BSOD when turning off the computer

[muzzz]

Well, just like in the title, the computer BSOD every time you turn it off, sleep does not cause a BSOD.
I've attached the debug zip to the post.
Help would be greatly appreciated.

 

[Gandalf]

Good news. All of your current dmp files point to the same thing. You have an IO Error. This means that the data can't be read from your HDD. Please run a HDD diagnostic tool to check your HDD. This tool would be HDD manufacturer specific.

 

[muzzz]

Good news. All of your current dmp files point to the same thing. You have an IO Error. This means that the data can't be read from your HDD. Please run a HDD diagnostic tool to check your HDD. This tool would be HDD manufacturer specific.

Thanks gandalf, i did an extended test to both my drives with "Data Lifeguard Diagnostic" from wd, also did a chkdsk for both, all the results were fine, with no problem at all.
what now?

 

[Gandalf]

We wait. You might have fixed the problem or it might happen again. If it does, send the dmp and I'll scratch my head for a while.

 

[muzzz]

Tried turning off the computer, and the BSOD came and slapped me across the face...
attaching the dmp file fresh from the oven, careful it's hot!

 

[Gandalf]

I've asked for assistance with this dmp. Nothing but the best for you Muzzz.

 

[Arc]

Hi muzzz.

Test the 250 GB WD Blue HDD using Data Lifeguard Diagnostic for Windows.

And, it is running off free space.

ITEM|VALUE
Drive | C:
Size | 232.88 GB (250,056,704,000 bytes)
Free Space | 3.08 GB (3,306,156,032 bytes)

Free up some space. Get at least 25 GB free.
http://www.sevenforums.com/tutorials/129976-hard-disk-space-free-up-recover.html

Report us back for any further BSOD after doing these two.
http://www.sevenforums.com/tutorials/819-hibernate-enable-disable.html

 

[Gandalf]

If you are saving video, music, and/or picture files. recommend you buy an external 1 TB USB HDD or bigger and move these files on to it. Here is a suggestion:
Western Digital My Passport for Mac USB 3 0 2TB External Hard Drive 0718037801131 | eBay

 

[Slartybart]

After following Arc's advice,

Is there a Windows.old on your C:\ drive?

Check that all cables are secure in the SATA ports - reseat if necessary
Which ports are you using?

Please post information about your drives so that a member can determine if there is a misconfiguration. Having this information also makes it easier to a discuss course of action.
See: http://www.sevenforums.com/tutorials/274797-disk-management-post-screen-capture-image.html

Please also follow this tutorial:
http://www.sevenforums.com/tutorials/92394-sf-diagnostic-tool-using-troubleshooting.html and attach the SF_DD_MM_YYYY zip folder to a new post on this thread.

Thanks

 

[muzzz]

Hi muzzz.

Test the 250 GB WD Blue HDD using Data Lifeguard Diagnostic for Windows.

And, it is running off free space.

ITEM|VALUE
Drive | C:
Size | 232.88 GB (250,056,704,000 bytes)
Free Space | 3.08 GB (3,306,156,032 bytes)

Free up some space. Get at least 25 GB free.
http://www.sevenforums.com/tutorials/129976-hard-disk-space-free-up-recover.html

Report us back for any further BSOD after doing these two.

i already scanned with this tool but i cleared about 50Gb and scanned again, it passed, but the BSOD persists...

After following Arc's advice,

Is there a Windows.old on your C:\ drive?

Check that all cables are secure in the SATA ports - reseat if necessary
Which ports are you using?

Please post information about your drives so that a member can determine if there is a misconfiguration. Having this information also makes it easier to a discuss course of action.
See: http://www.sevenforums.com/tutorials/274797-disk-management-post-screen-capture-image.html

Please also follow this tutorial:
http://www.sevenforums.com/tutorials/92394-sf-diagnostic-tool-using-troubleshooting.html and attach the SF_DD_MM_YYYY zip folder to a new post on this thread.

Thanks

no windows.old, sata ports are ok, im using 0,1, and 2.

