Multiple issues in event viewer + laptop freezing regularly

If this issue is happening on other laptops then it's most likely something that you're installing or some hardware that your plugging in (or its driver).

The first thing I'd try would be to unplug all external devices and reboot the laptop (to unload their drivers) then see whether these issues persist.

If it's not external hardware and/or their drivers then the next thing I'd try would be a clean boot of Windows. Initially I'd suggest disabling all third-party services in msconfig and disable all auto-start processes in Task Manager. That of course will mean that most third-party apps and devices either won't load or won't run properly, but what you want to see with it in this state is whether any of your reported issues happen. You need to persevere for as long as you can, several hours at least, because you want to be 100% certain whether or not your issues occur in this clean-boot state.

Let us know what you find. I appreciate it's not going to be much fun, troubleshooting rarely is, but this is the best way to locate your problems.

If this issue is happening on other laptops then it's most likely something that you're installing or some hardware that your plugging in (or its driver).

 

I did notice the below on the boot drive in the installed packages;

Ubuntu -> C:\Program Files\WindowsApps\CanonicalGroupLimited.Ubuntu_2204.3.49.0_x64__79rhkp1fndgsc [2024-03-16] (Canonical Group Limited)

 

I did notice the below on the boot drive in the installed packages;
 

Ubuntu -> C:\Program Files\WindowsApps\CanonicalGroupLimited.Ubuntu_2204.3.49.0_x64__79rhkp1fndgsc [2024-03-16] (Canonical Group Limited)

Edited by ubuysa, 02 April 2024 - 07:35 AM.

Yes I am running ubuntu with WSL1.

I mentioned in my initial post that I had the feeling the issues could come from this, particularly the SSD being 100 % active with no read/write (as seen here https://answers.microsoft.com/en-us/windows/forum/all/ssd-100-activity-but-no-readswrites-system-freezes/1831eff1-590f-48ee-b5af-d9fc24c58e0a).

Could it be related with WSL & google drive/onedrive ?

I also tried to use WSL2 instead of WSL1 but there were no significant impacts.

Also I can downgrade to a stable version of windows and not an insider preview but that will not solve anything because I was already with a stable version before last week.

Edited by froztiz, 02 April 2024 - 09:23 AM.

If that is the common between the 2 of your laptops it would/could be concluded that that is the issue.  But by all means continue on as per instructions.

Google One Drive can cause issues.  That is all.

Please find below the speccy report:

http://speccy.piriform.com/results/EedfdGUV83B5LbyXRPINE17

The SysnativeFileCollectionApp.zip is attached.

Memtest86 did not find any errors.

And here is the result of crystal disk info:

The System and Application logs in that latest upload cover only the 3rd and 4th of April. Are you clearing these logs? Please don't the history in these logs can be useful.

I've gone back and re-read your OP (because I missed the WSL reference at first). You say that these freezes don not happen in Safe Mode? That indicates that the problem is unlikely to be hardware related and is much more likely to be software/driver related. I think we're at the point now where Driver Verifier would be useful.

Driver Verifier subjects selected drivers (typically all third-party drivers) to extra tests and checks every time they are called. These extra checks are designed to uncover drivers that are misbehaving. If any selected driver fails any of the Driver Verifier tests/checks then Driver Verifier will BSOD. The resulting minidump should contain enough information for us to identify the flaky driver. It's thus essential to keep all minidumps created whilst Driver Verifier is enabled.

To enable Driver Verifier do the following:

1. Take a System Restore point and/or take a disk image of your system drive (with Acronis, Macrium Reflect, or similar). It is possible that Driver Verifier may BSOD a driver during the boot process (some drivers are loaded during boot). If that happens you'll be stuck in a boot-BSOD loop.

If you should end up in a boot-BSOD loop, boot the Windows installation media and use that to run system restore and restore to the restore point you took, to remove Driver Verifier and get you booting again. Alternatively you can use the Acronis, Macrium Reflect, or similar, boot media to restore the disk image you took.

Please don't skip this step. it's the only way out of a Driver Verifier boot-BSOD loop.

2. Start the Driver Verifier setup dialog by entering the command verifier in either the Run command box or in a command prompt.

3. On that initial dialog, click the radio button for 'Create custom settings (for code developers)' - the second option - and click the Next button.

4. On the second dialog check (click) the checkboxes for the following tests...

• Special Pool
• Force IRQL checking
• Pool Tracking
• Deadlock Detection
• Security Checks
• Miscellaneous Checks
• Power framework delay fuzzing
• DDI compliance checking

Then click the Next button.

5. On the next dialog click the radio button for 'Select driver names from a list' - the last option - and click the Next button.

6. On the next dialog click on the 'Provider' heading, this will sort the drivers on this column (it makes it easier to isolate Microsoft drivers).

7. Now check (click) ALL drivers that DO NOT have Microsoft as the provider (ie. check all third-party drivers).

8. Then, on the same dialog, check the following Microsoft drivers (and ONLY these Microsoft drivers)...

• Wdf01000.sys
• ndis.sys
• fltMgr.sys
• Storport.sys

These are high-level Microsoft drivers that manage lower-level third-party drivers that we otherwise wouldn't be able to trap. That's why they're included.

9. Now click Finish and then reboot. Driver Verifiier will be enabled.

Be aware that Driver Verifier will remain enabled across all reboots and shutdowns. It can only be disabled manually.

