Solved Seemingly random BSOD issues - Head hurts from banging it on the wall

[texjam]

Hi, guys... I fear I may have inadvertently put some blinders on myself and can't really diagnose my problem(s) so well. Since it never hurts to have some fresh eyes on a project, I'm posting this in hopes for some new advice... attached are specs.

I'm having some (seemingly) random BSODs, as well as a number of system freezes (without dumps), but the main culprit seems to be ntoskrnl... I can't really be 100% sure about that, as I'm also having some serious brainfart issues at the moment and may be missing something really simple on this one (I would hope). I've been through several driver updates and rollbacks (to no avail) and hoping you guys could offer some fresh eyes and direction on this.

A test with Driver Sweeper will result in an almost immediate BSOD.
I've got new RAM being delivered tomorrow, though all tests have been passing.

And I'm new to the forum, so please excuse me if I miss anything... I'll try to upload anything I've missed as quickly as I can, but I'm pretty frazzled about this one and just about ready to give it up... thanks for any help you can offer.

 

[x BlueRobot]

[COLOR="Red"]CLOCK_WATCHDOG_TIMEOUT (101)[/COLOR]

BugCheck 101, {30, 0, fffff88003364180, 2}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

Usual causes:  Device driver, BIOS bug, hardware defect

Follow these steps here:

• http://www.sevenforums.com/crash-lo...0x101-clock_watchdog_timeout-troubleshtg.html

Your BIOS needs to be updated:

Vendor                        American Megatrends Inc.
  BIOS Version                  7B3P081G              
  BIOS Starting Address Segment e000
  BIOS Release Date             [COLOR="red"]05/05/2008[/COLOR]

Check the motherboard website or your computer manufacturer's website.

Uninstall AVG:

AVG Mini-Filter Resident Anti-Virus Shield	c:\windows\system32\drivers\avgmfx64.sys

• AVG Official Uninstaller

Uninstall Spybot:

Start Menu\Programs\Maintenance\Spybot

Perform full scans with:

• Microsoft Security Essentials | Free Download
• Malwarebytes Anti-Malware | Free Download

:info:These programs are more stable and work better with Windows 7, although AVG and Spybot may not be the root causes for the BSODs, they are better to use when trying to diagnose your issue due to their better stability.

Remember to install the free version of Malwarebytes not the free trail ; untick the free trail box during installation.

Run some hard-drive and file system checks (will scan for corrupted system files):

• http://www.sevenforums.com/tutorials/139810-sfc-scannow-run-command-prompt-boot.html
• http://www.sevenforums.com/tutorials/433-disk-check.html

:warn: Running stress tests will place extreme load on components, and will cause failing or misconfigured hardware to produce errors and overheating; please follow the steps carefully.

Use hardware temperature monitoring programs when running the stress tests:

• CoreTemp
• CPUID HwMonitor

CPU:

• http://www.sevenforums.com/tutorials/100352-hardware-stress-test-prime95.html

Graphics Card:

• http://www.sevenforums.com/tutorials/100356-video-card-stress-test-furmark.html

I would also run Driver Verifier to check for missing or corrupted drivers, run for least 24 hours, stop the test if any BSODs occur before this time frame.

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

Please post back results

 

[texjam]

Thanks for the speedy reply... I've basically cleared my schedule and will start working on this from square one, though I've looked for BIOS updates for my MB before with little success, i.e. - 05/2008 is the newest I could find... but the internet is a big place, so I'll continue my search. I'll be working this today and tomorrow, but I'll be out of town later this week, so may not be able to update my results until after the 25th... thanks again.

 

[texjam]

Alright - I've done most of your suggestions... I've uninstalled Spybot and AVG, and currently waiting for MSSE to update and finish its run... I've updated and run Malwarebytes, but it found nothing... as for my BIOS, I've made an exhaustive search for a newer version (newer than 05/2008), but still no luck in that one. Several of the posts I've read in my searches leads me to believe that 05/2008 is as new as it gets for this board, which would lead one to think that maybe getting a new board and building a new machine (I understand that I may need to do that anyway) is the only option, but I wasn't really ready to go there yet. This machine has been my "workhorse" for several years, and I dread all the activation and deactivation I will have to go through if I swap my hard drive... my windows version is retail, but my Adobe, and Office, and a slew of other financial apps will have to be reactivated... sigh. Anyway, I've got a couple of questions:

Is MSSE reliable? If it is, I'll stick with it, but I process a number of financial transactions on this machine and really need to be sure it's "clean".

