Black screen of death?

[TomasD]

OK Gents, I'm attaching the ntbtlog file as previously requested. It Black Screened twice today. Awesome.

The first time was 04:30 today; when was the second one?

 

[TomasD]

OK Gents, I'm attaching the ntbtlog file as previously requested. It Black Screened twice today. Awesome.

The first time was 04:30 today; when was the second one?

I guess the second "black screen" was at 07:22, right?

Let's take a look into a comparison of the boot log at 04:30/07:22 (left) with any other boot (right):



All lines in these logs match until line 80th, at which it starts going differently:

• During successful boot, Windows loads dxgkrnl.sys (Windows DirectX driver) and nvlddmkm.sys (Nvidia driver). It also later loads nvhda64v.sys (Nvidia HDMI audio driver) and monitor.sys (Windows monitor driver) later.
• During unsuccessful boot, Windows doesn't load any of the drivers listed above and it loads vgapnp.sys (Windows VGA display driver) instead.

Now if I would need to guess why is it happening - I would say your video card is failing and that's the reason Windows is sometimes not able to identify it correctly, resulting in an attempt to use default VGA drivers and ending-up without any video output.

There are few other things that might be worth trying before getting the laptop to the service for video card check/replacement:

• Install the latest Nvidia drivers, released yesterday.
• Get rid of ASUS ATK WMIACPI (it seems to relate to Advanced Configuration and Power Interface (ACPI), so there's a chance (even a very very small one), it might be doing something wrong during boot that would cause power issues with video card):
  1. Download, extract and run Autoruns.
  2. Click File -> Run as Administrator.
  3. Navigate to Drivers tab.
  4. Deselect atkwmiacpi64.sys.
  5. Reboot the computer.

By the way, these lines from the log look really interesting:

Did not load driver \??\C:\Windows\SysWow64\drivers\cwkrrtoo.sys
Did not load driver \??\C:\Windows\SysWow64\drivers\dvfyfbnc.sys
Did not load driver \??\C:\Windows\SysWow64\drivers\jxomygok.sys

Even these drivers always fail to load and, hence, do not seem related to black screens, they seem be be related to some malware you had (have) on your computer. Legitimate drivers do not use randomly generated names like these. Do you think you check if any of these files exist on your system?

 

[r4kolb]

Did what you requested. Will see what happens. Scan w Malewarebytes came up clean. When I ran the autoruns.exe it came up w some things highlighted in yellow that look suspicious. Can you look at them and see if you know what they are:

cpuz134 File not found: C:\Users\Randy\AppData\Local\Temp\cpuz134\cpuz134_x64.sys

cwkrrtoo File not found: C:\Windows\system32\drivers\cwkrrtoo.sys

dvfyfbnc File not found: C:\Windows\system32\drivers\dvfyfbnc.sys

jxomygok File not found: C:\Windows\system32\drivers\jxomygok.sys

If I were to disable them would that crash my system? Randy

 

[TomasD]

Did what you requested. Will see what happens. Scan w Malewarebytes came up clean. When I ran the autoruns.exe it came up w some things highlighted in yellow that look suspicious. Can you look at them and see if you know what they are:

cpuz134 File not found: C:\Users\Randy\AppData\Local\Temp\cpuz134\cpuz134_x64.sys

cwkrrtoo File not found: C:\Windows\system32\drivers\cwkrrtoo.sys

dvfyfbnc File not found: C:\Windows\system32\drivers\dvfyfbnc.sys

jxomygok File not found: C:\Windows\system32\drivers\jxomygok.sys

If I were to disable them would that crash my system? Randy

Perfect. Let me know if the issue re-occurs.

As for the Autoruns view, it highlights the records that contain non-existing files in yellow. The first one (cpuz134) is OK, because CPU-Z application extracts this driver to the temporary directory when launched. The remaining three are the suspicious ones, but since Autoruns says these files are not found, it is very likely they were deleted by an antivirus some time ago. You can go on and disable (or delete) all of them, since they are not working anyways.

 

[r4kolb]

Did what you requested. Will see what happens. Scan w Malewarebytes came up clean. When I ran the autoruns.exe it came up w some things highlighted in yellow that look suspicious. Can you look at them and see if you know what they are:

cpuz134 File not found: C:\Users\Randy\AppData\Local\Temp\cpuz134\cpuz134_x64.sys

cwkrrtoo File not found: C:\Windows\system32\drivers\cwkrrtoo.sys

dvfyfbnc File not found: C:\Windows\system32\drivers\dvfyfbnc.sys

jxomygok File not found: C:\Windows\system32\drivers\jxomygok.sys

If I were to disable them would that crash my system? Randy

Perfect. Let me know if the issue re-occurs.

