Solved Fresh Build - Constant BSOD - Multiple Codes - 3b, 50, a

[Vir Gnarus]

Does the BIOS for your Mobo come with a built-in flash utility? If you're using UEFI, it should be able to access files on your drives, in which case you can direct it to the .ROM file of your BIOS update and have it install through there. Otherwise, yeah, you may have to use their bloatware, just make sure to uninstall it afterwards.

 

[LP81]

When I get home this evening from work, I will use my work Laptop using the same ethernet/router port to download the same files - Only difference is this laptop is Win 7 x64 Professional instead of Ultimate, but that should make zero difference.

I'll download xperf & wireshark some time during the day and run it when I get home

 

[Dave76]

Note, I have Rev 2.0 of the Mobo, not Rev 1.0. I am on BIOS FB, their most current is FD. Looks like the only way to update my BIOS is via their bloatware since I am running x64 based and it always tells me:

--------------------------- Unsupported 16-Bit Application ---------------------------
The program or feature "...\Win 7 Installs - 5-10-12\bios\FLASHSPI.EXE"
cannot start or run due to incompatibility with 64-bit versions of Windows. Please contact
the software vendor to ask if a 64-bit Windows compatible version is available.

The in OS executable method is not the best way to update your BIOS.
With the below method, it will ensure nothing will interfere during the update process.
Disclaimer: A failed BIOS update can cause severe issues with your computer. Only update BIOS if you have an issue that requires it.

How to update Gigabyte BIOS

Qflash method
Gigabyte "How To ~ Qflash Guide"

Use the Qflash method with a USB flash drive formatted to FAT32.

 

[LP81]

Apologies in the delay.

Hectic work week and personal issues.

I am now loading xperx and wireshark onto my work laptop and will run the same download file as before. Same Ethernet cable / router Port.

Please standby

Note, I was able to update BIOS to FD, but it made no difference.

 

[LP81]

Update:

So I installed Wireshark and xperf on the laptop.

Started xperf & Wireshark

Started the download of Windows6.1-KB947821-v22-x64.msu

Since it never stalled I let it run the full time of the download

I ended the xperf and it gave me a warning:

xperf: warning: Session "NT Kernel Logger" lost 341 events.

To avoid losing events, for in-file tracing try increasing buffer size or the minimum/maximum number of buffers. It is also recommended that a separate secondary storage device is used for in-file tracing, especially when analyzing secondary storage activity. Another way to avoid losing events is to trace in memory (-buffering mode). This guarantees that events will not be lost, but the time range of events captured can be significantly shorter than with in-file tracing.

Also, Wireshark refused to stop recording... Tried clicking the stop button, used the menu command, keyed command (ctrl-E) had to force quit it to stop recording subsequently losing the report.

I will try to run the full test again hoping for different results.

 

[LP81]

Same result as the first time, this time though it says 84329 events were lost.

Can't get Wireshark to stop recording for some reason

let me know if you want these xperf logs uploaded or if you think there's a workaround to avoid the event loss.

 

[LP81]

Just a quick update from more testing this weekend.

Went out and got a PCI 10/100 NIC card.

Popped it in, started to download the normal file listed previously.

It seemed to be OK at the start then it would stall out every min or so. Stopped at 27%, 35%, 53%, 66% & 91% It would hang for a min, then resume downloading, stall, resume without manual intervention.



Tested it on a few different download

Trillian 23mb download stalled at 33% and around 70%

Wireshark - 21MB download - stalled at 73% then finished up a few min later.


So I guess this might be good news that it's not hardware related???

 

[F5ing]

Could the ISP be involved here?

 

[LP81]

Could the ISP be involved here?

Doubtful as no other computer in the house is affected.

Tested on a MabBook Pro (hardwired and wireless), Dell Laptop (hardwired and wireless) and custom rig (wireless only)

None have this issue.

 

[Vir Gnarus]

In few occasions Wireshark will refuse to disconnect like that because there ends up being an issue with the LibPCap filter doesn't wanna discontinue. You'll need to restart the computer to get it to start working properly.

Can you provide another xperf/wireshark log combo with the new NIC so I can compare it with your previous logs?

 

[LP81]

I did have to uninstall and re-install WireShark for it to recognize the new NIC card, just as an FYI if you run into this in the future...


Did 2 tests back to back using the new NIC

Started both loggers
Waited about 5-10 seconds to start the file download
Crapped out after only a few seconds

First test I waited another 15-20 seconds to see if it would resurrect itself, but it didn't. Then I stopped the logging

Second Test, I killed the logging quickly after seeing it stall out.

