Solved Lenovo T420 random freeze and shutdown

[sobhambi]

Hi have had this problem with the laptop since i got it. Have tried updating all drivers and the system bios, which has seemed to reduce the frequency of the freeze and shutdown, and searched for solutions on the net but I seem to be going round in circles. Please assist me in finding out what the problem is and how i could fix it. I have attached the necessary files.

 

[writhziden]

Antivirus Software:

egui.exe	c:\program files\eset\eset nod32 antivirus\egui.exe	6000	8	200	1380	3/2/2012 3:39 PM	4.2.71.2	2.12 MB (2,219,184 bytes)	1/12/2011 3:41 PM
ekrn.exe	c:\program files\eset\eset nod32 antivirus\ekrn.exe	2508	8	200	1380	3/2/2012 3:38 PM	4.2.71.2	791.16 KB (810,144 bytes)	1/12/2011 3:41 PM

Your most recent .dmp files were from October. Make sure you have your system enabled for generating dump files. http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html OPTION TWO part 2. will configure them properly. Also, avoid using any disk cleaning software (CCleaner, Windows Disk Cleanup, etc.) after a crash occurs.

 

[sobhambi]

Thank you, followed your steps to the point will update on the situation. Sorry don't understand the Antivirus code, what should I do with it?

 

[writhziden]

That is just so we know what antivirus you are using in case it causes conflicts. You do not have to do anything with it, and you probably will not have to. It is also so we know you are using antivirus software and are protected.

 

[sobhambi]

New

Just had a recent shutdown, I have updated all the info. Sorry but please help again

 

[writhziden]

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\sobhambi\Seven Forums\Seven Forums\030512-22651-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x83239000 PsLoadedModuleList = 0x833824d0
Debug session time: Sun Mar  4 22:47:08.648 2012 (UTC - 7:00)
System Uptime: 0 days 0:01:04.678
Loading Kernel Symbols
...............................................................
................................................................
.............................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {8ca03000, 2, 0, 833c98eb}

*** WARNING: Unable to verify timestamp for PHCORE.SYS
*** ERROR: Module load completed but symbols could not be loaded for PHCORE.SYS
Probably caused by : PHCORE.SYS ( PHCORE+2e6e )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 8ca03000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 833c98eb, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 833a2848
Unable to read MiSystemVaType memory at 83381e20
 8ca03000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!ExSnapShotHandleTables+7d
833c98eb 833800          cmp     dword ptr [eax],0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  8dcc3194 -- (.trap 0xffffffff8dcc3194)
ErrCode = 00000000
eax=8ca03000 ebx=88fa9a10 ecx=00000000 edx=833744f0 esi=8d9093f0 edi=8ca01b40
eip=833c98eb esp=8dcc3208 ebp=8dcc3230 iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
nt!ExSnapShotHandleTables+0x7d:
833c98eb 833800          cmp     dword ptr [eax],0    ds:0023:8ca03000=00000000
Resetting default scope

LAST_CONTROL_TRANSFER:  from 833c98eb to 8327a5fb

STACK_TEXT:  
8dcc3194 833c98eb badb0d00 833744f0 00000001 nt!KiTrap0E+0x2cf
8dcc3230 833c9851 00000014 8dcc3250 00000014 nt!ExSnapShotHandleTables+0x7d
8dcc3254 8345986f 00000014 af70fcec 8dcc36f0 nt!ExpGetHandleInformation+0x58
8dcc36bc 83469df4 00000010 00000000 00000000 nt!ExpQuerySystemInformation+0x1665
8dcc36d8 8327721a 00000010 8a9e63f0 00000014 nt!NtQuerySystemInformation+0x76
8dcc36d8 83275be9 00000010 8a9e63f0 00000014 nt!KiFastCallEntry+0x12a
8dcc3760 99e1de6e 00000010 8a9e63f0 00000014 nt!ZwQuerySystemInformation+0x11
WARNING: Stack unwind information not available. Following frames may be wrong.
8dcc378c 99e1e092 b9500d20 142e2635 9af9b4bc PHCORE+0x2e6e
8dcc37c8 99e1ec46 9af9b4bc b2e09b98 00000000 PHCORE+0x3092
8dcc3c24 99e1da36 9af97e84 9af97e88 00000000 PHCORE+0x3c46
8dcc3c50 83441fda 00000001 af70f6c0 00000000 PHCORE+0x2a36
8dcc3c90 832ea1f9 99e1d982 9af975e0 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
PHCORE+2e6e
99e1de6e ??              ???

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  PHCORE+2e6e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: PHCORE

IMAGE_NAME:  PHCORE.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4e169d76

FAILURE_BUCKET_ID:  0xA_PHCORE+2e6e

BUCKET_ID:  0xA_PHCORE+2e6e

Followup: MachineOwner
---------

Caused by Lenovo RapidBoot Driver; would recommend uninstalling this software, at least to test. If it is necessary for the system, uninstall it and then re-install it. Create a restore point before uninstalling the software.


