# Windows Media Center hangs computer



## echo14612 (Jul 23, 2011)

For months I have been searching for a solution to this problem. Consistently my system will do a hard freeze, requiring use of the reset or power button, during use of Windows Media Center. Most frequently this will occur when I attempt to fast-forward through a recorded TV show, but sometime the hang will occur after just watching a show for a few minutes and occasionally upon just attempting to start a show.

I've already tested my memory using Memtest, pulled and reseated my memory, done monthly updates to my AMD/ATI drivers (and pulled and reseated my graphics card), studied the data in Event Viewer, reinstalled the OS at least 6 times ... lots of other things I've forgotten about. I'm really stumped.

The Event Viewer shows NOTHING when this happens. All it indicates is Kernel-Power Event ID 41 each time I have to push the reset button.

Is anybody out there who can help?


----------



## VirGnarus (Jun 28, 2010)

How does it freeze? Does it get progressively less responsive before freezing? If so, does it degrade quickly or slowly? Does it respond to Ctrl+Alt+Del or can you move mouse cursor? Also, grab something like VLC. Does that also freeze? How long do you wait out the freeze till you reset?

Here's a couple programs you can use to discern the cause:

1. Process Explorer - Sort by CPU or CSwitch Delta columns. Watch it as you're running a video. If there's any process (including Media Center) that is showing high numbers, take note. Especially take notice if DPC or Interrupts starts growing. You can also check the graphs on top-right (dbl-click for bigger) for more info. If the freeze is not instant, you should try and right click the highest running process at the time and quickly go to create Dump file to generate one before it crashes.

2. Process Monitor - Have it running while you are messing with a video. When it freezes observe the latest entry/entries in ProcMon to see what it was trying to do at the time of the freeze. You may also use a backing file on Process Monitor by clicking File then Backing File. Specify to use a file instead of pagefile, giving a name of your choice in an appropriate folder where it will create this file. This will cause it to save ProcMon data to a separate file that you can review after the freeze. If somehow it doesn't work (corrupt file) then this method will not help you much.

3. Driver Verifier - Turn on and keep on. Hopefully if this is a bad driver issue then DV will catch it and BSOD your PC as opposed to have it freeze. You may need to wait a few minutes before the BSOD occurs while the PC is froze. If it does not occur after 5 minutes, reset manually.

4. You may try to manually crash the PC with the keyboard. Even if Ctrl+Alt+Del does not respond this may have the chance to work. Note that PS/2 keyboards have a far, far, better chance of triggering the crash than a USB. Follow instructions here. For USB keyboard, go to _kbdhid_ instead of _i8042prt_. 

For Driver Verifier and manual crash, the point is to cause your PC to crash in order to generate a crashdump which we can use to analyze. Send us any that you obtain from using DV or the manual keyboard bsod, even if the DV one doesn't show up while you're watching a video (it may have detected the bad driver even before the driver messes up with the video).

Diagnosing hard, instant crashes like this are difficult to catch without live debugging (direct PC-to-PC connection with debugger). Your chances to catch are greater if it doesn't freeze instantaneously but degrades into a total freeze. If that's the case, then I will have you use another program to try.

At the moment it just sounds like your system resources are getting eaten alive by trying to run the video until there is nothing left. What's the specs on your PC?


----------



## echo14612 (Jul 23, 2011)

VirGnarus said:


> How does it freeze?Does it get progressively less responsive before freezing? If so, does it degrade quickly or slowly? Does it respond to Ctrl+Alt+Del or can you move mouse cursor?


Most of the time the crash is instantaneous, with no change in responsiveness before it happens. It doesn't matter how many or how few other applications I'm running. When it happens, the second hand on my clock gadget stops moving and neither the keyboard nor mouse responds in any way, including to Ctrl+Alt+Del.

Once in a blue moon Media Center will freeze without freezing anything else, but only for one "move". I'm allowed one keystroke or mouse click before the freeze becomes hard.



> Also, grab something like VLC. Does that also freeze? How long do you wait out the freeze till you reset?


I use Media Player Classic as my usual video player. It has never frozen my computer. When Media Center has crashed my computer, the longest I let it stay frozen was about 7 hours - I went to bed and awoke to found it still frozen.

Thank you for the list of diagnostic programs. I had tried already using Process Monitor and at the moment I'm using Chameleon Monitor. I have run them open on my screen to see if anything showed up at the moment of the freeze, but so far nothing. On the other hand, I really didn't know how to set the programs to show what I needed to see, and you've helped me with that. It will be among the next things I try, along with Driver Verifier and a manual keyboard crash. I have a wireless USB keyboard.



> Diagnosing hard, instant crashes like this are difficult to catch


That certainly has been my experience!



> At the moment it just sounds like your system resources are getting eaten alive by trying to run the video until there is nothing left. What's the specs on your PC?


I listed all the specs of of my computer when I joined the forum. Don't they show up in the left sidebar? If not, just let me know and I'll post them right away.

Thank you so much for all your suggestions. I'll report back when I can add more information.


----------



## VirGnarus (Jun 28, 2010)

I'd like you to use VLC temporarily just to determine if it's something more than "skin deep" as you say. If it's an issue that transpires across a number of programs than it's obviously not something wrong with the program itself.


----------



## echo14612 (Jul 23, 2011)

VirGnarus said:


> I'd like you to use VLC temporarily just to determine if it's something more than "skin deep" as you say. If it's an issue that transpires across a number of programs than it's obviously not something wrong with the program itself.


I'm not sure what you mean by


> "something more than "skin deep" as you say.


 Did I say that? I'm guessing you want me to use VLC in place of Media Center to see if anything crashes. I did, it didn't. Are you saying I should do this for a WHILE? How long?

