[SOLVED] Referred here by Tom's Hardware Forums: BSOD Mystery!

[Tekno Venus]

No prob John,

Fragmentation is not noticeable at all with SSDs since access rates are so fast and it doesn't matter where on the disk the files are physically located. On HDDs, files to the physical edge of the disk (I think) are accessed faster than those in the centre. But with an SSD, that can't happen. :)

 

[themagpieswarble]

Alright, the latest:

1. I ran Disk Cleanup and deleted all temp files which cleared up about 1.5 gigs of space
2. I disabled hibernation mode
3. Disk Management now says I have 29.72 GB capacity and 4.74 GB of free space. Good enough?
4. I ran the batch script and have attached the txt file output
5. I ran the WMI EXE and have attached the txt file output

Here is the list of non-Microsoft drivers:

dump_atapi.sys (<unknown>)
dump_dumpata.sys (<unknown>)
dump_dumpfve.sys (<unknown>)
speedfan.sys (<unknown>)
amdiox64.sys (Advanced Micro Systems)
amdxata.sys (Advanced Micro Systems)
rt64win7.exe (Realtek)

I enabled the hidden Administrator account in Safe Mode, turned on the last 3 drivers on this list above in Driver Verifier, and then rebooted. I logged into the Administrator account, and opened Internet Explorer. I was in the middle of installing Flash and Google Chrome on that account and then got the freeze screen with the distorted graphics (screenshots I posted earlier.) Still no BSOD there.

I will say that I don't think I've gotten any BSODs or hard locks in Safe Mode (w/ networking.) Perhaps still could be a driver issue?

I'll be offline on vacation for about a week so I won't be able to try anything new out. Hopefully some of the attached log files tell you guys something. Thanks for everything!

 

[jcgriff2]

3. Disk Management now says I have 29.72 GB capacity and 4.74 GB of free space. Good enough?

Hi -

That's a definite improvement, but Windows 7 will demand more.

I see iTunes is installed. If your iTunes library is on OS SSD, you should consider moving it.

Thanks for running the batch scripts.

I see -0- System Restore points & allocation for future restore points is minimal and the system will likely will not create any.

Shadow Copy Storage association
   For volume: (C:)\\?\Volume{0063df36-7ea8-11e1-a401-806e6f6e6963}\
   Shadow Copy Storage volume: (C:)\\?\Volume{0063df36-7ea8-11e1-a401-806e6f6e6963}\
   [COLOR=#FF0000]Used [/COLOR]Shadow Copy Storage space: [COLOR=#FF0000]65.531 MB[/COLOR] (0%)
  [COLOR=#0000FF] Allocated [/COLOR]Shadow Copy Storage space: [COLOR=#0000FF]320 MB[/COLOR] (1%)
   Maximum Shadow Copy Storage space: 342.282 MB (1%)

At least we know that System Restore is not eating up your SSD.

Your RAM -

[COLOR=#070f14]Kingston ValueRAM 4GB 1066MHz DDR3 (one stick)[/COLOR]

Your Page File shows 2345 MB base allocation size -

Read More:

[COLOR=#FF0000]AllocatedBaseSize[/COLOR]=[B][COLOR=#FF0000]2345[/COLOR][/B]
Caption=C:\pagefile.sys
CurrentUsage=0
Description=C:\pagefile.sys
InstallDate=[COLOR="#800080"][B]20130320[/B][/COLOR]080718.023625-420
Name=C:\pagefile.sys
PeakUsage=0
Status=
TempPageFile=FALSE

^^^ InstallDate=20130320 which = 20 March. Your earliest BSOD was 25 Feb, so the 3/20 date was likely due to the page file being reallocated (& not Windows install date). The system probably reduced (or deleted) the page file due to insufficient SSD space and was unable to (re-)create a 4+ GB page file for the same reason.

I would expect that number to exceed 4 GB (installed physical RAM) by a few hundred MBs, like this (my 4 GB RAM system) -

Read More:

A[COLOR=#FF0000]llocatedBaseSize[/COLOR]=[B][COLOR=#FF0000]4062[/COLOR][/B]
Caption=C:\pagefile.sys
CurrentUsage=76
Description=C:\pagefile.sys
InstallDate=20100626093920.056423-240
Name=C:\pagefile.sys
PeakUsage=255
Status=
TempPageFile=FALSE

For a system to produce BSOD dumps, the Page File allocated base size must > RAM. Please see - https://www.sysnative.com/forums/bs...-information/325-bsods-but-no-dump-files.html

This may be helpful to you to free up additional space & hopefully fix "no-dump" problem - https://www.sysnative.com/forums/bs...-without-pagefile-windows-7-server-08-r2.html

I will say that I don't think I've gotten any BSODs or hard locks in Safe Mode (w/ networking.) Perhaps still could be a driver issue?

