BSOD browsing web and hard drive

[Smeeth]

Hi there,

Many thanks in advance for taking a look at my situation. I think I'm starting to circle the drain and with my limited skill set, I think it's time to call in the cavalry.

Sudden BSODs have be plaguing me the last few days. Activities during the BSODs are pretty much browsing the web and dealing with files on the hard drive. I also do some work in Photoshop, geotag photos with the Microsoft tool, and play various video files.

The PC has started to lag, with the CPU jumping to 100% when it didn't "need" to do this previously.

I followed the directions for memory dumps and page file sizes, waited for another BSOD, ran the SF diagnostic tool, and attached a zipped file here. Incidentally, I peeked in some of the text files generated by the tool and noticed that EventSys.txt shows entries like:

Event[889]:
Log Name: System
Source: Disk
Date: 2013-06-24T06:58:27.041
Event ID: 11
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: MEGATRON
Description:
The driver detected a controller error on \Device\Harddisk6\DR6.

I mention this entry because the last two BSODs happened right when I right clicked the C drive to get into properties. I don't know if this references my C drive or not as I have a separate data disk in the box as well. A previous EventSys.txt showed similar entries, only referencing the page file in the description. Unfortunately I overwrote this file when I ran the diagnostic tool a second time. Perhaps my C drive is failing? Have not scanned the disk, awaiting a recommendation.

The first batch of BSODs made reference to "sasdifsv" and "saskutil", which I found out are files from Supersecret Anti Spyware. I removed this program and now the actual screen of the BSOD references timntr.sys, a file from Acronis, which doesn't show up in Add Remove Programs, so I can't uninstall it. Also, starting to feel like the problem is hopping around, perhaps because I'm not really addressing the root cause.

Please let me know if I need to do a better job of explaining my situation or if additional info is needed. I noticed that MEMORY.DMP is not gathered up by the diagnostic tool, probably a good thing as the file is now 8 GB in size. I attached a zipped copy here in case it is helpful. WinDbg suggests a problem with timntr.sys when it looks at this dump file.

Thanks in advance for the help!
David

 

[Smeeth]

MEMORY.DMP zipped is still huge, didn't upload it.

 

[Smeeth]

Ran chkdsk.exe from command prompt. No problem reported.

 

[Smeeth]

Recent BSOD screen shows "offending" driver as usbstor.sys. Still poking around for solutions. One source indicated that the right click context menu could be causing the BSODs, matches part of my problem since any right click of the C drive causes a BSOD. However, that's not the only way they happen. The one before last happened when I was out of the room.

 

[Smeeth]

Looks like too many of us with problems post here for the experts to respond

 

[koolkat77]

Welcome to Seven Forums and sorry for the delay in responding.

How old are the hard drives?

I took a look at the dumps without verifier enable. The bugchecks are F4, this is usually related to Hard Drive/ Storage device failures. As the first step, please take a back up of all your important files on another hard drive or an external one. Then proceed with these steps:

Safely disable and remove any external USB devices from your system.

Make scans with -

TDSSKiller Rootkit Removal Utility Free Download | Kaspersky Lab US

Online Virus Scanner Eset​

Upload a screenshot using:

CrystalDiskInfo​

:tip: For how to upload a screenshot or file, read here

Test your Hard Drive by running:

Hard Drive Diagnostic Procedure​

Use the System File Checker tool and Run Disk Check:

