Spontaneous reboots, hangs and BSOD extravaganza - Windows 8 x64

[Flitskikker]

Hi all,

I have been having problems with my computer and it's been going on for over a year now. The last months the problems settled down, but the last couple of days, things have started to get worse again. Since I can't locate the problem, I've decided to report here.


Summary

My computer has been suffering from spontaneous reboots, hangs and BSODs.

With spontaneous reboots, I mean that my computer just instantly reboots, without any warning or BSOD. This usually happens at startup: Windows loads and you can hear my HDD load all 3rd party apps that run with startup. As soon as it's supposedly done, my computer reboots. It can also happen when it's done loading and I'm using it for 10 minutes or so, and also during login or before I've even finished typing my password.

Also resume-from-hibernation seems to attract these reboots and hangs. After 10 minutes after I've woken up my computer, it just reboots or it hangs. When it hangs, everything freezes up and the last ~10 milliseconds of sound gets repeated continuously. It sounds like you're in a construction site. Resetting is the only thing I can do when this happens.

Because of this hanging and rebooting during startup, it once screwed my user profile so I had to do a system restore. It had also once damaged a critical boot file so badly, it was impossible to boot up and show the login screen again (BSOD). Safemode also BSOD. SFC couldn't load. Checkdisk couldn't load. Startup Repair didn't work. Something no less than System Restore was able to restore my computer back to its working state.

When I do get BSODs (they are rare), the error message as well as the causing file varies a lot. The only thing that stays the same is WIN8_DRIVER_FAULT, but I wouldn't know which driver it is because of these inconsistencies.

I even get real blue screens every now and then:

And then we have these two errors:

I suppose the one on the right should be somewhat alarming.


System info

· OS - Windows 8.1, 8, 7, Vista ?
Windows 8

· x86 (32-bit) or x64 ?
x64

· What was original installed OS on system?
None (self-built)

· Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)?
RTM version from MSDN

· Age of system (hardware)
Most if it is 4 years old. I added a new PSU and an SSD 2 years ago.

· Age of OS installation - have you re-installed the OS?
Same age as the SSD; 2 years old (and still fast)

· CPU
AMD Phenom II X4 955 @ 3,2 GHz

· Video Card
Club3D Radeon HD 5770 with 1 GB VRAM

· MotherBoard
ASRock 880GMH/USB3

· Power Supply - brand & wattage (if laptop, skip this one)
OCZ ModXStream Pro 600W

· System Manufacturer
Self-built

· Laptop or Desktop?
Desktop


Now what

I already tested my SSD and ran memtest86, but no errors. Also when in a Linux rescue environment, no problems occur, so I doubt hardware is the problem.

I've followed the steps from the BSOD Posting Instructions. Even that seems to be too much effort for my system, because it reboots everytime while generating the msinfo32.nfo file (I tried three times). I've added the TXT export (that seems to work fine) instead.

I've enabled Driver Verifier, so let's hope a BSOD occurs within the next couple of days.

View attachment 9404
View attachment PerfmonReport.zip

I really hope you can help me with this.

Thanks a lot in advance and have a nice day!

Cheers,
Flitskikker

 

[Patrick]

Hi,

Given what you've described, I'd like to immediately start with a Memtest for no less than 8 passes:

Memtest86+:

Download Memtest86+ here:

Memtest86+ - Advanced Memory Diagnostic Tool

Which should I download?

You can either download the pre-compiled .ISO that you would burn to a CD and then boot from the CD, or you can download the auto-installer for the USB key. What this will do is format your USB drive, make it a bootable device, and then install the necessary files. Both do the same job, it's just up to you which you choose, or which you have available (whether it's CD or USB).

Do note that some older generation motherboards do not support USB-based booting, therefore your only option is CD (or Floppy if you really wanted to).

How Memtest works (you don't need to read, it's only for those interested in the specifics):

Memtest uses algorithms (specifically two), namely moving inversion & what is deemed Modulo-X. Essentially, the first algorithm fills the memory with a pattern. Starting at the low address, it checks to see if the pattern was changed (it should not have been), writes the patterns complement, increments the address, and repeats. Starting at the highest address (as opposed to the lowest), it follows the same checklist.

