PC crashes

[Nick]

Hmmm. Seems to be that Bitdefender might hold slightly the upper hand, but it's a close-run thing... I've used (and still use) AVG with no problems at all for years.

https://www.av-test.org/en/antivirus/hom...windows-7/

Of course, AV is a small part of the story. Firewalls and, most importantly, user training, are just as critical, if not more so.

[ppppenguin]

W7 firewall plus NAT router. Well trained user I haven't made many mistakes over the years. The couple of infections I did manage to acquire were fixed by reversion to a full backup follwoed by restore from incrementals since then. I reckon that was more reliable than cleaning up.

[ppppenguin]

PC OK this morning. Installed AVG free. Remembered to uninstall Malwarebytes and Windows Defender though the latter is meant to get out of the way if another AV is installed.

[Nick]

Don't need to uninstall Malwarebytes - it's pretty passive; BitDefender should be removed.

Glad all a bit more stable now. Give it a few days and then lets look at the error logs again... Sounds also like one of your USB Mass Storage Devices (MSD) may have a problem.

Just out of interest, do you "Eject" USB MSDs before physically unplugging them?

[ppppenguin]

MWB was in full active mode for its free eval period. Otherwise I like to keep it handy for occasional scans. I've never installed Bitdefender or anything else on this PC.

I don't think I've got a USB device problem but I'll keep an eye on it. I don't eject USB devices but I wouldn't unplug one if I knew it was actively in use. I do plug my backup HDDs in and out of a SATA slot. I feel I ought to eject or unmount before unplugging but can't see an obvious way to do it.

[peter scott]

Probably not relevant but I have two IBM/Lenovo lap tops and both suffered from crashes but fortunately they do give you some clues with beeps. In both cases the problem was bad solder joints on the SMD sockets that hold the RAM boards.

Peter

[Nick]

. I feel I ought to eject or unmount before unplugging but can't see an obvious way to do it.

You really should Eject before unplugging, as this ensure any write caches are flushed.

Right-click on the drive letter in Explorer - Eject is one of the menu options.

HOWEVER ....

In Windows 7, the write cache is disabled by default for most MSDs (USB drives) so you don't have to use Eject...

To see/change this behavior, go to Device Manager (Windows+X, then click "Device Manager") - find the drive you just plugged in (under "Disk drives"), right-clock on the entry and select "Properties".

On the properties page, select the "Policies" tab - "Quick removal" should be selected by default - note that for fixed drives (normally SATA), write caching is ENABLED by default, so I would check your removable SATA drive when it's plugged in to see what Device Manager reports the caching status as.

If the write cache is ON, I would use the "Safely remove device" icon on the task bar, or use "Eject" as previously discussed.

[ppppenguin]

I'm pretty sure the write cache is off for both USB drives and the removeable HDD but I'll check again.

I'm aware of eject for USB devices but don't recall seeing it as an option for a SATA HDD.

[ppppenguin]

Spoke too soon. Crashed within seconds of cold start this morning. The only error on the log before the crash was:

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

[ppppenguin]

Then it crashed again just as I'd made that last post. These is the log betweent he crashes, oldest first.

Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

The content source cannot be accessed.

Context: Application, SystemIndex Catalog

Details:
The URL was already processed during this update. If you received this message while processing alerts, then the alerts are redundant, or else Modify should be used instead of Add. (HRESULT : 0x80040d0d) (0x80040d0d)

Activation context generation failed for "c:\program files\amd\cim\bin64\SetACL64.exe". Dependent Assembly Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found. Please use sxstrace.exe for detailed diagnosis.

Activation context generation failed for "c:\program files\amd\cim\bin64\SetACL64.exe". Dependent Assembly Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found. Please use sxstrace.exe for detailed diagnosis.

The previous system shutdown at 06:48:44 on ‎15/‎03/‎2017 was unexpected.