Solved 3 BSODs in the last six weeks, most recent was 0x00000101

[450125]

I have had three BSODs in the past six weeks.

First was on October 12, and definitely happened in the process of the normal restart of Windows I do each evening before bed, as I was watching and saw it happen. I don't know the details of the error, as it was somehow not logged.

Second one was sometime between November 24 bedtime and November 25 getting up. http://www.sevenforums.com/performance-maintenance/386489-unhandled-exception-managed-code-snap.html references it. In that post I said that it happened during Windows restart, but I didn't actually see it, so now I'm not sure. And again, somehow it was not logged either.

The most recent one was logged, and I have documented it here (zip file attached). Event 1001, bugcheck 0x00000101.

I'll invite any questions, but for now the noteworthy things I'll mention are that the event viewer said it happened at 3am - five hours after I restarted, 2 1/2 hours after the nightly Avast! AV scan happened. And it would have happened when no user was logged into Windows. That is, from the login screen that appears when the computer is started. Finally, I can't think of any material hardware or software changes or installations I've done in that time.

Thoughts/suggestions?

 

[axe0]

Hi 450125,

Please test your hard drive

Diagnostics Test

 HDD TEST

Run SeaTools to check the integrity of your HDD. SeaTools for DOS and Windows - How to Use - Windows 7 Help Forums

   Note

Do not run SeaTools on an SSD as the results will be invalid.

Run chkdsk
Disk Check - Windows 7 Help Forums

Run HDTune to

• scan for errors, no quick scan but full scan
• check the health,
• benchmark.

It may take some time, but please take the time you need to perform it properly.
Let me know what the results are

• of the error scan,
• make a screenshot of the health of every hard drive and post the screenshots,
• post screenshots with the benchmark of the
  • transfer rate,
  • access time,
  • burst rate,
  • cpu usage.

The marked parts are drivers.
NTFS.sys and FLTMGR.sys are both drivers for the Windows File system.
If there are problems with the file system, what the ntfs, fltmgr and other related drivers are usually pointing to, it could mean the hard drive is giving problems.
Driver Reference Table - fltmgr.sys
Driver Reference Table - ntfs.sys

0: kd> k
Child-SP          RetAddr           Call Site
fffff880`031a0d48 fffff800`030e093a nt!KeBugCheckEx
fffff880`031a0d50 fffff800`03093007 nt! ?? ::FNODOBFM::`string'+0x4e3e
fffff880`031a0de0 fffff800`0360b895 nt!KeUpdateSystemTime+0x377
fffff880`031a0ee0 fffff800`03085193 hal!HalpHpetClockInterrupt+0x8d
fffff880`031a0f10 fffff800`0308e308 nt!KiInterruptDispatchNoLock+0x163
fffff880`031a10a0 fffff800`030cd35c nt!KeFlushMultipleRangeTb+0x258
fffff880`031a1170 fffff880`0125764d nt!MmSetAddressRangeModified+0x2b0
fffff880`031a1270 fffff880`01302bb5 [COLOR="red"]Ntfs[/COLOR]!LfsFlushLfcb+0x5ad
fffff880`031a13e0 fffff880`01304df1 [COLOR="red"]Ntfs[/COLOR]!LfsFlushToLsnPriv+0x155
fffff880`031a1470 fffff800`030cb711 [COLOR="red"]Ntfs[/COLOR]!LfsFlushToLsn+0xa1
fffff880`031a14a0 fffff800`030c9eb2 nt!CcAcquireByteRangeForWrite+0x7e7
fffff880`031a1580 fffff880`012bf736 nt!CcFlushCache+0x2c2
fffff880`031a1680 fffff880`012bfc62 [COLOR="red"]Ntfs[/COLOR]!NtfsFlushBootCritical+0x76
fffff880`031a16f0 fffff880`012c041d [COLOR="red"]Ntfs[/COLOR]!NtfsCommonFlushBuffers+0x3e2
fffff880`031a17d0 fffff880`01123bcf [COLOR="red"]Ntfs[/COLOR]!NtfsFsdFlushBuffers+0x10d
fffff880`031a1840 fffff880`011226df [COLOR="red"]fltmgr[/COLOR]!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`031a18d0 fffff880`011226af [COLOR="red"]fltmgr[/COLOR]!FltpDispatch+0xcf
fffff880`031a1930 fffff800`03394f3b [COLOR="Red"]fltmgr[/COLOR]!FltpDispatch+0x9f
fffff880`031a1990 fffff800`03324c75 nt!IopSynchronousServiceTail+0xfb
fffff880`031a1a00 fffff800`03087ed3 nt!NtFlushBuffersFile+0x171
fffff880`031a1a90 fffff800`03084490 nt!KiSystemServiceCopyEnd+0x13
fffff880`031a1c28 fffff800`03325a3f nt!KiServiceLinkage
fffff880`031a1c30 fffff800`033164c7 nt!CmpFileFlush+0x3f
fffff880`031a1c70 fffff800`03092b69 nt!CmpLazyFlushWorker+0x33
fffff880`031a1cb0 00000000`00000000 nt!ExpWorkerThread+0x111

