Very Strange, Possibly Explorer Related Issue

LagginTimes

Distinguished
Sep 30, 2009
5
0
18,510
Hello,

Recently I've ran into some strange issues on my laptop. At first it was just some blue screens which I get randomly about once a week. Besides the occasional crash, nothing was out of the ordinary. Last night, however, I got two BSOD's in a row, one right after the other. First one occurred randomly, second one occurred when the desktop was loading. Afterwards, the system ran fine albeit with strange symptoms now.

This morning I had a blue screen again upon desktop loading after a reboot, and I noticed that the stop code was 0x0000007E (this is all that I remember, I don't remember where to check for logs for this information). But now, here are the very strange issues that persisted since last night:

1.) Start menu is screwed up: My Photos, Documents, and Music folders are labeled with what looks like registry keys (i.e., it will display "{FDD3842-[...]83}" instead of "Documents"), and clicking on them does nothing, as if they are dead links that lead to nowhere. The Start Menu remains open in this case. My "user" folder on the top will open an empty folder for about a tenth of a second before it closes automatically. The start menu disappears normally, as if I clicked on an operational folder in this case. The Games folder and every other folder beneath it works properly. There are the *only* problems I have observed with my Start Menu.

2.) Left-side pane on explorer folders is missing. When I open any folder, the usual "preview and filters" pane that shows up on the left is now gone. There is no menu bar below the title bar unless I switch to "Windows classic folder" view. I'm not sure if what controls this interface also controls the System Update and Control Panel->System folders, because if I try to open either System Update or System, I get an empty folder instead of the usual menus. This is the case whether I use the "preview and filters" or "classic folder" views.

My computer is running pretty stable right now besides these problems, and pretty much all my programs work normally. It's just these weird, possibly Explorer-related issues that I have described here that are bothering me.

I have Norton Internet Security and it has detected nothing. I don't download anything from, nor do I browse suspicious websites or pay any attention to suspicious e-mails, so I do not believe a virus is to blame... although it could be a possibility.

Worthy of note: I recently partially compressed and then decompressed C:/ in a temporary effort to save hard drive space.

I'm going to reboot and run checkdisk. Otherwise, I may be out of ideas besides possibly running MemTest to see if the RAM is funky.

Any help or suggestions on this will be greatly appreciated.

Thanks in advance!

EDIT: CheckDisk said drive is clean. Not sure what to do now.
 

fowang

Distinguished
May 30, 2006
1,650
0
19,960
compressing old files doesnt really save space as you still need the space that would have been saved to decompress the files anyway, but hmmm another thing to try is updating drivers also a bios update wouldnt do any harm.
 
Never... and I mean NEVER compress files to save disk space. This will slow your system to a crawl when the computer needs to access the compressed files, because it has to decompress them on the fly. The space you save isn't worth the performance hit.

Other than the stop code, is there anything else on the screen? Look near the top... there should be another message saying something like UNMOUNTABLE_BOOT_VOLUME or IRQ_LESS_THAN_OR_EQUAL. To me, it sounds almost like your hard drive is failing. When checkdisk ran did it do a check for bad sectors or did it just check the file system?
 
At first it was just some blue screens which I get randomly about once a week.

Eventually the frequent, continually occuring stop errors will corrupt the registry. The more often the system 'crashes' the more likely corruption is likely to occur. Perhaps run memtest and check for defective RAM. Something as simple as a bad SATA cable can be the cause of 'daily' system crashes. Eventually the crashes will cause registry corruption. BS can be caused by either system hardware or software. Sounds like the system system registry has already become corrupted and will need to be repaired or reinstalled. It may be too late, but perhaps refer to this this article for help in diagnosing BS's. It does refer to Win XP, but may provide some ideas of how to diagnose a BS.

http://www.pcstats.com/articleview.cfm?articleid=1647&page=4
 

LagginTimes

Distinguished
Sep 30, 2009
5
0
18,510
Okay, I set up WinDbg and checked out the minidump logs. I was incorrect in saying that it crashed twice yesterday night, as it actually crashed three times. Here is the dump log from last night's three BSODs:

