Solved Additional errors found while troublrshooting BSOD

[drdigital1]

[FONT=&quot]During my debugging efforts I also ran System Health Report. I always get ONE error as follows:[/FONT]
[FONT=&quot]Symptom: A service is reported as having an unexpected error code[/FONT]
[FONT=&quot]Cause: One or more services has failed. The service did not stop gracefully, suggesting the service may have crashed or one of its components stopped in an unsupported way.[/FONT]
[FONT=&quot]Details: Service exited with code not equal to 0 or 1077[/FONT]
[FONT=&quot]If I double-click on “A service is reported as having an unexpected error code” I get the following:[/FONT]
[FONT=&quot]Abnormally Stopped System Services[/FONT]
[FONT=&quot]Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

Any suggestion on how to handle?

Error event log attached
[/FONT]

 

[writhziden]

Log Name:      System
Source:        Disk
Date:          5/2/2012 8:17:33 PM
Event ID:      11
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      HP2010
Description:
The driver detected a controller error on \Device\Harddisk5\DR5.

You have a ton of errors like the above. What hard disk has location 5? Start Menu -> Computer -> Right click a hard disk -> Properties -> Hardware tab -> Select each piece of hardware -> Check the Location for 5.

Are you hard disk controller drivers up to date? If they are, they may be corrupted and in need of an uninstall and re-install. If you fill in your system specs on your profile (not in a post in this thread), we will be able to help you find the proper drivers. http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html can help with filling in the system specs.

• If you are overclocking any hardware, please stop.
  
  
• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html.
  For any drives that do not give the message:
  Windows has checked the file system and found no problems
  run disk check again as above. In other words, if it says:
  Windows has made corrections to the file system
  after running the disk check, run the disk check again.
  
  
• Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations. Use OPTION THREE of http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html to provide us with the sfcdetails.txt file if errors occur.

You also have event ID 4107 in your errors. See Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server to resolve that error.

 

[drdigital1]

[FONT=&quot]Thanks for you advice. Below is an itemized answer[/FONT]
[FONT=&quot]
[/FONT]
[FONT=&quot]1. You have a ton of errors like the above. What hard disk has location 5? Start Menu -> Computer -> Right click a hard disk -> Properties -> Hardware tab -> Select each piece of hardware -> Check the Location for 5.[/FONT]
[FONT=&quot]Nothing is shown for Location 5. More below.[/FONT][FONT=&quot]

2. Are you hard disk controller drivers up to date? [/FONT]

[FONT=&quot]Have 2 storage controllers:[/FONT]

[FONT=&quot]Intel ICH8R/ich9r/ICH10R/DO/PCH SATA RAID Controller[/FONT]
[FONT=&quot]Driver Date: 6/4/2009[/FONT]
[FONT=&quot]Driver Version: 8.9.0.1023[/FONT]

[FONT=&quot]JMicron JMB36X Controller[/FONT]
[FONT=&quot]Driver Datye: 11/25/2010[/FONT]
[FONT=&quot]Driver Version: 1.17.62.0[/FONT]


[FONT=&quot]Windows says “The best driver software for your device is already installed”, but (as I learned from the usb3hub.sys experience) this is not always true; or, as you mention, the drivers might be corrupt. How would I determine if they are corrupt or not?[/FONT]