Both are here:

Run 1: Zippyshare.com
Run 2: Zippyshare.com

 

[Vir Gnarus]

Hi mate, I didn't forget about this. I'll look at it when I have some spare time since this will require something more thorough in investigation than other cases. Shouldn't be too long.

 

[LP81]

Not a problem

Thanks for all the time you've put in already.

 

[Vir Gnarus]

I think we're getting somewhere.

Can you go into your registry using regedit (accessible from Windows start menu) and see if you can do a search in it for the following:

AB8902B4-09CA-4BB6-B78D-A8F59079A8D5

also look for this:

bf3a50c5-a9c9-4988-a005-2df0b7c80f80

Provide me any info you may garner on these two, such as process/driver names and whatnot. If you wanna just take a snapshot of what you find by all means.

I believe I've finally found some pattern. Evidently, there's some hold-up for the SMB redirectory, the UNC provider, and the filter manager (as well as NTFS). The former two items are related to networked files (like Windows file sharing) and the like, and the latter is an over-encompassing item involving any file I/O, hence its relation to NTFS. NTFS driver is also hanging up frequently. I'm also noticing this is happening only when your system is doing disk flushes

There may be a filter driver, like either from your antivirus, or from some software related to files sharing or network connections, that's holding things up. That, or your drive itself is experiencing issues.

Another thing, I found that IMEI (Intel Management Engine Interface) has a tendency to rear its ugly head immediately at download start and again when the download dies. I'm not sure if it has a relation to this, but I recommend getting rid of it anyways, it's a security risk.

Again, I think I'm on to something, but I'll peruse the data further. I would definitely like to figure out more on what's going on, such as your driver stack, so if it's at all possible when firefox download hangs, whip out Process Explorer, right click firefox, and create a full dump to give to us. If you wish, you may even go so far as to provide us a kernel dump. As in, first set up to do manually forced crash by following instructions here. Then after the restart, get firefox going, run another download, and as soon as it hangs manually force a crash (first make sure your crashdumps are set to kernel dumps as explained here). Send us the MEMORY.DMP file located in Windows folder after that.

The kernel dump and the firefox dump provide two separate details: the former provides me what was going on in the background such as I/O and stuff and gives me details on driver stacks n all that jazz, whereas the firefox dump will provide me a direct look at what was going on with firefox at the time the download hung. Preferably you provide both, but if you wanted to choose one, I'd go for the kernel dump first.

 

[LP81]

HKEY_CLASSES_ROOT\AppID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Sub Items:
(Default) REG_SZ Thumbnail Cache Out of Proc Server
DllSurrogate REG_SZ *Null*


bf3a50... was not found

Regarding IMEI: To verify I can just use the "Add/Remove Programs tool and remove "Intel(R) Management Engine Components" correct?

I will work on the Process Explorer and memory Dump later today (super busy at work)

 

[Vir Gnarus]

Try looking in HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\ for it. If you want you can even right click the "folder" with the long name and Export it. You may need to change the file extension. Make sure that "Selected branch" option is the one checked.

 

[LP81]

Still no dice on the BF3a one...

Even widened the search to "bf3a50c5" and I got no hits in the entire Registry.

Could that "folder" that's missing be an issue then?

attached is the entire CLSID "folder"

 

[LP81]

So either I'm doing something wrong, or I need to grab a different keyboard as the Ctrl Scroll Lock force crash isn't working

I checked and the Kernel dump was set as a default (attachment 1)

I added the registry Entry and did a restart (Attachment 2)

I held the right most crtl and pressed scroll lock twice as specified... no crash

Last MEMORY.DMP file is from 5/23

 

[Vir Gnarus]

Urp, I mean search the registry again for the AB8902B4, not the other one. Just search in that specific area. That should come up with an entry with lots of subkeys (subfolders) that contain a good bit of data behind it. Again, you can merely export it all as a .reg file.

It's ok, I found what it was. It's the thumbcache.dll, for Thumbnail Cache for directories. I'm not quite sure if it's relevant to your problems, though it did seem to show up at the wrong time in the logs. You can try and disable it by following this article.

As for getting it to crash, were you looking in HKEY_LOCAL_MACHINE? Try adding the entry for both ps/2 and usb keyboards. If need be, you may have do the alternate shortcut right described at the bottom of the article (maybe just Key1 is all you need to do). Remember to revert the CrashOnCtrlScroll value to 0 if you decide to go that route.

 

[LP81]

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\

{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}

(default) REG_SZ Thumbnail Cache Class Factory for Out of Proc Server
AppID REG_SZ {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}



Thumbnails Disabled via the registry edit procedure.



I'll see if I can set up an alternative crash dump key combo