Also be aware that we expect BSODs. Indeed, we want BSODs, to be able to identify the flaky driver(s). You MUST keep all minidumps created whilst Driver Verifier is running, so disable any disk cleanup tools you may have.

10. Leave Driver Verifier running for 48 hours, use your PC as normal during this time, but do try and make it BSOD. Use every game or app that you normally use, and especially those where you have seen it BSOD in the past. If Windows doesn't automatically reboot after each BSOD then just reboot as normal and continue testing. The Driver Verifier generated BSODs are these...

• 0xC1: SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION
• 0xC4: DRIVER_VERIFIER_DETECTED_VIOLATION
• 0xC6: DRIVER_CAUGHT_MODIFYING_FREED_POOL
• 0xC9: DRIVER_VERIFIER_IOMANAGER_VIOLATION
• 0xD6: DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION
• 0xE6: DRIVER_VERIFIER_DMA_VIOLATION

If you see any of these BSOD types then you can disable Driver Verifier early because you'll have caught a misbehaving driver.

Note: Because Driver Verifier is doing extra work each time a third-party driver is loaded you will notice some performance degradation with Driver Verifier enabled. This is a price you'll have to pay in order to locate any flaky drivers. And remember, Driver Verifier can only test drivers that are loaded, so you need to ensure that every third-party driver gets loaded by using all apps, features and devices.

11. To turn Driver Verifier off enter the command verifier /reset in either Run command box or a command prompt and reboot.

Should you wish to check whether Driver Verfier is enabled or not, open a command prompt and enter the command verifier /query. If drivers are listed then it's enabled, if no drivers are listed then it's not.

12. When Driver Verifier has been disabled, navigate to the folder C:\Windows\Minidump and locate all .dmp files in there that are related to the period when Driver Verifier was running (check the timestamps). Zip these files up if you like, or not as you choose. Upload the file(s) to the cloud with a link to it/them here (be sure to make it public).

Edited by ubuysa, 03 April 2024 - 04:10 AM.

Thank you very much ubuysa.

I have not modified anything in the logs and when I look at them, it starts in March 28th, not April.

I have completed the driver verifier step and that is very interesting since I got a BSOD at startup as you expected.

Please find attached the BSOD screen and the dump file for which I added extension "txt" otherwise the system does not let me upload it.

It seems your idea is the correct one: a faulty driver.

Dump files, HTML files and just about anything and everything needs needs to be zipped.  Compression is key for server space. Some for security to be zipped.

The BSOD seems to be linked with glary utilities software as mentioned in the dump file.

I have uninstalled glary utilities and I have restarted driver verifier. No BSOD so far, let's see in the next couple days.

Hi, for future something like that and anything else that is not needed at boot in the Utility Class should be uninstalled.

Then but things back slowly.

Good news though that is possible it. ;=}

Yep, that's a good Driver Verifier triggered dump and you're quite right that the offending driver was GUBootStartup.sys. I would fully uninstall Glary Utilities, for two reasons.

Reason 1: The GUBootStartup.sys driver is two years old now....

0: kd> lmvmGUBootStartup
Browse full module list
start             end                 module name
fffff809`2b780000 fffff809`2b789000   GUBootStartup T (no symbols)           
    Loaded symbol image file: GUBootStartup.sys
    Image path: \??\C:\Windows\System32\drivers\GUBootStartup.sys
    Image name: GUBootStartup.sys
    Browse all global symbols  functions  data
    Timestamp:        Fri Aug 19 10:05:41 2022 (62FF3645)
    CheckSum:         00006B50
    ImageSize:        00009000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

Reason 2: I never recommend, or use, tools like this. They often cause more trouble than they're worth. The Windows Disk Cleanup tool does all you're likely to need, mine runs on a schedule once a week.

Edited by ubuysa, 04 April 2024 - 06:24 AM.

Interesting, I got a BSOD IRQL_NOT_LESS_OR_EQUAL and the dump file mentions KfeCo11X64.sys.

I attached the dump file. Any idea about what it could be ?

I have reinstalled the network driver but noticed that in the task manager, I have two wifi connections: one in 802.11n and one in 802.11ax. I am not sure it is normal.

I also noticed that during the installation of the network driver, there is a short period in which the network components are not working because the old driver is removed and the new one is installed.

During this period, the ssd seems to be with low activity as a normal working computer ( I remind the main issue is that my ssd often goes to 100 % activity while read/write is ~1 MB/s). Like if the issue is linked with the wifi. Anyway, I think I become paranoic and at the moment it seems to work well, I try to correlate with the most obvious thing appearing in my screen ahah

Edited by froztiz, 04 April 2024 - 10:21 PM.

Your Speccy Report at the bottom of it is Network  You can whois the IP addresses to see what you are actual;y connection to.    Does not mean that it is in something that is not running or was not running at time of Report.

Can use Process Explorer or Monitor to see what is going on : https://learn.microsoft.com/en-us/sysinternals/    NOTE : do not do anything if do not know the end results.

EDIT : TCPView as well under Network as is Whois

Did you run MTB ?    

Download Minitoolbox from the below link :
http://www.bleepingcomputer.com/download/minitoolbox/
  Run the tool and only select the following tick boxes.           Tick all the boxes or just the Network and can see what is going on. (does not mean we will look at it)
    -List last 10 Event viewer errors
    -List installed programs
    -List devices
    -List users, partition and memory size
Now click "Go" and Copy/Paste and post the output text in your next reply

Edited by Pkshadow, 04 April 2024 - 11:12 PM.