[FONT=&quot]3. If they are, they may be corrupted and in need of an uninstall and re-install. If you fill in your system specs on your profile (not in a post in this thread), we will be able to help you find the proper drivers. [/FONT][FONT=&quot][FONT=&quot]System Info - See Your System Specs[/FONT][/FONT][FONT=&quot] can help with filling in the system specs. [/FONT]
[FONT=&quot]Done – system specs uploaded[/FONT]
[FONT=&quot]
4. If you are overclocking any hardware, please stop.[/FONT][FONT=&quot] No overclocking[/FONT]
[FONT=&quot]
5. Run [/FONT][FONT=&quot][FONT=&quot]Disk Check[/FONT][/FONT][FONT=&quot] with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using [/FONT][FONT=&quot][FONT=&quot]Check Disk (chkdsk) - Read Event Viewer Log[/FONT][/FONT][FONT=&quot].[/FONT][FONT=&quot]
[/FONT]
[FONT=&quot]I performed chkdsk as instructed. However, when checking the logs as described, [/FONT][FONT=&quot]FIND doesn’t work (grayed out). A manual investigation shows the following:[/FONT]
[FONT=&quot]13476 events from 4/13/2012 5:10PM to 5/5/2012 at 10AM[/FONT]
[FONT=&quot]ALL 13476 ARE THE SAME[/FONT]
[FONT=&quot]Source: Disk[/FONT]
[FONT=&quot]Event ID: 11 but when looking at the details I found 3 types:[/FONT]
[FONT=&quot]The driver detected a controller error on \Device\Harddisk1\DR1.[/FONT]
[FONT=&quot]The driver detected a controller error on \Device\Harddisk2\DR2.[/FONT]
[FONT=&quot]The driver detected a controller error on \Device\Harddisk5\DR5.[/FONT]
[FONT=&quot]Each type is reported consistently for several days.[/FONT]
[FONT=&quot]The following is interesting:[/FONT]
[FONT=&quot]Last timestamp for[/FONT]
[FONT=&quot]The driver detected a controller error on \Device\Harddisk5\DR5.[/FONT]
[FONT=&quot]is 5/4/2012 8:42:20 PM[/FONT]
[FONT=&quot]First timestamp for[/FONT]
[FONT=&quot]The driver detected a controller error on \Device\Harddisk1\DR1.[/FONT]
[FONT=&quot]Is 5/5/2012 12:38:26 AM[/FONT]
[FONT=&quot]The interesting thing is that Chkdsk performed between these times (5/4/2012 8:42:20 PM 5/5/2012 12:38:26 AM)[/FONT]
[FONT=&quot]For any drives that do not give the message:
Windows has checked the file system and found no problems
run disk check again as above. In other words, if it says:
Windows has made corrections to the file system
after running the disk check, run the disk check again.[/FONT]
[FONT=&quot]
6. Run [/FONT][FONT=&quot][FONT=&quot]SFC /SCANNOW Command - System File Checker[/FONT][/FONT][FONT=&quot] up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations. Use OPTION THREE of [/FONT][FONT=&quot][FONT=&quot]SFC /SCANNOW Command - System File Checker[/FONT][/FONT][FONT=&quot] to provide us with the sfcdetails.txt file if errors occur.[/FONT]
[FONT=&quot]
7.You also have event ID 4107 in your errors. See [/FONT][FONT=&quot][FONT=&quot]Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server[/FONT][/FONT][FONT=&quot] to resolve that error.[/FONT]

[FONT=&quot]Done

[/FONT][FONT=&quot]Again, many thanks for all the help.
[/FONT]

 

[drdigital1]

Correction

[FONT=&quot]
[/FONT][FONT=&quot]5. Run [/FONT][FONT=&quot][FONT=&quot]Disk Check[/FONT][/FONT][FONT=&quot] with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using [/FONT][FONT=&quot][FONT=&quot]Check Disk (chkdsk) - Read Event Viewer Log[/FONT][/FONT][FONT=&quot].[/FONT][FONT=&quot]
[/FONT]
[FONT=&quot]I performed chkdsk as instructed. However, when checking the logs as described, [/FONT][FONT=&quot]FIND doesn’t work (grayed out). A manual investigation shows the following:[/FONT]
[FONT=&quot]13476 events from 4/13/2012 5:10PM to 5/5/2012 at 10AM[/FONT]
[FONT=&quot]ALL 13476 ARE THE SAME[/FONT]
[FONT=&quot]Source: Disk[/FONT]
[FONT=&quot]Event ID: 11 but when looking at the details I found 3 types:[/FONT]
[FONT=&quot]The driver detected a controller error on \Device\Harddisk1\DR1.[/FONT]
[FONT=&quot]The driver detected a controller error on \Device\Harddisk2\DR2.[/FONT]
[FONT=&quot]The driver detected a controller error on \Device\Harddisk5\DR5.[/FONT]
[FONT=&quot]Each type is reported consistently for several days.[/FONT]
[FONT=&quot].
[/FONT]

[FONT=&quot]The comments made in item 5 are because I looked at Custom Views/Administrative Events instead of looking at Windows Logs/Application as instructed. Sorry about that. Once I did that, I found the summary of the chkdsk run last night (source was wininit as chkdsk was done through restart) and it says Windows has checked the file system and found no problems[/FONT]
[FONT=&quot]I will run another chkdsk tonight.[/FONT]

 

[writhziden]

In addition to the above, please take a screenshot of Disk Management. Start Menu -> Right click Computer -> Manage -> Disk Management (from the list on the left)

http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

Did you have a chance to run SFC /SCANNOW?

