Multiple Admin Pgms BSOD Windows 7

[rfrazier]

HI all. I wanted to bounce something off the collective braintrust here. I've literally been working intermittently for months on BSOD's for Windows 7. I have a troubleshooting log file with many dozens, if not hundreds, of lines. I've done almost all the conventional stuff.

Now before we get off on the wrong tangent, since there are literally hundreds of things that can cause BSOD's, I want to focus on a laser specific theory that I'm working on.

I'm pretty confident that the laptop's hardware is functional. I've removed the dust, changed out the thermal paste, etc. Just the other day, I ran a complete AV scan and got through it. That took 14 hours to process over 7 million files. Also, I've run hours and hours of memory tests with Memtest86+ and CPU tests with Prime95, etc. Even under full SSD and CPU stress, the temperatures stay within limits. The AV scan came out clean.

Sometimes the BSOD's manifest after hours of running. Sometimes they manifest after minutes. They are seemingly very random. The BSOD error messages are pretty random, although they frequently involve ntfs.sys. That makes sense since the file system is being heavily used.

I've pretty much narrowed down to MSE (Microsoft Security Essentials) as ONE trigger, but not the only trigger, particularly when it's running a full virus scan either manually or automatically every Sunday morning. The BSOD's seem to occur in conjunction with the AV scan and other things.

So, my basic procedure is to start an AV scan then either let the computer sit or use it depending on my testing procedure at the time and see when it crashes. I log what I'm doing to my test log before starting, then reboot, run a chkdisk, and update my log after a crash.

So, last night, I had been running an AV scan for quite a while with no problem, say 45 minutes.

As a prelude to what follows, I will note that I have UAC (User Account Control) turned all the way up. That means I should get a password request box for anything that requires admin rights.

So, since the AV scan had been running for a while, I decided to start up something else that hadn't been running. So, I started up SpeedFan. This utility measures temperatures. I do not let it control fan speeds. The BIOS handles that.

SpeedFan requires my admin code to start. In less than 5 minutes, the system crashes. AH-HA, I say, the culprit must be SpeedFan. But wait, there's more. I do my standard reboot, update my troubleshooting log, do a chkdisk, shut down a few things that start automatically, etc.

I start googling around for SpeedFan BSOD, etc. I find that yes, indeed, some people reported issues, mostly years ago. I find some advice that says put /NOSCSISCAN or various other things on the command line for SpeedFan.

Now, here's where it gets interesting. I restarted the AV scan. Meanwhile, I start poking around my system finding links in the various startup folders and on the desktop and modifying the startup command for SpeedFan to add that parameter. But, remember that I said SpeedFan requires an admin password to run. And, I couldn't find SpeedFan in either my user account startup nor in the all users startup folder. I couldn't find the link to modify the SpeedFan command during boot.

So, at this point, the AV scan is running. SpeedFan is NOT running. The PC seems plenty happy. In order to find the command that starts SpeedFan during bootup, I decided to start MSCONFIG. This allows you to look at various things that are scheduled to start up automatically. Note that MSCONFIG ALSO requires an admin code to start. So, I start MSCONFIG, type in my admin code, and IMMEDIATELY, the system BSOD's. (Wow, I'm really having fun now!) And, SpeedFan was nowhere in sight.

So, I rebooted, updated my troubleshooting log, ran a chkdisk, and went to bed. I was up too late last night and up too early this morning.

But, here's the point. Speedfan, which I thought was a trigger, wasn't running. AV was running and was happy. The moment I started ANOTHER admin level program besides the AV, the system crashed.

So my new working theory is that the problem is actually occurring when two or more admin level programs try to access the SSD, or maybe the RAM, or even the CPU, at the same time. It obviously doesn't have to be SpeedFan necessarily although it appears that SpeedFan can ALSO cause the crash. Maybe ANY two admin level programs can do it. Maybe it's a bug that's been in Windows forever. Who knows. But, that's my current theory.

I do run several things which require admin rights all the time. Those would be (presumably) AV, TorGuard, SpeedFan, Crystal Disk Info, and an NTP Server Monitor. I will further note that the BSOD's almost never occur when a virus scan is not running, although they sometimes do. I presume this is just due to the statistical fact that the AV is an admin level program and it stresses the PC much harder and more continuously. So, there's more likely to be a collision with something else running.

Well, this got a bit long since it was hard to explain. If you've read this far, I appreciate it. And, I totally appreciate any help anyone can give. Let me know what you think of my multiple admin programs conflicting theory. Thanks in advance.

I DEFINITELY don't want Windows 10 or 11 or a new PC. It would take me 2 months to get it tuned in and declutter and disable all the rubbish and privacy invading stuff.