 

[Arc]

The BSOD crash dump says:

BugCheck F4, {3, fffffa800ca96600, fffffa800ca968e0, fffff800035847b0}

----- ETW minidump data unavailable-----
[COLOR=Red]Probably caused by : lsass.exe[/COLOR]

Followup: MachineOwner
---------

The location of the file is ...

"c:\users\מחשב\appdata\local\[U][B]temp[/B][/U]\lsass.exe"

Download, Install and Run CCleaner, Temp will be cleaned.

But my question is ... what the programs are? They are auto-starting with windows.

• ef6805c25b5a2f877bc96e021971597e ef6805c25b5a2f877bc96e021971597e.exe ASAF\מחשב Startup
• ef6805c25b5a2f877bc96e021971597e "c:\users\מחשב\appdata\local\temp\lsass.exe" .. ASAF\מחשב HKU\S-1-5-21-3037542322-3080866099-3372102490-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Its a malware. And it is the source of the issue. It is faking itself as Local Security Authority Subsystem Service (LSASS).

Because lsass.exe is a crucial system file, its name is often faked by malware. The lsass.exe file used by Windows is located in the folder C:\Windows\System32. If it is running from any other location, that lsass.exe is most likely a virus, spyware, trojan or worm.

• Source: http://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service

Scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Daemon Tools, Alcohol 120% and Power Archiver Pro uses SCSI Pass Through Direct (SPTD), which is a well known BSOD causer. Uninstall Daemon Tools at first. Then download SPTD standalone installer from Disk-Tools.com, and execute the downloaded file as guided below :

• Double click to open it.
• Click this button only:
• 
• If it is grayed out, as in the picture, there is no more SPTD in your system, and you just close the window.

Let us know the results.

 

[Slartybart]

muzz: Thank you for the feedback.

Arc: You beat me to malware. More scanners that might be necessary, but let's see what TDSSKiller and MDO find.

When you think the threat has been removed, I suggest an SFC run.
But not until all scanners have done their job.

---

Side commentary only -> I am not suggesting that muzz change course or that any of the utilities listed below be used in this thread.

I am listing the following as reference only.

Old timer-TFC is a powerful stand alone application that cleans up Temp files/Folders.
A three pronged temporary file cleanup approach is probably best

• cCleaner - cleaner tab
• http://www.sevenforums.com/tutorials/76383-disk-cleanup-extended.html
• Old timer-TFC

I also found a nice utility, StartupLite, published by Malwarebytes that 'repairs' startup RUN items. It's BETA, ... more real world testing will determine when an RTM becomes available.

I tested it on my system but of course there was nothing to correct

What StartupLite considers when processing startup entries: Malwarebytes forum post
Download StartupLite from Malwarebytes

StartupLite Usage (from the download page):

• Simply download StartUpLight from the link above and save it to a convenient location
• Double click StartUpLITE.exe
• Select all options you would like executed and select continue
  :note: I didn't see any options, it just reported "No unnecessary startups found!"
  The continue button was inactive, the X close worked

There are two things I have not tested

• Restore changes (uses msconfig)
• Custom list

The user should manually check the MSCONGIG Services tab and Startup tab after running StartupLite and report items that remain.

Bill
.

 

[Arc]

Arc: You beat me to malware.

Slartybart, I did not beat you. I pointed to it only.

Better luck next time, when I will not be there.

Edit: Muzzz's post #5. Points the same thing that I posted in my post #11.

BugCheck F4, {3, fffffa800c9af750, fffffa800c9afa30, fffff8000358c7b0}

----- ETW minidump data unavailable-----
Probably caused by : lsass.exe

Followup: MachineOwner
---------

Honestly saying, I totally overlooked it at my post #7, which later rectified.

You had post #9 in between. If you said it there, I would not have the chance to beat you.

 

[Slartybart]

Yeah, I missed my window on post# 9 - I'm working on it, but my posts are already lengthy.

As long as the issue on muzzz's machine gets resolved.... that's why we're all here.

I'll go back to watching the thread and let my BSOD sensei do his work (it's not magic if...)

Bill
.