Isolating BSoD to IDE HD and/or AVG

[Groonx]

Hi, everybody.

This is my brand new first-built system, so "everything" is suspect. I've put on 3 xp64s as I troubleshoot my problem.

Hard Drives = 3

— 2 are 500GB SATAs on SATA Ports 1 and 2

— 1 is a 320GB PATA, as Slave with a Master PATA CD-RW on my only IDE Port. The CD-RW as Master is running perfectly.

Of course the system places the PATA disk as Drive 0, while the SATAs are Drives 1 and 2. That is simply a Windows demand that I can't change.

I want my System Drive to be ( C ) on a SATA drive. It is configured that way, and I did that by removing the PATA HD while I set things up.

That means, when all the drives are connected, that we have

Drive 0 — the single PATA HDD

Drive 1 — a SATA drive with ( C ) as System Partition. (I place my boot XPs on other partitions; never on the System partition.)

Drive 2 — the other SATA drive

The system would "prefer" that Drive 0 had the System ( C ) partition on it. Although that disk checks out fine with Maxtor PowerMax, and I have just done a low-level format on it, I have been a bit reluctant to configure my brand new system on this older PATA hard drive from my previous system. Maybe you think that would be a good idea anyway???

The problem: When all the drives are connected, but not when the single PATA drive—whether it holds data or not—is disconnected, I usually get BSoD Stop 50, Page Fault in Nonpaged Area, which either hangs the system or goes into an automatic restart. After that, the affected drives are write-protected.

Once up and running, however, the computer will operate flawlessly for hours, or all day and all night. The problem occurs on restarts, after Windows is up and looks good, maybe 3 minutes into operation. It has sometimes happened on the instant when I have first pressed a key to ask for any action, as though the keystroke itself wiped out an unstable system.

By installing several xp64s, I have been able to determine what has not been causing this to happen. I am down to 2 suspects, although I could be wrong. But for several days now I have had no trouble at all, with my PATA drive disconnected. (It is disconnected only at its data cable connection at the drive.)

I have been running AVG all this time. AVG was my main suspect until I realized (more or less accidentally) that the problem was linked with that PATA hard drive.

That hard drive is set at Cable Select on Slave, because the cable length makes it very difficult to establish it as Master. It could be done, but this was physically the more practicable arrangement.

Similarly, I could set up Drive ( C ) as System Partition on the PATA hard drive, if that is what it wants. I'd rather not, but I could.

One config I've never done at all is to set the System Partition as anything but ( C ) . Notice I'm talking about the System Partition now—not the Boot Partition(s) containing the Windows XP installations. I have read that it does not actually have to be Drive ( C ) , although every boot partition on the computer will seek to establish boot files on ( C ) .

Or do you think this is AVG interacting badly? AVG worked fine on my older x32 systems, and it is working now when that drive is disconnected, but could AVG be having a contributing influence?

Thanks.

[jaclaz]

I find difficult to believe that AVG is the culprit.

CS (Cable Select) is known to be a trouble maker, there is no reason in the world why you cannot make it Slave with the HD jumpers that is generally speakking more reliacle.

Let's for the moment get just the concept of BOOT and SYSTEM drive disambiguated:

http://homepages.tesco.net/J.deBoynePollar...em-volumes.html

Let's define the bootstrap volume as the one containing NTLDR NTDETECT.COM and BOOT.INI (or bootmgr and BCD).

Let's define the Operating System Volume as the one containing all the rest.

How are the disk partitioned?

Could you re-list the drives, the partitions (or Volumes) specifying which holds what?

Just for the record:

I have just done a low-level format on it

there is no such thing as a low-level format of an IDE/ATA/PATA/SATA hard disk, the most you can have done is a disk wipe.

jaclaz

Edited December 21, 2008 by jaclaz

[Groonx]

Thanks, jaclaz.

—I can set the cables to manual Master/Slave, so I'll try that.