A couple of more immediate problems: 
1. Ever since I started Driver Verifier, EVERYTHING takes a very long time. Is this normal? How do I stop it?
2. I can't use Media Center OR VLC to actually watch anything while I'm running Process Explorer. The audio pauses and buzzes constantly. When I close Process Explorer, both apps work normally.

Despite the above, I "fiddled" with various video files with both VLC and MC and watched the Process Explorer columns as I did so. I limited the columns to those regarding the CPU and the CSwitchDelta. The only thing regarding Deferred Procedure Calls in the PE Help mentioned Context Switches, so I added that column, too. Sorted on CSwitch Celta, Interrupts is at the top of the list all the time.

I don't know what any of the numbers mean, however. I don't know what's normal and what's high. Could you please give me some guidelines?

I haven't tried the manual crasher yet. I guess that's next.


----------



## echo14612 (Jul 23, 2011)

This is a status report.

I ran VLC for several hours and it didn't crash nor did my system hang. As powerful as it is, however, it lacks two features I absolutely need and which Media Center does, so I reverted. The THIRD time this afternoon that MC froze, my system did not.

First, I took a "snip" of part of the Process Explorer window (I have no idea, of course, if this is useful). When I tried to upload this message with the image embedded, however, the forum complained my reply was 250000 characters long, so I've attached it instead.

Next, I right-clicked on the ehshell line in the Process Explorer window and requested a dump. PE immediately showed "Non-Responsive" in the status bar. 

Finally, I did the Right-Ctrl+Scroll+Scroll and, wonders of wonders, I got a BSOD.

After rebooting, I got this informative message from "Whocrashed":



> *On Tue 7/26/2011 17:05:21 GMT your computer crashed*
> crash dump file: C:\Windows\Minidump\072611-140953-01.dmp
> This was probably caused by the following module: kbdhid.sys (kbdhid+0x2DDF)
> Bugcheck code: 0xE2 (0x0, 0x0, 0x0, 0x0)
> ...













Oh - and that dump file I'd tried to make from Process Explorer was 0 bytes.

What do you thing I should try next?

Were you able to see my system specs and did they reveal anything?


----------



## VirGnarus (Jun 28, 2010)

So using VLC on the same videos and doing the same operations does not cause the freeze? I just wanted you to temporarily use VLC to test if it is BSODing with that as well.

As for DV slowing everything down, that is not usual behavior. What settings did you on DV? did you make sure to only select 3rd-party drivers and no MS/Windows drivers? Also, if you enabled Low Resource Simulation option, disable it.

Concerning the interrupts, what number does it usually hover around in the CSwitch Delta column? Do you also see a consistent number pop up in the CPU column for interrupts? If so, what number is this? Does the number show up and increase dramatically when running Media Center?

Given your report so far, I am starting to believe that you are experiencing the dreaded strife that is an interrupt storm. There are a few reasons as to why an interrupt storm is caused, but in order to successfully analyze such a thing, you usually need live debugging for this, or at the very least a kernel dump generated at the time of the storm. 

It may be possible to catch the storm early on by using Process Explorer to create a dump file from the Media Center process while the video is playing before it crashes, or even just with Media center simply open. Use the Create Dump option as instructed before. If you can only have the chance to create a minidump, do so. However, far more information will be available if we can get a full dump. You'll have to zip it and upload it to a filesharing site tho.

I'm hoping this is an interrupt storm, as those are somewhat easier to catch than a deadlock (which if DV doesn't catch it, than it most definitely needs live debugging). Either of which can be caused by either drivers or hardware. As such, here's some further tips:

1. Make sure all your drivers for everything - including BIOS - are at their newest and from your appropriate OEM (Dell, HP, Asus, etc.) or hardware (Nvidia, Intel, etc.) vendor. If you are using an OEM PC, prioritize their drivers instead of using hardware vendor drivers. 

2. Check Device Manager for any devices shown up that have marks next to their names and resolve the issues. Disable any devices you do not see yourself using (like modem)

3. In Device Manager, open up your IDE Controller and right click and go to Properties for each channel listed. There should be an Advanced Settings tab. Under each, make sure NONE are set to PIO Mode unless you are sure there is no device present there. You're looking at connections from your hard drives or optical drives to your motherboard, so it's arranged based on what you have connected where. Obviously if you only have like 2 HDs and 1 DVD drive, only 3 devices are gonna be available to be changed to DMA (if not already so).

4. Lastly, I haven't asked before, but have you tried running Media Center in safe mode to see if the effect repeats?


This has you all going all over the place, I understand, but again, there's no sure-fire way of diagnosing neither an interrupt storm nor a deadlock without a live-debugging session. I'm afraid worst comes to worst you can try installing an extra copy of Windows on your PC and dual-boot into it and test Media Center there to see if the problem still exists. Or you may have to end up going caveman and start tearing out hardware and replacing. The extra Windows environment ain't a bad idea right now, as it allows you to test Media Center in a fresh environment to ensure nothing else if conflicting with it. Just don't do anything too drastic right now and you'll be good. Reinstalling Windows won't help if it's hardware, and swapping hardware won't help if it's drivers.


----------



## VirGnarus (Jun 28, 2010)

if you manually crashed while Media Center has gone buggered out, check in Windows\Minidump folder to ensure if there's any minidump listed at the time you crashed the PC and send it to us. If there's also a kernel dump, that'd be most splendid.


----------



## echo14612 (Jul 23, 2011)

VirGnarus said:


> ...
> As for DV slowing everything down, that is not usual behavior. What settings did you on DV? did you make sure to only select 3rd-party drivers and no MS/Windows drivers?


Yes

Also, if you enabled Low Resource Simulation option, disable it.