The reason for the second algorithm is due to a few limitations, with the first being that not all adjacent cells are being tested for interaction due to modern chips being 4 to 16 bits wide regarding data storage. With that said, patterns are used to go ahead and ensure that all adjacent cells have at least been written with all possible one and zero combinations.

The second is that caching, buffering and out of order execution will interfere with the moving inversions algorithm. However, the second algorithm used is not affected by this. For starting offsets of 0-20, the algorithm will write every 20th location with a pattern, write all other locations with the patterns complement, repeat the previous one (or more) times, and then check every 20th location for the previously mentioned pattern.

Now that you know how Memtest actually works, it's important to know that the tests it goes through all mean something different. It goes from Test 0 through Test 12, many of which use either one or the other algorithm discussed above, among many other things.

Any other questions, they can most likely be answered by reading this great guide here:

FAQ : please read before posting

Regards,

Patrick

 

[Flitskikker]

Hello Patrick,

Thanks for your reply. I will set it to run tomorrow, because I need this computer for the rest of the day (it's somewhat stable now).
In the meantime, could it be a driver problem (based on the minidumps)?

Thanks,
Flitskikker

 

[Patrick]

Wow! My sincere apologies, I completely missed the collection link mg:

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

2: kd> .trap 0xfffff8801e076230
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80082f7300 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000000 rsp=fffff8801e0763c0 rbp=fffff8801e076439
 r8=fffffa8007802a30  r9=fffff8801e0763c8 r10=fffffa8009966e78
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
00000000`00000000 ??              ???

Interesting, a lot of null registers and most important a null instruction pointer (immediate cause of the crash). This definitely does have the potential to be a driver problem.

---

1. AODDriver2.sys is listed and loaded in your modules list which is AMD Overdrive; also in EasyTune6 for Gigabyte motherboard. Known BSOD issues in Win7 & 8.

Please uninstall either software ASAP! If you cannot find either software to uninstall, or it's not installed, please navigate to the following filepath:

C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys

and rename AODDriver2.sys to AODDriver.2old and then Restart.

2. In your loaded drivers list, dtsoftbus01.sys is listed which is the Daemon Tools driver. Daemon Tools is a very popular cause of BSOD's in 7/8 based systems. Please uninstall Daemon Tools. Alternative imaging programs are: MagicISO, Power ISO, etc.

3. I'd actually like to go ahead and remove and replace ESET for temporary troubleshooting purposes, just to be sure. You can absolutely reinstall it after your issues are solved (provided it's not the problem).

ESET removal - How do I uninstall or reinstall ESET Smart Security/ESET NOD32 Antivirus? - ESET Knowledgebase

Windows Defender (how to turn on after removal)

A.Navigate to Control Panel (with icons). You can do this by hitting Start > Search > Control Panel. Once in Control Panel, change the drop-down from Category to Large and/or Small icons.

B.Among the list of icons, find and click Action Center.

C.Assuming the removal of your prior antivirus software went properly, you will notice for both Spyware and unwated software protection (important) and Virus protection (important), it'll have a button labeled Turn on now. Click this button (it doesn't matter which, as Windows Defender serves as both in Windows 8/8.1).

4.

2: kd> lmvm npf
start             end                 module name
fffff880`1d037000 fffff880`1d043000   npf        (deferred)             
    Image path: \SystemRoot\system32\drivers\npf.sys
    Image name: npf.sys
    Timestamp:        Fri Jun 25 12:50:58 [COLOR=#ff0000]2010[/COLOR]

Do you have NetGroup or WinPcap installed? If either, get them uninstalled.

Regards,

Patrick

 

[Flitskikker]

Hello Patrick,

Thank you for your elaborate response!

I've renamed the AODDriver2.sys file (AMD Overdrive was not installed though) and uninstalled Daemon Tools, WinPcap and VMWare Workstation (one of the filenames was from VMWare, and I didn't use it anymore anyway).