As for the Autoruns view, it highlights the records that contain non-existing files in yellow. The first one (cpuz134) is OK, because CPU-Z application extracts this driver to the temporary directory when launched. The remaining three are the suspicious ones, but since Autoruns says these files are not found, it is very likely they were deleted by an antivirus some time ago. You can go on and delete (instead of disabling) all of them, since they are not working anyways.

OK, after reboot got all kinds of error messages. Will attach picture of them. Will wait for your response before I do anything with the messages.

 

[TomasD]

Did what you requested. Will see what happens. Scan w Malewarebytes came up clean. When I ran the autoruns.exe it came up w some things highlighted in yellow that look suspicious. Can you look at them and see if you know what they are:

cpuz134 File not found: C:\Users\Randy\AppData\Local\Temp\cpuz134\cpuz134_x64.sys

cwkrrtoo File not found: C:\Windows\system32\drivers\cwkrrtoo.sys

dvfyfbnc File not found: C:\Windows\system32\drivers\dvfyfbnc.sys

jxomygok File not found: C:\Windows\system32\drivers\jxomygok.sys

If I were to disable them would that crash my system? Randy

Perfect. Let me know if the issue re-occurs.

As for the Autoruns view, it highlights the records that contain non-existing files in yellow. The first one (cpuz134) is OK, because CPU-Z application extracts this driver to the temporary directory when launched. The remaining three are the suspicious ones, but since Autoruns says these files are not found, it is very likely they were deleted by an antivirus some time ago. You can go on and delete (instead of disabling) all of them, since they are not working anyways.

OK, after reboot got all kinds of error messages. Will attach picture of them. Will wait for your response before I do anything with the messages.

OK, these are caused by the ASUS ATK application still trying to launch. Could you please open Program and Features , find "ATK Package" and remove it?

As for the Flash Update window above, it's always a good approach to keep the software up-to-date, so feel free to install the update.

 

[Tekno Venus]

Nice work here Tomas! :thumbsup2:

Sorry for my absence Randy, really busy for me atm.

I saw these ASUS applications in some earlier logs:

Start Menu\Programs\ASUS    Public:Start Menu\Programs\ASUS    Public
Start Menu\Programs\ASUS\ASUS WebStorage    Public:Start Menu\Programs\ASUS\ASUS WebStorage    Public
Start Menu\Programs\ASUS Utility    Public:Start Menu\Programs\ASUS Utility    Public
Start Menu\Programs\ASUS Utility\ASUS Splendid Utility    Public:Start Menu\Programs\ASUS Utility\ASUS Splendid Utility    Public
Start Menu\Programs\ASUS Utility\SmartLogon    Public:Start Menu\Programs\ASUS Utility\SmartLogon    Public

Please uninstall them all from your computer and see how it goes.

Stephen

NOTES - TomasD, feel free to read this. Randy - don't worry about these! :)

Read More:

Spotted this service in MSInfo32

ATKGFNEX Service    ATKGFNEXSrv    Running    Auto    Own Process    c:\program files (x86)\asus\atk package\atkgfnex\gfnexsrv.exe    Normal    LocalSystem    0

GFNEXSrv.exe Windows process - What is it?

You could also completely remove ATK Generic Function Service or PHotkey (Control Panel⇒Add/Remove programs).

From some other logs:

    16269   5/27/2004    8:13:04 PM  "C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASNDIS5.SYS"
     17024   7/26/2010    3:57:20 PM  "C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys"
     17024    9/6/2010   12:26:46 PM  "C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\epcwmiacpi64.sys"
     15928   5/13/2009   11:07:20 AM  "C:\Program Files (x86)\ASUS\ATK Package\ATK0100\Win7_64\ATK64AMD.sys"
     15416    7/2/2009    7:36:14 PM  "C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys"

 

[r4kolb]

Wait to clarify, you want me to remove it? I just went to ASUS and found it and reinstalled it to get rid of it. (Sorry I didn't wait for your response) Should I now uninstall the driver I just installed from ASUS?

[TD="class: word-black-12, width: 26%, bgcolor: #e0e0e0, align: left"]Description [/TD]
[TD="class: word-black-12, width: 74%, align: left"]ATKACPI driver and hotkey-related utilities
[/TD]

[TD="class: word-black-12, bgcolor: #e0e0e0, align: left"]File Size [/TD]
[TD="class: word-black-12, align: left"]

[TD="width: 72%, align: left"]8,01 (MBytes) [/TD]
[TD="width: 28%, align: right"]2010.11.04 update [/TD]

[/TD]

 

[Tekno Venus]

Yes, remove it. Just uninstall anything ASUS related from the computer.

