Solved Help debugging with STOP 0x000000CA (PNP_DETECTED_FATAL_ERROR)

[HoneycombAG]

Hmmm. Strange crash while monkeying around with this digital voice recorder as of recent. Probably a random crash out of the blue somewhere.

In either case, the debugging files are attached. Can't get perfmon /report to run since I've booted in Safe Mode for the moment. And I don't know why the tool jcgriff2 didn't capture the full MEMORY.DMP file.

 

[writhziden]

The jcgriff2 tool does not collect the MEMORY.DMP file because it would be too large to upload to forums.


Device Concerns:

avast! Network Shield Support	ROOT\LEGACY_ASWTDI\0000	This device is not present, is not working properly, or does not have all its drivers installed.
Security Processor Loader Driver	ROOT\LEGACY_SPLDR\0000	This device is not present, is not working properly, or does not have all its drivers installed.

The above may be due to Safe Mode. They may also indicate a virus/malware and/or graphics card driver issues.​

Software Concerns:

Start Menu\Programs\Spybot - Search & Destroy
Start Menu\Programs\SpywareBlaster	
Start Menu\Programs\Auslogics\Disk Defrag
Start Menu\Programs\Auslogics\Registry Cleaner

• Spybot Search and Destroy and SpywareBlaster are not the best malware/spyware utilities. Take a look at http://www.sevenforums.com/system-s...-system-security-combination.html#post1732627 for better options.
  
  
• I personally do not recommend 3rd party defrag tools. I have seen them damage restore points and even cause blue screen crashes. Windows has some nice command line flags for the defrag command that will accomplish the same tasks as 3rd party programs. The -b and -w flags will defrag boot files and the boot registry items as well as compact the data to the center of the disk for faster access.
  defrag c: -b
  defrag -c -v -w
  ​
  The first command optimizes boot performance for the Windows drive by defragmenting boot files and boot registry items.
  
  The second command includes all drives on the system through the -c command and optimizes the drives by compacting the data to the center of the disk. Verbose output through the -v option is optional to provide the user with more information about the defrag tasks. The commands have to be run in an http://www.sevenforums.com/tutorials/783-elevated-command-prompt.html.
  
  For more flags, see http://www.sevenforums.com/tutorials/11733-disk-defragmenter-open-use.html.
  
  
• Many of us on the forums actually do not recommend automated optimization tools for Windows 7. Windows 7 does a much better job of handling its own optimization than its predecessors did. We especially do not recommend registry cleaning as an "optimization" step because automated registry cleaning causes more harm to the registry than it actually repairs.
  
  In the future, if you need help optimizing Windows 7, please post a thread in Performance & Maintenance - Windows 7 Forums or follow the tutorial enclosed in that forum to http://www.sevenforums.com/tutorial...ws-7-a.html?filter[2]=Performance Maintenance.

Analysis:

It is difficult to find patterns with one .dmp file. You have made it difficult for us by using CCleaner to clean your disk; CCleaner deletes the .dmps when it runs, so please refrain from using it for the duration of your troubleshooting. Your one .dmp and the BugCheck codes found in your Event Viewer logs are pointing to a hard disk or Windows issue. I wonder if your Acronis/backup software is involved since it is pre-Windows 7; please update it or remove it. I also wonder whether the registry cleaning being done has damaged Windows and the software installed on it... There is a chance crashes are virus/malware related or memory related.

• If you are overclocking any hardware, please stop.
  
  
• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html (you may need to search for wininit instead of chkdsk).
  For any drives that do not give the message:
  Windows has checked the file system and found no problems
  run disk check again as above. In other words, if it says:
  Windows has made corrections to the file system
  after running the disk check, run the disk check again.
  
  
• Run all Basic tests with SeaTools: S.M.A.R.T. Check, Short Drive Self Test, Drive Information, Short Generic, and Long Generic. Run the tests for all HDDs.
  SeaTools for Windows
  
  SeaTools for DOS​
  
  
• If you have an SSD, make sure the following are up to date:
  • SSD firmware
  • BIOS Version
  • Chipset Drivers
  • Hard disk controller drivers/SATA drivers
  • If you have a Marvell IDE ATA/ATAPI device, make sure the drivers are up to date from the Intel site or Marvell site and not from your motherboard/vendor support site.
  