I didn't. I just followed the instructions at the link you indicated.



> Concerning the interrupts, what number does it usually hover around in the CSwitch Delta column?


Without Media Center running, CSwitch Delta hovers around 60,000. Once I open MC, it starts vacillating wildly between 20,000 and 200,000. I wasn't playing a video, I just opened the interface.



> Do you also see a consistent number pop up in the CPU column for interrupts? If so, what number is this? Does the number show up and increase dramatically when running Media Center?



Yes and not exactly. Before opening the MC interface, the Interrupts/CPU block stuck around 3.00. After opening it, the block started jumping all over between 1.xx to 6.00. 



> Given your report so far, I am starting to believe that you are experiencing the dreaded strife that is an interrupt storm.


Actually, I may have some familiarity with that. It describes the typical conversation between my husband and me.




> It may be possible to catch the storm early on by using Process Explorer to create a dump file from the Media Center process while the video is playing before it crashes, or even just with Media center simply open


I saved a dump file as described as soon as I opened MC. It's 512mb. Can you recommend a file sharing site? Is the rar format convenient for you? I can send a series of rar attachments to you if you'd prefer. As soon as I finish this reply I will start a video playing and do another dump.

 I think my drivers are good. I'm using Slimdrivers to scan them. It tells me they're up to date. I don't know about the BIOS. I'd have to have a really good reason to mess with that... 

No problems indicated in the device manager.. Only thing I see that I don't use is Firewire, so I disabled that. I have 4 of 6 ATA Channels in use, all set to Ultra DMA Mode 6, with the "Enable DMA" box clicked. 



> 4. Lastly, I haven't asked before, but have you tried running Media Center in safe mode to see if the effect repeats?




It's on the list.

I really appreciate that you're here to help. As I said, I've been working on this for months.

P.S. DANG This forum logged me out while writing the message. It took over an hour because of all the waiting between each character and mouse click. I don't know if it's PE that's doing this or MC or both. Fortunately I'd copied most of it to the clipboard...


----------



## echo14612 (Jul 23, 2011)

> if you manually crashed while Media Center has gone buggered out, check in Windows\Minidump folder to ensure if there's any minidump listed at the time you crashed the PC and send it to us. If there's also a kernel dump, that'd be most splendid.



There are 5 dump files in the minidump directory. I rarred the latest one and have attached it here. I found a memory.dmp file, but it apparently got deleted (by the OS, I assume) and my recovery utility claims it's not there now.

I tried running Media Center in safe mode, but not sure what to do with it. I can't play any media (because I'm in safe mode), nor can I do much of anything else there. I can say it didn't crash upon opening the interface...

I still have the Process Explorer dump file ready to upload to a file sharing site of your choosing. I've never used one, but I'm pretty sure I can figure it out. The one I tried to generate while a video was playing caused PE to go nonresponsive. I let it go for over an hour while I continued to use my computer, and then for a while longer after that, but it never recovered and I only got a 0 byte file. I'll keep trying.


----------



## VirGnarus (Jun 28, 2010)

Wow, ok, those interrupts are reeeeaally high. Unless something is bogging down your PC constantly to where Process Explorer is refreshing slower than it'd like too, then those are extremely high amount of interrupts. Are there any other processes listed that seem consistently busy? 

For the dump file, any filesharing site will do really. Megaupload is one that I can think off the top of my head. Yes, rar or any other archive format will be appropriate. Unfortunately, the minidump you gave me is, well, too small, and doesn't give me a lick of info as to what's going on. In fact, I'm pretty sure any minidump will just not give enough in this situation.

Concerning drivers, it's best to go ahead and look for drivers manually. 3rd party driver update software is typically erroneous and outdated. It is usually not a good idea to use them and instead start looking for the drivers on your own. If you're using an OEM computer (Dell, Asus, etc.), then look for updates on the appropriate vendor website. Otherwise look for the vendor drivers specific for each piece of hardware. For chipset hardware look for your motherboard vendor. Again, all of this is unnecessary if you are using an OEM computer, and should rely on those provided instead.

I haven't received a JCGriff Report from you, and while it's somewhat unnecessary, at least it gives me a good bit of info to get my bearings on what PC we're dealing with here. You can generate one using instructions here.

One other thing you can do, is grab Autoruns, and use it to look at stuff that starts on your PC (typically under Logon, Services and Drivers). You especially wanna look under Drivers section and just simply disable everything except your video drivers. If you're unsure, you can save the output from Autoruns as a file and send it to me and I can see what you should disable or not. Then test video playing with reduced drivers and/or services and see if it improves. Essentially you're just doing a process of elimination.

Lastly, I stopped worrying about losing written form data on my Firefox browser when I installed the Lazarus add-on. A lifesaver and a half, it is.


----------



## echo14612 (Jul 23, 2011)

*VirGnarus: JCGriff report*

As you requested. Attached are the files you wanted. I failed at the perfmon, though, the result was: 


> Error:
> An error occured while attempting to generate the report.
> The wait for the report generation tool to finish has timed out.


And I wasn't even running Media Center!

I included the Autorun.arn as well. I already disabled some things I knew I didn't need. Plenty left to experiment with

· OS - Windows 7
· X64
· Original OS: Vista Ultimate X64 - OEM installed by builder
· Windows 7 is retail version I bought and installed.
· Age of system: 3+ Years (4/30/2008)
· Age of OS installation - have you re-installed the OS? I've reinstalled the OS many times, most recently on 4/22/2011
· CPU: INTEL Q9300 2.5GHz 1333/6MB
· Video Card: Radeon HD3870 512MB
· MotherBoard: Intel P35DPM
· Power Supply - AGI 850 watts
· System Manufacturer: Microworx (Local business)
· Exact model number: N/A CUSTOM


----------



## echo14612 (Jul 23, 2011)

Thank you again! I feel like I'm getting an intensive course in troubleshooting (and I do need it)!

