First BSOD 8/25/10 at 8:23p.m.

[LostSamurai]

Obviously my first BSOD with Windows 7 Home Premium 64bit. I've tried reading the dump file on my own and coming to a conclusion but unfortunately I was absolutely lost. I think it might be svchost.exe but total novice here with Windows Debugging Tool so i'm more than likely wrong. Thank you so much for helping me out. I really mean it. This kind of thing gets me extremely anxious and nervous. My mini dump file is attached below.

edit: Fixing my post. Need a minute. I sincerely apologize, I didn't know all of the steps required to post the .zip file. I'm almost done completing the steps and i'll attach the correct zip file asap.

 

[LostSamurai]

Sorry

So here is the correct .zip file. Enclosed is my original dump file, the html document from the Performance Monitor, and the folder created using the BSOD app from your forums.

My computer came with Windows Vista 32bit OEM. I purchased the full version of Windows 7 Home Premium 64 bit to replace it. I've had Windows 7 for about 8 months.

My PC is 1 year, 2 months old.

Thank you for your patience and assistance.

 

[cluberti]

It's a page fault opening a File Control Block (fcb), but as to why I can't tell you - minidumps just don't get enough information for this sort of problem. You've got a couple of interesting drivers on here, but I'm loathe to tell you to update them because I have no clue for certain if any of them are even involved in this issue. You're going to need to change your memory dump type to kernel (at least) or complete, reboot, and if it happens again we can look at the memory.dmp file it will create. Until then, though, right now, this is a mystery.

 

[LostSamurai]

Well my sound card, video card, and bios are all up to date. As soon as a new driver is made available I make sure to get it done. As for my network card and other PC devices I usually use the Windows Update Configuration Utility to check them if they're up to date and as of a week ago all of my devices are up-to-date.

The only recent changes i've made to my PC is the update for Flash 10.1, a few Windows 7 security updates, virus definitions for Microsoft Security Essentials. After the BSOD I also disabled IPv6 and uninstalled my old version of iTunes because they were creating errors in the Event Viewer.

At any rate I do try to keep on top of certain things with my PC and after this i'm hell bent on defeating all errors in the Event Viewer.

On a side note I just want to say i'm not being disrespectful or undermining your response in any way. I did seek some help with a nasty virus that would rename itself on bootup and the tech on another forums accused me of bumping, etc. So i'm a bit hesitant now when seeking help from those that are more knowledgeable than I.

Thank you for the swift response. I'm trying to figure out now how to make my minidump files into the kernel format.

 

[cluberti]

No, I understand - that's why I didn't harp on "update your drivers!", because I personally abhor guessing. Sometimes it's necessary, but it's to be avoided at all costs. So, with that in mind, get a kernel or complete dump if it ever happens again by configuring for it now and rebooting .

 

[LostSamurai]

Sorry to keep wasting your time on this, it's the last thing i'll inquire about so you can move on. Obviously I used google to get the info on changing my memory dump type and I was informed that it is in Advanced System Settings > Advanced > Startup and Recovery > Settings. The thing is that the option for writing debugging information is already set to Kernel Memory Dump. Am I missing something?

edit: And thank you again. Btw I can't stop myself with all the thank yous, i'm a humble guy that appreciates help .

 

[cluberti]

The only other two things to watch for are 1, that your paging file is configured for at least the size of RAM in both the MIN and MAX size boxes (so, if you have 4GB RAM, you want your paging file MIN and MAX size to be at least 4GB); and 2, the paging file is stored on the same volume that the \Windows folder is located. After that and a reboot, any crashes should (by default) create a file in the root of the \Windows directory called memory.dmp.

 

[LostSamurai]

I feel like a dimwit lost in the desert. I'm trying to use google to see what I should use for a custom size of the page file considering i'm a gamer. All this stuff about 1.5x more than I have, and then others about how it is useless. Should I just set them both at 4096 considering thats how much ram I have and be done with it? Won't have any issues with virtual memory? Sorry about asking another question... All this stuff i'm reading is just making my head hurt. Just want to make sure I can attach a proper zip file if this ever happens again... Hope it doesn't though.

 

[cluberti]

The 1.5 - 3x numbers are remnants from the NT4 days - with 4GB of RAM, you actually probably want to (normally) run with 512MB of paging file or less. However, in situations where you need a dump file, you will want to set it to RAM size (plus about 100MB to handle savedump's overhead when writing a file). I doubt your kernel will be using 4GB of RAM, but it's to be safe (and it also allows you to choose complete memory dump without making any other paging file changes).

 

[LostSamurai]

I thought this might be the best place to explain the recent events of my PC because it seems to be related to my BSOD because the BSOD occurred while I was away and after exiting sleep mode. Also Radar_Pre_Leak_64 seems to be related to BSOD issues. If after reading a bit of this you believe I should post this somewhere else then please make a recommendation. Thanks.

Shortly after awakening my PC from sleep mode my computer was extremely slow and unresponsive. After hitting ctrl+alt+delete the PC immediately returned to its normal speed and here I am. I checked the event viewer. While checking app events I saw 3 recent entries for today: one for svchost.exe creating a restore point in association with Windows Update exactly 1 minute after exiting sleep mode (4:46), exactly 3 minutes later (4:47) the VSS is reported as being shut down due to being idle, and 30 minutes later (5:16) after coming back to my PC under source in events is Windows Error Reporting and the event name is Radar_Pre_Leak_64.

