Multiple BSOD issue, 0XF4 was the only culprit caught.

[squish8294]

Okay, so. I've had a couple of BSOD's today while doing video work using quicksync, another one while ripping a disc, and then I manually did one using the USB keyboard kernel dump of ctrl + scroll lock twice, and then, upon reboot, it BSODs before login 3 times. Everything before the manual crash dump my pc rebooted too fast to catch the bugcheck codes. I set the PC to NOT reboot after a crash if it BSODs, and forced it to BSOD with Bugcheck 0XE2 (Manual Bugcheck)

Then the 2 or 3 it gave me after this were stop ALL stop code 0XF4, critical system process or thread terminated, all before login. Any clues as to what caused it? I'm downloading windbg now to debug the crash dumps myself, to see what may have caused this issue.

Here's the windbg readout. Seems like a driver issue? I dunno.

1. 0: kd> !analyze -v
2. *******************************************************************************
3. * *
4. * Bugcheck Analysis *
5. * *
6. *******************************************************************************
7. CRITICAL_OBJECT_TERMINATION (f4)
8. A process or thread crucial to system operation has unexpectedly exited or been
9. terminated.
10. Several processes and threads are necessary for the operation of the
11. system; when they are terminated (for any reason), the system can no
12. longer function.
13. Arguments:
14. Arg1: 0000000000000003, Process
15. Arg2: fffffa8011339060, Terminating object
16. Arg3: fffffa8011339340, Process image file name
17. Arg4: fffff80003598270, Explanatory message (ascii)
18. Debugging Details:
19. ------------------
20. PROCESS_OBJECT: fffffa8011339060
21. IMAGE_NAME: wininit.exe
22. DEBUG_FLR_IMAGE_TIMESTAMP: 0
23. MODULE_NAME: wininit
24. FAULTING_MODULE: 0000000000000000
25. PROCESS_NAME: wininit.exe
26. EXCEPTION_CODE: (Win32) 0x5 (5) - Access is denied.
27. BUGCHECK_STR: 0xF4_5
28. DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
29. CURRENT_IRQL: 0
30. ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
31. STACK_TEXT:
32. fffff880`02ff19c8 fffff800`03620ab2 : 00000000`000000f4 00000000`00000003 fffffa80`11339060 fffffa80`11339340 : nt!KeBugCheckEx
33. fffff880`02ff19d0 fffff800`035cbabb : 00000000`00000001 fffffa80`1133bb50 fffffa80`11339060 fffff880`82ac8000 : nt!PspCatchCriticalBreak+0x92
34. fffff880`02ff1a10 fffff800`0354af04 : 00000000`00000001 00000000`00000001 fffffa80`11339060 0000007f`00000000 : nt! ?? ::NNGAKEGL::`string'+0x17486
35. fffff880`02ff1a60 fffff800`03291e53 : 00000000`00000008 00000000`00000005 fffffa80`1133bb50 00000000`00155cc8 : nt!NtTerminateProcess+0xf4
36. fffff880`02ff1ae0 00000000`776601af : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
37. 00000000`0024f738 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x776601af
38. STACK_COMMAND: kb
39. FOLLOWUP_NAME: MachineOwner
40. IMAGE_VERSION:
41. FAILURE_BUCKET_ID: X64_0xF4_5_IMAGE_wininit.exe
42. BUCKET_ID: X64_0xF4_5_IMAGE_wininit.exe
43. ANALYSIS_SOURCE: KM
44. FAILURE_ID_HASH_STRING: km:x64_0xf4_5_image_wininit.exe
45. FAILURE_ID_HASH: {9d5c7bc4-c11b-cfc3-c306-233fc3c94195}
46. Followup: MachineOwner

Also of note, I did run an sfc /scannow and it said some files were corrupt but unable to be fixed.

More on this in a moment, per the BSOD instructions thread.

 

[essenbe]

Hello, squish8294. I'll try to help you with this. First I need you to do something that will help us help you.

Please fill out your System Specs​

   Information

Your System Specs will help us to help you, and doing it in this manner will make them available to all helpers in every post and keep us from hunting for them. We ask that you fill them out in as much detail as possible including Desktop or Laptop, Model number if it is an OEM computer and all components with the Manufacturer and Model number if possible.

