Multiple issues that started with applecharger.sys BSOD

thaKing · 16 Mar 2013

Hello all!

Let me tell you a little of what I'm experiencing and hopefully you can help me troubleshoot and fix the problem.

I tried running iTunes and it locked up on me. So I rebooted and during the reboot I got a BSOD with an error relating to applecharger.sys. I ran the tool "autoruns for Windows" and on the Driver tab removed the check from applecharger.sys. I rebooted and tried a normal boot - after POST it just sat there. I held in the power button to restart and did a safe boot again. During the loading of the drivers it would just *stop* and sit there. It would take about 20 minutes before it would resume and finish booting into safe mode. I checked autoruns again and it was still unchecked.

I did a normal reboot into Windows and it too would just sit there after POST. After about 20-25 minutes, the logon screen would appear. I can log in just fine and everything appears to run (although, I still had an issue with iTunes, but I'm guessing one thing at a time for now). I ran sfc /scannnow and found no issues. I noticed in my notifications it listed a problem with ycc.dll. Both ycc.dll and applecharger.sys appear to be with my motherboard. I downloaded and installed "gigabyte on/off charge disable" but I cannot tell that it did anything. I then went into msconfig and did a selective startup and removed everything from startup that wasn't windows. Upon attempting reboot, it still took 25 minutes to boot.

Lastly, as I was entering my specs as I registered, I wanted to verify everything to make sure I had it correctly. When I viewed the Windows System Information tool, it listed only 4GB of RAM. I right-clicked my computer, and it said the same thing. Although I have 8GB of RAM installed.

So, my issues are:

applecharger.sys BSOD
ycc.dll error
20-25 minutes to boot
only 4GB of RAM showing

Any tips or help would be GREATLY appreciated. I'm at a loss of what to do or where to go next.
Note: I am no longer getting BSOD, just the first one that started all the issues.

Saurabh A · 17 Mar 2013

Hi thaKing,

It appears that 'applecharger.sys BSOD' is related to 'GIGABYTE On/Off Charge driver' (http://www.gigabyte.us/MicroSite/185/on-off-charge.htm)
Please try uninstalling the program from the system and check results; disabling the application may not be good enough.

You may also try running 'Hardware Diagnostics' to check the 'Hard Drive' functionality: WD Support / Downloads / SATA & SAS / WD RE2
Also try using the system in 'Safe Mode' and see if the system still takes time to start-up. Also look for any errors.

Also open the system BIOS to see if amount of 'RAM' that shows up.

Download and run the 'SF_Diagnostic_Tool.exe file' as suggested in the tutorial link for better 'BSOD analysis': Blue Screen of Death (BSOD) Posting Instructions
After download, click 'Grab all' to capture the Mini-Dump, Event Logs, Update Logs, Driver List and MGDiag reports. Apart from the 'Mini dump' the information in these files is vital for investigation.

Do reply with the information; would be glad to assist.

thaKing · 17 Mar 2013

Saurabh A said:

Hi thaKing,

It appears that 'applecharger.sys BSOD' is related to 'GIGABYTE On/Off Charge driver' (GIGABYTE ON/OFF Charge)
Please try uninstalling the program from the system and check results; disabling the application may not be good enough.

You may also try running 'Hardware Diagnostics' to check the 'Hard Drive' functionality: WD Support / Downloads / SATA & SAS / WD RE2
Also try using the system in 'Safe Mode' and see if the system still takes time to start-up. Also look for any errors.

Also open the system BIOS to see if amount of 'RAM' that shows up.

Download and run the 'SF_Diagnostic_Tool.exe file' as suggested in the tutorial link for better 'BSOD analysis': Blue Screen of Death (BSOD) Posting Instructions
After download, click 'Grab all' to capture the Mini-Dump, Event Logs, Update Logs, Driver List and MGDiag reports. Apart from the 'Mini dump' the information in these files is vital for investigation.

Do reply with the information; would be glad to assist.

Thank you so much for your assistance.