Could be a driver issue as 3rd party drivers do not load in Safemode (only networking in this case). Also, less system resources being used; less power demand, etc...

I enabled the hidden Administrator account in Safe Mode, turned on the last 3 drivers on this list above in Driver Verifier, and then rebooted. I logged into the Administrator account, and opened Internet Explorer. I was in the middle of installing Flash and Google Chrome on that account and then got the freeze screen with the distorted graphics (screenshots I posted earlier.) Still no BSOD there.

Until BSOD + freezing solved -
- Remove uTorrent
- Remove Spotify Web Helper
- Remove Vid-Saver

Remove these AMD/ATI items -
- Remove Steady Video
- CCC

See - https://www.sysnative.com/forums/wi...cards-driver-only-installation-procedure.html

I'll be offline on vacation for about a week so I won't be able to try anything new out. Hopefully some of the attached log files tell you guys something. Thanks for everything!

Enjoy your trip!

Regards. . .

jcgriff2

 

[Tekno Venus]

Agree with everything jcgriff2 posted.

Until BSOD + freezing solved -
- Remove uTorrent
- Remove Spotify Web Helper
- Remove Vid-Saver

Spotify Web Helper cannot be uninstalled normally without removing Spotify as a whole. To disable, open Spotify, go to preferences, scroll down and uncheck "allow Spotify to be started from the web"

 

[Laxer]

First off, I am sorry I didn't have time to read the entire post so I might be posting something that someone has already said...

To address John's comment about SSD's constantly "Defraging". This is not true, I can go into detail a bit but it will probably be overkill... (it's hidden below if you want to read)

Read More:

When you delete something on an SSD(or any drive for that matter) it usually just deletes a pointer to that item. Which frees it up to be overwritten later. (This is very highlevel, if you want more detail let me know).

So essentially here is what happens... You download/make a file and it is created in space on the SSD and tells whatever memory management system the OS uses that this space is occupied by that file. If you delete the file all you do is delete the record that tells the memory system that the space is in use. If you then download/make another file you just overwrite the information that was already there. The benefit of doing this is that 1 is faster and 2 you do less writes which gives you a longer life expectancy.

Now onto a bit about defragging. Say you have a full(ish) harddrive and lots of things have been deleted in the past. When you download/make a file it will put the file in whatever space is available. If you have deleted files/etc and don't have a large enough consecutive memory you will have to break it up and store it in multiple locations. Thus the file is fragmented.

Now think about a disk spinning. If the file is not in one consecutive "line" then you will have to read a part, move the laser to another location, read a part... This is why defraging makes your access times faster because you no longer have these extra "seek" times due to the HDD laser moving.

Now lets think about an SSD. There are no moving parts so the seek time is virtually instant. Thus defraging would really improve very little. On top of that the memory in an SSD rather it be SLC or MLC is only rated to do so many read/writes which is far far far less than a mechanical HDD. Therefore, if you defrag it you use up many of these read/writes and shorten the life expectancy for virtually no return.

Finally the meat of my comment...

The 5gbs of freespace on your SSD is fine but you need to move your page file over to a physical harddrive.

Having the pagefile on the SSD not only shortens the life expectancy but it gives little improvements. (many people keep the page file on the SSD but with yours being so small and the little improvement it shouldn't be on there)

FWIW, I have a 120gb SSD with plenty of freespace and still have the page file disabled.

Here is the information on how to disable the pagefile on an SSD and enable it on a physical HDD:

Read More:

Disabling the page file

1. Right click ‘My Computer' and click ‘Properties'.
2. Go to the ‘Advanced System Settings' tab.
3. Click Settings in the ‘Performance' fieldset, then go to the Advanced tab.
4. Click Change in the ‘Virtual memory' fieldset.
5. Click on your SSD drive, select ‘No paging file' and click ‘Set'.
6. Click OK when you're done.

Moving the page file from your SSD to a storage hard drive

1. First disable the page file as described above.
2. Then, click on your preferred HDD drive, select ‘System managed size' (unless you know what you're doing) and click ‘Set'.
3. Click OK when you're done.