—In Windows, your System partition holds the boot info, and your Boot partition(s) hold the system info. Easy to remember, even though the nomenclature is reversed. In other words, Windows is "booted" on its boot partition; that was why it was so named. But Windows always automatically puts all info for all Windows installs onto one single so-called System drive. That's Windows' own choice of words, although yours works fine. It is just sometimes confusing for people to subsequently hear that their Windows is not necessarily sitting on their system drive, and their boot files are not necessarily sitting on their boot drive(s). (Well, Bill confused fonts and typefaces, too.)

—Partitions: mine are always subject to change, but generally:

Disk 1 SATA 500 GB (I would prefer it to be Disk 0—but that is the PATA disk, which Windows demands must be recognized before any SATA disks)

Primary —this is the only Primary partition on the entire system

C = System only, and related boot files or info I might wish to store there; sometimes temporary files. (In other words, an almost-empty small partition)

Extended

D = xp64 (1)

E = xp64 (2)

F = Program Files

G = data

H = data

Disk 2 SATA 500 GB

Extended

I = xp64 (3) —These xp64 installs (1) (2) and (3) are for test purposes, and so all but one will eventually be taken off.

J = data

K = data

L = data

Disk 0 PATA 320 GB —When this disk is detached at its data connector, the system runs perfectly. When it is attached, the system crashes minutes after Windows seems to be up and functioning; following that crash, the system will run for hours.)

Extended

M = data

N = data

(Unfortunately, this disk will always be called Disk 0, and will be displayed above the other two in Windows' Disk Management, because Windows ALWAYS puts PATA before SATA.)

Oh, I see. Sorry; I meant to say scans; not formats. For others wondering, Maxtor, now Seagate, has a utility to determine whether RMAd disks were eligible for replacement under warranty. After these operations I called low-level formats, but which are properly called low-level scans, the entire disk is written to zeroes, and is guaranteed by Maxtor to be fault-free as new. A Windows format cannot equal such a low-level operation, so the PowerMax utility has long been a favourite used immediately before a disk is to have a clean install of Windows. (PowerMax can be used on various brands; not just Maxtor/Seagates.) When Windows first sees the disk after that, it must initialize it, and then the disk can be formatted. PowerMax was the application used by Maxtor, which was taken over by Seagate; the PowerMax functions are now performed under another name.

Edited December 21, 2008 by Groonx

[infiniti25]

Not sure whether your problem is windows related or not.

Have you overclocked the machine at all? even a little bit? If so tell us full details. Was it CPU multiplier, CPU FSB, RAM:CPU FSB ratio etc etc even ram timings.

Two suspects come to mind. One is chipset drivers, including the ones for the IDE controller. Check Gigabyte's website for updated drivers here http://www.giga-byte.com/Support/Motherboa...?ProductID=2814 based on the model in your signature, Gigabyte GA-MA78GM-S2H ver 1.1.

The second reason is proper bios settings. I say this because you have 8gb ram and 3 hard drives like me. And like me they are attached to a Gigabyte motherboard, although mine is a Q6600 on a P35 chipset, the bios layout is pretty much standard...

With your ram, you should have set the correct timings according to the manufacturers specifications and more importantly the correct operating voltage. The standard is 1.8v for DDR2 per JDEC specifications. I would guess that g.skill requires at least 2.0volts based on my OCZ Gold requiring 2.1v and my crucial ballistix requiring 2.2v.

Next after setting your ram voltage correctly, you should be looking to up the mchv(northbridge voltage). This might appear under a different name being a amd based board which will most likely use an nVidia chipset these days.

I suggest upping the voltage at least +0.1v(possibly appears as +0.100v) because not only do you have 3 drives running from both the SATA and IDE ports you have used all 4 ram slots with 8gb ram. This produces a strain on the chipset (northbridge/mch on intel based systems) and could cause data corruption in either memory or on the storage devices attached to SATA and IDE ports.

Get the hardware part right and your operating system usually doesn't cry unless bad drivers are involved.

*You may have to press Ctrl+F1 on the main bios screen to access the hidden advanced settings such as memory timings and voltage modifiers*

If you cannot boot after modifying the bios, you will need to clear the CMOS by either removing the battery on the motherboard or shorting the CMOS pins as per your manual. Usually the modern Gigabyte motherboards reboot until stable by reducing overclocks or modified ram settings back to defaults to save opening the machine up.

Hope this helps.