If you will go to your last post and click the 'System Specs' in the bottom left of the post, you will find a link to update your system specs. Please fill those out in as much detail as possible, making sure to click save at the bottom of the page. If you would like to know what we would like, you can click 'My System Specs' at the bottom left of this post to see mine. If you do not know what your components are, this will help you accomplish this task. http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html​

After doing that, please run Check Disk http://www.sevenforums.com/tutorials/433-disk-check.html
then run Seatools for DOS http://www.sevenforums.com/tutorials/313457-seatools-dos-windows-how-use.html#Part3. Please run the short and the long test. Let us know how the results come out.

 

[squish8294]

system specs updated, will do the rest when I get home

 

[essenbe]

Great, just let us know the results.

 

[squish8294]

Do you want me to run checkdisk for all drives?

 

[squish8294]

Short Generic

SSD: pass
Momentus XT 500GB: pass
WDCAVIARBLUE: Pass
Barracuda: Pass
​

 

[essenbe]

Run the long test too. That's the one you will usually fail and yes, if it were mine I would run check disk. As I recall, your dump files did not blame the Hard drive for the BSOD, but it did show several I/O errors.

 

[squish8294]

Long test: SSD pass, Momentus fail, WDCB pass, Barracuda pass. The momentus is NOT the OS drive in this scenario.

Edit: Inputting smart data from momentus

smartctl 6.3 2014-07-26 r3976 [x86_64-w64-mingw32-win7-sp1] (sf-6.3-1)
Copyright (C) 2002-14, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Family:     Seagate Momentus XT
Device Model:     ST95005620AS
Serial Number:    5YX1MD9K
LU WWN Device Id: 5 000c50 044ebeee2
Firmware Version: SD28
User Capacity:    500,107,862,016 bytes [500 GB]
Sector Size:      512 bytes logical/physical
Rotation Rate:    7200 rpm
Form Factor:      2.5 inches
Device is:        In smartctl database [for details use: -P show]
ATA Version is:   ATA8-ACS T13/1699-D revision 4
SATA Version is:  SATA 2.6, 3.0 Gb/s
Local Time is:    Sat Nov 29 03:58:56 2014 CST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED
See vendor-specific Attribute list for marginal Attributes.

General SMART Values:
Offline data collection status:  (0x00)    Offline data collection activity
                    was never started.
                    Auto Offline Data Collection: Disabled.
Self-test execution status:      (  25)    The self-test routine was aborted by
                    the host.
Total time to complete Offline 
data collection:         (  625) seconds.
Offline data collection
capabilities:              (0x73) SMART execute Offline immediate.
                    Auto Offline data collection on/off support.
                    Suspend Offline collection upon new
                    command.
                    No Offline surface scan supported.
                    Self-test supported.
                    Conveyance Self-test supported.
                    Selective Self-test supported.
SMART capabilities:            (0x0003)    Saves SMART data before entering
                    power-saving mode.
                    Supports SMART auto save timer.
Error logging capability:        (0x01)    Error logging supported.
                    General Purpose Logging supported.
Short self-test routine 
recommended polling time:      (   1) minutes.
Extended self-test routine
recommended polling time:      ( 102) minutes.
Conveyance self-test routine
recommended polling time:      (   2) minutes.
SCT capabilities:            (0x1001)    SCT Status supported.