Hope I was of some help :wave:

EDIT: on a sidenote, windows 7 should enable TRIM by default for your SSD. The extra program you listed above shouldn't actually be needed. (don't take my word on this, I don't know if the OEM is doing some driver wizardry or something... :lolg:) I would just uninstall it and see if something yells at you, it shouldn't be needed on a newer system.

 

[jcgriff2]

Guys - it was a figure of speech! I wasn't sure what to call it & was wondering if SSDs keep files non-fragmented 100% of the time or not.

So.... SSDs continuously defrag themselves (not sure if that is the correct terminology for SSDs or not)?

 

[Laxer]

Guys - it was a figure of speech! I wasn't sure what to call it & was wondering if SSDs keep files non-fragmented 100% of the time or not.

So.... SSDs continuously defrag themselves (not sure if that is the correct terminology for SSDs or not)?

1. I understand, just was explaining it to you and the OP.
2. I like making you look bad. :lolg:

With that said, the work you do is still amazing and far above my capabilities. :lol:

 

[Vir Gnarus]

Hi guys,

I've been perusing the old crashdumps, and I'm just scratching my head over the stuff it's telling me. Overall the behavior of the CPU is acting very screwy. Every single one I've analyzed so far is very bizarre. I'm seeing crashdumps complaining about memory accessed by instructions that never access memory (like register-to-register movs), ones that complain about completely arbitrary memory address references that have no origin in neither CPU registers nor memory, and other very completely strange behavior. Suffice to say, I really do think the CPU, Motherboard or PSU is at fault here. The SSD may indeed may be a contributor, but I'm kinda not putting my money on that one yet till the rest are taken care of.

Take for example this one:

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: [COLOR=#ff0000]fffff7ff88f64b28[/COLOR], memory referenced.
Arg2: 000000000000000[COLOR=#ff0000]8[/COLOR], value 0 = read operation, 1 = write operation.
Arg3: [COLOR=#ff0000]fffff80002e74b2e[/COLOR], If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030cd100
GetUlongFromAddress: unable to read from fffff800030cd1c0
 fffff7ff88f64b28 Nonpaged pool

FAULTING_IP: 
nt!ExpWaitForResource+5e
fffff800`02e74b2e 81e1001c0000    and     ecx,1C00h

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88002580850 -- (.trap 0xfffff88002580850)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8004d44b50 rbx=0000000000000000 rcx=[COLOR=#ff0000]000000000000a802[/COLOR]
rdx=fffffa80047e7090 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e74b2e rsp=fffff880025809e0 rbp=0000000000000001
 r8=0000000000000000  r9=0000000000007e00 r10=0000000000000004
r11=fffffa80039903a0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!ExpWaitForResource+0x5e:
[COLOR=#ff0000]fffff800`02e74b2e 81e1001c0000    and     ecx,1C00h[/COLOR]
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002f11673 to fffff80002e94c40

STACK_TEXT:  
fffff880`025806e8 fffff800`02f11673 : 00000000`00000050 fffff7ff`88f64b28 00000000`00000008 fffff880`02580850 : nt!KeBugCheckEx
fffff880`025806f0 fffff800`02e92d6e : 00000000`00000008 fffff7ff`88f64b28 fffff900`00000000 fffffa80`04c6ace0 : nt! ?? ::FNODOBFM::`string'+0x43801
fffff880`02580850 fffff800`02e74b2e : fffffa80`04e98838 fffff800`02e747e7 fffff880`009ea180 fffff880`009ea10e : nt!KiPageFault+0x16e
fffff880`025809e0 fffff800`02e99ebc : ffffffff`ffb3b4c0 fffffa80`047e7090 fffffa80`04c6ace0 fffff880`009ea180 : nt!ExpWaitForResource+0x5e
fffff880`02580a50 fffff800`02e9db43 : 00000000`00000001 fffffa80`04d44b50 fffff960`00336f10 00000000`00000001 : nt!ExAcquireResourceExclusiveLite+0x14f
fffff880`02580ac0 fffff960`00115592 : 00000000`00000004 fffffa80`047db090 00000000`00000001 00000000`0000000d : nt!ExEnterPriorityRegionAndAcquireResourceExclusive+0x23
fffff880`02580af0 fffff960`000a50c8 : fffffa80`0000007b 00000000`0000000f fffff880`00000001 ffffffff`80000264 : win32k!RawInputThread+0x982
fffff880`02580bc0 fffff960`00125e9a : fffffa80`00000002 fffff880`02565f40 00000000`00000020 00000000`00000000 : win32k!xxxCreateSystemThreads+0x58
fffff880`02580bf0 fffff800`02e93ed3 : fffffa80`04d44b50 00000000`00000004 000007ff`fffd3000 00000000`00000000 : win32k!NtUserCallNoParam+0x36
fffff880`02580c20 000007fe`fde01eea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01b4fc58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fde01eea