  
• Check Windows for corruption. Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations. Use OPTION THREE of http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html to provide us with the sfcdetails.txt file if errors occur.
  
  
• Download and install Malwarebytes, update it, do not start the free trial, and then run a full scan. Also run a full scan with your antivirus software installed on your system. If you do not have antivirus software installed, see the http://www.sevenforums.com/system-s...-system-security-combination.html#post1732627 for better security steps and scanning tools. Make sure to update the security software before running the full scan.
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
     Warning

  Before you proceed with the following, answer these two questions: Are you still under warranty? Does your warranty allow you to open up the machine to check hardware? If you are unsure of the answers to these questions, contact your system manufacturer. :warn:WARNING: The steps that follow can void your warranty!!!
  
  For Part 3: If You Have Errors: If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working. If you do not have an anti-static workbench, desk, or pad, you can use your computer tower/case by finding a metal hold in it, such as a drive bay.
  Once these steps have been followed, it is safe to remove and replace components within your computer.

 

[HoneycombAG]

Every other time I ran Seatools it treated my disk as a SCSI disk and not SATA and would not open the SMART statistics, so I ran that from Speedfan instead.

CCleaner isn't wiping memory dumps, as far as settings go at this point. This is due in part because I've been using the simple WhoCrashed tool to analyse what kind of crash took place.

And meanwhile I finally got together a perfmon report.

With Spybot - Search & Destroy and SpywareBlaster gone, who's going to keep my browser blacklist and hosts file updated?

Some of the software you listed will be uninstalled.

 

[HoneycombAG]

An invalid command line option was specified. (0x89000008)

defrag -c -v -w

What does -w do? I don't think that does anything. Should use /c or /v, etc. when entering a parameter.

:info: Note: File fragments larger than 64MB are not included in the fragmentation statistics.

 

[writhziden]

The -w flag compacts the files to the center of the hard disk. It makes the system run faster by allowing faster access to your files, program data, etc.

Does WhoCrashed delete the files when it finishes analyzing them? Is there an option to stop it from doing so if it does?

WhoCrashed and other 3rd party blue screen analysis tools that do not use WinDbg to gather information often give very vague analyses of .dmps. In my experience, the most you can usually gather from such programs is that Windows is not working as it should... Not the most helpful information to those trying to find out why Windows is not working as it should.

With Spybot - Search & Destroy and SpywareBlaster gone, who's going to keep my browser blacklist and hosts file updated?.

There was a time when Search & Destroy actually increased security vulnerabilities instead of decreasing them. I do not know if that is still the case, but due to that, I try to stay way from the software and recommend others do the same. If you need similar functionality, your questions are better posed to System Security - Windows 7 Forums.

 

[HoneycombAG]

System File Checker did not find any integrity violations.
Software uninstalled:
Spybot - Search & Destroy :warn: (warnings occurred)
SpywareBlaster
Auslogics\Disk Defrag
Auslogics\Registry Cleaner

SMART attribute for Seagate Barracuda 7200.12 - ST31000528AS (firmware:CC49)
SMART attribute for Maxtor Fireball 40G - 2F040L0 (firmware:VAM51JJ0)
SMART attribute for Western Digital My Passport External Hard Drive - WDC WD5000BMVW-11AMCS0 (firmware 1016)

Disk Defragmenter has been run today.

Some traces of Spybot - Search & Destroy weren't removed by the installer. These need to be removed by hand. You need to tell me where to look so I can delete from these locations.

Device Concerns:

avast! Network Shield Support	ROOT\LEGACY_ASWTDI\0000	This device is not present, is not working properly, or does not have all its drivers installed.
Security Processor Loader Driver	ROOT\LEGACY_SPLDR\0000	This device is not present, is not working properly, or does not have all its drivers installed.

The above may be due to Safe Mode. They may also indicate a virus/malware and/or graphics card driver issues.​

Hmmm. Your guess is as good as mine. In Device Manager they say they're working properly. Maybe it's just another issue about being "excluded from Safe-Mode execution" that throws everything off.

