it initially as such a wall of text).

 

[Shadowjk]

You IP config seems fine to me. Although I could almost guarantee you will still get the DHCP errors if you wait long enough. Windows will try and renew its DHCP lease after the halfway point that it has had it for. If it can't do that then a log is made. Since you gave it a reservation the lease time has gone from about a day to 8 days. If you wait long enough the errors would probably continue.

Try the clean boot. Of course if you don't receive the error with the clean boot then individually turn each service and startup on with consecutive reboots until the culprit is found. This can be a long process.

Note I have notified admins of your issue with the forum posting tools

Josh

 

[eharper256]

The forum posting seems to be fixed now. Not sure what was going on before. I edited the posts to give them less Wall of Text feelings!

Try the clean boot. Of course if you don't receive the error with the clean boot then individually turn each service and startup on with consecutive reboots until the culprit is found. This can be a long process.

Sorry, not sure if I made it clear, but the DCOM error only shows up JUST before it crashes/freezes (typically 3-5 mins). If I were to say, start up the PC, have a 1 hour session, and then shut down or reboot, it would not show at all. It shows only after the system is active for a time, typically at least 2-3 hours, but sometimes it can go 10+; and that is why it might take awhile to diagnose this way!!

The permanent IP address was set about 4-5 days ago and there have been crashes since then (about 4 of them); so I don't think its related to the lease being renewed, since I also tried the opposite and forced the router to hand out 1 hour long leases only for awhile, but this didn't force crashes.

Driver Verifier has now been running on non-microsoft drivers for about 3 days of use, so I don't think thats an issue. I did the instructions on Event ID 10000 is logged in the Application log on a Windows Server 2003-based computer that has Terminal Server enabled last night. The noted registry subkey in that article did not exist in my registry so I had to add it from scratch. But that may well be because the article is not for Windows 7.

Anyway now that the attachment system works, I have attached the BSOD report zip. The Event Log is pretty huge!!

 

[Shadowjk]

The forum posting seems to be fixed now. Not sure what was going on before. I edited the posts to give them less Wall of Text feelings!

Try the clean boot. Of course if you don't receive the error with the clean boot then individually turn each service and startup on with consecutive reboots until the culprit is found. This can be a long process.

Sorry, not sure if I made it clear, but the DCOM error only shows up JUST before it crashes/freezes (typically 3-5 mins). If I were to say, start up the PC, have a 1 hour session, and then shut down or reboot, it would not show at all. It shows only after the system is active for a time, typically at least 2-3 hours, but sometimes it can go 10+; and that is why it might take awhile to diagnose this way!!

The permanent IP address was set about 4-5 days ago and there have been crashes since then (about 4 of them); so I don't think its related to the lease being renewed, since I also tried the opposite and forced the router to hand out 1 hour long leases only for awhile, but this didn't force crashes.

Driver Verifier has now been running on non-microsoft drivers for about 3 days of use, so I don't think thats an issue. I did the instructions on Event ID 10000 is logged in the Application log on a Windows Server 2003-based computer that has Terminal Server enabled last night. The noted registry subkey in that article did not exist in my registry so I had to add it from scratch. But that may well be because the article is not for Windows 7.

Anyway now that the attachment system works, I have attached the BSOD report zip. The Event Log is pretty huge!!

There were no dump files in the attached ZIP which is to be expected since you don't get any BSODs. How long has this been happening? Was there a particular application or system change that happened around the time the issues started?

Josh

 

[eharper256]

Its happened as long as I can remember; even in the week I had it (I recall having it humiliatingly crash when my mates came around and noticed my new rig!!). So all of the initial software installs could be related I guess; but I kinda doubt Office, GIMP, Media Player Classic, Firefox etc. are faulty; since it doesn't crash with a specific program. Of course, it also installed at least 500 or so Windows Updates over the first few days without my input (though I did manually opt to pop Silverlight on).

 

[Shadowjk]

If it has happened ever since you installed Windows then we may be looking a faulty hardware device. Particularly if it is random and application unspecific. Since you have issues with launching new applications when it happens and the error logs point to issues starting new program instances then I would begin with testing RAM. Try and follow this tutorial to test you RAM and run until 7 passes to scan all addressable memory.

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Josh

 

[Thedoctor44]

If it has happened ever since you installed Windows then we may be looking a faulty hardware device. Particularly if it is random and application unspecific. Since you have issues with launching new applications when it happens and the error logs point to issues starting new program instances then I would begin with testing RAM. Try and follow this tutorial to test you RAM and run until 7 passes to scan all addressable memory.

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Josh

Very small suggestion, run for 8 passes as we've seen errors appear on the 7th pass a lot of times.

But yes it's starting to look hardware related.