Also, since this probably does not indicate the cause of the freezes/shutdowns, I would suggest doing some hardware tests.

• Monitor temperatures during the following tests.
  
  Use the following programs to monitor the temperatures.​
  • Real Temp is a good CPU temperature monitor.
  • Speccy - System Information - Free Download will monitor all hardware temperatures.
  • HWiNFO, HWiNFO32 & HWiNFO64 - Hardware Information and Analysis Tools can be inaccurate for CPU temperatures, but is a good program for GPU temperature monitoring.
  • 
    Use FurMark: VGA Stress Test, Graphics Card and GPU Stability Test, Burn-in Test, OpenGL Benchmark and GPU Temperature | oZone3D.Net to test the graphics card GPU. Then use the |MG| Video Memory Stress Test 1.7.116 Download to test your graphics card memory. Let the memory test run for at least seven passes; the more the better.
    
    
  • Run http://www.sevenforums.com/tutorials/100352-hardware-stress-test-prime95.html to determine any hardware problems. Run all three tests for a few hours each. If you get errors, stop the test and post back here.
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
  If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
  Once these steps have been followed, it is safe to remove and replace components within your computer.

 

[sobhambi]

Many thanks writhziden. The problem seems to be resolved. Haven't had any issues with any hardware. It must have been the rapidboot.

 

[writhziden]

Thanks for the update. Glad things are running smoothly now. Feel free to mark the thread solved.

 

[sobhambi]

Hi again sorry to disturb. Everything seemed to be fine before but I am having many unexpected shutdowns. May you please help me again. Am I doing something wrong? I have tried to upload the necessary files, but I couldn't remember how to do it like the last time...

 

[writhziden]

Event[102]:
  Log Name: System
  Source: Service Control Manager
  Date: 2012-05-03T21:50:28.419
  Event ID: 7000
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: BRY-CC664787
  Description: 
The SIXAXIS/DUALSHOCK3 DX (USB) Beta service failed to start due to the following error: 
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

The above error occurs relatively frequently. It does not look critical, but may be worth removing the software. Is the service necessary for a device you have to run properly?

Event[56]:
  Log Name: Application
  Source: SideBySide
  Date: 2012-05-03T18:35:53.000
  Event ID: 59
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: BRY-CC664787
  Description: 
Activation context generation failed for "C:\Program Files\Lenovo\Access Connections\AcCryptHlpr.dll".Error in manifest or policy file "C:\Program Files\Lenovo\Access Connections\AcCryptHlpr.dll" on line 0. Invalid Xml syntax.

Uninstall and then re-install Lenovo Access Connections or contact Lenovo regarding this error. If the software is not provided through the Lenovo support site, you may be able to just remove the software entirely as it is likely not important for the system to run unless it is included in their support. Before removing any Lenovo software, I would recommend creating a system restore point first.

Event[112]:
  Log Name: Application
  Source: Bonjour Service
  Date: 2012-05-03T12:17:19.000
  Event ID: 100
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: BRY-CC664787
  Description: 
Task Scheduling Error: Continuously busy for more than a second

Uninstall and re-install your Apple software by following the steps in that link very carefully. It must be uninstalled in the correct order to uninstall properly.

Event[518]:
  Log Name: Application
  Source: Application Error
  Date: 2012-05-01T19:53:38.000
  Event ID: 1000
  Task: Application Crashing Events
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: BRY-CC664787
  Description: 
Faulting application name: susetsched.exe, version: 0.0.0.0, time stamp: 0x4f63009f
Faulting module name: USER32.dll, version: 6.1.7601.17514, time stamp: 0x4ce7ba26
Exception code: 0xc0000005
Fault offset: 0x00023c71
Faulting process id: 0x15f4
Faulting application start time: 0x01cd27f5a03f7e1b
Faulting application path: C:\Program Files\Lenovo\System Update\susetsched.exe
Faulting module path: C:\Windows\system32\USER32.dll
Report Id: de71560a-93e8-11e1-8cd7-0021cc664787

Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations. Use OPTION THREE of http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html to provide us with the sfcdetails.txt file if errors occur.

 

[sobhambi]

Thank you, i followed the steps and all was fine after running SFC /SCANNOW Command - System File Checker three times. I still have the Lenovo Access Connections uninstalled and i have included the system info after a recent freeze and shutdown. Any advice on what to do next?

 

[writhziden]

At this point, I would recommend a http://www.sevenforums.com/tutorials/3413-repair-install.html of Windows 7. Nothing obvious pops out, so it may be your Windows registry has become corrupted. A repair install should rectify it if that is the case.

You can use steps 1-3 of http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html#post1839164 to backup your system and get installation media if necessary. Usually, a repair install finishes without issue, but I still recommend backing up important data in case the unforeseen should happen.

 

[sobhambi]

Thank you for your help. Will update if the situation changes.