BSOD with uT open

[felixalias]

Hey,

Although I doubt it's a fault with uTorrent, I only get BSODs with uTorrent open.

HijackThis log contains nvsvc32.exe (NVIDIA display) and my Creative Sound drivers. GMER turns up absolutely nothing. LSPFix shows only default LSPs (this is not a malware problem either). CCleaner has removed just a few old installer entries.

I started having BSODs a while back. They aren't all that frequent, I can still complete torrents. It feels completely arbitrary.

I ran WD tools on my two drives (both are WD, one is internal, one external) - The internal one had some bad sectors that wouldn't repair properly, so I replaced it with a fresh caviar black. On the new drive, there are no errors (full chkdsk with bad sector repairs on both drives, both pass all SMART and WD tests). Also defragged both with PerfectDisk. Both drives are NTFS. Other (I imagine) IO heavy programs do not trigger it - Sony Vegas, World of Warcraft, and FRAPS (and Crysis/GTAIV though I don't know if those are as heavy). FRAPS and Vegas run on the external drive, World of Warcraft data is on the internal. Admittedly, I don't FRAPS for more than 10 minutes, but still.

Memtest86+ runs for 24 hours without an error (did this twice). I've tried prime95 for ~30 mins on each option, no errors reported (I didn't bother going further). When I BSOD I'm at a reasonable temperature. Furmark runs fine for as long as I tested (1 hour).

I updated my NIC drivers (RTL8192 I believe, Windows shows as Realtek RTL8101E Family PCI-E FE). No difference. Also updated NVIDIA drivers to latest WHQL. Board is an ASRock ConRoe 1333-DDR2 (Intel 945GC chipset).

NO additional firewall/anti-virus is installed (I can manage my own computer just fine).

As for the BSODs themselves, I have saved about 6 minidumps. From analysis, they generally vary between BAD_POOL_HEADER, NTFS_FILE_SYSTEM, and IRQL_NOT_LESS_OR_EQUAL. Running them through the debugging tools, the image that crashed varies, but often is ntfs.sys, afd.sys, or tcpip.sys. I can post the minidumps if needed.

My torrents write to the external drive, which is a USB 2.0 LaCIE drive containing a 1TB WD. This is formatted NTFS. Write caching is enabled on this drive.

I have not adjusted uTorrent disk caching options. I am running the latest 1.9 alpha, however this has also occurred with 1.8.2.

Any suggestions, or additional information needed? I really want to fix this.

Forgot to mention; this occurs both while seeding and downloading. Have used files from 100MB to 11GB.

[Ultima]

>_>

You deserve praise for the very detailed reporting -- thanks for that!

Have you tried running µTorrent without the external drive to see if the problem persists? That is, try downloading to the internal drive only for a while? USB devices are often notorious for having bad/BSOD-inducing drivers and the likes.

As well, just to be sure, please grab your list of running processes (get both):

a) get HijackThis from trendsecure.com, run it, view the log, and post the contents here

get Process Explorer from sysinternals.com, run it, Ctrl+D (to show the lower DLL pane), select the µTorrent process from the list, Ctrl+S (and save the list somewhere you'll find easily -- like the Desktop), then post the contents of the saved process list in the .txt file here

[felixalias]

HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:21:13 PM, on 5/7/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\Fraps\fraps.exe
C:\Documents and Settings\Felixalias\Desktop\Felixstuffwin\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 2003 bytes

(Yes, I do have two ventrilo's open)