I have attempted to follow the instructions you gave and have uploaded the files to a new thread entitled *"VirGnarus: JCGriff report"

Somehow a mad "smilie" got posted with the title. I'm not responsible!

This board has weird formatting... I didn't put in this boldfacing and I can't undo it.
*


----------



## echo14612 (Jul 23, 2011)

here's a link to ehshell.dmp (rarred)
MEGAUPLOAD - The leading online storage and file delivery service


----------



## VirGnarus (Jun 28, 2010)

Thanks. I merged it since there's no need to provide a separate thread for the report. 

So far I've just skimmed through autoruns, and your drivers list is just an utter mess. I've never seen so many drivers listed from different vendors for the same kind of hardware (like your RAID, Sata/IDE controller drivers). I have a feeling a lot of this has to do with that Slimdrivers software you're using. Why, you even have drivers running that's exclusively designed for Windows ME! Definitely need to do some heeeavy trimming of this.

Unfortunately, I can't discern exactly what drivers you should be using because I'm not on a system right now that can run the file you gave that can tell me exactly what hardware you have. I'll need to wait till I have access to the right PC to do this. I just wanted to go ahead and notify you of that before I dip further into this.


----------



## echo14612 (Jul 23, 2011)

VirGnarus said:


> So far I've just skimmed through autoruns, and your drivers list is just an utter mess. I've never seen so many drivers listed from different vendors for the same kind of hardware (like your RAID, Sata/IDE controller drivers). I have a feeling a lot of this has to do with that Slimdrivers software you're using. Why, you even have drivers running that's exclusively designed for Windows ME! Definitely need to do some heeeavy trimming of this.


I noticed that when I glanced at that *J*ui*C*y (Griffin) report. I don't know that Slimdrivers is at fault. I've only been running it about a month and it only upgraded a couple of things. Certainly I didn't manually install them, though.

I'll wait until you've had a chance to review the data before I try to clean it out myself.


----------



## VirGnarus (Jun 28, 2010)

Urp, as I figured, Windows Media Center uses managed code, which I'm not skilled at debugging. Being that this is the case, I may need to end up grabbing a kernel dump from you, which only is produced when you manually crash the system. It's the big ole MEMORY.DMP file located in Windows, apart from the minidump that is also generated that's located in Minidump folder. The minidump obviously will not suffice, but a kernel dump will.

If for whatever reason the big crashdump isn't being produced, then this may be a bug with Windows 7 SP1, of which a fix is located here. Also check to ensure that you have it set to create those crashdumps. In Start Menu, type in Advanced System Settings. In the new window, go to Advanced tab followed by the Settings button under the Startup & Recovery section. Confirm that you have it set to make kernel dumps, and that it does *not* automatically restart after crash. There's also the possible need to have your paging file present on the same partition as where your Windows resides. So if Windows is on drive C: and you set paging file to sit in drive D:, crashdumps may not properly get produced. Make sure page file size also is at least size of your RAM.

As for on your end for potential remedies, since we're dealing with managed code, perhaps you may wanna uninstall & reinstall whatever version(s) of .NET Framework you have installed on the PC. Versions of .NET Framework don't work the same way as other "programs", where one version updates over another one. You have to reinstall each separate version you have.

Another thing, I don't know why but I was completely oblivious to the fact that this problem was occurring through several reinstalls of Windows. If a fresh install of Windows with only video drivers installed causes freezing, then we may be very well looking at hardware probs. We can still go through diagnosing this, but if you have any other video card laying around or your motherboard has onboard graphics, you may wanna temporarily switch to that as a substitute and test to see if the same effect applies.

I still haven't got the chance to use my x64 PC to look your full hardware specs, so you han hold off on Autoruns till then.


----------



## echo14612 (Jul 23, 2011)

VirGnarus said:


> Urp, as I figured, Windows Media Center uses managed code, which I'm not skilled at debugging. Being that this is the case, I may need to end up grabbing a kernel dump from you, which only is produced when you manually crash the system. It's the big ole MEMORY.DMP file located in Windows, apart from the minidump that is also generated that's located in Minidump folder. The minidump obviously will not suffice, but a kernel dump will.


Although I REALLY appreciate all the DIFFERENT suggestions you have for troubleshooting my problem, I think I'd better do them one at a time and let you respond to the result. The next thing I'll do is generate a kernel dump. I know already they ARE being generated, but I checked the settings you described to be sure. The one thing I'm NOT sure about is how important it is to do such a dump AFTER Media Player has frozen. It's always hit or miss whether I can do anything after that happens other than reset. I'll try it both ways.

As for all the reinstalls of Win7 - It was because problems with Media Center that I did all the reinstalls. MS does NOT make it easy to keep it running reliably and the database uncorrupted. The freezing started sometime after I installed SP1. I reinstalled twice since then, but it was never clear at which point the freezing recurred. I know it wasn't immediately after I installed the graphics drivers. 

I don't have another memory card to test.

Off to crash the computer. What fun.


----------



## VirGnarus (Jun 28, 2010)

Seeing as the interrupt storm is actually occurring continuously even before Media Center is open, I figure it's ok to have it crash any time, with Media Center open running a movie being the best possible moment.

Possibly the best method of troubleshooting that anyone can do is to start with a fresh environment and change it bit by bit, testing as you go. When you witness instability, you are aware of what changes caused it. It's also of course the most grueling and tedious process one can do - though it ain't much far off from trying to get your system to crash either.

