BSOD - file manipulations, dropbox hang?

[newbee_4]

Hello,
Yesterday ---
-- put around 160gb of files from an external drive onto the E drive;
-- searched for a bunch of files to clean up, this was on C, D, and E drives, and deleted a fair number of files, some from seldom-used and probably multiply nested folders;
-- tried to upload some things to Dropbox, which stopped, and I tried to cancel that and redo it a couple of times.

When I restarted I got the BSOD, it stayed at 0% for a while. I turned it off with the power button and mostly is ok after restarting but seems to be having issues when I move/download/upload lots of files? None of my drives is very full.

The TSF folks think I probably have a problem. Sorry I know nothing at all and am actually terrified of hardware but tried to follow the directions.
I could not get cmd to give me info re the power supply etc but I have info from when I ordered the machine from Velocity Micro a couple of years ago.
Windows 10 Pro OEM - originally installed on system
Velocity Micro
Desktop
manufactured/bought I think late 2019 / early 2020
I cannot remember whether I reinstalled the OS
No disc image.
No over- or under- clocking.
Please see attached file re motherboard, power supply, RAM etc - that is from the original Velocity Micro order and I have not changed anything. However when I tried to run cmd shell to get info on the battery etc, I was not able to get that to work.
I ran speccy, please see attached .txt file
I do not know what "Driver verifier" is, I have not changed it but do not know how it is set. I don't think drivers have been updated for a long time though.
No proxy I think??
I use Malwarebytes and whatever is native to Windows for firewall etc software.
For whatever it may mean - I do 99% of everything off a Limited account, I rarely use the Admin account though I did for getting information here. I am the Admin/ owner though. And when I do use the Admin account I mostly use an Admin account that is local to the computer, it is very rare that I log into the Microsoft account.

Looking at Speccy - I am surprised to see Hibernation is enabled and this happened after I had stepped away from the system for a couple of hours, shouldn't have as I am set to never hibernate, will try to attach screenshot.

Please delete first thread, sorry I can't figure out how to do it but this is the one to keep, has more info -- sorry !! I put a reply saying "please delete" in the other thread.

Thank you!

 

[SQx]

Hello newbee_4,

I am SQx and I will be handling your dumps to help you solve the problem.

Please give me some time to look it over and I will get back to you as soon as possible.

 

[newbee_4]

Thank you!

 

[newbee_4]

There are some new problems I have noticed.

My Firefox popup blocker has been continuously set to ON, but popups nonetheless are not being blocked at this time (on several websites). This just started within the past hour, after the other problems in this thread, and on sites where the popup blocker was fine even an hour before.


A couple of times while trying to do backups, I have had an issue where I get a message that the folder or file is already in the new location -- but it shouldn't be, then I get 2 copies of each file in a folder if for example I say to keep both copies.

Thank you again.

 

[newbee_4]

By the way, I just recently installed HEIC Converter from the Microsoft Store ? in case that might be malware? I am even getting popups here on Sysnative.

 

[ubuysa]

Since @SQx was here first I'll defer to them. I will watch this thread however...

 

[newbee_4]

Thank you so much!

 

[newbee_4]

Some more weird things I'm noticing. I created a new local user - and it defaulted to Firefox as browser. I did Firefox refresh, no changes in the weird behaviors. I noticed that Remote Desktop had been installed a couple of weeks ago, could have been during an update but I definitely didnt choose it and have now (I hope) uninstalled it.


on the same new local user account, it stuck a .txt file on the desktop which i think is a legitimate file it copied from my admin desktop, from 2020 it's mbst-clean-results. and it shows as Public Desktop?


Just wondering whether you think this is seeming more like malware rather than a hardware issue.

 

[SQx]

Greetings,

In the event logs I found a lot of events related to the poor health of hard drivers

   2023-11-24T13:55:20.8550000Z        An error was detected on device \Device\Harddisk3\DR3 during a paging operation.
   2023-11-24T16:52:25.1680000Z        The system failed to flush data to the transaction log. Corruption may occur in VolumeId: G:, DeviceName: \Device\HarddiskVolume7.
...
   2023-11-24T16:52:25.1660000Z        {Delayed Write Failed} Windows was unable to save all the data for the file G:\. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
   2023-11-24T16:52:25.1660000Z        {Delayed Write Failed} Windows was unable to save all the data for the file G:\$Mft. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.
   2023-11-24T23:47:55.2180000Z        The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
   2023-11-25T09:14:11.8590000Z        The system failed to flush data to the transaction log. Corruption may occur in VolumeId: G:, DeviceName: \Device\HarddiskVolume8.
....
   2023-11-25T10:57:16.1110000Z        The device, \Device\Harddisk0\DR0, has a bad block.
   2023-11-25T10:57:16.2680000Z        The device, \Device\Harddisk0\DR0, has a bad block.
   2023-11-25T10:57:16.3770000Z        The device, \Device\Harddisk0\DR0, has a bad block.
   2023-11-25T10:57:16.7050000Z        The device, \Device\Harddisk0\DR0, has a bad block.
   2023-11-25T10:57:16.8450000Z        The device, \Device\Harddisk0\DR0, has a bad block.

