Solved BSOD Error 0xF4 CRITICAL_OBJECT_TERMINATION 1 hour after cold boot

[Sidio47]

Hello, and thanks in advance. I am working remotely with a computer owned by a family member of mine.

The computer is running:
- Windows 7 Professional 64-bit
- System was built by me in the past
- This version of windows comes free via the MSDN where I am a student (so full retail I think)
- The system was built in May, 2011
- The OS has been maintained since then on its SSD

Seemingly, almost like clockwork, the computer is slowly freezing up until a BSOD 0xF4 appears for 100 seconds. The computer attempts to reboot and ends up on a black screen with a blinking cursor when it should be booting Windows. If a cold startup (hold power button, turn off, wait 10 sec, turn on) is done, windows boots up and it will function fine for right about one hour.

From there, I'll let the ZIP file do the talking for me.

Much appreciated for any time and effort you all can give.

 

[writhziden]

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Sidio47\Windows_NT6_BSOD_jcgriff2\011712-23665-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c1a000 PsLoadedModuleList = 0xfffff800`02e5f670
Debug session time: Tue Jan 17 15:33:41.818 2012 (UTC - 7:00)
System Uptime: 0 days 1:04:30.551
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa800e5fa910, fffffa800e5fabf0, fffff80002f9a8b0}

Probably caused by : wininit.exe

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa800e5fa910, Terminating object
Arg3: fffffa800e5fabf0, Process image file name
Arg4: fffff80002f9a8b0, Explanatory message (ascii)

Debugging Details:
------------------


PROCESS_OBJECT: fffffa800e5fa910

IMAGE_NAME:  wininit.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: wininit

FAULTING_MODULE: 0000000000000000 

PROCESS_NAME:  wininit.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

BUGCHECK_STR:  0xF4_IOERR

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`023d6b08 fffff800`030215e2 : 00000000`000000f4 00000000`00000003 fffffa80`0e5fa910 fffffa80`0e5fabf0 : nt!KeBugCheckEx
fffff880`023d6b10 fffff800`02fce99b : ffffffff`ffffffff fffffa80`0eab5b60 fffffa80`0e5fa910 fffffa80`0e5fa910 : nt!PspCatchCriticalBreak+0x92
fffff880`023d6b50 fffff800`02f4e448 : ffffffff`ffffffff 00000000`00000001 fffffa80`0e5fa910 0000007f`00000008 : nt! ?? ::NNGAKEGL::`string'+0x176d6
fffff880`023d6ba0 fffff800`02c95ed3 : fffffa80`0e5fa910 00000000`c0000006 fffffa80`0eab5b60 00000000`00000026 : nt!NtTerminateProcess+0xf4
fffff880`023d6c20 00000000`770215da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02aeff48 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770215da


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0xF4_IOERR_IMAGE_wininit.exe

BUCKET_ID:  X64_0xF4_IOERR_IMAGE_wininit.exe

Followup: MachineOwner
---------

If you are overclocking anything, please stop.
A windows system process was terminated unexpectedly. Do the following steps.

• Update all drivers that you are able to. If you need help finding a driver, let us know.
  
  
  You may use the following sites as references for finding drivers. We recommend finding the manufacturer of the driver and downloading drivers directly from the manufacturer or software developer. If you have trouble finding a driver or driver manufacturer, let us know and we will do our best to assist you. If you need help, please provide the device name, manufacturer, and the driver .sys file that you are looking for.
  

  1. Driver Reference is a good site to find the driver .sys files, their descriptions, and the site most likely to contain an update.
  2. Driver Search Methods provides driver manufacturers and links to their homepages.

  There are a few methods for updating drivers.
  

  1. http://www.sevenforums.com/tutorials/43216-installing-updating-drivers-7-a.html
  2. http://www.sevenforums.com/tutorials/99402-driver-install-add-hardware-wizard.html
  3. http://www.sevenforums.com/tutorials/97061-driver-install-device-manager.html

  
  To fully re-install a driver, use the following steps.
  

  1. Click Start Menu
  2. Right Click My Computer/Computer
  3. Click Manage
  4. Click Device Manager from the list on the left
  5. Find the device you are trying to uninstall by expanding the appropriate set of devices
  6. Right click the device
  7. Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
  8. Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
  9. Restart your computer
  10. Install the latest driver for the device once Windows starts.

  
  Alternatively:
  

  1. Login as an adminstrative user.
  2. Click Start Menu
  3. Click Control Panel
  4. Click Hardware and Sound
  5. Click Device Manager (the last link under Devices and Printers)
  6. Find the device you are trying to uninstall by expanding the appropriate set of devices
  7. Right click the device
  8. Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
  9. Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
  10. Restart your computer
  11. Install the latest driver for the device once Windows starts.
• Run Windows Update and install all updates.
• Check for viruses.
  