I've also had some issues with extreme slowdown through the week only during playback of my video files which also seems to be repaired by ctrl+alt+delete as well.

edit: If it is helpful at all the last event specifics for Radar_Pre_Leak_64 look like so.

- System
- Provider
[ Name] Windows Error Reporting
- EventID 1001
[ Qualifiers] 0
Level 4
Task 0
Keywords 0x80000000000000
- TimeCreated
[ SystemTime] 2010-08-30T22:16:38.000000000Z
EventRecordID 9215
Channel Application
Computer Michael-PC
Security
- EventData
644965695
5
RADAR_PRE_LEAK_64
Not available
0
Dwm.exe
6.1.7600.16385
6.1.7600.2.0.0
C:\Users\Michael\AppData\Local\Temp\RDRED9A.tmp\empty.txt
0
3fdf8460-b484-11df-8ae6-002219312a46
0

Just as well I didn't see any other suspicious events while looking through the various type of events except for bonjour service reporting a massive number of errors yesterday evening.

 

[cluberti]

You'll need to be a little more specific in what "slow" means specifically (what you observe and what resmon disk and memory show you), and what actually happens after you press ctrl+alt+del (aka, what does "not slow" mean). I think I understand, but it's always good to describe exactly what is slow and what is not slow - for instance, you say that after waking up from sleep, the computer was slow and unresponsive. You also say you've had extreme slowdowns when playing video at a different date/time, so is that also a total system slowdown? When it's slow, does it take a long time to open Start > Run > resmon or task manager, does perfmon show high amounts of disk or CPU activity during this time? Etc...

 

[LostSamurai]

I was unable to do anything on the PC when it became slow. Windows 7 suggested I use the basic Aero scheme though while it was happening. When I pressed ctrl+alt+delete the task manager loaded instantly and the slowdown immediately stopped so I was unable to observe the cpu and ram usage from there. When i've had video playback issues as of late only loading the video would be extremely slow and then no audio but all other aspects of my PC worked as usual. Maybe they're unrelated but both started happening in the same time frame.

 

[Jonathan_King]

cluberti- if I may please slip a suggestion in.

You got a 0x24:Ntfs.sys BSOD. That often relates to a bad hard drive, corrupted file system, bad page file, and many other things.

I strongly recommend installing these updated nForce drivers: NVIDIA DRIVERS 15.51 WHQL

That should update your outdated nVidia storage drivers.

 

[cluberti]

Yup, and chkdsk /f on the volume as well. Not sure about CTRL+ALT+DEL yet though, as doing that would do a lot of things, but none of them I can think of would magically free up a slow system. That is really, really odd. I'm sure there's a reason for it, but I'm unsure as to what it would be yet.

Here's a question - do you have a PS/2 keyboard you could attach to the system temporarily?

 

[LostSamurai]

Yup, and chkdsk /f on the volume as well. Not sure about CTRL+ALT+DEL yet though, as doing that would do a lot of things, but none of them I can think of would magically free up a slow system. That is really, really odd. I'm sure there's a reason for it, but I'm unsure as to what it would be yet.

Here's a question - do you have a PS/2 keyboard you could attach to the system temporarily?

Sorry about the few days that have passed with no response. I do have a PS/2 keyboard somewhere in my house.

Just to go over what i've done over the past few days.
I ran the Windows 7 memory (ram) diagnostic tool. No errors.
Ran chkdsk /f which resulted in 0 errors.
Used my Windows 7 installation disc to upgrade/repair my installation of windows.
Reinstalled my bios.
Updated the drivers for my motherboard as recommended.

No slowdown or BSOD as of yet since the upgrade/repair but 1 error in the event viewer does stick out like a sore thumb.

Event ID - 12
Source HAL
The platform firmware has corrupted memory across the previous system power transition. Please check for updated firmware for your system.
Count 1
FirstPage: 8
LastPage: 8

This error only occurs after the computer has waken from sleep mode.

I've literally attempted to update all drivers and I have no idea if it has done any good as of yet. I do know that nothing i've attempted to update has fixed that event error though.

edit: Suppose I could just never enter hibernation on my PC again considering all of the problems i've had seem to be centered around it but I depend on the service...

 

[cluberti]

Well do you *need* to hibernate, or is sleep "good enough"? Sounds like your BIOS isn't entirely ACPI 2.0 compliant, and while sleep works, hibernate doesn't. It wouldn't be the first time I've seen it, for what it's worth.

 

[LostSamurai]

Sorry got mixed up a bit, had just woken up myself. I basically just use sleep mode. At any rate that event seemed to start happening on 6/25/10 but wasn't happening daily. I couldn't find any other event that matched the date and time of the first recorded log of the first HAL event.

I do know now though that it has been happening every day since 8/24/10 after exiting sleep mode i've been getting that error in the event viewer. It does seem to coincide with the date of my first BSOD.

edit: Just on a hunch I uninstalled Microsoft Security Essentials and tah-dah. The HAL error has ceased thus far in appearing on the Event Viewer after 2 tests in sleep mode. 1 for 5 minutes and 1 for 10 minutes. Suppose i'll see what happens after the PC has been in sleep mode for several hours after returning from work.