I guess I'm an oddball when I say that I am eager to see my PC crash, cuz it means an adventurous time of debugging!

______


Ok, now I dug through your hardware setup, and I am even more baffled than I was when I first looked at your Autoruns. There are actually more than one RAID controller in your system, and not just 2, but at least 3! There's absolutely NO reason to use *3* RAID controllers in a system - especially each of a completely different brand - and the only time you'd have two is if you use a controller card to perform RAID better than what your motherboard controller can do (kinda like installing a graphics card when your motherboard already has onboard graphics). I am just reduced to confusion over the hardware inside your computer. I truly hope what I'm looking at is completely erroneous, because if it isn't, then it looks like a system that was very poorly designed and overly expensive. Even a server setup shouldn't go like this, as a decent RAID controller card has the potential of handling up to 128 drives with little problem.

I also believe this is just the fake RAID in action, but I do see a ton of hard drives present, both USB external and internal. Are you running a server? Can you verify how many hard drives you have present in total on the PC? The reason I ask, is that we will probably have to determine what RAID controllers need to be running and what shouldn't. These RAID controllers are prime candidates for causing sharing conflicts and can easily create interrupt storms. These are primarily the drivers that I see listed in Autoruns, and having them all active at the same time is like having 3 people try to drive the same car.


----------



## echo14612 (Jul 23, 2011)

Here are two memory dumps. 
memory1.dmp is with media center interface closed. The computer had been running pretty well most of the day, but gradually slowed down to a crawl until it seemed unresponsive, leaving me with a black screen:
MEGAUPLOAD - The leading online storage and file delivery service

memory2.dmp was generated not too long after the first one. I was playing a Media Center file at the time
MEGAUPLOAD - The leading online storage and file delivery service

I have 19 drives on this computer. 6 are internal and 13 external. All but two of these drives are for storage, mostly Media Center recordings (wtv). Of the external drives, 8 are in a SanDigital TowerRaid. This device is run off a Silicon Image card (3132 SATALink Controller) with two e-Sata connections. In theory I can do two 4-Disk RAIDs with this device, but I'm doing JBOD. I'm completely responsible for the "bad design". I just kept adding drives as they filled up and have no idea how best to do this. Although the computer is in a "homegroup" with 3 others, I don't know the first thing about servers.


----------



## VirGnarus (Jun 28, 2010)

Ok, the JBOD explains the huge list of disks. It also explains the SiI controller listed. I rechecked your Autoruns, and this setup just doesn't explain how you have well over *7* RAID drivers all from completely different vendors. I thought it was 3 at first, but I overlooked many of em. 

You can start by cleaning out Autoruns Drivers list of any RAID controller drivers that don't have anything to do with Silicon Image (SiS). I checked the list of TowerRaid models, and I'm not sure which one is yours specifically. However a vast majority of them use fake RAID, so I will assume that you had to install a RAID controller driver for the TowerRaid as well. Not sure what brand of controller chip/card it uses. If these are figured out, I think it's safe to start unchecking any other RAID/SATA drivers present in the list of drivers, with exception of your onboard ones (which uses Intel RAID). At most only 3 RAID drivers should be present out of the 7+.

I'll check up on the crashdumps later today to see what goodies they come up with. Being manual crashes, I estimate they should be very clean and without any ugly corruption that can occur with unexpected crashing. Also note that in extreme testing scenarios, it may have to have you end up disconnecting hardware unnecessary for PC functioning (like the TowerRAID) and disabling their drivers via Autorun in order to see if there's conflicts between hardware you have installed.


----------



## echo14612 (Jul 23, 2011)

> Ok, the JBOD explains the huge list of disks. It also explains the SiI controller listed. I rechecked your Autoruns, and this setup just doesn't explain how you have well over *7* RAID drivers all from completely different vendors. I thought it was 3 at first, but I overlooked many of em.
> 
> You can start by cleaning out Autoruns Drivers list of any RAID controller drivers that don't have anything to do with Silicon Image (SiS). I checked the list of TowerRaid models, and I'm not sure which one is yours specifically. However a vast majority of them use fake RAID, so I will assume that you had to install a RAID controller driver for the TowerRaid as well. Not sure what brand of controller chip/card it uses. If these are figured out, I think it's safe to start unchecking any other RAID/SATA drivers present in the list of drivers, with exception of your onboard ones (which uses Intel RAID). At most only 3 RAID drivers should be present out of the 7+.


When I read your message last night about the RAID drivers, I looked at the obvious ones in the Device Manager and uninstalled the one called "Marvell." Now my DVD drive doesn't work and Windows stubbornly refused to install cdrom.sys, claiming that it is a "service" that has been disabled. I don't see it listed in Services. How do I re-enable it?

The Sans Digital TowerRaid is a "TR8M-BP 8 Bay eSATA RAID". It runs off a Silicon Image controller card. I'll go through Autoruns again to see what other RAID devices I can disable.



> I guess I'm an oddball when I say that I am eager to see my PC crash, cuz it means an adventurous time of debugging!


Actually, I'm the same way. Unfortunately I only know enough to get myself in trouble. So you might be ENJOYING fixing my problems? :grin:

and THANK YOU, again


----------



## echo14612 (Jul 23, 2011)

MEGAUPLOAD - The leading online storage and file delivery service

Memory3.dmp - because I know how much you like them.

This one I manually generated after disabling what I think were the extraneous RAID drivers, plus a few other things.


----------



## VirGnarus (Jun 28, 2010)

Ok, checked first crashdump. I noticed that a running process was holding access to a resource and that there was a HUGE contention count on it. That means that other processes were fighting to gain access to this resource that the "boss" process held. The contention count at the time of the crash was nearly 1,000,000. Seeing as the next resource with contention over it had a count of 48,000, and others in the 10's, you can see how this one stood out. The process that owns this resource is _xplorer2_64.exe_, or _Xplorer2_, a 3rd-party software made from Zabkat.