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!RawInputThread+982
fffff960`00115592 44882d0fec2100  mov     byte ptr [win32k!gbValidateHandleForIL (fffff960`003341a8)],r13b

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  win32k!RawInputThread+982

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  50e64bda

FAILURE_BUCKET_ID:  X64_0x50_win32k!RawInputThread+982

BUCKET_ID:  X64_0x50_win32k!RawInputThread+982

Followup: MachineOwner
---------

System complains that completely oddball memory address was referenced, and when checking the instruction that was blamed, it was just an and instruction working on a cpu register, and the cpu register it's working on doesn't even have anything remotely similar in its contents! I think the '8' in the bugcheck arg2 is also kinda weird (I think it means not read or write but execute). Either way, this is the kind of stuff that I'm seeing in all of the crashes. Now, whether it's actually caused by some strange behavior due to the SSD, I'm not sure, but honestly, I think it's best to check the CPU/Mobo/PSU first. A couple of Prime95 runs ought to be in order.

EDIT:

Hold up, here! I'm reviewing the OP, and I noticed the guy is running a 250W PSU with the hardware he's using. I hope this is a typo, and honestly I can't see how the Tom's Hardware forum wouldn't have caught this one, but still, that appears to be one very insufficient PSU for the task. Also having him list it with the chassis makes me think it came with the chassis, which typically are not the best for the job. I'm wondering if the memtest only is working because of the low power load it pushes, but anything heftier and the PSU caves in. Just a thought.

 

[satrow]

EDIT:

Hold up, here! I'm reviewing the OP, and I noticed the guy is running a 250W PSU with the hardware he's using. I hope this is a typo, and honestly I can't see how the Tom's Hardware forum wouldn't have caught this one, but still, that appears to be one very insufficient PSU for the task. Also having him list it with the chassis makes me think it came with the chassis, which typically are not the best for the job. I'm wondering if the memtest only is working because of the low power load it pushes, but anything heftier and the PSU caves in. Just a thought.

It's a mini-ITX 'board using IGP, 1x RAM and an SSD so it should draw 150~175W; you're right about the unknown quality though, and according to the Amazon reviews, CPU fan clearance may be limited by the PSU being directly above it (depending on the CPU position on the 'board) so it may be preheating the cooling draught for the CPU.

 

[themagpieswarble]

EDIT:

Hold up, here! I'm reviewing the OP, and I noticed the guy is running a 250W PSU with the hardware he's using. I hope this is a typo, and honestly I can't see how the Tom's Hardware forum wouldn't have caught this one, but still, that appears to be one very insufficient PSU for the task. Also having him list it with the chassis makes me think it came with the chassis, which typically are not the best for the job. I'm wondering if the memtest only is working because of the low power load it pushes, but anything heftier and the PSU caves in. Just a thought.

It's a mini-ITX 'board using IGP, 1x RAM and an SSD so it should draw 150~175W; you're right about the unknown quality though, and according to the Amazon reviews, CPU fan clearance may be limited by the PSU being directly above it (depending on the CPU position on the 'board) so it may be preheating the cooling draught for the CPU.

Back from vacation and back to troubleshooting the beast. Thanks for the replies while I was gone.

It's strange that my system has been running fine for 6+ months with no issues. You're definitely right about the minimal clearance (1mm? maybe?) between the PSU and the CPU cooling fan. They are right on top of each other. I figured that since the CPU fan is pulling the heat off the CPU and the PSU fan on top of it is pulling that hot air through and out of the case, that it would be no problem. My temps are fine according to CoreTemp. (10 degrees celcius min, 37 degrees celcius max.)

I followed some of the instructions on that 'BSODs, but no Dump Files' link, but I'm kind of confused on what to do? Manually increase the page file size to above my RAM size? I have it set to automatically set by windows at the moment which appears to be the recommended thing to do. Should I move the page file over to my external hard drive like some other poster said earlier? Gah.. so confused.