  Download and install the free version of Malwarebytes : Free anti-malware, anti-virus and spyware removal download (do not start the trial) and make sure it is updated. Do not run a scan yet.
  Download VIPRE Rescue - VIPRE Computer Recovery Solution from Sunbelt Software but do not unzip it yet
  Download the Fakerean removal tool but do not run it yet.
  Start your computer in http://www.sevenforums.com/tutorials/69585-safe-mode.html
  Unzip VIPRE Rescue and let it run.
  Run a full scan with Malwarebytes.
  Run the fakerean removal tool.​
• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html
• Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors. Post back if it continues to show errors after the third run or if the first run comes back with no integrity violations.

Thanks to Dave76 for help understanding possible causes.

 

[Sidio47]

writhziden, thanks for the reply. I will post when I have the results.

 

[writhziden]

Have you had any more crashes? Did you follow all the steps?

 

[Sidio47]

writhziden,

Many thanks for the followup! As I mentioned previously, I've been working with the machine remotely. I ran into difficulties continuing remotely, so the computer owner and I have agreed to postpone the diagnosis until later in February. They have another machine so it hasn't been critical. Nevertheless, I will get around to it and I will be back with the reports!

Thanks again!

 

[writhziden]

You're welcome. Sounds like a good plan. Thanks for the update.

 

[Sidio47]

I have been able to run the tests on the computer in question.
Keeping in mind that there is usually a time window of 1 hour before the computer locks up some of the tests were not able to finish. I did observe some interesting behavior which I'll explain below:

1.) All the drivers I could find were updated.
2.) Microsoft update was run.
3.) Malwarebytes, VIPRE Rescue and Fakerean were downloaded and Malewarebytes installed.
4.) In safe mode VIPRE Rescue was run. There are two drives: one 64 GB SSD with Windows 7 (C:\ Drive) and one RAID 5 array with four disks (E:\ Drive). VIPRE was able to get to the point that it was scanning the E:\ drive. It continued for at least 2 hours (longer than I've seen the computer go w/out a crash). Windows came up with an error though saying "The instruction at 0x000000007777FD94 referenced memory at 0x000000000009DFSC. The required data was not placed into memory because of an I/O error status of 0xc000000e. Click okay to terminate the program." In the command prompt, the scan had failed. I went to go to the start menu in safe mode and as soon as the start menu popped up it locked and gave a similar message for explorer.exe. After that, explorer closed and the system was non-responsive.
5.) Did the full scan of Malewarebytes. It found one file, a dynamic link library used by winamp to convert files to shn format. Just to be safe, I had the system successfully quarantine and delete the dll. The computer owner said that they could restore the dll if need be later.
6.) Ran Fakerean removal tool once.
7.) Ran disk check on the boot SSD (C:\) with no errors (finished in < 1 hour)
8.) Ran disk check on the RAID 5 array. It continued to the point that it said everything was clear and then it froze. I did a cold boot and the system acted as if the disk check was still scheduled (and, of course, it did not show up in the event viewer).
9.) Ran sfc /scannow once and received "Window Resource Protection did not find any integrity violations."

So, I have some thoughts but most evidence seem circumstantial. For now, I'll keep my mouth shut and see what you all think the best course of action is from here.

Also, I have some hardware components on hand to swap out pieces of the fritzy computer if need be. I'm getting ready to build a similar system though not all components are the same (mobo is different and I don't have a spare SSD but I do have spare spin up drives).

 

[writhziden]

It sounds like the RAID array is corrupted or a drive within the array is failing. I would recommend backing up the data or even better would be creating a system image, and resetting the array. Then restore the system image or do a clean install of Windows. We see a lot of RAID related problems on these forums. In fact, I have a site bookmarked for a reason regarding these: Why RAID is (usually) a Terrible Idea - Puget Custom Computers

 

[Sidio47]

I have a system image that I created when I built the system. I put in the system recovery disk (that I also made) and rebooted. All extra cables are removed (except keyboard /mouse / Ethernet / monitor / power). When I reboot, I change the boot order to the DVD drive and it just sits with a black screen and a white blinking cursor. The drive works fine in windows. I then tried with an external USB DVD drive and the same thing happened. I take the same recovery disk and boot off it with my laptop and it shows up fine.

 

[Sidio47]

Another line of thought:
Could I physically disconnect the RAID array (SATA cables and power); make sure bios is then set properly (to have no RAID devices); boot up the system on the SSD and wait the typical hour to see if the system indeed freezes up? If it did have something specifically to do with the RAID would this not take it out of the equation so to speak? Would I have any problems hooking the RAID up later and still having access to the data?

Could I not do the same thing with the SSD? Take it completely out of the computer; hook up just a regular spin up drive; restore the image to this new drive and see if the system freezes?

