Isolating BSoD to IDE HD and/or AVG

[jaclaz]

disk.sys

This already tells us something more (not much ), it is definitely something related to one of the devices that use the disk.sys driver, i.e.:

any of the HD's (or the controller, or the cable)

any of the USB disk-like devices (USB sticks, card readers, etc.)

If you check with Regedit the key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Disk

You will see that disk.sys is the "SCSI miniport" driver that is used to acces the devices that you can see in:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Disk\Enum

OR, as it seems probable by now, something somehow interferring with the "normal" behaviour of the driver, like the CD/DVD-ROM, which share the same cable/controller but however use another driver:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum

OR, an actual RAM problem, that the tips from Infiniti25 should have fixed:

http://forums.techarena.in/tips-tweaks/945479.htm

What was the problem with the full memory dump?

You may want to re-check here:

http://www.msfn.org/board/Creating-memory-dumps-t90244.html

what you want to do is (apart having downloaded and installed the debugging tools) to follow just the part titled

Memory dump of the entire system:

jaclaz

[Groonx]

Hi, Jaclaz,

I really appreciate all your help.

My registry, in the places you mention, reads as follows (although the real registry is sure a lot more neat & tidy):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Disk

(Default) REG_SZ (value not set)

AutoRunAlwaysDisable REG_MULTI_SZ Brother RemovableDisk(U)

DependOnGroup REG_MULTI_SZ SCSI miniport

DisplayName REG_SZ Disk Driver

ErrorControl REG_DWORD 0x00000001 (1)

Group REG_SZ SCSI Class

ImagePath REG_EXPAND_SZ system32\DRIVERS\disk.sys

Start REG_DWORD 0x00000000 (0)

Tag REG_DWORD 0x00000002 (2)

Type REG_DWORD 0x00000001 (1)

"You will see that disk.sys is the "SCSI miniport" driver that is used to acces the devices that you can see in:"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Disk\Enum

(Default) REG_SZ (value not set)

0 REG_SZ SCSI\Disk&Ven_ST350032&Prod_OAS&Rev_SD15\4&2765364e0&000000

1 REG_SZ SCSI\Disk&Ven_ST350032&Prod_OAS&Rev_SD15\4&2765364e0&000100

Count REG_DWORD 0x00000002 (2)

NextInstance REG_DWORD 0x00000002 (2)

"OR, as it seems probable by now, something somehow interferring with the "normal" behaviour of the driver, like the CD/DVD-ROM, which share the same cable/controller but however use another driver:"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom

(Default) . . . . . . . . . . . . . .REG_SZ . . . . . . . . . (value not set)

AutoRun . . . . . . . . . . . . . . REG_DWORD . . . . . . . 0x00000001 (1)

AutoRunAlwaysDisable . . . . . . REG_MULTI_SZ . . . . . NEC MBR-7 NEC MBR-7.4 PIONEER CHANGR DRM-1804X PIONEER CD-ROM DRM-6324X PIONEER CD-ROM DRM-624X TORiSAN CD-ROM CDR_C36

DependOnGroup . . . . . . . . . . REG_MULTI_SZ . . . . . . SCSI miniport

DisplayName . . . . . . . . . . . . REG_SZ . . . . . . . . . . CD-ROM Driver

ErrorControl . . . . . . . . . . . . REG_DWORD . . . . . . . 0x00000001 (1)

Group . . . . . . . . . . . . . . . REG_SZ . . . . . . . . . . SCSI CDROM Class

ImagePath . . . . . . . . . . . . . REG_EXPAND_SZ . . . . . system32\DRIVERS\cdrom.sys

Start . . . . . . . . . . . . . . . .REG_DWORD . . . . . . . 0x00000001 (1)

Tag . . . . . . . . . . . . . . . .REG_DWORD . . . . . . . 0x00000002 (2)

Type . . . . . . . . . . . . . . . . REG_DWORD . . . . . . . 0x00000001 (1)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum

(Default) . . . . . . . . . . . . . . REG_SZ . . . . . . . . . . (value not set)

0 . . . . . . . . . . . . . . . . . REG_SZ . . . . . . . . . . SCSI\CDRom&Ven_PIONEER&Prod_DVD_RW_DVR-212D&Rev_1.24\4&2765364e&0&000200

Count . . . . . . . . . . . . . . . . REG_DWORD . . . . . . . 0x00000001 (1)

NextInstance . . . . . . . . . . . . REG_DWORD . . . . . . . 0x00000001 (1)

The two identical-twin Seagate Barracuda SATA hard drives show up there as ST350032.