I will go through the other crashdumps to try and confirm this. It may be hardware the process is waiting on, I'll have to look further into it. That's my initial diagnosis right now.

*UPDATE:*

Ok, dove further into it. Found out we got a bit of gridlock going on here. Xplorer2 itself is actually waiting on something else to finish, which happens to be the real explorer.exe and taskhost.exe both waiting on a particular resource. All of these involve DirectX and creating/refreshing windows on your screen, but the resource they're waiting for is file-related. Sure enough, through some more scrutiny, I found your HD controller drivers at fault here.

If you're interested in understanding, to make a rather ugly yet relevant analogy to explain all this, suppose the HD controllers are cars that crashed that's shut down the road, blocking all traffic behind em. Right behind is a 4-way intersection (DirectX), and people behind the crash (explorer/taskhost threads) have managed to block the entire intersection (don't you love that?) Therefore people trying to get through the intersection the other way (xplorer2 and contending threads) can't get through unless those behind the crash get through, and _those_ people can't get through unless the crashed cars stop blocking the road. It's an utter traffic mess and it ends up bogging both roads leading into the intersection until you get a true commuter's nightmare (lockup).

Right now I'm still trying to figure out what could be causing the problem exactly, but as of now so far I do notice Acronis dipping its fingers into most of this, so it's a suspect in this. I've dived as far as the driver layer of this problem but I'm having a bit of difficulty where to go further in this. I'll research a bit and try to see how low I can go on finding the culprit here. I will also look at the other crashdumps to get an idea from those too.




*Analysts:*



```
[I]1: kd> !locks[/I]
**** DUMP OF ALL RESOURCE OBJECTS ****
KD: Scanning for held locks.................................................

Resource @ 0x[B]fffffa8009f2a2f0[/B]    Exclusively owned
    Contention Count = [B]9972628[/B]
    NumberOfExclusiveWaiters = 7
     Threads: [B]fffffa8006fb8060[/B]-01<*> 
     Threads Waiting On Exclusive Access:
              fffffa8009e06800       fffffa800ac39b60       fffffa80095c8b60       fffffa800b24ab60       
              fffffa800b24a060       fffffa800b37fa10       fffffa8009688060       

KD: Scanning for held locks.

Resource @ 0xfffffa8009f4d9b0    Shared 4 owning threads
    Contention Count = 160
     Threads: fffffa8007345060-01<*> fffffa800aab2060-01<*> fffffa800aa34060-01<*> fffffa8006fb8060-01<*> 
KD: Scanning for held locks.

Resource @ 0xfffffa8009f541b0    Exclusively owned
    Contention Count = 1230
     Threads: fffffa8007345060-01<*> 
KD: Scanning for held locks.

Resource @ 0x[B]fffffa8009f7fbd0[/B]    Exclusively owned
    Contention Count = [B]47182[/B]
    NumberOfSharedWaiters = 2
    NumberOfExclusiveWaiters = 1
     Threads: fffffa8007345060-01<*> fffffa800aab2060-01    fffffa800aa34060-01    
     Threads Waiting On Exclusive Access:
              [B]fffffa8006fb8060[/B]       

KD: Scanning for held locks..............

Resource @ 0xfffffa80097ff5d0    Exclusively owned
    Contention Count = 44
     Threads: fffffa8007345060-01<*> 
KD: Scanning for held locks..............................................................................................................................................................................................................................................................
10121 total locks, 5 locks currently held

__________


[I]1: kd> !locks -v fffffa80`09f7fbd0 [/I]
Resource @ 0xfffffa8009f7fbd0    Exclusively owned
    Contention Count = 47182
    NumberOfSharedWaiters = 2
    NumberOfExclusiveWaiters = 1
     Threads: fffffa8007345060-01<*> 

     THREAD fffffa8007345060  Cid 1928.0920  Teb: 000007fffffd6000 Win32Thread: fffff900c8124320 WAIT: (WrPageIn) KernelMode Non-Alertable
         fffffa8006d64290  NotificationEvent
     IRP List:
         [B]fffffa8009f0d9d0[/B]: (0006,0628) Flags: 00060043  Mdl: fffffa8006d64330
...

___________


[I]1: kd> !irp fffffa8009f0d9d0[/I]
Irp is active with 19 stacks 14 is current (= 0xfffffa8009f0de48)
 Mdl=fffffa8006d64330: No System Buffer: Thread fffffa8007345060:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
>[  3,34]  12 e0 fffffa8007dc2060 00000000 fffff88000e58f00-00000000 Success Error Cancel 
	       \Driver\Disk	partmgr!PmReadWriteCompletion
			Args: 00001000 00000000 4308e7f000 00000000
 [  3, 0]  12 e0 fffffa8007c90b90 00000000 fffff88000e69010-fffffa8007ddfc10 Success Error Cancel 
	       \Driver\partmgr	volmgr!VmpReadWriteCompletionRoutine
			Args: 39a75c597 00000000 4308e7f000 00000000
 [  3, 0]   2 e1 fffffa8007ddfac0 00000000 fffff880016010a8-fffffa8007e17b90 Success Error Cancel pending
	       \Driver\volmgr	fvevol!FvePassThroughCompletion
			Args: 00001000 00000000 39a75c592 00000000
 [  3, 0]   2 e0 fffffa8007e17a40 00000000 fffff8800199af40-fffffa800af67830 Success Error Cancel 
	       \Driver\fvevol	volsnap!VspReadCompletionRoutine
			Args: 00001000 00000000 4308d7f000 00000000
 [  3, 0]   2 e1 fffffa8007e1a040 00000000 fffff88001231fc0-00000000 Success Error Cancel pending
	       \Driver\volsnap	Ntfs!NtfsPagingFileCompletionRoutine
			Args: 00001000 00000000 4308d7f000 00000000
 [  3, 0]   0  1 fffffa8007f5c030 fffffa8009a77970 00000000-00000000    pending
	       \FileSystem\Ntfs
			Args: 00001000 f4add000 4308d7f000 00000000
```