Sincerely,

May your bits be stable and your interfaces be fast. Ron

 

[Mervyn Haynes]

Sounds like you need Spinrite 7 mate!
Have you tried a windows refresh?

 

[Tazz]

Have you tried a system file scan?

sfc /scannow

I know that when I start getting blue screens or random reboots, usually due to video driver/game issues, that I'll start getting more blue screens with different error messages. System File Scanner usually finds and repairs an error or two. The scan can take a looooong time.

Once there was something that it couldn't fix automatically and it had to download a fresh version of whatever file(s) it was working on. I can't remember the specific command but your favorite search engine should be able to find it.

 

[rfrazier]

Sounds like you need Spinrite 7 mate!

@Mervyn Haynes thanks but both SpinRite and ChkDisk pass with flying colors. I've even cloned the SSD to an HDD and the same problem occurs. I'm pretty it's what's on the SSD rather than the state of the state of the SSD. Windows refresh is definitely in my only if I have to list. But, it's a thought.

sfc /scannow

@Tazz I ran across that advice in a blog and tried it. It didn't turn up anything weird. Gonna do some more troubleshooting and controlled testing with multiple admin level programs.

Thanks both of you for the suggestions. Below are some links to some interesting resources I found.

https://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

https://www.sevenforums.com/tutorials/715-memory-diagnostics-tool.html

https://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

I haven't done the whole driver test / remove / verify thing yet, but may eventually have to. I've been studiously ignoring the problem tonight.

May your bits be stable and your interfaces be fast. Ron

 

[Mervyn Haynes]

I'm pretty it's what's on the SSD rather than the state of the state of the SSD

Have you tried this SSD in another computer. It could be you just have an intermittent hardware fault on your PC and it is nothing to do with the SSD

 

[rfrazier]

Have you tried this SSD in another computer.

@Mervyn Haynes Good question. I actually thought about that. I did a bunch of googling and came to the conclusion that it could be dangerous. Apparently Windows likes to weld itself to the PC much more closely than Linux does. I don't have another identical computer available, and this laptop is a decade old. So, if I boot it on another PC, there's a good chance some of the stuff won't work. Also, what may be more of a concern is that Windows may deactivate itself and think it's not licensed any more. That would definitely be a problem. So, it's a good thought but it's also on my last resort list.

May your bits be stable and your interfaces be fast. Ron

 

[JimWilliamson]

What happens when you turn UAC OFF - and try to run multiple admin needing apps?

 

[rfrazier]

What happens when you turn UAC OFF - and try to run multiple admin needing apps?

@JimWilliamson An interesting idea. I wouldn't want to leave UAC off. But I might try it just for kicks. I haven't had that off ever since I got Windows 7 a decade ago. We'll see.

May your bits be stable and your interfaces be fast. Ron

 

[rfrazier]

OK. Found out something interesting. UAC behaves differently and allows different options depending on whether you're a standard user or an admin user. As a standard user, it only allows two options. 3 of 4) notify me if programs try to install or make changes, or if I make changes, and don't dim the desktop. 4 or 4) notify me if programs try to install or make changes, or if I make changes, AND dim the desktop. I set it to option 3 which is the less severe option. Even if I switch user to admin and change it to something less restrictive. It doesn't stick when I go back to the standard user. We'll see if it has any effect.

Starting MSE full AV scan under the following conditions. This is a pretty standard setup for me. If this fails, I won't bother y'all with every little change to my troubleshooting log. It makes pretty dry reading. (As in I want to throw something at the PC level dry.) I've been ignoring the problem this weekend, but intend to go back to almost nothing running except the AV scan and maybe one other admin level program and see if I can detect a pattern. This troubleshooting is very frustrating as it literally takes hours to test and change even a few parameters. And, if I've shut everything down, I cannot use my programs while testing.

Conditions: (admin level items marked with *)

All admin level programs are running before starting the AV scan. I should not need to enter a password.

UAC level 3 of 4.
task manager ON. resource monitor OFF. troubleshooting log OPEN. torguard ON*. lan cable ON.
speedfan ON*. crystal disk info ON*. NTP monitor and service ON*.
realtime AV protection ON. firefox OFF. brave ON. thunderbird ON. WinAuth ON.
screen saver OFF. terabyte backup notify OFF. write caching ON. pagefile ON.

chkdisk no autofix OK. starting AV scan.

May your bits be stable and your interfaces be fast. Ron

 

[rfrazier]

OK. 20 minutes later. The system crashed within 5 minutes. What's interesting, though, is that it made 5 minutes. I know from other experimentation that the AV system is capable of finishing the entire 14 hour process if not crashed. It does not detect any viruses.