SMART Attributes Data Structure revision number: 10
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x000f   120   096   006    Pre-fail  Always       -       0
  3 Spin_Up_Time            0x0003   097   097   000    Pre-fail  Always       -       0
  4 Start_Stop_Count        0x0032   100   100   020    Old_age   Always       -       468
  5 Reallocated_Sector_Ct   0x0033   100   100   036    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x000f   081   060   030    Pre-fail  Always       -       124307020
  9 Power_On_Hours          0x0032   086   086   000    Old_age   Always       -       12431
 10 Spin_Retry_Count        0x0013   100   100   097    Pre-fail  Always       -       0
 12 Power_Cycle_Count       0x0032   100   100   020    Old_age   Always       -       530
184 End-to-End_Error        0x0032   082   082   099    Old_age   Always   FAILING_NOW 18
187 Reported_Uncorrect      0x0032   001   001   000    Old_age   Always       -       4431
188 Command_Timeout         0x0032   100   253   000    Old_age   Always       -       0
189 High_Fly_Writes         0x003a   100   100   000    Old_age   Always       -       0
190 Airflow_Temperature_Cel 0x0022   073   062   045    Old_age   Always       -       27 (Min/Max 23/30)
191 G-Sense_Error_Rate      0x0032   100   100   000    Old_age   Always       -       0
192 Power-Off_Retract_Count 0x0032   100   100   000    Old_age   Always       -       337
193 Load_Cycle_Count        0x0032   093   093   000    Old_age   Always       -       14264
194 Temperature_Celsius     0x0022   027   040   000    Old_age   Always       -       27 (0 14 0 0 0)
195 Hardware_ECC_Recovered  0x001a   050   041   000    Old_age   Always       -       0
197 Current_Pending_Sector  0x0012   100   100   000    Old_age   Always       -       1
198 Offline_Uncorrectable   0x0010   100   100   000    Old_age   Offline      -       1
199 UDMA_CRC_Error_Count    0x003e   200   200   000    Old_age   Always       -       0

SMART Error Log Version: 1
ATA Error Count: 4401 (device log contains only the most recent five errors)
    CR = Command Register [HEX]
    FR = Features Register [HEX]
    SC = Sector Count Register [HEX]
    SN = Sector Number Register [HEX]
    CL = Cylinder Low Register [HEX]
    CH = Cylinder High Register [HEX]
    DH = Device/Head Register [HEX]
    DC = Device Command Register [HEX]
    ER = Error register [HEX]
    ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.

Error 4401 occurred at disk power-on lifetime: 12413 hours (517 days + 5 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 41 78 ff ff ff 4f  Error: UNC at LBA = 0x0fffffff = 268435455

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 00 78 ff ff ff 0f 00  14d+22:06:05.414  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  14d+22:06:00.967  READ LOG EXT
  60 00 78 ff ff ff 0f 00  14d+11:01:17.261  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  14d+11:01:12.769  READ LOG EXT
  60 00 78 ff ff ff 0f 00  13d+23:56:29.186  READ FPDMA QUEUED

Error 4400 occurred at disk power-on lifetime: 12413 hours (517 days + 5 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 41 78 ff ff ff 4f  Error: UNC at LBA = 0x0fffffff = 268435455

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 00 78 ff ff ff 0f 00  14d+11:01:17.261  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  14d+11:01:12.769  READ LOG EXT
  60 00 78 ff ff ff 0f 00  13d+23:56:29.186  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  13d+23:56:24.725  READ LOG EXT
  60 00 78 ff ff ff 0f 00  13d+12:51:41.091  READ FPDMA QUEUED

Error 4399 occurred at disk power-on lifetime: 12413 hours (517 days + 5 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 41 78 ff ff ff 4f  Error: UNC at LBA = 0x0fffffff = 268435455

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 00 78 ff ff ff 0f 00  13d+23:56:29.186  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  13d+23:56:24.725  READ LOG EXT
  60 00 78 ff ff ff 0f 00  13d+12:51:41.091  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  13d+12:51:36.657  READ LOG EXT
  60 00 78 ff ff ff 0f 00  13d+01:46:52.992  READ FPDMA QUEUED

Error 4398 occurred at disk power-on lifetime: 12413 hours (517 days + 5 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 41 78 ff ff ff 4f  Error: UNC at LBA = 0x0fffffff = 268435455

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 00 78 ff ff ff 0f 00  13d+12:51:41.091  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  13d+12:51:36.657  READ LOG EXT
  60 00 78 ff ff ff 0f 00  13d+01:46:52.992  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  13d+01:46:48.546  READ LOG EXT
  60 00 78 ff ff ff 0f 00  12d+14:44:53.394  READ FPDMA QUEUED

Error 4397 occurred at disk power-on lifetime: 12413 hours (517 days + 5 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 41 78 ff ff ff 4f  Error: UNC at LBA = 0x0fffffff = 268435455