 

[drdigital1]

[FONT=&quot]Thanks again for all the help![/FONT]
[FONT=&quot]Screenshots requested enclosed[/FONT]
[FONT=&quot]Yes, I ran SFC /SCANNOW both yesterday and today with the same result: Verification 100%. Windows Resource Protection did not find any integrity violations[/FONT]
[FONT=&quot]I also ran chkdsk again last night with the same result: Windows has checked the file system and found no problems[/FONT]
[FONT=&quot]I am enclosing the latest Error Event Log as you instructed me earlier[/FONT]
[FONT=&quot]1. In addition to the errors of type [/FONT]
[FONT=&quot]Source: Disk[/FONT][FONT=&quot]
Event ID: 11
The driver detected a controller error on \Device\Harddisk1\DR1 or 2 etc[/FONT]
[FONT=&quot]2. I have a lot of VSS errors[/FONT]
[FONT=&quot]3. I still have some event ID 4107 (CAPI2) errors even though I followed the recommendations at Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server to resolve.[/FONT]
[FONT=&quot]Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.[/FONT]
[FONT=&quot]4. You wrote earlier[/FONT]
[FONT=&quot]Are you hard disk controller drivers up to date? If they are, they may be corrupted and in need of an uninstall and re-install. If you fill in your system specs on your profile (not in a post in this thread), we will be able to help you find the proper drivers. System Info - See Your System Specs can help with filling in the system specs.[/FONT]
[FONT=&quot]With so many controller errors (one every few seconds!) shouldn’t I do this? If you think so, can you provide some guidance, please?

Any other suggestions?
[/FONT]

 

[writhziden]

Hard disk 5 is one of your hidden Removable disks, from the looks of it. That was my suspicion all along. Let's see if uninstalling and re-installing the controllers helps:

• Download the controller drivers from Original Intel SATA Controller Driver HP Pavilion Elite HPE-380t CTO Desktop PC - HP Customer Care (United States - English)
• Uninstall your Controller drivers through Device Manager.
  1. Log in as an administrative user
  2. Click Start Menu
  3. Click Control Panel
  4. Click Hardware and Sound
  5. Click Device Manager
  6. Expand IDE ATA/ATAPI Controllers
  7. Right click the each Controller
  8. Click Uninstall (do not hit OK yet)
  9. Put a tick in the box to Delete driver software for this device
  10. Click OK
  11. Restart your computer if asked
  12. Install the downloaded drivers (if Windows installed its own drivers, see how the system responds, and if the errors are gone, do not worry about installing the downloaded drivers from HP).

 

[drdigital1]

[FONT=&quot]Done. Windows installed a new driver as follows:[/FONT]
[FONT=&quot]Driver date: 1/15/2010[/FONT]
[FONT=&quot]Driver version: 9.5.7.1002[/FONT]
[FONT=&quot]This is the same version (but not the same date) as the driver on the HP site.[/FONT]
[FONT=&quot]The bad news is that the disk error EVENT ID 11 ([/FONT][FONT=&quot]The driver detected a controller error on \Device\Harddisk5\DR5[/FONT][FONT=&quot].) continues, and so does VSS error EVENT ID 12294
[/FONT]
[FONT=&quot](new event log file attached)[/FONT]


I really appreciate your continuous assistance. Thanks,

 

[writhziden]

What do you use for backing up your system? Do you have 3rd party backup software by any chance?


Also check Windows Backup and Restore: http://www.sevenforums.com/tutorials/648-restore-backup-user-system-files.html

Make sure you do not have a backup pending. The VSS errors indicate that the computer is trying to backup your computer files to a removable storage drive that is not connected.

 

[drdigital1]

Disk 5

...there is one thing which is different though. As you can see in the attached screen shot Disk 5 is now the USB-connected external drive. Could it be that the controller for the USB-connected hard drive is not the Intel one which I updated but a different (and corrupted/obsolete one)?

 

[drdigital1]

Making great progress

Make sure you do not have a backup pending. The VSS errors indicate that the computer is trying to backup your computer files to a removable storage drive that is not connected.