I used _!locks_ to figure out what's locking up. Saw two bigger contentions going on. Biggest one's owning thread was discovered to be the one thread waiting for the other resource listed at the bottom. Looked at the thread holding THAT resource and found a current running IRP. Passed it through _!irp_ and that's what I have so far. I see some pending but others not. Either way, I'm scratching my head. I'll be exploring it further, but I'd like any assistance.


----------



## echo14612 (Jul 23, 2011)

VirGnarus said:


> Ok, checked first crashdump. I noticed that a running process was holding access to a resource and that there was a HUGE contention count on it. That means that other processes were fighting to gain access to this resource that the "boss" process held. The contention count at the time of the crash was nearly 1,000,000. Seeing as the next resource with contention over it had a count of 48,000, and others in the 10's, you can see how this one stood out. The process that owns this resource is _xplorer2_64.exe_, or _Xplorer2_, a 3rd-party software made from Zabkat.


xplorer2 is a file manager, one of my all-time favorite pieces of software, and I've been a registered user for many years. It's the only one I've found that allows me to show Microsoft Media Center-specific metadata. I've passed on what you said to Nikos, the developer.

In the meantime, I have closed xplorer2 and will see if it affects the crashing issue.


----------



## VirGnarus (Jun 28, 2010)

Updated my previous post with some new goodies. Check back on it. I'm still working on this and will report more info to you.


----------



## echo14612 (Jul 23, 2011)

Wow! This is turning into quite a compelling mystery. I love your analogy. Not only does it give me a good idea of what's going on, but also, if I were a driver in that gridlock, I'd have the same feelings of exasperation and impatience that I have trying to use my system.

Here's another memory dump:
MEGAUPLOAD - The leading online storage and file delivery service

I generated it after fresh reboot; x2explorer isn't running, nor are most of the other apps I usually have open. Media Center stopped responding after fast-forwarding through a file. System froze when I tried to open Task Manager so I could close the MC window. Acronis is still in the picture. I'll disable that next.


----------



## echo14612 (Jul 23, 2011)

Uninstalling Acronis did not stop the freezing.


----------



## VirGnarus (Jun 28, 2010)

Ok, still going through em, and...

Nothing yet. I'm leaning on your TowerRAID, but I'm not sure. I'm just utterly stumped since I don't have enough expertise in this. I won't let this go, but I'll need to call in the big boys and get answers from some pros. When they'll respond though, I'm not sure.

You can try sending a video to your system drive and temporarily disable your SATA controller to your TowerRAID and restart to see if it resolves anything. Make sure to set system restore point beforehand and do *NOT* do this if any system files (such as paging file) reside on the TowerRAID.


----------



## VirGnarus (Jun 28, 2010)

Welp, fortunately I managed to alert a couple of debugging professionals about the situation. I'm corresponding with them right now to ascertain the cause here. Hopefully this will turn up with a resolution. I'm still leery, though, given that - again - the only way to truly and honestly get a clear-cut answer here is with live debugging when the actual hang occurs. We'll see, though.


----------



## echo14612 (Jul 23, 2011)

VirGnarus said:


> Welp, fortunately I managed to alert a couple of debugging professionals about the situation. I'm corresponding with them right now to ascertain the cause here. Hopefully this will turn up with a resolution. I'm still leery, though, given that - again - the only way to truly and honestly get a clear-cut answer here is with live debugging when the actual hang occurs. We'll see, though.


Thank you so much for hanging in there! I've been trying to gather more info and did come across some error messages that may or may not be relevant.

The first group of errors involve IESHELL.DLL and IESHIMS.DLL. These have got to have something to do with Internet Explorer, which I'm not even running. The errors turn up within the threads of every application I've checked.:

Error: Modules with different CPU types were found.
Warning: At least one delay-load dependency module was not found.
Warning: At least one module has an unresolved import due to a missing export function in a delay-load dependent module.

There's also an error claiming that something can't locate IESHIMS.DLL although it's in at least 4 places.

The next set of mysterious data I gathered using Warehouse eXtended Task Manager (XTM). When running Media Center, I got a lot of "Waits" listed. Eventually the player stopped responding (as usual). Before the system crashed I collected an ehshell.dmp and copied some lines from XTM which might give you some leads. Or might not.

1. Ehshell.dmp.rar is here: MEGAUPLOAD - The leading online storage and file delivery service

2. This one reappeared: Warning: At least one module has an unresolved import due to a missing export function in a delay-load dependent module.

2. Then:
4436 mcplayer.dll!DllUnregisterServer+0x6ecc 10,090 8/5/2011 14:43:59 Normal Wait Executive 0x000036B7 The requested lookup key was not found in any active activation context. 

This was listed as one of the threads under ehshell. All the other threads said "Execution Delay" Or "Wait" or "Queue".

I looked at the table for "Locked" and there were about 10 lines, one of which listed contentions at at about 40,000. I tried to copy that line, but that's when the computer stopped responding.