[Groonx]

Infiniti, I have just seen your reply this moment, and I want to THANK YOU! I know very little about the BIOS, and I have been going very slowly there—maybe too slowly. Now I shall study exactly what you have said, and I'll carry that out.

No, I have not overclocked anything at all. As you can tell, my system has been built capable of possibly being upgraded to a Phenom. I built it with that in mind, although I may or may not ever do it. If I did eventually upgrade, I believe I could oc this DDR2-1000. Until I learn more, for sure, I want to simply learn how to do these things well. THEN I'll try more adventuresome settings.

Again, I really appreciate these specifics you have supplied me with. I'll report back, likely on the 22nd (tomorrow).

_____________

[Edit] I went to the link site this evening, and I had indeed been there before, when I was really guessing my way through my AHCI driver requirements, which a few days ago I slipstreamed into an nLite disk after failing for days at getting Windows to accept AHCI any other way.

Today, linking from there, I used the private site called DriverAgent as well. DriverAgent claimed I had four drivers that were old, including my IDE ATA controller. I got my replacement drivers from their source companies, and without much trouble I had DriverAgent giving me green circles for every driver it identified in my system. To tell you the truth, I really don'y know exactly which driver it was that satisfied the IDE Controller, but it changed from red to green, so I suppose I covered it okay. How is THAT for having precise knowledge of what one is doing?

Tomorrow I intend to do the BIOS settings. As they don't have red and green circles beside them, I need my brain to be working as well as I can nudge it along.

Edited December 22, 2008 by Groonx

[jaclaz]

Maybe the old IDE/ATA/PATA drivers had a role in it.

You should check your Event Viewer, when such crashes as the ones you describe happen there should be an entry, something like "The device, \Device\Harddisk0\DR0, has a bad block."

Unlike what is hinted in the message, this means often a bad driver or a bad cable/bad connection (which would be compatible with the CS thingie).

jaclaz

[infiniti25]

to keep this topic on topic and wrapped up, you might want to either send me a private pm requesting help with the bios & overclocking, or create a new thread in the hardware section asking for help and pm me the link to your new thread.

OFF TOPIC: don't do any overclocking without reading some guides or seeking help here first, you need to monitor temperature!!!

Glad you got sorted...well it seems you got sorted....maybe post back and confirm no more bluescreens after 48 hours.

[Groonx]

You have both been very helpful. I'll be following all your instructions carefully.

More information:

RAM

DDR2-1000

CAS Latency = CL5

dual channel

As noted by infiniti, there are 2 kits @ 2x2 each, total 4 sticks @ 2GB each; in total they take up all 4 slots, total 8 GB

performance rating by G.Skill is "Performance", middle in G.Skill's series which are called Gaming, High Performance, Performance, Mainstream, Normal

The CPU runs this RAM as DDR2-800.

CRASH DUMP TEXTS from the BSoD crashes—I thought of this when you mentioned the Event Viewer, jaclaz:

[01]OS Major Version:5, Minor Version:2, Build Number:3790, Platform Id:2

[01]wManualLangID = 24951

[01]LangFile_Manual = E:\DOCUME~1\Carson\LOCALS~1\Temp\English.bin

[03] wInitLang = 1033

[03] LangFile_Auto = E:\DOCUME~1\Carson\LOCALS~1\Temp\English.bin

—I received this identical message at least twice, but I had no idea how to interpret it. I have now run the computer for 3-4 days without the PATA drive connected, and I am definitely free of problems at startup.* So now I can say that the problem is definitely with the connection of the older PATA hard drive, which itself works perfectly. Today I am learning about RAM and setting things in my BIOS.

I'll let you both know my progress and results. Again, thank you very much indeed.

____

* Well, apart from a strange tendency for the computer to hesitate at the very first press of the power on button, repeating a particular sound half a dozen times, as though it is having trouble persuading something to work; this is long before the BIOS. I suspect a case wiring problem, but so far I've found nothing; all wires are tight and properly placed. But, er—the restart button does not function, even though its wire is also tight and properly placed in the mobo. (I expect these things to be minor hardware fix-ups that I have to troubleshoot; I hope so.)