I will try removing ESET tomorrow (I'm using my PC now extensively, so it could be a little risky to remove it now) if the problem has not been fixed.

I'll keep you posted. Thanks!

Cheers,
Flitskikker

 

[Flitskikker]

In the meantime, I got this "VERIFIER_ENABLED" BSOD.

While I only checked non-Microsoft drivers like in the guide, WinDbg says it is caused by volsnap.sys; a Windows component.

For your convenience, my verifier /querysettings output:

Special pool: Enabled
Pool tracking: Enabled
Force IRQL checking: Enabled
I/O verification: Enabled
Deadlock detection: Enabled
DMA checking: Enabled
Security checks: Enabled
Force pending I/O requests: Enabled
Low resources simulation: Disabled
IRP Logging: Enabled
Miscellaneous checks: Enabled
Invariant MDL checking for stack: Enabled
Invariant MDL checking for driver: Enabled
Power framework delay fuzzing: Enabled
DDI compliance checking: Disabled


Verified drivers:


epfwwfp.sys
ndis.sys
eamonm.sys
ehdrv.sys
epfwlwf.sys
atikmpag.sys
atikmdag.sys
amdkmafd.sys
flxhcic.sys
rt630x64.sys
atihdw86.sys
amdacpksl.sys
flxhcih.sys
rtkvhd64.sys
dump_dumpata.sys
dump_atapi.sys
dump_dumpfve.sys
atmfd.dll
mbam.sys
epfw.sys
aoddriver2.sys
secdrv.sys
hamdrv.sys

EDIT: I see aoddriver2.sys in the list, but I did rename the file as you suggested.

Thanks,
Flitskikker

 

[Flitskikker]

Okay, several things happened.

I got a BSOD caused by epfw.sys, an ESET component:
View attachment 092814-16859-01.zip

So I tried to remove ESET, but I got a BSOD during removal:
View attachment 092814-16390-01.zip

Then, my computer would not boot anymore. I got an INACCESSIBLE_BOOT_DEVICE BSOD where the counter didn't move from 0%, so no minidump.
I also got a DRIVER_VERIFIER_IOMANAGER_VIOLATION BSOD, but the minidump seems to be damaged:
View attachment 092814-10953-01.zip

I had to do a system restore and I was left with leftovers from VMWare and ESET that I couldn't uninstall anymore. Fortunately, ESET had a removal tool I could use, but I had to fully remove VMWare manually. I bet there are still traces left.
I also had to re-uninstall DAEMON Tools, WinPcap, etc. and re-rename the AMD driver.

I've created a new restore point now and re-enabled Driver Verifier.

My computer is working again now, but now I don't have reliable anti-virus protection nor a good firewall, and probably the overall stability is not as good as before.

What should I do now?

Thanks,
Flitskikker

 

[Flitskikker]

Now, even with ESET and everything removed, I'm still getting BSODs. It's the same error message and file (volsnap) as in #6.

Thanks,
Flitskikker

 

[Patrick]

Sorry for the late reply.

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)

This is the general bug check code for fatal errors found by Driver Verifier.

BugCheck C4, {[COLOR=#ff0000]1010[/COLOR], fffffa8008165040, fffff98006566c60, fffffa800cbe2000}

Child-SP          RetAddr           Call Site
fffff880`031769f8 fffff803`f3dcc0d0 nt!KeBugCheckEx
fffff880`03176a00 fffff803`f4256a51 [COLOR=#ff0000]nt!MdlInvariantPreProcessing1+0x1c8[/COLOR]
fffff880`03176a70 fffff803`f4254c51 nt!IovpCallDriver1+0x1cd
fffff880`03176bd0 fffff803`f424bcde nt!VfBeforeCallDriver+0x141
fffff880`03176c00 fffff880`01a9149b nt!IovCallDriver+0x35e
fffff880`03176c50 fffff880`01a9259e [COLOR=#ff0000]volsnap!VspDecrementIrpRefCount+0x24b[/COLOR]
fffff880`03176ca0 fffff880`01a91b4e [COLOR=#800080]volsnap!VspWriteVolumePhase35+0xae[/COLOR]
fffff880`03176ce0 fffff880`01a920d3 [COLOR=#006400]volsnap!VspWriteTableUpdatesCompletionLoop+0x5e[/COLOR]
fffff880`03176d10 fffff803`f3c3b075 [COLOR=#0000cd]volsnap!VspWorkerThread+0xc4[/COLOR]
fffff880`03176d50 fffff803`f3cef3b6 nt!PspSystemThreadStartup+0x59
fffff880`03176da0 00000000`00000000 nt!KiStartSystemThread+0x16