At the moment, my PATA hard drive is disconnected.

— I didn't know that I owned anything built by either Brother or NEC.

On the back of my box, I have a USB keyboard plugged in, as well as a sending device for a wireless USB mouse.

PCI Cards:

— Those 2 USBs are both on USB slots that are part of a USB PCI-card.

— I have one other PCI-card, which is a wireless network adapter (which I don't need, but it would allow my desktop to function wirelessly).

There are no USB devices on the front ports at the moment.

(Jaclaz, there is one other anomaly I have noticed on my machine. When I insert a USB memory stick or a USB digital camera stick, XP-64 tells me it would like to do a restart to install the appropriate driver. It works without my doing that, but I have never had messagers like that on XP-32.)

I don't think I can get you a memory dump file now, because I am not getting any blue screens now.

_____________________________________

However, on a cold start, I press the front power button, and the monitor comes on but then goes into power-saving mode. Meanwhile, the fans turn in the box and the power button remains illuminated, but there are no sounds for about 2 minutes. Then I hear be-BEEP! (as 2 tones), and the computer comes up. It seems to take a fairly long time to load Windows, but it operates normally until the next full power off. Restarts operate normally.

—This behaviour is the same whether the PATA cable is in use or not.

_____________________________________

Here is another clue—I am sure. But I haven't been able to interpret it:

—Today I bought several new USB sticks. I always format USB sticks as NTFS, using the free hp utility (via Google).

When I placed my new USB stick in the computer, XP-64 said it recognized the new hardware, but a system restart was required for the drivers to be properly installed. (I think that is very strange.) I did the restart.

Then I tried to use the hp utility to format the USB stick. It refused, saying it was write-protected.

So I went into the stick and wrote a textfile and placed it on the stick with no trouble. Also, I copied boot.ini and saved the copy, without any read/write problems.

— However, when I tried again to reformat the USB stick, no, it was write-protected.

So I removed the USB stick and put it in a different computer (xp32) and it used the same hp utility to reformat the same stick as NTFS; no trouble at all.

—Is there any possibility that I have made a terrible mess of my file system on XP-64, and that is affecting the whole computer? Is it possible for files on Windows to have a disruptive effect on the very first things a computer does on startup?

There are so many variables that I am very confused.

Maybe the old IDE/ATA/PATA drivers had a role in it.

— Jaclaz, you said that 5 days ago. Guys, just imagine for a moment that when I nLited my ASCI drivers, I did something wrong. Somewhere earlier in this thread I mentioned I was worried that I had installed the x64 driver only. (nLite warns us that we should not install multiple drivers, so I selected one of two that showed as available: the driver for 64-bit. I thought, but I might have been wrong, that it covered everything a 64-bit system required. But maybe I really was supposed to select BOTH the x64 and the x32 driver that showed there, side by side, in the selection box?????)

— Supposing that was a crucial error, might it have these effects? The entire system is running in SATA mode, as SATA—not as IDE.

So this afternoon I am setting the BIOS back to SATA AS IDE, to see what happens.

Pretty chaotic, huh, Jaclaz? I certainly agree with you that a read-out of a dump would be a far more systematic way to figure this out. But there are no memory dumps now. Oh, by the way (to answer a question of yours), whatever went wrong before was seemingly in my making some kind of error in following the procedure. I made the registry changes, and I had everything set up, but after the experiment, I had only the file I mentioned at the time. The results, such as they were, are detailed above.

Edited December 26, 2008 by Groonx

[infiniti25]

Just a thought but the delay of 1-2 minutes on boot up is most likely being caused by leaving a usb pen drive plugged in. I have seen this causing an issue with one of my really old pen drives, a 128mb ANC, on one of my previous PCs.

Also another question which will probably serve as another test case for the cdrw is: Have you tried a clean, un-nlited x64 xp installation to compare with your nlited one so you know for definite that its not an issue with any drivers you may have included.

[jaclaz]

— I didn't know that I owned anything built by either Brother or NEC.

Rest assured, you don't.

The AutoRunAlwaysDisable is a "standard" XP key.

Evidently the "Brother RemovableDisk", whatever it is, didn't work properly in tests with the Autorun Feature, and the good MS guys added a key to prevent Autorun to EVER run from a "Brother RemovableDisk".