Edited December 22, 2008 by Groonx

[jaclaz]

Well, no, strangely enough, I mentioned the Event Viewer meaning the Event Viewer.

http://support.microsoft.com/kb/308427/en-us

jaclaz

[infiniti25]

the ram is pc2-8000(1000mhz) ddr2 if you want to update your sig to read properly. To make it run at 1000mhz you will either need to modify the cpu:ram ratio or overclock the cpu fsb along with the ram fsb (if cpu:ram fsb linked as 1:1, example cpu800mhz:ram800mhz).

refering to your statement "performance rating by G.Skill is "Performance", middle in G.Skill's series which are called Gaming, High Performance, Performance, Mainstream, Normal", that is usually an indicator of the fsb overclock threshold, voltage required and memory timings supported by the modules in the kit.

And again for the pata hard drive problem I still say you need to modify the bios voltage for the northbridge because of the strain of using 4 ram slots & two seperate drive controllers.

Like I said pm me or create a new thread for advice and help with the BIOS. I am willing to spend some time on msn, xfire or skype with you if you want to talk about it

[Groonx]

Jaclaz, that is great! I've stumbled across the Event Viewer from time to time, but from now on, I can see it will be a useful tool—thanks to your pointing it out for me. (I've made a shortcut from Sys32 so I can go straight to it in my own System group.)

I've been scrolling through mine since I read your last post. Unfortunately I didn't record the exact times of the crashes.

Most of the various logs are very quiet. In the System section, I see a few of these warnings:

TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

There are a few of these errors, usually in pairs, as though I were attempting something twice. Following the blue screens, the system would create a no-write state which I had trouble with. Maybe my attempts to write to read-only files caused these (but I'm just guessing):

The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID

{555F3418-D99E-4E51-800A-6E89CFD8B1D7}

to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19). This security permission can be modified using the Component Services administrative tool.

There is almost nothing else that displays as a warning or error. (Some system restores warned me that I'd disconnected my PATA drive so it was missing from the system.)

In any event, from now on I can see this will be a valuable tool. Thanks again.

[infiniti25]

I get the tcp warnings frequently, don't worry too much about those. I think that pops up when you are downloading lots of files or using p2p software which creates lots of connections.

EDIT: The warnings can be a symptom of the standard tcpip.sys file in windows. Search google or the forums for a method to patch your tcpip.sys to increase the half-open connections from 10 to any number you want

as for your other error, first result in google showed http://www.velocityreviews.com/forums/t509...-sid-s1519.html

enjoy

Edited December 22, 2008 by infiniti25

[jaclaz]

Yep, part of the idea of the event log is to clear past logs and re-create the crash.

Then you'll have the exact idea of what happened exactly before the crash.

In any case there should be a number of triplets of I (info) entries showing you that the service was started (source eventlog codes 6005, 6006 and 6009), something like this:

6005 Eventlog service started <- the system booted allright

6009 Microsoft ® Windows ® 5.01. 2600 Service Pack 2 Multiprocessor Free. <- the system is booting allright

6006 Eventlog service stopped <- the system was shut down allright

Basically, if you have a crash, you will find a 6009 and a 6005 (when the system was booted/re-booted after the crash) WITHOUT a corresponding prior 6006 (meaning that the crash didn't give the service the opportunity to stop properly and log the event)

jaclaz

[Groonx]

Okay, I think I've made some progress here. (Please note that I shall not be back after this for 5-6 hours.)

1.

Master and Slave jumpers now positioned as Master and Slave, rather than Cable Select.

— As before, the PATA CD is Master, and the PATA HDD is Slave.

2.

I attached the PATA HDD for the first time in a few days. I turned on the power but I kept my hands away from all keys for the duration:

On startup, it did exactly what it did before. After a minute or two of what looked like a stable Windows screen, there was a blue screen and an automatic restart.

I let it continue into Windows for a second time. Again, after a minute or two, without my touching any keys, there was a (second) blue screen and there would have been a (second) automatic restart, but I turned the power off while it was down.

3.

These are the first instances of the blue screen since I ran the system with the PATA HDD connected a few days ago.

4.

The Event Log showed no warnings or errors.