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 00 78 ff ff ff 0f 00  13d+01:46:52.992  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  13d+01:46:48.546  READ LOG EXT
  60 00 78 ff ff ff 0f 00  12d+14:44:53.394  READ FPDMA QUEUED
  2f 00 01 10 00 00 40 00  12d+14:44:48.947  READ LOG EXT
  60 00 78 ff ff ff 0f 00  11d+22:23:25.511  READ FPDMA QUEUED

SMART Self-test log structure revision number 1
Num  Test_Description    Status                  Remaining  LifeTime(hours)  LBA_of_first_error
# 1  Short offline       Aborted by host               90%     12412         -
# 2  Short offline       Completed: read failure       90%     10931         382460965
# 3  Short offline       Completed: read failure       90%     10931         382460965
# 4  Short offline       Completed without error       00%     10675         -
# 5  Short offline       Completed without error       00%      9437         -
# 6  Short offline       Completed without error       00%      8686         -
# 7  Short offline       Completed without error       00%       395         -

SMART Selective self-test log data structure revision number 1
 SPAN  MIN_LBA  MAX_LBA  CURRENT_TEST_STATUS
    1        0        0  Not_testing
    2        0        0  Not_testing
    3        0        0  Not_testing
    4        0        0  Not_testing
    5        0        0  Not_testing
Selective self-test flags (0x0):
  After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.

More edit: Chkdsk C no problems, Checking others now, with problems on barracuda and seagate.

 

[Laith]

Since this is a F4 code and wininit.exe was killed begin with searching for viruses.
Install Malwarebytes Anti-Malware

When your done and have come to the last page of setup make sure to UN-TICK the try the free trial of malwarebytes-antimalware.

After that run a quick scan and post the logs.

 

[squish8294]

Malwarebytes Anti-Malware
[URL="http://www.malwarebytes.org"]Malwarebytes | Free Anti-Malware & Internet Security Software[/URL]

Scan Date: 11/29/2014
Scan Time: 7:59:06 AM
Logfile: mbam.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.11.29.03
Rootkit Database: v2014.11.22.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Squish

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 321191
Time Elapsed: 3 min, 10 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

I have malware bytes premium already....

 

[essenbe]

Disconnect the Momentus and see if there is any difference in how the computer reacts. Laith is partially correct in that F4 code can be a Virus or usually a hard drive or ram problem. Those are just they usual things it is. There can be many more, but my experience is those are the normal things. My intention was to deal with it one at a time and not throw a whole bunch of stuff at you all at once. Just my style. So, My advice would be to copy everything from the Momentus that you want to keep. If it is under warranty, I will help you clean it well, before returning it, if you need that help. To make sure, please run these
Scan with Kaspersky TDSSKiller:
Anti-rootkit utility TDSSKiller
Anti-rootkit utility TDSSKiller
ESET online scanner:
Free Virus Scan | Online Virus Scanner from ESET
Free Online Virus Scanner | ESET

Then copy everything off that you need while you still can. Then disconnect the drive completely from the computer and see if you can tell a difference in how it operates. I would run the scans first just in case there is a virus. You wouldn't want to copy the virus along with the data.

 

[Laith]

Hmm, Ive expercined such BSODs when a fake winitit.exe or csrss.exe take over and when killing them bsods occur.

 

[essenbe]

Laith, I'll explain my theory, although I do not want to disrupt this thread. My theory is that you ate dealing with a critical object termination. No matter if you have a bad hard drive that causes errors in a process critical to the operation of Windows or if you are dealing with a Virus that impersonates csrss.exe or that affects the proper operation of csrss.exe, the computer cannot tell the difference. All it knows is that for some unknown reason a process that I need to operate is functioning improperly or has quit functioning at all so Automatic shutdown occurs. It only knows that a process I can't run without has malfunctioned. The reason is immaterial. That's all it knows. A bad hard drive, a Virus or Rootkit, a ram error or several other thing could cause csrss.exe to malfunction, the computer does not care why, it only cares that something I need does not work and goes into shutdown mode. That is my theory.