I've grown to love Spybot over the years I've used it (and supported them financially, too), but if they're the root cause of the BSODs then I'm sorry to see them go... they've got to go, right? I use them as real-time protection, so if they go I need to find a comparably priced replacement (free).

And I'm hoping that the RAM I get tomorrow will fix things up, but we'll see... I know Driver Verifier will throw a BSOD quickly if enabled, so I'd rather wait until I can swap the RAM to enable it again... I've had a few more BSODs since I began my journey today and, if only for the psychological benefit of not seeing any more tonight, I will wait to enable it until after I swap the RAM.

MSSE came up clean while I was writing this, so I'm hoping it's the RAM.

SFC & Disk Check came up clean, too.

I normally run CPUID's monitors and have never had extreme temps with anything (except during the GPU test where my card plateaued at 95C), but I can’t rule out overheating completely.

Anyways, do you have any other suggestions that I could try this evening?

Thanks.

 

[x BlueRobot]

You must have the latest BIOS for your motherboard then, and what results did these stress tests give?

MSE is much more stable, and I've been using for almost a year and have had no problems at all; AVG and Spybot were both real-time protection programs and were causing problems such as the crashes.

You can run a scan with this program which is designed to scan for rootkits, it was designed by the same programmers who made Malwarebytes:

• Anti-rootkit utility TDSSKiller

Test RAM:

• http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Run Memtest86+ for least 7-8 passes, and preferrly overnight as it can take a while to fully complete.

Test each RAM stick individually, if an error is found then move the same RAM stick into the next DIMM slot and test again, if errors are found for the same RAM stick in every available slot then you have a faulty RAM module. On the other hand, if no errors are found in the next slot or the other slots for the same RAM module, then you have a faulty DIMM slot.

Test each RAM stick and every motherboard DIMM slot available.

:info: Each pass performs a different test on the RAM modules and DIMM slots.

 

[texjam]

The BIOS is what is, I suppose... Spybot and AVG are gone, and the stress tests all came back good... Prime95 ran almost 3 hours with no anomalies... Furmark did its thing, and though it plateaued my card at 95C, it reported and caused no anomalies during its run... MSSE was clean, as was Malwarebytes, and TDSS, too... SFC and CHKDSK were both good... and the only thing else I can do right now is enable Drive Verifier, but I wanted to wait until I could swap my RAM, but apparently Hurricane Sandy is causing delays in my delivery to New Mexico from California... I’m not sure how exactly, but Fedex wouldn’t lie, would they? Anyway, I won’t be able to do that until Monday. I did, however, get a BSOD overnight, but I’m not sure if it was before or after or during my daily machine backup using Paragon (free) software. I will be performing a complete backup now, and then maybe uninstalling Paragon for the moment. Do you know of any issues with Paragon software?

I did another diagnostic grab (this morning) and will attach it, though I don’t know if you need another one... and I don’t know if the several BSODs I’ve had since my first diagnostic grab are included, but maybe they are and I can’t see them. And after I complete my backup I will do the RAM test and post back any results... probably this evening or tomorrow, though.

Thanks for all your help and direction with this.

 

[x BlueRobot]

[COLOR="Red"]BugCheck A[/COLOR], {28c5, 2, 1, fffff8000368aaea}

Probably caused by : ntkrnlmp.exe ( nt!KiCommitThreadWait+28a )

Usual causes:  Kernel mode driver, System Service, BIOS, Windows, Virus scanner, [COLOR="red"]Backup tool[/COLOR], compatibility

You could try uninstalling Paragon as a test and see what happens, Windows does have it's own built in backup and drive imaging service.

You could also test for some hardware and driver compatibility issues with Windows 7:

• Windows 7 Upgrade Advisor - Download - Microsoft Windows

The Stop 0x101 also occurred again.

• http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html

Please configure Windows to create kernel dump, and then upload to this thread with your next BSOD, as kernel dumps provide additional information which makes analysis for 0x101 bug checks much easier.

