Applications stop responding, never recovers

TheJTrain

Senior member
Dec 3, 2001
665
6
81
Really odd and I'm having trouble pinpointing anything in particular, could really use some help diagnosing what the issue is from the very knowledgeable folks here. It's a DIY-built system that I've been fairly meticulous about keeping clean.

Win7 x64, up-to-date on Windows Updates
Gigabyte GA-Z77X-UD3H mobo
Core i5-3570K @ stock speed/voltage
8GB DDR3 RAM @ stock speed/voltage
eVGA GTX 670 @ stock speed/voltage
240GB SSD is C: with Windows on it
DVD-RW is D :
640GB HDD (Western Digital if that matters) is E:

No problems exhibited until this weekend. It will start into Windows and be ok for several minutes. But at some point, all applications, one-by-one, go into "Not Responding" mode, even the generic Explorer task, which means not even the Start button is responsive. The mouse cursor never freezes (it always moves when I move it) but clicking in applications that have stopped responding doesn't do any good (obviously). The Task Manager never shows any spiked CPU usage (idle process hovers between 98-99) nor spiked memory usage, but if I don't already have Task Manager open when whatever happens happens, CTRL-ALT-DEL is unresponsive as well and I'm unable to get Task Manager open. Any applications that were open when The Event happens go to "not responding", and trying to open any new applications is ineffectual (though the mouse cursor still moves and to a certain extent I can still task-switch through the taskbar). The only thing I've been able to do is hard-reset with the power switch. Rinse, repeat.

I noticed there was an Ad-Aware process (GFI Antimalware something) that was taking up 158MB of RAM (the most of any process, followed by another Ad-Aware process and an Avast AV process using 20-30MB each), but I'm not sure if that's something new or if it had always taken up that much and I never noticed because I wasn't seeing any symptoms. On one startup I immediately exited Ad-Aware to see if that was the cause, verified that all Ad-Aware processes were gone, but the same symptoms happened in about the same time period. Tried to update Ad-Aware (to v11.x from v10.x) but the installer couldn't finish what it was doing before The Event happened and the installer froze.

Tried to run a full Avast scan immediately after another fresh boot, the scan started, I saw filenames zipping by, the progress circle was at 0% but "moving"; walked away for 30 minutes, came back and it was stuck on a single filename and still at 0% and "not responding".

I can Explore into C: or E: to my heart's content, navigating folders and opening files on either, for a period of about 5-7 minutes, at which point, "not responding".

I just got done running 4 passes of MemTest v4.20 (it's been a while since I burned it/needed it, so maybe that's an old version), 0 errors.

Next step (barring revelations/suggestions from you all) will be to disconnect the internal HDD and boot back up without it, see if Problem Still Exists, and go from there. But maybe first I'll try to see if it'll make it through a HijackThis run before The Event?

Appreciate in advance any suggestions!
JT
 
Last edited:

Ketchup

Elite Member
Sep 1, 2002
14,545
236
106
Sounds like it could be a virus. A few options would be:

- see if you can run an AV scan from safe mode
- run msconfig and temporarily dusable everything in the list, then see if you can run Superantispyware from normal mode
- put the drive in another computer and run a good cleaning program from there
- kaspersky makes a roitkit remover that you can burn to a cd, is bootable, and it will scan the pc before windows loads.
 

TheJTrain

Senior member
Dec 3, 2001
665
6
81
Update:
- booted into Safe mode, Avast didn't let me run a scan ("no more endpoints" message)
- had some weirdness trying to to boot back up after that, BIOS wouldn't recognize the bootability of my C: SSD ("please select correct boot drive or insert bootable media" message) so I figured it died and what I was seeing in Windows prior was its death throes. I did notice that while in BIOS, under the boot priority options it only gave me the option to pick the HDD or the DVD; though in another area of BIOS (ATA Port Information) it correctly identified all three, the SSD, the HDD, and the DVD. Gave it another try after a full shutdown/cold boot and it booted back into Windows where C: seemed ok, but it's still having the same symptoms as described above.
- ran msconfig, disabled everything under processes and startup (some of them remained checked even after "Apply" and a restart); attempted Avast Full Scan again, once again froze after about 6-8 minutes; subsequent boots (with everything disabled under msconfig) still exhibited the same symptoms
- installed and ran SuperAntiSpyware while booted as above; its first find was the Ask Toolbar (which I don't recall ever installing, even during Java or Flash updates), clicked to remove it and proceeded to the big scan: 253 memory items scanned, 64426 registry objects scanned (both complete), and it's been running for 20 minutes but seems to be hung on 10212 files scanned (it's been showing the same filename and count for at least 10 minutes) even though the clock is still running, and the scrollbar lets me scroll and the view moves (so, not exhibiting the usual "not responding" symptoms); CTRL-ALT-DEL was responsive and I clicked to open Task Manager, but it never actually opened, and now CTRL-ALT-DEL is ineffectual. Results of the scan so far: 318 tracking cookies, but if it's not responding I don't think I can do anything about those. Perhaps I'll reboot, re-run the scan and as soon as it comes up with those 318 I'll stop the scan and clean, then rinse repeat.