Having said all of that, I do not want to derail this thread discussing theory and cause. I want to fix whatever is causing squish's problem, whatever is causing it.

 

[Laith]

Essenbe is right about those things that he said. If the rootkit scan finds no rootkits then it is a failing ram or harddrive

 

[squish8294]

But if it's the Momentus failing, and not the SSD that my OS is located on, why would that make a difference? Only thing I can think of is my 2TB drive disappears sometimes and needs its power reconnected every so often, and with a page file on that, that could be an issue, but I don't see how as the BSOD's have occurred during work that puts the processor under stress.

 

[essenbe]

I am not able to explain everything that goes on inside an operating system. I am only able to look at files to see what I believe is going on. There are some people who are able to get much more out of a dump file than I ever will be. But, at the end of the day, it all boils down to interpretation. My Theory again. The way the error reporting system is made in Windows, the system has to blame something for the crash. I have never seen a dump file, and know no one who has, that says "I have no clue to what really happened". What it does is blames whatever it can find that crashed, and name something that caused it. If it does not know it will blame the Windows Kernel or some part of it. Now, does that mean dump files are worthless? Absolutely not. If you put a lot of them together, and read the errors that led up to the crash, you can most times get some idea of 'it is 2 or 3 things' causing the problem. Windows files, including the Kernel will never cause a crash. When the Kernel is blamed, what it really is saying is there is another problem that caused the Windows Kernel to crash. My job is to figure out what that is. I will not lie to you and tell you "I always get my Man". I don't too often for my liking.

I have seen secondary hard drives that were bad cause a crash of Windows many times. Once I had a secondary hard drive in my system once. I could not figure out why the system would not even start. It would get a BSOD, 3 seconds after pushing the start button. Now, I am embarrassed by this story. I have built and rebuilt more computers than I care to count. But, I did everything I know to figure it out and couldn't. I completely dismantled the computer and rebuilt it 3 times in one night. Same results. I put it on a table and did what I should have done to begin with (overconfidence will get you every time). I stripped it down to only what was necessary for it to just post. No hard drive at all attached, no graphics card, no DVD no nothing except the CPU, Ram and power supply. it booted right up. So, I slowly added 1 component at a time, and restarted. It got down to that secondary hard drive that I only used for storage and some backups. Started it up and BSOD instantly. Unplugged it, and it started right up. So, why did that happen? I have no idea. It was not frozen up. I could hear and feel the disks spin up when power was put to it. I could hear the armature moving slightly trying to read the disk, and did hear it click a few times. I took the drive completely apart to try to find out what caused it. Everything was there and nothing was seized up. I have no idea why, other than possibly the circuit board went bad. This is an embarrassing story for someone who actually built a computer blindfolded once, just to prove I could.

This is a lot longer post that I normally make. This is also a lot more controversial post than I have ever made before. But, it's much the way it is in the world I live in, according to me and no one else. My ideas and my view on things. But, the moral of the story as I see it, is analyzing a BSOD is far more than what the debugger tells you. It requires a lot more interpretation and intuition than many people think. I wish it was as simple as reading a dump file and being able to tell you what the problem is or knowing a certain code always means 1 specific thing is wrong. But it is not. If I could write a program that was able to do that I would be a multi millionaire overnight. Don't worry, that's not going to happen. I'm not that smart. Until someone smarter than me writes that program, we just have to try to read the tea leaves and try to figure out what they are trying to tell us. The real kicker is, in a few of the cases that make you pull your hair out, there are 2 or 3 problems all occurring at the same time. If, after all of this, you would like a different analysist to handle your case, I will be more than happy to call the best I know to do it. My feelings will not be hurt in the least, I have a lot thicker skin than that.

 

[essenbe]

Squish, if you moved the page file from your SSD to the secondary hard drive, please move it back to the SSD, then shut down and remove both cables from the Momentus, start back up and open a elevated command prompt ( click start, type cmd in the search box, right click on the cmd entry and select run as administrator) in the black box that opens, copy/paste sfc /scannow. If you decide to type it, notice the space between the sfc and the /. It is a system file checker which will scan your system files and attempt to correct any missing or corrupt files. What we want are the results to say windows found no integrity violations. If it says files were found but could not be repaired, close the box, reboot and run it again, after opening the administrative command prompt. You may have to reboot and run it three times for it to repair all system files. If it can't repair them after 3 reboots, let us know.

