BSOD & PerfMon Reports

spluck · Dec 17, 2013

Dell XPS 8500
Windows 8 Home Premium X64 OEM never reinstalled
Hardware & OS - 1 year old
Intel Core i7-3770 3.40 GHz
NVIDIA GeForce GT 640
686 AMIBIOS 1999 L176
Dell Switching Power Supply 460W

Microsoft Updates were installed on the 13th. I installed the latest NVIDIA drivers on Dec 14th after receiving several error msgs. My system also shows Microsoft updates being installed today. I didn't allow any updates today. ?? Anyway, my crash occurred last night while creating a txt document. Did a system restore after the crash - reverted to Dec 10th.

jcgriff2 · Dec 17, 2013

Hi -

Did you actually see a Blue Screen?

There are no BSOD memory dump files in the attached zip file nor is there any indication of dump files located in \windows\minidump on your system.

Regards. . .

jcgriff2

spluck · Dec 18, 2013

jcgriff2 said:
Hi -

Did you actually see a Blue Screen?

There are no BSOD memory dump files in the attached zip file nor is there any indication of dump files located in \windows\minidump on your system.

Regards. . .

jcgriff2

It froze to a black screen with the chimes clock showing. Hard booted to the boot menu. My apologies for not being clearer in my original post.
https://www.sysnative.com/forums/windows-8-|-windows-rt/8021-crashed-corrupt-amd-file.html#post61394

spluck · Dec 18, 2013

To add to the confusion, I just discovered via HijackThis that a bunch of files are missing from my system32 folder.
alg.exe
lsass.exe
fxssvc.exe
msdtc.exe
nvvsvc.exe
locator.exe
snmptrap.exe
spoolsv.exe
sppsvc.exe
UI0Detect.exe
vds.exe
vssvc.exe
wbengine.exe
WmiApSrv.exe

x BlueRobot · Dec 18, 2013

I would firstly suggest running this command in a Administrative Command Prompt:

Code:

sfc /scannow

Please upload the resulting .CBS log file in a zipped folder in your next post.

Code:

%windir%\Logs\CBS

spluck · Dec 18, 2013

CBS log attached.

x BlueRobot · Dec 19, 2013

I'm not a expert at reading at .CBS logs but I don't think that the any files were attempted to even be repaired:

Code:

2013-12-18 15:36:27, Info                  CSI    000006aa [SR] Verify complete
2013-12-18 15:36:27, Info                  CSI    000006ab [SR] Verifying 100 (0x0000000000000064) components
2013-12-18 15:36:27, Info                  CSI    000006ac [SR] Beginning Verify and Repair transaction
2013-12-18 15:36:32, Info                  CSI    000006ad [SR] Verify complete
2013-12-18 15:36:32, Info                  CSI    000006ae [SR] Verifying 100 (0x0000000000000064) components
2013-12-18 15:36:32, Info                  CSI    000006af [SR] Beginning Verify and Repair transaction
2013-12-18 15:36:37, Info                  CSI    000006b0 [SR] Verify complete
2013-12-18 15:36:37, Info                  CSI    000006b1 [SR] Verifying 100 (0x0000000000000064) components
2013-12-18 15:36:37, Info                  CSI    000006b2 [SR] Beginning Verify and Repair transaction
2013-12-18 15:36:42, Info                  CSI    000006b3 [SR] Verify complete
2013-12-18 15:36:42, Info                  CSI    000006b4 [SR] Verifying 100 (0x0000000000000064) components
2013-12-18 15:36:42, Info                  CSI    000006b5 [SR] Beginning Verify and Repair transaction
2013-12-18 15:36:49, Info                  CSI    000006b6 [SR] Verify complete
2013-12-18 15:36:49, Info                  CSI    000006b7 [SR] Verifying 64 (0x0000000000000040) components
2013-12-18 15:36:49, Info                  CSI    000006b8 [SR] Beginning Verify and Repair transaction
2013-12-18 15:36:52, Info                  CSI    000006b9 [SR] Verify complete
2013-12-18 15:36:52, Info                  CSI    000006ba [SR] Repairing 0 components
2013-12-18 15:36:52, Info                  CSI    000006bb [SR] Beginning Verify and Repair transaction
2013-12-18 15:36:52, Info                  CSI    000006bc [SR] Repair complete

Have you looked into a Repair Install? Have you had recent infections or hardware problems?

