Solved 3 BSODs in the last six weeks, most recent was 0x00000101

[cyclops]

Something/someone had hit the mouse what caused the system to wake up from sleep.

Event[25070]:
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2015-08-26T03:36:49.602
  Event ID: 1
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: DAVEWIN7
  Description: 
The system has resumed from sleep.

Sleep Time: ?2015?-?08?-?26T04:44:19.710119800Z
Wake Time: ?2015?-?08?-?26T07:36:46.186401200Z

[COLOR=Red]Wake Source: Device -HID-compliant mouse[/COLOR]

From Post 17
I would be surprised if he is working it at 3:30AM, but the sleeptime and waketime logged does not jive with that????
. To wake it, I click twice on the mouse, or press the power button, and it takes about 10 seconds for the display to return and the computer be functional again.


Again the wake times and sleep times make no sense. also ref. event25065 the clock adjusted and it was a nearly 3 hour adjustment
The wake time and sleep time for event 25070 are outside of the time that the mouse was detected??

Should we have him turn off the automatic clock sync??

 

[axe0]

Who says it is only 450125 who is able to do that?
When waking from sleep, clicking is what 450125 does but not required.
I used to just move the mouse a little to wake the system on my fathers system.

 

[450125]

0x00000101 again - second time in four days

It happened again, and I have attached the collected files here.

Normal restart around 22:00 last night (I'm using 24-hour time here since I'm being helped by people outside the US). It went to the login screen fine - I waited to notice. Avast! AV scan ran fine from 00:15 to 00:26 approximately. Many normal "information" events were logged after that for a couple hours. STOP error occurred at 03:25, seven minutes after the last prior logged informational event, that the Adobe Flash Player Update Service entered the stop state.

I discovered this about two hours later this morning.

So I've now had three BSODs in the past eight days, and four in the past seven weeks:

1. 10/12 - BSOD during the normal shutdown phase of a Windows restart. Not logged and no dumpfile created.
2. 11/24 - BSOD during the normal shutdown phase of a Windows restart. Not logged and no dumpfile created.
3. 11/29 - BSOD at 03:00 after a normal restart approximately 5 hours earlier, and the AV running approximately 3 hours earlier, with the computer at the login screen.
4. 12/02 - BSOD at 03:25 after a normal restart approximately 5 hours earlier, and the AV running approximately 3 hours earlier, with the computer at the login screen.

To me it's noteworthy that none of these have happened during a logged-in user session. And that two were after Windows stopped in a normal restart cycle, and not logged. And that two happened in the middle of the night from an unattended login screen. Both are documented in this thread; most recent in this post, and #3 at the start of the thread. 3 and 4 happened the only two nights in the past eight weeks that the computer, as it does sometimes, did not go to sleep 2 1/2 hours after restart and no use.


Options I'm considering:

• Running a chkdsk
• System restore to 11/17, the earliest restore point I have, and a week before the most recent problems began. Interestingly, there were restore points made before critical updates on 11/24 and 11/29, BSODs #2 and #3 above. Although there have been other restore points and critical updates made on days with no BSODs.
• Perhaps restoring my C drive to the image I took in early November after the November patches were installed. A more drastic step, admittedly.

All thoughts welcome. Of course.

 

[axe0]

I suggest to uninstall Avast, it caused the last crash
http://www.sevenforums.com/tutorials/343783-avast-uninstall-completely.html

fffff880`038307f8  fffff880`03e6f6bdUnable to load image \SystemRoot\system32\drivers\aswSP.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSP.sys
*** ERROR: Module load completed but symbols could not be loaded for aswSP.sys
 aswSP+0xc6bd

Does any setting in the BIOS have been changed?

 

[450125]

I suggest to uninstall Avast, it caused the last crash
http://www.sevenforums.com/tutorials/343783-avast-uninstall-completely.html

fffff880`038307f8  fffff880`03e6f6bdUnable to load image \SystemRoot\system32\drivers\aswSP.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSP.sys
*** ERROR: Module load completed but symbols could not be loaded for aswSP.sys
 aswSP+0xc6bd

Does any setting in the BIOS have been changed?

Thanks axe0.

I'm now at work, but will look further into this in the evening. (EDITED TO ADD THE FOLLOWING): If any bios settings were changed, it was not by my or any other human hands. I'd have to say bios settings have been unchanged for two years or longer.

Interestingly, I did, at Avast's prompting, update Avast (the software itself; not just the virus definitions) sometime last week. Not sure when (there must be a way to check this? - the software updates itself once I okay it, vs. me having to download an update), but certainly before the 0x00000101 errors started happening.