May I ask to follow the instructions below:
1. Download

Crystal DiskInfo and save it to your Desktop.

• Run the installer to install the program :
• When finished, open the installed program by double clicking on it (please check all hard drivers, click the Disk menu and select your target system disk drive)..
  • Good - There are no problems found, the drive is working properly.
  • Caution - The drive have some problems. (which indicates a drive that you should most likely be thinking about backing up and replacing.)
  • Bad - This usually indicates a drive that’s dead or near death. (! - Back up all important data as soon as possible.)
• Take a screenshot of what you see and post it in your next reply.

 

[newbee_4]

Thank you!
Do you think that would explain my Firefox issues though? Do you think I may have been unlucky enough to get malware at the same time??

Also I noticed I have a 16gb hiberfil.sys file even though my power settings were, I thought, to never hibernate.

Disk G is an external drive and my easiest recourse is to toss it in the trash.
Here is the information for the others --

 

[newbee_4]

I am noticing -- hard disk 3should be Drive E one of the internal drives? I have a C around 500gb and 2 additional 2TB internal drives, then G was an external 2Tb drive.

 

[ubuysa]

Whilst your major problem most likely lies in the storage area as mentioned above, the BSOD was something different. It's always risky making a diagnosis based on just one dump, this may just have been a glitch. In any event, unless this BSOD happens again, I would concentrate on the advice from @SQx.

Your BSOD occurred because a device took too long to complete a power transition...

DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time.
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: ffff8e8e91409060, Physical Device Object of the stack
Arg3: ffff8c0cd929f110, nt!TRIAGE_9F_POWER on Win7 and higher, otherwise the Functional Device Object of the stack
Arg4: ffff8e8e9c0554c0, The blocked IRP

The address of the IRP managing the power transition is in argument 4 above, displaying that IRP gives...

8: kd> !irp ffff8e8e9c0554c0
Irp is active with 4 stacks 3 is current (= 0xffff8e8e9c055620)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  Pending has been returned
     cmd  flg cl Device   File     Completion-Context
 [N/A(0), N/A(0)]
            0  0 00000000 00000000 00000000-00000000 

            Args: 00000000 00000000 00000000 00000000
 [IRP_MJ_POWER(16), IRP_MN_WAIT_WAKE(0)]
            0  0 ffff8e8e91409060 00000000 fffff8056e14fd00-ffff8c0cdff17138 
           \Driver\pci    dxgkrnl!DpiFdoPowerCompletionRoutine
            Args: 00000000 00000000 00000000 00000002
>[IRP_MJ_POWER(16), IRP_MN_SET_POWER(2)]
            0 e1 ffff8e8ea61a6030 00000000 fffff80557179330-ffff8e8ea1ef8070 Success Error Cancel pending
           \Driver\nvlddmkm    nt!PopRequestCompletion
            Args: 00051100 00000001 00000001 00000002
 [N/A(0), N/A(0)]
            0  0 00000000 00000000 00000000-ffff8e8ea1ef8070 

            Args: 00000000 00000000 00000000 00000000

The drivers on the IRP list (dxgkrnl.sys and nvlddmkm.sys) are graphics drivers, so we know already that this is an issue with the graphics card or driver. The IRP_MJ_POWER(16) and IRP_MN_SET_POWER(2) function calls clearly show that this was a power IRP, as expected from the dump bugcheck.

Argument 2 in the dump gives us the address of the device object that Windows uses to manage the device (that was having the power transistion problem). Displaying that gives...

8: kd> !devobj ffff8e8e91409060
Device object (ffff8e8e91409060) is for:
 Cannot read info offset from nt!ObpInfoMaskToOffset
 \Driver\pci DriverObject ffff8e8e8da99720
Current Irp 00000000 RefCount 0 Type 00000023 Flags 00001040
SecurityDescriptor ffffb1857bc79c60 DevExt ffff8e8e914091b0 DevObjExt ffff8e8e914098f8 DevNode ffff8e8e91402c90
ExtensionFlags (0000000000)
Characteristics (0x00000100)  FILE_DEVICE_SECURE_OPEN
AttachedDevice (Upper) ffff8e8e913b4e00 \Driver\ACPI
Device queue is not busy.

The most useful bit of data in there for us is the address of the device node (DevNode). Displaying that gives...