 

[texjam]

Grumble, grumble... my RAM tests have been passing, and I won't get my new RAM until Tuesday, as Fedex doesn't make home deliveries on Mondays (news to me)... it seems as though my RAM has political connections, as it's been very hard to get them replaced. Anyway, I'm holding out hope that some new sticks will fix this, but I'm still throwing some BSODs. I think I followed your instuctions for kernel dumping, but don't think I actually changed anything... I thought it was set for kernel dumps all along, but maybe not... I'm included the latest grab.

I ran the W7UA program and it listed everything as compatible except Speedfan, which I uninstalled, but I'm still getting BSODs showing ntoskrnl as a suspect. Please let me know if this upload is incorrect or missing any valuable information... I hate to keep asking you guys for help, but I'm also having some issues installing the latest Windows SDK debugging tools, too... if I could get them working, I'd probably be asking a lot more specific questions, I'm sure. Thanks for the help, though.

 

[texjam]

Jiminy Christmas - sometimes you run around so blind that you don't even realize how blind you are. I'm going to be looking around for some way to share my 200MB (zipped) memory.dmp file with you guys, but I had a question: I know my machine is probably archaic to some, but I'm happy with it (for the most part)... anyway, several weeks back I did (for a short time) install an SSD and some system modifications (TRIM, etc.), but what caused me to uninstall the SSD was that I ultimately couldn't find any W7 AHCI drivers for my system/board... my machine is currently running with IDE controllers only, and though I can't say with absolute certainty that my BSODs started when I did this, I can basically equate them to "around" the same time. I know my BIOS is old and doesn't support AHCI within it, but I didn't think it would matter if I could find a correct driver(s) for W7... well, I do have an AHCI driver that says it's Vista x64 compatible, but not sure if I should try it or not, so I wanted to ask the forum for its opinion.

Thanks,
JAM

 

[x BlueRobot]

I would match drivers with the operating system you have installed, drivers designed for one operating system won't be compatible for another operating system.

I'm having a look at the dumps now, and if you want to get your debugger configured properly, then visit the BSOD 'How-To' section.

I have a suspicion of a faulty processor, but I'm not entirely sure as of yet.

STACK_TEXT:  
fffff880`080e3d88 fffff800`036ecd5a : 00000000`00000101 00000000`00000030 00000000`00000000 fffff880`03364180 : nt!KeBugCheckEx
fffff880`080e3d90 fffff800`0369fad7 : fffff800`00000000 fffff800`00000002 00000000`0002625a fffffa80`0a284b50 : nt! ?? ::FNODOBFM::`string'+0x4e2e
fffff880`080e3e20 fffff800`03c131c0 : 00000000`00000000 fffff880`080e3fd0 fffff800`03c2f460 fffff800`00000000 : nt!KeUpdateSystemTime+0x377
fffff880`080e3f20 fffff800`03692513 : 00000000`5ecb2a65 fffff800`03c2f460 fffff880`080e3fb0 00000000`00000000 : hal!HalpRtcClockInterrupt+0x130
fffff880`080e3f50 fffff800`0369add2 : fffff800`03808e80 fffffa80`00000001 00000000`00000000 fffff880`080e41d8 : nt!KiInterruptDispatchNoLock+0x163
fffff880`080e40e0 fffff800`036d9cac : 00000000`0000000d fffff800`03808e80 fffff8a0`0023cb20 00000000`00000000 : nt!KeFlushMultipleRangeTb+0x252
fffff880`080e41b0 fffff880`0145fea8 : fffffa80`0a284b50 00000007`845df343 00000000`0000000d fffff800`03808e80 : nt!MmSetAddressRangeModified+0x2b0
fffff880`080e42b0 fffff880`0150c0d3 : fffff8a0`0023cb20 00000007`845df528 00000000`00000001 fffff880`0150b700 : [COLOR="red"]Ntfs!LfsFlushLfcb+0x5d8[/COLOR]
fffff880`080e4430 fffff880`0150e640 : fffff8a0`0023cb20 00000007`845df528 fffff800`03833280 fffff800`03833280 : [COLOR="red"]Ntfs!LfsFlushToLsnPriv+0x143[/COLOR]
fffff880`080e44c0 fffff880`0150bc6f : fffff8a0`0023cb20 fffff8a0`000a42b0 fffff8a0`0030c050 fffff8a0`0023cb20 : [COLOR="red"]Ntfs!LfsWriteLfsRestart+0xf0[/COLOR]
fffff880`080e4500 fffff880`0150a653 : fffff8a0`000a42b0 00000000`00000000 fffffa80`081ea430 00000007`845dc4df : [COLOR="red"]Ntfs!LfsWriteRestartArea+0x143[/COLOR]
fffff880`080e4590 fffff880`0150d977 : fffff880`080e4ab0 fffffa80`081ea180 00000000`00000000 fffff880`080e4c00 :[COLOR="red"] Ntfs!NtfsCheckpointVolume+0xa97[/COLOR]
fffff880`080e4990 fffff880`0150c317 : fffff880`080e4ab0 fffffa80`081ea180 fffffa80`081ea188 fffffa80`088ef188 : [COLOR="red"]Ntfs!NtfsCheckpointAllVolumesWorker+0x4b[/COLOR]
fffff880`080e49e0 fffff880`0150e428 : fffff880`080e4ab0 00000000`00000000 fffff880`0150d92c fffff880`080e4cb8 : [COLOR="red"]Ntfs!NtfsForEachVcb+0x167[/COLOR]
fffff880`080e4a80 fffff800`0369f641 : fffff800`03833200 fffff800`03988500 fffffa80`0a284b00 00000000`00000002 : [COLOR="Red"]Ntfs!NtfsCheckpointAllVolumes+0xb8[/COLOR]
fffff880`080e4cb0 fffff800`0392ce5a : 00000000`05c20265 fffffa80`0a284b50 00000000`00000080 fffffa80`06a459e0 : nt!ExpWorkerThread+0x111
fffff880`080e4d40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PspSystemThreadStartup+0x5a