 

[450125]

Hi 450125,

Please test your hard drive

I appreciate the suggestion, but was it made after analyzing the BSOD information I uploaded?

None of my three hard drives (system C drive less than a year old; mirrored D/F data drives) has ever exhibited any troubling signs, and I have never event-logged a HDD issue or failure, and I'd not want to do a time-consuming test when there's no data suggesting that it's a HDD matter.

In a separate note, the BSOD I am documenting occurred roughly 22 seconds after 3am, which is, I believe, the time that Windows update automatically triggers. Could this have had anything to do with what happened?

Last night the computer went to sleep as it normally does, and there were no problems. I manually downloaded/installed an update during the day, which required a restart of the computer, and none of those things triggered an error.

 

[axe0]

Where do you think I have the data of the Windows File system from?

I hope you have in mind that a problem could suddenly occur and doesn't have to build up in time.

The 0x101(CLOCK_WATCHDOG_TIMEOUT) is a crash that mostly is caused by BIOS/hardware problems, the trick is to find software problems with this crash.

Of course, if you don't want to follow my suggestions, no problem. I only want to help finding the root cause with the crashes you had.

 

[cyclops]

Greetings axe0. I'm Brian and just shooting in the dark after scanning through the event log, but there were instances of unexpected shut downs indicated in a startup sequence which looks like it coincides with what was logged as BSOD. The time noted in the comment for the startup indicates an unexpected shut down at a time for which there were no events logged. I hope that makes some sense. I observed these things in the log for 2015-11-29 very early in the morning. Similar events prior to that also, but too much to sit here and bang out. Never worked on a BSOD problem before, so feel free to shoot me down if it is just. I am attaching a .doc with suspect problem in RED. Some of the time stamps make no sense at all. I also noted one incident of the clock synch was screwy when communicating with the NIST time server. Just a shot in the dark. If you don't care for me to attempt any of this sort of communication to you just say so, I won't be offended.
Good luck all.

 

[axe0]

Hi Brian,

Those event logs are usual, the system always writes those kind of logs when the computer unexpectedly restarts from a crash.
Except for the bugcheck, and in some rare cases the up-time, it is kinda useless.

 

[cyclops]

Last time I'll bug you

Hi Brian,

Those event logs are usual, the system always writes those kind of logs when the computer unexpectedly restarts from a crash.
Except for the bugcheck, and in some rare cases the up-time, it is kinda useless.

Axe0, Below is the event where the system time was way out of sync. Just something which has piqued my curiosity. I am going to start watch the threads here, maybe I'll learn something from you. I'll keep my mouth shut while I learn.

Event[25065]:
Log Name: System
Source: Microsoft-Windows-Kernel-General
Date: 2015-08-26T03:36:45.500
Event ID: 1
Task: N/A
Level: Information
Opcode: Info
Keyword: Time
User: N/A
User Name: N/A
Computer: DAVEWIN7
Description:
The system time has changed to ?2015?-?08?-?26T07:36:45.500000000Z from ?2015?-?08?-?26T04:44:26.059331000Z.

 

[axe0]

How so is it way out of synch?

Year, month, day, minute, second, millisecond.
A few minutes difference, completely normal with a hard drive

 

[cyclops]

How so is it way out of synch?