Also, if you are overclocking anything, please set everything back to default levels.

 

[Arc]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

[COLOR=Red]BugCheck F4[/COLOR], {3, fffffa8011339060, fffffa8011339340, fffff80003598270}

----- ETW minidump data unavailable-----
[COLOR=Red]Probably caused by : wininit.exe[/COLOR]

Followup: MachineOwner
---------

Stop 0xF4. That is CRITICAL_OBJECT_TERMINATION as it reads. When it is probably caused by "wininit.exe" or "csrss.exe", the first notion goes to the storage failure.

Why? What is said in the crash dump in this line? NOTHING. For a stop 0xF4, the bugcheck code says enough. 0xF4 is a storage failure, fair and square.

Well, it may be a virus issue, but in that case the probably caused by will be neither of wininit or csrss. Rather it will point to something abrupt, and the location of the failing module will point to an unusual location of the module, like c:\user\appdata\local\temp rather that %systemroot%.

One more thing is there, that is a failing memory. A failing RAM can cause any sort of issue.

If I have been there in the place of the OP, my steps would have been ....

1. Uninstalling Daemon tools, including its SCSI adapters.

ITEM|VALUE
Name | DAEMON Tools Virtual SCSI Bus
PNP Device ID | ROOT\SCSIADAPTER\0000
Driver | c:\windows\system32\drivers\dtscsibus.sys

2. Uninstalling Intel AHCI (IRST drivers) and run the system on system native AHCI.

3. Make it sure that the the Intel SSD is running with the latest firmware.

4. Check all the three storage devices with their manufacturer's tools (Seatools and Data Lifeguard).

And then will wait for any further evidence of the BSOD. If it comes back, there are more places to look at, if needed.

 

[Arc]

And there is some good reason to uninstall MediaCoder VOD edition. Better you uninstall it and see how it goes.

Event[12535]:
Log Name: Application
Source: Application Error
Date: 2014-11-26T13:00:18.000
Event ID: 1005
Task: Application Crashing Events
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: Squish-PC
Description:
Windows cannot access the file for one of the following reasons: there is a problem with the network connection, the disk that the file is stored on, or the storage drivers installed on this computer; or the disk is missing. Windows closed the program ffmpeg.exe because of this error.

Program: ffmpeg.exe
File:

The error value is listed in the Additional Data section.
User Action
1. Open the file again. This situation might be a temporary problem that corrects itself when the program runs again.
2. If the file still cannot be accessed and
- It is on the network, your network administrator should verify that there is not a problem with the network and that the server can be contacted.
- It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
4. If the problem persists, restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for further assistance.

Edit .....

Also there is some solid good reason to free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Event[12406]:
  Log Name: Application
  Source: Application Error
  Date: 2014-11-26T11:31:53.000
  Event ID: 1000
  Task: Application Crashing Events
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Squish-PC
  Description: 
Faulting application name: AnyDVDtray.exe, version: 6.7.3.0, time stamp: 0x4cebfb75
Faulting module name: AnyDVDtray.exe, version: 6.7.3.0, time stamp: 0x4cebfb75
Exception code: 0xc0000005
Fault offset: 0x00689100
Faulting process id: 0x14fc
Faulting application start time: 0x01d0099ede805e72
Faulting application path: C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe
Faulting module path: C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe
Report Id: 1c2e27b2-7592-11e4-8ead-60a44c6127d7

 

[essenbe]

Help with uninstalling Dameon tools:

Daemon Tools, Alcohol 120% and Power Archiver Pro uses SCSI Pass Through Direct (SPTD), which is a well known cause of BSOD's.

1. Uninstall Daemon Tools.
2. Download the SPTD standalone installer and follow these steps:
- Double click the executable to open it
- Click the button shown below



If the button it is grayed out, as shown in the image, there is no more SPTD installation on your system, and you can just close the window.