 

[Shadowjk]

If it has happened ever since you installed Windows then we may be looking a faulty hardware device. Particularly if it is random and application unspecific. Since you have issues with launching new applications when it happens and the error logs point to issues starting new program instances then I would begin with testing RAM. Try and follow this tutorial to test you RAM and run until 7 passes to scan all addressable memory.

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Josh

Very small suggestion, run for 8 passes as we've seen errors appear on the 7th pass a lot of times.

But yes it's starting to look hardware related.

Ahh fair enough, go for 8 passes! Been awhile since I last suggested a memtest ...

Josh

 

[eharper256]

I did already run 8 passes on memtest

>> memtestx86 has run 8 passes with no issues.

Then again, this was whilst windows was running (I'm assuming 850% coverage from 4 seperate instances of the program whilst I was at work is equivalent to 8 passes. Or is that wrong?)

 

[eharper256]

Also of note; the error occured last night; but if you shut down you can avoid it. Its just if you start to run a program.

I'll admit though; RAM was my first thought when it first hit me.

 

[eharper256]

Anyway, ran Memtest again off my USB key overnight regardless; still no problems; did 9 passes. Also ran CHKDSK with the fix flag, no problems.

No DCOM 5 errors yesterday. I removed the 'device AMDA00 Interface' from the Device Manager; and there is now no User Mode Driver Crash when starting so startup is quicker. I also went to Online Armour and gave wmprvse full permissions just in the vague off-chance its something dumb like that (they were all question marks before though, no blocks, so I don't anticipate that to be a problem).

Google has been strangely slow a couple of times for some reason in the last few days. But no other websites have, so I'm thinking that's an isolated issue.

I'm starting to wonder if this is the culprit:
The driver \Driver\WUDFRd failed to load for the device ACPI\PNP0A0A\2&daba3ff&3.

Since it also shows up during boot basically every time. That said; I checked this thread: http://www.sevenforums.com/drivers/268212-driver-driver-wudfrd-failed-load-device-error-2.html and my Windows Driver Foundation already starts automatically; so I dunno. I noticed the ASUS website has some kind of ACPI driver (another article somewhere pointed it out, but for some reason I cannot download it (it just halts at 20% every time; very strange as all my other downloads are fine today).

 

[Thedoctor44]

Have the BSOD issues stopped?
If not the dump files are required.
As for the WUDFRd driver you should read this.

Event ID 219 is logged after you install Windows 7 or Windows Server 2008 R2

 

[eharper256]

Well as noted before, there was never any BSOD, per se. It's an unrecoverable freeze so it doesn't generate a dump; I just have to reset it. And yes, it did occur a couple days ago. Not yesterday. I'll keep updating of course. If it seems its gone all stable on me I'll resolve the topic, don't worry; but at the moment I'm still not sure.

 

[eharper256]

Well, it now just happened thrice in succession. It also seems that the above problem with the ASUS website is not isolated to just there. Now, any direct downloads above a certain size (about 2mb or so) just halt at X% and never go anywhere (sourceforge and fosshub also had similar occurances). Booting utorrent to try P2P downloads also seems to cause a freeze (fairly sure booting it in order to try a P2P driver download was what caused the second failure in the above). Google occasionally has moments of terrible slowness before responding.

There are no DCOM errors listed in Events anymore since the 1st May; so something I did must have stopped them; but apparently they were never at fault, but were a symptom given the fact it is still occurring?

Well in any case, my internet appears cocked. I can access webpages, and type right now, but things are definately not right. I used a Ethernet checking tool from Netgear and nothing showed up in that error wise.

Out of random interest; I also tried changing the IDE plug of the HDD to see if that was at fault, but have still gotten issues.

I also tried a Spybot scan on the off-chance its malware; but no results.

 

[Thedoctor44]

Enable Driver Verifier to monitor the drivers.
Driver Verifier -Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point Manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[eharper256]

Driver Verifier has been running for some time as noted in the first post:

>> Have run DriverVerifier using this post Driver Verifier - Enable and Disable for some time with no problems or BSODs.

Actually, you just reminded me I should finally turn it off; no BSODs have been caused by it at any point, and it must have been running for a week now. All non-microsoft drivers were selected as per the posts instructions.

Honestly I have tried a huge amount of diagnosis and still feel rather stumped with advice from here and all over the web before I even tried this post. The only other vaguely threatening sounding events are:

"The driver detected a controller error on \Device\Harddisk1\DR1" happened before the last freeze, but only shows up occassionally. I believe this is my external 1TB drive. However, I tried using the computer with this drive detached for about a week (nothing essential is on it, its a store for photos and videos), and freezes still proceeded.

"Audit events have been dropped by the transport. 0" Tends to occur after a reset, but again only 1 in 3 times or so.

I'll generate a fresh DM Log dump and attach it again here when its done.

 

[Thedoctor44]

Ah yes, sorry about that I forgot you had Driver Verifier already running.
Yes disable it as it isn't necessary then.