Year, month, day, minute, second, millisecond.
A few minutes difference, completely normal with a hard drive

3 hours off

 

[axe0]

I see now yes, currently online via phone.
I'll check the log for the why when I'm back at my laptop.

A lot of logs are around that time that always happen at boot, so one would need to know what you can avoid when searching.

Just to keep in mind, this could be simply due to a normal startup after a normal shutdown

 

[450125]

This time thing is interesting to me.

I'm looking at the event log in my work computer, and the time resets are never more than unnoticeable fractions of a second - versus the occasional hours that I see in my home computer event log.

My work computer does not "sleep," and I have my home computer set to sleep after 2 1/2 hours of inactivity. Still, many of the sleep wakeups don't have the massive time adjustments.

Should I try the advice in http://www.sevenforums.com/general-discussion/91924-can-anyone-please-shed-any-light.html relative to stopping and resetting/resyncing the time service?

I have, in the past week, run sfc /scannow and everything was found to be normal.

 

[cyclops]

This time thing is interesting to me.

I'm looking at the event log in my work computer, and the time resets are never more than unnoticeable fractions of a second - versus the occasional hours that I see in my home computer event log.

My work computer does not "sleep," and I have my home computer set to sleep after 2 1/2 hours of inactivity. Still, many of the sleep wakeups don't have the massive time adjustments.

Should I try the advice in http://www.sevenforums.com/general-discussion/91924-can-anyone-please-shed-any-light.html relative to stopping and resetting/resyncing the time service?

I have, in the past week, run sfc /scannow and everything was found to be normal.

450125, I will be watching this from the sideline, as I am not a BSOD expert, in fact I am here to learn at this time. I would not want to complicate things for you and Axe0. He can ask for my opinion, but that is up to him.

 

[450125]

Regarding the observations about the system time changing, I took a look at my event log, filtered down to EventID 1, and it appears that every radical system time reset immediately follows a wake-from-sleep condition, and the time differential is the amount of sleep time.

It was just a quick look that I took, but in all likelihood whatever is (or hopefully just happened to be) wrong with the computer, the hours-long readjustments of time aren't a cause or an effect of that.

 

[450125]

I took another look at my event log and maybe the following information will be helpful.

The two most-recent BSOD incidents were on 11/24 and 11/29.

Because I restart my computer every night, there are usually consecutive events with IDs 13 (Windows stopping) and 12 (Windows starting), about 20-30 seconds apart.

On 11/24, the 13 (Windows stopping) event happened, but there was no starting event, until the next day when I forced a start from the BSOD. Whatever the cause of the BSOD it was not logged, and obviously would have occurred after the Windows stopping (by my hand). My antivirus scan, which runs after midnight, did not run on the morning of the 25th, more proof that the BSOD happened during the restart.

My computer generally goes to sleep after 2 1/2 hours of inactivity - that's how I have it set. There are some times when this does not happen, and I've never figured out the pattern. Maybe out of 60 "sleep opportunities" in a month, 55 will happen and five won't, to make a guess.

In the past week, the only night the computer did not sleep was overnight 11/28 into the 29th, and that night the BSOD event, with stop code 0x00000101, happened just after 3:00 in the morning, which is the time that Windows updates are pushed to my computer, I believe.

So I'm wondering if this Windows update push somehow triggered the most recent BSOD.

I've been reluctant to try the disk tests axe0 suggested. No good reasons, just laziness and inertia on my part, and the fact that I have three HDDs and the tests are lengthy. I image my C drive each month after Patch Tuesday (once a quarter to an external HDD, and the other two months simply to my internal D drive, which mirrors to the F drive, and the two of them appear synchronized). I have no logged disk errors, and the C imaging has always happened without error or incident.