However, I found the following, extracted from a much longer series of events:

The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xfffffadfc82af9cb, 0x0000000000000000, 0xfffffadf2f5ad290, 0x0000000000000000). A dump was saved in: E:\WINDOWS\Minidump\Mini122208-02.dmp.

5.

Here is more of the Event Log information around that time, with the bugcheck message:

First Blue Screen

11:44 am :46

The IMAPI CD-Burning COM Service service entered the running state.

11:44 am :52

The IMAPI CD-Burning COM Service service entered the stopped state.

11:44 am :59 Tcpip

The system detected that network adapter \DEVICE\TCPIP_{F41AA613-DA59-4D8E-AC53-B0CDE0EFCD86} was connected to the network, and has initiated normal operation over the network adapter.

11:46 am :54 eventlog

Microsoft ® Windows ® 5.02. 3790 Service Pack 2 Multiprocessor Free.

11:46 am :54 eventlog

The Event log service was started.

11:46 am :55 DCOM

The COM sub system is suppressing duplicate event log entries for a duration of 86400 seconds. The suppression timeout can be controlled by a REG_DWORD value named SuppressDuplicateDuration under the following registry key: HKLM\Software\Microsoft\Ole\EventLog.

11:46 am :55 Save Dump

The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xfffffadf84841fe3, 0x0000000000000000, 0xfffffadf2f5ad290, 0x0000000000000000). A dump was saved in: E:\WINDOWS\Minidump\Mini122208-01.dmp.

11:46 am :40 IPSec — [NOTE: This one displays as here, out of time sequence]

The IPSec Driver is starting in Bypass mode. No IPSec security is being applied while this computer starts up. IPSec policies, if they have been assigned, will be applied to this computer after the IPSec services start.

11:46 am :53 Application Popup

Application popup: : \SystemRoot\System32\ATMFD.DLL failed to load

11:46 am :55 Tcpip

The system detected that network adapter \DEVICE\TCPIP_{F41AA613-DA59-4D8E-AC53-B0CDE0EFCD86} was connected to the network, and has initiated normal operation over the network adapter.

11:47 am :11 AeLookup Svc

The Application Experience Lookup service started successfully.

. . . . . . . . . . . . . .

Second Blue Screen

11.52 am :03 Save Dump

The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xfffffadfc82af9cb, 0x0000000000000000, 0xfffffadf2f5ad290, 0x0000000000000000). A dump was saved in: E:\WINDOWS\Minidump\Mini122208-02.dmp.

compared with the other:

11:46 am :55 Save Dump

The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xfffffadf84841fe3, 0x0000000000000000, 0xfffffadf2f5ad290, 0x0000000000000000). A dump was saved in: E:\WINDOWS\Minidump\Mini122208-01.dmp.

@Jaclaz, I am afraid that what I have been calling a crash has been a hang or else an automatic restart following a bugcheck.

Er—I apologize if my unskilled vernacular is once again at fault.

6.

RAM and BIOS

I have looked but not touched anything, so far:

"Intelligent Tweaker"

DRAM Configuration

DDRII Timing Items [Auto] [Manual]

Auto — under SPD and Auto:

CAS # Latency = 5T

RAS to CAS R/W Delay = 5T

Row Precharge Time = 5T

Minimum RAS Active Time = 15T

System Voltage Control [Auto] [Manual]

DDR2 Volt Control = Normal [+0.1, +0.2, +0.3]

Northbridge Volt Control = Normal [+0.1, +0.2, +0.3]

CPU Voltage Control = Normal [1.6000V to 1.9000V, in increments]

Normal CPU Vcore = 1.3500V

7. Hard Disk Priority is set as:

SCSI-0 ST3500320AS — This is my first 500GB SATA drive

SCSI-1 ST3500320AS

Ch0 S ST 3320620A — This is my older 320GB PATA drive, whose presence coincides with the blue screens

Edited December 22, 2008 by Groonx

[cluberti]

All the bugchecks are Stop 0x50's, meaning an invalid memory location was referenced. So, either it is a driver, or you have bad hardware. Would you be able to get a complete memory dump from the box the next time it occurs, and then compress/upload it somewhere so we could look? It'd remove some of the guesswork.