 

[writhziden]

I have a system image that I created when I built the system. I put in the system recovery disk (that I also made) and rebooted. All extra cables are removed (except keyboard /mouse / Ethernet / monitor / power). When I reboot, I change the boot order to the DVD drive and it just sits with a black screen and a white blinking cursor. The drive works fine in windows. I then tried with an external USB DVD drive and the same thing happened. I take the same recovery disk and boot off it with my laptop and it shows up fine.

Do the following steps and see if you can then boot from the DVD.

1. Shut down and turn off the computer.
2. Unplug the computer from the wall or surge protector (then remove the battery if it is a laptop).
3. Hold down the power button for 30 seconds. This closes the circuit and ensures all power from components is drained to clear the software connections between the BIOS and hardware and clear any corruption in the temporary memory.
4. (If it is a laptop, plug the battery back into the laptop and then) Plug the computer back into the wall.
5. Turn it on to reinitialize the software connections between the BIOS and hardware, and post back your results.

Another line of thought:
Could I physically disconnect the RAID array (SATA cables and power); make sure bios is then set properly (to have no RAID devices); boot up the system on the SSD and wait the typical hour to see if the system indeed freezes up? If it did have something specifically to do with the RAID would this not take it out of the equation so to speak? Would I have any problems hooking the RAID up later and still having access to the data?

Could I not do the same thing with the SSD? Take it completely out of the computer; hook up just a regular spin up drive; restore the image to this new drive and see if the system freezes?

Yes, these are all good troubleshooting steps. Make sure you backup your important data in case the RAID re-initialization fails, though. It would even be prudent to backup anything important from the SSD even though you are not too likely to lose that data.

In short, those steps are good steps to take to narrow the problem down.

 

[Sidio47]

I unplugged, held down power button for 30+ seconds, booted using the F8 boot menu to DVD -> black screen with blinking cursor. It seems there is no light up from the SATA DVD drive LED.

I changed boot priority to the DVD drive in BIOS; saved and exited.
I unplugged, held down power button for 30+ sec, booted with no intervention -> black screen with blinking cursor; i.e. it never moved on to the SSD as if the DVD drive was "doing" something.


I will discuss backup options with the owner and prepare to physically remove the RAID array first.

 

[writhziden]

Could be the BIOS needs to be reset to defaults to clear the CMOS, but that will reset the RAID, which is why I did not recommend it.

 

[Sidio47]

I turned off the machine, removed the HDD's associated with the RAID array completely, reset CMOS via popping the jumper, booted up and setup basic BIOS settings. I set the DVD drive as first in priority and it was able to boot off the Windows recovery disk. I changed the boot priority back to the SSD and I'm waiting for the 1 hour mark to come as I type.

 

[Sidio47]

Well, even though I did not see it directly (I was out of the room) I believe it blue screened again. Typically, the system will stay on from cold startup for 1 hour, lock up over a few minutes, blue screen, count down 100 seconds and restart.

I found the system on the Windows System Recovery screen from the DVD drive. Now, BIOS is set such that the SDD with Windows 7 is booting first and DVD drive second. I canceled the recovery and it prompted to restart. I restarted and the startup screens were very sluggish. I entered BIOS to find that the SSD was not detected in the SATA 5 port where it lives. I confirmed the boot order (which now had "hard drive" instead of the M4-**** typical tag) as SSD then DVD. I exited BIOS and it went to a black screen with blinking cursor. This time, though, it picked up and started booting the DVD drive since it couldn't do anything with the SSD. I did a hard shutdown (holding power button for 5 seconds). I then started up again and went straight to BIOS. The SSD was back, as normal, in the SATA 5 slot. I exited and windows started as normal.

I'll let others suggest what it might be without me influencing the decision.

 

[writhziden]

We have seen many problems due to SSDs on these forums, as well. usasma has a QUOTE he uses anytime SSD BSODs result. The quote and what usasma recommends can be found in post #2 of BSOD playing Battlefield 3, just got a new SSD is that the problem ?.

 

[Sidio47]

Interesting...

It just so happens that there is a Marvel 91xx controller for eSATA drives (this is how the RAID is backed up). So, I will take this controller card out first, start up and wait the 1 hour to see if a blue screen appears.

 

[writhziden]

Best of luck!

 

[Sidio47]

Well with the Rosewill RC-226 eSATA controller card out of the motherboard, the system still tanked. I have now taken out the SSD and have replaced it with a 500 GB WD Caviar Black 7200 rpm drive. I am currently loading a windows recovery image onto the new spin up drive. Once that is done, I'll boot up cold and wait an hour to see what happens. writhziden, thanks for the support.

 

[writhziden]

You're welcome. Look forward to hearing back how the HDD does. At least these steps will narrow down possible hardware issues.