 

[cyclops]

Hello 450125
I would like to experiment without running diagnostic and cleaner apps for the moment. Axe0 don't kill me!
I don't do many forced shut downs and I don't use Hibernate. I only use sleep mode. I have not had a BSOD since the day I fired up this custom build in September of 2013.
If you are willing, for test purposes only, start putting it to sleep at the times you would usually shut down and don't let it hibernate under any conditions. I have a friend whose machine hated to come out of hibernate. Leave everything else as it is. Sleep shuts down the HDD's but remembers exactly everything that was open and active. I have mine set to wake on USB or Keyboard, but Wake on LAN is disabled to prevent phone home activity from waking it and any other reason the LAN from waking it out of a nap.
That is just a step in a process of elimination for what might events are/might be triggering BSOD's.
Let me know what you think (axe0 that means you too, please).

 

[axe0]

Within a few hours, I'll be home and read the thread.
Can't promise to post, I'm very busy with my study for app/site development, but I'll try my best.

 

[450125]

Hello 450125
I would like to experiment without running diagnostic and cleaner apps for the moment. Axe0 don't kill me!
I don't do many forced shut downs and I don't use Hibernate. I only use sleep mode. I have not had a BSOD since the day I fired up this custom build in September of 2013.
If you are willing, for test purposes only, start putting it to sleep at the times you would usually shut down and don't let it hibernate under any conditions. I have a friend whose machine hated to come out of hibernate. Leave everything else as it is. Sleep shuts down the HDD's but remembers exactly everything that was open and active. I have mine set to wake on USB or Keyboard, but Wake on LAN is disabled to prevent phone home activity from waking it and any other reason the LAN from waking it out of a nap.
That is just a step in a process of elimination for what might events are/might be triggering BSOD's.
Let me know what you think (axe0 that means you too, please).

Just to make clear, my regular regimen is to restart (using Restart from the Start circle) at the end of each day. The computer then sleeps (?*) after 2 1/2 hours. I wake it in the morning, and while I'm at work it again sleeps (?*) after 2 1/2 hours. Most of the time on weekends, I'm on the computer often enough during the day that it stays awake until I do the evening restart.

I essentially never shut the computer down. Certainly if moving it or opening it up. Sometimes if I'm going to be gone for a long period of time. 99% of the time, it's a nightly restart.

When I say "sleeps (?*)" above I am referring to I am afraid I have never grasped the differences between sleep, hibernation, hybrid sleep. When I'm home I can check (tell me where please) on what I use. When it goes to "sleep (?*)" the power light shuts off on the case, and then no one can (for example) print to the USB printer attached to the computer. To wake it, I click twice on the mouse, or press the power button, and it takes about 10 seconds for the display to return and the computer be functional again.

 

[cyclops]

Hi again.
I am gathering some info for you. Be back shortly. I'd like to make sure I give you the most accurate descriptions of what is what.

 

[cyclops]

Just to make clear, my regular regimen is to restart (using Restart from the Start circle) at the end of each day. The computer then sleeps (?*) after 2 1/2 hours. I wake it in the morning, and while I'm at work it again sleeps (?*) after 2 1/2 hours. Most of the time on weekends, I'm on the computer often enough during the day that it stays awake until I do the evening restart.

I essentially never shut the computer down. Certainly if moving it or opening it up. Sometimes if I'm going to be gone for a long period of time. 99% of the time, it's a nightly restart.

When I say "sleeps (?*)" above I am referring to I am afraid I have never grasped the differences between sleep, hibernation, hybrid sleep. When I'm home I can check (tell me where please) on what I use. When it goes to "sleep (?*)" the power light shuts off on the case, and then no one can (for example) print to the USB printer attached to the computer. To wake it, I click twice on the mouse, or press the power button, and it takes about 10 seconds for the display to return and the computer be functional again.[/QUOTE]


OK Let's see if I put this together in a way that will be easy to follow. Please see the images below, you can right click the image/select view image to enlarge it in a new window and then use the back arrow in your browser to return. Let me know how it goes.

View attachment 377149

View attachment 377150

 

[axe0]

Something/someone had hit the mouse what caused the system to wake up from sleep.

Event[25070]:
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2015-08-26T03:36:49.602
  Event ID: 1
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: DAVEWIN7
  Description: 
The system has resumed from sleep.

Sleep Time: ?2015?-?08?-?26T04:44:19.710119800Z
Wake Time: ?2015?-?08?-?26T07:36:46.186401200Z

[COLOR="Red"]Wake Source: Device -HID-compliant mouse[/COLOR]