There seems to quite a few !ntfs exceptions in your call stack, run a few of these tests:

• http://www.sevenforums.com/tutorials/433-disk-check.html
• CrystalDiskInfo - Software - Crystal Dew World
• SeaTools for Windows | Seagate

Please post a screenshot of your Crystal Disk Info summary:

• http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

Please check and post a screenshot of your Advanced Boot Options:

Start rb: > Type: msconfig > Boot tab > Advanced Options

Make sure the the number of processor and maximum memory tick boxes are unticked; post a screenshot of that Window too.

 

[texjam]

Did you want me to do anything within Crystal? I'm attaching an info cap:

View attachment 243078

The MSCONFIG cap:

View attachment 243079

And I'm having some issues uploading my dump file to filefactory.com at the moment... it's got nothing to do with the BSODs, it's just a consequence of living in rural America and having a really shotty ISP... it keeps failing @ 25-30% into the upload, but I think that's because my ISP does not actually offer a stable internet connection in their pricing packages.

I'm also finishing up an SDK install, too, so I'll do another CHKDSK when it's finished, and post the results soon after the CHKDSK is done.

Thanks,
JAM

 

[x BlueRobot]

Thanks for the screenshot, and Crystal Disk seems to be pointing out no problems so far which is good, the hard-drive does seem to be a little warm in my opinion.

Do the other two tests, and perform long and short tests with Seagate;

please post back your results

 

[texjam]

01:03 showing left on the long generic test... I'm assuming that's one hour, three minutes, so I'll post the results later this evening after I've completed them. And I agree about the temps, but it's a cramped/modified Gateway case and I didn't really want to replace it, but this machine has rarely done what I want it to do anyway, so I'll make a note... under use, the case temps (for all components) can get into the upper 40s, but it's never gone over 50C that I've seen... I'd thought that was pretty par for an AMD machine, but the way this is turning out I may be doing several upgrades anyway... I'll post back my disk results this evening.

Thanks,
JAM

 

[x BlueRobot]

Okay thanks, and it may be worthwhile checking inside the case for any dust which may have accumulated over time too

 

[texjam]

Alright -

I've finished all the basic tests in the Seagate utility, and all passed.

The CHKDSK utility turned up no errors, or least repaired them (I didn't actually see).

And after several hours to upload a mere 200MB file, here's the link to my latest kernel/memory dump (AM today) via File Factory:

MEMORY2012.11.25-0.zip - download now for free. File sharing. Software file sharing. Free file hosting. File upload. FileFactory.com

I'm only a free member with them, so I hope it doesn't give y'all some of the same troubles downloading it, as it gave me uploading it.

I appreciate any advice you can give me on it (as time permits), and once again

Thank you very much for the help.

-JAM

 

[F5ing]

You should be able to find chkdsk results, even when no errors were found, by going into event viewer and searching for wininit and/or chkdsk events.