By browsing the Registry you will see a number of these hardware specific "exception" keys, they are all more or less ways to fix incompatibilities between Xp and "strange" hardware.

jaclaz

[Groonx]

I'm going to end this thread, because it is too cumbersome with unanswered questions and such. I think I'll take my computer back to the building stage. I can retain my important data on safe partitions or DVDs, while I take off every vestige of Windows. I have installed xp32 so many times, and I have never had problems like these. I think, as I've said several times, that my SATA drivers may be wrong or incomplete for the system.

I intend to set up the simplest rendition of my basic XP disks that I can, adding only SATA to them.

But I have one last question: why do I find "the media is write-protected"? It seems to be the final curse. This morning, using a different XP in a different hard drive, using Disk Management I deleted a partition which had another XP on it. Then I created a new partitition in that very same location, but when I went to format that new partition, I was stopped with a popup telling me the media was write-protected.

Is that just Microsoft having fun? Were they simply curious as to whether I would then take a baseball bat to the whole system?

I did get around it. I restarted the computer, and I was then able to carry out the format. Those write-protections used to follow the memory dumps I was getting a week ago, although I have not had any of those for a few days now. No blue screens at all.

Anyway, please answer me abou why that format would have been disallowed like that—even though there was no problem in deleting the partition itself and replacing it. Yes, it was a logical partition in an extended series.

Then I'll end this thread.

And thanks very much, everyone, for all your help.

Edited December 27, 2008 by Groonx

[jaclaz]

But I have one last question: why do I find "the media is write-protected"? It seems to be the final curse. This morning, using a different XP in a different hard drive, using Disk Management I deleted a partition which had another XP on it. Then I created a new partitition in that very same location, but when I went to format that new partition, I was stopped with a popup telling me the media was write-protected.

Is that just Microsoft having fun? Were they simply curious as to whether I would then take a baseball bat to the whole system?

I did get around it. I restarted the computer, and I was then able to carry out the format. Those write-protections used to follow the memory dumps I was getting a week ago, although I have not had any of those for a few days now. No blue screens at all.

Anyway, please answer me abou why that format would have been disallowed like that—even though there was no problem in deleting the partition itself and replacing it. Yes, it was a logical partition in an extended series.

It's not easy to give you an exact or proper answer, there could be a number of services running in the background that still locked that partition, you do not specify whether you unmounted the drive before re-partitioning over it .....

....however re-booting after having made changes to the MBR and partition tables is a good idea anyways, guess why the good ol' fdisk REQUIRED that?

http://www.blackviper.com/Articles/OS/fdis.../image1_24.html

jaclaz

[Groonx]

That was a logical partition in an extended series that occupies the entire hard drive. I

1. removed all the data I wanted to keep
   
2. in Drive Management, selected "remove partition"
   
3. which then resulted in that area being designated by Windows as "Free Space". I didn't realize there could be anything operating in free space. The closest I have seen to that is when my brain is attempting to operate in free space, as it has often been required to do of late.
   
4. Then I immediately created a new partition there, which I wanted to format.
   

I had to restart the computer first. It didn't say so; I just thought I'd try that, and it worked.

(Later it seemed strange to me, too, that there was no advisory saying a restart was required, because XP loves to give popups to that effect.)

Maybe in the past I have reformatted the partition and then removed it, although that wouldn't seem right.

Of course it doesn't matter at all; I have no problem with doing a restart. I was puzzled because I didn't remember that happening before, and I've done it so many times. Now that I think of it, those "many times" were likely with XP 32. Perhaps there is a difference between XP 64 and XP 32 procedure there, although Black Viper doesn't mention that.

Tanagers, for those who come later to this thread, are birds. The Tanagra is a tropical family, and only a few of its very bright-coloured members go north in the summer to nest; most remain in their tropical paradises. Im Europe and North America, if you are interested in escaping your computer constraints for awhile, you likely have a few hundred species of birds to see outside your back door; yes, even in the cities. Their voices just come to you along the way, so in waking in the morning, you recognize a dozen or maybe two dozen species from your pillow, and you know them like hearing your friends' voices on the telephone. These are valuable gems in all of our lives, not just to give us a change from computer-consciousness, but also to take us into realms that were here millions of years before any human being.

I wish happiness and love and learning to everyone for 2009.

Carson

Vancouver