volsnap!VspDecrementIrpRefCount+0x24b's MDL buffer contents for its IRP were modified. Please go ahead and disable driver, and now I'd actually like to test your drive. Run Chkdsk + Seatools:

Chkdsk (there are various ways to run Chkdsk):

Method 1:

Start > Search bar > Type cmd (right click run as admin to execute Elevated CMD)

Elevated CMD should now be opened, type the following:

chkdsk x: /r

x implies your drive letter, so if your hard drive in question is letter c, it would be:

chkdsk c: /r

Restart system and let chkdsk run.

Method 2:


Open the "Computer" window
Right-click on the drive in question
Select the "Tools" tab
In the Error-checking area, click <Check Now>.

If you'd like to get a log file that contains the chkdsk results, do the following:

Press Windows Key + R and type powershell.exe in the run box

Paste the following command and press enter afterwards:

get-winevent -FilterHashTable @{logname="Application"; id="1001"}| ?{$_.providername –match "wininit"} | fl timecreated, message | out-file Desktop\CHKDSKResults.txt

This will output a .txt file on your Desktop containing the results of the chkdsk.

If chkdsk turns out okay, run Seatools -

SeaTools | Seagate

You can run it via Windows or DOS. Do note that the only difference is simply the environment you're running it in. In Windows, if you are having what you believe to be driver related issues that may cause conflicts or a false positive, it may be a wise decision to choose the most minimal testing environment (DOS). I always recommend running Seatools in DOS if absolutely possible.

-- Run all tests EXCEPT: Fix All and anything Advanced.

Regards,

Patrick

 

[Flitskikker]

Hellp Patrick,

Thanks for your reply.

volsnap!VspDecrementIrpRefCount+0x24b's MDL buffer contents for its IRP were modified. Please go ahead and disable driver, and now I'd actually like to test your drive.

Which driver are you referring to? Or did you mean Driver Verifier?

My SSD (with Windows) passed Checkdisk and Seatools (Short and Long test) without errors. Should I test my data HDD as well?

I also ran memtest86+ while I was at work, and no errors. I think it did 5 passes.

Thanks,
Flitskikker

 

[Patrick]

Or did you mean Driver Verifier?

Yes, apologies.

My SSD (with Windows) passed Checkdisk and Seatools (Short and Long test) without errors. Should I test my data HDD as well?

Thanks for mentioning you have an SSD. AFAIK, Seatools doesn't even work on SSDs. Is the firmware on the drive 100% up to date?

I think it did 5 passes.

Let it go for 8.

Regards,

Patrick

 

[Flitskikker]

Hello,

It's been a while. I disabled Driver Verifier and left ESET uninstalled and I haven't had BSODs since.

However, my computer still reboots spontaneously. No BSOD, nothing special in Event Viewer. It just reboots out of nowhere.

When I wake my computer up from hibernation, I can work for 15 minutes and then it happens. Sometimes even sequentially (work 15min > reboot > work 1h > reboot > work 30min > reboot etc.)
When I shut down and cold boot it every day, it's even worse. After 30 minutes of constant rebooting (during login, after desktop is shown, during boot logo, any time), it's finally stable to use and doesn't reboot anymore.
When it reboots, you can hear the DVD drive as usual. But sometimes, you can hear the drive several times on a 5 second intervals, while the screen stays black. It seems like it's re-POSTing continuously, as if it can't find the power to boot. Sometimes, it just stops doing this and the screen keeps black. Pressing the reset button doesn't work then, I have to hold the power button until it shuts down completely. Then I can try again.