 

[texjam]

The last CHKDSK log:

-System
-Provider
[ Name] Microsoft-Windows-Wininit
[ Guid] {206f6dea-d3c5-4d10-bc72-989f03c8b84b}
[ EventSourceName] Wininit
-EventID1001
[ Qualifiers] 16384
Version0
Level4
Task0
Opcode0
Keywords0x80000000000000
-TimeCreated
[ SystemTime] 2012-11-26T00:50:32.000000000Z
EventRecordID27795
Correlation
-Execution
[ ProcessID] 0
[ ThreadID] 0
ChannelApplication
ComputerJAM-HQ027
Security
-EventData
Checking file system on C: The type of the file system is NTFS. Volume label is W7PROx64. A disk check has been scheduled. Windows will now check the disk. CHKDSK is verifying files (stage 1 of 3)... 268032 file records processed. File verification completed. 747 large file records processed. 0 bad file records processed. 2 EA records processed. 93 reparse records processed. CHKDSK is verifying indexes (stage 2 of 3)... 349482 index entries processed. Index verification completed. 0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 3)... 268032 file SDs/SIDs processed. Cleaning up 3073 unused index entries from index $SII of file 0x9. Cleaning up 3073 unused index entries from index $SDH of file 0x9. Cleaning up 3073 unused security descriptors. CHKDSK is compacting the security descriptor stream 40726 data files processed. CHKDSK is verifying Usn Journal... 33854192 USN bytes processed. Usn Journal verification completed. CHKDSK discovered free space marked as allocated in the master file table (MFT) bitmap. Correcting errors in the Volume Bitmap. Windows has made corrections to the file system. 488384511 KB total disk space. 122294068 KB in 225284 files. 154200 KB in 40729 indexes. 0 KB in bad sectors. 383635 KB in use by the system. 65536 KB occupied by the log file. 365552608 KB available on disk. 4096 bytes in each allocation unit. 122096127 total allocation units on disk. 91388152 allocation units available on disk. Internal Info: 00 17 04 00 26 0f 04 00 97 0b 07 00 00 00 00 00 ....&........... 99 c4 00 00 5d 00 00 00 00 00 00 00 00 00 00 00 ....]........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Windows has finished checking your disk. Please wait while your computer restarts.

 

[F5ing]

I'd run chkdsk again. The last run attempted repairs. See if another run reveals that no errors remain.

 

[x BlueRobot]

I agree with F5ing, the log file did report some errors being repaired, so it's best to run the test one more time to make sure all the errors were fully repaired by Windows.

What link am I supposed to click to download the file?

 

[texjam]

The latest CHKDSK log:

Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 2012-11-26 06:30:08
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: JAM-HQ027
Description:

Checking file system on C:
The type of the file system is NTFS.
Volume label is W7PROx64.

A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 3)...
272896 file records processed.
File verification completed.
760 large file records processed.
0 bad file records processed.
2 EA records processed.
93 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
354786 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 3)...
272896 file SDs/SIDs processed.
Cleaning up 20 unused index entries from index $SII of file 0x9.
Cleaning up 20 unused index entries from index $SDH of file 0x9.
Cleaning up 20 unused security descriptors.
Security descriptor verification completed.
40946 data files processed.
CHKDSK is verifying Usn Journal...
36504440 USN bytes processed.
Usn Journal verification completed.
Windows has checked the file system and found no problems.
488384511 KB total disk space.
125336992 KB in 227604 files.
154908 KB in 40947 indexes.
0 KB in bad sectors.
391007 KB in use by the system.
65536 KB occupied by the log file.
362501604 KB available on disk.
4096 bytes in each allocation unit.
122096127 total allocation units on disk.
90625401 allocation units available on disk.
Internal Info:
00 2a 04 00 12 19 04 00 71 17 07 00 00 00 00 00 .*......q.......
bd c4 00 00 5d 00 00 00 00 00 00 00 00 00 00 00 ....]...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.

And the link to Filefactory is: MEMORY2012.11.25-0.zip - download now for free. File sharing. Software file sharing. Free file hosting. File upload. FileFactory.com

It is hosted at the Filefactory for free, and does make you jump through a couple of hoops before you can download it, but let me know if there's any issues and I'll see about another service or do you have a preferrred hosting site?

Thanks guys,
JAM