Process    PID    CPU    Description    Company Name
System Idle Process    0    77.34        
 Interrupts    n/a    1.56    Hardware Interrupts    
 DPCs    n/a        Deferred Procedure Calls    
 System    4            
  smss.exe    400        Windows NT Session Manager    Microsoft Corporation
   csrss.exe    636        Client Server Runtime Process    Microsoft Corporation
   winlogon.exe    668        Windows NT Logon Application    Microsoft Corporation
    services.exe    712        Services and Controller app    Microsoft Corporation
     svchost.exe    880        Generic Host Process for Win32 Services    Microsoft Corporation
      wmiprvse.exe    3288        WMI    Microsoft Corporation
     svchost.exe    948        Generic Host Process for Win32 Services    Microsoft Corporation
     svchost.exe    1044        Generic Host Process for Win32 Services    Microsoft Corporation
     svchost.exe    1120        Generic Host Process for Win32 Services    Microsoft Corporation
     svchost.exe    1232        Generic Host Process for Win32 Services    Microsoft Corporation
     spoolsv.exe    1396        Spooler SubSystem App    Microsoft Corporation
     nvsvc32.exe    1504        NVIDIA Driver Helper Service, Version 182.50    NVIDIA Corporation
     svchost.exe    1532        Generic Host Process for Win32 Services    Microsoft Corporation
     alg.exe    1880        Application Layer Gateway Service    Microsoft Corporation
    lsass.exe    724        LSA Shell (Export Version)    Microsoft Corporation
explorer.exe    248        Windows Explorer    Microsoft Corporation
 rundll32.exe    480        Run a DLL as an App    Microsoft Corporation
 rundll32.exe    500        Run a DLL as an App    Microsoft Corporation
 firefox.exe    776        Firefox    Mozilla Corporation
 Ventrilo.exe    2580    0.78    Ventrilo by Flagship Industries, Inc.    
 Ventrilo.exe    3268    0.78    Ventrilo by Flagship Industries, Inc.    
 fraps.exe    1584        Fraps    Beepa P/L
 procexp.exe    1116    2.34    Sysinternals Process Explorer    Sysinternals
 uTorrent.exe    1824        µTorrent    BitTorrent, Inc.
Wow.exe    2208    17.19    World of Warcraft Retail    Blizzard Entertainment

Process: uTorrent.exe Pid: 1824

Name    Description    Company Name    Version
unicode.nls            
locale.nls            
sortkey.nls            
sorttbls.nls            
ctype.nls            
uTorrent.exe    µTorrent    BitTorrent, Inc.    1.09.0000.14981
ntdll.dll    NT Layer DLL    Microsoft Corporation    5.01.2600.3520
kernel32.dll    Windows NT BASE API Client DLL    Microsoft Corporation    5.01.2600.3541
ADVAPI32.dll    Advanced Windows 32 Base API    Microsoft Corporation    5.01.2600.3520
RPCRT4.dll    Remote Procedure Call Runtime    Microsoft Corporation    5.01.2600.3173
Secur32.dll    Security Support Provider Interface    Microsoft Corporation    5.01.2600.3518
COMCTL32.dll    User Experience Controls Library    Microsoft Corporation    6.00.2900.2982
msvcrt.dll    Windows NT CRT DLL    Microsoft Corporation    7.00.2600.2180
GDI32.dll    GDI Client DLL    Microsoft Corporation    5.01.2600.3466
USER32.dll    Windows XP USER API Client DLL    Microsoft Corporation    5.01.2600.3099
SHLWAPI.dll    Shell Light-weight Utility Library    Microsoft Corporation    6.00.2900.3395
comdlg32.dll    Common Dialogs DLL    Microsoft Corporation    6.00.2900.2180
SHELL32.dll    Windows Shell Common Dll    Microsoft Corporation    6.00.2900.3402
WS2_32.dll    Windows Socket 2.0 32-Bit DLL    Microsoft Corporation    5.01.2600.2180
WS2HELP.dll    Windows Socket 2.0 Helper for Windows NT    Microsoft Corporation    5.01.2600.2180
IMM32.DLL    Windows XP IMM32 API Client DLL    Microsoft Corporation    5.01.2600.2180
oleaut32.dll        Microsoft Corporation    5.01.2600.3266
ole32.dll    Microsoft OLE for Windows    Microsoft Corporation    5.01.2600.2726
uxtheme.dll    Microsoft UxTheme Library    Microsoft Corporation    6.00.2900.2180
rsaenh.dll    Microsoft Enhanced Cryptographic Provider    Microsoft Corporation    5.01.2600.2161
USERENV.dll    Userenv    Microsoft Corporation    5.01.2600.2180
netapi32.dll    Net Win32 API DLL    Microsoft Corporation    5.01.2600.3462
CRYPT32.dll    Crypto API32    Microsoft Corporation    5.131.2600.2180
MSASN1.dll    ASN.1 Runtime APIs    Microsoft Corporation    5.01.2600.2180
shfolder.dll    Shell Folder Service    Microsoft Corporation    6.00.2900.2180
CLBCATQ.DLL        Microsoft Corporation    2001.12.4414.0308
COMRes.dll        Microsoft Corporation    2001.12.4414.0258
VERSION.dll    Version Checking and File Installation Libraries    Microsoft Corporation    5.01.2600.2180
hnetcfg.dll    Home Networking Configuration Manager    Microsoft Corporation    5.01.2600.2180
DnsApi.dll    DNS Client API DLL    Microsoft Corporation    5.01.2600.3394
mswsock.dll    Microsoft Windows Sockets 2.0 Service Provider    Microsoft Corporation    5.01.2600.3394
wshtcpip.dll    Windows Sockets Helper DLL    Microsoft Corporation    5.01.2600.2180
Iphlpapi.dll    IP Helper API    Microsoft Corporation    5.01.2600.2912
rasadhlp.dll    Remote Access AutoDial Helper    Microsoft Corporation    5.01.2600.2938
MPRAPI.dll    Windows NT MP Router Administration DLL    Microsoft Corporation    5.01.2600.2180
ACTIVEDS.dll    ADs Router Layer DLL    Microsoft Corporation    5.01.2600.2180
adsldpc.dll    ADs LDAP Provider C DLL    Microsoft Corporation    5.01.2600.2180
WLDAP32.dll    Win32 LDAP API DLL    Microsoft Corporation    5.01.2600.2180
ATL.DLL    ATL Module for Windows XP (Unicode)    Microsoft Corporation    3.05.2284.0000
rtutils.dll    Routing Utilities    Microsoft Corporation    5.01.2600.2180
SAMLIB.dll    SAM Library DLL    Microsoft Corporation    5.01.2600.2180
SETUPAPI.dll    Windows Setup API    Microsoft Corporation    5.01.2600.2180