I will try to uninstall the on/off app and see what that gets me. I will also run the HDD diagnostic tool and will report back. I don't know if uninstalling the on/off will change the boot time, but I know as of right now booting to safe mode also takes 20-25 minutes. I will also try safe mode after removing the on/off app. And lastly, I will provide the log files as requested. But I will have to do this in the morning, as I am headed to bed.

I will work on these first thing tomorrow morning and will post back everything I find.

I really do appreciate you offering to assist. Thank you so very much!

Saurabh A · 17 Mar 2013

Hi thaKing,

Thank you for the reply.

If the system takes that long to start in 'Safe Mode' also, that may point at a possible 'Hardware Issue'; 'Hard Drive' diagnostics may produce conclusive results. Uninstalling 'GIGABYTE On/Off Charge drive' is worth a shot.

Please take your time and share the 'crash logs' when convenient; will take it forward from there.

thaKing · 18 Mar 2013

Here's what I have thus far:

Uninstalled on/off app
Ran HDD diagnostic tool on 2 of 3 drives and all passed (last drive is a 2TB drive and it will take some time, so I'll get that running now)
Looked in BIOS and only 4GB of RAM was listed, so I opened the case and one stick was not fully mounted. After pushing that stick in and rebooting the system booted in under a minute (normal speed). Looked in system information and all 8GB are listed.
I am posting the zip file for the logs as requested.

I did not boot to safe mode (actually meant to but just missed it after fixing the RAM). However, since I booted into Windows in a normal time, I'm wondering if all my issues lie with the loose RAM? I can still attempt a safe mode if you'd like.

If you see anything in the log files, or would like me to try anything else just to be sure, please let me know.

thaKing · 18 Mar 2013

I ran the HDD Diagnostic tool on my 2TB drive and it passed as well.

Saurabh A · 18 Mar 2013

Hi thaKing,

Thank you for the response.

The crash dump analysis:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8880306d428, 0, fffff8800306a80a, 5}

Unable to load image \SystemRoot\system32\DRIVERS\AppleCharger.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for AppleCharger.sys
*** ERROR: Module load completed but symbols could not be loaded for AppleCharger.sys

Could not read faulting driver name
Probably caused by : AppleCharger.sys ( AppleCharger+280a )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8880306d428, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8800306a80a, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032ba100
 fffff8880306d428 

FAULTING_IP: 
AppleCharger+280a
fffff880`0306a80a 498b14dc        mov     rdx,qword ptr [r12+rbx*8]

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88002184460 -- (.trap 0xfffff88002184460)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000ffffffff rbx=0000000000000000 rcx=fffff8800306b340
rdx=fffff8800306d578 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800306a80a rsp=fffff880021845f0 rbp=0000000000000000
 r8=0000000000000001  r9=0000000000000002 r10=0000000000000001
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
AppleCharger+0x280a:
fffff880`0306a80a 498b14dc        mov     rdx,qword ptr [r12+rbx*8] ds:3600:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030fe673 to fffff80003081c40

STACK_TEXT:  
fffff880`021842f8 fffff800`030fe673 : 00000000`00000050 fffff888`0306d428 00000000`00000000 fffff880`02184460 : nt!KeBugCheckEx
fffff880`02184300 fffff800`0307fd6e : 00000000`00000000 fffff888`0306d428 00000000`00000000 00000000`ffffffff : nt! ?? ::FNODOBFM::`string'+0x43801
fffff880`02184460 fffff880`0306a80a : fffffa80`00000200 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`021845f0 fffffa80`00000200 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : AppleCharger+0x280a
fffff880`021845f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000002 : 0xfffffa80`00000200


STACK_COMMAND:  kb

FOLLOWUP_IP: 
AppleCharger+280a
fffff880`0306a80a 498b14dc        mov     rdx,qword ptr [r12+rbx*8]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  AppleCharger+280a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: AppleCharger

IMAGE_NAME:  AppleCharger.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d2ad809

FAILURE_BUCKET_ID:  X64_0x50_AppleCharger+280a

BUCKET_ID:  X64_0x50_AppleCharger+280a

Followup: MachineOwner

Probably caused by : AppleCharger.sys
Related to 'GIGABYTE On/Off Charge driver'

Please clean up (remove) the following applications from the system and recheck performance:

Code:

Start Menu\Programs\GIGABYTE
Start Menu\Programs\GIGABYTE\AutoGreen
Start Menu\Programs\GIGABYTE\ET6

PAGE_FAULT_IN_NONPAGED_AREA (50):
Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).
Another common cause is the installation of a faulty system service. An antivirus software can also trigger this error, as can a corrupted NTFS volume.