I'll try running Prime 95 and see what happens. Wish me luck.

 

[themagpieswarble]

Well Prime95 lasted about 1 minute and then gave me the graphic glitch hard lock screen that I posted pictures of earlier. No minidump of course.

BLURRGGHHH. What should I do? I'm about ready to scrap the damn thing and build a whole new MediaPC (just build it in a tower, instead of a stupid cramped mini-PC case.)

Help!

 

[Laxer]

If you only have an SSD in the system no need to move the page file.

The extra space you freed up should be fine.

 

[Vir Gnarus]

Is this recurring for Prime95? As in, can you run Prime95 and see if it triggers a crash again? If so, definitely looks like a bugged CPU or some other internal component (i.e. PSU or mobo). What setting did you use for Prime95? Try doing Torture Test in Blend first, then follow with Large FFTs, regardless if the first one crashes or not. If Blend is ok but Large FFTs bugs out, it's more likely the CPU. If opposite effect, then more likely PSU/Mobo. If both conk out pretty quick, then more likely CPU. Again, all three are potential culprits, but it's just a matter of prioritizing which ones to replace first.

 

[themagpieswarble]

I only have an SSD inside my system, but I always have it connected to that external terabyte via eSata. I use it for storing downloaded movies/shows/etc.

I only ran Prime95 once last night before I had to hit the hay. I tried the Torture Test in Blend first, and it hard locked after about a minute. Without running the Large FFT, sounds like it's PSU/Mobo?

I'll give the Large FFT a go tonight and see how long it lasts before hard locking. It sounds like I'll be replacing all these components soon... blurgh.

 

[Vir Gnarus]

It's necessary to run both to ascertain if the CPU is behind both of them, since the CPU will most of all affect both tests, but mobo will more commonly affect just the Blend test. The PSU will be involved in either considerably, given it's the heart of the entire operation.

 

[themagpieswarble]

Is this recurring for Prime95? As in, can you run Prime95 and see if it triggers a crash again? If so, definitely looks like a bugged CPU or some other internal component (i.e. PSU or mobo). What setting did you use for Prime95? Try doing Torture Test in Blend first, then follow with Large FFTs, regardless if the first one crashes or not. If Blend is ok but Large FFTs bugs out, it's more likely the CPU. If opposite effect, then more likely PSU/Mobo. If both conk out pretty quick, then more likely CPU. Again, all three are potential culprits, but it's just a matter of prioritizing which ones to replace first.

Alright, so Large FFT test conked out after about 5 seconds. So, both Blend and Large FFT conk out under a minute.

That means it's most likely the CPU that's been fried or something? Is there any other test I can run to make sure that's the only problem? Or is it just a matter of slowly replacing all components and spending $500 because there's no way to know for sure?

 

[Vir Gnarus]

Sorry, outside of swapping hardware parts out for known reliable ones, there isn't. There are no software diagnostic tests for PSU and motherboard, and the ones for CPU are quite limited in scope. There's no way from a software perspective to determine if one of those three parts are bad, just because of how integral they are to the operation of everything else. To properly test them, one needs to have access to either replacement parts and/or a diagnostic testing kit to properly test such equipment, neither of which option are particularly cheap and the testing kits require advanced computer knowledge to use properly.

I'm sure you have some kind of manufacturer's warranty for your parts, yes? I recommend putting those to good use before you go off and purchase replacements.

 

[themagpieswarble]

Ah, bummer. Well, I bought all my parts from Amazon new.. so hopefully they're under warranty.

So, contact the motherboard and CPU manufacturer for a replacement? I'll probably just have to buy a new PSU since the one that came with the case is crappy and it sounds like I shouldn't keep using it? I'm also tempted to sell my 32 GB SSD and upgrade to 64.

Is there a particular order of components that I should be replacing in? 1. PSU 2. CPU 3. Motherboard? If there's a bad egg in the group, will it possibly screw up a new component once connected to it?

 

[Vir Gnarus]

Yes, avoid PSUs that come with cases. I recommend starting with the CPU first, then PSU, then mobo.

 

[themagpieswarble]

Should I get them one at a time? Just buy the CPU first, try it out, see if it fixes the problem, and then move on to PSU if I'm still getting the same issue?

p.s: Would love to get some second/third opinions on me moving forward with replacing these replacement parts.