8: kd> !devnode ffff8e8e91402c90
DevNode 0xffff8e8e91402c90 for PDO 0xffff8e8e91409060
  Parent 0xffff8e8e912e3ca0   Sibling 0xffff8e8e914099a0   Child 0xffff8e8ea7a31a20
  InstancePath is "PCI\VEN_10DE&DEV_1F07&SUBSYS_21723842&REV_A1\4&30c250c0&0&0000"
  ServiceName is "nvlddmkm"
  State = DeviceNodeStarted (0x308)
  Previous State = DeviceNodeEnumerateCompletion (0x30d)
  StateHistory[06] = DeviceNodeEnumerateCompletion (0x30d)
  StateHistory[05] = DeviceNodeEnumeratePending (0x30c)
  StateHistory[04] = DeviceNodeStarted (0x308)
  StateHistory[03] = DeviceNodeEnumerateCompletion (0x30d)
  StateHistory[02] = DeviceNodeEnumeratePending (0x30c)
  StateHistory[01] = DeviceNodeStarted (0x308)
  StateHistory[00] = DeviceNodeStartPostWork (0x307)
  StateHistory[19] = DeviceNodeStartCompletion (0x306)
  StateHistory[18] = DeviceNodeStartPending (0x305)
  StateHistory[17] = DeviceNodeResourcesAssigned (0x304)
  StateHistory[16] = DeviceNodeDriversAdded (0x303)
  StateHistory[15] = DeviceNodeInitialized (0x302)
  StateHistory[14] = DeviceNodeUninitialized (0x301)
  StateHistory[13] = DeviceNodeRemoved (0x312)
  StateHistory[12] = DeviceNodeQueryRemoved (0x310)
  StateHistory[11] = DeviceNodeStarted (0x308)
  StateHistory[10] = DeviceNodeEnumerateCompletion (0x30d)
  StateHistory[09] = DeviceNodeEnumeratePending (0x30c)
  StateHistory[08] = DeviceNodeStarted (0x308)
  StateHistory[07] = DeviceNodeEnumerateCompletion (0x30d)
  Flags (0x6c0000f0)  DNF_ENUMERATED, DNF_IDS_QUERIED,
                      DNF_HAS_BOOT_CONFIG, DNF_BOOT_CONFIG_RESERVED,
                      DNF_NO_LOWER_DEVICE_FILTERS, DNF_NO_LOWER_CLASS_FILTERS,
                      DNF_NO_UPPER_DEVICE_FILTERS, DNF_NO_UPPER_CLASS_FILTERS
  CapabilityFlags (0x00600400)  WakeFromD0
                                Unknown flags 0x00600000

The InstancePath value in these gives the VEN & DEV identifier for the device in question. If you lookup VEN_10DE&DEV_1F07 you'll see it's your RTX 2070, this gells with the IRP data above and confirms that this BSOD was caused by a graphics driver or graphics card that failed to complete a power transition in time...

The version of the graphics driver that you have installed (nvlddmkm.sys) dates from July 2022...

8: kd> lmDvm nvlddmkm
Browse full module list
start             end                 module name
fffff807`cef90000 fffff807`d1a3e000   nvlddmkm T (no symbols)        
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\System32\DriverStore\FileRepository\nv_dispig.inf_amd64_ee20464bb4ac57f4\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Browse all global symbols  functions  data
    Timestamp:        Fri Jul 22 03:04:08 2022 (62D9E978)
    CheckSum:         029B8575
    ImageSize:        02AAE000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

The Nvidia driver website has a more recent driver (546.17) dated 14th November 2023, which (amongst other things) 'fixes a random BSOD'. I suggest that you update to this driver at some point - when you have resolved the storage issue. Be sure to do a clean install (via a Custom (Advanced) install. If the BSODs continue afterwards please run the file collection app again and upload a new zip file.

 

[newbee_4]

Thank you for the detailed explanation! But the drives if I'm understanding correctly are still the first concern?

trying to recap to hopefully understand - the C drive which I think must be drive 0, showed bad block in dump but was ok on CrystalDiskInfo. and the one that showed as "caution" on CrystalDiskInfo which is D didn't seem like a problem in the dump.

And - does this have anything at all to with Firefox no longer blocking popups, creating a new user in Windows that defaulted to Firefox instead of Edge which is really strange? or do I have a simultaneous potential malware issue?

 

[ET_Explorer]

does this have anything at all to with Firefox no longer blocking popups

I doubt it, nothing in the dump files that @ubuysa, shows anything about firefox blocking popups.

 

[newbee_4]

But if it is completely unrelated, doesn't that sound like malware?

 

[satrow]

But if it is completely unrelated, doesn't that sound like malware?

No, it's much more likely to be from a rushed install of Firefox in the past, allowing installation to All Users instead of Current User and making/allowing Firefox to be the default browser. Popups are a different matter, highly dependent upon visited sites and actions/inactions of the User during initial visits to sites when popups first occurred.

 

[Jonathan21]

Hello,

I don't want to interfere with your analysis.
Just a note on the Speccy report: a particular reason for Windows Defender to be disabled !!!!

Regards,

 

[ubuysa]

I suggest that the Firefox issue is a Red Herring, it's most likely related to a bad extension. You can try starting Firefox with extensions disabled (google it) and see whether that helps. If you're concerned about malware then run a virus scan.

I would recommend that you continue working with @SQx to resolve what look like storage problems. That seems to be your principal problem.

 

[newbee_4]

Thank you all! I have not heard recently from @SQx ? currently desperately backing up stuff which anyway will take probably a couple of days.

That's interesting about Firefox, I definitely install for all users and usually run it from a Limited account where it's the default browser.


About Speccy and Microsoft Defender- I don't understand? But I think that's my main firewall, what do people like as an alternative?

Thanks!

 

[Jonathan21]

Hi,

Firewall is enabled. Windows Defender antivirus is disabled