----------



## VirGnarus (Jun 28, 2010)

Hi,

Before you consider that I abandoned this case, it's still in inspection. However, I've had other serious PC-related issues both at work and from church that I've prioritized which has soaked up nearly every waking hour I've had this past couple weeks (not to mention my own PC puttering out for one week). Once one of them gets resolved, I will continue on this. Sorry for the extremely extended delay. Fortunately I have some professionals working with me on it that are eager to resolve this as much as I am, but all of us are extremely busy at the time.


----------



## echo14612 (Jul 23, 2011)

VirGnarus said:


> Sorry for the extremely extended delay. Fortunately I have some professionals working with me on it that are eager to resolve this as much as I am, but all of us are extremely busy at the time.


Thank you so much for alerting me to your status. Best of luck in solving your real world problems. I know you love your work. :grin:


----------



## VirGnarus (Jun 28, 2010)

I managed to resolve the issue with the church members' PC and now that's lifted a big weight off my shoulders. I should have some more free time which I can put into figuring this out. Thanks for keeping patient on this.


----------



## VirGnarus (Jun 28, 2010)

Urgh, I'm sorry. Not long after starting to work on this again I'm given other work that's gonna fill up all my free time. I'm afraid I might have to let this go, as the amount of work necessary to analyze it outside of live debugging will look to be immense, and beyond what I can afford to put in. Obviously this answer won't come as much of a surprise to you, though I figure it won't make it any less burdensome on your part to receive it. I apologize, this simply is just one of those "I *have* to be at the PC" cases. 

The only thing I can mention that is suspicious from the kernels dumps me and some of the pros discovered is that memory usage showed to have skyrocketed in some of them. Again, I can't provide further beyond this right now. It's a very curious case that I'd love to solve, but seeing as I've been going on a month without the time necessary to look into it, I doubt I'll have it in the near future.

Good luck solving the case. If you still want my educated guess, I'm very leery of the TowerRAID, and/or controller card it's connect too.


----------



## echo14612 (Jul 23, 2011)

I don't blame you for backing out because of your real work! 

I'm a bit confused, though. Are you the only one here that answers questions? Can't I be transferred or assigned to somebody else who has more time? What is this live debugging you keep mentioning? How do I go about doing that?

I have an additional question you may be able to answer: I need to find a forum in which Microsoft employees who actually work on the development and bug-fixing of Media Center field questions and comments. I've asked quite a few questions on thegreenbutton.com which purports to be such a place, only to have most of my questions ignored. Apparently the Microsoft employees there are ... uhm ... selective ... about what they answer. There are some very real, if minor, bugs I'd love to report but hate dumping my thoughts into a black hole.


----------



## VirGnarus (Jun 28, 2010)

I've forwarded notice to the tech group again here and hopefully someone can pick up where I left off, but while there's a number of BSOD analysts here, only a handful are particularly savvy with it (with me being only a novice). Troubleshooting of this kind requires a rather specific technical skill and a high level of it, so there's not that many individuals that have the capacity to perform this kind of work.

The live debugging is where someone takes a specialized serial or USB cable and hooks their PC up to yours. Then they can break into your PC at any time and debug right there in the PC's exact state. It's the most thorough and accurate method of debugging available, though obviously it's the least available too compared to crash dump analysis. If you know anyone who does this kind of work or writes Windows drivers for a living they shouldn't have any problem with this at all. Otherwise, this option is simply not accessible. Though if you did have that kind of person around, you prolly wouldn't be asking us to help now would ya


----------



## echo14612 (Jul 23, 2011)

> Though if you did have that kind of person around, you prolly wouldn't be asking us to help now would ya


... people around here expect ME to do the helping...

I hope I don't appear ungrateful for all your efforts. I most certainly am! It's just that I still have this problem! Thank you for alerting your cohorts. I hope one of them takes up the challenge.

BTW. I HAVE made sure I had the latest BIOS for my motherboard, latest firmware & drivers for the TowerRaid (Silicon Image Card) and all the rest of those little Intel drivers for the chipset and so forth. Apparently nothing was repaired by this activity since my computer froze while I was in the middle of previewing my first attempt to write this response. :grin:


----------



## jcgriff2 (Sep 30, 2007)

echo14612 said:


> I have 19 drives on this computer. 6 are internal and 13 external. All but two of these drives are for storage, mostly Media Center recordings (wtv). Of the external drives, 8 are in a SanDigital TowerRaid. This device is run off a Silicon Image card (3132 SATALink Controller) with two e-Sata connections. In theory I can do two 4-Disk RAIDs with this device, but I'm doing JBOD. I'm completely responsible for the "bad design". I just kept adding drives as they filled up and have no idea how best to do this. Although the computer is in a "homegroup" with 3 others, I don't know the first thing about servers.


I don't know how Windows Media Center sharing would handle 19 HDDs + sharing with Home Group. I suggest that you disconnect the 13 external HDDs and see if freezing continues.

Regards. . . 

jcgriff2

`


----------



## echo14612 (Jul 23, 2011)

I appreciate your suggestion and apologize for the delay. I had to get to a point where I could be without those drives for a few days to test your theory.

So ... these are my latest experiments:
1. removed all folders from my Media Center folders. (If Media Center can't handle the library, empty the library ... no?) 
No change. Still freezes.

2. removed the power from all my external drives, including the TowerRaid.
No change. Still freezes.

3. disabled the TowerRaid drivers (Device Manager).
No change. Still freezes.

4. Deleted the contents of the ProgramData/Microsoft/ehome folder. Ran Media Center setup from scratch.
No change. Still freezes.

Have I been sufficiently thorough in eliminating the TowerRaid and/or external drives as the cause of Media Center freezing? (Actually, if it were JUST MC freezing, I could live with it. When I try to close the unresponsive MC window using Task Manager, the computer freezes and I have to reset.)

Is there something else you'd like me to try?

Thanks again...


----------