Tekno Venus · Dec 19, 2013

x BlueRobot said:

I'm not a expert at reading at .CBS logs but I don't think that the any files were attempted to even be repaired:

Code:

2013-12-18 15:36:27, Info                  CSI    000006aa [SR] Verify complete
2013-12-18 15:36:27, Info                  CSI    000006ab [SR] Verifying 100 (0x0000000000000064) components
2013-12-18 15:36:27, Info                  CSI    000006ac [SR] Beginning Verify and Repair transaction
2013-12-18 15:36:32, Info                  CSI    000006ad [SR] Verify complete
2013-12-18 15:36:32, Info                  CSI    000006ae [SR] Verifying 100 (0x0000000000000064) components
2013-12-18 15:36:32, Info                  CSI    000006af [SR] Beginning Verify and Repair transaction
2013-12-18 15:36:37, Info                  CSI    000006b0 [SR] Verify complete
2013-12-18 15:36:37, Info                  CSI    000006b1 [SR] Verifying 100 (0x0000000000000064) components
2013-12-18 15:36:37, Info                  CSI    000006b2 [SR] Beginning Verify and Repair transaction
2013-12-18 15:36:42, Info                  CSI    000006b3 [SR] Verify complete
2013-12-18 15:36:42, Info                  CSI    000006b4 [SR] Verifying 100 (0x0000000000000064) components
2013-12-18 15:36:42, Info                  CSI    000006b5 [SR] Beginning Verify and Repair transaction
2013-12-18 15:36:49, Info                  CSI    000006b6 [SR] Verify complete
2013-12-18 15:36:49, Info                  CSI    000006b7 [SR] Verifying 64 (0x0000000000000040) components
2013-12-18 15:36:49, Info                  CSI    000006b8 [SR] Beginning Verify and Repair transaction
2013-12-18 15:36:52, Info                  CSI    000006b9 [SR] Verify complete
2013-12-18 15:36:52, Info                  CSI    000006ba [SR] Repairing 0 components
2013-12-18 15:36:52, Info                  CSI    000006bb [SR] Beginning Verify and Repair transaction
2013-12-18 15:36:52, Info                  CSI    000006bc [SR] Repair complete

Have you looked into a Repair Install? Have you had recent infections or hardware problems?

Looking quickly over the full, unfiltered CBS log shows no cause for concern.

EDIT - I did just spot on thing from an earlier run of SFC:

Code:

2013-12-17 12:59:03, Info                  CSI    00000009 CSI Store 521370188176 (0x000000796415b990) initialized
2013-12-17 12:59:03, Info                  CSI    0000000a StoreCorruptionRepair transaction begun. WcpVersion: [l:74{37}]"6.2.9200.16683 (win8_gdr.130806-1503)".
2013-12-17 12:59:03, Info                  CSI    0000000b@2013/12/17:17:59:03.158 Starting corruption detection (InnerFlags=5)
2013-12-17 13:08:47, Info                  CSI    0000000c Hashes for file member \SystemRoot\WinSxS\amd64_prncacla.inf_31bf3856ad364e35_6.2.9200.16384_none_fd9c01be8b864efc\Amd64\CNBJ2530.DPB do not match actual file [l:36{18}]"Amd64\CNBJ2530.DPB" :
  Found: {l:32 b:vtQnEr7Syd3/PnZdZRREwnN+psvBqdD95fmOYfwu06Y=} Expected: {l:32 b:n520k714Uu3utHa5JGQ6HQYbZphKhlMWq5pEmfnCDuw=}
2013-12-17 13:08:47, Info                  CSI    0000000d Hashes for file member \SystemRoot\WinSxS\amd64_prncacla.inf_31bf3856ad364e35_6.2.9200.16430_none_fdce12188b615b12\Amd64\CNBJ2530.DPB do not match actual file [l:36{18}]"Amd64\CNBJ2530.DPB" :
  Found: {l:32 b:vtQnEr7Syd3/PnZdZRREwnN+psvBqdD95fmOYfwu06Y=} Expected: {l:32 b:n520k714Uu3utHa5JGQ6HQYbZphKhlMWq5pEmfnCDuw=}
2013-12-17 13:08:47, Info                  CSI    0000000e Hashes for file member \SystemRoot\WinSxS\amd64_prncacla.inf_31bf3856ad364e35_6.2.9200.20531_none_fe58af2da47e1433\Amd64\CNBJ2530.DPB do not match actual file [l:36{18}]"Amd64\CNBJ2530.DPB" :
  Found: {l:32 b:vtQnEr7Syd3/PnZdZRREwnN+psvBqdD95fmOYfwu06Y=} Expected: {l:32 b:n520k714Uu3utHa5JGQ6HQYbZphKhlMWq5pEmfnCDuw=}
2013-12-17 13:09:14, Info                  CSI    0000000f@2013/12/17:18:09:14.213 Corruption detection complete. numCorruptions = 3, Disp = 1.
2013-12-17 13:09:14, Info                  CBS    Repr: CSI meta data corruption found, will commit repair transaction if repair is asked.
2013-12-17 13:09:14, Info                  CSI    00000010@2013/12/17:18:09:14.307 CSI Transaction @0x7969961ab0 initialized for deployment engine {d16d444c-56d8-11d5-882d-0080c847b195} with flags 00000002 and client id [26]"TI5.30341969_2309678521:1/"

