BSOD starting Windows Backup w/2 active "users"

[billm5]

Noteworthy context information: Win7 laptop, stable for a l-o-n-g time...

Two sessions were running (logged-in as two different users, via the "Switch user" option ... because I needed to finish up some work on the web, while the backup ran). I knew this was slightly risky, but never anticipated a BSOD.

First session was a web browser, logged-into the pc as a non-Admin user; second session was Admin, intending to start Windows Backup; BSOD within seconds of starting BACKUP.

ZIP uploaded. System has seemed stable, as usual, since the event (2.5+ days now) ... but my BSODs have been so rare, I didn't want to ignore it.

 

[axe0]

Please try to upload the zip again, there is nothing attached in the post.

 

[billm5]

The site says the .ZIP attachment is there... and I noticed that it includes not one but *two* .dmp files... only the most-recent one (080116-23680-01) is germane. Without knowing what personal data or personally-identifiable data might be in the .DMPs, I'm hesitant to have them spreading around by uploading yet another copy.

 

[derekimo]

The info collected is for diagnostic purposes, there is no personal info.

What axe0 is talking about is some of the other files missing,

Your zip is missing a few items,

View attachment 390280

Compared to a full zip,

View attachment 390281

 

[billm5]

How odd; I simply followed the steps prescribed on your site... I'll investigate.

 

[billm5]

(axe0 reported there was *nothing* attached to the post... but, moving right along ...)

By eyeball comparison, I see the following 8 files are missing from the upload... and all but one of them don't exist on my hard drive:

These 7 don't exist:

msinfo32.nfo
Processlist.txt
startup.txt
systeminfo.txt
tasklist.txt
uninstall.txt
updatelog.txt

services.txt - exists, but has been changed since the BSOD

The missing ones are apparently missing because either
A. whatever step I executed, at your instruction, didn't create them... or,
B. I missed one or more steps that would have generated them.

Since we're now a few days "downstream" of the crash... is it meaningful, to attempt to re-create them now?

Am I guessing correctly that "dm_log_collector.exe" is what would have gathered these files, to be bundled and submitted to you?

Or was there some other script-like thing that played hunter/gatherer?

My hunch is that, since this is the first BSOD in some months, there's nothing more to be gained at this point from the available data... what do you think?

On the other hand, I have had two BSOD's in the past year. Is there something I should put in place to gather data, automagically, the next time one occurs?

Thanks for your advice!!

 

[derekimo]

They sometimes don't get created for one reason or another during the process of running the DM log collector, running it again usually gets them all.

Both of your dumps give me symbol errors, so they are not very useful, maybe someone else will get a different result.

If you want to wait and see if you have another BSOD that's certainly an option, I was mainly pointing out the difference in the contents to show you.

 

[axe0]

What axe0 is talking about is some of the other files missing

I really meant that I didn't see any attached file

 

[derekimo]

What axe0 is talking about is some of the other files missing

I really meant that I didn't see any attached file

Alright, nevermind then.

It's there now.

 

[axe0]

Please open an admin command prompt and copy/paste the following command

systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"

This command will create following files on the desktop

• systeminfo.txt,
• msinfo32.nfo,

Please zip them up and upload the zip.

 

[billm5]

One last try for this upload...

 

[axe0]

Another problem, the msinfo file is corrupt...
Can you open the msinfo.nfo file on your computer after creating one?

 

[billm5]

msinfo file

Sure can... ZIPped and attached

 

[axe0]

Unfortunately it is corrupted again for me.

Diagnostics Test

 System File Check

Please try following:

• Open an admin command prompt
• Copy/paste "sfc /scannow" (without quotes) and press enter
• When it is finished reboot your system
• Open again an admin command prompt
• Enter sfc/scannow again

If sfc/scannow says "Windows Resource Protection found corrupt files but was unable to fix some of them" after the second SFC, please upload the cbs.log file located at {windows partition}\Windows\Logs\CBS\, if the file is too large try a 3rd party uploader like dropbox, onedrive, google drive, mediafire etc.
System File Check(SFC a.k.a. Windows Resource Protection) needs to have your system rebooted in order for sfc to try to fix the problems that it finds.

Make a photo of the result and post it.

 

[billm5]

SFC

I ran SFC /SCANNOW within the last week (i.e., after the crash) and it came up clean. Is there any reason to suspect that today's run would be any different??

(By the way, all my messages in this thread have been entered from the machine which crashed, so we can safely say that it is de-facto working... and, for the record, my habit is to only run as Admin *when necessary,* following the principle of using "least necessary privileges" to minimize potential privilege-based disruptions.)

 

[axe0]

The usual thing is that many do not run sfc where sfc resolved the msinfo corruption after running it.

Has SFC been run since yesterday afternoon? Yesterday was the monthly patchday, many unfortunate users have sometimes problems with the updates.

 

[billm5]

No SFC hasn't been run since before yesterday afternoon... 'twas about a week ago, but Patch Tuesday is a non-issue: I turned off automatic Windows Update several months ago, because my laptop was quite stable and I was getting more undesirable stuff shoved down my pipe than I was willing to waste time on. So it's easier to pick-and-choose, pro-actively, the updates I -want- to apply. (hint, NOTHING related to WinX )

The only routine value I was getting from WinUpd was MSSE updates... but it turns out there's a three-click-and-a-filename method to download those daily. (Except on days when I never power-up the machine, of course but this tactic -does- do a full-download of the MSSE definitions, not just a differential... so I'm still well-covered.)

(Happy to provide the daily MSSE three-click-and-a-filename details if desired, but obviously should be a different thread.) I'll run another SFC /SCANNOW later, just for the halibut.

 

[axe0]

I would suggest that you install all available updates, it takes a single update missing to have problems.

 

[billm5]

Re-ran SFC /SCANNOW ... "Repairing 0 components" ... "Repair complete." ... looks clean to me. Attaching sfcdetails.txt, in case you see something I don't.

 

[billm5]

Ran SFC again (to satisfy your run-twice recommendation) ...
Results attached, but in a nutshell:

C:\Windows\system32>SFC /scannow
Beginning system scan. This process will take some time.
Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection did not find any integrity violations.
C:\Windows\system32>

The only distinction I see, is the first-run included "Repairing 0 components" ... "Repair complete" ... and the second did not.

Is that a distinction without a difference??