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00041790, The subtype of the bugcheck.
Arg2: c08020d8
Arg3: 0000ffff
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41790

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 822e4434 to 820df0e3

STACK_TEXT:
9de45ac4 822e4434 0000001a 00041790 c08020d8 nt!KeBugCheckEx+0x1e
9de45bac 8209ea51 08053000 85336be4 990afcb8 nt!MiUnmapLockedPagesInUserSpace+0x315
9de45be0 819155d5 07f50020 87756aa8 81120018 nt!MmUnmapLockedPages+0x22
9de45c2c 81913203 00958ad8 00000050 00000000 WUDFRd!RdFdoDevice::RdIoReply+0x179
9de45c6c 81925c1d 85336be4 86958ad8 81120018 WUDFRd!RdFdoDevice::RdReply+0x1b9
9de45c90 81928fd5 81120018 00000008 00000000 WUDFPf!WudfLpcMessage::ReplyMessage+0x87
9de45ccc 8192830a 00120000 9e3ffcb8 99175b78 WUDFPf!WdfLpcPort::processMessage+0x266
9de45cec 819270c9 81120000 9e3ffcb8 00000000 WUDFPf!WdfLpcCommPort::processMessage+0x1a4
9de45d68 819274a7 011875b0 819238d9 991cf808 WUDFPf!WdfLpc::WorkerThread+0x122
9de45d70 819238d9 991cf808 9de45dc0 821e7b18 WUDFPf!WdfWorkerThread::WorkerThread+0xc
9de45d7c 821e7b18 991875b0 d08dc537 00000000 WUDFPf!WdfLpc::s_WorkerThread+0x11
9de45dc0 82040a2e 819238c8 991875b0 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
WUDFRd!RdFdoDevice::RdIoReply+179
819155d5 807d0b00 cmp byte ptr [ebp+0Bh],0

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: WUDFRd!RdFdoDevice::RdIoReply+179

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: WUDFRd

IMAGE_NAME: WUDFRd.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47919040

FAILURE_BUCKET_ID: 0x1a_41790_WUDFRd!RdFdoDevice::RdIoReply+179

BUCKET_ID: 0x1a_41790_WUDFRd!RdFdoDevice::RdIoReply+179

Followup: MachineOwner


=====================================================

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00041790, The subtype of the bugcheck.
Arg2: c0802080
Arg3: 0000ffff
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41790

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: taskeng.exe

CURRENT_IRQL: 0

BAD_PAGES_DETECTED: 10

LAST_CONTROL_TRANSFER: from 8209730e to 820434d9

STACK_TEXT:
9f674c20 8209730e 029d0000 02ad0fff 04a608da nt!MiDeleteVirtualAddresses+0x7ce
9f674d4c 8205ca1a ffffffff 023af740 023af734 nt!NtFreeVirtualMemory+0x652
9f674d4c 00000023 ffffffff 023af740 023af734 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0x23


STACK_COMMAND: kb

SYMBOL_NAME: PAGE_NOT_ZERO

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: PAGE_NOT_ZERO

Followup: MachineOwner
---------

*** Memory manager detected 16 instance(s) of page corruption, target is likely to have memory corruption.


===================================================

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c032a9b0, memory referenced
Arg2: 00000000, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82069de1, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82139868
Unable to read MiSystemVaType memory at 82119420
c032a9b0

CURRENT_IRQL: 0

FAULTING_IP:
nt!MmProtectSystemCacheView+94
82069de1 8b1e mov ebx,dword ptr [esi]

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

BAD_PAGES_DETECTED: 1

TRAP_FRAME: 8b36bae4 -- (.trap 0xffffffff8b36bae4)
ErrCode = 00000000
eax=8211a820 ebx=99d319b0 ecx=8211a820 edx=96d42d60 esi=c032a9b0 edi=84983580
eip=82069de1 esp=8b36bb58 ebp=8b36bc2c iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!MmProtectSystemCacheView+0x94:
82069de1 8b1e mov ebx,dword ptr [esi] ds:0023:c032a9b0=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 82069de1 to 8205cd24