procexp loaded DLLs

I'll try it out on the internal drive tonight (should have tried beforehand, sorry ). I'll be able to say if there are any problems with it in max 3 days (BSODs always happen in this timeframe).

Edit: I should also mention that I only have the intel chipset USB drivers installed (not LaCIE's speed improving bullshit ones).

[Ultima]

Yeah... those logs don't reveal anything too interesting. I guess it's just down to that hunch about USB devices/drivers and BSODs... Unless someone else comes up with another idea that neither of us thought of yet

Edit: FWIW, a search for BAD_POOL_HEADER seems to point at it being a driver issue indeed, though nothing definitive.

[felixalias]

Okay, removed all other torrents, and started an 100mb torrent downloading. All default options on Disk Caching. I'll let it stay up while I do everything else normally. It'll be up for about 3 days, downloading and then seeding. That should narrow it down to one of Windows' fantastic USB bugs

(If it does turn out to be my external drive, is the best solution to just download to my main HD and then archive it over to my external?)

edit:

Okay, I got an IRQL_NOT_LESS_OR_EQUAL BSOD. However, this triggered right when I opened an AVI from the external drive. So, I went to Intel's site and downloaded the latest chipset drivers, and I'll see if that solves it. Can anyone recommend a program that stress tests USB drives or something similar? uT was open, but then it seemed to trigger pretty directly from accessing that file on the external drive. Solved as far as uTorrent goes though, I think.

[Ultima]

Don't know :S

Googling for something along the lines of usb hard disk benchmark seems to bring this up, though I'm not sure how useful it is. And I don't think it's free either.

[felixalias]

I updated my intel chipset drivers:

http://downloadcenter.intel.com/confirm.aspx?httpDown=http://downloadmirror.intel.com/16023/a08/infinst_autol.exe&agr=&ProductID=816&DwnldId=16023&strOSs=&OSFullName=〈=eng

I was previously running an older version from the mobo's install disc.

I can't confirm until I have something big to download over a few days, but I've pushed maybe 4 gigs of uTorrent traffic and probably 10 gigs of just plain disk IO with no crashes. I'm hesitant, but this may have solved it Hope this is useful to someone with an external USB drive. Thanks for your suggestions Ultima

Edit: I'm now quite confident that this has been solved. Confirmed fix by updating INF driver.

[Ultima]

Hm, so after updating the chipset drivers, you are now able to use the USB drive without BSODs?

[felixalias]

Yep. Been using it heavily for a little more than 3 days now (normally it would crash before 24 hours passed).