BSOD 1E on shutdown

[cormanaz]

So lately I have been plagued with BSOD errors. I've been researching the issue and trying things, and have done the following:

• Run memtest86+ for 12 hrs, everything OK
• Run the Windows memory checker, everything OK
• Run run CHKDSK, everything OK
• Run SFC and repaired a few corrupt files
• Updated all outdated drivers
• Flashed to latest BIOS
• Removed Windows coupon app and Yahoo! Detect key from registry on advice of Kaspersky support
• Uninstalled and resinstalled Kaspersky Internet Security on advice of Kaspersky support (some of the earlier BSOD crashes were flagging a Kaspersky driver).

Now, I am getting BSOD 1E on shutdown (don't know yet if I'm still getting them in normal operation). Values after the error key are 0xFF...C0000005, 0xFFFFF80003576C9A, 0x00....0, 0x00...4E.



Oddly enough, it says its writing the dumpfile to disk, but when I reboot there is no minidump or full dump where it should be. Sysinfo gathered per forum instructions attached. What to do?

 

[Laith]

Hey! It seems like you don't have dumps enabled. Enable dumps.

http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html

 

[cormanaz]

I double checked, and I do have crash reporting enabled. See attached screenshot. I tried changing the option to kernel dump, and on the BSOD it said it was writing the file, but when I restarted, no dump file. I have verified that I have > 200 gb disk space, and an 8 gb page file, so that is not what's preventing the dump.

 

[cormanaz]

BTW, the crash now consistently happens on shudown, very last thing. I had hoped they had disappeared during normal operation, but alas I got a crash today while the thing was sitting idle when I wasn't around. One thing I have noticed is that it seems more likely when I have Cisco AnyConntect VPN conntected, and a network drive mapped, but I can't be sure that isn't a coincidence.

 

[Laith]

Run SeaTools. http://www.sevenforums.com/tutorials/313457-seatools-dos-windows-how-use.html

 

[cormanaz]

Since I have a WD HDD, I ran Data Lifeguard instead (does the same thing). Both short and long scans report no errors.

 

[Laith]

Try SeaTools, i know you have a WD but SeaTools gives an much more better scan. Use SeaTools.

 

[cormanaz]

Short and long tests on Sea Tools passed.

 

[Laith]

Hm, run MemTest86+ http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

 

[cormanaz]

As noted in the original post above, I have already done that. 12+ hrs, no errors.

Have also updated bios and all old drivers. It was after this that it stopped logging crashes, and began crashing on shutdown.

 

[Laith]

Hm, this helped alot. Run Driver Verifier for 24 hours.
http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

 

[cormanaz]

So here is something else that might be relevant, since you seem to think this is a disk problem. I initially set up this system with a RAID 0. One of the drives degraded and I decided not to replace it since that would require imaging the remaining drive, removing the RAID, and restoring the single drive. Before these driver/BIOS updates, I received a message on boot from the RAID controller about the degraded drive. After the updates, I no longer get this message. Maybe this is a clue?

Also I don't know if this is related or relevant, but I was looking at the system log and found an error event ID 36, volsnap, "The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit." This was not associated with a crash, but AFAIK I haven't placed any limit on shadow copy. Don't know if it's relevant, but something else disk related.

 

[Laith]

Hmm, i think you've got a failing drive there but i'm not quite sure. Set the controller to IDE and see if that works.

 

[cormanaz]

Re driver verifier, I will do that, but if dump files aren't being written how will I know what the bad driver is?

 

[Laith]

Snap a picture.

 

[cormanaz]

OK well this got some action. Set up driver verifier, and changed the HDD to IDE. On reboot, Windows went into system restore. When that finished, I checked TweakBit driver updater, and it lists an outdated driver for Standard Dual Channel IDE Controller. Outdated driver is 6.1.7601.18231 dated 6/21/06 from Microsoft, and available new driver is 9.1.9.1005 dated 7/25/13 from Intel. Moreover it lists this driver twice (see screenshot). Device manager lists two copies of the driver too.

Couple other things. Before, when I set the drive to IDE mode, I would get a DOS-mode dialog (I don't know if from Windows or bios) saying I have a SATA drive in IDE mode and offering to change it to AHCI. I'm not getting that anymore.

Also, the icon for Intel Rapid Storage technology on the taskbar has ! and hovering says the service is not running. When I try to open it, I get an error IAStorUI is not working. I think this could be due to having the drive in IDE mode, tho.

I checked and I am still getting the same BSOD on shutdown, and no log file.

 

[Laith]

I haven't thought of that. Remove Intel Rapid Storage technology and set the drive to AHCI.

 

[cormanaz]

Are you certain it's safe to remove RST given that I have a RAID still configured on the system?

No errors, BTW, with driver verifier running. I assume it's safe to turn that off...

 

[Laith]

Good turn off DV. Yea remove RST.

 

[cormanaz]

Alright I removed RST. On reboot it installed SATA ACHI drivers. Tweakbit no longer reporting out of date drivers. Still getting 1E on shutdown. Says it completed dump, but still no dump file. Tried changing dump file location just for fun, no help.

I went to disable verifier. When I followed the instructions the last dialog that popped up said something like "no changes made to settings." So again following instructions I went into safe mode to disable it (got the same message; BTW when I restarted I did not get the BSOD on shutdown from safe mode). Anyway went back to enable verifier again to make sure I got it running. Followed instructions again, but after reboot I don't see a process for it on process explorer. Should there be one?