I did try sfc /scannow in a command window on a fresh boot but got a fairly generic error message saying it couldn't do that.
 

VirtualLarry

No Lifer
Aug 25, 2001
56,229
9,990
126
Virus? Maybe... but it sounds like the SSD might be going out too.

If you have a spare, known-good HDD or SSD, trying removing your current drives, and do a fresh install onto the spare drive. Might also burn a Linux DVD, and try booting off of that, and see if the same thing happens.
 

Ketchup

Elite Member
Sep 1, 2002
14,545
236
106
Your latest update does sound like a drive possibly going out. A SMART test could help confirm that.

Depending on the brand, the manufacturer may have some good testing software on thier site.
 

TheJTrain

Senior member
Dec 3, 2001
665
6
81
I did go looking last night for Corsair's SSD tools but didn't get a chance to try it out until this morning:
SMART status was green lights across the board, and I left it open while trying to run one scan at a time (Spybot S&D, MalwareBytes AM, SuperAntiSpyware), each scan went "not responding" after about the same time period, with the SMART tester going "not responding" along with it while still showing green lights/"OK" status; hard reset between each partial scan.

Re-enabling all of the available processes in msconfig (by selecting the "normal boot" option) didn't seem to return everything to normal operation; networking isn't enabled, the look/feel "theme" is not back to what it was; I'm not hugely concerned given that I'm anticipating a fresh install at some point anyway, but didn't want to leave it out, given that one of the scans above (I think it was Spybot S&D) wouldn't start the scan until definitions were updated, which it can't do without networking. Maybe I'll see if I can do something about that today.

Next steps (again, barring any new suggestions in the interim):
- save off any critical data (it was mostly an OS/Apps drive, so there's little that's not re-installable) in the few minutes I have between bootup and "not responding"
- remove the E: HDD and reboot, to eliminate it as the cause of The Event
- update SSD's firmware with Corsair's SSD Toolbox; possible risk here of hosing the drive if The Event (whatever it really is) happens in the middle of the firmware update. Hopefully it'll be recoverable with a reformat if that happens. Now that I'm typing this out I'm wondering if an unrecoverable situation resulting from a failed firmware update is covered by the warranty. I'll have to check, since this drive is still under Corsair's 3-year warranty. If it's not covered I'll likely forego trying the firmware update as not worth the risk.
- remove existing SSD and HDD and do a fresh Win7 install in the same machine on another HDD I have on-hand, see how that goes. If all goes well, I'll reconnect the E: HDD and see if it stays stable. If it does, I'll fully AV scan the E: HDD to make sure it's clean

Question: at that point, would I be able to reconnect the SSD as a second drive (after removing the clean E: HDD), and still boot from the "replacement" HDD and see if things stay stable, and perhaps do full AV scans of the SSD from AV apps installed on the HDD? I've been DIYing it since 2001, but have stayed pretty vanilla configuration-wise, and been pretty fortunate in terms of stability and don't have much experience swapping HDDs that have various installs on them (meaning, among other things, I've never had Windows on two drives in the same machine before).

Thanks again for the replies, my appreciation continues!

JT
 

Ketchup

Elite Member
Sep 1, 2002
14,545
236
106
I agree with your idea. Get the good data off (using another computer). Format and fresh install. That should be the easiest way to tell if it is a drive issue.
 

TheJTrain

Senior member
Dec 3, 2001
665
6
81
Minor update:
Pulled the E: HDD and rebooted, verified that The Event still occurs with only the SSD connected. Unfortunately even though there are fewer GB to scan without the HDD, Malwarebytes and SuperantiSpyware still couldn't complete a full scan of the SSD before The Event locked everything up, but the files they were able to scan resulted in 0 infections found.