Repair Windows 7 System Files with System File Checker

Run Disk Check in Windows 7 for Bad Sectors & Errors​

```````````````
What antivirus software are you using? I don't seem to find one from your files.

Microsoft Security Essentials & the Free version of Malwarebytes, update and make full scans separately:

Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase

Microsoft Security Essentials - Microsoft Windows

Malwarebytes Free​

• :info: Do not start the trial version of MalwareBytes
  
  

You may also take a look at:

Good & Free System Security Combination​

.

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa8008bbd060, fffffa8008bbd340, fffff80002fdb350}

----- ETW minidump data unavailable-----
Probably caused by : csrss.exe

Followup: MachineOwner
---------

 

[Smeeth]

Thanks koolkat, I appreciate your input and will work on what you've outlined above and report back. I've already backed up my files...

 

[Smeeth]

I ran majorgeeks.com cleaning procedure as outlined here and came up clean:
Vista & Windows 7 Malware Removal/Cleaning Procedure - MajorGeeks Support Forums
I just installed Windows Security Essentials. I run Malwarebytes as needed.

 

[Smeeth]

Hi kookat.

Back in town, working on the BSOD issue. To my mind it appears that the hard drive might be going, but the results are mixed. Thanks for taking a peek at the result and for your expert advice.

Hard drives:
C - 3.5 years old.
D - Data drive, perhaps 4.5 years old.

TDSSKiller:
Ran about 10 days ago, no problems reported

Online Virus Scan Eset:
Ran today, 3 adware items, 1 Trojan, results attached.

CrystalDiskInfo screenshot:
Couldn't make one - software doesn't detect any hard drives. Tried re-scan, refresh but still no
drives. My drives show up in device manager as SCSI - software looks like it doesn't support SCSI -
could this be right? device manager screen shot attached.

Hard Drive Diagnostic Procedure:
Downloaded and ran SeaTools from boot CD for both Seagate hard drives. The short and long tests both
came up clean, yielding a "PASSED" status.

HP PC Doctor (accessed during computer boot):
BIOHD-4, uninitialized / corrupt boot structure detected. Searched this online and see references to making recovery disk - could this be worth the effort? I already have more time into this than it would take me to buy and load a new hard drive. PC Doctor has "repair computer" option, didn't yet run - awaiting recommendation.

Repair Windows 7 System Files with System File Checker:
System file checker "found corrupt files but was unable to fix some of them".

Disk Check for Bad Sectors and Errors:
chkdsk comes back clean when run from command prompt, but did find and fix free space marked as
allocated. However, cannot get into this tool in windows - right clicking C drive generates BSOD.

Antivirus:
Microsoft Security Essentials. However, and I suppose that this will sound reckless, I've been running
without anit-virus for quite a while until recently. My experience with antivirus software has been
fairly mixed, with many programs eating up system resources, going AWOL when least expected, etc. I
run Malwarebytes when suspicious and it has not found anything for a long time. At the beginning of
this problem, I downloaded and installed Microsoft Security Essentials, which has been running for the
last 3 weeks or so. At this point I am operating as suggested in the "Good and Free System Security
Combination" article.

Cheers,
David

 

[koolkat77]

I'd suggest you keep a back up of your stuff in an external HDD.
And, if you continue getting BSOD's, upload them for us for further analysis

 

[Smeeth]

One BSOD yesterday, two the day before that. Ran SF diagnostic tool again, attached results to this message.

 

[koolkat77]

Pretty straight forward with Driver Verifier - snapman.sys Acronis True Image Snapshot Manager driver also included in Seagate DiscWizard

Please uninstall the above software with Revo Uninstaller free, then disable verifier and observe for further BSOD's.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {f6, 444, fffffa800d31e060, fffff88001b00837}

*** WARNING: Unable to verify timestamp for snapman.sys
*** ERROR: Module load completed but symbols could not be loaded for snapman.sys
Probably caused by : snapman.sys ( snapman+21837 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_f6

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID: [U] VERIFIER_ENABLED_VISTA_MINIDUMP[/U]

PROCESS_NAME:  [U]DiscWizard.exe[/U]

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000314e4ec to fffff80002cc0c00

STACK_COMMAND:  kb

FOLLOWUP_IP: 
snapman+21837
fffff880`01b00837 3d230000c0      cmp     eax,0C0000023h

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  snapman+21837

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: snapman

IMAGE_NAME:  snapman.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  47453b95

FAILURE_BUCKET_ID:  X64_0xc4_f6_VRF_snapman+21837

BUCKET_ID:  X64_0xc4_f6_VRF_snapman+21837

Followup: MachineOwner
---------

2: kd> lmvm snapman
start             end                 module name
fffff880`01adf000 fffff880`01b1a000   snapman  T (no symbols)           
    Loaded symbol image file: snapman.sys
    Image path: \SystemRoot\system32\DRIVERS\snapman.sys
    Image name: snapman.sys
    Timestamp:        Thu Nov 22 14:19:33 2007 (47453B95)
    CheckSum:         00043F7B
    ImageSize:        0003B000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[Smeeth]

Hi koolkat,

Performed steps as you recommended and already computer is running better. Will keep you posted if BSODs continue.

Thanks for all your help!
David