Because there are no accompanying BSODs, I really can't debug it. I checked the Minidump folder and looked for a MEMORY.DMP - there's nothing generated.
No errors in Event Viewer. Just your typical "The previous shutdown was unexcepted" errors.

memtest86+: 9 passes and nothing found.
Checkdisk and SeaTools: All tests on all drives passed.
SFC /scannow: No errors.

I kept track of the temperatures, and everything is normal. No 100 degrees reboot or something.

I even renewed my PSU (maybe it was faulty and unstable). The same problem.

I'm getting really, really tired of this. My computer is just not reliable anymore, because it just reboots while I'm doing work. This is actually the second time I'm writing this post, because it rebooted while typing it the first time - everything gone.
Furthermore, I don't have much to spend to have it checked at a store or to buy a new one.

I really hope you can help me with this, but what's left for me to try...?

Thanks so much in advance!


Cheers,
Flitskikker

 

[Patrick]

Glad to hear no more BSOD's.

As you've already run Memtest, spontaneous reboots suggest a failing Power Supply. Do you have another one to test?

Regards,

Patrick

 

[Flitskikker]

Hello Patrick,

Thanks for your reply.

I already have installed a new PSU and it did not help, unfortunately. I don't have another PSU to test.

Thanks,
Flitskikker

 

[Patrick]

I even renewed my PSU (maybe it was faulty and unstable). The same problem.

Sorry, missed that!

My only remaining guess left is faulty motherboard. Is there a BIOS update available to try?

Regards,

Patrick

 

[Flitskikker]

Hello Patrick,

Thanks for your reply. I will look for BIOS updates for my motherboard. My SSD firmware is the latest by the way.

In the meantime, I did a cold boot and surprisingly, I got a BSOD at the login screen (KMODE_EXCEPTION_NOT_HANDLED, WIN8_DRIVER_FAULT). This is without ESET and without Driver Verifier, so maybe you can finally find the real cause. :)

Thanks,
Flitskikker

 

[Patrick]

Unfortunately not with a minidump, no.

KMODE_EXCEPTION_NOT_HANDLED (1e)

This indicates that a kernel-mode program generated an exception which the error handler did not catch.

3: kd> k
Child-SP          RetAddr           Call Site
fffff880`012f7838 fffff803`9238d98e nt!KeBugCheckEx
fffff880`012f7840 fffff803`922d959d [COLOR=#ff0000]nt!KiFatalExceptionHandler+0x22[/COLOR]
fffff880`012f7880 fffff803`92300fb4 nt!RtlpExecuteHandlerForException+0xd
fffff880`012f78b0 fffff803`922db302 nt!RtlDispatchException+0x458
fffff880`012f7fc0 fffff803`9226c942 nt!KiDispatchException+0x455
fffff880`012f8680 fffff803`9226b0ba nt!KiExceptionDispatch+0xc2
fffff880`012f8860 00000000`00000082 [COLOR=#4b0082]nt!KiPageFault+0x23a[/COLOR]
fffff880`012f89f8 fffff803`922c043c 0x82
fffff880`012f8a00 fffff803`922bfd30 [COLOR=#0000cd]nt!PpmIdleExecuteTransition+0x47b[/COLOR]
fffff880`012f8c20 fffff803`92296adc nt!PoIdle+0x460
fffff880`012f8da0 00000000`00000000 nt!KiIdleLoop+0x2c

We hit a pagefault transitioning from an idle CPU state, therefore we bugchecked. With this bug check introduced, I am going to say faulty CPU is possible as well aside from possible faulty board. There aren't diagnostics for either, so we'd have to replace one (or both if warranty allows it) and see the outcome.

I will look for BIOS updates for my motherboard.

I checked for you, here - ASRock > 880GMH/USB3

You're on version 1.00, and the latest is 1.50. To be quite honest, not much of importance has changed (at least nothing impacting your issue whatsoever). I wouldn't do the update.

Regards,

Patrick