[FONT=&quot]I have 2 back up systems:[/FONT]
[FONT=&quot]Local: USB-connected Seagate (Drive L) Scheduled daily at noon. No back-up pending.[/FONT]
[FONT=&quot]On-line: Crashplan. Just checked the logs and there are some files not being backed-up which causes the back-up process to re-start every few minutes. Last bad back-up was at 4:37PM. Once I cleaned the files up (bad file types, etc), the following back up attempt was completed successfully and now there are no pending back ups. To my pleasant surprise, the following is showing in the event logs:[/FONT]
[FONT=&quot]Last VSS error (EVENT ID 12294 ) at 4:37PM[/FONT]
[FONT=&quot]At 4:40PM VSS Information (EVENT ID 8224): The VSS service is shutting down due to idle timeout.[/FONT]
[FONT=&quot]And 2 hours later, still no VSS errors since[/FONT]
[FONT=&quot]Also, at 4:37PM last Disk error (EVENT ID 11: The driver detected a controller error on \Device\Harddisk5\DR5[/FONT]
[FONT=&quot]And 2 hours later, still no Disk errors since[/FONT]
[FONT=&quot]
Question 1: While this is great news (in addition to no more BSOD events), I am puzzled by the following: the Disk errors (EVENT ID 11) say The driver detected a controller error on \Device\Harddisk5\DR5[/FONT]
[FONT=&quot]Harddisk5 is an external USB hard drive which is NOT backed-up on line to Crashplan server. Does it make sense that this error would go away when the pending on-line backups to Crashplan stopped?[/FONT]
[FONT=&quot]
Question 2: the only errors since 4:37PM are 2 CAPI2 errors (EVENT IT 4107) even though I followed the recommendations at Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server to resolve. I used the “Fix It” method (Microsoft Fix it 50531). Could it be that the "Fix It" method didn’t work and that I should try the alternative manual method described?
[/FONT]
[FONT=&quot]Question 3: I continue to have the problem which I mentioned at the beginning of this thread i.[/FONT]
[FONT=&quot]During my debugging efforts I also ran System Health Report. I always get ONE error as follows:[/FONT][FONT=&quot]
Symptom: A service is reported as having an unexpected error code
Cause: One or more services has failed. The service did not stop gracefully, suggesting the service may have crashed or one of its components stopped in an unsupported way.
Details: Service exited with code not equal to 0 or 1077
If I double-click on “A service is reported as having an unexpected error code” I get the following:
Abnormally Stopped System Services
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

Any suggestion on how to handle?[/FONT]


[FONT=&quot]Thanks again for the patience and for the very effective guidance,
[/FONT]

 

[writhziden]

Alright, now that we have cleaned up the controller errors, we can proceed with the other error. I was hoping the controller errors were related, but evidently not.

I have 2 back up systems:
Local: USB-connected Seagate (Drive L) Scheduled daily at noon. No back-up pending.

Pay close attention to whether the controller error occurs only when the USB drive is not plugged in. My guess is, your system is trying to access the USB drive through the hidden removable disk, does not find the drive, but finds the hidden removable disk instead, and throws a controller error.

It may also be that despite you not having the drive backing up online, Windows was using the drive as a resource for the VSS operation.

Both of the above are just hypotheses, so you will have to determine which is most likely by monitoring for a few days.

On-line: Crashplan. Just checked the logs and there are some files not being backed-up which causes the back-up process to re-start every few minutes. Last bad back-up was at 4:37PM. Once I cleaned the files up (bad file types, etc), the following back up attempt was completed successfully and now there are no pending back ups. To my pleasant surprise, the following is showing in the event logs:
Last VSS error (EVENT ID 12294 ) at 4:37PM
At 4:40PM VSS Information (EVENT ID 8224): The VSS service is shutting down due to idle timeout.
And 2 hours later, still no VSS errors since
Also, at 4:37PM last Disk error (EVENT ID 11: The driver detected a controller error on \Device\Harddisk5\DR5
And 2 hours later, still no Disk errors since

All great news (as you say)!

Question 1: While this is great news (in addition to no more BSOD events), I am puzzled by the following: the Disk errors (EVENT ID 11) say The driver detected a controller error on \Device\Harddisk5\DR5
Harddisk5 is an external USB hard drive which is NOT backed-up on line to Crashplan server. Does it make sense that this error would go away when the pending on-line backups to Crashplan stopped?

See above for my hypotheses on this.

Question 2: the only errors since 4:37PM are 2 CAPI2 errors (EVENT IT 4107) even though I followed the recommendations at Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server to resolve. I used the “Fix It” method (Microsoft Fix it 50531). Could it be that the "Fix It" method didn’t work and that I should try the alternative manual method described?

It could be the Fix It did not stick. You could try it again. If it still does not resolve the error, try the manual method.