Rebooted. Ran chkdisk. Updated troubleshooting log. Restarted all apps. Re login to LastPass.

Threw cannon ball through PC. Oh, just kidding on that. Since I actually need to use the PC, I'm waiting on further testing tonight. I'm leaving the UAC setting not to dim my screen though.

Possible future plans:

01) Never use AV or realtime protection. (Not desirable.)
02) Use a different AV system. (Not desirable.)
02) Extensive analysis to see what other admin apps along with AV can crash.
03) More exhaustive memory testing. (Not likely the problem.)
04) Exhaustive driver startup, termination analysis. (Very time consuming.)
05) Windows refresh. (Not desirable.)
06) Booting SSD in another PC. (Not Desirable.)

I appreciate all the thoughts and suggestions. I'm really learning how much I don't know.

May your bits be stable and your interfaces be fast. Ron

 

[Mervyn Haynes]

I've even cloned the SSD to an HDD and the same problem occurs

If you have done this why don't you try the clone in another PC? I still think the problem is an intermittent hardware fault in your PC.

 

[rfrazier]

If you have done this why don't you try the clone in another PC?

Hi @Mervyn Haynes Good question. I actually thought about that. I did a bunch of googling and came to the conclusion that it could be dangerous. Apparently Windows likes to weld itself to the PC at install time much more closely than Linux does. I don't have another identical computer available, and this laptop is a decade old. So, if I boot it on another PC, there's a good chance some of the stuff won't work. Also, what may be more of a concern is that Windows may deactivate itself and think it's not licensed any more. That would definitely be a problem if it thinks it's a pirate copy. So, it's a good thought but it's also on my last resort list. It is definitely possible that it's a hardware problem though.

I have some NOT news this morning. Sometimes no news is good news as they say. The AV scan started at 2 AM and it's been running for 7 hours without a crash. That's interesting. All my other admin level programs are running as well as Brave and Thunderbird. Hope I didn't just jinx myself by mentioning it. CPU temp is a balmy 63 C with a 90 C upper limit. SSD temp is a balmy 51 C with a 70 C upper limit. I'm typing this post while the AV is running.

It occurred to me that I almost always put the AV scan window in one corner of the screen so I can watch the file count and status display showing what files are being scanned, etc. But, overnight, the AV scan has been just running from the system tray with the little icon spinning. So, just in case there's some issue with the window and display itself (possibly a long shot), I'm leaving the window closed and leaving it running in the system tray. We'll see.

May your bits be stable and your interfaces be fast. Ron

 

[Mervyn Haynes]

Also, what may be more of a concern is that Windows may deactivate itself and think it's not licensed any more

This will not happen as long as you have a valid win 7 product key. I have reinstalled win 7 many times with my product key, and it has successfully done so every time.

 

[rfrazier]

This will not happen as long as you have a valid win 7 product key.

@Mervyn Haynes I'm only going based on what I read in the Googleverse. But, cloning a PC is not the same as reinstalling. As I understand it Windows fingerprints all the system hardware and will barf if too much changes at once. Gotta watch those pirates. Actually I see both sides of that coin. Anyway, I'm not sure I could even do a full reinstall at this point, considering that Win 7 is no longer supported and drivers and such may not be available. So the licensing issue and the drivers issue is (are?) why I'm reluctant to take the clone drive to another computer.

May your bits be stable and your interfaces be fast. Ron

 

[Intuit]

Do you have a list DMP files from the \Windows\MiniDump folder? If it doesn't exist, create it and Windows should start keeping crash dump logs there which are useful for analysis.

Any other performance issues that may serve as additional clues? Stutters/pauses, graphics display glitches, random programs faulting for examples?

Provide us with a list of the STOP codes. They may not actually be random. Seemingly unrelated STOP codes, some being NTFS, in my experiences are typically SSD or RAM related. For whatever reason HDD (even hybrids) tend to be more consistent with the STOP codes versus SSD. Use SMARTCtl tool to read the stats from your drive and post them. A/V and encryption software operating in the kernel, can also be responsible for generating these errors. Unencrypt and disable their kernel drivers as a means of eliminating these factors. Microsoft Security Essentials can be disabled via Group Policy setting. RAM is good for generating random STOP codes when ASLR is enabled. In the DDR-II and DDR days, reseating them helped, particularly in smoker homes and/or high humidity environments. If you have two modules, run the machine without one for awhile. Then switch to the other module if it keeps crashing. Note whether or not the crashes change. Make sure the modules have the same chips with the same timing characteristics. If you only have a single module, borrow a replacement module to test on. Your biggeset benefit is that it doesn't take long for a crash to occur so you don't have to borrow it for long. (If it's DDR3 DIMM, I have some spares. Might have some SO-DIMM DDR3 but would have to check.) Check BIOS settings and make sure it isn't overclocked. Test your CMOS battery as I've encountered some systems that would do some absolutely weird crap when that battery got low.