STACK_TEXT:
8b36bae4 82069de1 badb0d00 96d42d60 820fa920 nt!KiTrap0E+0x2ac
8b36bc2c 821f31b0 00000002 96d42a20 00000000 nt!MmProtectSystemCacheView+0x94
8b36bc48 821f2e3b 4ba648d4 00000000 96d42a20 nt!HvpReleaseFlushedViews+0x6a
8b36bcd0 821f2061 96d42a20 8b36bcf0 96d42d48 nt!HvWriteHive+0x377
8b36bcf8 821f36de 82101e10 82137ea8 00000000 nt!HvSyncHive+0xa8
8b36bd14 821f3554 82104100 8b36bd36 8b36bd3c nt!CmpDoFlushNextHive+0xdc
8b36bd44 8203a445 00000000 00000000 84983580 nt!CmpLazyFlushWorker+0x9a
8b36bd7c 821d7b18 00000000 4ba649c4 00000000 nt!ExpWorkerThread+0xfd
8b36bdc0 82030a2e 8203a348 00000001 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

SYMBOL_NAME: PAGE_NOT_ZERO

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: PAGE_NOT_ZERO

Followup: MachineOwner
---------

*** Memory manager detected 1 instance(s) of page corruption, target is likely to have memory corruption.



 

LagginTimes

Distinguished
Sep 30, 2009
5
0
18,510
This is from this morning's solitary BSOD:

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 82238c7e, The address that the exception occurred at
Arg3: 8b363b6c, Exception Record Address
Arg4: 8b363868, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!CmpDereferenceView+7
82238c7e 83790800 cmp dword ptr [ecx+8],0

EXCEPTION_RECORD: 8b363b6c -- (.exr 0xffffffff8b363b6c)
ExceptionAddress: 82238c7e (nt!CmpDereferenceView+0x00000007)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 011a0009
Attempt to read from address 011a0009

CONTEXT: 8b363868 -- (.cxr 0xffffffff8b363868)
eax=9a841cc0 ebx=9a841cc0 ecx=011a0001 edx=8209eb49 esi=8ed625e0 edi=8ed622a0
eip=82238c7e esp=8b363c34 ebp=8b363c48 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
nt!CmpDereferenceView+0x7:
82238c7e 83790800 cmp dword ptr [ecx+8],0 ds:0023:011a0009=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

BAD_PAGES_DETECTED: 1

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 011a0009

READ_ADDRESS: GetPointerFromAddress: unable to read from 82180868
Unable to read MiSystemVaType memory at 82160420
011a0009

FOLLOWUP_IP:
nt!CmpDereferenceView+7
82238c7e 83790800 cmp dword ptr [ecx+8],0

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from 8223a194 to 82238c7e

STACK_TEXT:
8b363c30 8223a194 8ed622a0 00000000 00000008 nt!CmpDereferenceView+0x7
8b363c48 82239e3b b5d07f70 00000000 8ed622a0 nt!HvpReleaseFlushedViews+0x4e
8b363cd0 82239061 8ed622a0 8b363cf0 8ed625c8 nt!HvWriteHive+0x377
8b363cf8 8223a6de 82148e10 8217eea8 00000000 nt!HvSyncHive+0xa8
8b363d14 8223a554 8214b100 8b363d36 8b363d3c nt!CmpDoFlushNextHive+0xdc
8b363d44 82081445 00000000 00000000 84983ad0 nt!CmpLazyFlushWorker+0x9a
8b363d7c 8221eb18 00000000 b5d07e60 00000000 nt!ExpWorkerThread+0xfd
8b363dc0 82077a2e 82081348 00000001 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


SYMBOL_NAME: PAGE_NOT_ZERO

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

STACK_COMMAND: .cxr 0xffffffff8b363868 ; kb

BUCKET_ID: PAGE_NOT_ZERO

Followup: MachineOwner
---------

*** Memory manager detected 1 instance(s) of page corruption, target is likely to have memory corruption.