Question 3: I continue to have the problem which I mentioned at the beginning of this thread i.
During my debugging efforts I also ran System Health Report. I always get ONE error as follows:
Symptom: A service is reported as having an unexpected error code
Cause: One or more services has failed. The service did not stop gracefully, suggesting the service may have crashed or one of its components stopped in an unsupported way.
Details: Service exited with code not equal to 0 or 1077
If I double-click on “A service is reported as having an unexpected error code” I get the following:
Abnormally Stopped System Services
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

Any suggestion on how to handle?

I am unable to find anything in your error logs regarding svchost.exe or Abnormally Stopped System Services. The only service issues I see are Volume Shadow Copy Service (VSS) and Bonjour (you may want to read through Removing and reinstalling iTunes, QuickTime, and other software components for Windows Vista or Windows 7 and make sure to uninstall in the correct order or it may cause further problems with the Apple software). Anyway, I do not think the error you mention is critical since it is not mentioned in the administrative logs. If you are concerned, you can upload the perfmon report as in the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html (we do not need the jcgriff2 report in this case, just the perfmon html file compressed/zipped and uploaded).

[FONT=&quot]Thanks again for the patience and for the very effective guidance,
[/FONT]

You're welcome.

 

[drdigital1]

[FONT=&quot]While a little confusing as to why, the bottom line is that I have no more disk errors (EVENT ID 11) at all (6+ hours!), while before I used to have them every few seconds[/FONT]
[FONT=&quot]VSS errors still happen sometimes but in a short burst that disappears right away; when comparing event log timestamps, I found out that VSS errors coincide with backup to Crashplan server. Once the backup completes successfully, VSS errors stop.[/FONT]
[FONT=&quot]CAPI2 errors (EVENT IT 4107) - the “FixIt” method (Microsoft Fix it 50531) described at Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server didn’t stick. So I tried the manual method described and the errors continued. I’ll keep looking at this.[/FONT]
[FONT=&quot]And now to the last one:[/FONT]
[FONT=&quot]Abnormally Stopped System Services[/FONT][FONT=&quot]
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted[/FONT]

If you are concerned, you can upload the perfmon report as in the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html (we do not need the jcgriff2 report in this case, just the perfmon html file compressed/zipped and uploaded).

[FONT=&quot]You will find the report enclosed[/FONT]

 

[writhziden]

Alright, I've done a little more research into your problem. I suspect that the abnormally stopped system service is the result of a third party program. Go through the steps to http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html and see if the abnormally stopped system service still exists after a clean startup.

 

[drdigital1]

Declaring Victory!

[FONT=&quot]I think it’s time to declare victory.[/FONT]
[FONT=&quot]1. All the major problems have been addressed successfully (BSOD, disk errors, VSS errors)[/FONT]
[FONT=&quot]2. The remaining 2 problems i.e., the [/FONT][FONT=&quot]Abnormally Stopped System Service[/FONT][FONT=&quot] (see P.S. below) and CAPI2 errors EVENT ID 4107 don’t seem to have any bad effects and seem very widespread as lots of people on the Internet are complaining about these.[/FONT]
[FONT=&quot]So, [/FONT]writhziden[FONT=&quot] I want to thank you again for your infinite knowledge, patience and kindness; you are awesome![/FONT]
[FONT=&quot]P.S. the problem happens even with all non-Microsoft services disabled.[/FONT]

 

[writhziden]

[FONT=&quot]I think it’s time to declare victory.[/FONT]
[FONT=&quot]1. All the major problems have been addressed successfully (BSOD, disk errors, VSS errors)[/FONT]
[FONT=&quot]2. The remaining 2 problems i.e., the [/FONT][FONT=&quot]Abnormally Stopped System Service[/FONT][FONT=&quot] (see P.S. below) and CAPI2 errors EVENT ID 4107 don’t seem to have any bad effects and seem very widespread as lots of people on the Internet are complaining about these.[/FONT]
[FONT=&quot]So, [/FONT]writhziden[FONT=&quot] I want to thank you again for your infinite knowledge, patience and kindness; you are awesome![/FONT]
[FONT=&quot]P.S. the problem happens even with all non-Microsoft services disabled.[/FONT]

You're welcome. Just be forewarned: I did notice one other possible cause of the abnormally stopped system service error; some have said it may be virus/malware related. You should scan your system for these. http://www.sevenforums.com/system-s...-system-security-combination.html#post1732627 may help in that regard. Malwarebytes and SuperAntiSpyware both are good at catching things antivirus software might miss. Careful for any false positives, though.