 

[writhziden]

Please provide the warnings that occurred when removing the spybot software.

Did you remove in Safe Mode? If so, did you use these steps: http://www.sevenforums.com/tutorials/117840-uninstall-remove-software-safe-mode.html.

I do not use Spybot Search & Destroy, so I would be guessing as to where the remnants reside. You would be much better off asking the developers of the software. They would know exactly how to remove it manually:

The home of Spybot-S&D!: How to uninstall

The home of Spybot-S&D!: Support​

I also wonder if the problems with removing programs and device issues are being caused due to a damaged registry from using the registry cleaner...

 

[HoneycombAG]

Please provide the warnings that occurred when removing the spybot software.

The message I got was: Some elements of the program could not be removed.

Found it, remaining program data on Spybot - Search & Destroy has been obliterated. (Location checked: C:\ProgramData)

Disk Health
Scans were scheduled to run at restart on the system and swapfile partitions.
All other partitions or disks will be scanned, provided it doesn't bog down my system first when I'm trying to do something else!!

Status
ChkDsk eated my memory
Every other disk scanned and checked out fine, but My Passport (G: ) did not complete its scan. The system was already low on resources and already messing up applications such as Windows Live Mail (couldn't connect to Gmail) and Chrome ("application/page has become unresponsive" warning messages). I suppose I should run a check in the WinRE later.

For some reason, Windows skipped through and said "the volume was clean" whenever it scanned the system and swap partitions, so I had to go back and issue commands to reschedule both of them for scans before any work was to be done.

 

[HoneycombAG]

Do you want for me to uninstall the WhoCrashed tool?

 

[writhziden]

I do not think the WhoCrashed tool is really beneficial. 3rd party tools that do blue screen analysis usually provide very vague information that tells us the system is not working right but rarely actually tells us why the system is not working right.

It is up to you whether you want to continue to use it. I would prefer that you run it only after you have uploaded any new .dmps though since there seems to be question at the moment as to whether or not it deleted your .dmps...


And yes, you should probably run the disk checks through the recovery environment if you are having performance issues running them while in Windows.

 

[Jacee]

The PNP_DETECTED_FATAL_ERROR bug check has a value of 0x000000CA. This indicates that the Plug and Play Manager encountered a severe error, probably as a result of a problematic Plug and Play driver.

Bug Check 0xCA: PNP_DETECTED_FATAL_ERROR

"Scan your computer for computer viruses"
Did you do this?

Since this doesn't appear to be an OEM (brand name) computer, you say this in your specs:
"Other Info Has one bad memory slot."

 

[HoneycombAG]

Actually, now that you think about it, let me report back what the Debugging tools said about this crash...

PNP_DETECTED_FATAL_ERROR (ca)
PnP encountered a severe error, either as a result of a problem in a driver or
a problem in PnP itself. The first argument describes the nature of the
problem, the second argument is the address of the PDO. The other arguments
vary depending on argument 1.
Arguments:
Arg1: 0000000000000001, Duplicate PDO
A specific instance of a driver has enumerated multiple PDOs with
identical device id and unique ids.
Arg2: fffffa8001aae9d0, Newly reported PDO.
Arg3: fffffa80059e11c0, PDO of which it is a duplicate.
Arg4: 0000000000000000

Probably caused by : Volume Manager Driver

All my avast! Free Antivirus' shields are turned on constantly, and they haven't found and sent any files to the Virus Chest within the past month. In fact avast! is also set on a schedule. I did resolve an issue about "OpenCandy", if you look in the System Security post about why Windows Defender wouldn't stay hidden when I had WinPatrol installed for a brief moment.

 

[PepiMK]

There was a time when Search & Destroy actually increased security vulnerabilities instead of decreasing them. I do not know if that is still the case, but due to that, I try to stay way from the software and recommend others do the same. If you need similar functionality, your questions are better posed to System Security - Windows 7 Forums.

Hope you understand that I feel kind of insulted by reading this. Would you care to elaborate?