See my guide here: https://www.sysnative.com/forums/wi...prncacla-inf-corruptions-windows-8-8-1-a.html and work through Repair Method 1

Stephen

spluck · Dec 19, 2013

By Repair Install you mean 'Refresh', yes? Trying to avoid it if I can. I'm not pleased with this OS at all and don't want to do anything to it if I don't have to. I'm prone to trashing things.

No infections that I am aware of, but I'm running AVG Free at the moment so it's anyone's guess.

The only problem I've had is with NVIDIA drivers. Months ago I had the 'blinking monitor' issue -resolved by installing updated drivers. Last week the monitor flashed and I got a message saying there was a problem with my graphics driver. I found updated drivers and did the 'recommended' install. I'm not a gamer so when I saw the barrage of NVIDIA junk in my running processes I went back and did a custom, clean install.

The system started to slow down but I don't know the exact time frame. Four days after the NVIDIA install it got very slow, then crashed. I did a System Restore and ran tons of scans, all of which were clean, except HijackThis. I don't know what the deal is with them showing so many missing files. I checked my system32 folder and there's only one missing file. WmiApSrv.exe. As for the CBS log, it's Greek to me.

The system has been OK since the Restore but if I install anything there's a slight (but noticeable) drop in speed. Web pages load slower. Programs launch slower. I'm lost.

jcgriff2 · Dec 19, 2013

spluck said:
To add to the confusion, I just discovered via HijackThis that a bunch of files are missing from my system32 folder.
alg.exe
lsass.exe
fxssvc.exe
msdtc.exe
nvvsvc.exe
locator.exe
snmptrap.exe
spoolsv.exe
sppsvc.exe
UI0Detect.exe
vds.exe
vssvc.exe
wbengine.exe
WmiApSrv.exe

For info, HiJackThis is an x86 app and will erroneously report items when executed on an x64 system.

When an x86 app runs on an x64 system and attempts to reference \system32, it is redirected to \syswow64; hence the reason HiJackThis reported the above items as "missing". HJT thought it was in \system32, but it was really in \syswow64.

On an x64 system, \system32 is pure 64-bit; \syswow64 is 32-bit.

One remedy -- the x86 app should reference the virtual copy of \system32 -- which is called \sysnative

Regards. . .

jcgriff2

x BlueRobot · Dec 23, 2013

Please follow Stephen's instructions.

BSOD & PerfMon Reports

spluck

Member

jcgriff2

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)

spluck

Member

spluck

Member

x BlueRobot

Administrator

spluck

Member

Attachments

x BlueRobot

Administrator

Tekno Venus

Senior Administrator, Developer

spluck

Member

jcgriff2

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)

x BlueRobot

Administrator

BSOD & PerfMon Reports

Member

Co-Founder / AdminBSOD Instructor/ExpertMicrosoft MVP (Ret.)

Member

Member

Administrator

Member

Attachments

Administrator

Senior Administrator, Developer

Member

Co-Founder / AdminBSOD Instructor/ExpertMicrosoft MVP (Ret.)

Administrator

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)