Please share if you recently made any hardware change to the unit (Especially RAM related). In either case, please test the system 'Memory' and share results: RAM - Test with Memtest86+

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.
Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.
If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
3. Test the next stick of RAM (stick #2) in the next motherboard slot.
If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

You may also try the following steps:
1. Uninstall 'Avast' avast! Uninstall Utility | Download aswClear for avast! Removal; restart the system and install 'Microsoft Security Essentials' Microsoft Security Essentials - Microsoft Windows

2. Perform 'Windows Updates' and check if the issue re-occurs.

3. If you still experience issues, it could be a corrupted 'NTFS volume'. You may try to run Chkdsk /f /r to detect and repair disk errors. Please refer to the steps in this tutorial (Option 2) to attempt the diagnosis/repair through 'Command Prompt': Disk Check

Hope this helps. Do reply with the findings; would be glad to assist.

thaKing · 19 Mar 2013

Saurabh A said:

Hi thaKing,

Thank you for the response.

The crash dump analysis:
****
Probably caused by : AppleCharger.sys
Related to 'GIGABYTE On/Off Charge driver'

Please clean up (remove) the following applications from the system and recheck performance:
******
PAGE_FAULT_IN_NONPAGED_AREA (50):
Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).
Another common cause is the installation of a faulty system service. An antivirus software can also trigger this error, as can a corrupted NTFS volume.

Please share if you recently made any hardware change to the unit (Especially RAM related). In either case, please test the system 'Memory' and share results: RAM - Test with Memtest86+
*******
You may also try the following steps:
1. Uninstall 'Avast' avast! Uninstall Utility | Download aswClear for avast! Removal; restart the system and install 'Microsoft Security Essentials' Microsoft Security Essentials - Microsoft Windows

2. Perform 'Windows Updates' and check if the issue re-occurs.

3. If you still experience issues, it could be a corrupted 'NTFS volume'. You may try to run Chkdsk /f /r to detect and repair disk errors. Please refer to the steps in this tutorial (Option 2) to attempt the diagnosis/repair through 'Command Prompt': Disk Check

Hope this helps. Do reply with the findings; would be glad to assist.

Hi Saurabh A -

- I can/will cleanup the Gigabyte files.
- Hardware changes: As I mentioned yesterday, one slot of RAM was not seated properly. I reseated the RAM and got all 8GB showing up. So the change would be that one stick of RAM became loose and I reseated it. I will run the test overnight and report back results tomorrow.
- I'm going to hold off on uninstalling Avast, as that has been my go-to antivirus for quite a while. I have it on several machines and never had an issue with it. As we narrow things down, if it becomes necessary to try, then I will, but until then I will wait.
- I was holding off on running windows updates just in case an update caused any issues. However, I have just ran updates and will reboot shortly.
- Hoping the NTFS volume is not corrupted.

So, as a recap - will remove Gigabyte stuff, I have ran Windows update and will run Memtest overnight. I am holding off on removing Avast.

By the way, I have rebooted a time or two since resetting the RAM that was loose. Boot time is normal (less than a minute).

Saurabh A · 19 Mar 2013

Hi thaKing,

Thank you for the response.

Your thought about removing 'Gigabyte' and running 'Memtest' before uninstalling 'Avast software' makes complete sense. It is likely that the test produces some conclusive results; or removing 'Gigabyte' proves to be good enough. Uninstalling 'Avast' may not be required in that case, at all.

Do reply with the findings; glad to assist.

thaKing · 21 Mar 2013

Removed Gigabyte apps, ran Memtest (10 passes no errors) and updated all Windows files. So far everything still seems to be running smoothly. I'm really beginning to think it was the stick of RAM that wasn't seated properly. As mentioned, I have not uninstalled Avast at this time. What do you think, could the loose RAM have been the culprit all along?