Can you tell me where I'd find the stuff you quoted, and if it says what time this occurred?

There is plenty of documentation, especially in the Avast forum (https://forum.avast.com/index.php?action=search2), of aswSP.sys being a cause of such problems.

So what do you suggest? A complete uninstall/reinstall of Avast? Since so far as I know it caused no prior problems (and I've been using it and updating it for more than five years). Or going to AVG or another such antivirus program?

(Dumb question, I know) How sure are you that taking action on Avast will fix these BSODs?

And, less dumb, why might this problem only be happening when the computer is not logged in and unattended?

 

[axe0]

I can tell you where I have found the data, but what you'll see would be out of your mind, because you wouldn't understand it.
At what time it exactly happens, I'll have to see if I can find a way to do so (i'm by far an expert at debugging bluescreens) but I do that later.

For now just uninstall it while troubleshooting.

Honestly I can't say how much it might help, there are many times that when I thought something the opposite happened.
As I stated earlier the 0x101 is mostly caused by BIOS and hardware problems, it would be the trick to find software issues. That is the general expertise with 0x101's, but I have only noticed software and BIOS problems with this 0x101.
I have no idea what exactly happens or why a crash occured and that is the reason why I can't say if it helps a lot.
I'm only a novice at debugging

 

[450125]

Again axe0, thanks a lot.

When you say to uninstall Avast while troubleshooting, that's a bit tricky.

If this problem was causable and repeatable (i.e., predictable), that would be great. But since I went 72 hours between blue screens, how long do I "go naked" with no AV protection? I do practice extremely safe computing and am not particularly worried about being infected for a day or two weeks, but when/where do I draw the line and view myself as having solved this?

Would you recommend I turn sleeping off on my computer, as a way to "force" the conditions under which the failure has occurred (middle of the night, if computer doesn't fall asleep)? The 0x000101 errors have only occurred since I updated Avast, and only on those nights that the computer doesn't fall asleep after the scan.

 

[axe0]

Ai, forgot (again) to add the instructions for Microsoft Security Essentials to use as alternative
Microsoft Security Essentials - Microsoft Windows

In your case, because the crashes appear extremely infrequently, it is something to follow for months and simply reply again when you have encountered another bluescreen.

I think it doesn't matter a lot, but it wouldn't hurt to turn sleeping off

 

[450125]

Ai, forgot (again) to add the instructions for Microsoft Security Essentials to use as alternative
Microsoft Security Essentials - Microsoft Windows

In your case, because the crashes appear extremely infrequently, it is something to follow for months and simply reply again when you have encountered another bluescreen.

I think it doesn't matter a lot, but it wouldn't hurt to turn sleeping off

I can't put into words why, but I just have this weird gut feel that this is going to fix it. But as you said, I can't really say "solved" for a while. If this helps me break the 72-hour barrier I'll call that a tentative win.

 

[450125]

Very minor update...

I did successfully remove Avast last night using the 3-step method Axe0 linked to, then installed Microsoft Security Essentials.

No BSOD so far, which doesn't at the moment prove much.

I restarted the computer many times last night during the uninstall and install process, and there were no BSODs during the shutdown, which had happened twice in the past two months.

The computer went to sleep four hours after my bedtime restart, vs. the 2 1/2 that it's set to. Not sure why.

For me, the key upcoming milestones will be:

• First time the computer makes it through the night without going to sleep and without BSOD-ing (last happened 11/25-26)
• First time I go four days with no BSOD (last happened 11/19-23)
• First time I go 15 days with no BSOD (15 days is an arbitrary figure, but have to draw a line somewhere - again, last time was the 15 days ending 11/23)

If I can hit all the above milestones, I'll mark the problem solved.

And if I don't - well, I'll post an update.

 

[axe0]

Hope I don't see an update then

 

[450125]

15 days! - so marking solved

Okay, this morning is the 15th consecutive morning of waking to no blue screen, so I'm marking the problem as solved.

Actually, sort of the 14th; we were unexpectedly out of town earlier this week, so the computer slept for 36 hours without waking (or "bluing").

I believe there were two nights in that time that the computer never slept, and the November pattern had been that it would mysteriously blue screen 5-7 hours after restart, so it was important to have at least one instance of making it through the night awake and surviving.

I have been checking my event log daily as well, and there has been nothing "sketchy" going on undetected beneath the surface.

I'd particularly like to thank axe0 who was persistent and thorough and was the one who proposed the solution. Especially since I blew off his initial suggestion (that, it turned out, didn't happen to be the problem at all anyway).