Saved off the data I wanted from the SSD, but left most everything in place that was on the HDD, except for moving some stuff that was in Users\JT\(My Documents/My Music/etc.) out of the Users\JT\ area, just in case my reinstall doesn't let me access those folders again.

Removed both SSD and HDD, connected another HDD, fresh full install of Win7 x64, deleting existing partitions along the way. Just got done loading mobo drivers and video drivers, now installing Ad-Aware and Avast (with the intention of verifying that The Event isn't happening even after running the same two AV apps). After that I'll install the others that need installation (SuperAntiSpyware, Spybot S&D, MBAM). Also found rootkit killers from Kaspersky (though couldn't find the bootable version, only the windows-installed version) and bitDefender, so I'll run all of those above against the original HDD when I connect it.

Assuming a clean bill of health, I'll disconnect it, connect up the SSD and do the same, and will report back.
 

TheJTrain

Senior member
Dec 3, 2001
665
6
81
Update:
- Avast gave the new HDD a clean bill of health
- Ad-Aware kept hitting installation errors, so based on what I've read, I suppose I'm done with it, in favor of the other suggested alternatives going forward.
- SuperAntiSpyware, MBAM, and Spybot also gave the new HDD a pass
- Connected the old E: HDD, scanned it with all four, came back clean
- Disconnected the old HDD, connected the SSD as the "second" drive, first two scans with Avast got about 30% in and halted... because the drive disappeared! No longer showing up in Windows Explorer; hard reboot made it appear again. More indication that the issue is with the SSD - feeling pretty good about figuring out what was happening and that I'll get a replacement SSD
- In the meantime, got a reply from Corsair CS, telling me to update the firmware and perform a secure erase, and if I'm still seeing the problem or the firmware update failed, they'll replace it.
- Updated the firmware, no issue 'cause it happened so fast
- Avast scan made it all the way through without halting like before, but found 2 "infected" files, both in Temporary Internet Files for a Gamefly update; kinda doubt they were what caused The Event, given that they were so old and a firmware update stopped the drive from halting on its own.

At this point I suppose I'll try to put the drives back where they were (SSD as C: and the original HDD as E:) and see if I can restart the services I disabled with msconfig in order to bring it back up to working order without doing another new fresh install on the SSD. If it proves to be too much trouble I'll likely buy a new, larger SSD to do my new fresh install and see what I can get for the Corsair SSD used.

Thanks again!
JT
 

TheJTrain

Senior member
Dec 3, 2001
665
6
81
Thanks! So apparently the issue was caused by the SSD shutting itself off completely after that 6-8 minute time period, and because it was the C: Windows drive, Windows didn't know what to do, so it froze. When it wasn't the C: drive, it just disappeared from Explorer and Windows kept trucking merrily along.

Interesting that an issue that was "fixed" by a firmware update happened so suddenly last Friday. I'm not sure how confident I am that this self-shutdown issue won't rear its ugly head again, and with only 6 months left on its warranty... Color me a little skeptical, TBH. Tempted to RMA it anyway, and follow the "sell it and buy a bigger one" advice.
 

Ketchup

Elite Member
Sep 1, 2002
14,545
236
106
I understand that. Was your issue specifically mentioned in a fix log for the firmware update? That would make me feel better about it being a permanent solution.
 

TheJTrain

Senior member
Dec 3, 2001
665
6
81
Unfortunately no - looks like the latest firmware (v5.24) was released in Dec 2013 and hasn't been updated since, and at the bottom of the announcement post it says there's no change log. :-(
 

VirtualLarry

No Lifer
Aug 25, 2001
56,229
9,990
126
If that's a SandForce 2nd-gen controller-based drive, I would RMA it (after doing a Secure Erase to clear your data), and then sell it, and buy a non-SandForce-based drive. Like a BX100 or something.
 

TheJTrain

Senior member
Dec 3, 2001
665
6
81
If that's a SandForce 2nd-gen controller-based drive, I would RMA it (after doing a Secure Erase to clear your data), and then sell it, and buy a non-SandForce-based drive. Like a BX100 or something.
It is, SF-2200. I pulled the trigger on a Samsung 850 EVO 500GB yesterday, and Amazon already delivered it this morning (& I'm stuck at work!).

get yourself a an external scan tool, one you can boot
ftp://devbuilds.kaspersky.com/rescuedisk/updatable/
Cool thanks!