 

[Mervyn Haynes]

Win 7 is no longer supported and drivers and such may not be available

When you do a new install you still get all the old updates from windows update. I have even reinstalled XP and get the old updates!

 

[rfrazier]

I want to say THANKS to all who've been reading the thread and responding. I really appreciate it whether the problem gets solved or not.

When you do a new install you still get all the old updates from windows update.

@Mervyn Haynes That is good info to know.

@Intuit I saw your post and read it. I intend to reply later but haven't had a chance to yet. You packed a lot of info to think about into the post.

May your bits be stable and your interfaces be fast. Ron

 

[Intuit]

NirSoft has a BlueScreenView app.

 

[rfrazier]

Hi all. Since you've been so generous in trying to help, I wanted to give an update.

07:49 AM EDT (Way to early to be up.) As of this moment, AV scan has been running 29:39:00 since it started automatically Sunday at 02:00 AM. It has processed 7.16 million files. I have no idea why it's still running and not crashing. But, I'm OK with it. The only 3 things I can think of that have changed are: 1) UAC is now at level 3 vs level 4. That means no screen dimming during an alert. 2) The AV started automatically on Sunday and has been running in the system tray without the window open. I just open the window periodically to check the status and then close it. Usually, I would have the window open to see the stats. 3) I've been trying to pick up the laptop and put it down a bit more gently, although I'm never rough with it anyway.

I have no idea why the AV is running slower at this point, but it appears to be doing that. Maybe an update to the definitions came through in the recent past or something. Maybe the telemetry back to Microsoft detected all my reboots and somebody changed something. Who knows. I have the controls set not to use more than 50% CPU. But, it appears to only be using about 30% for whatever reason. Whatever the reason, it hasn't crashed recently. I hope the trend continues. I have plenty of other useful things to do with the computer besides troubleshooting it. I won't be troubleshooting again until and unless there's a crash. And, since I've been ignoring a bunch of other stuff I need to do, It may be a while before I'm posting again. Although I try to keep up with the forums here, my time to do so is very erratic. I want to thank everyone for all the suggestions.

This was the list of additional possible steps to troubleshoot I had posted a few posts prior to this:

01) Never use AV or realtime protection. (Not desirable.)
02) Use a different AV system. (Not desirable.)
02) Extensive analysis to see what other admin apps along with AV can crash.
03) More exhaustive memory testing. (Not likely the problem.)
04) Exhaustive driver startup, termination analysis. (Very time consuming.)
05) Windows refresh. (Not desirable.)
06) Booting SSD in another PC. (Not Desirable.)

@Intuit provided some good specific advice that I haven't previously replied to. I'm adding these to my possible list of actions. He even offered to share some memory sticks. So, big thanks for all that.

07) DMP files. (Yes the folder and files do exist.)
08) Performance glitches. (Haven't noticed any. Just seemingly random BSOD's usually when AV is scanning.)
09) STOP codes. (Will note if it happens again.)
10) Use SMARTCtl tool to read the stats from your drive. (Good idea.)
11) A/V and encryption software operating in the kernel (I'm not aware of any encryption running in the kernel of my Win 7. I'm not running bitlocker or anything. I really don't want to disable or replace MSE since Win 7 is out of support.)
12) RAM is good for generating random STOP codes when ASLR is enabled. (As far as I know, ASLR is enabled by default. I haven't changed it. The RAM is certainly a possible troubleshooting target.)
13) Check BIOS settings and make sure it isn't overclocked. (I'm not overclocking. I don't think it's possible on this laptop.)
14) Test your CMOS battery (I'm not even sure I can get to it, or if it has one. But, it's an interesting suggestion. I don't think it's losing BIOS settings though.)

So, all together, y'all have come up with a LOT of great suggestions. Thanks very much for that. If the PC starts crashing again, I'll come back here and start working down the list again. If it doesn't crash, well, I'm not going to complain. This has been a royal pain. If the pain gets too great, I'll buy a new Win 10 or Win 11 laptop and spend the next 2 months tweaking it and uninstalling rubbish and de-spystation-ifying it.

Hopefully, some of the other posts I put on the forum are helpful to others. I try to pay it forward.

May your bits be stable and your interfaces be fast. Ron

 

[rfrazier]

Minor update. YAY! The AV scan completed with no crash. It took just over 31:10:00 to run. Don't know why it worked, but I'll take blessings and / or good luck where I can get them!

May your bits be stable and your interfaces be fast. Ron