Stephen

 

[r4kolb]

Yes, remove it. Just uninstall anything ASUS related from the computer.

Stephen

Ok I uninstalled the ATK driver but now I get those pop up windows telling me I need to install the drivers every time I boot?????? Randy

 

[TomasD]

Yes, remove it. Just uninstall anything ASUS related from the computer.

Stephen

Ok I uninstalled the ATK driver but now I get those pop up windows telling me I need to install the drivers every time I boot?????? Randy

Could you please run Autoruns, click File -> Run as Administrator, click Save... and attach the saved report here?

 

[r4kolb]

Yes, remove it. Just uninstall anything ASUS related from the computer.

Stephen

Ok I uninstalled the ATK driver but now I get those pop up windows telling me I need to install the drivers every time I boot?????? Randy

Could you please run Autoruns, click File -> Run as Administrator, click Save... and attach the saved report here?

I'm guessing I misunderstand what you are asking for. When I click the autoruns.exe and run as admin then I go to file....save it creates a file AutoRuns.arn which when I try to upload it here it won't let me?

 

[TomasD]

Yes, remove it. Just uninstall anything ASUS related from the computer.

Stephen

Ok I uninstalled the ATK driver but now I get those pop up windows telling me I need to install the drivers every time I boot?????? Randy

Could you please run Autoruns, click File -> Run as Administrator, click Save... and attach the saved report here?

I'm guessing I misunderstand what you are asking for. When I click the autoruns.exe and run as admin then I go to file....save it creates a file AutoRuns.arn which when I try to upload it here it won't let me?

You understood me correctly: the ARN file is what I need. I'm not sure why it doesn't allow you to upload the file here, though. You can either try compressing the file to ZIP and trying to upload it here or upload the file to some other service (e.g. OneDrive).

 

[r4kolb]

Let me know if this is what you wanted. Thanx, Randy

 

[TomasD]

Yes, that's it. Thank you.

Now go ahead and use Autoruns disable (by deselecting) the following under Logon:

Under Logon:

• ASUS Screen Saver Protector
• ASUSPRP
• ASUSWebStorage
• SynAsusAcpi

Under Scheduled Tasks:

• \ACMON

Under Services:

• TurboBoost

Under Drivers:

• TurboB

Reboot the computer afterwards. You shouldn't get any error messages after on startup.

 

[r4kolb]

Yes, that's it. Thank you.

Now go ahead and use Autoruns disable (by deselecting) the following under Logon:

Under Logon:

• ASUS Screen Saver Protector
• ASUSPRP
• ASUSWebStorage
• SynAsusAcpi

Under Scheduled Tasks:

• \ACMON

Under Services:

• TurboBoost

Under Drivers:

• TurboB

Reboot the computer afterwards. You shouldn't get any error messages after on startup.

Did all.....still getting pop ups?

 

[TomasD]

Yes, that's it. Thank you.

Now go ahead and use Autoruns disable (by deselecting) the following under Logon:

Under Logon:

• ASUS Screen Saver Protector
• ASUSPRP
• ASUSWebStorage
• SynAsusAcpi

Under Scheduled Tasks:

• \ACMON

Under Services:

• TurboBoost

Under Drivers:

• TurboB

Reboot the computer afterwards. You shouldn't get any error messages after on startup.

Did all.....still getting pop ups?

Have you really removed everything Asus related using Programs and Features?

 

[r4kolb]

If by remove you mean uncheck then yes. If you mean uninstall no. My question is if I do will I lose features? I noticed my keyboard doesn't light up now? Randy

 

[TomasD]

If by remove you mean uncheck then yes. If you mean uninstall no. My question is if I do will I lose features? I noticed my keyboard doesn't light up now? Randy

Yes, removing (uninstalling) ASUS applications might remove some features as well. My original idea was to simple get rid of atkwmiacpi64.sys for testing purposes, anyhow, as we see it results into error messages. It's up to you how to proceed now:

• You can leave all the ASUS applications installed but disable atkwmiacpi64.sys driver in Autoruns. This will result in error messages after Windows loads, but you would only need to live with that until we confirm if this driver is or is NOT related to these black screens you are getting.
• You can leave all the ASUS applications installed and atkwmiacpi64.sys driver enabled. You won't get any errors and everything will work, but, if the black screens reoccurs, we won't be 100% if it relates to this driver.
• You can remove all ASUS applications and disable atkwmiacpi64.sys. You won't get any errors and we will be sure if that driver is related to black screens, but you will lose some functionality.

By the way, you installed the latest Nvidia drivers, right?

 

[r4kolb]

Sorry for taking so long to reply. I will proceed to do all you said to with uninstalling all the ASUS stuff. Will get back to you if it Black Screens. And yes to video drivers. Randy